Slashdot Mirror

We need to trust regional CAs less, the classic example is the Hong Kong Post Office. Mozilla's list of current roots - https://ccadb-public.secure.fo...

This can only be done with a collision attack if the CA is really, really stupid. Proper CAs should include chain-length restrictions in their certificates.

Please correct me if I'm wrong, but it appears that most CAs are really, really stupid. Here's a list of the CAs included in Firefox: https://mozillacaprogram.secur... . I split the PEMs into a pile of files, and checked them:

$ for pem in * ; do openssl x509 -text -in $pem | grep pathlen ; done
        CA:TRUE, pathlen:4
        CA:TRUE, pathlen:1
        CA:TRUE, pathlen:1
        CA:TRUE, pathlen:7
        CA:TRUE, pathlen:7
        CA:TRUE, pathlen:3
        CA:TRUE, pathlen:5
        CA:TRUE, pathlen:12
        CA:TRUE, pathlen:12
        CA:TRUE, pathlen:12
        CA:TRUE, pathlen:12
        CA:TRUE, pathlen:3
        CA:TRUE, pathlen:10
        CA:TRUE, pathlen:3

So out of 172 root CAs only 14 include any path length restrictions, and even the ones who do still allow some chaining. This is what allowed the beautiful Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate to succeed.

I don't think the SHApocalypse will be tomorrow. This was an identical-prefix attack instead of a chosen-prefix which constrains the attacker considerably, and the computation required is much higher even to generate simple collisions. However, (again, please correct me if I'm missing something) it does seem plausible that that further weaknesses will be found which provide just enough leverage to forge a signature with one of those 172 CAs, and we may eventually see a rogue sha1WithRSAEncryption CA issued.

https://firsttechfed.secure.fo...

First Tech federal credit union.

Neil Young already has the Pono Player. It plays FLAC.

Cooler name origin, just $400 (BKA one third the price), Kickstarter funded. And helps you keep on rockin' in the free world

My cube mate has a $300 bland iPod-ish thing with it's own FLAC capable firmware, and a true hardware amp. Did i mention $300, B.K.A. one fourth the price.

Methinks this is a non-starter. They will sell when heavily discounted, much like the HP Tablets finally sold (as Linux devices) when prices came down.

Go figure. Hipster trends hit mainstream, give it 2-3 years and vinyl will fall by the wayside as people pickup Zune's and say "THIS IS HOW IT WAS MEANT TO BE!"

Actually this

https://ponomusic.force.com/

may be how it's meant to be...

• Learning on your own is great and gives you a sense of independence, but you can't generally put that stuff on a resume, making it almost worthless.
• Volunteering for the Community Corps. and help a non-profit customize a Drupal site or something is nice, but then you have learn Drupal/Wordpress, and you still can't put C# on your resume. Most non-profits don't need development work.
• What sucks about learning on your own is that it limits your employment opportunities. Most places, sadly, will turn away your resume if you have no education in the field and haven't worked in it already for 5+ years.
• Startups hire people that don't necessarily have good educational credentials and lots of experience, but they expect rockstars--great coders with quick learning abilities, i.e., probably not you (at least until you get back close to 100%). Startups would expect a lot more from you than you can deliver, and they'll probably be disappointed given your short-term memory issues.

• School doesn't have most of these issues.

  • Schools almost always give extra support to folks like you. You'll be given extra time to complete tests and quizzes (1.5x - 2x, usually), along with tutors, etc. In fact, having a free tutor is almost the top reason to go to school, as a good one will have the patience to repeat things day-after-day which you say will help you. Most tutors are students themselves, so they are there for 4+ years, so you might be able to stick with the same person year-after-year.
  • Go to a local 4-year school, or do a 2+2 program (where you spend the first two years at a community college and the next two at a regular 4-year school to get a Bachelor's). You sound like a smart guy/gay, so I think you'll do fine. The point is to get a Bachelor's in Computer Science or MIS or something.
  • Go to an public, in-state school! It's a lot cheaper. (Or, go to a school that has cheap out-of-state tuition, like North/South Dakota.)
  • School will also (hopefully) give you lots of extra time to learn the stuff you wanna learn (i.e., C#).
  • Alumni networks can give you a foot in the door, something that's probably gonna be hard for you.

  This is obviously a long-term plan (most good things in life take time, I'm sure you can understand that), and the punchline of this plan is to get into a large corporation that does a lot of EO (Equal Opportunity) hiring.

• Big corps (e.g., IBM, Microsoft, etc.) tend to have strong EO programs that would love people like you, even if you're not a coding rockstar, as long as you have some education credentials and some skills they like (e.g., Java, C#, respectively).
• You'll make good money, as these corps don't want to make the headlines that they pay disabled Software Engineer I less money than non-disabled Software Engineer I for "the same work." Even if you're not productive as a non-disabled person, they probably won't wanna pay you any less.

Yes, this is a long-tem plan. It's not "Learn C# in 24 Hours!" type of stuff. But the payoff is amazing: you'll never have to worry about finding another job, you're not a burdon to society (hell, you'll be paying lots in taxes), and you'll have plenty of money to do whatever you want.

Have you considered using force.com (there is for example the GeoPointe tool to link with google maps) or perhaps Google App Engine (GAE) as a platform for building your own easily scalable, mashup-friendly service? There seems to be something called GeoModel which you can access from within GAE for simple queries like what assets are within a given radius. These services will host it for you so you can save the money of purchasing and renting your own servers too. Here are some jumping off points perhaps..

http://googlemapsapi.blogspot.com/2008/05/app-engine-local-search-maps-making.html
http://code.google.com/apis/maps/articles/geospatial.html#geomodel
http://www.arrowpointe.com/
http://sites.force.com/appexchange/listingDetail?listingId=a0N300000016ZHeEAM

As long as the line is "do you want Windows or Linux on that, Sir", and the seller gets paid whichever way, Windows will be the easiest sell [...]

That's unfortunately not quite the way it is. The seller is often paid to sell Windows. Dell's Ideastorm is filled with cases like this, and you'll find more of the same story for other manufacturers that supposedly ship with Linux pre-installed.

Disclaimer: I work as a software engineer at Salesforce.com.

Depending on your needs and budget, Force.com might be a viable option. It's all proprietary, but they do provide enterprise-class service level agreements and have delivered enterprise-grade levels of uptime to companies big and small ( http://trust.salesforce.com/trust/status/ ). Its Apex programming language is Java-like ( http://www.salesforce.com/platform/application-development/apex-programming-language/ ), and it's possible to write arbitrary user interfaces on it using its Java server faces extending VisualForce page layout markup language ( http://www.salesforce.com/platform/application-development/visualforce/ ).

Salesforce ensures via its processes throughout the company that no one except for you and anyone who you explicitly temporarily authorize, such as a support person in a service call, will see your data.

As new releases are created, Salesforce ensures that the APIs for previous versions do not regress, meaning that if you build an API integration on the latest version of the API and continue to use it as more Salesforce.com versions get released, your integration will work indefinitely until you decide to use the latest version of the API, and Salesforce.com hasn't dropped support for any of its obsolete API versions in years.

Depending on what you want to do with the platform, it's possible to sell your software to customers on the AppExchange. Customers, including those who already use Salesforce.com and those who do not, can install your AppExchange package and be up and running quickly. Customers who do not use Salesforce.com can use it via a platform license that you can sell directly to your customers, thus relegating Salesforce.com to be the underlying platform and giving you more complete control over your interactions with your customers. This is platform as a service (PaaS). I know, I know.. Buzzwords ;-)

Relevant URLs:
Force.com: http://www.force.com/
Salesforce.com's cloud status: http://trust.salesforce.com/trust/status/
Apex programming language: http://www.salesforce.com/platform/application-development/apex-programming-language/
VisualForce: http://www.salesforce.com/platform/application-development/visualforce/
AppExchange: http://www.salesforce.com/platform/appexchange/
API and integrations: http://www.salesforce.com/platform/integration/

Hopefully, this helps. Please don't mod me as troll ;-). I'm trying to be helpful and informative to the original poster.