Slashdot Mirror

So seriously, enough with this "OMG MS just needs to make a 100% perfectly secure OS!" shit. It shows massive ignorance of how complex and OS is, and what all you have to balance. No problem with that, you needn't learn about it if you don't want, but then don't argue from a position of ignorance and assume that they could make a perfect OS if only they wanted to bad enough.

Well, the problem is the complexity of their OS. Even Mark Russinovich said they didn't know how the system works:

What we do [instead] is take full Windows, and start pulling pieces off of it. The problem with that is, pieces that're left sometimes have dependencies out to pieces that we've removed. And we don't really understand those dependencies.

"Then your system admin is an idiot. Plain and simple. There is absolutely no other reason for that being possible."

Its called security hole...
any system can have then, but windows always had more, its usually easier to break by design (but its getting better designed in each release) and the lusers are usually alot simpler to trick doing the wrong thing

"WTF? There's a clickable link right there for "Add Programs", where your admin can advertise available programs through Active Directory."

yep, everyone knows how to work with AD, its plain simple in usability!! NOT!!

you are trying to compare windows and linux, yet you use both sides for windows ( home user and enterprise ) yet only home user for linux for comparing

if you are a home user, you have a set of problems for both OS, in enterprise you have others...
example: text files and installing programs in linux on a enterprise is almost totally blocked for users in a enterprise, a decent admin will do all that and the user just use the machine... just like windows
Linux admin for a home user might look harder than windows, but in a enterprise its the oposite

Finally, there are the false issues, linux for home user arent really that different from windows to admin... linux have a lot more choice/flexibility, that might confuse some users, it have advanced apps that are always hard to config and manage, but windows also have its own problems! to start, most of then arent administrated at all, the most common administration action in windows is to reinstall. then a user have to install many apps in windows to make it useful... then update then manually to fix security problems. If you use apps that are build for that system, everything is fine... if you try to use things not designed for that system, you are screwed! ... this for BOTH OS
in any case, users/admin must know what they are doing, not knowing, searching, reading, learning will only lead to complains that it "doesnt work"

Yes, they are supposed to be backed up to Amazon's servers and available over the web.
http://www.ditii.com/2009/05/26/kindle-annotations-accessible-on-web//

But the BlackBerry doesn't store the encryption key in-the-clear like the iPhone 3G S does, and you can't run arbitrary code on a BlackBerry just by plugging it in to a PC.

Again, my point was that YOU can't. That doesn't mean it's not possible to do so, you have no proof this cannot be done. Sure, the BlackBerry is supposed to be secured. The iPhone was also supposed to be.

Either way, if you only have to enter a 4-digit number to get in, then even if the device slows down accepting PINs after a while

No; the BlackBerry (or even the iPhone!) would be configured to wipe the device after a few invalid password attempts. My (corporate managed) BlackBerry wipes the device after 10 invalid password attempts, and my password is longer than 4 characters (and includes non-digits.)

Do me a favor, how about you don't prune off the important part of my message.

Here is my paragraph:

Either way, if you only have to enter a 4-digit number to get in, then even if the device slows down accepting PINs after a while, if you could pry it open and get the data off, all you need to do is try 10,000 combinations and you'll find one that decrypts the internal key needed to view the data on it.

That's why I said you would pry the device open and get the data off. What I am saying is that any device that can be unlocked with a 4-digit code has enough information on it to completely decrypt itself based upon only providing a 14-bit (10,000 combinations) piece of information. I explicitly did NOT say you could sit there and try to guess the code by entering it repeatedly. But you pruned that off, so you could say my statement is incorrect.

It's the same as if I had a 4,000 bit key but I store it inside my house. All you need to do is open my front door (my front door has a lock with only 100,000 combinations) to get inside and get the key.

It may be difficult to get the right data needed to run the 10,000 combinations through the system (sorry for rapid-fire switching back to the other example) offline, but it is there. If you can exploit your way into the Blackberry like you can the iPhone, then you're a long way down the road.

And don't say it's impossible.

http://www.ditii.com/2008/07/17/blackberry-pdf-exploit-exposes-corporate-networks/

Well, as I said it is merely a demo, you would not be likely to use these abilities in this particular way for a real world application.

screenshot: http://www.ditii.com/2009/03/23/glimpse-of-future-web-technologies/

In any case, you first have SVG text on a curved path. There is a rotated (I think all the rotation is done with CSS3) text box that lets you seamlessly change the SVG text. There are also a number of SVG shapes with different Z orders (foreground/background) and different transparencies.

Then there is some rotated MathML, and a button that changes the displayed formula. There is some text near the bottom that has a CSS blur filter, and buttons (rotated) that add more text and more blur. There is a button to highlight some text that is marked up with RDFa information; that info pops up in a box when you hover over the text.

There is a "play" button that is highly styled (multicolored, bold letters, flat red border, white background). When you press it, it makes a (rotated) <video> play and the button now says "pause", while a "stop" becomes enabled. The video has a caption box that uses DFXP timed text. This text is not part of the video, it can be selected, copied and pasted. Also, in the beginning of the movie when a clock ticks, a faucet drips and a phone, the sound effects text is also rendered in SVG and placed on the page around the movie and even on top of the movie.

There is a button that rotates further around its center point every time you press the button. At some times in its rotation, it overlaps the video element. It seamlessly overlays the video even when the video plays.

There is an example of East Asian ruby annotations, although even with the FF beta, you need an extension to see it properly.

Finally there is a reset button that resets everything in the demo to its original state.

1/ Using someone's computer without their permission is a criminal act

First there's the upfront sponsoring of criminal acts. Those supporting MS products are sponsoring anti-competitive and often illegal business methods. Second, Windows can be said to, in effect, be designed to make these takeovers easy, we can extend that observation: running Windows while connected to the net is a criminal act.

• 20 minutes - 2004
• 12 minutes 2005
• 5 minutes - 2008

Now those are from unpatched systems. However, many remote exploits are available for years before Waggener Edstrom / Microsoft even acknowledges their presence. Remember a bug exists, and can have published exploits, whether or not the company acknowledges its existence.

"This is the first time that we have used such a massive number of projectors for the opening ceremony - a combination of approximately 150 Christie Roadster S+20K and Christie CP2000-ZX models, with brightness levels up to 20,000 ANSI lumens,"

Altogether 2,342 fixtures were used for the show which consisted of, amongst others, 308 Vari*Lite VL3500 spot, 316 VL3000 spot, 180 VL3500 wash, 112 Clay Paky Alpha Wash 1200. The first session had 15,921 parameters with 14 MA NSPs and 834 fixtures, the second 13,503 parameters with 16 MA NSPs and 884 fixtures, the third session 15,987 parameters, with 16 MA NSP and 624 fixtures.

The video system under the creative direction of media artist Andree Verleger from Germany included some 110 media servers, 86 Christie Roadster Projectors with Orbital Heads and 63 Cinema Christie Projectors. HP Pro-Curve 2626 field switches, HP Pro-Curve 8212zl and kilometers of multi mode fiber-optic cable were the backbone of the huge network.

Think they didnt use the DL2/3's because the brightness is only about 6.5k lumens if I remember correctly, vs. 20k from the projectors they used. Considering they are already using 150 projectors, along with the long throw/brightness issues and limitations on the lens for the DL2/3's, dont think they could have used them.

The Christie's dont have DMX control (they do have other forms like RS232 and proprietary solutions) so they should still have been able to take the feed offline however.