Domain: ittoolbox.com
Stories and comments across the archive that link to ittoolbox.com.
Comments · 51
-
Re:Truce
It's just the one computer (a pager) telling the server the status of a message ( it's been read), then the server automatically telling another pager (belonging to the same user) to mark the message as 'read'.
Like IMAP.
SAP GUI told users they had sessions logged on elsewhere, back in 2002.
http://sap.ittoolbox.com/groups/technical-functional/sap-basis/audit-of-multiple-logons-108489
Obvious.
-
This is patently incorrect.
Samba has supported LM, NTLM, NTLM v2, and kerberos authentication for quite a long time (since v2.2 at least). Your gripe with "unencrypted passwords" is only valid if you want to use PAM for password authentication (which requires the password to be sent over the wire to be "applied" at the server side as if you typed it into the login prompt) and you are not using kerberos or LDAP, as you should be. This feature of windows is purposely disable in XP SP1 and greater because it is retarded and you don't know how to properly set up your linux box in a sane way.
-
Re:A serious reply, but even shorter...Ignoring the rest of your post. but in the end the spreadsheet was based off of lotus 123 older than both. Lotus 1-2-3 was a successor of VisiCalc which itself was originally released in 1979, 4 years before Lotus 1-2-3. But even Dan Bricklin (co-creator of VisiCalc) states "The special thing about VisiCalc was not that it was the first row/column tabulation program. There were many such programs of various sorts prior to VisiCalc." and concluding "It was the combination of many things including its "programming by example" user interface and its influence on others that made VisiCalc special."
See Bricklin's Was VisiCalc the "first" spreadsheet?. Here's an account of somebody old enough to actually have used VisiCalc at the time. And while I'm at it be sure to check out the Computer History Museum's Software Industry Special Interest Group's Overview of the History of the Software Industry. -
Re:Frosty Posts
*tinfoil hat*
Yeah but who is to say they haven't already fiddled with the compiler?
-
Re:And on the plus side. of plus-size..
Spinach has almost no iron content. Popeye was wrong.
http://soundmedicine.iu.edu/segment.php4?seg=238
Popeye's creators chose spinach -- instead of, say, brussels sprouts or broccoli -- because of an 1870 German study that claimed spinach contained about as much iron as there is in red meat!
In reality, this was nothing more than an accounting error. The scientists put the decimal point in the wrong place!
The iron content of spinach is actually one-tenth of what was reported. The mistake was corrected in 1937. It was too late for Popeye, though. Hed already been getting strong on spinach for almost 10 years!
Spinach does contain iron, but no more than other leafy vegetables.
In fact, the iron in spinach is not easily absorbed by the body unless its combined with an acid, such as a squirt of lemon juice.
http://blogs.ittoolbox.com/bi/websphere/archives/spinach-10166
Spinach took another hit in the early 90s when research into nutrition refined what we know about iron absorbtion. To quote the Innvista website: Although much lauded as a nutritional vegetable, spinach has a drawback in that, while containing high levels of iron and calcium, the rate of absorption is almost nil. The oxalic acid binds calcium into an insoluble salt (calcium oxalate), which cannot be absorbed by the body. The same applies to the iron, as it is bound, leaving only 2-5% of the seemingly plentiful supply actually available for absorption.
The spinach iron myth suffered two big falls. Cut to 1/10th and then further cut to 2-5% of that 1/10th. A pretty big data drop. I did a blog search of the spinach / iron combination and found a lot of entries from people taking spinach for the iron content who had never heard the correction to the myth. It is better to try and get iron from a range of foods rather then spinach along. Spinach has a lot of positive things going for it but iron is not one them.
-
Re:Amish use websites?
No, I've just visited photography web-pages dedicated to the craft of barn-raising:
Amish Barn-Raising
A discussion
I'm amazed that so many people can be coordinated in such a confined space. There's a new building being built on my local campus. At most there are never more than 10 workmen on site at any time, and even then, they are always working in separate areas, operating machinery (elevators, cranes, clamps for plate glass). -
Re:Nightmare
that's not even completely valid. there was a hack to the earliest unix C compilers which recognised if they were compiling login.c and inserted a back door. If the compiler detected it was compiling the compiler, it inserted the code which looked for compiling login. Then, the non-hacked compiler and login were put back to make the system look innocent. read more
So, you actually need to examine the program with a debugger. Oh wait, the debugger might be compromised too so as to hide the backdoor!
-
Re:Boycott the Olympics
There are other examples of totalitarian capitalist countries.
capitalist!=free -
forgetting history
>that's hogwash. you don't use a compiler that you don't have the sources to.
The grand parent was making a reference to a historical case where a compiler binary was created that would create a back door in compiled software. Editing the compiler sources in this case would normally help, except that the compiler was designed to detect that it was recompiling itself and reinsert the code that had been removed from the sources.
http://blogs.ittoolbox.com/emergingtech/edge/archives/ken-thompson-and-the-selfreferencing-c-compiler-16142
In this case, it's impossible to determine the back door exists by reading the sources, or remove it by editing it. -
Re:Corporate Espionage?
Sorry folks, not new news, been discussed at least 14 months ago here. http://blogs.ittoolbox.com/security/dmorrill/archives/google-apps-is-a-risk-management-decision-14666 Anyone else got anything earlier? It would be interesting to track the history of stories like this. At least this is a good refresher on what to think about.
-
Re:because they've been conditioned
I think the term you're looking for is "managing expectations." Here's a little article about it from the IT side. It's something that Microsoft and teleco's have become so good at. If you keep expectations low and give them a little better, they'll be more than happy. If you give the same, but you promised the world, you get a bunch of unsatisfied customers.
-
Re:Will it be used?
People like myself who design software requiring a database usually prefer speed over features.
Then the choice is easy. PostgreSQL is faster than MySQL, especially for highly concurrent workloads. PostgreSQL 8.3 increases the performance gap considerably.
PostgreSQL SPEC benchmark
PostgreSQL 8.2 vs MySQL 4.1 and 5.0
PostgreSQL vs MySQL 5.0 pages per second
PostgreSQL 8.2 vs 8.3I suggest you bone up on PostgreSQL tuning (here's a handy configuration guide) and perform your own comparison.
Anyone else wondering when this "MySQL is faster" myth is finally going to die?
-
Re:Such anger
http://www.vistaheads.com/forums/security-news/1689-microsoft-convicted-fine-1-52-billion.html
http://episteme.arstechnica.com/eve/forums/a/tpc/f/48409524/m/3850972554
http://channel9.msdn.com/ShowPost.aspx?PostID=361048
http://www.theregister.co.uk/2002/03/19/why_microsofts_eu_concession/
http://search.zdnet.com/index.php?t=4&s=0&o=0&q=screwed
http://blogs.ittoolbox.com/visualbasic/dotnet/archives/infoq-fire-and-motion-what-openxml-means-to-ibm-and-lotus-notes-14187
I don't know, man, do a little Google search - it's not hard to track down.
As head honcho, the responsibility for corporate crime rests on the CEO's shoulders, even if current legal practice doesn't actually make them pay for their surrogate criminality. -
Re:Yeah, but...
Even that isn't too much security.
Before WPA, if you had that setup with WEP, you could still be hacked easily:
aircrack / whatever to steal password, then spoof your mac address to the clients, snatch up a bit of traffic to find the subnet/ip range + the gateway, done!
Most of that stuff will only help against average users with KisMac or some other app that will crack WEP. If someone knows what they are doing, and is determined to clog your pipes, they will succeed.
And WPA is also hackable, though it is not as easy.
http://blogs.ittoolbox.com/wireless/networks/archives/wpa-encryption-cracking-7419
To much security would be having the internet gateway being a squid proxy with NTLM authentication, port knocking, or weird SSH tunnels to get to the internet. This is reasonable security, which all Slashdot users should have. -
TopCoder Inc. Misconceptions
There appear to be a lot of misconceptions about TopCoder and it's business model. I work as an architect for TopCoder and can honestly tell you that it's one of the best software development companies in the world. I've written a blog entry to clear up a lot of the misunderstandings that some people have. http://blogs.ittoolbox.com/visualbasic/dotnet/archives/about-topcoder-inc-21092
-
What about Darwin Calendar Server?
Apple provides a nice calendar server with Leopard server - but it works with Linux (any anything else running Python) as well...
-
Re:Yep, the next answer will be
Where did I say Firefox is all open source projects?
"Unfortunately, that is the direction open source is headed."
This is referring to the attitude of the open-source teams, and it does seem to be going the same way the Mozilla teams are going. I do believe the open source teams will get to the point of telling people to fix the bugs themselves. Actually, it may already be the attitude of some open source teams. Allegedly, some have already used the line "If you don't like it, fix it yourself." No I am not trolling or trying to flamebait but if this is indeed the attitude of the Firefox teams "or open-source in general" then it needs to change if open-source is to grow. On the other hand, those who call it "open-sores" or Linux "Linsux" are simply immature.
http://www.cygwin.com/ml/cygwin/2000-06/msg00613.h tml
http://blogs.ittoolbox.com/linux/locutus/archives/ is-open-source-complacent-16924
I have given suggestions for features to closed-source developers and every time they have stated they will implement it when there is enough of a demand for it. They also have seem to take bug reports. -
Re:Sorry but...
Was this guy hired to experiment with alternative operating systems on company time? Because from TFA, it looks like he's not one of the I/T guys.
The guy in TFA would be Mike Kravis. There's a link from TFA to his bio which gives his job description as "enterprise architect". So unless he designs buildings for a living, I think he probably IS employed to experiment with alternative operating systems on company time.
Let the IT guys work out which OS you can use.
I am an IT guy, thank you. I think you'll find a disproportionate number of Slashdotters are.
-
Re:We finally have PROOF (but not real proof)
My understanding is that running mysql on anything with more than 4 cores shows a performance drop, so i can't see why you'd want to use more...
Yup; it's fairly well known that MySQL doesn't get as much benefit from additional cores (see, for example, MySQL 5 only showing 6%-14% improvement when going from two cores to four, compared to PostgreSQL jumping 77% in the same situation) and has performance drop-offs beyond certain levels though Josh Berkus of PostgreSQL pointed out in response to that test that Postgres will also top out, just at a higher number of cores), so using a machine with fewer cores can actually favor MySQL.
The common wisdom among folks who know what they're talking about seems to be that lower-end hardware and certain use patterns (lots of single-table stuff or simple joins) favor MySQL, while beefier boxes and different use patterns (complex queries where the Postgres cost-based planner can shine) favor PostgreSQL.
-
Bad firehose!
Why this emaciated post made it while mine didn't I'll never know...here's how I submitted this story:
The current version of PostgreSQL now has its first real benchmark, a SPECjAppServer2004 submission from Sun Microsystems. The results required substantial tuning of many performance-related PostgreSQL parameters, some of which are set to extremely low values in the default configuration — a known issue that contributes to why many untuned PostgreSQL installations appear sluggish compared to its rivals. The speed result is close but slightly faster than an earlier Sun submission using MySQL 5 (with enough hardware differences to make a direct comparison of those results unfair), and comes close to keeping up with Oracle on similarly priced hardware — but with a large software savings. Having a published result on the level playing field of an industry-standard benchmark like SPECjAppServer2004, with documentation on all the tuning required to reach that performance level, should make PostgreSQL an easier sell to corporate customers who are wary of adopting open-source applications for their critical databases. -
Re:Why isn't WEP recalled?
Your use of "all a matter of time" somewhat overlooks the sheer scale of the problem at hand.
Quoting MechaBlue (from http://blogs.ittoolbox.com/wireless/networks/archi ves/cracking-wpapsk-6730):
Assuming a decent utility is used, a 31 character long password of random upper- and lowercase letters and numbers results in 62^31, or 3.7x10^55 possible combinations.
If we assume 60 attempts per second, it will take more that 1.3x10^36 times the age of the universe (15 billion years) to attempt every possible combination. The average time would be half that, or 6.5x10^35 times the age of the universe.
Even if someone were to come up with a scheme that reduced the bruteforce time to 1 trillionth of what would be required otherwise, it would still take 6.5x10^23 times the age of the universe. And so on...
That is perfectly good enough for me to secure my home network :-) -
Re:Why isn't WEP recalled?So you're either referring to this dictionary attack or you're just making stuff up. All of the reported WPA cracks are for WPA-PSK and are brute force cracks. I don't see why you'd need modified firmware to do a brute force attack (although I guess you could make it faster that way, but ideally you'd do the attack on captured traffic, so it wouldn't make a difference). If you're instead referring to some super secret uberleet method to take advantage of a flaw in the crypto of WPA (like the weak IV's or small keyspace of WEP) then out with it! Pretending like you've solved a very difficult problem but refuse to tell people how you did it screams of you making it all up.
And a brute force attack isn't a real crack, either. Quoting MechaBlue on this site:
WPA-PSK may be vulnerable to a brute force attack but, with the choice of the right password, it becomes unfeasible. Assuming a decent utility is used, a 31 character long password of random upper- and lowercase letters and numbers results in 62^31, or 3.7x10^55 possible combinations. If we assume 60 attempts per second, it will take more that 1.3x10^36 times the age of the universe (15 billion years) to attempt every possible combination. The average time would be half that, or 6.5x10^35 times the age of the universe. Even if someone were to come up with a scheme that reduced the bruteforce time to 1 trillionth of what would be required otherwise, it would still take 6.5x10^23 times the age of the universe. And so on... Unless someone find another way to get the password (e.g., can determine from traffic (like with WEP), beats it out of me, hacks my laptop, etc.), my WAP will remain secure until long after I'm dead. And that's good enough for me.Thinking about it, though, I'd bet you could pick up traces of the unencrypted datastream in poorly designed cards. That's hardly a crack for the crypto, though.
-
Re:Why isn't WEP recalled?OK, so WEP is the United Nations of encryption schemes--only slightly better than no encryption at all.
This December 2005 blog post (the first google hit for "WPA hack") http://blogs.ittoolbox.com/wireless/networks/archi ves/cracking-wpapsk-6730
saysThe other tools that caught my interest are Aircrack and Airdecap because they work for both WEP and WPA encryption, which in my experience thus far hacking tools are typically limited to WEP.
Fine. Bash WEP. But what's the point of killing myself getting WPA configured when it buys me, at most, a bit of time?
If I'm worried about packet security, better just trot out the CAT 5 cable, near I can tell.
Certainly would cut down on the configuration agony experienced across all the operating systems I use. -
Re:What's going on here? - But DB2 is free too!
I had to check on this to and yes, it is now free.
The only restrictions relate to the number of CPUs( 2 max-single or dual core) and the amount of system memory( 4 GB max ):
http://blogs.ittoolbox.com/database/technology/arc hives/free-db2-7555 -
Re: Shared-Nothing Architecture
Gee, I don't know anyone who's been succuessfully doing this for years... or getting crazy performance with partitioned databases, or anything...
/Caveat, I work for the folks who make this product... but nobody pays me for PR or anything -
Clarification
One of the PostgreSQL developers quoted in the article feels this article is inaccurate in some ways.
-
Re:What gap ?
It has to do with how it stores data. I think you need to use compact n repair every once in a while. More info here.
-
You can use them to blow stuff up!
Apparently there is a theory going around that these RFID-based passports can be used to set off bombs? I read it here.
-
Look At All Of These Passwords!
On a related note, check out this article in ITtoolbox called Look At All Of These Passwords!. Apparently, the public terminals at DefCon had illicit listeners. It's pretty amazing how many popular sites don't have any safeguards against a linux user using ettercap.
-
didnt read tfa
http://blogs.ittoolbox.com/security/investigator/
a rchives/look-at-all-of-these-passwords-11240
this is a good one, anyone buy any amazon books lately? take a look here. -
Re:This would helpApparently not so.
Quoting Deb Goodkin of FreeBSD Foundation (from here):
We spent close to $35,000 for this release. It is hard to estimate the future costs of maintaining the Java releases since we expect to build updated distributions in response to all security advisories released by Sun.So, while the license itself might have been given gratis, this clearly shows that the process of obtaining it was cumbersome and costly, and the result is still a limited, version-dependent, binary-only distribution.
Yes, Java is still evil. Changing license for something more liberal would certainly help much with adoption here. -
'Blazing' Angels
Maybe they should have talked to this guy before writing that review.
-
Good example of a linux - OS X switcher
Ok, you may have to go back to the very beginning of this blog , but in his early case files he is clearly a linux user. He talks about using Kpresent, KDE, and Gentoo Linux a lot. Then almost without explanation, he has a powerbook running OS X! I was surprised though because I didn't think there were a lot of forensic tools for OS X but I guess he is just compiling the linux ones using fink and X11? Anybody? SecurityMonkey if you're reading this please comment?
-
Not all bloggers are created equal
I have found great value in bloggers like Bruce Schneier and Security Monkey, and I think to paint them all with one brush is useless. There are some scumbag bloggers that are out for attention and revenge - but if we wish them to go away, aren't we taking away from the purpose of blogging?
Something to think about. -
Thanks MySQL!
Dear MySQL,
Ever since you and joined forces, my PostgreSQL hosting and consulting business has gone up. On top of that, several existing customers have begun asking how they can migrate their applications from MySQL to PostgreSQL. While I am happy to hear that you finally got yourself some stored procedures and other advanced features... it saddens me that you're doing business with a company (SCO) that thinks that one of your business models is unconstitutional. You are tainted now. However, I really just wanted to say thanks for the extra work that have you provided me. It's no secret that being a professional PostgreSQL consultant is going to be a highly valuable skill in the coming few years...there is already a shortage. Thanks for sending people to the world's most advanced open source database server!
Former MySQL fan,
Me -
Yes, techies can write fiction!
Well, almost fiction I suppose. A weekly read of mine is SecurityMonkey's stories, and I nearly pee myself waiting for the next installment.
Rumor: he apparently has a book deal in the works. I'm going to pre-order on Amazon!!! -
CMS Recommendations
Are you considering Java based ones? There are quite a few of them like OpenCMS, Lenya and Alfresco. There is a short review here http://blogs.ittoolbox.com/km/content/archives/00
5 119.asp. If you want to use a portal server that has content management capabilities, then Liferay is a good choice. It is JSR168 compatible. There is a good review at http://portlets.blogspot.com/2005/07/open-source-p ortal-server-selection.html and http://www.apoorv.info/index.php/2005/07/16/open-s ource-portals-comparison/. If you are looking for non java ones, there is midgard, drupal, plone (based on zope). I've used wordpress, which although not a CMS can be used as one for smallish sites. regards /a http://apoorv.info/ -
Wait a minute! This sounds familiar.
So I've been reading this security stories series for the past few months and this guy is describing an investigation that sounds a LOT LIKE THIS!
Coincidence?
Anybody know? -
Intriguing weblog usage?
Say what you will about most bloggers out there, but this guy's blog is still worth a weekly read.
What I like is that instead of doing the "blah blah blah" about news items or what's going on in his life, he shares real stories (although he's changed some things to protect the innocent I suppose) that are very well written, suspenseful and entertaining.
If you're into computer or information security - you need to check it out! -
Interesting take
According to http://blogs.ittoolbox.com/security/investigator/
, the disclosure may have been to cover their ass or keep the thugs from using the info? I hope I wasn't one of the victims. -
My Favorite Blog Is Written By A Monkey!
I'm sure these guys are paid on this site, but this dude writes some fascinating stuff about computer crime case files. He updates is pretty regularly too.
http://blogs.ittoolbox.com/security/investigator
The writing style is great. -
hmmm better comments on longhorn posted here...
-
Couple of interesting blog entries on this too...
'Sophos' has some good blog postings over at ITToolbox on the emerging market of "Digital Snake Oil" in the antivirus/antispyware product sector...
http://blogs.ittoolbox.com/eai/implementation/arch ives/001997.asp
http://blogs.ittoolbox.com/eai/implementation/arch ives/002284.asp -
Couple of interesting blog entries on this too...
'Sophos' has some good blog postings over at ITToolbox on the emerging market of "Digital Snake Oil" in the antivirus/antispyware product sector...
http://blogs.ittoolbox.com/eai/implementation/arch ives/001997.asp
http://blogs.ittoolbox.com/eai/implementation/arch ives/002284.asp -
I've converted my wife to Firefox and Thunderbird
I've been hearing the same complaints from my wife about her computer being slow for months. She's using a Dual Pentium III 750 with 512 Megs of Ram and Windows XP. The problem was her computer is slow, it was IE and Outlook XP being slow.
This weekend I converted her over to Firefox and Thunderbird. Not only was she happy, she was REALLY happy about it and she's thanked me twice more today.
I write a blog on IT Toolbox and today I wrote about this topic. Go check it out!
http://blogs.ittoolbox.com/visualbasic/dotnet/arc
h ives/001750.asp -
Here's why Linux on Apple hardwareOn the desktop side, I see no advantage of running Linux rather than OS X. Don't get me wrong, I use Linux on my IBM laptop all the time, but on OS X I can run the same programs and also all the nice Mac OS X only things like iTunes.
I primarily run OS X these days, but I've lived with Yellow Dog on an older iBook and it was a great experience. Nobody is even close to Terrasoft's Mac hardware support, particularly on laptops. My iBook YDL 3.0 install was even better behaved on PPC than its parent, Red Hat 8, was on x86. Airport and power control works right out of the box.
I'm with you on iTunes. But guess what? It will be supported by Codeweavers in the full release of Crossover Office 3.1.
The primary reasons for running YDL on Apple hardware are the same as running Linux on any platform: free or inexpensive software and freedom from Corporate hegemony. OS X totally rocks. But it ain't cheap, and you'll sink big dollars approximating the functionality of Linux' totally free Open Office, GIMP, and so on. The boxed edition of YDL is quite reasonably priced, and comes with the riches of Open Source software we all take for granted.
In a commercial setting, Mac hardware is elegant and durable. More importantly, Terrasoft is an authorized Apple reseller. That means great support, making PPC Linux a viable alternative for mission-critical installations.
I'm not sure YDL's claim to be lighter than OS X is justified these days. OS X has been running pretty well since Jaguar (even on older G3s), and the big two desktops are
... well ... pretty big. But with Linux on PPC, you can pick and choose window managers and programs to get the most out of your hardware. Can't really do that on OS X.Finally, a lot of people simply *like* their Linux desktop environments. KDE folks get used to the way KDE works, and the same could be said for Gnome or Windowmaker or whatever. Familiarity breeds efficiency.
I have money in OS X software, so I run Panther on all my Apple gear. But Linux is a great call for a lot of PPC users. And it will scream on a dual G5 when Terrasoft releases their 64-bit native suite.
-
See
See this
blog -
Typically misleading SCO press releaseFor instance,
SCO has a worldwide network of more than
... 8,000 developersThe last reliable reference I could find for the total number of SCO employees was 375, as of last August. Of course, not all these were developers. SCO will claim that this figure of 8,000 includes everyone who works for their resellers and has ever touched SCO code. But, in reality, this is just deliberately misleading.
-
use
a real source of information.
ITtoolbox -
Re:What is IT?
I guess when I use the term IT Professional I mean someone with a general understanding of the IT Industry, and the ability to represent that angle in a business context. Not, as you describe, a person with an understanding of a subset of the industry.
Sort of the concept of IT as espoused by sites like IT Toolbox. You know, enterprise stuff, ERPs and CRMs and the like.
The writer of this story took IT to mean programming, you take it to be a term used exclusively by end lusers, and I mean by it something implying much broader understanding.