Schneier on Security

You must think my Saturdays are really shit. I'll listen anyways. Thanks.

Thanks a lot.
I am truly happy that the mp3 is published in the internet.

Bruce Schneier:
look at this: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/054041.html

"look at this: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/054041.html"

Does anyone actually believe this information is secret in any way? Does this surprise anyone?

A pity that an organization like the BCS would publish a talk in the (proprietary, patent-encumbered) mp3 format, rather than in ogg format, which is technically slightly better, not encumbered by patents, and for which free (as in freedom) player software is available for all platforms.

I tried to record an mp3, speaking only Bruce Schneier's Social Security number, and my computer self destructed.

Is patch Tuesday the first or the second Tuesday?
http://en.wikipedia.org/wiki/Patch_Tuesday
http://www.networkworld.com/news/2005/011005widernetpatchtuesday.html

@nostromo:
everyone uses mp3. get over it.

Jack Valenti doesn't use MP3.

What you describe (about 33 minutes in) as "annualized loss expectancy" seems to me to be a bad way of determining how much to spend on security. The goal should be spending on security to maximize expected benefit minus cost, not spending to make the total cost equal the total expected benefit (which makes the net benefit zero). Benefit minus cost (which I also called net benefit) is maximized when marginal expected benefit equals marginal cost. (Perhaps "expected benefit" is an odd way to describe "expected loss prevented", it makes the description apply to more than just security.)

@The Anonymous Pilot

Memphis Two seems to be making a habit of it.

http://marc.info/?l=openbsd-misc&m=117512516319539&w=2

There were some people at the end of this during the questions who were talking about some sort of opensource E-cash thing. Did anyone happen to catch the URL for their effort?