http://feedproxy.google.com/~r/DilbertDailyStrip/~3/98NKi_mggBk/

http://dilbert.com/strips/comic/2013-05-18/

http://www.schneier.com/blog/archives/2013/05/friday_squid_bl_376.html

Technically, it's a cuttlefish and not a squid. But it's still nice art. I posted a photo of a real striped pyjama squid way back in 2006.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

http://www.schneier.com/blog/archives/2013/05/applied_cryptog.html

In the episode that aired on May 9th, about eight or nine minutes in, there's a scene with a copy of Applied Cryptography prominently displayed on the coffee table. This isn't the first time that my books have appeared on that TV show.

Posted by Victoria Strauss for Writer Beware

Just over a year ago, I wrote about a new French law that, under the guise of dealing with the pressing issue of orphan works, implements a truly massive rights transfer.

The law empowers the Bibliothèque Nationale de France to create an online database of works published in France before 2001 that are currently out of print (this includes not just works by French writers, but foreign works translated into French). Once a work has been listed in the database for more than six months, the right to digitize it transfers to a collective management organization, which thereafter has near-unlimited power to exploit that right–including granting it to publishers without the author’s permission. The collective management organization will also be responsible for distributing (an unspecified portion of) the proceeds from such grants to rightsholders.

There’s a six-month waiting period between a book’s appearance in the database and the transfer of rights to the collective management organization. To be removed from the database, rightsholders–who are not currently being notified if their works are included–must opt out in writing before the six-month waiting period expires. If they miss that deadline, they lose control of the digital display and sale of their work, and can only demand removal by proving that that they are the sole holder of digital rights.

The database, known as ReLIRE, is now online,with an initial list of 60,000 books. According to a comprehensive post on the program by writer Gillian Spraggs, numerous problems have been noted, including data errors, inclusion of books published after the 2001 cutoff date, and inclusion of books still in print or already available in digital form. Also included are many translated works by foreign authors that are clearly not orphans.

Digital-hungry publishers are already taking advantage of the database. Spraggs writes,

It appears that 10,000 (one in six) of the books in the database have been opted in by the publishers. The ReLIRE website FAQ outlines what a publisher will get out of the arrangement:

‘You will have the possibility of having an exclusive publishing licence for 10 years, implicitly renewable, to exploit the book in digital form, without having to sign a contract with the author or the author’s successors in title for the digital rights.

Sofia [the collecting society] will contact the authors or the successors in title to pay them, in accordance with the terms set out in the publishing contracts’…

Two points that the FAQ discreetly avoids spelling out are:

1. The legislation specifically charges the collecting society with developing contractual relationships that will ensure the greatest possible availability of the works…This puts prospective publishers in a very strong negotiating position and more or less guarantees that the contracts agreed will be bargain-basement deals with very low royalty rates, regardless of the market value of the work.

2. Certain administration costs that in a normal publishing arrangement would be borne by the publisher will instead be borne by the collecting society, which will take them out of royalties (so all or part of them will be taken from the authors’ share of any income). These include the cost of contacting authors and estates.

For authors, Spraggs says, it is “a ripoff deal.”

Writers’ groups in the US are taking notice of this threat to copyright. The Science Fiction and Fantasy Writers of America  has sent the letter below (reproduced with permission) to members, a number of whom have already found their works included in ReLIRE.

Dear SFWA Members,

As many of you already know, the ReLire program currently underway in France has scanned many books it considers to be “orphan works” in order to make them available through a public database. This database has already been found to contain many titles that are clearly not orphan works or in the public domain, including a number by prominent SF and fantasy authors. A more detailed explanation of the program is available here.

As this is a program of the Bibliotheque Nationale Francaise (French National Library), the Board is currently discussing options for applying pressure to the French government to prevent further works by SFWA members from being scanned and made available through this program, and we invite any members who have connections with the United States Trade Representative or any relevant branch of the U.S. Government to contact us. For the moment, however, we are informing all members of the issue and making them aware of the process involved in finding out whether a work is included and how to request that it be removed from the database.

All parts of the ReLire website and database are available only in  French. The Society of Authors has produced translations of four key pages:

- The ReLire home page
- The Your Rights page
- The Search page
- The FAQ

Here is a direct link to the advanced search page. The search fields are Titre( Title), Auteur (Author), Editeur (Editor) and Date d’edition (Publication date). If you are aware of any works of yours that have ever been published in French, you are strongly advised to search under all of the first three fields, as the entries in the database have been found to have many typos. Please notify SFWA of any of your works that are found in the database, as that will be valuable information in our efforts to protest the program.

If you do find any novels, stories or any other works belonging to you in the database you may request to have them removed. Please note that at this time it appears as though you will need either a French identification card (only available to residents of France) or a valid passport to make the application. We are awaiting clarification on the question of whether any other forms of identification will be accepted.

Thanks to Aliette de Bodard, Lawrence Schimel, Michael Capobianco and Jim Fiscus for their help in researching and co-ordinating SFWA’s response.

If any of your works have been published in French, and you find them included in ReLIRE, see this step-by-step manual for applying to have the work removed. For many other helpful resources and links, as well as some of the writing/publishing community’s reaction to ReLIRE, see Gillian Spraggs’s blog post, French Copyright Grab: the Machine Creaks into Action.

Spraggs writes that a group of French authors are planning to challenge the new law on constitutional grounds. She concludes by urging all writers to protest ReLIRE:

Whether or not you find that any of the books on the list are by you, or contain works by you, make a complaint to your government about the ReLIRE project, and talk to any author societies to which you belong.

The Berne Convention says: ‘Authors of literary and artistic works protected by this Convention shall have the exclusive right of authorizing the reproduction of these works, in any manner or form.’ (9.1) This can only be overriden ‘in certain special cases’ and ‘provided that such reproduction does not conflict with a normal exploitation of the work and does not unreasonably prejudice the legitimate interests of the author’. (9.2) The Convention says of all the rights that are guaranteed under it: ‘The enjoyment and the exercise of these rights shall not be subject to any formality‘. (5.2)

By compelling foreign authors, in order to prevent their works’ being co-opted into collective management, to search for them on a database and request their removal, the French government has imposed an illegal formality on their exclusive exercise of the right of reproduction.

The ReLIRE scheme is in no sense a ‘special case’ within the meaning of Article 9.2. By intervening in such an outrageous manner in the fast-developing market for digital rights it interferes with the normal exploitation of the works and most unreasonably prejudices the legitimate interests of the authors.

Mirrored from SFWA | Comment at SFWA

http://www.GiantITP.com/comics/oots0888.html

http://feedproxy.google.com/~r/DilbertDailyStrip/~3/OpaglI--_mc/

http://dilbert.com/strips/comic/2013-05-17/

http://herbsutter.com/2013/05/16/gotw-4-class-mechanics-710/

http://herbsutter.com/?p=1920

How good are you at the details of writing classes? This item focuses not only on blatant errors, but even more so on professional style. Understanding these principles will help you to design classes that are easier to use and easier to maintain.

Problem

JG Question

1. What makes interfaces “easy to use correctly, hard to use incorrectly”? Explain.

Guru Question

2. You are doing a code review. A programmer has written the following class, which shows some poor style and has some real errors. How many can you find, and how would you fix them?

class complex {
public:
    complex( double r, double i = 0 )
        : real(r), imag(i)
    { }

    void operator+ ( complex other ) {
        real = real + other.real;
        imag = imag + other.imag;
    }

    void operator<<( ostream os ) {
        os << "(" << real << "," << imag << ")";
    }

    complex operator++() {
        ++real;
        return *this;
    }

    complex operator++( int ) {
        auto temp = *this;
        ++real;
        return temp;
    }

    // ... more functions that complement the above ...

private:
    double real, imag;
};

Note: This is not intended to be a complete class. For example, if you provide operator++ you would normally also provide operator+=. Rather, this is an instructive example to focus on the mechanics of writing correctly the kinds of functions this class is trying to support.

http://herbsutter.com/2013/05/16/gotw-3-solution-using-the-standard-library-or-temporaries-revisited/

http://herbsutter.com/?p=1912

Effective reuse is an important part of good software engineering. To demonstrate how much better off you can be by using standard library algorithms instead of handcrafting your own, let’s reconsider the previous question to demonstrate how many of the problems could have been avoided by simply reusing what’s already available in the standard library.

Problem

JG Question

1. What is the most widely used C++ library?

Guru Question

2. How many of the pitfalls in GotW #2 could have been avoided in the first place, if only the programmer had replaced the explicit iterator-based for loop with:

(a) a range-based for loop?

(b) a standard library algorithm call?

Demonstrate. (Note: As with GotW #2, don’t change the semantics of the function, even though they could be improved.)

To recap, here is the mostly-fixed function:

string find_addr( const list<employee>& emps, const string& name ) {
    for( auto i = begin(emps);  i != end(emps); ++i ) {
        if( i->name() == name ) {
            return i->addr;
        }
    }
    return "";
}

Solution

1. What is the most widely used C++ library?

The C++ standard library, with its implementations on every platform.

2. (a) How many of the pitfalls in GotW #2 could have been avoided with a range-based for loop?

Astute readers of GotW #2 will have been champing at the bit to say: “Why aren’t you using a range-based for loop?” Indeed, why not? That would solve several of the temporaries, never mind be easier to write.

Compare the original unimproved explicit iterator loop:

    for( auto i = begin(emps); i != end(emps); i++ ) {
        if( *i == name ) {
            return i->addr;
        }
    }

with the range-based for loop (bonus points if you remembered to write the const auto&):

    for( const auto& e : emps ) {
        if( e == name ) {
            return e.addr;
        }
    }

The expressions e == name and return e.addr; are unchanged in terms of their possible or actual temporaries. But the questions in the naked loop code about whether or not the = causes a temporary (recall: it doesn’t), whether or not end() recalculation matters and should be hoisted (recall: probably not, but maybe), and whether or not i++ should be rewritten ++i (recall: it should) all simply don’t arise in the range-for code. Such is the power of clear code, and using a higher level of abstraction.

A key advantage is that using the range-based for loop has increased our level of abstraction, the information density in our code. Consider: What can you say about the following two pieces of code without reading what comes next?

    for( auto i = begin(emps); i != end(emps); i++ ) {   // A

    for( const auto& e : emps ) {                        // B

At first it might seem that lines A and B convey the same information, but they don’t. When you see A, all you know is that there’s a loop of some sort that uses an iterator over emps. Granted, we’re so used to A that our eye’s peripheral vision tends to “autocomplete” it in our heads into “a loop that visits the elements of emps in order” and our autocomplete is often correct—except when it isn’t: was that a ++, or a s+= 2 in a strided loop? is the index modified inside the body? Our peripheral vision might be wrong.

On the other hand, B conveys more information to the reader. When you see B, you know for certain without inspecting the body of the loop that it is a loop that visits the element of emps in order. What’s more, you’ve simplified the loop control because there’s no need for an iterator indirection. Both of these are raising the level of abstraction of our code, and that’s a good thing.

Note that, as discussed in GotW #2, the naked for loop didn’t naturally allow consolidating to a single return statement without resorting to making the code more complex by adding an additional variable and performing extra computation (a default construction followed by an assignment, instead of just a construction). That’s still true of the range-based for loop form, because it still has the two return statements in different scopes.

2. (b) … with a standard library algorithm call?

With no other changes, simply using the standard find algorithm could do everything the range-based for loop did to avoid needless temporaries (and questions about them):

// Better (focusing on internals)
//
string find_addr( /*...*/ ) {
    const auto i = find( begin(emps), end(emps), name );   // TFTFY
    return i != end(emps) ? i->addr : "";
}

This naturally eliminates the same temporaries as the range-for version, and it further increases our level of abstraction. As with the range-based for loop, we can see at a glance and for certain that the loop will visit the elements of emps in order, but on top of that we also know we’re trying to find something and will get back an iterator to the first matching element if one exists. We do still have an iterator indirection, but only a single-use iterator object and no iterator arithmetic as in the original naked iterator for loop.

Further, we have eliminated a loop nested scope entirely and flattened out the function to a single scope which can simplify this calling function in ways even the range-for couldn’t. To demonstrate still more just how fundamental this point is, note that what else the flattening out of the body buys us: Now, because the return statements are in the same scope (possible only because we eliminated the loop scope), we have the option of naturally combining them. You could still write if( i != end(emps) ) return i->addr; else return “”; here, on one or two or four lines, but there’s no need to. To be clear, the point here is not that reducing return statements should be a goal in itself—it shouldn’t be, and “single exit” thinking has always been flawed as we already saw in GotW #2. Rather, the point is that using an algorithm often simplifies our code more than an explicit loop, even a range-for loop, can do—not only directly by removing extra indirections and extra variables and a loop nested scope, but often also by permitting additional simplifications in nearby code.

The above code might still cause a temporary when comparing an employee with a string, and we can eliminate even that temporary if we go one small step further and use find_if with a custom comparison that compares e.name() == name to avoid a possible conversion, assuming something like a suitable employee::name() is available as we did in GotW #2. Combining this with the other fixes to pass parameters by reference, we get:

// Better still (complete)
//
string find_addr( const list<employee>& emps, const string& name ) {
    const auto i = find_if( begin(emps), end(emps),
                      [&](const auto& e) { return e.name() == name; } );
    return i != end(emps) ? i->addr : "";
}

Summary

Prefer algorithm calls over explicit loops, when you have or can write a suitable algorithm that does what you want. They raise the level of abstraction and the clarity of our code. Scott Meyers’ advice in Effective STL is still true, and more applicable than even now that lambdas make algorithms much more usable than before:

Guideline: Prefer algorithm calls to explicit loops. Algorithm calls are often clearer and reduce complexity. If no suitable algorithm exists, why not write it? You’ll use it again.

Prefer reusing existing library code to handcrafting your own. The more widely used the library, the more likely it is to come well-designed, pre-debugged, and pre-optimized for many common requirements. And what library is more widely used than the standard library? In your C++ program, your standard library implementation is the most widely used library code you’re likely to use. This helps you both in the library’s design and its implementation: It’s full of code that’s intended to be used and reused, and to that end a lot of thought and care has gone into the design of its features, including its standard algorithms like find and sort. Implementers have also spent hours sweating over efficiency details, and usability details, and all sorts of other considerations so that you don’t have to—including performing optimizations you should almost never resort to in application-level code, such as using nonportable OS- and CPU-target specific optimizations.

So, always prefer to reuse code, especially algorithms and especially the standard library, and escape the trap of “I’ll-write-my-own-just-’cause-I-can.”

Guideline: Reuse code—especially standard library code—instead of handcrafting your own. It’s faster, easier, and safer.

Acknowledgments

Thanks in particular to the following for their feedback to improve this article: Olaf ven der Spek, Sam Kramer.

http://www.schneier.com/blog/archives/2013/05/bluetooth-contr.html

Here is a new lock that you can control via Bluetooth and an iPhone app.

That's pretty cool, and I can imagine all sorts of reasons to get one of those. But I'm sure there are all sorts of unforeseen security vulnerabilities in this system. And even worse, a single vulnerability can affect all the locks. Remember that vulnerability found last year in hotel electronic locks?

Anyone care to guess how long before some researcher finds a way to hack this one? And how well the maker anticipated the need to update the firmware to fix the vulnerability once someone finds it?

I'm not saying that you shouldn't use this lock, only that you understand that new technology brings new security risks, and electronic technology brings new kinds of security risks. Security is a trade-off, and the trade-off is particularly stark in this case.

http://feedproxy.google.com/~r/DilbertDailyStrip/~3/lcXki_HEv_4/

http://dilbert.com/strips/comic/2013-05-16/

http://blog.xkcd.com/2013/05/15/dictionary-of-numbers/

http://blog.xkcd.com/?p=734

I don’t like large numbers without context. Phrases like “they called for a $21 billion budget cut” or “the probe will travel 60 billion miles” or “a 150,000-ton ship ran aground” don’t mean very much to me on their own. Is that a large ship? Does 60 billion miles take you outside the Solar System? How much is $21 billion compared to the overall budget? (That last question is  why I made my money chart.)

A friend of mine, Glen Chiacchieri, has created a Chrome extension to help solve this problem: Dictionary of Numbers. It searches the text in your browser for quantities it understands and inserts contextual statements in brackets. It might turn the phrase “315 million people” into “315 million people [≈ the population of the United States]“.

As Glen explains, he once read an article about US wildfires which mentioned that the largest fire of the year had burned “300,000 acres.” This didn’t mean much to Glen:

I have no idea how much 300,000 acres is [...] But we need to understand this number to answer the obvious question: how much of the United States was on fire? This is why I made Dictionary of Numbers.

Dictionary of Numbers helpfully informs me that 300,000 acres is about the area of LA or Hong Kong.

Wolfram|Alpha provides a lookup service like this, but you have to load the site and type in the quantity you’re curious about, which I never remember to do. (It’s also often short on good points of comparison.)

Dictionary of Numbers is a new project, so it’s got its share of glitches and rendering hiccups; it’s very much a work in progress. You can submit bug reports, feedback, and suggestions for data sources via a link on the project’s website.

I think these kinds of tools are a great idea, and I want to encourage them. Intelligence is all about context, and when computers get better at providing it, they make us smarter.

The extension can even be surprisingly funny, like when it seems to be making an oblique suggestion for how to solve a problem—e.g. “The telescope has been criticized for its budget of $200 million [≈ Mitt Romney net worth].” It can also come across as unexpectedly judgmental. Glen told me about complaint he got from a user: “I installed your extension and then forgot about it … until I logged into my bank account. Apparently my total balance is equal to the cost of a low-end bicycle. Thanks.”

You can get Dictionary of Numbers here.

I recently went to a talk by Victoria Curran of Harlequin on writing for her line. One of the things she talked about was the frequent problem of writers trying to follow formulas and ending up short-changing the story, the emotional impact, and the characters themselves. I was really impressed to hear her say a lot of things about romance formula that I have said myself. TRUST YOUR CHARACTERS, she said. Let them lead you to interesting plots.Let them lead you to new places that other romances don’t go.

I have been thinking for almost a week now about this idea of trusting your characters and what that means for writers. I know that we have this idea that there are writers who outline and writers who discover. But I am not sure this is really a different thing. I suspect that writers who discover-write can have just as many problems forcing characters to do what will lead to the “right” plot as writers who outline do. And writers who outline can outline based on character rather than based on the “right” plot as much as discovery writers do. It’s not really one way or another, once you have written fifteen drafts of a manuscript. You are moving back and forth between plot and character, tweaking character so plot works, and tweaking plot so character works.

That said, I still like the idea of trusting your characters to lead you to interesting plot. I think sometimes we are scared to let our characters veer off script. Even if you don’t have an outline written down for a particular novel, you still have an idea in your head of what is done and what isn’t done in your particular genre. And when a character might have a chance to do something that you have never seen a character do before, as a writer you might have a tendency to reel that character in because you will have an easier time writing the next scene and indeed the rest of the book if the character stays within the kinds of plot that you have seen done before.

For instance, if you have a character in a fantasy novel who decides to leave the magical school s/he is enrolled in, what happens next? That’s not the way those stories are written. If you have a character in a romance novel who decides to leave town just when things get hot and heavy on a year-long world cruise, well what next? You don’t usually have a year gap before the resolution of your romance. If you have a character in a science fiction novel who does something stupid and gets killed, well then who is going to be your main character for the rest of the novel? You put a lot of time and effort into developing this great alpha character and now all you have left is the beta characters running around.

But often the most interesting thing about a novel may be the ways in which it disobeys the formulas and rules of convention. Yes, there are probably rules you can’t circumvent. In romance, do you have to have a happily ever after? Well, actually no. I’ve read romances that didn’t. But readers are not always happy. Still, it can be done and if your characters demand it, then you may end up writing a much more satisfying story that way than by making your characters act in ways that serve the HEA, but take away all the uniqueness and power of the character development you have worked on.

Still thinking about this …

http://feedproxy.google.com/~r/DilbertDailyStrip/~3/MZMCQz1nDaI/

http://dilbert.com/strips/comic/2013-05-15/

http://www.schneier.com/blog/archives/2013/05/transparency_an.html

As part of the fallout of the Boston bombings, we're probably going to get some new laws that give the FBI additional investigative powers. As with the Patriot Act after 9/11, the debate over whether these new laws are helpful will be minimal, but the effects on civil liberties could be large. Even though most people are skeptical about sacrificing personal freedoms for security, it's hard for politicians to say no to the FBI right now, and it's politically expedient to demand that something be done.

If our leaders can't say no -- and there's no reason to believe they can -- there are two concepts that need to be part of any new counterterrorism laws, and investigative laws in general: transparency and accountability.

Long ago, we realized that simply trusting people and government agencies to always do the right thing doesn't work, so we need to check up on them. In a democracy, transparency and accountability are how we do that. It's how we ensure that we get both effective and cost-effective government. It's how we prevent those we trust from abusing that trust, and protect ourselves when they do. And it's especially important when security is concerned.

First, we need to ensure that the stuff we're paying money for actually works and has a measureable impact. Law-enforcement organizations regularly invest in technologies that don't make us any safer. The TSA, for example, could devote an entire museum to expensive but ineffective systems: puffer machines, body scanners, FAST behavioral screening, and so on. Local police departments have been wasting lots of post-9/11 money on unnecessary high-tech weaponry and equipment. The occasional high-profile success aside, police surveillance cameras have been shown to be a largely ineffective police tool.

Sometimes honest mistakes led organizations to invest in these technologies. Sometimes there's self-deception and mismanagement—and far too often lobbyists are involved. Given the enormous amount of security money post-9/11, you inevitably end up with an enormous amount of waste. Transparency and accountability are how we keep all of this in check.

Second, we need to ensure that law enforcement does what we expect it to do and nothing more. Police powers are invariably abused. Mission creep is inevitable, and it results in laws designed to combat one particular type of crime being used for an ever-widening array of crimes. Transparency is the only way we have of knowing when this is going on.

For example, that's how we learned that the FBI is abusing National Security Letters. Traditionally, we use the warrant process to protect ourselves from police overreach. It's not enough for the police to want to conduct a search; they also need to convince a neutral third party -- a judge -- that the search is in the public interest and will respect the rights of those searched. That's accountability, and it's the very mechanism that NSLs were exempted from.

When laws are broken, accountability is how we punish those who abused their power. It's how, for example, we correct racial profiling by police departments. And it's a lack of accountability that permits the FBI to get away with massive data collection until exposed by a whistleblower or noticed by a judge.

Third, transparency and accountability keep both law enforcement and politicians from lying to us. The Bush Administration lied about the extent of the NSA's warrantless wiretapping program. The TSA lied about the ability of full-body scanners to save naked images of people. We've been lied to about the lethality of tasers, when and how the FBI eavesdrops on cell-phone calls, and about the existence of surveillance records. Without transparency, we would never know.

A decade ago, the FBI was heavily lobbying Congress for a law to give it new wiretapping powers: a law known as CALEA. One of its key justifications was that existing law didn't allow it to perform speedy wiretaps during kidnapping investigations. It sounded plausible -- and who wouldn't feel sympathy for kidnapping victims? -- but when civil-liberties organizations analyzed the actual data, they found that it was just a story; there were no instances of wiretapping in kidnapping investigations. Without transparency, we would never have known that the FBI was making up stories to scare Congress.

If we're going to give the government any new powers, we need to ensure that there's oversight. Sometimes this oversight is before action occurs. Warrants are a great example. Sometimes they're after action occurs: public reporting, audits by inspector generals, open hearings, notice to those affected, or some other mechanism. Too often, law enforcement tries to exempt itself from this principle by supporting laws that are specifically excused from oversight...or by establishing secret courts that just rubber-stamp government wiretapping requests.

Furthermore, we need to ensure that mechanisms for accountability have teeth and are used.

As we respond to the threat of terrorism, we must remember that there are other threats as well. A society without transparency and accountability is the very definition of a police state. And while a police state might have a low crime rate -- especially if you don't define police corruption and other abuses of power as crime -- and an even lower terrorism rate, it's not a society that most of us would willingly choose to live in.

We already give law enforcement enormous power to intrude into our lives. We do this because we know they need this power to catch criminals, and we're all safer thereby. But because we recognize that a powerful police force is itself a danger to society, we must temper this power with transparency and accountability.

This essay previously appeared on TheAtlantic.com.

http://feedproxy.google.com/~r/DilbertDailyStrip/~3/d-JgPqBmUtk/

http://dilbert.com/strips/comic/2013-05-14/

Doll Bones is a delicious fantasy adventure about three children on the verge of their teen years. It’s about not knowing who you are and being afraid to be who you are. It’s about having friends who aren’t cool and dreams that are even less cool. It’s about wanting to stay a child and yet hating the lack of power that comes with childhood. And it’s also about the bonds between us that never die. I cried several times as I read and I could not put the book down once.

I don’t want to tell too much about this story, but I did love the story of “The Queen,” the doll for whom the book is named. I loved how it was resolved, and I loved the sense that I had that the girl who had been harmed had found a way to power, even if it was only through haunting other children. I also loved the other story of loss, and it made me think about how often we tell ghost stories to comfort, and how little it makes sense to those who have had loved ones go on who don’t haunt them. I loved the way in which the library and the librarian in the end become such a pivotal part of solving the problem of the book. I love libraries! I love librarians! I think all authors do, and it’s great when a book can just tip the hat to our heroes. I also loved the made-up stories the children told themselves.

This is a book I suspect our children’s children will be reading to their kids. Or at least, I hope they do.