From one of my favorites ... the expression on Max's sister Andy in the last panel is *perfect* ...

Horace, as usual, makes some very astute observations. I've noted this effect with other technology firms that consistently design, build, and market innovative products. The stock market only values currently shipping products, rarely does it value the culture and process of the enterprise that allows it to consistently create something new and valuable.

The premise of the stock market today is therefore that being innovative in technology is meaningless. Innovations are valuable but there is no such thing as an innovation process. If there was such a thing then we could measure it and put a number of its value. Until then innovation is nothing more than a spin of the roulette wheel.

This is really, really serious. Congress is considering one of the most draconian, unfair, and freedom-blocking bills in a long time. Read this and *act*!

On November 16 the U.S. Congress will hold hearings on a bill that would unfairly, recklessly and capriciously enable and encourage broad censorship of the Internet in the name of suppressing distribution of works not authorized by copyright holders. As Public Knowledge aptly summarizes, the “Stop Online Piracy Act” would seriously “threaten the functioning, freedom, and economic potential of the Internet” by:

• short-circuiting the legal system, giving rightsholders a fast-track to shutting down whole websites;
• creating conflicts between Domain Name System (DNS) servers, making you more vulnerable to hackers, identity theft, and cyberattacks;
• sanctioning government interference with the Internet, making it more censored globally.

SOPA threatens every site on Internet, but would especially harm the commons, as the Electronic Frontier Foundation explains, focusing on free software. The same applies to free and open projects beyond software, which often use CC licenses. While standard public licenses have lowered the costs and risks of legal sharing and collaboration, SOPA would drastically increase both the costs and risks of providing platforms for sharing and collaboration (think sites ranging from individual blogs to massive community projects such as Wikipedia, from open education repositories to Flickr and YouTube), and vaporize accessibility to huge swathes of free culture, whether because running a platform becomes too costly, or a single possibly infringing item causes an entire domain to be taken down.

The trend that one can plot from the DMCA (1998) to SOPA, and continued extensions and expansions of copyright and related restrictions around the world, also demonstrate the incredible importance of the commons for healthy information policy and a healthy Internet — almost all other “IP” policy developments have been negative for society at large. The DMCA was decried by advocates of free speech and the Internet, and has over past 13 years had many harmful effects. Now, in 2011, some think that the U.S. Congress ‘struck the right balance’ in 1998, while big content is dissatisfied, and with SOPA wants to ratchet the ‘balance’ (watch out, 2024!) much further to their short-term advantage.

Techdirt has excellent coverage of the gritty details of SOPA, its ill effects, and the many constituencies alarmed (such as librarians and sports fans).

Sign up at American Censorship Day to be alerted of actions you can take against SOPA. Demand Progress, EFF, and PK have forms you can use to write the U.S. Congress right now.

Please take action! If you aren’t already sharing works under a CC license and supporting our work, now is a good time. Bad legislation needs to be stopped now, but over the long term, we won’t stop getting new bad legislation until policymakers see broad support and amazing results from culture and other forms of knowledge that work with the Internet, rather than against it. Each work or project released under a CC license signals such support, and is an input for such results.

Thanks to Gus Mueller (master of "Flying Meat" and creator of Acorn and VoodooPad and FlySketch) I learned about this absolutely fabulous interactive site explaining the math and geometry behind Bezier curves ... which are the fundamental building blocks for drawing nice smooth curves in digital graphics. If you are at all interested, check it out!

BTW, the interactivity and math typesetting is all done without any plugins ... just using standard HTML5 and JavaScript ... IE people need to be running IE 9, but everyone else just needs to be using the current version of their browser.

A primer on Bezier curves - by Mike "Pomax" Kamermans

Last updated: 2 November, 2011

Before we begin I'd like to say that all the graphics on the page, except for the Wolfram Alpha images, are interactive graphics, without requiring any special browser plugins. If your browser supports javascript, and the canvas element (sorry IE8 users, you'll have to upgrade to IE9, which supports <canvas> - Get it here,) it will be able to let you use this page, thanks to the most excellent Processing.js project. You will also see rather nicely typeset mathematics, thanks to the equally excellent MathJax library.

So, with that out of the way, let's look at the topic at hand: Bezier curves.

This is good stuff, and I'm glad to say that I had a bit to do with this (although our excellent PHY team - both engineering and marketing - did the heavy lifting while I provided high-level technical and evangelism support). Anyway, congratulations to our team!

Tech and Automotive Leaders Unite to Drive Next Generation In-vehicle Networking

IRVINE, Calif., Nov. 9, 2011 /PRNewswire/ --

News Highlights:

• Enables Wide Scale Adoption of Ethernet-Based Automotive Connectivity
• Establishes industry standard for 100Mbps Ethernet connectivity over single pair, unshielded cable
• Enables migration from closed application to open, scalable Ethernet-based network

Broadcom Corporation (NASDAQ: BRCM), NXP Semiconductors N.V. (NASDAQ: NXPI), Freescale Semiconductor (NYSE: FSL), and Harman International (NYSE:HAR) today announced the formation of a special interest group (SIG), established to drive wide scale adoption of Ethernet-based automotive connectivity. Jointly developed with founding automotive members BMW and Hyundai Motor Company, the OPEN Alliance (One-Pair Ether-Net) SIG will address industry requirements for improving in-vehicle safety, comfort, and infotainment, while significantly reducing network complexity and cabling costs. For more information visit www.opensig.org.

(Logo:  http://photos.prnewswire.com/prnh/20111109/LA03155LOGO)

Designed to encourage wide scale adoption of 100Mbps Ethernet connectivity as the standard in automotive networking applications, the OPEN Alliance plans to expand its membership roster in the coming months to additional automotive suppliers and manufacturers.

Key to the newly established SIG is the proliferation of Broadcom's BroadR-Reach® technology as an open standard. BroadR-Reach technology, designed specifically to address the stringent requirements of the automotive industry, delivers high-performance bandwidth of 100Mbps over an unshielded single twisted pair cable. By eliminating the need for expensive, cumbersome shielded cabling, automotive manufacturers can significantly reduce connectivity costs and cabling weight.

Founding members will initially focus on establishing interoperability requirements, third party testing, certification procedures, and higher data rate specification requirements. License to specification for BroadR-Reach is available to all interested OPEN Alliance members under RAND terms via a license from Broadcom.  

Quotes:

Kevin Brown

, Vice President and General Manager, PHY, Broadcom Corporation

"Broadcom is working closely with leaders throughout the industry in defining the future of automotive networking. Through the formation of the SIG, we'll gain invaluable insight and support in the proliferation of BroadR-Reach Ethernet technology as an open industry standard. Making BroadR-Reach Ethernet open to the industry will help manufacturers achieve higher bandwidth, significantly reduce connectivity costs, and deliver new and exciting features and applications to a broad range of vehicles."

Lars Reger

, Vice President Strategy & New Business Automotive, NXP

"BroadR-Reach Ethernet technology addresses the high bandwidth functionality the automotive market is asking for. We're excited to adopt this standard. As the global No. 1 supplier of In-Vehicle Networking technologies NXP will speed up the wide adoption of Ethernet in the automotive industry. Automotive Ethernet is the logical next step in NXP's broad In-Vehicle Networking portfolio of products, starting from LIN, CAN and FlexRay up to Ethernet."

Ray Cornyn

, Vice President and General Manager, Automotive Microcontroller Division, Freescale

"Freescale has long been at the forefront of automotive networking technology, helping to establish such standards as CAN, LIN and FlexRay. Ethernet is the next step in the evolution of automotive networking, meeting the need of new high bandwidth applications, such as cameras and multimedia. By enabling Ethernet communication over unshielded twisted pair cable, BroadR-Reach technology provides a critical element to a flexible and cost effective Ethernet solution."

Sachin Lawande

, Chief Technology Officer and Co-President, Lifestyle and Infotainment Divisions, Harman

"As the leader in connectivity solutions for the world's automakers, HARMAN is pleased to support the work of our industry partners in driving scalable Ethernet solutions for high speed networking for the car.  Increasingly we see the need for flexible and cost-effective connectivity solutions supporting the customers growing demand for information, entertainment, and safety features seamlessly integrated within the car network.  Ethernet will provide the highest quality streaming A/V experience and encourage interoperability of networked A/V devices."  

About Broadcom

Broadcom Corporation (NASDAQ: BRCM), a FORTUNE 500® company, is a global leader and innovator in semiconductor solutions for wired and wireless communications. Broadcom® products seamlessly deliver voice, video, data and multimedia connectivity in the home, office and mobile environments. With the industry's broadest portfolio of state-of-the-art system-on-a-chip and embedded software solutions, Broadcom is changing the world by Connecting everything®. For more information, go to www.broadcom.com.

About NXP Semiconductor

NXP Semiconductors N.V. (Nasdaq: NXPI) provides High Performance Mixed Signal and Standard Product solutions that leverage its leading RF, Analog, Power Management, Interface, Security and Digital Processing expertise. These innovations are used in a wide range of automotive, identification, wireless infrastructure, lighting, industrial, mobile, consumer and computing applications. A global semiconductor company with operations in more than 25 countries, NXP posted revenue of $4.4 billion in 2010. For more information visit www.nxp.com.

About Freescale Semiconductor

Freescale Semiconductor (NYSE:FSL) is a global leader in the design and manufacture of embedded semiconductors for the automotive, consumer, industrial and networking markets. The company is based in Austin, Texas, and has design, research and development, manufacturing and sales operations around the world. www.freescale.com.

About Harman International

HARMAN (www.harman.com) designs, manufactures and markets a wide range of audio and infotainment solutions for the automotive, consumer and professional markets - supported by 15 leading brands, including AKG,

Harman Kardon

, Infinity, JBL, Lexicon and

Mark Levinson

. The Company is admired by audiophiles across multiple generations and supports leading professional entertainers and the venues where they perform. More than 25 million automobiles on the road today are equipped with HARMAN audio and infotainment systems. HARMAN has a workforce of about 12,500 people across the Americas, Europe and Asia, and reported net sales of $4.0 billion for twelve months ending September 30, 2011. The Company's shares are traded on the New York Stock Exchange under the symbol NYSE:HAR.

Media Contacts:
Tamara Snowden Broadcom Corporation 408 922-6505 tamaras@broadcom.com	Birgit Ahlborn NXP Semiconductor 49 1705746124 Birgit.Ahlborn@nxp.com	Andy North Freescale Semiconductor 512 996-4498 andy.north@freescale.com	Darrin Shewchuk Harman International 203-328- 3834 Darrin.shewchuck@harman.com

Broadcom®, the pulse logo, Connecting everything®, BroadR-Reach® and the Connecting everything logo are among the trademarks of Broadcom Corporation and/or its affiliates in the United States, certain other countries and/or the EU.  Freescale, the Freescale logo, are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off.  Any other trademarks or trade names mentioned are the property of their respective owners.

SOURCE Broadcom Corporation; BRCM Infrastructure & Networking

News Provided by Acquire Media

I'll admit to being one of those that used Amazon extensively over the past few years to get around taxes ... but it's really time to stop that. I'm just draining biz away from local firms and benefiting places where Amazon workers (and executives) do their thing. Not fair, and I'm stopping. I'm glad that even Amazon is supporting this act ... good on them!

Disclaimer: This blog post has little to do with Bearmageddon or drawing comics.  Also, I feel like I risk sounding egotistical in some of the things I write below.  I am attempting to write about being a big brother, and that means to write about being looked up to.  I want to write honestly, with humility but not false modesty.  I’ve done my best, but you can be the judge.  Also, because this blog is about brothers, it is about boys.  I love my sisters dearly, and some of this applies to them as well, but I am speaking mainly from the experience of growing up in a house of brothers.  I also write a lot about the dark side of being a musician, and I do not mean to paint all musicians in this way, but only those who truly believe they are the super-humans fans make them out to be.

The character Louis is meant to embody not only my own three younger male siblings, but he is a nod to the young male fans that used to show up at my band’s rock concerts.  That is why he is wearing a Lunaractive hoodie, which was the name of my band.  A lot of the kids that came to our shows had that hairstyle, and even though it bears a resemblance to Malachai in some way, it was actually those kids who inspired it.  Much like being a big brother, being in a rock band tends to put you into a position in which, whether you like it or not, you are seen by some as a kind of super hero or mini god.  I do not attribute to myself these things in the least, but I can say it from the experience of being called a hero on more than one occasion, and in my own experience of how I viewed my own favorite rock stars (especially those in my own home town who were close enough to touch but still so far away I could never be “one of them”).

In fact one day at a concert I literally came upon a kid who looked identical to me at age 15 (I was 25 at the time) who walked up to me and asked if I was Ethan, and then told me I was his hero.  It was surreal, and eye opening.  It reminded me that those kids looking up to me were not fans, or others… they were me.

I don’t know if it is common for a guy in a popular rock band (and we were only popular in a small part of Oregon) to carry the weight of feeling like he has taken on a whole group of new siblings, but I think that all of us in the band felt that way.  We didn’t want to abuse our position, even if it was simply by ignoring it.  We always tried to make ourselves available, to step down from the pedestal kids put us on and let them know we really believed that the highest place we could be was not on a stage where in general only the most shallow and self-indulgent people spent their time, but down where the richness of people could really be experienced… off the high horse and at the same level as everyone else.

It is not an easy lesson to learn, and I don’t know that we fully learned it, because for all the talk I think we all still got a thrill from the experience of standing in the lights at a level higher than the rest of the room and being cheered harder than we had ever been cheered by our own family or close friends… and the simple reason for that is because they knew us very little in truth, and a whole lot in fantasy.  Nonetheless, the 65% cheer of a loved one means a world more than a 200% cheer from a stranger, but in the moment, the stranger’s cheer feels so much better, it just doesn’t last as long.  For if they are cheering you that hard, they are making no room for the possibility that you need correction in life, and the family member who loves you knows that if they put 100% into cheering for you, their will be no energy left to lift you up, and I do not mean to lift you up to a pedestal, but out of the pit you don’t yet realize you are in, and of which all your fans are willfully blind.

During my short time as a rocker I saw a lot of people who survived on the cheers of strangers.  It was like living on a strict diet of microwavable popcorn.  It was a fun, festive and cheap delight that was meant for a late night horror movie on occasion, not to sustain you day after day as a replacement for honest human interaction.  Why are so many rock stars quiet, reserved, hard to talk to and in their own world?  Because they live on that higher ground, the stage, where love comes easy, it costs nothing, and nobody thinks you need correcting.  On the floor, where the most burned out losers share foot space, you have to face the fact that you are just as susceptible to being a fool as any of the rest, and it’s terrifying.

I do have to say that I attribute my straying from the intoxication of the stage not only on the fact that there was never money in it (there isn’t much in comics either, and to be honest, not making money is not a big deterrent for most people addicted to the stage) I have to give credit where credit is due, and that is the church.  You may be the kind of person who is strong enough to find these truths in life without the teachings of humility that I would say saved my soul, but I am not.  I know what I am made of, within my own dark heart, and I know that in me is a guy who revels for the cheap praise of strangers like a dog at feeding time.  I must point outside myself for any explanation as to why I would not have committed my life to the microwavable popcorn of rock n’ roll, because I in my heart loved the attention.  I believed that I, like all people, have a higher calling than to be a great rock star… it is to be a great person, and it became very clear that being a great rock star was detrimental to my greater goal.  I needed to step down to a place where I was not only no longer looking down on others, but that I could look up to them.

From left: Ethan, Noah, & Isaiah Nicolle

I contrast the unearned praises of fans with the unearned praises of little brothers.  I have three and they all mean the world to me.  Most of you are very well acquainted with one aspect of my relationship with Malachai, but few of you know of my other two brothers, Noah who is 2 years younger than me, and Isaiah who is 6 years younger.  Noah and Isaiah share the same mother as I do, Malachai has a different mother.  Noah and Isaiah are the brothers I grew up with, went through the hell of transformation out of childhood with, and who know me better than most anyone else on this earth.  This blog is dedicated to all three brothers, but to these two the most, because they were with me from the days I was a child, and they knew me at my most horrifying stages of metamorphosis.

What is fascinating to me about my little brothers, is that even before I was any kind of hero to anyone else, I was a hero to them for no reason but because I was born first.  Just as by divine roulette I had been given an unquenchable desire to draw pictures without ever getting exhausted, and to eat food without ever looking down at my gut, I had been put in the position of big brother.  My Dad likes to say we are given a “package” in life and it contains some things that are their to make life easier, and some to make life harder… the things to make life easier may only be a vice in disguise.  For my Dad, his pursuit of fame as an Opera singer felt like a good part of his life package until he learned what he was truly meant to do with that thing is set it aside and step down from the Opera stage and unshield himself from the harshness of being small like the rest.  So, part of my package was to be a big brother, and with that package came the great honor of being looked up to… to be a hero without having earned it for one second.  Of course, with that honor came the responsibility to try to fulfill that roll, because much like a parent, in the position of big brother you are looked up to whether you want to be or not.

I say this because as I look back on my life, a lot of little things were instrumental in my journey as an artist and as a man.  Many things deserve credit including my faith, my parents, my friends… but few deserve quite as much credit as my little brothers, because they treated me like a hero before I ever could be even close to becoming one, and if I ever could deserve to be called a hero by anyone, it is because of that self-fulfilling prophecy that they proclaimed when they were only toddlers, they told me my future and believed it far before I ever could… not in the encouraging way of a friend, or the hopeful way of a parent, but in the never doubting faith that could only come from a child who believes wholeheartedly in insane things like Santa Clause, Dragons and Big Brothers.  So, when my brothers wonder how I became the guy I am, I have them to thank in large part.

I hope this doesn’t sound like I am lifting myself up too high, I am only trying to acknowledge that I am in a blessed position, and I know that it is due in part to luck, providence and drive.  Well, even the drive I can not take full credit for because I am saying that it came from the providence of little brothers saying I was awesome, and luck is always a term used out of ignorance of how the universe really works.  In other words: I consider my brothers a gift from God.

Proof that we actually started out this awesome.

Don’t let this fool you into thinking my brothers and I had a great relationship all our lives, especially Noah and I used to fight like cats and dogs.  In fact, my treatment of Noah as a child is one of the great regrets of my life because looking back I see that he looked up to me and I looked down on him.  Much later in my early 20′s, when I began to befriend my comic artist hero Doug TenNapel, I realized for the first time what it felt like to have a big brother.  I realized how inspiring it is, but I also realized how horrific it would be to have someone you hold in that high regard look down at you and berate you.  It took me 30 years of my brothers looking up to me, for me to finally look up to my little brothers and see that they are me heroes as much as I was ever theirs.

So if you have little brothers I hope you look up to them too.  And if you are aspiring for fame, I hope you see as clear as possible how cheap it is compared to the true heroism bestowed on you (and that you are called to) simply by being someone’s son, daughter, brother or sister… not to mention mother or father.  The stage is an incredibly lonely place.  It’s a lesson I thank God for every day.  Thanks for reading.

 

Ethan

 

P.S. for those of you who had wanted to buy my older comic series Chumble Spuzz from SLG at dirt cheap prices (under $4/book) they are now back in stock!  Also, if you live in So Cal come see me at Long Beach Comic Con this weekend!

1

Wonderful comment about being a big brother from another great comic artist.

CureTogether is a great service ... not exactly scientific, but loads better than the typical "my cousin's father-in-law's best friend" report. It counts on self-reporting, which adds considerable bias ... but it at least has *numbers*, and those numbers are open and readily available for analysis.

Anyway, this is interesting as *I'm* a GERDsufferite ...

Sunday, 16 October 2011

Open Mike: Why Creationism May Be Ungodly

As an unregenerate, dyed-in-the-wool Doubter I have fairly radical views about religion. Not according to me, of course, but probably the religious would see it that way. But one thing that's always perplexed me is what I understand to be a central tenet of fundamentalism: that everything in the Bible must be literally true.

I've learned to my surprise over the years that many people who have argued religion with me haven't actually read the Bible, which I find curious. One friend told me that she knows what's in it because she hears about it from her priest, and that's enough for her.

Well and good, but still, I'd recommend reading the Bible as well as at least a few lay commentaries on it. I'll set aside atheistic favorites like Doubt: A History by the talented Jennifer Michael Hecht (she's also a poet) or the delightfully entertaining Ecce Homo! by the French materialist Baron d'Holbach. And I'm actually not a big fan of "The New Atheism"—Hitchens, Dawkins et alia—which as a rule I find tendentious and ponderous as well as partially if not largely irrelevant. For believers, I don't think logic enters into it, so logical refutations are sort of talking past the point.

If you appreciate blasphemy rendered with a sharp stick and lemon juice, though, you'd enjoy the d'Holbach, the world's first modern biography of Jesus of Nazareth. Pity it can hardly be found. The edition I have is the 1977 Gordon Press reproduction of the first American translation of 1827; the book originally appeared pseudonymously in 1770—in Amsterdam, I believe—as Histoire critique de Jésus-Christ. Its author put himself in considerable peril by writing it. Its English translator, one George Houston, c. 1799, whose words were the basis for the "rev. and corr." American First, was tossed in jail for two years and fined just for translating it. [UPDATE: It's actually on the web, in its entirety. The web version is apparently the British translation, with footnotes that the first American edition lacks. Amazing! Thanks to Matteo for this. —MJ]

 

But I digress. As I was saying, I'd recommend reading, preferably simultaneously, at least two translations of at least the New Testament (although the Old is astounding and hence, really not to be missed). For those who prefer to read English, I'd recommend a reader's edition of the famous King James Bible, rendered at the end of the Elizabethan era and a masterpiece of translation in its own right (I have a thing for Elizabethan translations, including the KJV). Augment that with something such as J. B. Phillips' New Testament in Modern English. Not only are they Englished quite differently, but the translators in either case had quite different sources from which to work. Then there are commentaries for both the credulous and the skeptical which further illumine the experience. (The one I wanted to recommend I can't find...I wonder if I loaned it to someone.)

In any event it seems basic to me for both believers and non-believers to discover first what we are talking about.

If one actually reads the Bible, it becomes obvious pretty quickly that the literary methods employed are things such as allegory and extended metaphor, tales with morals, mythos, parables, symbolism, and poetic justice. In other words, you can't read it "literally"—or you miss many of the points entirely!

"No, no, you must take Aesop literally. This one's not about human beings preparing for the future, it's only about one actual ant, and one actual grasshoppper, who plays the fiddle. No, 'fiddle' is not a euphemism for the way grasshoppers make noise by rubbing their legs together! This grasshopper played an actual fiddle, made of wood with catgut strings and a horsehair bow. The point of the story? Just that an ant is more likely to make it through a winter than a grasshopper is. Why would you even ask? It has no meaning beyond that, and there is no lesson or moral or significance in the story for people; am I an ant? No. Are you a grasshopper?! No. Don't be stupid...."

Some Sunday thoughts
But here's the point about Creationism. If you believe in God, and God (who created us) gave us our brains, and the brains God gave us are capable of understanding the mechanism of how He made the world and everything in it, how could anyone plausibly refuse such a gift? Evolution is simply God in action; our ability to understand it also has to be a privilege granted by God, does it not? Why did God both create DNA and also let us detect and decode it, if He didn't want us to understand the mechanisms of His creation? Since you really can't understand much of anything about the world without understanding evolution, averting one's eyes—deliberately choosing to remain in ignorance—is to refuse one of God's greatest gifts...if all gifts come from God.

I've simply never seen the religion and evolution as being incompatible, is all. Unless you insist on reading the Good Book's creation allegory literally, which seems on its face like a fool's errand to this infidel. But then, I'm just imaging or postulating the position of the believer, not being one myself. Maybe I don't get it. It simply seems to me that if I were a religious person in the time of Darwin, my reaction would merely have been, "Ahh! So that's how He did it."

I'm just sayin'.

Mike

 "Open Mike" is a series of off-topic essays by Yr. Hmbl. Blogger that appear only, but not always, on Sundays.

http://theonlinephotographer.typepad.com/the_online_photographer/2011/10/crea...">Send this post to a friend

Please help support TOP by patronizing our sponsors B&H Photo and Amazon

via theonlinephotographer.typepad.com

From a completely irrelevant source (but one that I frequently enjoy for the photographic content and advice) comes this fabulous commentary.

Good interface design is as transparent as possible, because I don’t want to have to think about it. I just want to write, or do whatever else I’m doing, and not have to think about whatever I’m doing it on.

From a writer that I admire, about what he wants in a tech product. It seems that he is exactly the kind of person that I have in mind while doing *my* engineering work. I consider a design a success if no one has to notice how clever it is.

http://bmwmoarally.com/motorcycle-adventure-blog-contest

and to www.RevZilla.com

So, Revzilla, my favorite online motorcycle gear site, is having a contest ... they are just asking "why do you ride?" and that got me to thinking (as unusual as that might be). What came up was really simple, and rings true: "Riding alone, or with my wife (on her bike ... two-up is too constraining), is the perfect antidote for sitting here at the computer, or cooped up in a meeting room, or puzzling out one more interesting (but *inside*) technical challenge. I just love being *in* the environment, moving *through* the landscape, smelling the plant life and feeling the wind

Solving the SSL CA Debacle Using Multi-Signed Certs

Published on Monday September the 5th, 2011

The recent Comodo and DigiNotar breaches have proven that the HTTPS trust model is broken. Every browser trusts the opinion of hundreds of Certificate Authorities. If a single one of those CA's is breached by a hacker, government, or mischievous employee, then you can't be sure that the HTTPS connection you're making isn't being intercepted. To make the problem worse, if a CA (Comodo for example) has a very large share of the SSL market, the browsers can't just "untrust" them; millions of non-technical users would suddenly start getting HTTPS errors. My proposal addresses both the issues of forgery, and the issues of CAs who are too big to fail.

The concept is quite simple. The implementation, a little more involved. Instead of requiring that a certificate is signed by a single trusted authority, require multiple independent trusted signatures.

Forgeries

If a browser requires that a certificate is signed by at least N trusted authorities (three maybe?), then getting forgeries signed suddenly become much more difficult. There is the problem that some states might be able to compel three different CA's under their own influence to sign a forged certificate. This could be addressed by requiring that a certificate is signed by authorities in different states. Rather than limiting this issue to "states", each CA could be assigned (in the browser) a list of entities under whos influence they fall. Each certificate would then have to be signed by a minimum of N authorities who don't have any overlapping influences.

Too big to fail?

If a browser requires a certificate to be signed by a minimum of three authorities, and people get their certificate signed by four or even five authorities, then no CA is "too big to fail" anymore. Browsers can remove even the largest CA from their trusted root list, and affected certificates will still have enough signatories to be trusted. If forged certificates are found in the wild that are signed by three different CA's, a temporary "influence" relationship could be created between the three CAs to specify that they have all been compromised by the same attacker.

The technology

X.509 certificates do not allow multiple signatories. A new format/version would need to be developed. TLS would need to be updated to support this too. All web browsers would also need to be updated to support this. On the plus side, this technology could be rolled out gradually. Once the browsers support it, they could start off with the requirement that a certificate must be signed by at least one trusted authority. A date could be set where this minimum number increases. Certificates need to be renewed anyway, so this change shouldn't catch anyone by surprise. We would need co-operation between the major browser vendors for such a roll out; this years World IPv6 Day shows that this sort of co-operation is possible on the Internet, when the problem is large enough. Co-operation from the CAs is guaranteed; if the larger ones don't want to take part, I'm sure there are plenty of smaller CAs who would prefer to take a larger slice of the certificate market.

Alternatives

Perspectives and Convergence do away with CAs altogether, and introduce the concept of "notaries." When you visit a HTTPS URL, your browser connects to multiple notaries and asks them if the certificate you're seeing is the same as the one that other people are seeing for that site. This solution is potentially workable, but it would require a large number of notaries to be created, and for the browser to automatically and randomly choose a default set, preferably run by entities without overlapping influences. 99.99% of end users will not pick and choose their own notaries, nor should they have to. Convergence has addressed end user privacy by configuring notaries as one hop proxies so the IP of the site visitor can't be easily linked to the site being visited. This is the bare minimum required for privacy.

Very interesting idea ... conceptually simple, straight-forward engineering ... politically useful discussions by the browser vendors. The browser with the "safest" set of acceptable CAs would be preferred by consumers. Hmm. Maybe the browser vendors could even color-code or otherwise label the webpages with a "Apple trust" or a "Microsoft trust" or a "Mozilla trust" level ... and may the safest and yet most useful "trust" mechanism win.