I was recently writing a random password generator and in the processit occurred to me that there is an important difference between randompasswords and good passwords, because we mean different things by thoseterms.

A truly random password is one that an attacker can't guess betterthan through random chance even if they know your password generationalgorithm, so that on average they would have to try half of all of thepossible passwords before successfully guessing yours.

(How many possible passwords there are is based on how many bits of

Part of validating a SSL certificate is making sure that it is a SSLcertificate for what you are actually connecting to, to avoid thepossibility of a man in the middle attack. SSL certificates for websiteshave a field (the CN portion of the 'Distinguished Name') that names thehost they are for, and so target validation consists of checking thatthe certificate's CN is the same name as the host portion of the URL.

This checking is pretty literally a string compare; the web browserdoes not

Our SMTP frontend died (twice) around 8am on Friday morning, so some ofthe stats for this are partial stats and some of them are missing abouttwo hours of data. That said, this week we:

• got 10,583 messages from 249 different IP addresses.
• handled 17,948 sessions from 1,258 different IP addresses.
• received 257,246 connections from over 50,000 different IPaddresses.
• hit a

I've been experimenting with AoE lately, and as a resultI've been looking at the protocol more than I did in my earlierexposure . Unfortunately, the more I look at the AoEprotocol, the more uncomfortable I get.

The AoE protocol is quite simple; requests and replies are simpleEthernet frames, and a request's result must fit in a single replypacket. This means that the maximum read and write sizes per request arebounded by the size of the Ethernet frame, and thus on