It recently struck me that one of the things that the universitywebmail phish attacks demonstrate is thatreputation based antispam systems are now dead. The university webmailattacks aren't just a few previously good sources going bad, which hashappened before; they're a systemic, broad attack on a whole class ofsystems that previously had a good to great 'spam reputation'.

(Well, this exaggerates the situation somewhat. There are two aspects ofreputation based antispam systems; you can attempt to blacklist placesthat are

In theory, iSCSI has a feature called 'multiple connections persession', commonly abbreviated as MC/S. In iSCSI terminology, a'session' is a single logical connection between an iSCSI initiator andan iSCSI target, and a 'connection' is a TCP connection. MC/S lets asession be composed of multiple TCP connections, each of which can use adifferent set of IP addresses and thus a different network path.

(In practice, apparently very few iSCSI initiators and targets actuallysupport MC/

One of my blogging flaws is that when I write up an entry, I can be soclose to the issue that I leave important things out because they are'obvious' to me. I did that with my recent entry about Firefox 3's handling of self-signed SSL certificates: I skippeddescribing exactly what makes Firefox 3's approach so wrong.

Firefox 3 is not wrong-headed for being cautious about self-signed SSLcertificates, because there are real concerns with them in practice. Firefox 3

I was a little harsh on Firefox 3's handling of self-signed SSLcertificates in the last entry , and in fairness Ineed to say that this is a genuinely hard problem for browsers, at leastfrom a security perspective. Let us talk about just how this is so.

First, let us start with my previous basic model of how https could work. Browsers always use SSL if possible, and theyprotect against straightforward man in the middle attacks by rememberingthe SSL certificate they saw last time, or