![]() |
Friday, June 21, 2002 |
Brian Jepson: Rotor for Linux [Sam Ruby] 11:42:34 PM ![]() |
Fuzzygroup :: Radio UserLand FAQ a useful Radio FAQ. 11:40:08 PM ![]() |
Forbes Jun 21 2002 9:38PM ET [Moreover - Bay Area news] Not sure if it has any connection to housing prices, but here it is anyway. 11:31:38 PM ![]() |
The daily Review (Hayward) Jun 21 2002 4:19PM ET [Moreover - Bay Area news] 5:34:23 PM ![]() |
Culturecide [The Register] Tough break for Rusty -- SomaFM shuts down because they can't afford the new royalties. 5:33:19 PM ![]() |
Switching from the PC to the Mac is relatively painless for many users--that is unless they want to import their Windows Outlook data into Entourage X. Bottom line: it's ugly. Fortunately, an independent AppleScripter, Paul Berkowitz, has stepped forward with a solution. Dale Dougherty tells his story. [O'Reilly Network Articles] 5:19:07 PM ![]() |
Also added a link to a page of related sites, as generated by Radio Userland's myWeblogNeighborhood tool. 3:32:11 PM ![]() |
I added a Usage Stats link to the page -- now you can see who else is visiting. 3:18:39 PM ![]() |
Open source Java e-biz. Mike's post about open source Java workflow engines highlights a trend I've noticed recently. You've heard a lot about open source Java software at the tools level - class libraries, appservers, IDEs, code generators, and build tools. But recently, open source Java has been moving up the chain - towards the business application area. You won't find a complete and ready for deployment open source Java e-biz solution yet, but you will find some key components. Here are some of the pieces:
10:35:40 AM ![]() |
RSA touts DIY certificates. Certifiable decision [The Register] Now you can run your own CA! Revolutionary! Really disappointing that this is the best they can do. We've waited for years for X.509 to catch fire -- and so far haven't seen much smoke. Now, developers say that security is web services biggest stumbling block. Will X.509 answer the call as most technologists seem to think/want? I don't think so. The operating model commonly used around X.509 is lame -- far too cumbersome and expensive to set up and maintain, and a poor fit the requirements in most real world settings. Hence, the rather lack luster level of adoption -- considering that security still ranks as one of the top problems on the minds of businesses and consumers using the Internet! Either the problem doesn't need solving (a possibility) or this doesn't solve the problem. It's probably both to a degree, but here's why I think it's the latter: the current model is built around two bad assumptions: The first is that trust should be centrally managed and expressed as hierarchies. This works poorly for the same reason that communism worked poorly: things work better when the people on the spot have the authority to make decisions and responsibility for the decisions. With a decentralized model, you'd get more flexibility *and* better security. The hierarchy just gets in the way and makes the system more brittle. Trust should not be centralized. The second bad assumption is that the parties involved are mostly offline. For whatever reason, most certificates are created with relatively long validity periods (~year). It's actually one of the really cool things about pki that you can make these public assertions that everyone can verify and that, despite being purely digital, are completely unalterable. This is really valuable for a lot of things -- but bounding a trust relationship with a time period isn't one of them. But the truth is that trust relationships are subject to immediate cancellation and actually might fluctuate from hour to hour (e.g. only the on-duty nurse should be able get meds). So trying to build trust system around a static and long-lived certificate has led to some unnatural acts (CRLs and OCSP). I'm not the first to point these out -- notably Ellison and Rivest had a laundry list of problems that guided they're design of SDSI. Sorry to see that nothing has come of SDSI -- Because where X.509 has been a little ungangly for SSL and B2B applications, it will prove to be utterly useless for web services *if* web services are ever to live up to the hype about loosely-coupled, dynamically constructed applications. 10:21:56 AM ![]() |
Study: Security Worries Holding Back Web Services. XML security market to grow to $4.4 billion by 2006, according to ZapThink. [Yahoo News Headlines - XML] 7:04:28 AM ![]() |