Slashdot Mirror

offtopic wrt main topic but, what about SCADA attacks?

PBS did an excellent show on CyberWarfare highlighting that it's the points of weakness where attacks are most likely to occur. Milnet, siprnet, etc may be secured but could any *western* city be without power for a period of 6 months? Think asymmetric not conventional and you can appreciate how real such threats are taken.

If you are running the software on your own laptop, then you don't need to care about 'vulnerabilities'. It's your laptop so you can run what you like on it anyway! For example, run the exam software in a VMware virtual machine or under a debugger. If you demonstrate this point to the exam organizers I'm sure they will rethink their plan.

To do online exams you need to control the PCs being used, as done with Lexis.

When a human player take a look at the chess board, he rejects the vast majority of the possible moves and concentrate only on very few of them.

This is called pruning the search tree. Computer chess players do this too; see a description of alpha-beta pruning.

No, I'm sorry, you're wrong. A console, a stack of punchcards, a bunch of relays on the front of the machine - these are all user interfaces. That's why there's such a thing as a GUI, and a UI, and they're not the same. See User Interface

"On computable numbers, with an application to the Entscheidungsproblem"" is unarguably the paper that began the field of computer science as we understand it today. Here we have the first descriptions of universal computing devices, Turing machines, which eventually led to the idea of universal stored-program digital computers. The paper even seems to describe, in what is unarguably the first ever conceptual programming language, a form of continuation passing style in the form of the "skeleton tables" Turing used to abbreviate his Turing machine designs. It's also relatively easy reading compared to many other scientific papers I've seen.

Along with this we might also include Alonzo Church's 1941 paper "The Calculi of Lambda Abstraction" (which sadly does not appear to be anywhere online), where the lambda calculus, the basis for all functional programming languages, is first described.

I would love to just encrypt my documents dir and leave my music available.

Is it any wonder that when some people recognize the similarity between the simple things that computers can do and the simple things that people can do, that they would want to extend computers in a way that resembles the complexity of human abilities? This isn't to say that the simple things are identical; clearly they aren't. But, the similarity lies in the idea that they can both do simple things. And, if one can easily (unconsciously) perform seemingly complex activities, why not the other?

A good reference for the driving analogy can be found here.

= 9J =

Very true, and not just in the US. I went to IC in the UK and the CS department run their own networks (very well I might add) as a seperate entity from the college-wide ICT who were largely a joke (when I was there anyway).

Very true, and not just in the US. I went to IC in the UK and the CS department run their own networks (very well I might add) as a seperate entity from the college-wide ICT who were largely a joke (when I was there anyway).

Very true, and not just in the US. I went to IC in the UK and the CS department run their own networks (very well I might add) as a seperate entity from the college-wide ICT who were largely a joke (when I was there anyway).

as long as functional programming languages are considered to be declarative (at least according to foldoc) then there are plenty of declarative programming languages. arguably, functional languages are not completely declarative, but they aim high and do a much better job of defining the problem.

A few quotations:
"Make everything as simple as possible, but not simpler." - Albert Einstein
"Genius is the ability to reduce the complicated to the simple." -C. W. Ceram
Any intelligent fool can make things bigger, more complex, and more violent. It takes a touch of genius - and a lot of courage - to move in the opposite direction. - Albert Einstein

The last one being my particular favourite (more here). It does look a whole lot like these proposed modifications, while temporarily giving us what we want, are going to cause big headaches in the future when we all think "Ugh, what an ugly hack" as we try to implement the next big thing.

I think the implementation and design of X is in need of some of the 'neat-n-tidy' treatment. For every issue or teething problem I've had using X, I've nearly always been able to solve it, but hardly ever in a neat and consistent way.

If we can't tidy everything up, then maybe it's time to take a step back and start again, and then say 'may the best project win'. I am particularly looking out for the Y Windowing System, which seems to have all the right ideas, and looks to be very flexible for years to come.

These dirty hacks to put in the features we want might tempt us, but please let us steer clear of digging holes for ourselves.

Just my humble opinion.

This proposal sounds very much like the render/tree-traversal stage of Y (page 25), except that in X your widgets still would be client-side, not server side.

Check out the definition of download. Apparently, there's some sorta bizarre historical usuage of the term that was lost on us kids growing up with BBS systems....

The Japanese are committing genocide in other universes!! They must be stopped!!

Sperry - gone. Burroughs - gone.

According to a FOLDOC article, Sperry merged with Burroughs to form this company. Primary consumer-visible product - here. The patent still subsists for about eight more months in Canada, Europe, and Japan.

Thier proprietary solutions by and large are dead.

I don't know about "by", but Sperry-Burroughs proprietary technology is used in a "large" number of images displayed on the World Wide Web. I'd guess that at least 90 percent of web sites, Slashdot included, use the Sperry-Burroughs proprietary product I mentioned.

Developers in this situation should examine this type of arrangement:

That's from FOLDOC by Denis Howe.

copied and pasted off this site, and he/she/it didn't even mention the source, check out the FAQ guys, CmdrTaco says this should moded as redundant.
thank you.

My experience is that labor is the biggest single cost in a product.

Labor is the entire cost of a product; supply and demand determine the value of the labor used to develop, replicate, and deliver a given product. You're still correct in that Amdahl's Law limits the effect that labor reductions in replication and delivery can have on the product's final price.

This is not the project you are looking for.

Y: A Successor to the X Window System is.

Now move along.

Definition here.

Ah, that would be the quantum computer on board the manned space expedition to Mars, power by a fission-reactor ion-drive. Back home we can watch it via our ubiquetous videophones, or our Linux powered desktops, which can run applications with true Artificial Intelligence. All our homes will be supplied by nuclear electricity that is too cheap to meter. There will be peace in Isreal.. etc..

We live in such interesting times that everyone is taking everything for granted. The idea of a quantum computer was born in 1982 (history of Quantum computing). Now, just over twenty years later, we already have brought bits of the idea into practice - that is stunningly fast, compared with history. Quantum computers are an extremely advanced idea.

Charles Babbage got the idea of a general computer around 1812 (Babbage), but one wasn't built until World War II.

So after only 20 years we already have done some tiny, extremely simple calculations involving a few qubits. Very far from being useful, and still totally amazing that we've come so far. Most ideas take twenty years to become widely known before they're looked at seriously.

So Slashdot readers compare it to Duke Nukem and flying cars, and laugh. These times are so interesting that everyone is jaded.

According to FOLDOC, Murphy's Law is:

If there are two or more ways to do something, and one of those ways can result in a catastrophe, then someone will do it.

The FOLDOC entry (from the Hacker's Lexicon I believe) also mentions the rocket sled thing....

Volume ratings (baud, bits per second, space) that don't have usage expectations have always been base 10, and for good reason.

People tend to forget that there are other things in the world than the eight bit byte. People will get into huge arguments over that a byte is always eight bits, and won't shut up until you show them something like Foldoc: Byte, Knuth1 pp125, K&R1 pp34, etc. Hell, some people will keep trying to argue the point (don't you love those guys that tell you that language is mobile, and that therefore five year old slang, or misunderstandings that they and their friends have, or some other atrocity is legitimate?)

People also tend to forget that these units have been in use since considering a byte to be eight bits was a risk at best, and that changing the system which has been in place for almost half a century would balk far more expectations than the one litigant which couldn't be bothered to do their homework, either before shopping or before filing suit .

Come on, how many of you here are old school enough to remember what that 8 in N,8,1 meant? How many of you remember dialing E,7,0? Was that for nothing? I was still calling Atari Hydra BBSes in the early nineties. That's not exactly ancient history. If the defense lawyers need proof that those systems were and still are common (embedded, these days, but still,) tell them to crack out the term programs that come standard with their favorite OS, or the AT command set.

It is not appropriate to assume that the space measurements of a device which is not itself allowed to assume the alignment requirements of the host align with your expectations. Period. The boxes of hard drives and modems have been reading the full numbers since the 1980s. It is not the manufacturer's fault that the plaintiff was not acquainted with old, appropriate practice that predates the standards that the plaintiff is inappropriately attempting to hold the manufacturer to.

Frankly, even if they were right, this would be a stupid, frivolous lawsuit. I hope they have to pay the manufacturer's legal bills. This litigation-happy society has got to go.

"operating system (OS) - The low-level software which handles the interface to peripheral hardware, schedules tasks, allocates storage, and presents a default interface to the user when no application program is running. The OS may be split into a kernel which is always present and various system programs which use facilities provided by the kernel to perform higher-level house-keeping tasks, often acting as servers in a client-server relationship. " -- FOLDOC

It's not a matter of complexity, an operating system is just a layer between the user and the hardware, takes care of all the background work for you, lay your ATM application on top of that (or even better integrate it in to the OS).

It's unclear how windows-like the ATM OS is/will be, I figure by "stripped down" they mean "the average person isn't going to have any idea this is windows, it just runs on the same kernel and has the ability to interact with other MS designed elements". That being said, I am certainly not pro MS ATM... AFAIK no where in the world does really "important" stuff (life support systems, defense systems, etc...) run anything resembling windows... I would much rather have my bank running something which is historically a little more secure/stable...

...(especially when that sniffing is misspelled "most civilised counties", and directly contributes to marketing-droid number inflation), how about looking it up?

More power to the plaintiffs. Maybe next we can get it so monitors can stop being labeled ridiculous things like "19 inches (18 inches viewable)". Who cares what the size across the glass envelope is -- I wanna know how big my screen is, dammit!

...(especially when that sniffing is misspelled "most civilised counties", and directly contributes to marketing-droid number inflation), how about looking it up?

More power to the plaintiffs. Maybe next we can get it so monitors can stop being labeled ridiculous things like "19 inches (18 inches viewable)". Who cares what the size across the glass envelope is -- I wanna know how big my screen is, dammit!

...(especially when that sniffing is misspelled "most civilised counties", and directly contributes to marketing-droid number inflation), how about looking it up?

More power to the plaintiffs. Maybe next we can get it so monitors can stop being labeled ridiculous things like "19 inches (18 inches viewable)". Who cares what the size across the glass envelope is -- I wanna know how big my screen is, dammit!

Sounds like an interesting effort. I was just thinking the other day about how "profiles" of C++ might provide the safety and ease (eg. pointer checking, garbage collection) of Java or C#, without re-inventing the entire wheel.

As an alternative approach, I've had some success with this tool, which is basically a patch to gcc so that the code that is emitted on compilation contains bounds checking for each and every pointer arithmetic operation, including array indexing.

It works by finding the size of the block which is the target for the "base pointer" of any pointer arithmetic, and checking that the final result is within the bounds of that block.

The disadvantage is that it will slow your code down, but if security is important enough that becomes less important. However, it *doesn't* require any change to your code whatsoever.

I have not deployed code compiled with this extension, but I have used it when running unit tests over our existing code base, and it did find some subtle problems lurking in our code that had some of the real C language-lawyers around the place scurring to prove the tool was wrong and that their code was OK. After much argument, and referral to the C standard, it turned out the tool was exactly right in all cases. These were problems that didn't shown up at all in Purify! It really worked very well, and I didn't expect it be worthwhile at all.

I'm currently reading "Building Secure Software" (Addison-Wesley), and that's how I discovered this extension. This book seems quite good so far, despite the fact that I know a lot of it already. It doesn't just focus on prevention, but also talks about auditing and monitoring and other important deployment issues that are often ignored. You just can't assume that "nothing will go wrong" ...

It would be nice if every undergrad were to have read this book (or something like it) at some point.

I find the one made by americans much funnier. The one above was made by german hackers kind of in response to the american one.
(Nothing against germans, or even for americans..I just find the american one more funny)

Here it is from foldoc:

ACHTUNG! ALLES LOOKENSPEEPERS!

Das computermachine ist nicht fuer gefingerpoken und
mittengrabben. Ist easy schnappen der springenwerk,
blowenfusen und poppencorken mit spitzensparken. Ist nicht
fuer gewerken bei das dumpkopfen. Das rubbernecken
sichtseeren keepen das cotten-pickenen hans in das pockets
muss; relaxen und watchen das blinkenlichten.

The ability to stick this electronic device into that pocket gives you a many to one relationship and will remove any market demand for integrated devices. In fact they are a disfeature[1].

[1] Is that a real word? Go on, pedants you know you want to look it up for me.

As has been pointed out, disfeature is a real world, but "I do not think it means what you think it means."

The word you want is probably misfeature: "...the term implies that the feature in question was carefully planned, but its long-term consequences were not accurately or adequately predicted..."

Not to nitpick, but do you mean 10Base2?

Well, this is an amusing, serious problem that's been with us since the founding days of 100mbit. See: http://wombat.doc.ic.ac.uk/foldoc/foldoc.cgi?query =100baseVG&action=Search.

To quote from that entry, [The AnyLAN] faction wanted to change to a polling architecture from the hub (they called it "demand priority") in order to maintain the 10baseT distances, and also to make it a deterministic protocol. The CSMA/CD crowd said, "This is 802.3 -- the Ethernet committee. If you guys want to make a different protocol, form your own committee". The IEEE 802.12 committee was thus formed and standardized 100BaseVG. The rest is history.

Now, back then, the issue wasn't so cut and dried - AnyLAN was targeting CAT3 cable, required 4 pairs, and was backed by companies likely to have kept important parts of it under patent. Thus, the triumph of Holy and Glorious Ethernet seemed like a victory for the engineers and all that was Free and Good in the world. Even if latencies became more of a problem. Even if the cable lengths had to get shorter. You could throw switches at the problem and keep your collision domains small, and that was that. The reign of the Token Ring lords is over! Life is beautiful!

Fast forward to gigabit. The cable lengths keep getting shorter. Rewired for CAT5? Great! Now rewire for CAT5e and fiber... But worse, the latencies/overhead begin stealing a bigger chunk of throughput. It takes people a while to notice - PCI and internal buses have often been the limiting factor in gigabit throughput - but now they're starting to.

Meanwhile, 802.11 crops up. It's no longer using 'pure' ethernet technology -- CSMA/CD becomes CSMA/CA and other techniques, but it gets marketed as 'the real ethernet,' versus, say, HomeRF or other technologies, to great success.

Now, people start thinking of 10gbit and beyond. CSMA/CD, the foundation ethernet itself, is already stretched far beyond its limits, but people have been trained to mistake "ethernet" for "standard"/"open," and all else to be "bad"/"evil." Even if you can seamlessly bridge ethernet frames to another technology and back (HomePNA, AnyLAN, the now ubiquitous DSL/cable systems... and as noted, even 802.11 come to mind), the market at-large doesn't "trust" it unless it carries the Ethernet brand, or 'sneaks in' to a niche people think they already understand. (Notice that DSL/cable-to-Ethernet bridges are still referred to as 'modems,' because consumers are used to the idea of a magic box that connects you to an ISP. If someone pitched a LAN architecture and called their interfaces 'modems,' even if it performed better than 100baseT, you can imagine it'd be a harder sell.)

So now, after all these years, the various ethernet-boosters are finally going to be called out. We need some new protocols - people have been experimenting with token-passing on *top* of 802.11 to get around some of its limitations, and tech like CDMA holds promise for some interesting post-store-and-forward ideas... but the question is, once CSMA/CD is dropped, "who gets to be ethernet?"

I love the concept of iSCSI, for instance, but ethernet, at present speeds, isn't a perfect carrier for it. Everyone wants high speeds and low latencies, and we already *have* dozens of technologies that could provide them in a cheap and interoperable fashion... but they don't get very far without the ethernet name.

Say you wanted to add an 8 bit field - bits 0-7, to another, bits 8-15, and store the result in a 9 bit field, 16-24.

Search as follows (CC Field is Carry):-

Bits: C 1 1 1 1 1 1 1
Bits: C 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
Find: X X X X X X X X X X X X X X X X X X # All rows
Writ: 0 0 X X X X X X X X X X X X X X X X # Clear output
Find: X X X X X X X X X 0 X X X X X X X 1 # 0+1=1
Writ: 0 1 X X X X X X X X X X X X X X X X # write 1
Find: X X X X X X X X X 1 X X X X X X X 0 # 1+0=1
Writ: 0 1 X X X X X X X X X X X X X X X X # write 1
Find: X X X X X X X X X 1 X X X X X X X 1 # 1+1=0 carry 1
Writ: 1 0 X X X X X X X X X X X X X X X X # write 0 carry 1

So there is a fixed processing time for parallel operations on all the data.

We still had to use two input lines to represent the Ternary value, but, remember, no address lines needed.

Content Addressable memory chips are also used for lookaside Cache memory in CPUs today.

Cheers, Andy!

I remember 20 years ago the father of a friend of mine claimed he had hardware/software that could identify faces. It was all over the TV and newspapers. Nothing's changed.

Frankly, it may be worth jettisoning a lot of the XFree86 baggage and starting anew.

Y, an X Windows replacement, looks extremely well designed and this guy wrote a pretty complete implementation for his thesis.

Why not port the useful bits of X - like the hardware drivers - over to this already-established well-designed base instead of trying to hack XFree86 into something of similar quality?

(Well, the obvious answer, ``to keep the applications`` is fair enough. But a compatibility module wouldn't be too hard, and worth the benefit in the long run.)

If I don't know what I'm talking about, then apparently FOLDOC, everything2, and wikipedia are all equally misled. I'm not picky, though. Call it what you like. Too bad changing the name won't make it better software.

Not all *nix is open source (sun, sco, aix)

And lets not forget about:

The Great Worm of 15 years ago! This infected some 6000 different hosts, on an internet that was very much smaller than it is today, so percentage wise it is perhaps a bigger infection

Perhaps when windows (NT) is as old then it might be as robust as *nix in general. Remember *nix developers have had a long time to fix most of those nasty overflows :)

For all you kiddies that want to read about it, you can drool over its functions here

What we "KNOW" is that the global average temperature has been increasing over the last 150 years or so. Atmospheric physicists and climatologists are trying to work out why. You're right - grant proposals frequently do contain the buzzwords you list. Here's a major climatology project in the UK for example: "the effect of solar variability on climate". Not, you will notice, "an attempt to show that solar variability is the cause of observed climate change", nor "why solar variability has no effect on climate".

There's a point here, and it's that good scientists (the vast majority) are trying to determine what the facts are rather than prove their own preconceptions. I can only assume you base your abuse of scientists in general on the tiny minority you see on television: take my word for it - people with provocative books to defend are *not* representative of the objective majority.

Anyway, back to my first point: scientists are trying to work out why global temperature is increasing. The majority of them believe *personally* (*not* professionally) that human activity is almost certainly the cause. These are people at least as intelligent as the average slashdot reader who have spent years studying the issue. Shouldn't you be at least a little bit worried?

Long before there was war driving there was war dialing. Which comes from a movie about AI written by people who knew nothing about AI. Besides, you've got Ally Sheedy alone in your room, why are you wasting time on that stupid computer?

Sorry, caught me in a bad mood.

Your next lexicographical
assignment is apparent. Nice work on VisiCalc.

Anyway, the last internet sharing gadget I bought was (a) the same $50 price previously mentioned and (b) a true router. There was no mistaking this: by default, all the systems you plugged into it got assigned 10.*.*.* addresses.

And I really think this is a better approach than the one you use. At least it is for most people. Is there better way to prevent a system from being attacked than making it inaccessible from outside your local network? Of course, this means you can't "dial in" to your network -- but most people don't need to do that, and especially don't need the extra headache such a capability implies.

Incidentally, hubs seem to be disappearing. When you can buy a router or bridge for $50, a hub no longer makes economic sense.

Anyway, the last internet sharing gadget I bought was (a) the same $50 price previously mentioned and (b) a true router. There was no mistaking this: by default, all the systems you plugged into it got assigned 10.*.*.* addresses.

And I really think this is a better approach than the one you use. At least it is for most people. Is there better way to prevent a system from being attacked than making it inaccessible from outside your local network? Of course, this means you can't "dial in" to your network -- but most people don't need to do that, and especially don't need the extra headache such a capability implies.

Incidentally, hubs seem to be disappearing. When you can buy a router or bridge for $50, a hub no longer makes economic sense.

Anyway, the last internet sharing gadget I bought was (a) the same $50 price previously mentioned and (b) a true router. There was no mistaking this: by default, all the systems you plugged into it got assigned 10.*.*.* addresses.

And I really think this is a better approach than the one you use. At least it is for most people. Is there better way to prevent a system from being attacked than making it inaccessible from outside your local network? Of course, this means you can't "dial in" to your network -- but most people don't need to do that, and especially don't need the extra headache such a capability implies.

Incidentally, hubs seem to be disappearing. When you can buy a router or bridge for $50, a hub no longer makes economic sense.

Yes ;-) and no. PHP provides a bit less control on choosing the appropriate trade-off between size and speed: an issue born with data structures and algorithms, much older than Java.

How is this scalable, say, to multiple computers?

Performance is a matter of software design and not of language or bytecode or whatever. It's like the "don't debug, verify correctness" principle of eXtreme Programming. Here it's: "don't optimize your code, design it to be fast and scalable".
On multiples computers, your design should also reflect the same principle: avoid reprocessing the same things again and again. The difference is only about granularity. Caesar's "divide and conquer" principle is very useful too.
You may specialize some machines on some subsets of data so each can have in memory the data they need most of the time, let each work on it, and finally merge all sub-results. That's how Google manage its huge index for instance.
You may also keep databases but use them through Active Objects to "decouple method execution from method invocation to enhance concurrency". I often use a LRU cache to address the issue of what should be kept in memory and what should not.

Can you point to a document that explains some of this stuff without using words like 'enterprise enabled'?

That's a very wide topic covering most of computer science: data structures and algorithms, design patterns, architectures of OS, ...
With some experience, I discover OOP and system programming are very similar. Programmers of both worlds often argue although they in fact agree: they simply don't use the same words for the same things!
I therefore suggest you have a look at Design patterns from Gamma and al., Pattern Languages of Program Design from Vlissides and al., read any good book about the architecture of modern OS (paper on I/O aspect), and for god sake keep off "The ultimate /my-favorite-language/ Programming Bible ;-).

IMHO, every programmer should know about design patterns, even if he doesn't consider ever practicing OOP, and about how wonderfully OS are designed, even if he doesn't consider ever leaving Java to write a device driver or an I/O library in C.
In addition to improving software around, it would also make a true miracle: terminate the weekly Biggest Di*k Contest about languages on /.

I'm sure you are right, though not everyone believes this. See Foldoc where is states, Correspondant Bob White claims the modern use of the term predates Monty Python by at least ten years. He cites an editor for the Dallas Times Herald describing Public Relations as "throwing a can of spam into an electric fan just to see if any of it would stick to the unwary passersby."

Ha ha

Another Machinima that's kind of neat is NeoBreakfast, winner of the 2002 "Mach My Day" competition in San Jose (first annual). Recommend broadband, although it isn't strictly necessary.

it's only $169 million: in beltway terms, this isn't a whole lot of money.

(Sorry, but somebody had to do this one, for the old-timers.)