It sounds like he's in the "all or nothing" camp. More than anything else he just needs to figure out that we're out to accomplish the "right" thing not the "best".
I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of our members use that single username.
Yesterday while we were surfing the web (checking mails) usi...
Back on the topic of comment-chat... I find it mildly irksome that the "would you like to move this to chat" prompt remains after I've already moved it to chat.
@thisjosh that's correct. Also, editing requirements are lower. It's really an issue of marking it as a "list-of-X" question, dont expect a "correct" answer.
thing is, it functions on a pretty "dumb" logic. Even with all its claims of multiple scanning engines, etc, it really is only 2: syntax, and source-sink traces.
I would definitely use it, as a starting point, if I didnt have anything else.
so, the thing is, even if you spend a lot of time tweaking the "rules" (not much you really can tweak, you're very limited in your control), you're still only aiming for the (very) low hanging fruit.
again, sometimes thats what you need, and anything beyond that is a waste of energy.
and, if thats what you need, it can do the job, <strike>remarkably</strike> passibly well.
it does have some advantages... pretty much the widest coverage of the most languages, for sometimes low values of coverage... (e.g. it "covers" SQL and classic ASP, but very minimally)
I also freely admit that part of the reason my despising (whats the noun for that??) of most code scanners, is being focused on fortify (besides me using it the most) is because of their market perception of being the leader by far.
hehe - jumping ahead!
@thisjosh also, before I condemn (or condone) Fortify (or any other code scanner) for a specific use, I would have to ask what the specific use is.
if it's for compliance, e.g. PCI 6.3... sure, why not. just expect to spend quite a bunch of time on it.
if it's for baselining, and bringing a completely broken product up to (sub-)par, it can do that relatively easy.
(btw, thats what I spend most of my Fortify time doing... )
so yeah, if everybody runs Fortify, then running Fortify is a great way to be equally secure as everyone else. Some value in not outrunning the bear, I guess...
hmm, @Rory I think it's time for a corrolary to AviD's Law of Compliance....
@Rory, how's this sound: AviD's Theorem of Code Scanning: if everybody runs Fortify, then running Fortify is a great way to be equally secure as everyone else.
@thisjosh heh, what now? That's.... actually an interesting idea.
in fact, Ive advocated that (well, not that, but similar). This goes towards risk management - it IS important to focus on the MOST important ones first, before all the others.
I am not getting the real world usage scenarios of both these cryptography methods,can any one please brief their working with examples and also their usage in real world.
@AviD Yeah - I felt the same way. But do we have a question like that yet? It is an important question after all. Kudos to the answerers
If we can't find a dup, it is useful
I wish it was easier to find dups... Maybe we want a tag to help find these simple ones? Not sure what thought
Contrast it with all the folks that think they know what their question is, but instead lead us on a wild goose chase to figure out they don't know or won't tell us....
I seem to remember a q like that from early days, but I wasnt able to find it.
@nealmcb lol, yeah...
@nealmcb I agree with @Jeff, and think we should not use "meta" tags. i.e. tags that describe the question, and not the content of the question. like "beginner", "advanced", "homework"...
@nealmcb but is it? (an important question). If it's so trivial, not only does one not need to google it, but there is a wiki page on that specific topic, and it explains it so simply and well - does it really belong as a Q&A?
@Iszi this guy is really giving you a run for your money, on the longest-post-ever contest... ;)
note: A lot of these questions on the WebID side are answered in the Foaf+ssl FAQ.
BrowserID versus WebID: is the distinction real?
BrowserId (detailed spec) is an experiment at Mozilla labs, is very new, not fully defined (exactly how the e-mail servers public key should be found is not speci...
Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the DNSSEC Root Keys are secured. Obligatory wiki entries. Does anyone know of any commercial or open sou...
I guess.... I am also trying to leave "signposts", to preempt additional questions of the sort - but then yknow what they say about premature optimization....
I love this comment from @ThomasPornin: "Also, a "silver bullet" is a way to kill werewolves. It is an "ideal solution" only if your idea of medicine is shooting patients.)"
It is mostly untrue. Using a compiler of a different version than the one used for the "mainstream" binary, or using it with different compilation flags, may result in a few things ordered differently, but chances are that most of the code elements will appear in the same order. Insofar as it cha...
Too bad he was commenting on his own use of the phrase....
I am not getting the real world usage scenarios of both these cryptography methods,can any one please brief their working with examples and also their usage in real world.
