Security is such a strange thing. In order for most security measures to work you have to defeat them a little. Let’s take money as an example. The U.S. mint has included a tremendous number of security features in order to make American bills difficult to counterfit and easy to spot as real. Now, they have to release what those features are to the public at large in order for them to be useful. By doing so, they are giving counterfeiters a blow by blow account of how to defeat their security. I wonder if our government could save some time and money on printing costs by just releasing a few bills with all of the added “features” and letting the counterfeiters handle all of the actual production.
Dreamhost (the folks that host the Pumpkin) recently had a security hiccup and lost some passwords. Well, I say “some” but I mean 3500, which seems a little more like “a lot”, but maybe that’s just me. Dreamhost owned up to their mistake and then later said that they were working to make sure that it didn’t happen again. And those are both good things. But some folks over at this blog, where I heard about the problem from, seem to think Dreamhost should tell us just what the problem was and what they have done to fix it. Personally, I disagree. If they release what the problem was, they are giving hints as to how folks can do it again, especially if they also publicize the fix. I’ll stick with hearing them say, “we found the door that they came through and have since locked that particular door.” And that will do for me. The more they talk about the new locks they installed, the easier it is to pick that lock.
And it isn’t just security that works that way. There are a lot of books and articles that tell you how to avoid certain scams by giving up the inner workings of that scam. Now, it is easier to avoid something if you know the particulars of that something, but there is an easy rule of thumb, if it looks like you have a chance to sucker some poor shnook out of some money, you are probably being taken for a ride. Free money does not exist, despite what the Rich Jerk may tell you.
Speaking of free money. Wouldn’t it be awesome if you were a Ninja? Just click the link in the Pseudo-Sponsors section, and you too can be a ninja. Seriously. And if you send us pics of you in your new occupation as a high level assassin we promise not to turn you in to the proper authorities, and we’ll post them on the site.
Tune in tomorrow for more ranting and, with any luck, more humor.