There's no such thing as proper architecture at the first try. By programming, you explore the problems you have to face. In "The Mythical Man-Month", Fred Brooks says that it's not first or second system that is correctly design, but usually the third. Rewriting is a part of a process.

You forgot that refactoring might decrease the maintenance costs. It's possible that the developer just found it too hard to add any new functionality to the existing codebase and figured that refactoring is the only way to go. Seriously, it's not always enough for a project to work. Actually, it usually isn't.

There you go: https://www.youtube.com/results?search_query=moxie+marlinspike+ssl

I agree. But that's what makes this model useless. We shouldn't outsource trust to CA's, but push it to the users. Let them decide who do they trust. If, after the VeriSign fiasco they don't trust VeriSign anymore, they should be able to revoke the trust without losing the ability to view 1/4 of the internet. Seriously, guys, go watch any Moxie's talk and you'll understand the issue much better.

Does this mean that we'll finally give up on this sick certificate-based trust scheme? It's not like Moxie hadn't proposed his own solutions, even with implementations... why don't we make THESE internet standards? Making encryption stronger is just pointless if you can fake a ceritificate.

Provided it's not Watson: http://www.news.slashdot.org/story/13/01/10/2315252/ibms-watson-gets-a-swear-filter-after-learning-the-urban-dictionary

I'm under the impression that you're confusing things. Noone said that you'd be forced to run an exit node, or even a relay. I believe it's just about making the protocol a standard.

Don't get me wrong, I'd have hard time living without The Linux Foundation's products, but when this year I wanted to work for The Linux Foundation in Google Summer of Code, I gave up after reading their proposals. I wanted to learn some kernel development stuff and couldn't find a single suggestion related to that. Instead, there were some higher-level projects like OpenPrinting, which I personally find totally uninteresting.

The trick is that retrieval can be dangerous by itself if you're using the database and forgot to sanitize your SQL. Being a moron can't be solved by an RFC.

How is that news? Zalewski wrote a book on that years ago ("Silence on the wire")

You actually woke up just to see the article?

Because they ship, for example, laptops with these optical drives?

You don't worry about security too much, do you? As far as I know, 2.4 is not supported anymore.

I'm not sure it's really that simple design. Don't you think it really takes a lot of imagination to actually visualise the inner state of the cube?

DIdn't mean that. Complexity is usually a sign of bad design. Actually, most of concepts in CS are pretty straightforward and if you get stuff complicated, it's more prone to bugs and thus, security problems. For example, take ECDSA and RSA. Modular exponentation is a pretty simple concept while the whole elliptic-curve thing was complicated enough for guys smarter than us to insert a backdoor into the equations. We should definitely go for simple and transparent designs.