Viewing profile — cscott

Decisions were made about certificate revocation based on assumptions about this code and Akamai customers ended up being exposed. Perhaps third-party security validation of such a…

It comes down to intent. There are two distinct ways to evaluate Akamai's patch: 1. Did Akamai release the PoC patch to start a discussion about how to protect private keys and sha…

No doubt. Those who do not follow police officer instructions to produce identification, even in states without "stop and identify" statutes, will find themselves risking an obstru…

Unless the state has a "stop and identify" statute on the books, you cannot be arrested for refusing to identify yourself. 24 states have such a statute. My new home state, Califor…

Thanks for the feedback! The assumption is that you should consider your source code open and exposed to inspection by an attacker, not that it has been compromised. As a result, i…

I'm concerned about the lack of revocation that comes with bundling a key in source. Shouldn't you warn people in your note that if the key is compromised, you're going to have a d…

Right you are, sir.

This is simply a re-application of device fingerprinting and voice verification that many banks are using to secure online banking. There are many things that can go wrong here, ba…

As a hiring manager, my experience has been the opposite. When hiring staff members that need to be able to write documents as part of the job and explain things clearly, the cover…

Talk about contributing to the public health problem in our ERs. Emergency medicine in the US is in a horrible state. Overcrowding is one of the primary reasons. See: http://www.am…

Employee performance reviews that enforce an arbitrary curve-based ranking or grading system often to do more harm than good. I have seen employees who have performed well all year…

Great story, and my favorite part was the link to the Slashdot iPod release story: "No wireless. Less space than a nomad. Lame."

Agreed. I don't think there was any intentional deception either. However, don't forget the influence of the lobbyists hired by the security industry. Additionally, "non-profit" or…

Executive orders to impacted entities would involve a much more formal chain of command and control than a direct kill switch from White House.

There is a significant momentum building for stronger executive control over Internet connectivity to private-sector networks that are designated as "critical infrastructure." The …

The key point of the article: "What's much more likely is that the Web, through its links, and Google, through its search algorithms, have inadvertently set into motion a very stro…