The real truth in the slides is that the algorithms are expected to have a collision and pre-image resistance that is 1 half the digest size. In this case the 128 and 256 numbers mean that the collision resistance is 2^128 and 2^256.
My current plan already does this and I'm certain it's a basic tenet of all medical insurance plans. After all, most people choose a plan by balancing the up front premium costs with the out of pocket costs on the backend. Der, someone is fibbing. X-/
The Santa Cruz atmosphere is certainly unique, it gives many people the heebie jeebies.
On any given Wednesday (farmers market) you will be bombarded by a litany of drug addled homeless people looking to score some food, cash, or drugs. It is a terrible blight on Santa Cruz and leaves a bad taste in the mouths of those who get out of SC. The streets are dirty, foul odors emanate from the alleys that act as both throughways for local workers and garbage repositories for the restaurants.
Another significant problem with SC is parking, the City owns almost all of it because the zoning allowed builders to do whatever they want, and the City supports the parking load for them. In other parts of the City you must have a given number of parking spaces for a given square footage, it's a zoning requirement, but not in the heart (downtown). So parking is totally jacked up and costs a fortune. If you're lucky, thieves won't target your vehicle. There is only 1 city owned lot that is free to park in anymore, they just added gates to the 3 story garage on Front and River streets.
When strolling down the sidewalks, commuting between the parking lots and work, you may be asked for a handout or assaulted by someone else's secondhand smoke. The City doesn't enforce it's own outside smoking ban, much less enforce the Medical Marijuana statutes, which leaves the rest of us to hold our breath while the dope head in front of us is toking on a pipe.
I have worked in downtown SC on 3 different occasions, and all 3 have left me with the same opinion: it's a dirty and does not convey the clean and inviting atmosphere that businesses -- and their employees -- expect. The sooner I can GTFO, the better.
There are plenty of people who only enjoy watching honey booboo that have the interwebs, unfortunately the rest of us have to suffer the side effects of stupid management.
I'm really baffled how shows like 24 stay on the air for years, and shows like The Agency, Jericho, and Terra Nova get canceled?
I'm sick of the real catty housewives of the next urban location. I'm tired of Dodgy the bountiful hunter, and every lame "re-enacted" reality shows like Operacion Repo.
Funny thing, one of the biggest offenders was called "Real TV", but there was too much reality and they went to "truTV".
Reality happens in real life, there isn't anything "real" on TV, it's either streamed with factual errors and no supporting information, "produced", or "re-enacted", nobody show "reality" because it wouldn't be salacious or dramatic enough.
Let's see, a company who cons small business into bad decisions by taking advantage of their inability to quickly do an ROI and assess risk, is themselves falling ill to their unmitigated growth and overhead.
How much could it cost to run a company that just sells coupons?
The Parallax Propeller is a great multi-core chip to get started with. The chip is $7.95 and has 8 cores running at 80Mhz. You can pickup the Quickstart board at Radio Shack for $40, including an overpriced RS USB cable (they normally retail for $25).
The Parallax Propeller is a much more economical way of getting started with multi-core programming. Parallax offers the PropTool, which provides SPIN and PASM language support. For C development you can get SimpleIDE which is a great IDE to get started with C programming on the Propeller, which uses a port of GCC.
I just reviewed the documentation for the receipt verification, and that process is broken too.
To summarize, you forward an opaque token to the appstore and verfiy success using a simple clear text status flag. This is fundamentally broken because the client doesn't authenticate the source of either piece of data. The original hack in this article is based on a Man In the Middle attack, their receipt verification system is vulnerable to exactly the same type of attack.
The lack of cryptographic hashing and authentication on the client side is a complete failure of Apple's API design. The first step should be message signing and authentication to ensure the server is who the server says they are. Apple is relying on SSL certificates for this role, which I feel is inadequate. The SSL Certificate Authority system has been broken for a long time and reliance upon them to assure authenticity is a Bad Idea(tm).
The concept of centralized CAs is good in theory, but recent events have proven that CAs are easily corrupted by economic, political, and technical means.
I'm sorry, but any way to slice it, that's just a straight up anti-competitive move.
I don't use Meebo, or much care about it, but Google is *clearly* using their might and cash to eliminate services. I can't decide whether it's Google trying to squash tools that marginalize the difference between competing products, thus eliminating any advantages one IM protocol has over another, or they are just trying to remove products from the landscape and further promote the mono-culture they have pushed so very hard.
Android is an utter pile of garbage, having used both Blackberry and Danger, it is a sorry second, but because Google has pushed it so hard, we live in a mono-culture of Android vs iDevice. It's been years, and Android still can't do things in a sane and successful manner, they seem to feel that going against intuition is the best way to innovate. Eliminating well understood UI concepts and relying on quirky interfaces. Apple just confounds me with the "let's take everything out that could possibly add power or confuse", and thus you are left with the "dumb" smart device.
Why does everyone agree with me when I complain about my phone, but we don't have the tools available to make our own good phones? I WANT SEND and END BUTTONS!
I'm excited to find out that Motorola has a semi-native Debian distro hiding under Android on their phones, which is only exposed via webtop. At least it's something?!
Sorry for the OT Rant, but I can't help but go on a tangent once in a while.
I was hoping this would turn around, I'm tired of hearing stories of companies that take gov't money and fold right quick afterwards. That ugly monument to screwing the taxpayers, SolyndraBuilding, irks me every time I drive by it.
I wonder if the neighbor's kids have ever gotten laid.
Them kids just sit in their rooms and play games, smoke weed, and play some more. There is some sort of employment they are involved with, but it doesn't look real stable or regular, certainly not a 9-5 job.
That said, I blame their mom. They are over privileged and simply have to pitch a fit to get what they want, whether it's a new computer part or a car to replace the last POS they bought.
I don't think it was games that did it, I think their mother's lack of parenting and failure to instill drive in them is to blame. Dad is whipped, so he's not much of an influence.
Teach kids right from wrong, learn them some work ethic, and give them opportunity to succeed, that's what I think is lacking.
When I read the article I felt like the world at large has failed. With the resurgence of the DIY genre, why do the young ones have to be ignorant of history? It seems like the intention is to forget all that came before, so nobody can have an original idea. The irony is that many great, original, ideas are a rehash of some previous idea because it was the best way to do something.
As someone who grew up using floppies, building computers, learning to program, and finally leaving that arena to explore a career in one of the oldest professions, metalworking, I have a particular spot for history and nostalgia.
Just because every 14 year old kid has an ARM A5 processor strapped to them doesn't mean the lessons that were learned in the 80's, innovating computers and electronics, aren't just as applicable today.
I feel it takes an appreciation for the classical trades and the way things *were* done, to truly appreciate what we have -- and apply the hard won principles of yesteryear to tomorrow.
Sure, those icons stand for concepts that we rarely use today, but many of them were "obsolete" when they were invented. Further, what would we replace them with, what are the analogues today that people will unmistakebly associate those actions with? What, two fingers making a V? How about a curly swipey gesture?
The world is full of things past and present, let's not throw them away because the "future" beckons "futuristic" notions.
At a time when all of the content producers are crying foul about piracy, they are plundering the pocketbooks of their customers! They want to have their cake and eat it too, eliminate piracy and prevent their customers from seeking value from a disused game.
The used game market allows people who are bored with a game to see value and allow people who want to sample a game they aren't familiar with. This completely ignores the people who are took friggin' poor to pay $60 for a first release title and instead pickup 3 games for the price of 2 at a GameStop sale -- not to mention that the 3rd game they got for 'free' was a turd!
What a great way to encourage repeat customers or to gain a first person sale, knife them in the back!
EA had it right with the "Veteran" guns in Battlefield, but wrong when they required a VIP code to get 6 of the 10 maps (or whatever)! Like I want to pay $18 for a demo of a game and get nickled and dimed to death for the full game!
If they want to sustain this business model, then everyone has to be on a level playing field. The game disc is $5 and is a boostrap playable demo, then you pay $15 to get the full game. Give the disc to another, they pay $15 to get the full game. You can't have your cake and eat it too!
This methodology was tried long ago, it's called HTTP keepalive. The problem is that every blasted selfish client wants to keep your server connections occupied in hopes that you'll be browsing forth within a short period. In the One-Process-One-Connection model, this is extremely inefficient and taxing on the server. The idea of keeping connections open for HTTP kills the multiplexing ability of the server. This is great for IMAP, but sucks for HTTP. HTTP is lightweight, all they are doing is adding some extensions to the original keepalive model, multiple streams on the same connection, and push.
The multiple stream issue doesn't seem like a win because you would need a highly specialized HTTP engine (like Google has probably designed for their search tool) to take advantage of multiple streams per connection. The traditional model doesn't lend itself well to this. The Apache process/thread model would be closer and permit this kind of solution, but typically threads suffer from I/O starvation due to blocking on data. I could also see some caching issues and subquery issues with the multiple stream per connection model.
Of course the push method is really there so Google can use HTTP like other push protocols, but be able to code against HTTP instead of using the other protocols for what they were designed for. Why not put weight behind the protocols that are intended for these kinds of things instead of trying to co-opt an existing protocol to do your bidding? There is already an IMAP-push proposal, which I'm sure would see swift adoption if Google deployed that internally.
I remember some "push" (content) network from the late 90s that went nowhere, had an ex-Cisco or Netscape guy as a co-founder. Push has traditionally been a non-starter because it either is just a roll reversal, or it's an attempt to circumvent the notion that clients are clients and servers are servers.
My favorite example that doesn't get much play is ETRN in SMTP. Basically it's intended to solve the (old) dilemma of dialup mail servers.
The in-computer onboard UPS is not a new idea. I don't see how they could have gotten any patents on it since I used it have one of these (my day might still). The device I saw had a gel cell mounted on an 8-bit ISA card, full length. It had +5/12v pass through connectors for powering the drives and it powered the computer through the main bus. There was more logic to it, as it had some monitoring capabilities too.
What's next, patenting a hard drive on a plugin board? Been there, it was called the Hard Card and put a 20mb HDD in an 8 bit full length ISA slot, a truly neat idea for upgrading old XT computers back in the day. You could make them work with AT computers too by putting a regular disk controller, without a drive connected, on the bus too and the BIOS would see the XT controller and boot from it.
You didn't specify in your question whether they *needed* to access your database to answer a support related question.
I used to work for a webhost, first doing low level frontline support, then later I was the system engineer and head escalation handler.
We never had to detail an official policy on customer data, because it never became and issue. However, it was implied that employees act ethically during the course of business. It is ethical to access your data for the purposes of support, sometimes access is deeper than you would think, due to the issue. Many times support issues are not isolated and require accessing all of the affected services or resources in order to get a clear picture of the problem. When looking over a script, depending on how it was written, a support representative may require delving into additional resources to fully understand the logic flow, or what the data *should* look like when it is operation correctly.
Your question is somewhat ambiguous and leaves out some of the important details, which leads me to wonder if it was a leading question.
I don't work for a web hosting company anymore, nor do I have any alliances.
They probably added indexes because your DB was bringing the server to it's knees. The only reason to add an index is to improve query performance. They may have changed the column for a technical reason, or it could have been another naive type choice on your part.
They should have contacted you about the problem first, suggested a solution, and allowed you to take action. If you chose not to take action (on the index), they may likely do it on your behalf if it's a quality of service issue.
Webhosts look at server resources and quality of service for every customer on that server. If one customer is impacting the quality of service for others, they will take action. No one customer is allowed to monopolize the resources of a server, unless that's what they paid for. Some hosts have more elegant solutions for this problem, while others use a more brute force approach.
Slashdot Mirror
The real truth in the slides is that the algorithms are expected to have a collision and pre-image resistance that is 1 half the digest size. In this case the 128 and 256 numbers mean that the collision resistance is 2^128 and 2^256.
Cell69, because that's what your phones do to make it work.
My current plan already does this and I'm certain it's a basic tenet of all medical insurance plans. After all, most people choose a plan by balancing the up front premium costs with the out of pocket costs on the backend. Der, someone is fibbing. X-/
I have Unagi on my phone and it makes it simple. Yeah it's a bandwidth hog, but a simple and helpful interface.
BTW the paid product placement is lame.
Here's how you win:
Step 1: Ship via UPS with big FRAGILE label on box
Step 2: ???
Step 3: Win!!!
The Santa Cruz atmosphere is certainly unique, it gives many people the heebie jeebies.
On any given Wednesday (farmers market) you will be bombarded by a litany of drug addled homeless people looking to score some food, cash, or drugs. It is a terrible blight on Santa Cruz and leaves a bad taste in the mouths of those who get out of SC. The streets are dirty, foul odors emanate from the alleys that act as both throughways for local workers and garbage repositories for the restaurants.
Another significant problem with SC is parking, the City owns almost all of it because the zoning allowed builders to do whatever they want, and the City supports the parking load for them. In other parts of the City you must have a given number of parking spaces for a given square footage, it's a zoning requirement, but not in the heart (downtown). So parking is totally jacked up and costs a fortune. If you're lucky, thieves won't target your vehicle. There is only 1 city owned lot that is free to park in anymore, they just added gates to the 3 story garage on Front and River streets.
When strolling down the sidewalks, commuting between the parking lots and work, you may be asked for a handout or assaulted by someone else's secondhand smoke. The City doesn't enforce it's own outside smoking ban, much less enforce the Medical Marijuana statutes, which leaves the rest of us to hold our breath while the dope head in front of us is toking on a pipe.
I have worked in downtown SC on 3 different occasions, and all 3 have left me with the same opinion: it's a dirty and does not convey the clean and inviting atmosphere that businesses -- and their employees -- expect. The sooner I can GTFO, the better.
Perhaps we should actively obstruct their communications to Saudi Arabia? Sounds preposterous doesn't it?
Their argument is stupid and pointless.
There are plenty of people who only enjoy watching honey booboo that have the interwebs, unfortunately the rest of us have to suffer the side effects of stupid management.
I'm really baffled how shows like 24 stay on the air for years, and shows like The Agency, Jericho, and Terra Nova get canceled?
I'm sick of the real catty housewives of the next urban location. I'm tired of Dodgy the bountiful hunter, and every lame "re-enacted" reality shows like Operacion Repo.
Funny thing, one of the biggest offenders was called "Real TV", but there was too much reality and they went to "truTV".
Reality happens in real life, there isn't anything "real" on TV, it's either streamed with factual errors and no supporting information, "produced", or "re-enacted", nobody show "reality" because it wouldn't be salacious or dramatic enough.
Maybe they'll come home more often now that they have the bandwidth to research and do remote investigations with Skype!
I read that as "HP not giving up on Lobotomy".
Let's see, a company who cons small business into bad decisions by taking advantage of their inability to quickly do an ROI and assess risk, is themselves falling ill to their unmitigated growth and overhead.
How much could it cost to run a company that just sells coupons?
The Parallax Propeller is a great multi-core chip to get started with. The chip is $7.95 and has 8 cores running at 80Mhz. You can pickup the Quickstart board at Radio Shack for $40, including an overpriced RS USB cable (they normally retail for $25).
The Parallax Propeller is a much more economical way of getting started with multi-core programming. Parallax offers the PropTool, which provides SPIN and PASM language support. For C development you can get SimpleIDE which is a great IDE to get started with C programming on the Propeller, which uses a port of GCC.
Bravo! You have made the beginning of my day!
The title of my next newsletter:
Ruby: A language designed by programmers for non-programmers
Then followed by these illustrious titles:
Ruby: Non-programming for Programmers
Ruby: Unprogramming what you've learned about Programming
Ruby: Lobotomy required
Ruby: Brainfuck for the masses
Yeah, um, ya...
I just reviewed the documentation for the receipt verification, and that process is broken too.
To summarize, you forward an opaque token to the appstore and verfiy success using a simple clear text status flag. This is fundamentally broken because the client doesn't authenticate the source of either piece of data. The original hack in this article is based on a Man In the Middle attack, their receipt verification system is vulnerable to exactly the same type of attack.
The lack of cryptographic hashing and authentication on the client side is a complete failure of Apple's API design. The first step should be message signing and authentication to ensure the server is who the server says they are. Apple is relying on SSL certificates for this role, which I feel is inadequate. The SSL Certificate Authority system has been broken for a long time and reliance upon them to assure authenticity is a Bad Idea(tm).
The concept of centralized CAs is good in theory, but recent events have proven that CAs are easily corrupted by economic, political, and technical means.
I'm sorry, but any way to slice it, that's just a straight up anti-competitive move.
I don't use Meebo, or much care about it, but Google is *clearly* using their might and cash to eliminate services. I can't decide whether it's Google trying to squash tools that marginalize the difference between competing products, thus eliminating any advantages one IM protocol has over another, or they are just trying to remove products from the landscape and further promote the mono-culture they have pushed so very hard.
Android is an utter pile of garbage, having used both Blackberry and Danger, it is a sorry second, but because Google has pushed it so hard, we live in a mono-culture of Android vs iDevice. It's been years, and Android still can't do things in a sane and successful manner, they seem to feel that going against intuition is the best way to innovate. Eliminating well understood UI concepts and relying on quirky interfaces. Apple just confounds me with the "let's take everything out that could possibly add power or confuse", and thus you are left with the "dumb" smart device.
Why does everyone agree with me when I complain about my phone, but we don't have the tools available to make our own good phones? I WANT SEND and END BUTTONS!
I'm excited to find out that Motorola has a semi-native Debian distro hiding under Android on their phones, which is only exposed via webtop. At least it's something?!
Sorry for the OT Rant, but I can't help but go on a tangent once in a while.
I was hoping this would turn around, I'm tired of hearing stories of companies that take gov't money and fold right quick afterwards. That ugly monument to screwing the taxpayers, SolyndraBuilding, irks me every time I drive by it.
I wonder if the neighbor's kids have ever gotten laid.
Them kids just sit in their rooms and play games, smoke weed, and play some more. There is some sort of employment they are involved with, but it doesn't look real stable or regular, certainly not a 9-5 job.
That said, I blame their mom. They are over privileged and simply have to pitch a fit to get what they want, whether it's a new computer part or a car to replace the last POS they bought.
I don't think it was games that did it, I think their mother's lack of parenting and failure to instill drive in them is to blame. Dad is whipped, so he's not much of an influence.
Teach kids right from wrong, learn them some work ethic, and give them opportunity to succeed, that's what I think is lacking.
When I read the article I felt like the world at large has failed. With the resurgence of the DIY genre, why do the young ones have to be ignorant of history? It seems like the intention is to forget all that came before, so nobody can have an original idea. The irony is that many great, original, ideas are a rehash of some previous idea because it was the best way to do something.
As someone who grew up using floppies, building computers, learning to program, and finally leaving that arena to explore a career in one of the oldest professions, metalworking, I have a particular spot for history and nostalgia.
Just because every 14 year old kid has an ARM A5 processor strapped to them doesn't mean the lessons that were learned in the 80's, innovating computers and electronics, aren't just as applicable today.
I feel it takes an appreciation for the classical trades and the way things *were* done, to truly appreciate what we have -- and apply the hard won principles of yesteryear to tomorrow.
Sure, those icons stand for concepts that we rarely use today, but many of them were "obsolete" when they were invented. Further, what would we replace them with, what are the analogues today that people will unmistakebly associate those actions with? What, two fingers making a V? How about a curly swipey gesture?
The world is full of things past and present, let's not throw them away because the "future" beckons "futuristic" notions.
Why is it that Yahoo has job listings on Craigslist? Surely some of those 2,000 had the skills to fill those positions?!
At a time when all of the content producers are crying foul about piracy, they are plundering the pocketbooks of their customers! They want to have their cake and eat it too, eliminate piracy and prevent their customers from seeking value from a disused game.
The used game market allows people who are bored with a game to see value and allow people who want to sample a game they aren't familiar with. This completely ignores the people who are took friggin' poor to pay $60 for a first release title and instead pickup 3 games for the price of 2 at a GameStop sale -- not to mention that the 3rd game they got for 'free' was a turd!
What a great way to encourage repeat customers or to gain a first person sale, knife them in the back!
EA had it right with the "Veteran" guns in Battlefield, but wrong when they required a VIP code to get 6 of the 10 maps (or whatever)! Like I want to pay $18 for a demo of a game and get nickled and dimed to death for the full game!
If they want to sustain this business model, then everyone has to be on a level playing field. The game disc is $5 and is a boostrap playable demo, then you pay $15 to get the full game. Give the disc to another, they pay $15 to get the full game. You can't have your cake and eat it too!
This methodology was tried long ago, it's called HTTP keepalive. The problem is that every blasted selfish client wants to keep your server connections occupied in hopes that you'll be browsing forth within a short period. In the One-Process-One-Connection model, this is extremely inefficient and taxing on the server. The idea of keeping connections open for HTTP kills the multiplexing ability of the server. This is great for IMAP, but sucks for HTTP. HTTP is lightweight, all they are doing is adding some extensions to the original keepalive model, multiple streams on the same connection, and push.
The multiple stream issue doesn't seem like a win because you would need a highly specialized HTTP engine (like Google has probably designed for their search tool) to take advantage of multiple streams per connection. The traditional model doesn't lend itself well to this. The Apache process/thread model would be closer and permit this kind of solution, but typically threads suffer from I/O starvation due to blocking on data. I could also see some caching issues and subquery issues with the multiple stream per connection model.
Of course the push method is really there so Google can use HTTP like other push protocols, but be able to code against HTTP instead of using the other protocols for what they were designed for. Why not put weight behind the protocols that are intended for these kinds of things instead of trying to co-opt an existing protocol to do your bidding? There is already an IMAP-push proposal, which I'm sure would see swift adoption if Google deployed that internally.
I remember some "push" (content) network from the late 90s that went nowhere, had an ex-Cisco or Netscape guy as a co-founder. Push has traditionally been a non-starter because it either is just a roll reversal, or it's an attempt to circumvent the notion that clients are clients and servers are servers.
My favorite example that doesn't get much play is ETRN in SMTP. Basically it's intended to solve the (old) dilemma of dialup mail servers.
The in-computer onboard UPS is not a new idea. I don't see how they could have gotten any patents on it since I used it have one of these (my day might still). The device I saw had a gel cell mounted on an 8-bit ISA card, full length. It had +5/12v pass through connectors for powering the drives and it powered the computer through the main bus. There was more logic to it, as it had some monitoring capabilities too.
What's next, patenting a hard drive on a plugin board? Been there, it was called the Hard Card and put a 20mb HDD in an 8 bit full length ISA slot, a truly neat idea for upgrading old XT computers back in the day. You could make them work with AT computers too by putting a regular disk controller, without a drive connected, on the bus too and the BIOS would see the XT controller and boot from it.
You didn't specify in your question whether they *needed* to access your database to answer a support related question.
I used to work for a webhost, first doing low level frontline support, then later I was the system engineer and head escalation handler.
We never had to detail an official policy on customer data, because it never became and issue. However, it was implied that employees act ethically during the course of business. It is ethical to access your data for the purposes of support, sometimes access is deeper than you would think, due to the issue. Many times support issues are not isolated and require accessing all of the affected services or resources in order to get a clear picture of the problem. When looking over a script, depending on how it was written, a support representative may require delving into additional resources to fully understand the logic flow, or what the data *should* look like when it is operation correctly.
Your question is somewhat ambiguous and leaves out some of the important details, which leads me to wonder if it was a leading question.
I don't work for a web hosting company anymore, nor do I have any alliances.
They probably added indexes because your DB was bringing the server to it's knees. The only reason to add an index is to improve query performance. They may have changed the column for a technical reason, or it could have been another naive type choice on your part.
They should have contacted you about the problem first, suggested a solution, and allowed you to take action. If you chose not to take action (on the index), they may likely do it on your behalf if it's a quality of service issue.
Webhosts look at server resources and quality of service for every customer on that server. If one customer is impacting the quality of service for others, they will take action. No one customer is allowed to monopolize the resources of a server, unless that's what they paid for. Some hosts have more elegant solutions for this problem, while others use a more brute force approach.