Interesting paper on how to use memory errors to attack a virtual

Monthly reports on security and non security-related items, such as analyzing SSL webserver usage, apache module usage. Very interesting. I like to see Apache having almost 80% of the market share now :-)

“99% of SSL users have no idea how SSL works and consequently make informed decisions”

A great (old) post to Risks 22.74 about the past issues with designing solutions to buffer overflows in hardware. Also, a link to a paper describing the history of these efforts that I’ll be looking to check out.

I still run into people who believe that PKI is a viable end-user authentication solution for the masses. My favorite were the systems that tried to solve the certificate portability problem by allowing download of certs from a website – with only a password! The vendor couldn’t see that it was no more secure than the password itself. Another case of “But this one goes to 11”.

And now candidates are crying “security” to win elections… It works on both sides apparently.

An update to this story: As of Sept 2004, a heavily-redacted report was released that reportedly found fault with some of the RCMP’s handling of the case, but, according to the CBC timeline, claims that the RCMP did not know that the US was planning to arrest and deport him to Syria.

Catching up on draft postings, this is one that is very timely today, although it was originally penned over a year ago.

This is a great site that will show you who your legislators are by submitting your 9 digit zip + 4.

If you have fond memories of recounts from the 2000 election–I know I do!–then you need to see this film. The 2004 election is going to be _worse_ because of the explosion of electronic voting machines that do not produce a Voter Verifiable Paper Ballot. Without a non-electronic storage mechanism for recording official vote tallies, there will be NO WAY TO HAVE A MEANINGFUL VOTE RECOUNT.