Slashdot Mirror

Loser.

I'm trying to be objective here.

Appliances produced by Tumbleweed, Allot and Radware are all heavily adopting FOSS. They can secure their VC investment, their brand and their business; their staff contribute back to FOSS community and keep it growing. They wouldn't whine, do they?

we all know it's nonsense, when he said no FOSS software giant exists. What he actually meant was 'No FOSS Software Giant that can cash in big profit for small group of people'. If it can't take huge profit, it's then a failure. Bullshit. People paid overprice product just because there're no other better alternative around. Things changed, face it.

I couldn't agree with this more. We did a startup in 2001 and kept a web presence up and running the whole time. The primary things we agreed would always be available:

• A technology overview. The things we were working on for technology.
• A blog for each of the principals. Not that we always updated it, but we tried.
• Resumes for each of the principals.
• Some amount of changing content on the front page. In our case we had company news, security news and virus outbreaks.
• Technical notes. These were observations on technology longer than a blog entry. We did some nontrivial analysis of various Java technologies that ended up in here.
• Downloads. We maintained a few free utilities for people to download that showcased some of our technology.

Based on this web presence, we were contacted several times with various offers, ultimately selling the technology to Sendmail, Inc. and taking full-time positions there working on the code. Now the product (Mailstream Manager) is going gangbusters under the Sendmail flag.

This is the second time we've done this kind of deal. The first time was pre-Google in 1996, so it was more of a "loud startup with good industry networking" since you couldn't STFW as effectively in those days ;). This technology is still in use today in products from Tumbleweed Communications.

Getting back to this "Do Stealth Startups Suck?" theme -- our personal perspective is that if it's so cool that you have to keep it a secret, then it isn't very cool at all. If you can't maintain an edge even if the other guy knows exactly what you're doing, then you don't have an edge. We call this the "True Lies" approach -- at the end of True Lies, Schwarzenegger explains exactly his plan for escaping from the guy who's gonna torture him, and despite the fact that the guy knows the exact plan, Schwarzenegger is able to execute it and escape.

Encryption & establishing identity go hand-in-hand. I work for one of the largest PPO's in the nation. It is of the upmost importance that identity can be established in addition to providing a secure means to get there.

I need to know that not only can nobody but the recipient get my message, but that said recipient is who they claim to be.

I am in the middle of discussions of trying to move us off of tumbleweed (a la hotmail type secure email) and on to pgp/gpg. I would like to hear more about your experience/difficulties with pgp/gpg (I don't have any. but then again, I've been using pgp since 1997, so any difficulties I might have remembered are forgotten in light of the tumbleweed project).

According to Tumbleweed's press release, the patent in question concerns "Private URLs for Directed Document Delivery", which sounds pretty damn elementary. It's not like no one could have possibly come up with the idea of private, dynamically generated URL's for document retrieval. In fact, given the way that the use of URL's is, well, intrinsic to the way the web works, who wouldn't do this if it was unsatisfactory to send the whole shmear over email, as is obviously the case if the html content you want to send involves custom rendered gif's and the like.

I can say that if the law allows for something weaker than what I consider my digital signature, then I'd be really pissed. Also, even if the law provides that strong cryptography be used, how are the signatures to be verified as the ones that the user wants to have as his signature? I used PGP 6.0.2's signature, which I guess is a DSS signature, but what if someone else comes up with a different signature standard and decides to claim that it's my signature?

Do I bring my public keyring into the DMV on a floppy and submit it to them with my driver's license?

As for verified delivery of mail, there is some solution to this, which the US Post Office is starting to use. It's from Tumbleweed Software - a friend of mine used to work there. It's basically a web-based system for verified delivery of messages.

It's important for everyone to understand such things as the fact that, to sue someone, a process server (not the person suing) has to deliver the notice of the lawsuit _in person_ to the person being sued and then file a form attesting to having properly served the process. (Always pay extra to have a cop serve the process!)

It's possible to duck a lawsuit by dodging the process server. I experienced this when I tried to sue my landlord in small claims court for failing to return my deposit. But will they be able to serve processes electronically?

I want to know if there's a way I can ensure that nothing short of my own PGP signature is accepted as my digital signature. If a weaker signature than my own gets accepted as my signature - or yours - we'll have a lot of problems.

Mike Crawford
GoingWare - Expert Software Development and Consulting
http://www.goingware.com
crawford@goingware.com