hall of shame

In a recent interview, Linus Torvalds expressed regret about the pointless churn of SHA1 deprecation and this immediately reminded me of a similar, although much smaller pointless churn.

There was once a company-wide ban on SHA1, so a developer replaced SHA1 with SHA256 in a Hashcash implementation in one of the projects... without thinking of the negative side effects:

1. Hashcash became ~1.5..2 times slower
2. Third-party tooling could not be used anymore

The project uses this broken Hashcash even today.

P.S. In case it is not clear, SHA1 was "broken" by generating two PDFs with identical SHA1 hashes but different content by adding random binary data to it. This is why the "attackers" used PDF and not C or Java code in the first place. And when they say broken, they mean that the SHA1 collision was generated 100,000 times faster that it should be, but it still took quite a lot of computing and coding.

Where there have been better SHA1 attacks since Google's, they are mostly impractical due to collision detection built into git for a long time already.

Just stumbled upon a fancy banner by Microsoft that advertises its Embrace and Extend from the childhood program.

For the record: the only reason Microsoft supports this "Coding in classroom initiative" is because they want to push their products through kids. It's a problem, but a bigger problem is that Microsoft have long striven to make computing an elite profession by introducing inconsistencies and complexity for the most basic abstractions: a character, a file, a block device... their products are designed to fail pupils who want to understand how computers work. And this design is intentional, because the less people understand computing, the less competition their business has... and higher are the profits.

Thus, taking money from Microsoft to promote coding in the classroom is akin to taking money from Philip Morris to promote healthy lifestyle. Shameful.

On Fri, Apr 11, 2014 at 04:26:33AM -0400, Abdullah Rahmoyan wrote:
>
> For a well known financial institution, I am currently looking
> for a senior Java developer to take part in a 6 months project.
>
>
> The requested skills are:
>
> - BACK-END AND FRONT-END with level SPECIALIST
>
> - DEVELOPMENT KNOWLEDGE with level SPECIALIST
> - BUILD TOOLS, WEB SERVERS with level SPECIALIST
> - AND DATABASES with level SPECIALIST
> - DESIGN REST SERVICES with level EXPERT
> - AND API'S with level EXPERT
> - JAVA EE6, JAVASCRIPT with level SPECIALIST
> - ANGULARJS,POSTRESQL with level SPECIALIST
> - FULL DETAIS TO BE SENT with level SPECIALIST
> - BY EMAIL with level SPECIALIST

Here is an excerpt of the Legal aspects of free and open source software workshop notes. Every phrase is a masterpiece.

"When the public agency has decided that open source requirements are particularly important for a specific software acquisition case, the process described in this section can be followed. This process would end in the agency downloading open source software itself, with no fee paid whatsoever. Separately, commercially provided services and support, if required, may be acquired by publishing calls for tender. Note that this process can be abandoned at any point - for instance, if the software cannot be found easily, or evaluated, or once downloaded is found unsuitable for any reason. At that point, the other approach described in the next section can be followed, namely, publishing a call for tender for open source software."