As many of you know from previous blogs, I have a language fetish I like to indulge as often as possible. One of my recent acquisitions is Baibala Hemolole (Holy Bible, translated into Hawaiian) which gives me a chance to practice my incipient (OK, rudimentary) Hawaiian language skills by reading something that's familiar to me in English, so I can do a sort of "reverse translation" into Hawaiian. For example, since I know Psalm 137 by heart ("By the rivers of Babylon, we sat down and wept, when we remembered Zion...") it's pretty easy to read it in Hawaiian and pick out the meaning of Hawaiian words whose meanings I don't otherwise know.


(Small aside: lots of people love the King James Version of the Bible for its majestic language, but it is fairly widely acknowledged to be among the worst translations in terms of linguistic accuracy. If you don't know Aramaic, Hebrew and Koinic Greek (and who does besides seminary graduates and classicists?) go with the New International Version if you want to read something that's as close to the original texts as linguistic, cultural and "manuscriptural" differences will allow.) 


Occasionally, I find a translation that actually sounds better in Hawaiian than in English. A Jewish friend asked me how the translators had done with the ten plagues of Egypt (described in Exodus): how accurate were the words in Hawaiian? As far as I could tell (this after an hour or so with Baibala Hemolele and a Hawaiian dictionary), most of the words used by translators were pretty spot on. I went through about 6 or 7 plagues to reach that conclusion. When I got to the plague of darkness, I found that the translators used the word  po'ele'ele.  In Hawaiian, pô is night, 'ele is black, and reduplication adds emphasis, so a good translation of po'ele'ele would be "the deepest darkness of night." And truthfully, that is a far more terrifying plague (if you are Pharaoh) than plain old "darkness." I like that.


There are actually a number of words whose meaning has shifted or been corrupted over time (or through moving into different languages) until what we swear a word means is actually not what it means at all. One of these words is taboo.  The Merriam Webster online dictionary provides the following definition:


1 : forbidden to profane use or contact because of what are held to be dangerous supernatural powers
2 a : banned on grounds of morality or taste <the subject is taboo> b : banned as constituting a risk


So, most people use taboo to mean something that's forbidden, or that is outside societal norms. However, if you look at where the word came from, that's not what it means at all. The origins of the word taboo are Polynesian: tapu in Tahitian, tabu in Tongan or kapu in Hawaiian. What the word really means is "sacred." Now, that's a surprise. Sacred, not forbidden. After you let that sink in, you realize that it's actually quite understandable why people think the word means "forbidden," because in many religions, the things of God (or the gods) are sometimes forbidden to mere mortals. In Hawaiian religion, there were things that only the ali'i (chiefs) or mo'i (kings) could do, eat, or access. Various surfing spots, for example, being sacred (kapu), were reserved for the ali'i and thus forbidden to commoners.


One source I looked at said the kapu system existed to maintain pono (rightness) between the gods, lands, and people. For example, the Hawaiians had a practice of putting various fishing grounds out of rotation to preserve the larger ecosystem. A fishing area was declared kapu: sacred, off limits. By doing this, the Hawaiian avoided the problem of overfishing (and implicitly recognized that the bounty of the ocean is a sacred thing, if I can be indulged here).  Having experienced the mystery and the wonder of surfing when honu (Hawaiian green sea turtle) flipper through the lineup, and Hawaiian monk seals lope through the waves, I can say that the experience is indeed kapu, sacred.


It's therefore with some appreciation that I note that the largest marine sanctuary in the world was created about a year ago, in the northwest Hawaiian Islands. It's also the largest conservation area in the United States. It has, of course, a Hawaiian name: Papâhanaumokuâkea. (Click here if you want to know how to say it properly: The kupuna (ancestors) would approve.


Along similar linguistic lines, the word "sanctuary"comes from the word sanctus in Latin, meaning "holy" or "sacred." Here is (Merriam Webster's) definition:


1 : a consecrated place: as a : the ancient Hebrew temple at Jerusalem or its holy of holies b (1) : the most sacred part of a religious building (as the part of a Christian church in which the altar is placed) (2) : the room in which general worship services are held (3) : a place (as a church or a temple) for worship
2 a (1) : a place of refuge and protection (2) : a refuge for wildlife where predators are controlled and hunting is illegal b : the immunity from law attached to a sanctuary


What the Hawaiians would have declared kapu has become the largest marine sanctuary in the world, with the same idea. Something that is sacred is "off limits" to some, so that its sacredness can be preserved. And Papâhanaumokuâkea is also a place of refuge for the critters that live there, to address both senses of the word sanctuary.


Sanctuaries can crop up where you least expect to find them. For example, we are starting a metrics project within my team. Metrics are one of those tricky areas that can inspire the full range of reactions from near-religious ecstasy (speaking of the sacred) to the gag reflex, depending on who is talking about the issue and which metrics are actually in use. I view metrics very simply: as a tool in order to be able to manage better. I had an engineering professor who said, "All the easy problems were solved in the 19th century." I am not so sure about that: I think there are easier and harder problems left to work out. However, trying to determine which are the biggest problems  (e.g., through metrics) certainly helps you work on the problems that matter. Also, and as I talked about in an earlier blog entry, nobody ever has unlimited time, people, computing cycles, and so on, so trying to whack away at the worst problems first (which metrics can help identify) is just good management.


A secondary goal of metrics is holding people accountable for things whose outcome they can control. That last bit is an important qualification because there are, alas, people who jump on metrics with It's The Latest Business Fad fervor, only to use metrics as a way to identify whose throat to choke. I'm all for accountability, but accountability without authority is a recipe for frustration. I can measure the weather pretty accurately, but I can't reasonably fire anybody for it being too hot unless I can find someone who works for me who actually has the ability to control the weather.


Our goal in the metrics project is to both data mine what we already have (such as the Oracle bug database) to look for interesting patterns (do we have differences in, say, the top 5 security vulnerabilities that vary by development group?) and to try to develop metrics that help us manage better going forward. I should also note that we have plenty of metrics we use in development already for things like code coverage, bug counts and trends, and so on. What we are doing is working up some security-specific bug metrics beyond what we already do. I have to say that development groups seem keen to embrace this, because the Amazingly Wonderful Person who is driving the project (and who has a well ordered plan) has been chivvied into immediately jumping into data mining for one of the development groups. Those developers want to know where their biggest problems are so they can attack those first. Who could ask for anything more? It's kind of like wanting to know your top five sins so you can properly repent of them.


It may seem strange to talk about metrics in the same breath as "sanctuary." Like the word "kapu," the received wisdom about what the word means is at odds with what the word actually does mean. My goal for this project really is simple (I have no hidden agenda): for us to manage better. If we find, for example, that the top five major security vulnerabilities do differ by development group, it may mean that we need different tools (from one group to the next), or different training, or better tricks to make it easy for people to do the right thing (e.g., we give them an API instead of telling them "go roll your own code"). I am also optimistic that nothing succeeds like success. If you can help development do better, faster (by targeting their efforts), then they get to reap the rewards of that and they want to continue to invest in improvement.


Targeting your energies also help avoid the "everything is number 1 priority" syndrome that so many companies fall prey to. I once had a manager who (and I am not making this up) had literally three pages (single spaced, double column, about 12 point font) of projects that we were not doing (in addition to the ones we were doing). Every week at his staff meeting, we went over the Projects We Aren't Doing List as well as status of ones we were working on. I finally got so irritated that I pointed out to him that even managing the list of Things We Aren't Doing creates work and consumes resources (why, only last week, I Didn't Climb Mount Everest and I Didn't Invent a Cure for Cancer). Why not make a decision just to Not Do These <Dumb> Projects, period?  Because some of them we were never, ever going to get to, anyway.


I hope that this metrics project will, in a way, create a sanctuary for development, because the data will help them focus their energies and help give them credit when we make progress. Not that I am ever shy about speaking up and saying "the emperor has no clothes," but I don't want my team to be the team thought of as "the people always giving development a hard time" as much as "the team that helps make it easy for development to develop securely." And just like religion, while people might start doing the right thing out of fear, it is far better, in the long run, for people to do the right thing from a sense of what is pono (right)  and kapu (sacred).


"And what does the LORD require of you? To act justly and to love mercy and to walk humbly with your God?" Micah 6:8


"A he aha ka mea a ke Akua i kauoha mai ai ia oe, ke ole e hana i ka pono, a e aloha i ka lokomaikai, a e hoohaahaa i ka hele ana me ke Akua?" Micah 6:8



For more information:


Speaking of sanctuary, my home is my sanctuary, as it is for most people, so a big mahalo nui loa to all the terrific firefighters who are currently battling the Castle Creek Fire in Ketchum, Idaho that is threatening so many people's homes and the Sun Valley ski resort. You guys and gals are no ka 'oi - "dabest."


An essay on the religion(s) of Polynesia:


About the Hawaiian Marine Sanctuary, Papâhanaumokuâkea:


Where to get your very own Baibala Hemolele:


Or find it online at:


More on Hawaiian green sea turtles (honu):


It's reading your blog entries that make me miss working for you! Mahalo!

Posted by Jeff DeMello on August 29, 2007 at 03:30 PM PDT #

It's reading your blog entries that make me miss working for you! Mahalo!

Posted by Jeff DeMello on August 29, 2007 at 03:30 PM PDT #

It was an interesting post, thanks

Posted by Oscar on August 30, 2007 at 12:13 AM PDT #

I am rather surprised to see Oracle's Chief Security Officer publicly take on the linguistic accuracy of the King James Version. *grin* Wow. Talk about tossing out flame bait. However, I for one loved the segue from a biblical exposition to "sacred" metrics. I appreciate your openness about your efforts in your job role. attempting to walk humbly, love mercy and act justly,

Posted by Charles Schultz on August 31, 2007 at 01:31 AM PDT #

Post a Comment:
  • HTML Syntax: NOT allowed



« July 2016