David A. Wheeler's BlogDavid A. Wheeler's weblog.YEARFRAC Incompatibilities between Excel 2007 and OOXML (OXML)- May 19, 2008 In theory, the OOXML (OXML) specification is supposed to define what Excel 2007 reads and writes. In practice, it's not true at all; the latest public drafts of OOXML are unable to represent many actual Excel 2007 files. For example, at least 26 Excel financial functions depend on a parameter called "Basis", which controls how the calendar is interpreted. The YEARFRAC function is a good example of this; it returns the fraction of years between two dates, given a "basis" for interpreting the..http://www.dwheeler.com/blog/2008/05/19#excel-oxml-yearfrac Oracle letter to Universities: Educate software developers on securityassurance!- May 15, 2008 I am delighted to point out a really interesting letter to Universities by Mary Ann Davidson, the Chief Security Officer of Oracle Corporation. It basically tells colleges and universities to stop ignoring security, and to instead include software security principles in their computer science curricula. I'm so delighted to see this letter, which has just been released to the public (it had been privately sent to many colleges and universities). Let me point out and comment on some great...http://www.dwheeler.com/blog/2008/05/15#oracle-letter Defining "open standards": The Digital Standards Organization (digistan.org)- May 14, 2008 Lots of people agree that we need "open standards" in information technology. The problem is, there are a lot of snake-oil salesmen who are trying to (re)define that term to mean "whatever proprietary product I'm selling". Will we be able to choose what products we use Will we even be able to exercise our rights (as citizens) at all These are important questions about our future. The answers to those questions depends on whether or not we have real open standards in place for critical areas..http://www.dwheeler.com/blog/2008/05/14#open-standards-digistan Bilski: Information is physical!- May 9, 2008 The US Court of Appeals for the Federal Circuit in Washington, DC just heard arguments in the Bilski case, where the appellant (Bilski) is arguing that a completely mental process should get a patent. The fact that this was even entertained demonstrates why the patent system has truly descended into new levels of madness. At least the PTO rejected the application; the problem is that the PTO now allows business method patents and software patents. Once they allowed them, there's no rational...http://www.dwheeler.com/blog/2008/05/09#bilski-information-is-physical Open Source Computer Emergency Response Team (oCERT)- May 8, 2008 Here's something new and interesting: the Open Source Computer Emergency Response Team (oCERT). Here's how they describe themselves: "The oCERT project is a public effort providing security handling support to Open Source projects affected by security incidents or vulnerabilities...". They promise to keep things moving. They do permit embargo periods (where vulnerabilities are not publicly disclosing, giving time for developers to fix the problem first). More importantly, though, they have..http://www.dwheeler.com/blog/2008/05/08#ocert.org Securing Open Source Software (OSS)- May 6, 2008 I've just posted my presentation titled "Securing Open Source Software (OSS or FLOSS), which is to be presented at the 8th Semi-Annual Software Assurance Forum, May 6-8, 2008, Sheraton Premiere, Tyson's Corner in Vienna, Virginia. In it, I discuss how to improve the security of an OSS component by modifying its environment, as well as securing the OSS component itself (by selecting a secure component, building a secure component from scratch, or modifying an existing component). I include a..http://www.dwheeler.com/blog/2008/05/06#securing-oss-2008 |