Other articles

  1. Security by number

    2014.12.04

    The prior observation leads to a very simple, very high performance design for secure storage.

    We could take the abstract notion of a single big number as a key, and omit distinct access-checks. For example, if an object were stored under:

    http://bannister.us/storage/7A1DD621-BA6D-414D-9BEC-48F38431314A

    If you did not already have the number (a UUID in this case), the odds of your guessing the right number are essentially none. So simply storing an object under a big number is secure.

    The problem with this scheme is that it leaks over time. You can only “find” objects if you already have the number. You would first get the number only via some authenticated path. But once ...

    read more
  2. Security in numbers

    2014.12.04

    Security, and more specifically - access control, is all about numbers.

    To obtain an object out of secure storage, you need a key. In the software world, this key usually has two parts.

    The first part of the key goes by various combinations of modifiers: access, authorization, ticket, token, identity, and security. At base, this key identifies who you are, and is usually deriven from a username/password. The username/password is also just a (big) number, encoded in ASCII (usually). If guessing the first key is hard enough, then the storage is considered secure.

    The second part of the key identifies the object within storage, and for ease of use is usually the same for all users. This is the ...

    read more
  3. Rain Inflection

    2014.11.30

    Sunny earlier this morning. Was going to take a longer hike up Saddleback Peak. Heavy clouds outside now, offering bits of rain. Paused.

    Work is at a similar point. Might solve a problem in a new market segment for a very large company. Spent months building an initial version, recently presented to customers, all of which went very well. The amount of revenue at risk makes anything I might get paid a rounding error.

    Or not. Companies are social organizations, at times driven by emotion and ego as much as reason. This could all go to nothing. Which will prove true, I do not yet know.

    Given all that needs done, I should be working through to the priority bits ...

    read more
  4. Family Thanksgiving Dinner

    2014.11.27

    Thought we should make an attempt at a coordinated “family” dinner, this time around, as a practice for the future. Dividing up the work should make the event easier. Also a gathering at my house burns less money, and is far more practical as the number of kids increase.

    My middle kid - Cedric - has learned quite a lot about cooking in the last several years, so he can do much. So Cedric and I went shopping for supplies the day before, and split the load so he could do some prep at his place beforehand. Missed a few bits, but this generally worked.

    (I also used the opportunity to “kidnap” my grandson, with which he was entirely fine.)

    The last ...

    read more
  5. Keep up

    2014.11.25

    Question asked by a coworker:

    How do you keep up?”

    I was … puzzled. Perfectly sensible question. I am in my late-50s. He is likely 20 years younger - old enough that technology changed substantially within his time. Lots of older folk get fixed on past patterns, and have trouble adapting to changes … and my field advances steadily. We met on visit to a (very large) customer, where I was bringing a first, early solution to an domain where most everything was new.

    A reasonable question, but why did I have no immediate answer?

    I have never felt the need to “keep up”. Why?

    Ever watched a surfer ride a wave? If you “catch” a wave - match speed with the front of ...

    read more
  6. Inflection point

    2014.11.23

    At an interesting point. Two paths for my near future. One is intense work over a year or more, of benefit. Other is changing jobs. Which is yet unchosen.

    The intense path means writing software for new usage, in a very short timeframe, working mostly by myself, with my work going direct to the customer into critical usage.

    Also this is pretty much dead center on what I can do. Sounds like fun.

    As a part, could end up presenting at a conference, with between a few hundred and a few thousand in the room. Never done the like. In the past, such prospect would have been slightly terrifying. Now, the notion does not bother me at all.

    Will also ...

    read more
  7. Openstack

    2014.11.23

    Moved my writings about OpenStack to a distinct weblog.

    My current employer sells components you might use to build a (software/hardware) cloud. There is a huge amount of business (translation: dollars) in that space. I need to tell a coherent story in that space, so thus the distinct space for writings.

    read more
  8. Multiplier

    Read The Mythical Man Month quite a long time ago. One of the assertions in the book, since much repeated, is that “super programmers” are an order of magnitude more productive than average programmers.

    While I know that I have always been more than usually effective, an order of magnitude felt like an overstatement.

    The last project offered two examples that seem to confirm the multiplier.

    At the beginning of the project, I assigned the simplest part of the project to the team member whom I suspected was the least capable (and who later became the group manager). A few months in he was joined by a new hire just out of college. Their assignment was to write a thin ...

    read more
  9. Conversion

    Converted my weblog from WordPress to a Pelican (a static site generator), recently. Did a bit of clean up today. The original conversion (several weeks ago) was very rough. Better … but still needs work.

    Several years back I bet on WordPress as an intermediate solution. Looking at the implementation, I never trusted WordPress to be secure … and it was not. (Never put your code into the web-addressible / writable space.) A weblog is not exactly mission-critical. With offline backups, it was good enough.

    Still, the poor performance and regular corruption was an annoyance. The static weblog generators improved over time. Time to move over.

    Apologies for any (very likely) broken bits. :)

    read more

Page 1 / 89 »

blogroll

social