David A. Wheeler's BlogDavid A. Wheeler's weblog.Microsoft Office XML (OOXML) massively defective- March 21, 2008 Robert Weir has been analyzing Microsoft's Office XML spec (aka OOXML) to determine how defective it is, with disturbing results. Most standards today are relatively small, build on other standards, and are developed publicly over time with lots of opportunity for correction. Not OOXML; Emca submitted Office Open XML for "Fast Track" as a massive 6,045 page specification, developed in an absurdly rushed way, behind closed doors, using a process controlled by a single vendor. It's huge...http://www.dwheeler.com/blog/2008/03/21#ooxml-200803 Twisted Mind of the Security Pro- March 21, 2008 Bruce Schneier's "Inside the Twisted Mind of the Security Professional" is highly-recommended reading - he explains the different kind of thinking required to be good at making things secure. Security pros are able to see the bigger picture, and in particular, they are able to see things from from an attacker's perspective. For example, "SmartWater is a liquid with a unique identifier linked to a particular owner. 'The idea is for me to paint this stuff on my valuables as proof of...http://www.dwheeler.com/blog/2008/03/21#twisted-mind OSS and the U.S. DoD - Questions and Answers- March 11, 2008 I've just posted Questions and Answers for 2008 "Open Source Software and DoD" Webinar. These are my attempts to answer the questions people sent me at my February "Open Source Software (OSS) and the U.S. Department of Defense (DoD)" Some of the questions were easy to answer, but some were surprisingly difficult. In some cases, I asked lawyers and got conflicting answers. But this is the best information that I could find on the topic. For example, I explain in detail why In particular,...http://www.dwheeler.com/blog/2008/03/11#oss-dod-qa2008 |