LookIt

Not watching security

Now this is just scary. "While most respondents to the Deloitte-Ponemon Institute survey who use cloud services say they include security requirements in service providers’ contracts, 82.6% say they have no program to check for compliance." Why have the requirements at all, then?

A good analogy to the way we update protocols in the IETF

But this is art.

Is there a heaven? I'd like to think so.

Obscure and demented lyrics, wailing guitars, haunted sax: that would be Roxy Music at their prime. Here's a classic In Every Dream Home a Heartache from a concert almost exactly 30 years ago (April 20 1979, Oakland CA).

Names are important, part 1

I remain a Twitter skeptic; the jury is still out on Facebook. Twitter cannot have much of a revenue model, regardless of its population size. Facebook could make it, although the ads they show me (and anyone I have talked to) are embarrassingly bad and therefore should not be generating them much revenue. But that's not what this is article is about.

The relationship between user namespaces and scalability should not be underestimated. Twitter did the same thing that nearly all failed user-centric services did: it created a flat, first-come-first-served namespace. Once paulhoffman is registered on Twitter, even if that person stops using it, that name is gone for good. The canonical example of this problem will always be AOL, where it was not uncommon to have friends who called themselves "sunflower2118" because all possible sensible permutations of their real name, and even their desired alternative names, were taken. The vast majority of these were unused after the first few days, but that didn't matter to the AOL administrators (and appears to not be important to Twitters', either).

Compare this to Facebook. The namespace is completely elastic, and name overlap is not a problem. I recently started playing my old guitar again, and wanted to see if my first (and only) guitar teacher was online somewhere. I looked up "Erica Hamer" on Facebook, and there are seven. Each one is listed with her name. It was easy to determine that none were her (either by location or age). But this also means that, if she joins the rest of us in the "old fogies" category on Facebook, she can join using her real name.

My prediction is that the bad namespace choice is just one of the things that will maim Twitter (it will never die, but it will lose its late-round investors a ton of money). The good namespace choice for Facebook won't save it, but it will certainly make it more palatable to a much, much larger audience than if they have chosen a flat and limited space like Twitter (and AOL before it).

For what it's worth, I readily admit that Gmail is an exception to this rule, but not completely. You can make your Gmail name quite long. Further, you can use periods to separate parts of the name (so that someone can be "joe.smith.in.huston". They will hit the namespace limit well before they would want to, and it will be quite interesting to see how the normally-creative Google folks decide what to do, if anything.

OpenSSL adopts partially sane numbering policy

According to this, the next version of OpenSSL will be 1-point-something, not 0-point-9-point-something. That's the good news. The bad news is that it might be 1.0.0, not just 1.0. For a security package, it is sad that stability of numbering has not been a high priority.