Someone MD5ing phrases will have to look for months not days.. Change your passphrase like every three months and you'll never have a thing to worry about.
It's a little bit worse than that. You have to remember that as an admin/user, you must win the security fight 100% of the time to remain secure. The malicious hacker must be successful only once.
So if it generally takes several months to recover your password and you change it more often, you still aren't totally safe. It doesn't always require the average time to crack a security scheme. By luck and random chance, some tries will be faster, others slower. After enough tries, the hacker will get lucky and guess your password within a day. If he tries an infinite number of times, he'll guess it on the first try!
In the password and security arena, time is against you.
I read through your posts, and replies, and replies to replies... I just wanted to say thanks for writing everything you have. I've written some posts like yours and answered question after question (which ends up taking a lot of time).
I started to get tired of it, since some people on slashdot think that smart people can't beleive in God, and they are quite willing to attack you for it. But then other people posted defending my position. That helped me much more than I thought it might.
I appreciate your comments and posts. Keep them coming. You seem to be a couragious, smart, articulate, faithful person. Slashdot could use a few more like you.
These are two microcontrollers for robotics. I have used the OOPIC and heard that the Brainstem is also very good. Both come with sample code. They are an excellent way to start a robotics project.
I've used Oracle and MS SQL Server in environments ranging from web sites to enterprise apps. The biggest problems I've seen are not usually problems with these DBMS; they are problems with the application.
I've mainly used MySQL for my large projects, and like you, those projects have not had more than several million entries. But my experience with SQL has been wonderful. I have spent several hours pounding my head on a desk trying to understand why something did or didn't work. But all my applications have run as smoothely and as quickly as one can expect.
I think XML is a step backward, if you're using it to replace a SQL Server database.
I agree - provided your application is best suited for SQL to begin with. There are some small problems where flexibility (XML) is more important than the great features SQL has to offer. I can't see a large number of XML databases at the core of huge operations though.
Oh... I was all ready to thrash you, with my mouse over the reply button and everything. Then I got to that last line about how your entire post was sarcasm.
I think relational SQL databases are just fine, easy enough to use, and serve their purpose very well. They DO take some serious thought when designing tables and queries - but we shouldn't be afraid to think. If your head hurts from SQL, keep on it for a couple more minutes and you'll probably have it! If your head hurts from SQL, you've tried thinking about it - and you still don't get it - you're probably in the wrong business. Complex information retrieval is complicated and sometimes difficult to understand.
On to the next part. XML serves its purpose very well. Although I wouldn't consider XML and SQL to serve the same problem sets equally well. There are certain situations where SQL is perfect. And there are other situations where XML is preferable. If you think of the two as two sides of the same coin, I think you're making a mistake. Likewise, you can't just flip between the two on a whim. Choose the format that's most suited to what you want to do and go forward.
In another post, I was conversing with someone about how difficult it would be to strip down an issue like security, since it depends so much on knowlege from related subjects. In that respect it does seem odd, and not as rigorous as one might hope.
I went to Drake. They have one or two really good professors who teach you everything, and help when you want to learn something on your own. I hope those professors never leave!
I got thrown into assembly language my first semester of college. Boy was I in for a world of hurt! But I learned a of a lot in that world.
Yeah, I was thinking of all the math that's involved in cryptography. And to really know what you're talking about, you should probably understand the guts of networking, tcp/ip and ethernet inside and out. You should know machine language pretty well too.
The most difficult part about security is that you aren't learning how something is supposed to act. That's the easy part. That's what every programmer does (and what I do mostly). But to really do security, you have to know what could happen and how something might work if manipulated. That's really, really hard when you think about all the possibilities!
I just can't imagine squeezing that all in to a short certificate class.
Many computer security companies hire converted hackers. But others refuse, saying that anyone with that bad seed can't every be trusted. They only hire people who have studied hacking, but have never been a hacker (like graduates of this school).
Like you said, it sounds like a good idea, but there are going to be weak points in your staff if they don't really know what they're doing. For instance, I've studied security from books, and I'm pretty adept at defending my computer. But I know there's a lot that I don't know that I would know if I hacked computers on a regular basis.
I'm offering 5 dollars to help a poor Microsoft programmer attend this school, where he will learn how hackers think in order to stop them. Maybe if we all contribute to the pool, we'll have easier lives.
The name of the certificate is new, but the concepts are not novel.
We went through an entire class about computer ethics. We had to to get a Computer Science degree. And since it was an actual Computer Science degree, we learned all about security and machine language and what have you... basically everyting you would learn in this course.
This program seams like a stripped down version of computer science for people who are only interested in security related work.
how many times have you written part of a report while tired and part of a report while much more awake and had the two parts sound the same?
When I was in college, I wrote a fair share of late night reports. In the morning, when I was clear minded, I would proof read them one last time before printing. On occasion, there would be things in the paper that I didn't even remember writing! And the biggest shock, is that much of what I wrote while sleep-deprived-half-unconscious was BETTER than what I wrote while I was awake!
I just hope they can maintain a strong cohesion with disparate authors. They have the potential to gather many viewpoints (a wonderful tool in teaching) of the same topic so that there are high odds of a reader understanding at least one of them.
At the same time, every truly great text book that I've read has come from a great author. That author has made each chapter build on the one before, and follow a similar form. In other words, buy the second or third chapter, you're starting to understand how the author thinks and writes, which helps you pick up the material faster. It will be more difficult to acheive the same flow - not impossible mind you (there are many good collaboratively written books) - but difficult.
If you are planning or executing a serious crime DO NOT BROADCAST INCRIMINATING MATERIALS using that text messaging that's all the rage now. Sure it may seem cool, but think about what you're doing.
__ I'm pushing the car and everything thats left into the river now __
__ It is two miles north of the bridge __
__ I hope no one other than you reads this message __
Of course, it would be better to not commit the crime to begin with.
I'll wave the consulting fee since this is our first meeting.
The theory of how the data is stored is important, the actual method is not. For instance, there is no theoretical difference between reading/writing ram, and scanning/punching cards. You can perform the same operations (assuming you can feed the newly punched cards to the card reader). That is why computer theory didn't have to be reconstructed with the invention of the transistor. The more-or-less swapped out all the relay switches with transistor switches - the actual method didn't matter as long as they could use the same theory.
Babbage's engine was remarkable for its time, no doubt. But the big difference between that and what would now be considered modern day computers is the concept of the Universal Machine.
For instance, you probably write reports, listen to music, watch movies, perform complex calculations, browse the web, serve web pages, and email using the same computer. Imagine having a special purpose machine for each of those tasks... and for others as well. That's where Zuse's Z3 and the several computers that followed really forged ahead. They made a structured system to deal with bits, and it was freely programmable above that level. That is a truly amazing and groundbreaking concept that has forever changed the face of society.
To my knowledge Babbage's engine was much more limited. And while it might be called programmable, it certainly was not an all-purpose machine.
The scientific communities virtually stopped communicating before and during the war. We're not talking about German scientists and American/English scientists who would have been fighting otherwise. I'm sure they would have wanted to collaborate with each other to further their knowledge, as they enjoy now.
But if you think a warring nation is going to let its scientists share technological advances with an enemy nation... you get real.
I DO happen to think that Zuse should get credit for the first computer. I remember hearing all that historical stuff about who made the first computer. But then I read what Zuse had accomplished and when he did it. His concepts were way ahead of everyone else. He basically invented the programmable computer. No, its not just like the architecture of our computers today, but he certainly laid the foundation - or would have had his research been shared.
The crazy thing is that he developed all his ideas and machines isolated from the rest of the western world due to the Nazis. That to me is even more incredible. Give him a trophy.
Slashdot Mirror
... a next-generation optical disc format which 'can hold 25GB on a single layer
What they didn't mention is that each disc is 3 meters in diameter.
I understand this is also going to replace RFID tags as a theft deterent.
Someone MD5ing phrases will have to look for months not days.. Change your passphrase like every three months and you'll never have a thing to worry about.
It's a little bit worse than that. You have to remember that as an admin/user, you must win the security fight 100% of the time to remain secure. The malicious hacker must be successful only once.
So if it generally takes several months to recover your password and you change it more often, you still aren't totally safe. It doesn't always require the average time to crack a security scheme. By luck and random chance, some tries will be faster, others slower. After enough tries, the hacker will get lucky and guess your password within a day. If he tries an infinite number of times, he'll guess it on the first try!
In the password and security arena, time is against you.
I read through your posts, and replies, and replies to replies... I just wanted to say thanks for writing everything you have. I've written some posts like yours and answered question after question (which ends up taking a lot of time).
I started to get tired of it, since some people on slashdot think that smart people can't beleive in God, and they are quite willing to attack you for it. But then other people posted defending my position. That helped me much more than I thought it might.
I appreciate your comments and posts. Keep them coming. You seem to be a couragious, smart, articulate, faithful person. Slashdot could use a few more like you.
http://www.oopic.com/
h tml
http://www.acroname.com/robotics/parts/S1-GP-BRD.
These are two microcontrollers for robotics. I have used the OOPIC and heard that the Brainstem is also very good. Both come with sample code. They are an excellent way to start a robotics project.
"The Imagineers who tackled this challenge are thrilled with the breakthrough -- and they're already working on the next advancement."
Next advancement? Are they replacing the payload with a flashlight? Will there still be a boom at the top?
I'm not sure if I consider this progress.
I've used Oracle and MS SQL Server in environments ranging from web sites to enterprise apps. The biggest problems I've seen are not usually problems with these DBMS; they are problems with the application.
I've mainly used MySQL for my large projects, and like you, those projects have not had more than several million entries. But my experience with SQL has been wonderful. I have spent several hours pounding my head on a desk trying to understand why something did or didn't work. But all my applications have run as smoothely and as quickly as one can expect.
I think XML is a step backward, if you're using it to replace a SQL Server database.
I agree - provided your application is best suited for SQL to begin with. There are some small problems where flexibility (XML) is more important than the great features SQL has to offer. I can't see a large number of XML databases at the core of huge operations though.
Oh... I was all ready to thrash you, with my mouse over the reply button and everything. Then I got to that last line about how your entire post was sarcasm.
Whew...
I think relational SQL databases are just fine, easy enough to use, and serve their purpose very well. They DO take some serious thought when designing tables and queries - but we shouldn't be afraid to think. If your head hurts from SQL, keep on it for a couple more minutes and you'll probably have it! If your head hurts from SQL, you've tried thinking about it - and you still don't get it - you're probably in the wrong business. Complex information retrieval is complicated and sometimes difficult to understand.
On to the next part. XML serves its purpose very well. Although I wouldn't consider XML and SQL to serve the same problem sets equally well. There are certain situations where SQL is perfect. And there are other situations where XML is preferable. If you think of the two as two sides of the same coin, I think you're making a mistake. Likewise, you can't just flip between the two on a whim. Choose the format that's most suited to what you want to do and go forward.
It aint broke and don't need fixin'
In another post, I was conversing with someone about how difficult it would be to strip down an issue like security, since it depends so much on knowlege from related subjects. In that respect it does seem odd, and not as rigorous as one might hope.
I didn't think anyone would send me anything weird in the mail...
But I thougt about it and decided not to take any chances.
Be careful with dynamic memory.
Watch for stack overflows.
Always restrict access as much as possible.
Use the strongest encryption available depending on the sensitivity of your data.
Turn off all services that you don't use.
Don't set your root password to root.
Assume every user has bad motives.
Plan for the worst.
Send $4000 and a self addressed, stamped envelope with your name as you would like it to appear on your certificate.
Where did you get that degree?
I went to Drake. They have one or two really good professors who teach you everything, and help when you want to learn something on your own. I hope those professors never leave!
I got thrown into assembly language my first semester of college. Boy was I in for a world of hurt! But I learned a of a lot in that world.
Yeah, I was thinking of all the math that's involved in cryptography. And to really know what you're talking about, you should probably understand the guts of networking, tcp/ip and ethernet inside and out. You should know machine language pretty well too.
The most difficult part about security is that you aren't learning how something is supposed to act. That's the easy part. That's what every programmer does (and what I do mostly). But to really do security, you have to know what could happen and how something might work if manipulated. That's really, really hard when you think about all the possibilities!
I just can't imagine squeezing that all in to a short certificate class.
Many computer security companies hire converted hackers. But others refuse, saying that anyone with that bad seed can't every be trusted. They only hire people who have studied hacking, but have never been a hacker (like graduates of this school).
Like you said, it sounds like a good idea, but there are going to be weak points in your staff if they don't really know what they're doing. For instance, I've studied security from books, and I'm pretty adept at defending my computer. But I know there's a lot that I don't know that I would know if I hacked computers on a regular basis.
I'm offering 5 dollars to help a poor Microsoft programmer attend this school, where he will learn how hackers think in order to stop them. Maybe if we all contribute to the pool, we'll have easier lives.
The name of the certificate is new, but the concepts are not novel.
We went through an entire class about computer ethics. We had to to get a Computer Science degree. And since it was an actual Computer Science degree, we learned all about security and machine language and what have you... basically everyting you would learn in this course.
This program seams like a stripped down version of computer science for people who are only interested in security related work.
Depending on how skeptical you are today, you might think:
Really bad/inexperienced users write insecure code.
Good programmers write good,secure code.
Excellent programmers that work for companies that make a lot of money from support and updates write insecure code that is easy to fix.
how many times have you written part of a report while tired and part of a report while much more awake and had the two parts sound the same?
When I was in college, I wrote a fair share of late night reports. In the morning, when I was clear minded, I would proof read them one last time before printing. On occasion, there would be things in the paper that I didn't even remember writing! And the biggest shock, is that much of what I wrote while sleep-deprived-half-unconscious was BETTER than what I wrote while I was awake!
Sell it back for 100 times what you paid for it...
I just hope they can maintain a strong cohesion with disparate authors. They have the potential to gather many viewpoints (a wonderful tool in teaching) of the same topic so that there are high odds of a reader understanding at least one of them.
At the same time, every truly great text book that I've read has come from a great author. That author has made each chapter build on the one before, and follow a similar form. In other words, buy the second or third chapter, you're starting to understand how the author thinks and writes, which helps you pick up the material faster. It will be more difficult to acheive the same flow - not impossible mind you (there are many good collaboratively written books) - but difficult.
Just to save you all a lot of trouble ...
If you are planning or executing a serious crime DO NOT BROADCAST INCRIMINATING MATERIALS using that text messaging that's all the rage now. Sure it may seem cool, but think about what you're doing.
__ I'm pushing the car and everything thats left into the river now __
__ It is two miles north of the bridge __
__ I hope no one other than you reads this message __
Of course, it would be better to not commit the crime to begin with. I'll wave the consulting fee since this is our first meeting.
The theory of how the data is stored is important, the actual method is not. For instance, there is no theoretical difference between reading/writing ram, and scanning/punching cards. You can perform the same operations (assuming you can feed the newly punched cards to the card reader). That is why computer theory didn't have to be reconstructed with the invention of the transistor. The more-or-less swapped out all the relay switches with transistor switches - the actual method didn't matter as long as they could use the same theory.
Babbage's engine was remarkable for its time, no doubt. But the big difference between that and what would now be considered modern day computers is the concept of the Universal Machine.
For instance, you probably write reports, listen to music, watch movies, perform complex calculations, browse the web, serve web pages, and email using the same computer. Imagine having a special purpose machine for each of those tasks... and for others as well. That's where Zuse's Z3 and the several computers that followed really forged ahead. They made a structured system to deal with bits, and it was freely programmable above that level. That is a truly amazing and groundbreaking concept that has forever changed the face of society.
To my knowledge Babbage's engine was much more limited. And while it might be called programmable, it certainly was not an all-purpose machine.
No one interacted with the Nazis? Oh, get real.
The scientific communities virtually stopped communicating before and during the war. We're not talking about German scientists and American/English scientists who would have been fighting otherwise. I'm sure they would have wanted to collaborate with each other to further their knowledge, as they enjoy now.
But if you think a warring nation is going to let its scientists share technological advances with an enemy nation... you get real.
I DO happen to think that Zuse should get credit for the first computer. I remember hearing all that historical stuff about who made the first computer. But then I read what Zuse had accomplished and when he did it. His concepts were way ahead of everyone else. He basically invented the programmable computer. No, its not just like the architecture of our computers today, but he certainly laid the foundation - or would have had his research been shared.
The crazy thing is that he developed all his ideas and machines isolated from the rest of the western world due to the Nazis. That to me is even more incredible. Give him a trophy.