Mary Ann Davidson Blog

It's not often that I read a headline that almost causes me to spill my morning coffee and then weep, but I confess I had that reaction to an article making the papers this week. The article said 1 out of 4 adults read no books in the past year. I find that as astonishing as if I had read that 1 out of 4 adults hates dogs. (Who doesn't like dogs?)

I really wonder what those 25% of adults do with their free time, because almost every minute of mine (not spent surfing) is spent reading. As long as I can remember, I have had a book addiction severe enough that I've thought about joining a 12-step program for Bookaholics: People Who Read Too Much. I started early and have never really slowed down. (I learned to print my name at age 4 only so I could get my very own library card.)

As an adult, I have books stacked two and three deep in all my bookshelves. I have them on top of the radiators (which I turn off - I'd rather shiver in winter than ruin a book). They are stacked under tables (with long tablecloths to hide the stacks) and on and under my nightstand. Under my coffee table and under my sofa, too. My mother expects to read that my apartment in San Francisco has sunk into San Francisco Bay from the weight of all those books. It's not quite as bad in Idaho, because a) I have more room! And b) I don't buy books so much anymore, but I devour whatever the Ketchum Community Library has - and they are really well-stocked.

It's not that I think I am better or smarter than those 1 out of 4 adults. (My dog differs but he is allowed his prejudices, which I happen to know can be bought for a couple of Greenies.) But reading has opened my eyes to worlds, histories, thoughts and dreams I never would have experienced otherwise. I can't imagine a life without books. I don't even go out of the house without reading material, because waiting in line (or at an airport or at a cafe for a friend) is an opportunity to read just a few more pages.

I am also a "carrier." When I find a book I really like, I buy copies for friends and nudge them into reading them. (Only I keep forgetting what I have already bought my nephew, which is how he ended up with two copies of Goodbye to All That by Robert Graves and 2 copies of Stories of Hawai'i by Jack London. Sorry, Piers!) My buddy Elad and I have traded books and writers back and forth for a couple of years now and have been known to read the same book at about the same time to have someone to enthuse with (or alternatively, pick a book apart).

I simply don't understand people who don't read books.

Love of reading is not a function of educational level, either. I had a friend once who, despite two degrees (2 - count 'em - 2) from Stanford, freely admitted she had read no books since graduation. (Yeesh.)  She marveled at the number of books in my apartment and wanted to know if I actually read them. It was all I could do not to say, "No, <name omitted>, they are wall insulation. Of course I read them!" No matter how impressive your educational credentials, a university education is just the beginning of knowledge. You learn, or should learn, to teach yourself. Books are the key. Reading also helps give you a broader perspective on the world than you might otherwise have. Let's face it; technology (for example) is not the be-all and end-all we sometimes think it is. (A shock, I know, to some in Silicon Valley who think history began with the transistor.)

I guess there is a security aspect to all this, somewhere, somehow. For a start, I do read a lot of military history and that helps me look at IT security from the posture of a warrior. I haven't personally worn a "war suit" for years or done field exercises/war games in years, but I think that reading military history helps give me a different slant on computer security. It also helps me connect with customers (like the Defense Department) because I can speak their language. I think about computer networks like battlefields and I look at battles of the past to think about IT defense.

Also, so much of history is military history. It grieves me to no end that all kids seem to learn about WWII anymore is synopsized in the following: "We interned the Japanese: That Was Bad. Women (like Rosie the Riveter) entered the workforce: That Was Good."Nothing about Midway, Guadalcanal, Iwo Jima, Okinawa, Stalingrad, Kursk. Why we fought, who fought, how the world changed and how the world was - for better or worse - shaped by war. I don't think we can hope to understand the present or shape the future if we do not understand the past. We also need to try to learn from the lessons of the past:  it history does not repeat itself, as the dictum goes, it sure does rhyme.

(Another "security" aspect to my reading: I would not have known, without reading Miracle at Midway by Gordon Prange, that the victory at Midway was made possible in no small part because the US had broken Japan's JN25 naval cipher. Code breaking was critical in other aspects of the war, too, as anyone who has read about Enigma knows. The lesson here is that you should never assume your codes are unbreakable unless you are using one-time pad ciphers and not reusing the pads.)

So, I offer below (because it is, technically still summer, and because kids aren't the only ones who need reading lists), a smattering of books in no particular order I'd recommend for anybody's reading list.

Oracle 10g Performance Tuning Tips and Techniques by Rich Niemic

Well, it's not fiction, and it's not history, and normally, I would not put a tech book on my reading list. All that said, it's actually easy to recommend this book because I am a) not a performance tuning person and b) not someone who was ever even remotely interested in performance tuning. I am, however, a charter member of the Rich Niemic Fan Club (Rich is the former president of the Oracle User Group and a big Oracle security friend). Rich asked me to provide a quote for his book and, in reading the sections he sent me (I wanted to make sure the book was great before I gushed over it publicly), I became really interested in performance tuning. Who knew? This book is very readable, it's really interesting, and I can guarantee you that your Grandma from Des Moines will be a performance tuning fool after reading this book. Life's too short to buy some dull Oracle-related tome that you will never read and that won't help you. (Especially when you can buy this one that's fun to read and will most definitely help make your database crank!)

Sea of Thunder by Evan Thomas
Last Stand of the Tin Can Sailors by James Hornfischer.

Many of us spend oodles of money to go to the movies to see battles of derring do between good guys and bad guys, or defenders of the universe vs. evil aliens. Save the $10 ($15 with popcorn) and buy one or both of these books to read about real heroism against the odds. Both books describe the Battle off Samar in the Philippines in 1944, a story that should be told and retold as long as acts of heroism are recounted through generations. This is the story of the men of Taffy3 (destroyers, general purpose or "Jeep" carriers and destroyer escorts) against the Japanese armada, including the Yamato, the largest battleship ever built. Think about a bunch of determined gnats going up against an angry tiger - and winning!

I confess to having more than a passing interest in this story: Mick Carney, ADM Bull Halsey's chief of staff (and family friend) is liberally quoted in Sea of Thunder and another family friend is quoted in Last Stand of the Tin Can Sailors. I have read both books, more than once, and as I close the back cover, I always say, "Where do we get such men?" There is also (gotta work that security angle in here) a retelling of the incredible but true story of an well-known encryption blunder: the infamous message from ADM Chester Nimitz to ADM Bull Halsey: "Where is task force 34 the world wonders?"  (The last three words were message padding, a slight rip-off of the Charge of the Light Brigade by Tennyson and not intended to be part of the message; Halsey read it, thought Nimitz was ridiculing him, and had a fit. He then turned his carriers around from pursuing the Japanese and headed back to where Taffy3 was in the thick of battle. Some LTJG was cashiered for that mistake, one suspects.)

Power, Faith and Fantasy: A History of America in the Middle East: 1776 to the Present by Michael Oren

The Middle East is much in the news these days, and it is interesting to note how long America has been involved in the Middle East: since the origins of the country. There are a lot of amazing factoids in here, such as: one of the reasons the United States has a strong constitution (supplanting the Articles of Confederation) is because of the Barbary pirates (and that at one point, the United States was giving up 25% of our GDP in tribute  - better known as "blackmail" - to the Barbary pirates). The states realized that individually, they could not raise a strong navy, but a strong centralized government could, and voila - we have a strong central government and the beginning of US naval power. (Ever wonder about that line in the Marine Corps Hymn: "...to the shores of Tripoli?" That came from the war against the Barbary pirates.)  A really interesting read and a view of history you won't readily find anywhere else.

A Peace to End All Peace: The Fall of the Ottoman Empire and the Creation of the Modern Middle East by David Fromkin

If you want to know a lot of why the Middle East is the way it is, you need to understand how the borders got drawn and by whom. For that, you need to at least go back as far as the first World War and the dissolution of the Ottoman Empire. This book tells you almost more than you want to know about the subject, but it is thorough and will explain a lot that you can't easily understand without reading history. I confess to having had an argument over the Middle East once (well, more than once - I'm obviously opinionated on a number of topics) and I threw out a lot of points related to "how the borders got drawn and who did all that, anyway?" The gentleman I was arguing with asked - in amazement - how I came by all that information, to which I responded (slightly censored version), "I read history." I should have said that I read this book. It's a worthy (and non-polemical) read, well researched and presented.

A Better War by Lewis Sorley.

For those of us of a certain age (if you lived through the late 1960s), reading about or discussing Viet Nam is a painful exercise. The author is a West Point graduate and a former intelligence professional and, well, you will have to read the book to have your myths shattered. It should be required reading for anybody before even thinking about discussing Viet Nam. The book is balanced, thoughtful, well researched, but an eye opener.

Pied Piper, Trustee from the Toolroom, Requiem for A Wren, In the Wet, aw heck, how about anything by Nevil Shute

I had the unfortunate experience recently of reading a really dreary modern piece of dreck...er...literature for my book group about loss (related to September 11), and I could not but contrast the heavy handed plot, the wandering, aimless prose and the thoroughly unsympathetic characters in that book with Requiem for a Wren by Nevil Shute (also published under the title The Breaking Wave), that I had just read. What comes through in his work (besides his keen interest in engineering, aviation, archeology and other topics) is the fundamental decency of his characters, many of whom are confronted with hard choices and with unspeakable losses, but who soldier on, anyway. I am pleased to say that the Ketchum Community Library has 13 works by Shute and I intend to read them all. (Several of his books have been made into movies, including No Highway (the movie version is No Highway in the Sky), Pied Piper and On The Beach.)

From a security aspect, No Highway talks about an engineer who is convinced that a plane is about to have a catastrophic failure. It also concerns the lengths he goes to to ground the plane before there is an accident. It is a lesson in integrity, risk, and the moral issues around how far one can go or should go to ensure safety.

The Poems of A.E. Housman

I have a Housman fetish. I once spent two years looking for his books in print - anywhere. It took me that long to find a (used) copy of his complete poems. Later that same year, I went to Blackwell's in Oxford, England (the Mecca for bibliophiles, or one of them) and they had three shelves of works by and about Housman. Sigh. I think the folks at Blackwell's are still washing the saliva off the floor from the amount of drooling I did there. There is no finer poet or one more capable of eliciting wistfulness from the reader. "To an athlete dying young" is a particular favorite (and should be familiar to you if you saw Out of Africa).

Jasper Fforde's Thursday Next books (The Eyre Affair, Lost in a Good Book, The Well of Lost Plots, Something Rotten, First Among Sequels)

Fforde is just as witty and silly (good silly) in person as his books are; I heard him speak recently about his latest book, First Among Sequels. His books are really hard to explain; they simply defy genre. I liked the review that said they are a combination of Buffy the Vampire Slayer, Harry Potter, and Monty Python. The books contain absolutely outrageous puns and amazing literary references (Jane Eyre is a character; so are Hamlet, Miss Havisham and Mrs.Tiggy-Winkle). Life is serious enough; sometimes you need to read something very smart but amazingly silly.

The Code Book by Simon Singh

Closing out with a security book of sorts. I confess to not being a technical security kahuna in a lot of ways, particularly in the area of cryptography (which is, let's face it, one of the sexier parts of security). The Code Book really explains cryptography, and the history of it, in a readable, interesting way. You can sit through a lot of truly dull lectures and presentations, or you can grab this book and happily read your way to being a whole lot smarter about crypto (and a lot more appreciative of code breakers and makers throughout history).

A few closing thoughts. Lest anyone think I am a stuffed shirt who only reads Meaningful Tomes, I freely confess that I have read more than my share of murder mysteries, suspense books, adventure tales, science fiction, children's books and things that don't always qualify as literature but are great reads. Some days, after a hard week at work, you want "mind candy" and not War and Peace (with apologies to Count Leo Tolstoy).  It is just not that hard to be one of the 75% of adults who read at least one book a year, so go for it.

Almost all of these books can be ordered from Amazon, Borders, Barnes and Noble and so on and so forth. Or, you can patronize your local independent bookseller (the ones who remember what you like). Or you can support your local library and borrow the book. (Libraries like donations, too.) Go get lost in a good book.

For more information:

1 in 4 adults read no books last year:

http://www.msnbc.msn.com/id/20381678/

Rich Niemic's book:

http://www.amazon.com/Oracle-Database-Performance-Tuning-Techniques/dp/0072263059

About Nevil Shute:

http://www.nevilshute.org/biblio.php

Jasper Fforde's web site:

http://www.jasperfforde.com/

About the Battle off Samar:

http://www.bosamar.com/

The Code Book:

http://www.simonsingh.net/The_Code_Book.html

Selected poems of A.E. Housman online at:

http://www.chiark.greenend.org.uk/~martinh/poems/housman.html#ASLxix

A review of A Better War:

http://findarticles.com/p/articles/mi_m0IBR/is_3_30/ai_67502116

More on "the world wonders" padding screwup:

http://en.wikipedia.org/wiki/The_world_wonders

A really great biography of Halsey by the late E.B. Potter (former professor emeritus at the US Naval Academy):

http://www.amazon.com/Bull-Halsey-Elmer-Belmont-Potter/dp/1591146917

Who also wrote a great book on Nimitz:

http://www.amazon.com/Nimitz-E-B-Potter/dp/0870214926

A few errata correction on my last blog entry before I go any further: 1) my mother insists that I was closer to 3, not 4 years of age when I threw a fit and demanded (and got) my own library card* and 2) the name of the devastating fire in Ketchum, Idaho last month was the Castle Rock Fire, not Castle Creek Fire. I can only plead brain fuzziness based on the amount of smoke I inhaled over the two weeks it was burning. 

Now that the fire is over, I have a newfound appreciation for the beautiful, clean, cool and pristine air in Idaho. For the two weeks the 46,000-acre Castle Rock Fire was burning, dense smoke and haze clouded the sky to the point that I could see neither the ski runs at Sun Valley (just a hoot and holler from my house) or the Boulder Mountains to the north of me. You will never know how beautiful clean air can be until you've lived through several weeks of smoke, ash, and debris falling around you. It's like living through the Apocalypse, particularly the experience of looking across the valley and seeing fire burn down the ridge so fast that it was as if it were being fanned by the Devil himself.

The fire has been hard on people, particularly businesses. It caused a cancellation of a lot of activities over Labor Day that were not only a lot of fun but that the local merchants depended on to bring in revenue. We are now officially in what is known as "slack season": hardly anybody comes here in fall, though heaven knows why. Fishing, hiking, camping and hunting are all great Idaho fall activities. I once went on a beautiful 6-mile hike to a pristine alpine lake and I did not see a single other soul during the hike, other than my hiking buddy and my dog. (Try that in California.) So come on up to Sun Valley, y'all. If there is anything better than terrific natural beauty, it's terrific natural beauty with no crowds.

My other change in perspective (besides a newfound appreciation for clean air) is the way I feel about firefighters. You hear all the time - and most of us believe it - that firefighters are heroes. I never doubted that. But it's one thing to think that in the abstract and another to have experienced it firsthand. I got to see a lot of them in Sun Valley in August, since we had 1600 firefighters in a town of 3000 people. My house was never in any real danger, for which I am grateful. Furthermore, there was no loss of life and no structural damage to anybody's houses or businesses. The critters even made out OK, too, though there are a lot of hungry bears wandering around looking for chow.  Pretty much every place in town now has a "thanks, firefighters" sign or banner displayed prominently. We really mean it: thank you, wildland firefighters, you saved our town.

Now that the fire is 100% contained, a lot of locals are saying that in the long run it is going to be healthy for the forests that we had a burn; in fact, we were overdue for one. The forest will recover; the wildlife will thrive (so long as cheat grass doesn't crowd out the sage that is a key habitat for many species). It's only been a couple of months since the Trail Creek Fire burned one of my favorite hikes in Sun Valley, but you can already see a sheen of green on the mountains and some new seedlings sprouting up through the blackened detritus. Forests recover, and a periodic burn gets rid of the underbrush that can otherwise build up and contribute to "crown fires" where the fire spreads not along the forest floor, but leaps from treetop to treetop. The difference between a disaster and a blessing in Ketchum was the skill of the firefighters, the grace of God and also the passage and perspective of time.

When you think about it, it's amazing how much of what you see really is based on your perspective. Perspective can include where you are as you look at The Big Picture, where you are in the picture and who else is in the picture.

I was reminded of this recently in a discussion with a state government struggling with open records issues. States keep a lot of data on their citizens to support, among other things, taxation (personal and property) and licensing (driver's, hunting, fishing, construction, "concealed carry"  permits and more). The question they were asking was how much of this data should be on-line and searchable?

I did not offer to write, critique or edit their state's open records laws, but I did point out to one of their legislators that a lot of concerns over privacy might depend very much on who is accessing the data and why they might want to access the data.

Most people are OK with some data being collected relevant to a transaction between parties. For example, to get a concealed carry permit in the state of Idaho, I needed to give the state some information to so they could do a background check on me. I also expect the state of Idaho to keep records about the fact they gave me a concealed carry permit (so that a law enforcement official can independently verify that I have a valid license and not a fake one, for example).

Many people who provide information for a service or transaction become unhappy if that data is accessed or sold or otherwise used for some purpose they didn't agree to. If you are dealing with a government entity like a state, you expect that when you give information to the state (that they need for things like raising taxes and providing services to citizens) they are going to use it for those "stated" purposes (no pun intended) and not for three thousand other things. I would not expect that the Idaho gun permit database would be searchable, say, by a gun ownership organization (or, conversely, by an anti-gun ownership organization). "Taint none of their goldurn business."

When data suppliers' expectations on who accesses what and for what purpose do not match with data collectors' uses, it's a problem. For example, if you've ordered books from Amazon.com, the next time you log on, you might get a friendly message that says something like, "Hi, <Your Name>! Based on your last few book purchases, we think you might be interested in the following books..." (In my case, the book list will be on military history or the Hawaiian language.) Many people might think: "Wow! How cool that they know me and can recommend books I might like!" 

Now imagine, if you will, the exact same message coming from the FBI**: "Hi, <Your Name>, based on your last five book purchases, we think you might be interested in ..." Many people would be outraged to think that the FBI (or another law enforcement entity) was looking at their book purchases. But, and here is the kicker: it is exactly the same data! Whether the above message is a "service" or an "invasion of privacy" depends on who had access to "my" data, who is doing the data analysis and why they are looking at the data. It's all about perspective.

In the private sector, these discussions take place in the realm of what a company collects, what they use the data for and who they can share the data with. Most companies have privacy policies that forbid collecting data for one stated purpose and using it or sharing it for another purpose that the "collectee" did not agree to, for example.

However, if data is public, or a public record, especially if it is Internet accessible and searchable, potentially anybody can access and analyze the data, for any purpose. My advice to the state was that they ought to hire someone to review the data they already have and figure out all the ways that data access could be misused by the evil-minded, like spear-phishers or stalkers. That is the place to start a legitimate public discussion about "open records;" specifically, how much the citizens of the state want to trade off convenience for privacy, and how much citizen data should be searchable and accessible by someone other than the state agency that collected it. It's all about perspective. 

People's perspectives on data collection can also be colored by the accuracy of the data that is kept. If someone made a mistake in doing a background check on me, that led to my being denied a carry permit, I should be able to get that "mistake" corrected. Otherwise, someone down the pike may find that I was once "denied" a carry permit and deny me something else. It's the second law of thermodynamics applied to data: entropy always increases. If data is inaccurate, inaccurate decisions will flow from use of that data.

Along those lines, there is another issue I've opined about a couple of times, and I'd be done with it except the topic keeps rearing its head in different forums, and that is the idea of "automated vulnerability testing your way to security." As much as I think that the use of automated tools can help deliver more security-worthy software and have said so, there are too many discussions of late dominated by the perspective that vendors are all evil, lazy and greedy slugs (ELGSs) that happily ship products with tons of security holes in them. The perspective of people who subscribe to the ELGS theory is that vendors must be forced to submit their code to multiple, random, unvetted tools to "validate" their security.

A differing perspective (mine) is that these tools are useful only to the extent they are used and work in development: they can't "prove" security, and vendors should license and use the tools that work well for them in development. The idea, after all, is to make products better, not have public "rat out" sessions after products have shipped. And I feel really strongly that anybody wanting to run a third party tool against a product should have to prove the tool works properly and accurately. It's only fair.

In fact, they ought to have to prove that the tool is accurate before it's used, otherwise the results may "taint" a vendor (just like a mistake in my background check could color people's perceptions of me forever if it is not corrected).

The idea of "burden of proof" is important for a couple of reasons. One of them is that we are still in the nascent stages of tool usage (if it were easy, everyone would already do it) and some of the tools don't work so well. The last thing industry needs when we are trying to promote and encourage tool usage in development is every customer, or every country, deciding that IT products need to be submitted to 348 different "tool tests."  Aside from annoyance and inefficiency, accepting tools' "vulnerability alarms" without question goes against the grain of how a lot of other things are supposed to and generally do work. For example:

• 
  
  People who are put on trial are assumed to be innocent until proven guilty. Hardly anybody gets thrown in jail for 25 years to life without someone (a prosecutor) validating the evidence, presenting it in court, and defending it (from defense challenges). The burden of proof in our court system is on the prosecution, and the standard of conviction is "beyond a reasonable doubt." (A 90% "false alarm rate" of evidence presented in a prosecution would not be "reasonable doubt.")
  
  
• 
  
  Journalists are expected to check facts before reporting that, for example, a celebrity was caught in a love nest with another celebrity. Furthermore, if journalists get the news wrong, they generally print a retraction or correction. (Of course, at that point, reputational damage may not be "retractable," which is one reason why good journalists are rigorous about fact checking.)
  
  
• 
  
  Gossip is called "gossip" and not "impartial fact exchange" because so much of it is not true and potentially hurtful or damaging. This is why your mom tells you not to do it. Mom is right, as she almost always is.

The ugly issue in the promise of automated vulnerability tools is that there is no standard for these tools: what they find, how well they find it. Which means anybody can create a tool, point it at a product, claim to find problems, and all the work is on the product vendor to prove their product does not have a problem instead of on a tools vendor to prove the tool is accurate. And let me tell you, having to go through hundreds or thousands of "potential vulnerability fire alarms"  to validate every one makes security worse, not better, because it takes a scarce resource (a security-aware developer) and puts him/her to work chasing phantoms instead of improving products.

Some tools vendors push the "evil vendor" perspective because to the extent they can convince IT vendors' customers that their products need to be scanned, they create fear, uncertainty, and doubt (FUD) and thus increase the demand for their scanning product. Can't blame them for that: it's capitalism at work. That said, I take the perspective that these tools offer promise, but they need to be validated to prove that they are accurate before anyone can be expected to use them. Only if they are accurate are they useful. If they are inaccurate, they are useless and harmful.  (Putting it differently, if IT vendors need to "prove" their products are secure, why shouldn't tools vendors need to "prove" their tools are accurate before anybody would even think of using them? What's sauce for the goose is sauce for the gander.)

Lastly, some of these tools are so "chattery" and "noisy" that it really is like gossip and, like gossip, the damage is done even if there is a retraction. A tool that has a lot of false alarms taints a vendor's brand just like tabloid journalists can print innuendo that damages someone's reputation unjustly. I shouldn't have to prove the coding equivalent of "I did not spend the weekend in a love nest with a celebrity,"  the vulnerability tool maker should have to prove that I did.

(Aside: one of my own amazingly wonderful ethical hacking team members just improved one of our internally-developed tools, a protocol fuzzer lovingly called BitRotter, to do more pernicious and nefarious code breaking in a good cause. He's just rechristened it ByteRotter. Thanks, Jeff.)

Clearly, my perspective isn't unbiased, because I work for an IT vendor. I believe in better security, doing more in secure development, and in industry "raising the bar" through better development practice. Automation (and automated tools) can definitely help.

I also believe in accuracy and fairness as basic principles of any business undertaking, because it is only when the haze and smoke and debris is swept away, that you can see - really see - what is there.

I climbed to the top of the ridge behind my house a few days after the Castle Rock Fire was declared 100% contained. The fall rains had come to help soothe the burns, and the winds that a few days prior had been fanning the fire were now whisking the few remaining puffs of smoke out of the valley. It's about a 600 foot climb through sage and scrub, but when I got to the top of the ridge, I could see the Boulder Mountains in the distance, and the ski runs at Sun Valley, still green and beautiful, and the aspens beginning to change color on the mountains that ring the Wood River Valley.

After two weeks of hellish smoke and ash and debris, I could see rightly - 'ike pono, as the Hawaiians say - for miles and miles and miles. There is no better perspective than that.

*  Mom also noted it was far from the last fit I would throw. What can I say? I learned useful business skills early.

** Disclaimer: I know several people who work for the FBI. They have difficult jobs that the rest of us don't understand and take for granted. I am quite sure they have more important things to do than check up on my latest book-buying binge. Ergo, no slight to them was intended nor should be inferred.

For more information:

Book of the week: I just read another book by James Hornfischer: Ship of Ghosts, about the USS Houston, sunk at the Battle of Sunda Straights in March 1942. Many of the survivors were forced to build the Burma Railway. An amazing story of survival and heroism. Definitely worth a read.

http://www.amazon.com/exec/obidos/ASIN/0553803905/bookstorenow69-20

About the Castle Rock Fire:

http://www.inciweb.org/incident/952/

http://www.sunvalleyonline.com/news/article.asp?ID_Article=3894