Global Quality Journal

Over Half of SSL Sites Unsafe?

Netcraft:

A new internet browser, Comodo Dragon, reports that more than half of the world's valid SSL certificates are unsafe.

Comodo Dragon is based on the open source Chromium project, but includes additional security and privacy features. In particular, when a user browses to a site that uses a domain-validated SSL certificate, Comodo Dragon will warn the user that the site may not have undergone trusted third-party validation. 

Users are presented with buttons to "Proceed anyway", or go "Back to safety". The warning message explains why such a site is deemed to be unsafe:

The security (or SSL) certificate for this website indicates that the organization operating it may not have undergone trusted third-party validation that it is a legitimate business. Although the information passed between you and this website will be encrypted, you have no assurance of who you are actually exchanging information with, and many websites connected to cyber-crimes use this type of security certificate. Prior to exchanging sensitive information including login/password, personal identity information, or financial details such as credit card numbers with any website that generates this warning, you should find some alternative method of validating this business or consider abandoning the transaction.

Mainstream adoption of this behaviour would have a huge impact on e-commerce — more than half of the SSL certificates in use on the web are domain-validated, and this market continues to show strong growth due to the generally lower costs and ease of issuance when compared with organisation and extended validation certificates.

However, none of the popular browsers provides an explicit warning when browsing to a domain-validated site. With such widespread use of domain-validated certificates, it would undoubtedly lead to uproar if any of these browsers were to display warnings when users browse to domain-validated sites.

Although Comodo states that many websites connected to cyber-crimes use domain-validated certificates, Netcraft's phishing site feed shows that only 0.3% of reported phishing sites use HTTPS, including those running on compromised servers with SSL certificates already in place.

Netcraft found 683,563 valid domain-validated certificates in its March 2010 survey. Go Daddy has issued more than half of these, which it currently sells at $29.99 per year for new purchases.

Comodo itself is also a sizable player in the domain-validated SSL market, accounting for 7.6% of all domain-validated certificates. Ironically, domain-validated certificates signed by Comodo are also reported as being potentially unsafe, including those sold via hosting companies such as DreamHost.

DreamHost's CTO, Dallas Kashuba, told Netcraft: "I think the information being presented about the nature of the SSL certificate is useful, but the approach Comodo has taken to present the information is heavy-handed and seems a bit too close to "crying wolf". I worry that users of the browser will see that warning so frequently that they will become desensitized to all warnings." [Read more]

posted by: gqjournal

Theo Schlossnagle: Cheap bandwidth, Hardware and Programmers Are Not Enough

Theo Schlossnagle, CEO, OmniTI argues in a blog post quoted below that cheap bandwidth, hardware, and programmers are a mixed blessing and by no means are a substitute for good scalable design. Effective management of resources will win the game. Nevertheless it says a lot about the less than mature state of our industry if such a well-recognized expert as Theo Schlossnagle has to argue for a self-evident truth about the need to think about performance  of the critical components early on in the development process.

CNNMoney.com:

...There is a famous quote in computer science attributed to our patriarch Donald Knuth of Stanford University:

“Premature optimization is the root of all evil.”

This, however, is a snippet that abuses and misses the larger point from Knuth’s full statement:

There is no doubt that the grail of efficiency leads to abuse … We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil. Yet we should not pass up our opportunities in that critical 3%.  A good programmer will not be lulled into complacency by such reasoning, he will be wise to look carefully at the critical code; but only after that code has been identified.

In other words, 97% of the time, we waste too much time worrying about small efficiencies.  But the other 3% of the time, what I argue is the most important 3%, we fail to make small, vital optimizations that prepare for the onslaught of traffic that we’re trying to generate.

The “tech side” of the industry continues to believe that because computers are getting faster and cheaper, it is better to innovate without optimizing because it enables them to get to market faster and optimization was something they could fix if it became a problem.

In my experience auditing and providing guidance on building websites, failure to find and correct that all-important 3% results in rampant inefficiencies: too much equipment provisioned, outrageous bandwidth usage, frequent and prolonged outages, overstaffing, and a loss of agility, resulting in an acute and profound loss of competitive advantage.

With programmers, hardware and software in abundance, it is easy to manage Web projects as if the 3% can be erased with more elbow grease.  Such a backwards looking, “I’ll fix it when I need to” approach is a recipe for disaster. [Read more]

posted by: gqjournal

How Software is Built Interviews Jason Huggins – CTO of Sauce Labs / Selenium

How Software is Built:

Interview with Jason Huggins – CTO of Sauce Labs / Selenium

Testing a web site against multiple browsers has been a long-time challenge of
Web development.  In this interview, Jason Huggins, CTO of Sauce Labs,
explains how the Selenium project makes multi-browser testing much faster.

• The creation of the Selenium web-testing tool
• The Sauce Labs startup around Selenium to run testing on cloud systems
• Automated web testing with Selenium
• Taking Selenium beyond testing into software documentation and marketing
• The revenue and business models of Sauce Labs
• The maturation of Selenium beyond predecessors and into the emerging cloud ecosystem

[Read the whole thing]

posted by: gqjournal

Nationwise Verizon Outage Due To "Bad Switch Software"

Is this a sign of the predicted Mobile Warming? Looks like it. Verizon says that the cause of the outage is in "bad switch software". It would be interesting to learn what this actually means.

www.csmonitor.com:

By Matthew Shaer
posted March 3, 2010 at 9:46 am EST

Hundreds of consumers are flocking to online discussion boards to report a Verizon outage across the carrier's network, a problem that Verizon says it is working to fix. Outage time appears to vary, but some Verizon users say they have been unable to access the Web or email for hours. Crucially, the issues center on faulty Internet and data connections – Verizon phone service appears to be unaffected.

"I haven't had Internet or email access all morning (4:30 am EST when I woke up). How sad that this could happen," a user in Cincinnati wrote today on a Droid forum. "How pathetic that Verizon doesn't post something up on their site." Judging by the message boards, the Midwest and South seem to have been hit harder by the outages than the coasts. "Mine started going haywire last night," an Indiana Droid fan posted this morning. [Read more]

posted by: gqjournal

Wachovia Site In Trouble

Business Insider:

posted by: gqjournal

Mobile Warming and Wireless Network Meltdown

Business Insider:

2010: The Year of 'Mobile Warming': The Inconvenient Truth about Telco Network Bandwidth and How It’s Failing You

Have you or anyone you know ever experienced a dropped call on the AT&T network in a major US city? If so, you may be a victim of mobile warming. Whether you’re a leftist liberal or a die-hard conservative, we all know Mobile Warming is happening now and will only get worse.

Mobile Warming is the biggest problem facing mobile providers and users in the next two years. Wireless networks are melting down. Thanks to the explosive growth of demand for mobile video and data traffic, top metro areas in the US are already full of frustrated users with constantly dropped calls, slow connections, long video buffer times and an inability to connect to mobile apps at peak times. And if you think it’s bad now….just wait. New applications like video calling and the addition of Adobe Flash on some high-end phones mean that networks will feel more strain than ever. A recent research report released by Cisco found that mobile video will represent 66 percent of all mobile data traffic by 2014, increasing 66-fold from 2009 to 2014. [Read the rest]

posted by: gqjournal

Bringing Sophisticated Performance Testing to Open Source

GQJournal news:

jUDDI-v3.0.0 Holds Its Own Under Load


jUDDI release 3.0.0., the open source Java implementation of the Universal Description, Discovery, and Integration (UDDI v3) specification for Web Services, held its own under a stress and load test of over 400 transactions per minute. The performance benchmark was developed in 2009 and executed in December of 2009 by a team of jUDDI sponsors -- Global Quality Partnerss, LLC and Xceptance, Inc. The system configuration under test was JBOSS 5.1 (the CXF web services stack) and jUDDI 3.0.0. Red Hat Enterprise Linux, MySQL.

posted by: gqjournal

Measuring Server Energy Efficiency

Measuring energy consumption is cool and dandy, but this is a secondary step, the primary stet is measuring the efficiency of work capacity of a given system. A better architected system will deliver a better work efficiency from the same hardware and will save energy by default.

DeepTech:

Benchmark group tackles server energy efficiency
by Stephen Shankland

The Transaction Processing Performance Council has released a new benchmark called TPC-Energy for measuring how much work computers get done for a given amount of energy.
The move reflects the growing concern with power efficiency given environmental issues such as carbon footprint and financial issues involving the cost of electricity for running computers and cooling data centers.
The group already has developed a variety of server benchmarks: TPC-C and the newer TPC-E for database performance and TPC-H for data warehouse performance. TPC-Energy in effect does a little extra math on those tests to yield a "watts per performance" score, the group said in an announcement this week. [More]

posted by: gqjournal

Mysterious SSL Botnet Attack Failing

PC Magazine:

Botnet Attack on CIA Failing
Larry Seltzer - PC Magazine Larry Seltzer - Pc Magazine Tue Feb 2, 9:08 am ET
A mysterious flood of SSL packets from the Pushdo botnet, possibly an attempted DDOS attack, is not succeeding, according to the Internet Storm Center. None of the attacked sites are experiencing significant outages.

The attacked sites include government sites including the FCC, the NIH, the FBI and the CIA, not to mention smaller targets like the Australian embassy in Berlin. There are also prominent commercial sites from Microsoft, Office Depot, Mozy, GotoMeeting and Red Hat Magazine. A full list from Shadowserver can be found here. Shadowserver credits Joe Stewart from SecureWorks. [More]

posted by: gqjournal

High-performance PHP Compiler for Facebook

ReadWriteWeb (emphasis by GQJ):

          CONFIRMED: Facebook Gets Faster, Debuts Homegrown PHP Compiler [Update]

Written by Mike Melanson / February 2, 2010 1:09 AM

The rumors have been flying over what's going on over at Facebook headquarters. The word has been that a PHP team was brought in and made to sign non-disclosure agreements before discussing a PHP project that has been in development for the past two years. Alex Handy, senior editor of the Software Development Times Blog, predicted last Saturday that Facebook "has rewritten the PHP runtime from scratch," and several sources have confirmed for us tonight that Facebook has indeed been making some changes to the basic PHP runtime environment.
According to our sources, Facebook has been working on a PHP compiler that will increase speed by around 80% and offer a just-in-time (JIT) compilation engine that will offer a number of advantages. The project is very similar to Google's Unladen Swallow project, which rebuilt the Python compiler, boosting the speed fivefold and opening the door for multi-language integration. [Read more]

posted by: gqjournal