What you need to make these cocktails:

Six pack of Corona Extra
Bottle of Bacardi Limon
Lime
Coctail stirrer (a chopstick works fine)

Pop a slice of lime into a Corona and hand to a friend. Have them drink the neck, then refill with Bacardi Limon (putting the lime in first seems to reduce fizzing). Stir and hand back to them so they can drink it down as it fizzes up a bit.

Mixing rum and beer may sound nasty, but this actually results in a very smooth, tasty drink. It's our favorite accompaniment when we are playing Rock Band.

We took this recipe and applied it to one of our other favorite beers as well: Honey Moon Summer Ale (also works with Blue Moon, or any other typically orange-flavored beer). Just use Barcardi O instead of Limon.

Enjoy!

The interesting thing to me is the big question of certifying companies v/s individuals.  I think the endgame will involve doing both because you certify companies for methodology and you certify people for skills.

This is the problem with certification and accreditation services as I see it today:

• Security staffing shortage means lower priority:  If you are an agency CISO and have 2 skilled people, where are you going to put them?  Odds are, architecture, engineering, or some other high-payoff activity, meaning that C&A services are candidates for entry-level security staff.
• Centralized v/s project-specific funding:  Some agencies have a “stable” of C&A staff, if it’s done wrong, you end up with standardization and complete compliance but not real risk management.  The opposite of this is where all the C&A activities are done on a per-project basis and huge repetition of effort ensues.  Basic management technique is to blend the 2 approaches.
• Crossover of personnel from “risk-avoidance” cultures:  Taking people from compliance-centric roles such as legal and accounting and putting them into a risk-based culture is a sure recipe for failure, overspending, and frustration.
• Accreditation is somewhat broken:  Not a new concept–teaching business owners about IT security risk is always hard to do, even more so when they have to sign off on the risk.
• C&A services are a commodity market:  I covered this last week.  This is pivotal, remember it for later.
• Misinformation abounds:  Because the NIST Risk Management Framework evolves so rapidly, what’s valid today is not the same that will be valid in 2 years.

So what we’re looking at with this blog post is how would a program to certify the C&A service providers look like.  NIST has 3 viable options:

• Use Existing Certs: Require basic certification levels for role descriptions.  DoD 8570.1M follows this approach.  Individual-level certification would be CAP, CISSP, CG.*, CISA, etc.  The company-level certification would be something like ITIL or CMMI.
• Second-Party Credentialing:  The industry creates a new certification program to satisfy NIST’s need without any input from NIST.  Part of this has already happened with some of the certifications like CAP.
• NIST-Sponsored Certification:  NIST becomes the “owner” of the certification and commissions organizations to test each other.

Now just like DoD 8570.1M, I’m torn on this issue.  On one hand, it means that you’ll get a higher caliber of person performing services because they have to meet some kind of minimum standard.  On the other hand, introducing scarcity means that there will be even less people available to do the job.  But the big problem that I have is that if you introduce higher requirements on commodity services, you’re squeezing the market severely:  costs as a customer go up for basic services, vendors get even less of a margin on services, more charlatans show up because you’ve tipped over into higher-priced boutique services, and mayhem ensues.

Guys, I’m not really a rocket scientist on this, but really after all this effort, it seems to me that the #1 problem that the Government has is a lack of skilled people.  Yes, certifying people is a good thing because it helps weed out the dirtballs with a very rough sieve, but I get the feeling that maybe what we should be doing instead is trying to create more people with the skills we need.  Alas, that’s a future blog post….

However, the last thing that I want to see happen is a meta-game of what’s going on with certifications right now–who certifies those who certify?  I think it’s a vicious cycle of cross-certification that will end up with the entire Government security industry becoming one huge self-licking ice cream cone.  =)

Bookmark to:

Of course the board's owner should have been making backups all along, but he has been very sick for the past year and wasn't able to. And the Internet Archive has been only somewhat helpful.

More and more, information we rely on -- either created by us or by others -- is out of our control. It's out there on the internet, on someone else's website and being cared for by someone else. We use those websites, sometimes daily, and don't even think about their reliability.

Bits and pieces of the web disappear all the time. It's called "link rot," and we're all used to it. A friend saved 65 links in 1999 when he planned a trip to Tuscany; only half of them still work today. In my own blog, essays and news articles and websites that I link to regularly disappear -- sometimes within a few days of my linking to them.

It may be because of a site's policies -- some newspapers only have a couple of weeks on their website -- or it may be more random: Position papers disappear off a politician's website after he changes his mind on an issue, corporate literature disappears from the company's website after an embarrassment, etc. The ultimate link rot is "site death," where entire websites disappear: Olympic and World Cup events after the games are over, political candidates' websites after the elections are over, corporate websites after the funding runs out and so on.

Mostly, we ignore the issue. Sometimes I save a copy of a good recipe I find, or an article relevant to my research, but mostly I trust that whatever I want will be there next time. Were I planning a trip to Tuscany, I would rather search for relevant articles today than rely on a nine-year-old list anyway. Most of the time, link rot and site death aren't really a problem.

This is changing in a Web 2.0 world, with websites that are less about information and more about community. We help build these sites, with our posts or our comments. We visit them regularly and get to know others who also visit regularly. They become part of our socialization on the internet and the loss of them affects us differently, as Greatest Journal users discovered in January when their site href="http://barry095.vox.com/library/post/greatest-journal-death.html">died.

Few, if any, of the people who made Wine Therapy their home kept backup copies of their own posts and comments. I'm sure they didn't even think of it. I don't think of it, when I post to the various boards and blogs and forums I frequent. Of course I know better, but I think of these forums as extensions of my own computer -- until they disappear.

As we rely on others to maintain our writings and our relationships, we lose control over their availability. Of course, we also lose control over their security, as MySpace users learned last month when a 17-GB file of half a million supposedly private photos was uploaded to a BitTorrent site.

In the early days of the web, I remember feeling giddy over the wealth of information out there and how easy it was to get to. "The internet is my hard drive," I told newbies. It's even more true today; I don't think I could write without so much information so easily accessible. But it's a pretty damned unreliable hard drive.

The internet is my hard drive, but only if my needs are immediate and my requirements can be satisfied inexactly. It was easy for me to search for information about the MySpace photo hack. And it will be easy to look up, and respond to, comments to this essay, both on Wired.com and on my own blog. Wired.com is a commercial venture, so there is advertising value in keeping everything accessible. My site is not at all commercial, but there is personal value in keeping everything accessible. By that analysis, all sites should be up on the internet forever, although that's certainly not true. What is true is that there's no way to predict what will disappear when.

Unfortunately, there's not much we can do about it. The security measures largely aren't in our hands. We can save copies of important web pages locally, and copies of anything important we post. The Internet Archive is remarkably valuable in saving bits and pieces of the internet. And recently, we've started seeing tools for archiving information and pages from social networking sites. But what's really important is the whole community, and we don't know which bits we want until they're no longer there.

And about Wine Therapy, I think it started in 2000. It might have been 2001. I can't check, because someone erased the archives.

This essay originally appeared on Wired.com.

From the little I've seen of this app, it looks pretty impressive. I'll keep experimenting and post my findings here.

Here are some hopefully helpful hints if you want to give it a try along with me. I installed all of the items on the "Required Packages" list:

1. I already had Python 2.5 installed.
2. The Glade runtime environment was trivial to install.
3. PyGTK was a little more complicated. Since these instructions were written, it looks like the project was split into three parts, and I think you need all three (which are trivial to install). I installed the latest versions of each for Python 2.5. Once you get all three installed, add the bin/ directory from the GTK into your path and bring up a python command shell (just run python.exe to do this) then type 'import gtk' and if you don't get any errors, you're probably good.
1. PyCairo
2. PyGObject
3. PyGTK
4. PyWin32 install was trivial.
5. PIL was also trivial.
6. PyRTF is python sources, which you'll need to install. Copy the directory to a drive somewhere, then bring up a command shell and CD into the directory you just created. You should find a setup.py file there. Run 'python setup.py install' to install. This is what I'll call a "python install" from now on.
7. ReportLab also requires a "python install", so do the same thing.
8. PySqlite2 - the website is down as I write this, so I don't recall what type of install it requires, but I don't remember having trouble with it...
9. Metakit - this one I couldn't quite figure out how to install, but it appears to be an optional thing.

Once you've installed all of the prerequisites, it's easy to install Gourmet Recipe Manager. It's also a python install, and once you've run the setup.py script, you can launch the program as described in section 3 of the instructions.

From the little I've seen of this app, it looks pretty impressive. I'll keep experimenting and post my findings here.

Here are some hopefully helpful hints if you want to give it a try along with me. I installed all of the items on the "Required Packages" list:

1. I already had Python 2.5 installed.
2. The Glade runtime environment was trivial to install.
3. PyGTK was a little more complicated. Since these instructions were written, it looks like the project was split into three parts, and I think you need all three (which are trivial to install). I installed the latest versions of each for Python 2.5. Once you get all three installed, add the bin/ directory from the GTK into your path and bring up a python command shell (just run python.exe to do this) then type 'import gtk' and if you don't get any errors, you're probably good.
1. PyCairo
2. PyGObject
3. PyGTK
4. PyWin32 install was trivial.
5. PIL was also trivial.
6. PyRTF is python sources, which you'll need to install. Copy the directory to a drive somewhere, then bring up a command shell and CD into the directory you just created. You should find a setup.py file there. Run 'python setup.py install' to install. This is what I'll call a "python install" from now on.
7. ReportLab also requires a "python install", so do the same thing.
8. PySqlite2 - the website is down as I write this, so I don't recall what type of install it requires, but I don't remember having trouble with it...
9. Metakit - this one I couldn't quite figure out how to install, but it appears to be an optional thing.

Once you've installed all of the prerequisites, it's easy to install Gourmet Recipe Manager. It's also a python install, and once you've run the setup.py script, you can launch the program as described in section 3 of the instructions.