76 karma · joined June 26, 2010
Most developers could jump into a 40 year old COBOL codebase and safely make changes. This is probably less true for even a 20 year old C++ codebase. Sure COBOL looks old but its complexity is so much lower.
Similarly, I haven't written COBOL in 25 years but I suspect the language hasn't changed much, unlike C++.
I couldn't appreciate those things on the first pass as a young engineer.
To quote "Novell CEO Eric Schmidt" (heh) from the linked Wired article[0],
> [...] and it did a good job of getting into the psychology of leadership. The corporate maneuvering was both fascinating and abhorrent to me.
The joy of rereading a good book, it hasn't changed but I have.
Whenever I ran into him on email or in Zurich, it brightened my day.
He mentions only those that are frequently cited so as to address their results.
[1] https://www.amazon.com/How-Not-Die-Discover-Scientifically/d...
"Along the way they’d also proven my privacy to be a
modern fiction. It turns out that people — ordinary
people — really can gather an incredible dossier of facts
about you."
"But a month later, life was back to normal and no one
was taking any interest."
https://www.amazon.com/dp/0982761058/ref=cm_sw_r_cp_apa_dC-D...
As someone who lives in the area I've always been curious how it came about, especially circa 1996/97.
Bill Pugh's FindBugs, http://findbugs.sourceforge.net/bugDescriptions.html
I hope this is a win for the Webpass employees, in the short and long term. Thanks for all the bits!
https://youtu.be/1n6yLPNj_Pk "The Legend: Victor Korchnoi - Ben Finegold"
If you've never seen Ben Finegold lecture from the St Louis Chess Club, he's hilarious (relative to the subject matter).
https://www.frontier.phys.nagoya-u.ac.jp/en/chubusat/chubusa...
Impressive! Creating a new word in the same sentence you declare you'll be using new words. Assuming I understand her cromulent new word.
Completely agree. Which is why I say at the end of my original comment that security is "always a compromise." Put another way, you weigh the day-to-day cost of more hardware and man hours against the potential future cost of a serious security exposure.
Unfortunately most people are bad at calculating potential future costs. Which leads us to your second point about needing a good security guy. =]
"DISECONOMY of SCALE #1: CERTIFICATE MANAGEMENT"
The author states that distributing keys to a "farm" of servers (10 apparently) is hard. Presumably if you have 10 servers running your website you've figured out how to distribute code to them all without injuring yourself. Distributing certs is not much different.
DISECONOMY of SCALE #2: CERTIFICATE/KEY SECURITY
The author states that SSL keys are sensitive. Indeed, and so is your source code. The paragraph contains some excellent FUD in the form of, a key on your "commodity hardware" server is immediately at risk of theft and will lead to "further breaches."
DISECONOMY of SCALE #3: LOSS of VISIBILITY / SECURITY / AGILITY
The author argues that SSL to the server introduces "unacceptable amounts of latency." This is just patently false. Many of the top 100 websites on the internet operate under this model.
The same paragraph says that not decrypting traffic at every hop will open up your service to "compromise." Even if parsing all the traffic is part of your threat mitigation strategy, out-of-band or port-mirroring can give you this ability without adding latency to the request or response.
Ah and I think the author should remove the bolded article that says Virtual Hosts can not be used with SSL certs. This is what the SNI extension is for.
Remember, security is hard and always a compromise.