Microsoft: As of October, 1024-Bit Certs Are the New Minimum 207
way2trivial writes with this snippet from Information Week about a warning from Microsoft reminding Windows administrators that an update scheduled for October 9th will require a higher standard for digital certificates. "That warning comes as Microsoft prepares to release an automatic security update for Windows on Oct. 9, 2012, that will make longer key lengths mandatory for all digital certificates that touch Windows systems. ... Internet Explorer won't be able to access any website secured using an RSA digital certificate with a key length of less than 1,024 bits. ActiveX controls might be blocked, users might not be able to install applications, and Outlook 2010 won't be able to encrypt or digitally sign emails, or communicate with an Exchange server for SSL/TLS communications."
Why 1024? (Score:5, Interesting)
System have the ability to go further, why not make 2048 the minimum? Does anyone know why 1024 was selected? I would guess it has to do with some backwards compatibility with something. Some of the issuers are making it next to impossible to go below 2048.
Re:Why 1024? (Score:5, Interesting)
Thinking much the same thing here as well. Even a CA like GoDaddy won't take anything smaller than a 2k cert key.
Most SSL certs we cook up have a 2048 minimum anyway, and some certs we use have a standard of at least 4096 (I work in the banking/financial industry, so we're used to using the bigger keys).
I'm thinking that they stuck with 1024 because most IIS 7.x (Win2k8 Server) allows for a minimum 1024 key size when making CSRs, and (maybe? can't remember) the really old crap (IIS5 or 4?) won't interpret anything bigger, which means enterprises with those old installs will scream bloody murder if they have to re-key but can't meet minimum length.
Re:Why 1024? (Score:4, Insightful)
Bigger keys in banking? Why do we still have the 14 bit pin codes then...
Re: (Score:2, Insightful)
For the same reason you don't carry a vault in your pocket. 14 bits is enough to protect the $10^3 moving out of your ATM account, but something better is called for when processing $10^9 interbank transactions.
Re: (Score:2)
I'm thinking you must have "refractored" several "pints" there... *hic*
Re: (Score:2)
Why 3 in 1000? 9^4 is more like 6500.
Re: (Score:2)
I am sorry to tell you that Certs are predominately used to secure communication between two points. They can be used for authentication of executables as well as users, and microsoft is pushing this requirement(gradually). To suggest that the selection of certificate bit length is to "pretend" that the are secure is crazy. Can you give an example of how this has been used in the past?
Re: (Score:2)
I am sorry to tell you that Certs are predominately ...
Just an FYI:
(0) kiak /home/keeling_ dict predominately /home/keeling_ dict predominantly
No definitions found for "predominately"
(20) kiak
2 definitions found
From The Collaborative International Dictionary of English v.0.48 [gcide]:
Predominantly \Pre*dom"i*nant*ly\, adv.
In a predominant manner.
[1913 Webster]
From WordNet (r) 3.0 (2006) [wn]:
predominantly
adv 1: much gr
Re: (Score:2)
A ton of money is made by the PC "security" industry surrounding Windows.
Why would Microsoft support an industry that they don't make money from that actually makes their product look bad?
I've been wondering that ever since I first heard of Windows malware. I have to assume either they think it makes them look good ("Oh look, my virus checker stopped an infection, yay!"), or they have no idea how to eliminate the problem (painted themselves into a corner) now that billions of copies of Windows are in the wild.
Re:Why 1024? (Score:5, Interesting)
Re:Why 1024? (Score:5, Informative)
Have a look at http://en.wikipedia.org/wiki/Birthday_problem [wikipedia.org] A group of just 23 people is required to get a 50% probability two people will have the same birthday, despite there being 366 different days in the year. 57 for 99% probability. That equates to 6.3% change, hits 50% probability and 15.5% hits 99%.
If moving to 2048bits makes 15% of the certs in use invalid, the vast majority of your users will be effected.
Re: (Score:2)
Rattling the same response to every user you calls you up is still going to cost in terms of call centre resources.
Re: (Score:2)
Rattling the same response to every user you calls you up is still going to cost in terms of call centre resources.
That's just depressing to even think of. There's this thing out there called the web and on it is a site called microsoft.com. I'll bet they even have a link to "News" there, maybe even "Search."
Sigh.
Re: (Score:2)
Re:Why 1024? (Score:5, Insightful)
It is easy for Microsoft to phase out 768 bit keys; hardly anyone uses them these days. 1024 bit keys are a completely different story; they are widespread, popular, and it is going to be expensive to replace them all. For over a decade, 1024 bits has been the default, and during that time a lot of systems were deployed, including a lot of hardware modules. Some of those systems have the key-length set in stone, and some of those systems are hard to replace (imagine taking a mission critical system down to upgrade your key length -- try selling that one to management).
1024 bit is deprecated, but it is not going to be gone any time soon. There is just too much friction, and too little understanding of why key lengths should be increased.
Re: (Score:3, Insightful)
"Does anyone know why 1024 was selected?"
But one has to wonder why Microsoft is doing the selection.
I'm not Microsoft-bashing here, but if I had an old cert on a site somewhere, there is no way in hell I would update it just to be compatible with Internet Explorer. Let Explorer users do without. I don't care in the slightest.
Re: (Score:2)
Re: (Score:2, Insightful)
"If you want to cut 40% of the internet users off from your content, that's your prerogative."
Yes, indeed it is. But it could be 30%, or 20%, or whatever, if it were some browser other than Explorer. The only reason I mentioned Explorer at all is because it is Microsoft doing this.
But I don't agree with companies using coercive tactics to push a standard THEY decided THEY like. I don't particularly care what standard that is.
Re: (Score:2)
If you want to cut 40% of the internet users off from your content, that's your prerogative.
This's nonsensical.
I don't have a great deal of respect for this cert system you guys use, but since you do, you ought to all be using it in the best way it can be used to protect both yourselves and the users who're relying on your securing of your systems.
You're damned right I care whether my online banking is secure, and if my bank's doing it wrong, you're damned right I'm going to be looking to transfer to one that does it right.
Secure, or convenient? Hmm. "What's the potential downside of convenient?
Re: (Score:2)
"You push a political edge with your comments that I am not quite comfortable answering. I will let someone else start that conversation."
You read far more into my comment than I actually wrote.
There's nothing "political" about it. If I had an old site with an old certificate, I simply would not be motivated to upgrade it just for the benefit of the user of one browser. I could say the same about Chrome or Safari or Firefox.
Now, if several browsers imposed that restriction, I might be inclined to upgrade.
Re: (Score:2)
"The political comment was based on the the opening presented to go on a political rant. The similarities with our(US for me) current climate are quite obvious and very tempting."
Again, you are reading more into it than actually exists. Sure I wrote "Microsoft", but that is just because Microsoft happens to be the one doing it. It could just as easily have been some other browser.
"Your site with the old cert will expire in less than three years from the second I post this comment. This is not something that is happening tomorrow. Your post implies that you would not "upgrade" for the benefit of one user. Why not?"
That's two different issues. So (A) who cares? That's a completely separate issue, and it IS, as you say, 3 years. (B) Because if it's an old site that I have not bothered upgrading to this point, I probably don't care that much about it to support a particular browser anyway.
"Are you saying that you refuse to adopt a standard that progresses the security of our current computing environment?"
Of course not. Where did I actu
Re: (Score:2)
Are you saying that you refuse to adopt a standard that progresses the security of our current computing environment? Because Safari does not support it??? I don't get it... Sorry.
I'll play.
"Are you saying that you refuse to adopt a standard that only purports to progress the abysmal security of our current computing environment, as far as Microsoft Operating Systems and its apps are concerned?"
Yup. If banks can do, and demand, 4096, why can't Microsoft up its game to protect its users and customers?
Honest to $DEITY, I'm not an Apple fanboi, but Apple saw the writing on the wall and made the jump from OS9 to OSX. Why hasn't Microsoft even attempted anything that forward thinking?
Re:Why 1024? (Score:5, Informative)
Re:Why 1024? (Score:5, Interesting)
On Win2000, US lifted export restrictions only one month after Win2000 RTMed in Dec 1999, so MS had to ship the high encryption pack on a floppy disk inside the Win2000 package in addition to making it available for download. SP2 finally built it in.
Re:Why 1024? (Score:5, Insightful)
From reading on the issue, the problem isn't fresh keys, it's older programs and hardware that can't handle anything greater than 1024. Not all of them have the option to handle 2048+. So we have to wait until those are replaced before breaking support for them.
Re: (Score:2)
So we have to wait until those are replaced before breaking support for them.
And they wait with replacing until the software can't support what's needed.
See what I did there? =P
Re: (Score:2)
Hardware can last decades, true, but 'most' of it should be gone within a decade. Not breaking support will slow down adoption a touch, true. But it'll also reduce disruption, and the answer of some companies if MS DID break support would be to stop upgrading(IE no more $ for MS) or switch to an alternative for that function. It's about balance.
Reading up, it's like 8.4M CPU years to break a 1024 bit key. A touch high for expiring data of low marginal worth like your forum logon. You know the military
Re: (Score:3)
Re:Why 1024? (Score:5, Informative)
smart/feature phones
There's your biggest drawback to the 1k keysize. How many of them can handle more then that? Simply put, it's the U.S. Telco's that aren't able to handle anything larger as everyone else offers phones that can handle 2k+ certs.
Re:Why 1024? (Score:4, Informative)
Re: (Score:2)
Read up on the history of PGP. The answer to that will become clear.
Re:Why 1024? (Score:5, Insightful)
Re: (Score:2)
System have the ability to go further, why not make 2048 the minimum? Does anyone know why 1024 was selected? I would guess it has to do with some backwards compatibility with something. Some of the issuers are making it next to impossible to go below 2048.
There is an embedded VPN device (hardware box) that is so old it won't take certs longer than 1024 where I work. I assume a lot of other companies are in the same boat, expensive or simply not made anymore bits of infrastructure using tech that was envisioned as "enough". Stuff that came out during the tech-boom is even worse, where the assumption every company was loaded with cash to spend on IT stuff was sorta true.
I bought a 3 year cert last time around for the device, and have about a year left befo
Re: (Score:2)
Does anyone know why 1024 was selected?
Almost certainly due to the number of 1024 bit certs that are out there.
Most CA's won't sign anything smaller than 2048 bit now, and that has been the case for a year or few, but what about companies that paid an absolute fortune for five year "enhanced validation" certificates or have their own CA for internal use and signed many many keys smaller than 1024 some years ago.
From a security standpoint 2048 should really be the cut-off, as it is elsewhere, but from a practicality view that simply wouldn'
Re: (Score:2)
1024 is much faster: ~x5 less operations. The is also an issue with larger keys (especially with chains) not fitting in the first packet.
More specifically Google still uses 1024 keys (despite the fact you and me can't even get them any more), so not supporting them may have been bigger news.
This was announced several months ago (Score:5, Informative)
Key length is the least of concerns for SSL (Score:5, Interesting)
Re: (Score:2)
There are more keys in use then just for HTTPS.
Custom Packages via WSUS will also be Affected (Score:2)
how to check? (Score:2)
1. Am I correc
Something's not right here... (Score:2)
Re:open source (Score:5, Insightful)
Re: (Score:3)
They present a version of the source code. How do you know it is the version that ships with every OEM and in every COTS box?
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Indeed. I have a copy of the Windows CE 6 source code (or perhaps partial source code - I haven't tried to compile it) on an external drive somewhere. When I graduated, I went through our MSDNAA site and grabbed everything that looked interesting.
I'd be violating all kinds of licenses if I were to release it, probably even if I read it at this point. But they don't exactly guard their source all that well.
Re: (Score:2)
How many students actually evaluate the source in any detail?
The same number as true open source.
Re: (Score:2)
Re: (Score:2, Funny)
Did you oversee Debian's SSH build when they fucked it up?
I did. I'm sorry, but that week the NSA check came late, so I wasn't able to make the compromises less obvious.
They paid up later.
Re: (Score:3, Interesting)
Do you oversee Red Hat's build servers? Did you oversee Debian's SSH build when they fucked it up?
Thanks for so clearly spelling out one of the great advantages of the Linux ecosystem. Namely, that a vulnerability in RedHat isn't necessarily a vulnerability in Debian so the damage doesn't propagate to the overall community of users. That's one of the great things about there being so much diversity and unique approaches to Linux. Again, thank you and I commend you on your evangelism of Linux. People need to know!
Re: (Score:2)
Not true when kernel.org itself gets hacked.
http://www.theregister.co.uk/2011/08/31/linux_kernel_security_breach/ [theregister.co.uk]
Re:open source (Score:5, Interesting)
Not true when kernel.org itself gets hacked.
On the contrary. Which distros actually compiled and released a version of the kernel that was compiled from code downloaded during the window this attack was in effect? If you're running Debian then your kernel is anywhere from just now old to 2 years on the stable version. And if you're doing the right thing and using Ubuntu LTS releases instead of the beta interim stuff then it's the same deal. With Windows, there's only 2 releases to the mainstream. The server and the desktop versions. So whatever kernel MS builds, that's the one everybody uses. With Linux even with kernel.org getting hacked, you have a fighting chance but with Windows, you're done.
Re: (Score:2)
Youre basically trying to defend fragmentation as a good thing, because while some programs might not work across the myriad of versions, neither will the vulnerabilities.
I find this logic lacking.
Fragmentation is a good thing (Score:4, Interesting)
Up to a point fragmentation or variety is a good thing. And not just in software. In agriculture, if your field consists of only one crop, your goose is cooked if there's an outbreak of a plant disease. A country whose GDP comes from a single source, say oil or a single cash crop, is also more vulnerable to price fluctuations in the global market. A crash in the prices of that product would lead to a crash in the country's economy as well.
Too much fragmentation of course is bad. But as far as Linux, the major distros are quite few, namely, Ubuntu, Redhat, Fedora, Debian, and possibly Suse. It's their derivatives that give the impression of excessive fragmentation. Derivatives tend to be compatible with the mother distro at least as far as the installation of third party programs not in the main repository. A binary-only printer driver that can run in Ubuntu would be compatible with Linux Mint for example.
Re: (Score:2)
Re:open source (Score:5, Informative)
Re:open source (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Just because you can find a backdoor doesn't mean you can use it. It as not hard to make a backdoor, that requires authentication. The only thing that is hard is to make a backdoor that is both secure and does not look like it was made deliberately.
Re: (Score:2)
But those people are few and far between and to lesser hackers, there is a huge chasm between that dump and actual source with comments, etc.
If you have respect for variable/function names and comments during code review, then you are a failure at code review. There is a difference between the reading of source code to derive what its expected/claiming to do, and the reading source code to derive what it actually does.
You are right not to trust closed source, but you fail in not extending that mistrust to open source. Faith is not a valid justification for trust.
Open source suffers from quasi-religious stuff too (Score:5, Informative)
No matter how few people actually read through the Linux kernel code, it's sufficiently open that blatant backdoors are not going to be inserted.
Open source suffers from quasi-religious stuff too, as you just demonstrated with your claim. Ken Thompson, of Bell Labs and Unix and C fame - the "K" in K&R, demonstrates the insufficiency of being able to read the source code.
http://cm.bell-labs.com/who/ken/trust.html [bell-labs.com]
The real K&R (Score:4, Informative)
The "K" of K&R is wrong.
"K" is Brian Kernighan. You know, the Brian Kernighan of "The C Programming Language" fame. He wrote a book or two. He's quite famous. Maybe you've heard of him.
Look it up.
Re: (Score:3)
The "K" of K&R is wrong.
Yeah, I actually know that. My 1st and 2nd editions of K&R are well used. I have no idea why I referred to Ken Thompson. I guess I was thinking about C compilers, hacking them, Ken Thompson's paper and had a major brain fart connecting the language and the book. Its quite embarrassing.
Re:open source (Score:5, Informative)
Nice weasel word there. Blatant. What makes you think that if there are backdoors in Windows they're blatent?
Think back to the AARD code, they went way out of their way to obfuscate it. Microsoft would not be so stupid as to put a well commented backdoor in there.
Of course, I'm sure someone will bring up the NSAKEY incident, which various security researches (such as Bruce Schneier) have dismissed as merely allowing the NSA to install their own key to be install for their internal systems without having to have MS sign it.
You do know that backdoors have been inserted into Linux distro's in the past, and some of them took a great deal of time to be discovered. Then of course, one never really knows if a security vulnerability is intentional or not (on any platform).
There have also been some near calls as well in the kernel itself. For instance, who remembers this doozy?
http://www.securityfocus.com/news/7388 [securityfocus.com]
Yes, it was caught, but not because of "many eyes". It was because the attacker chose to try to modify the version control file directly. Had it gone in by some other means, it may not have been caught at all.
Re: (Score:3)
That particular one came down to code standards and review. There's a reason why most coding standards explicitly disallow assignment inside a conditional structure. It's a security hole waiting to happen, just like null-terminated buffers or processing unsanitized input.
NASA's guidelines, for example, are fairly stringent. An attack would have to be very sophisticated, where the attacker would have to know the system fairly well, and insert seemingly-innocuous code in multiple places. It's harder to attack
Re: (Score:2)
Your argument is that because the burglar slipped on the icy sidewalk and broke his neck, it proves your security system works as expected.
Re: (Score:2)
Disallowing assignments in conditions would work too.
Assignments in conditions (Score:2)
Disallowing assignments in conditions would work too.
A lot of C compilers already have compile-time options to warn when the outermost operator in an if or while condition is an assignment. This allows various idioms where conditions have side effects, such as pulling one pointer from an iterator function and then checking whether or not it's a null pointer terminator, while requiring the programmer to make his intent explicit.
closed minds (Score:2)
Open source is great mechanism for finding security holes, but it's hardly the only mechanism. OK, Windows is probably not as secure as Linux, but it's not totally insecure either.
Hey, I live in an apartment that doesn't have the best security, but enough for the neighborhood in which I live. By your logic, I should either beef up security to the max (iron bars on the windows, install a CCTV, maybe get a pit bull) or just forget all about it and leave never lock the front door or window by the fire escape.
Re:open source (Score:5, Insightful)
I don't really understand how anyone can care whether a closed source operating system is secure.
This is so much garbage.
Opensource systems have their share of holes, and the idea that there is a gigantic pool of people qualified to catch backdoors in something as relatively simple as a web browser-- let alone an OS-- is absurd. Just because you can look at the source doesnt mean you can do a remotely competent job of auditing it; and the idea that a single person could somehow audit hundreds of thousands of lines of code for security "on a whim" is even more absurd.
There are a lot of benefits to open source, but sometimes its advocates really stretch the imaginations with some of the claims and accusations they level against proprietary software.
it's sufficiently open that blatant backdoors are not going to be inserted.
So I suppose the whole potential IPSEC backdoor in freeBSD [marc.info] thing was just my imagination, then?
Youre talking nonsense. Consider that OpenSSL is widely considered a horrendously complex pile of spaghetti code, which I believe has had its share of security issues, and yet we still use it. Is it because we're lazy? No, its because sometimes some of this security stuff is phenomenally complicated, and it would take a horrendous number of man-hours from incredibly talented people to refactor or replace it.
One of the benefits of paid software is that, if theyre competent, they can devote a lot of time to it because they are paid. Im gonna go out on a limb here and say that one of the biggest helpers to good code in a lot of OSS projects are the paid volunteers, not the mere fact that its "open" as if that dash of pixie dust makes a project magically better.
Re: (Score:2)
Re: (Score:2)
It doesn't take "a gigantic pool of people qualified to catch backdoors" to fix software bugs. If it did, closed source projects would be inherently hoplessly doomed security wise. What it does take is a few or even just one qualified person to catch backdoors. For closed source, the lure of money i
Re: (Score:2)
I dont disagree with most of what you said, except the general implication that because some proprietary companies suck at security they all must.
Also,
You see, as horrible as the whole situation might be with the potential OpenBSD's IPSEC backdoor, the fact that we know about it gives us the option to audit the code or to outright avoid the code because we know of the potential threat.
Thats true, but youll note that if the accusations are correct (and I see no indication that anyone has actually done the audit, 2 years later), it took 10 years and then the backdoor was not even caught by OSS devs, it was revealed by an insider whose NDA expired.
Re: (Score:3)
It may sound absurd, but reality is sometimes like that. A large portion of the vast pool is called "students" and the more qualified deep end of that pool is called "graduate students", and many thousands are looking at open source software from all angles for their own benefit.
Re: (Score:2)
It might suprise you to know that having a graduate degree and being a good programmer can also net you a job at a company that produces proprietary software. The idea that programmers at Microsoft are all incompetent is partisanship of the most extreme kind; by all accounts it tends to be very competitive and there are truly good programmers there. Certainly noone would accuse Google of hiring slouches.
Why the goalpost shift into absurdity? (Score:2)
Re:open source (Score:4, Interesting)
Certainly noone would accuse Google of hiring slouches.
No, but I would accuse them of having hiring practices that discourage creativity (even if their employment practices promote it).
I interviewed with Google a little while back. Right at the start I told them I was not interested in the job they were offering as it's somewhat "below" what I currently do (and would require moving to a more expensive city for a similar level of pay as what I'm on now). They said they'd like to interview me anyway and perhaps after that offer me a job that would better fit my skills.
The short version is that after going through their rather long and drawn out process, involving mind-numbingly boring "solve this well known algorithm problem" questions, they offered me the job that I said I didn't want. After I turned them down, they then sent me a letter saying that "after consideration, we don't think you're a good match for Google".
Personally, I would've really liked to work there. But NOT as a code-monkey on their generic sites. I'm a pretty good developer (although by no means brilliant); but where I really shine is creating new things from scratch. I'm an ideas person with the technical aptitude to put the ideas in to practice. Their hiring process showed me very clearly that they had no interest in my creativity and only wanted someone who can churn code, find bugs, and patch systems to keep them running (all important; but not the only thing in the world; and definitely not for me).
Paying your dues (Score:2)
Their hiring process showed me very clearly that they had no interest in my creativity and only wanted someone who can churn code, find bugs, and patch systems to keep them running (all important; but not the only thing in the world; and definitely not for me).
I believe it's called "paying your dues", and I believe it's considered standard practice at most major companies.
Re: (Score:2)
Their hiring process showed me very clearly that they had no interest in my creativity and only wanted someone who can churn code, find bugs, and patch systems to keep them running (all important; but not the only thing in the world; and definitely not for me).
I believe it's called "paying your dues", and I believe it's considered standard practice at most major companies.
Actually, I'd say at most good companies, it's understood that someone with significant work experience behind them doesn't start again at the bottom... (especially when you're trying to lure them away from a job they're already quite happy in with no plans to leave)
Re: (Score:2)
I'd say at most good companies, it's understood that someone with significant work experience behind them doesn't start again at the bottom
Even if the work experience is in a different industry, such as accounting software vs. video games? I'm trying to figure out what you meant by "significant".
Re: (Score:2)
I'd say at most good companies, it's understood that someone with significant work experience behind them doesn't start again at the bottom
Even if the work experience is in a different industry, such as accounting software vs. video games?
Yes and no... depending on the actual work the person has done. I appreciate the vast differences between accounting software and video games of course; but I don't accept that someone who has spent ten years working on the networking code of accounting software would need to go in as a junior in the game industry - I'd put them mid-level working on network code in the games (the probationary period would determine if they really can do it or not). If they wanted to completely change over and start doing
Re: (Score:2)
I have recently discovered the benefits of open source by working on Microsoft Dynamics CRM. That is that if you have an enormously complex web app (CRM) you need the source to figure out what the issues are, unless you feel like spending hours on Google trying to debug "An unexpected error has occurred".
Sadly I do not have the source and so my job is made immeasurably more difficult because of it. I'm sure that the quality of any open source product would not necessarily be better, but if there are any i
Re: (Score:2)
I think you're one of those stupid libertarians,
Youre free to think that, but you would be wrong. I do so enjoy ad hominems, though, I find they are a wonderful way to start a post.
so it'll be hard to argue with you as you assume everyone works only for money despite all evidence to the contrary
Everyone assumes things, but this is not something that I assume. You however seem to be making assumptions full steam. Your post isnt off to a good start.
and they will be "qualified" to catch backdoors of varying subtlety.
Read up on some of the articles like "Trusting trust", where one dev did a PoC corrupted compiler that would insert backdoor code into binaries when it saw certain strings. Students generally are not going to be qualifie
Re: (Score:2)
a) if MS hacks you, you'd never know it
You assume that IT folks have no way of tracking what enters and leaves their networks. Maybe that is true in smaller networks, but any larger business with any kind of budget is going to have an edge firewall, and Im gonna go out on a limb and say its not Microsoft's firewall.
b) they have lawyers that will have you run crying to your mommy.
The idea that Microsoft could somehow win that kind of case through the simple merit of its lawyers is ridiculous. Big companies have been brought to unfavorable judgements before, and if the evidence is clear enough theyd probably
Close Goate.cx instead (Score:5, Funny)
Wouldn't be much of an OS if it didn't have a reach-around.
Re: (Score:3, Funny)
With Microsoft products, it always more of a bend-over than a reach-around.
Re: (Score:2)
Re: (Score:3)
That many institutions have access to MS Source Code is kinda like instituting a needle-inna-haystack search.
Yes you might find a needle, but unless you're a needle-collector or perhaps a seamstress what in this universe d'you think you're gonna do with it?
At least with Open Source you can
(1) fix the problem with the code
(2) submit the code back to The Author
(3) expect that The Author will either accept the fix as is or perhaps integrate the solution with more elegance
Sure not *always* but the expectation would be more-often-than-not your fix (in one form or another) reaches the wider community of users.
You also fork the code and encourage people to download the fixed version, or to use your patch against the official sources until the upstream realizes the significance.
Digging through a small patch to ensure it's not overtly malicious is actually pretty easy.
Re: (Score:2)
Multiple providers of SLAs for a FLOSS product (Score:2)
With closed source you can leverage the SLA's between yourself and the vendor
With closed source, there is only one provider of such SLAs for each product. With open source, you can leverage the competition among several companies that offer SLAs for a given open source platform. For example, one can choose Red Hat, Oracle, or Canonical to support a Linux deployment.
Re: (Score:2)
I've run Windows on the desktop (along with Linux and OS X) and have yet to get an infection on any OS since 2001. What's your point?
Muppet administrator = risk, regardless of OS.
Re: (Score:2)
Re: (Score:2)
The apple thunderbolt cinema display is basically the apple equivilent of a dock. It connects to the mac with thunderbolt and magsafe. It then provides a thunderbolt port for chaining further displays (or hooking up other expensive thunderbolt perhipherals), 4x USB and 1xFW800 for your perhipherals and gigabit ethernet for connecting to your network.
I haven't used one myself though so I don't know how well it all works in practice.
Re: (Score:3)
Re:Only 10 years behind the times (Score:4, Informative)
As everyone moves to 2048 bit keys
Re: (Score:2, Informative)
True. ECC is definitely the way forward. NSA has already switched all their systems to it and the DoD mandated that all systems must switch from conventional public keys to ECC by 2010 (2 years ago). Whit Diffie said that NSA insiders told him the same thing (i.e. they trust ECC more). This has lead some to speculate there is an unpublished (NSA discovered) weakness with RSA (a speculation which may have some merit according to James Bamford, who in his infamous Wired article claims NSA "made a huge bre
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You would think that after the successful factoring of a 768 bit RSA modulus, whoever was still using less than 1024 bit would have fixed that. Frankly, 1024 bit should be considered too short for any new applications going forward, but that is still built in to quite a lot of packages.
Re: (Score:2)