 |
privacy |
||
|
Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.
Blog Feed Recent Items 
The nfoCentrale Blog Conclave nfoCentrale Associated Sites |
2005-03-12Identifying Key Elements of Safety-Critical SoftwareACM News Service: Added Reliability to Safety-Critical Software. This blurb reports on an IST Results report of 2005-02-22. The funded research has led to the ATASDAS toolkit, which is also available in a commercialized form. The research project ended in May 2004, and the project coordinator is now involved in the commercialization as imPROVE-C, a product that may be mandated in a variety of situations. I find this slant puzzling. The ATASDAS (Automated Target Analysis to SPeed up the Dependability AnalysiS) Consortium page provides no public solution, and the only link for useful content is to a proprietary validation & verification vendor. So, as valuable as this approach might be, it is difficult to assess.CVSS: Common Vulnerability Scoring SystemACM News Service: Computer Vulnerabilities Given Unified Rating Systems. The consortium-produced CVSS is being promoted for giving a consistent means for rating vulnerabilities based on the nature of the damage that an exploit can create: data theft, data corruption and alteration, denial of service, etc., covering a total of seven traits. This seems like something to keep in mind with regard to carrying out threat modeling too. Celeste Biever's 2005-02-21 NewScientist.com article provides further details and links. The CVSS report is available at the National Infrastructure Advisory Council link.2005-03-11Open-Source License Simplification (and Trust?)ACM News Service: Open-Source Overseer Proposes Paring License List. This squib describes the move to favoring a small number of easily applied open-source licenses and restricting the increase of duplicative licenses. The 2005-03-02 Stephen Shankland CNet article provides more links and examples of why some licenses have to be different.Identity, Authentication, and Attestation TogetherACM News Service: Identity Management, Access Specs Are Rolling Along. Greg Goth, in a February 2005 IEEE Internet Computing article observes how authentication (Liberty Alliance style) and Security Assertions (SAML 2.0 style) are going to be integrated. There are three assertions of special interest: (1) assertion of an identity claim, (2) attributon of user-specific details, and (3) authorization of particular privileges. It looks like there are the usual "standards"-group and sponsoring-organization rivalries at work here. What's important for me is to see how this aspect of SAML 2.0 is adaptable to TROSTing in a disintermediated way. I'm looking for a general system that does not require a specific single approach to authentication, especially for PKI.Collaborative Systems: Social ProtocolsACM News Service: Will Social Databases Give Way to Social Protocols?. This blurb refers to the blog of a ZDNet commentator. Does that make it journalism, when it is abstracted by a news service? David Berlind in a 2005-03-01 ZDNet posting suggests that a protocol could alleviate the need for intermediated services and allow individuals to provide identity and affinity information on their own sites and pages using the XHTML Friends Network (XFN) microformat. The protocolaspect is the use of the rel attribute in links to suggest the relationship that is claimed as part of a link from one party's material to that of another. I am presently busy with rel="nofollow" additions to many links among my own pages that confuse linking-based search-relevance schemes. (It is cool that "orcmid" is at least as unique on the Internet as "Scoble." It is less cool that most of the links that Google finds for my nom di bit are trivial -- dare I say banal -- references within my own material.) Meanwhile, I can see an adaptation of something like this as part of TROSTing authentication and establishment of authority via web-of-trust social-protocol assertions. Hmm.Secure Computer Infrastructure as a JourneyACM News Service: Linux Security Rough Around the Edges, But Improving. The focus here is on measures to safeguard systems against attacks and to mitigate the consequences of successful exploits. The delivery vehicle is the NSA-built Security Enhanced Linux (SELinux) distribution. There is also a strong claim that quality of software code is crucial, according to the technical director of the NSA Information Assurance Directorate. I am not sure that the specific SELinux measures address code-quality issues so broadly or directly, but I can't quarrel with this being an important start on a never-ending voyage. The Larry Greenemeier 2005-03-03 Information Week article has the details. Of interest to me are the observed difficulties of implementation and how hard it is for the average customer to control. It appears that there is enough excitement around the enhancements for refinement and improvement to be sustained.Component-Based Software Engineering ProjectsACM News Service: Laying Foundations for Component-Based Software Markets. A combination of EC initiatives support development of organizational and commercial arrangements for component-based software. COMPONENT+ for built-in test capability is oriented to also confirming that an integration is coherent. This is tied to the European COTS User Working Group (ECUA), a growing organization now having annual workshops. A 2005-03-07 IST Results release has the details. The incorporation of built-in testing techniques is valuable in TROSTing of components too, so I will take special interest. The University of Pau BIT/J library for incorporating built-in testing into Java components is interesting for the way that even their documentation process is accountable. The work is available on the equivalent of a Creative Commons attribution license. Simple.TROST: Templates for Raising Open-System TrustworthinessOn February 1, my proposal for an M.Sc in IT project dissertation was accepted by my Dissertation Advisor and approved by the Academic Coordinator of the program. I more or less went autistic and comatose at that point, although I had prepared a project plan and the clock began running in relentless one-day-per-day fashion. My deadline is July 28 and my plan envisions the dissertation being submitted on July 4 (and already slipping slightly in a replan I am conducting this weekend). There have been many little stumbles getting started, and that is something for 43 Things at another time. Today, I want more of the world to know what this is about. That's mostly because I have other items to post about related work and materials that I find in my explorations. It seems useful to establish the perspective that gives rise to my interest. Why TROST? Well, FROST was already taken and I was grasping at straws. Once I had an acronym that worked in a (puny?) punny way, I held onto it. I even adjusted the name of the project at one point. I was careful to preserve the acronym. Templates? "Frameworks," "patterns," and "templates" all work. It is not about laws or theories although principles, practices, guidelines, and approaches figure in. I can go either way with "model" but I think I'll save that one from further over-use just now. Raising? Sure, as in improving, enhancing, enriching, increasing, expanding, and so on. I am looking at the achievement of trustworthiness as a process and a journey, not an absolute result. I do mean continuous improvement along with resilience in the face of setbacks. Open-System? I had originally said Open-Source here. It didn't take long to realize that there is nothing in my vision for TROST that is peculiarly about open-source development (not to be confused with open-source licensing). I chose open-system trustworthiness in homage to OSI, the Open Systems Interconnection effort that had much to teach us about interoperability and integration as well as network interconnection. I mean open-system in this general way. My attention is on ways in which we can address the trustworthiness of components and their integrations in any open-systems setting. Trustworthiness? Well, that should be easy. We all know trustworthiness when we see it, right? Maybe not. Starting out, I am looking at trustworthiness in terms of human arrangements for mitigation of the risks of everyday and not-so-everyday life. There is, most of all, the risk of dealing with each other, especially at a distance. I foresee a mapping into trustworthiness projected onto artifacts. I am not willing, at this point, to take my eye off of the ultimately human and social nature of trust and trustworthiness. Enough blather, where's the code? Uh, yes, this is an Information Technology project and that usually means that something will be built. So, along with some templates and a fair amount of metatemplating too, there is a feasibility demonstration involving honest-to-gosh delivered software. The sofware will be produced using open-box development of an open-source component. This component will integrate into open-system middleware, ODMA, on the Microsoft Windows desktop. Here's more based on the definition of TROST as a SourceForge project:
|
||
|
You are navigating Orcmid's Lair. |
template
created 2004-06-17-20:01 -0700 (pdt)
by orcmid |