1. Out of The Inner Circle, Landreth. Read this in 1986 or so when it originally came out. Holy shit, did that change my life. It put me on the vector that, among other things, has me reading Slashdot today.
2. M*A*S*H- Hooker. Besides being ripping funny, introduced me to the concept that if you're really good at what you do, you can get away with a lot. A whole lot.
3. 1980 Signetics Linear IC Databook. Never underestimate the learning capability of a curious kid on a remote farm with no internet access ('cause it didn't exist. Well, not as we know it.)
4. War Games. Yeah, so it's a movie, but life-changing nonetheless. See items 1-3.

No, not really, at least not in my experience. The primary motivation is to be able to peer into SSL/TLS traffic to see if there's malware using it as a transport. Internet caching is... well, I won't say a dead technology, but at least in the enterprises where I've worked bandwidth is sufficiently cheap (and caching proxies tend to break stuff unpredictably) that they typically don't bother.

Consider: if you don't block 443, and you don't decrypt/examine it, that's a wiiiide open hole out of your network for any botnet members to phone home or exfiltrate data... or a host of other things. It's a real problem.

Wrong.

The https proxy server is trusted as a signing CA. It generates server certs real-time for any requested https content, then retrieves the content for you on the other side- via it's own https session- before sending it back to you. Since the proxy is trusted by your browser, it doesn't complain.

Without getting into a protracted discussion about x.509 certs and their completely fucked implementation, suffice to say that while the proxy can effectively decrypt your https traffic, noone else can. There's still a reasonable amount of security there.

Although it depends a great deal on the proxy admin to keep it secure...

You're almost right. There are a number of commercial appliances (Websense makes one, which I've deployed for corporate use) that do exactly this so the corporate powers-that-be can peer into SSL encrypted traffic. This is generally (hopefully) for IDS/IPS purposes.

The key is that:

1. Corporate workstations have to be loaded with a CA cert generated by the appliance so they trust all certs issued by the appliance, and
2. The fake server certs are generated *real time*. Pre-generation isn't necessary.

So the reality is that this happens every day if you're running one of these systems. You raise an interesting point, though, that if a CA with their CA cert already in browser distros did this, it would be pretty much undetectable. However, then anyone with one of those appliances could do this man-in-the-middle attack, rendering the CA's infrastructure/reputation worthless. Additionally, they'd have the CA's private key, which is the crown jewel of a CA- so I doubt that would happen.

Now, if someone maliciously inserted their CA key into a browser distro, well, that opens the door for all kinds of fun...

J-.

Sigh. Not always. You have to look for positive expectation games in casinos, but they can be found. Google "positive expectation video poker" if you don't believe me.

Also, there's card counting at blackjack, of course, but you'll be detected quickly and summarily removed.

That said, if becoming a VP playing drone is your idea of fun, that's your business. I'm there for the free beer and to have fun, and I'm willing to pay a nominal fee to do so. Playing craps, getting loaded, and minimizing that fee are what I enjoy. Did you know that depending on how you play craps, you can make the house advantage asymtotically approach zero?

J-.

I've worked in a number of military-oriented institutions (TLAs, if you get me) and while I have nothing but respect for the warfighter, I rarely found any of them to be technical superstars. Like any population, there were a few, but overwhelmingly they were put-the-square-peg-in-the-square-hole guys. They could memorize a manual and know everything about a piece of equipment (well, on a sysadmin level), but innovation was not their strong suit. At all.

And this is why the government/military has had and will continue to have immense problems attracting really, *really* good people to work in their CyberCorps or whatever they're calling it now. There's too much procedure in those circles; good techies quickly go insane.

One thing I did find, though, was that *usually* the officers had damn good project management skills and knew how to solve problems, support their people, and get the job done. That skillset is really universally applicable to all fields, though, and not just IT.

What are you, twelve? Free speech *especially* protects offensive (ProTip: who decides what is offensive?) speech.

I can't believe people as stupid as you exist. Well, actually, I can. Let me guess: you're in San Francisco, right?

You've never seen those rules? Where do you play? They're all over the place in Vegas and Atlantic City. I've also seen games where you could only double on 7, 8, and 9, no resplits, all kinds of stuff. Wizardofodds.com has a table with all those stupid rules and their impact on the house edge. Interesting reading. And don't just mistrust the CSMs, they help the house too- since there's always the same (many) number of cards in play naturals are less likely. Bastards.

But people still play them... Oddly, I've found- especially in Vegas- that the higher end casinos have the worst rules. You'll almost always find the best rules in the dumpy little off-strip places. Hmm, Fremont St. is calling to me...

With the wealth of information available at your fingertips, you really should have done some research before posting that. I even told you what to look for.

I'm quite serious- and I'm right. You have to read the pay tables and find a video poker terminal that has been configured for positive expectation. Why the casinos do this I have no idea, since yep, they're potentially losing money on that one- but in any decent sized casino you can usually find a couple. I suppose the likelihood of a skilled player wandering by is low enough that they don't care. After all, you still have to play the game in mathematically optimal fashion. There's certainly no shortage of idiots in casinos.

War story- I've seen- more than once- a roulette pit where half the wheels were single zero and half were double zero. Every wheel had players. (Hint: the double zero table has roughly twice the house edge of the single zero game.) I've also seen a 6:5 blackjack table next to a 3:2 table, with identical rules otherwise- both occupied. Sadly, people are, on average, not very bright.

Actually, I posted AC accidentally. Oops.

Yes, the dealer can pound out cards fast, but if you're at 5th base there's plenty of time to count while the other bozos consult their tea leaves or strategy cards to figure out what to do.

Um... I *have* done it and *do* do it. Actually, the hardest part now is finding a game with good enough rules that you can get a positive expectation while counting. Most of the corporate casinos are running CSMs, naturals pay 6:5, no double after split, and other annoying crap that increases the house edge to the point of absurdity. Personally, I practice maybe 10 minutes a day. I find that's enough to keep it more or less automatic. If I have to think about it, it becomes too much like work. ProTip: Hoyle Casino (I use a custom driller I wrote, but for anyone wanting to mess with counting) will track the hi-lo count so you can check yourself.

Which brings us to your final point: "if you get it slightly wrong you will lose". Bullshit. I count hi-lo- other schemes may be different- but It depends on how large the house edge is to start with. If you're counting against a low-edge game there is a margin of error before you move into negative expectation territory.

Thankfully, I have an office (and an officemate, but he's cool) now but I have done the cubicle sea thing in the past. I realize the apparent economy of cubicles, but the loss of productivity must be staggering. If I'm deep in the middle of a firewall hack, or trying to configure a router without bringing the entire company down, I *really* need to be able to concentrate. I know my productivity suffers greatly. I found myself working off-hours just to avoid having to listen to the idiot two rows over yap with his bookie or frat brother or whatever he was doing. This also probably impacted productivity, because my hours then overlapped less with the rest of the company.

And, to those of you who can screen out the world with headphones: I envy you. Maybe it's a by-product of being a musician, but even if I put classical music on, it's distracting because I actually find myself listening to it. The noise canceling headsets make me feel like my head is full of cotton.

> Do you also have sex with every person who happens to come within 10 feet of you?

Well, I try...!