Response to PayPal on EV Certificates

Over on the PayPal blog Michael Barrett (their chief security officer) mentions a paper he and Dan Levy wrote extolling the virtues of Extended Validation certificates.

I’ve left a comment there (yet to escape from moderation) questioning the merits of EV and I thought I’d reproduce it here, especially in light of the recent cross-site scripting attack against PayPal through a page protected by such a certificate.
Continue reading

Help Search for the Missing 1999 Mars Polar Lander

The Planetary Societys Emily Lakdawalla has blogged about an interesting project up on their website at the moment, trying to rope in volunteers to help NASA locate Mars Polar Lander using images from the HiRISE camera on the Mars Reconnaissance Orbiter. Emily writes:

What I would really love is if any of you readers out there who wanted to join in the search would write to me and let me know which image you’re searching, or ask me to assign you one, so that we can spread out the effort of all the volunteer searchers and make sure each image is examined by multiple people. I’ve also given some guidelines on how to report anything that you think might be a piece of the missing Mars Polar Lander. So if you want to join in the search, go check out that page.

Currently there are 18 images to search through, and the full resolution JPEG 2000 images are over 1GB a shot..

Old protocols have their advantages

If you were fretting about the Ubuntu mirrors being so slow, remember that the installer defaults to using HTTP, rather than FTP.

Warning: download speeds can go down as well as up..

Adobe Opens Flash 9 Specification (Updated)

As part of Adobe’s OpenScreen project to get Flash onto more devices they have just openly published the Flash 9 specification, with what appear to be no restrictions on their part (that I can see). The OpenScreen site seems to confirm it, listing their moves as:

  • Removing restrictions on use of the SWF and FLV/F4V specifications
  • Publishing the device porting layer APIs for Adobe Flash Player
  • Publishing the Adobe Flash® Castâ„¢ protocol and the AMF protocol for robust data services
  • Removing licensing fees – making next major releases of Adobe Flash Player and Adobe AIR for devices free

This is great news, suddenly Flash becomes an open standard and the projects to create open source viewers for it suddenly should have a lot of the information that they need. It doesn’t remove all the issues though, some of the codecs that can be employed are patented and can themselves attract licensing fees, but it does appear that they are not required (unlike OOXML, which requires MP3 for audio content for example). It also means that people wanting to implement open tools to create Flash content, or export to Flash, will have their job made a lot easier too.

Hats off to Adobe – better late than never!

Update: This also includes the FLV/F4V specification too!

Found via the ever excellent LWN..

Australian “Open Source Industry & Community Report” published

So Jeff Waugh has announced the “Australian Open Source Industry & Community Report” has been published as a PDF (( or you can buy a hardcopy version )), hopefully the first of many.

Come and see what Open Source really does for Australia!

Our conservative projection of earnings suggests that the Open Source industry generates $500 million in revenue each year, with over 50% of that being directly related to Open Source.

The report is covered by a CC license:

The Australian Open Source Industry & Community Report is published as a freely downloadable PDF on the Census project website and is redistributable under a Creative Commons Attribution-NoDerivatives license.

Mac.com email sillyness

You’d have thought Apple would know how to do email right, but sadly it appears not. A message I sent to the Beowulf list today generated a bounce from a mac.com email address back to me rather than to the envelope sender – very naughty as RFC-2821 says:

If an SMTP server has accepted the task of relaying the mail and later finds that the destination is incorrect or that the mail cannot be delivered for some other reason, then it MUST construct an “undeliverable mail” notification message and send it to the originator of the undeliverable mail (as indicated by the reverse-path).

I wonder if they read their Postmaster email ?