All posts by strlen

The IT Crowd

Well, it’s not The Office, but it’s not a bad way to spend 23 minutes of your time. The first episode of a new show in the UK called The IT Crowd is available for download. It’s not entirely clear if they’ll post anything other than the premiere.

Plot Summary:

A couple of socially awkward geeks get handed a new manager who knows nothing about computers, but has aspirations toward corporate greatness. Hilarity ensues.

Facebook? Face Unemployment

We were discussing MySpace at the last Geek Gather, and the potential effect that this (largely) youth culture’s MySpace content will have on their future professional aspirations. Well, Facebook is not MySpace, but it’s a similar idea. Looks like it’s already a reality in some cases:

[Someone important] “said employers will find content they determine to be less than professional or inappropriate, and many students do not realize the consequences.”

Students, please, don’t drink and post!

dyne:bolic – The multimedia OS

Because I like free software.

dyne:bolic is a bootable linux cd built for multimedia. That means you can run it without installing anything. This means you can turn any PC/Mac into a multimedia editing machine without installing a new OS on it. If you’re into text, you can even stream ascii video on the web with dyne:bolic. Gives you that matrix feel for real.

And it’s optimized for old hardware:

“This operating system is designed to run on a minimum of Pentium 1 MMX processor with at least 64MB of RAM (memory), not even an harddisk is needed. It can be used to stream online radio with a Pentium 2 400MHZ or a Xbox game console, all very cheap on the second hand market.”

Oh, if you try it out, post a comment.

OpenSSL Received FIPS 140-2 Validation

OpenSSL, the open-source cryptography libraries used in many other applications, including Apache HTTP, has been certified under FIPS 140-2. If that seems like a fairly random string of information, you’re probably not alone. Here’s why it’s important.

FIPS (Federal Information Processing Standard) 140 provides standards for encryption used in government. That means that, generally speaking, that government organizations require products to be FIPS 140 certified if they use encryption. There are exceptions and waivers, etc, but it’s *much* easier for the organization making the purchase to go with the FIPS product. NIST does the certifying for FIPS, and they certify an implementation of certified algorithms. Got that? They certify first the algorithms themselves (AES, 3DES, etc), then they certify the specific cryptography module’s implementation of said algorithms. NIST has *never* certified source-code. They have only certified compiled modules. The logic here is understandable; if you certify source code, there’s no guarantee that the source code hasn’t been changed prior to compilation.

The good folks at OpenSSL, or at least a few of them, took on that challenge. They built a branch of openssl that contains sufficient checks within the code itself to ensure that the compiled and running code is, in fact, the FIPS certified code. So, NIST has now broken off of their tradition of not certifying source code, and certified OpenSSL.

That means that OpenSSL can now be used in governement applications, which has the potential to save you and I (taxpayers) some money. No longer will agencies using Apache, for example, have to buy a certified cryptography module from IBM or RSA. New applications that are built on open-source can implement OpenSSL and sell to government. All around, it’s good for security.