Josh's Blog

So I finally bought a Wii this weekend. My Gamecube started making a horrible noise, so it was a perfect opportunity.

I have decided that wiimotes weren't accidentally slipping from people's hands, they were throwing them at the TV. Countless childhood memories of rage came rushing back while playing Wii Sports. I fondly recall yelling at the TV while playing Super Mario Brothers so long ago, knowing full well the NES had some sort of grudge against me. Sometimes the NES controller would manage to hit the TV screen, luckily back in the CRT days, this didn't matter much. These days I have two things on my side though.

1) I throw like a girl
2) The TV is 10 feet away and hangs on the wall (see #1)

It should be interesting to see what sort of clever games come out in a few years, as one can compare the huge leaps in gameplay from Super Mario Brothers to Super Mario Brothers 3 on the NES.

Is Open Source Software Secure?
This week there was a story posted to Slashdot titled How To Argue That Open Source Software Is Secure?. Quoting the post:

... saying that they were warned that they are dangerously insecure because they run open source operating systems or software, because 'anyone can read the code and hack you with ease.'

This issue seems to keep coming up from time to time. This argument is of course silly and one of those "Prove it ... you can't? So it's true!" There is no way to prove that a piece of closed source software is more or less secure than a given piece of Open Source Software. If you can't see the source, you can't be certain that the vendor did or didn't fix issues. You need to unconditionally trust your vendor. If the source code is wide open for anyone to see, it keeps the vendor honest. You can't sweep issues under a transparent rug. You can try, and maybe hide a few piles of dust, but the really scary piles of dirt will stick out like sore thumbs.

The issue at hand isn't is application A more secure than application B, but do you trust vendor A more than vendor B?

Wow, I've been lazy this 2009. So here goes my first blog entry of the year.

Encryption Security
With all the recent talk of encrypting hard drives, the cold boot method, and using proper passwords, this xkcd comic reminds us of the weakest link in all cryptography, the person with the password:
http://xkcd.com/538/

Running things as root is a bad idea
While I always knew this, this article still sort of blows my mind:
Windows Security Improved By Denial Of Administrative Rights
To quote the article:

... configuring users to operate without administrative rights mitigates the impact of 92% of "critical" Microsoft vulnerabilities ...

92%, that is mind boggling. It's been sound advice for a long time in the Linux world, not to do things as root. I suspect if we expected everyone to be doing everything as root, virtual any minor security flaw would suddenly become a very serious matter. ... 92%!, just WOW.