Slashdot Mirror

I said "_the_ millions" which means the infected millions. I would have left out the "the", if I meant something different. I put it there for a reason.

If I were talking about uninfected+infected users a different phrase would be more appropriate.

A user who is prone to infection is different from a user who isn't. A user prone to infection is just as likely to be infected whether they ran Windows or Ubuntu.

The number of infected windows computers may even rival the number of Desktop Linux computers worldwide :) [1].

Macs have 10% market share and they ARE getting the same shit, just not so often _yet_:

http://www.wired.com/politics/security/news/2007/11/mac_trojan
http://voices.washingtonpost.com/securityfix/2008/06/new_trojan_leverages_unpatched.html

If they hit 20-30% share, things will start to heat up for OSX, since with a 3:1 or 2:1 ratio - not targeting OSX becomes a significant missed "opportunity" - your botnets would not grow as fast if you just targeted Windows.

Lastly, you said the registry was bad because stuff could be hidden there.

But to most "windows class" users there would be little difference between "hiding stuff" in the registry or /etc. Most of them won't even know that either exist in the first place!

Whereas you'd have just as much luck hiding stuff in the registry from the experts as you would in /etc or wherever.

So I don't see this "hiding" thing as a problem.

If you suspect your system is compromised, the safe thing to do is reinstall and update from a trusted source, then restore data and documents from backups.

[1] http://www.microsoft.com/downloads/details.aspx?FamilyId=47DDCFA9-645D-4495-9EDA-92CDE33E99A9&displaylang=en
http://www.microsoft.com/downloads/details.aspx?FamilyID=e0f27260-58da-40db-8785-689cf6a05c73&displaylang=en

A lot of windows machines don't run windows update and so don't run that tool. Some of them because they have an invalid license.

Last time I checked (and it has been a little while since I checked, so I could be wrong) there was no way to push out power settings with a GPO.

Almost true. Mostly true? Or used to be true. Or, in a perfect utopia, this isn't true anymore.

There's a tool from Energystar called EZ GPO which lets you install an power managment agent on the client, and manage it using an administrative template. In my experience, it works pretty well. It's a bit weird though: for some configurations, the tool doesn't use the win API, and has broken in the past with Windows Updates.

AFAIK, Windows 2008, or a Vista workstation on a 2k3 domain can be used to manage power savings on XP if the client-side extensions are installed.

Also, some expensive tools like LANDesk support power policies. Not ideal for most people ($$$$), but if you're already using "enterprise" management tools, worth checking out.

But FP requires explicit notation when the opposite is true, when sequence matters.

Well, not really, no. Laziness requires explicit sequencing, sure, but not all functional languages are lazy (e.g. SML/OCaml). And you still get a lot of the same benefits from them. What really matters there is functional purity - so long as it's there, it's easy to parallelize. In that sense, the functional approach of "pure by default", with all mutable state marked explicitly, is a Good Thing. It's even better when it's lifted to the type system, as it's done in Haskell - that's your explicit notation.

Now, obviously, it's best to use sensible defaults - i.e. explicit notation should be required for cases that are relatively rarer than those covered by default. And here's the interesting thing:

(from "The Next Mainstream Programming Language: A Game Developers Perspective", by Tim Sweeney)

For-loops in Unreal:
- 40% are functional comprehensions
- 50% are functional folds

So perhaps functional and pure is actually a reasonable default?

In all honesty this is from 1992 so they may very well have a new implementation, but it does sounds to me like the Haskell compiler at the time produced source code in the mother of all imperative languages.

There's no escaping from it - in the end, assembler is an imperative language. But here we get to that "what vs how" difference in approach between functional and imperative. That C code that is output is an implementation detail - it can even be different depending on the target platform it is generated for, and compiler options (number of cores, etc). Could I hand-code it for any given case? Yes, of course. Do I want to do that? Absolutely not.

Does that not show that many of the benefits of FP can be brought to imperative languages by just following conventions?

Sure. And you could also mention that gcc can optimize tail calls these days :) But conventions are brittle things, and optimizing compilers are only so good (both in imperative and in FP world). Even with an ideal compiler, it's all to easy to change an implementation of some small and seemingly unimportant C function, making it non-pure in the process, and have that purity change chain-propagate throughout your entire program, rendering it all non-parallelizable all of a sudden. Same goes for constness analysis (though C/C++ const is pretty useless as far as these things go, as it doesn't guarantee the client that no-one can change the value - merely that he cannot).

And as soon as you start adding "pure" and "const" and "immutable" to the language to move from convention to static checking, and using the idioms involving them heavily, you're effectively doing FP :)

(by the way, gcc is pretty much there - it has proper lexically closing nested functions and tail calls! ;)

And this is what actually happens to some programming languages today. D 2.0 has "immutable" and "pure" (and closures, and ad-hoc polymorphism), even though it's an imperative language on the whole. Thing is, it isn't really, anymore - the line is blurring, and blurring fast. It used to be that closures were considered an arcane feature in mainstream - and now C# and VB (of all languages!) have it and use it heavily, C++ is following with its own lower-level alternative, and Java gurus are ashamed that their own closures proposals are going to miss Java 7. Back to .NET, PLINQ effectively requires functional purity and lazy evaluation, and MSDN Library has articles in it which are essentially FP tutorials for C# and VB programmers. Just five years ago, who could've thought?

And well, that gives me hope that we'll see STM

But if you'd said five years then you would have been right.

You're right, I was off. You can actually run Leopard on a 7 year old Mac.

Big deal, I can also play your stupid game. You can actually run Vista on a 9-year-old PC.

• Windows Vista minimum supported system requirements
  Home Basic / Home Premium / Business / Ultimate
  • 800 MHz processor and 512 MB of system memory
  • 20 GB hard drive with at least 15 GB of available space
  • Support for Super VGA graphics
  • CD-ROM drive

Nobody wants to run Leopard (slowly with lots of eye candy disabled) on a 7-year-old PowerMac G4 that's slower than a 4-year-old Mac mini. Nobody wants to run Vista on a 9-year-old Dell Workstion when a current $279 Dell kicks its ass.

That is why I am so thankful that I still have ten XP licenses from a MSDN subscription I bought back in 2003. The first thing I do when I get a new computer or laptop for personal use is reload it with XP.

Wow, way to violate the license agreement. MSDN isn't a free-for-all way to get bulk licenses for personal use. The software is licensed solely for software development and test purposes. More info at the MSDN Subscription FAQ.

That is why I am so thankful that I still have ten XP licenses from a MSDN subscription I bought back in 2003. The first thing I do when I get a new computer or laptop for personal use is reload it with XP.

Wow, way to violate the license agreement. MSDN isn't a free-for-all way to get bulk licenses for personal use. The software is licensed solely for software development and test purposes. More info at the MSDN Subscription FAQ.

I find this a little scary too: Microsoft also plans a certification program for SSDs

Ever hear of the MS HCL http://www.microsoft.com/whdc/hcl/default.mspx? They certify tons of hardware. Take a look at it, I don't see MSFT trying to embrace-extend-whatever EMC/HDS/IBM/HP disk arrays, Cisco/Brocade FibreChannel switches.

Take off the tinfoil hat....

and with relatively good hardware (dual 64-bit CPUs, 10k RPM SATA drives, 4GB of RAM, etc.) it can take hours to perform even a simple search with a small list

I believe that's why Vista introduced Instant Search. Johnny Law just needs to call ahead and ask the suspect to ensure that it's enabled and properly configured. And that the suspect has at least 4GB of RAM installed, and dual 64-bit CPUs. Also, it would be helpful if the suspect left the computer on so the police don't have to wait around for Vista and Norton and HP to spin up. Hmm. I'm starting to see your point.

I believe XP does have the "Disk Layout task" which runs when the System is Idle. This process is not a defrag but might be confused with defragging.
I couldn't find a good explanation/reference but this article from MSFT gives an overview:
Windows XP does not enter standby after the exact period that is configured in the Power Options profile

Also:
Benchmarking on Windows XP
(look in the section entitled "General Concepts: The Dynamic Nature of Windows XP")

I believe XP does have the "Disk Layout task" which runs when the System is Idle. This process is not a defrag but might be confused with defragging.
I couldn't find a good explanation/reference but this article from MSFT gives an overview:
Windows XP does not enter standby after the exact period that is configured in the Power Options profile

Also:
Benchmarking on Windows XP
(look in the section entitled "General Concepts: The Dynamic Nature of Windows XP")

F# is not a part of VS2008 at the moment, and there was no final F# 1.0 release either. For now, you still have to download it separately. That said, its VS integration is certainly much better than what it was.

It does get a lot of publicity from Microsoft lately, though: it has its own section on MSDN, there were a lot of mentions of it on PDC 2008, including a dedicated session, but also in other presentations (e.g. Anders spoke about F# as one source of inspiration, and demoed it, during his C# futures talk), and so on.

Finally, it has been known for a long time that Microsoft is going to "productize" F# (that is, release it as a boxed commercial product). And finally, just now, Don Syme has announced that F# will be shipped as part of VS2010, and that further F# releases won't be separate, but will be part of VS2010 betas.

And yeah, it's a big deal. To the best of my knowledge, it's the first time a functional language (not just in name, but with roots in the traditional academic FP - ML/OCaml) is commercialized and pushed together with a development environment by the company of size and influence of Microsoft.

F# is not a part of VS2008 at the moment, and there was no final F# 1.0 release either. For now, you still have to download it separately. That said, its VS integration is certainly much better than what it was.

It does get a lot of publicity from Microsoft lately, though: it has its own section on MSDN, there were a lot of mentions of it on PDC 2008, including a dedicated session, but also in other presentations (e.g. Anders spoke about F# as one source of inspiration, and demoed it, during his C# futures talk), and so on.

Finally, it has been known for a long time that Microsoft is going to "productize" F# (that is, release it as a boxed commercial product). And finally, just now, Don Syme has announced that F# will be shipped as part of VS2010, and that further F# releases won't be separate, but will be part of VS2010 betas.

And yeah, it's a big deal. To the best of my knowledge, it's the first time a functional language (not just in name, but with roots in the traditional academic FP - ML/OCaml) is commercialized and pushed together with a development environment by the company of size and influence of Microsoft.

I was apprehensive at the beginning, but then I downloaded their guide (Download Guide) and I liked what I saw.

http://msdn.microsoft.com/en-us/devlabs/cc950524.aspx/

Very easy, graphics based and fast ramp-up to programming concepts, which you can then take anywhere else.

They even have a Logo Turtle...

I was apprehensive at the beginning, but then I downloaded their guide (Download Guide) and I liked what I saw.

http://msdn.microsoft.com/en-us/devlabs/cc950524.aspx/

Very easy, graphics based and fast ramp-up to programming concepts, which you can then take anywhere else.

They even have a Logo Turtle...

It does, here is a RAID 5 example: http://support.microsoft.com/kb/323434

http://www.justbasic.com/

and if you are evil you can do try this too
http://www.microsoft.com/express/vb/

C# is also free in the express edition and it comes with alot.

I would try Visual Basic.NET as it does not suck like the original vb. Also the kids can create dialog boxes and buttons and you can throw in a little logic if needed. .NET can be used if the kids are bored and want to do something more powerful.

Check out Microsoft's Small Basic. It's like a cut down Visual Basic complete with intellisense! http://msdn.microsoft.com/en-us/devlabs/cc950524.aspx It was concieved and designed specifically to get people started in programming.

http://msdn.microsoft.com/en-us/devlabs/cc950524.aspx Enjoy!

Actually it's .wri files, which haven't been savable in Windows since 3.1.

You can rename or Save As to whatever.wri in any version of Windows.
Inferring from the content of the advisory at http://www.microsoft.com/technet/security/advisory/960906.mspx , the extension and format really doesn't matter, except to the extent you can get Wordpad to open the file. It would also work with a .doc extension, but only if you don't have Word installed (which is not vulnerable). To broaden the susceptible audience, .wri will likely be used an attack because it is always associated to the flawed program (Wordpad), assuming you haven't changed that behavior.

http://msdn.microsoft.com/en-us/library/ms686558.aspx

are your arms that weak that moving a 4~5 ounce mouse poses physical strain on you? i mean, why would i use a clumsy 2-inch trackpad when i have plenty of free desk space for movement?

just because you prefer a certain setup doesn't mean it's suitable for everyone else. there's a reason why the mouse is so much more popular than trackpads and trackballs. mice are generally more accurate and have superior ergonomic design than trackpads--which are mainly used to conserve space. it's just more comfortable/natural to use a mouse than a trackpad in applications that rely heavily on movement-based inputs, such as 2D and 3D gaming, image editing, or even CAD programs.

this is how i'd rank various input devices in terms of accuracy/intuitiveness in motion-translation:

1. tablet/screen hybrids (such as the Wacom Cintiq or tablet PCs) / touchscreens - there's really minimal "translation" to be done here as you're just using your hand/arm as the input device. even though a digitizing tablet requires you to hold a stylus pen, your hand movements are still translated directly into pointer movement.
2. conventional digitizing tablets (such as Wacom Graphire, Intuos, etc.) - a handheld stylus is still pretty intuitive and natural, but there's a greater gap between the user's physical motions and the motion of the virtual pointer.
3. a conventional mouse - a mouse provides decent motion-translation for most applications, but it's too clunky for graphic design or other tasks which require accuracy and fine motor skills. also, software functions like motion thresholds and dynamic pointer acceleration (a.k.a. ballistics) can throw off the user's natural motor reflexes (compare drawing a circle with your eyes closed on paper and with a mouse), making the input device less intuitive.
4. trackball - i'm not particularly fond of trackballs. to be honest, they feel a little awkward to me. however, i know a lot of people swear by them. they're not quite as clumsy as a trackpad, but they still don't provide the same ease of movement as the mouse, and as a result trackballs also rely on more pronounced use of thresholds/ballistics.
5. trackpad - trackpads inherit all of the drawbacks of the trackball and then compounds them with a tiny input area. certainly the limited range of physical movement afforded by trackpads are largely compensated for in software, but this just leads to even more pronounced use of motion thresholds and ballistics. in fact, it's almost impossible to get a linear response in X + Y acceleration using a touchpad.
6. pointer stick/nubs - the mouse nipple is about the only thing worse than a trackpad.

Why yes, there is an iSQL, though it's a command-line client tool for MS SQL. But it does meet all of your criteria.

There are more than two goals. In addition to information disclosure and DOS there are the threats/goals of faking identity, tampering, repudiation and elevation of privilege.

The STRIDE model is the one of the accepted ways of categorizing threats in electronic crime/warfare.

http://msdn.microsoft.com/en-us/library/ms954176.aspx

A lot of the security issues in Vista today are there because drivers used those holes to work. People still use hardware that uses those broken drivers, and the companies who released the products stopped supporting them years ago.

Actually Vista addressed the driver issues with new driver models and which broke compatability with many older drivers. The link has the details but a lot of restrictions were created specifically against older drivers and holes. That's exactly why everyone so pissed about Vista because a lot of compatability was broken. Most of the security issues in Vista seem to be people rolling back to XP.

Perl could be a first class citizen on Windows if MS bundled a C compiler and library like any decent OS does.

Or, you could go and download them, geeze! Why bloat installations with bundled stuff that the vast majority of users won't ever need?

There is a fully fledged commerical reason for wanting IPv6 support and end-to-end addressing, from Microsoft of all people. It's called DirectAccess and corporate IT types want it.

Basically, your corporate network is IPv6 IPSec based. Add a static IPv6 nameserver and put it on the internet. You just then allow your servers to be directly accessed over the Internet via IPSec IPv6. No messing around with VPNs, no nothing, your users will be able to access company resources on corporate laptops by just plugging them in to the Internet because your internal servers are just plain accessable via the 'net.

Imagine if everything Just Works on your employees laptop - if they're physically wired in to your LAN, or sitting at Starbucks.

Code from failed projects? It usually ends up here: http://research.microsoft.com/

When you put it all together like that in front of you, you sorta realize we are in a new era, whether developers know it or not.

"They're here..."

Oh yes, they're here, and there's more to it than meets the eye on the first glance. Microsoft is pretty big into pushing FP these days, though they do it pretty slowly; nonetheless, those .NET developers who read the blogs, watch Channel9, and generally keep track of the way things are going, cannot help but notice that the phrase "functional programming" can be seen and heard more and more in that corner of the world. Try Googling for microsoft "functional programming", and see what it gives - about half of that is about F#, as could be expected, but look at the other half. For example, this FP primer - note that it is an MSDN article that is part of the .NET class library documentation that ships for both C# and VB.

And that is pretty serious. The biggest problem of FP was its relative obscurity, because there was no big player behind it pushing it as an industrial-strength solutions. There was a bunch of academics, a few curious hackers, and some bright people who built their start-ups on exploiting FP strength. Now... we'll have to wait and see, but I'm very optimistic about these developments.

One microsoft official, from IE engineering team, has claimed (in an unofficial interview that can be found on the web) that IE8 is the more standards-compliant than Firefox or Webkit engine for instance. That is why it breaks sites that aren't usually anticipated to be broken and that is why they have that readiness page or developers.

So let's assume that is true (and probably is). I would have a tremendous respect to IE8 effort if only they've chosen to adopt crucial CSS features:

- ???-border-radius (WHY!?)

- opacity

- RGBA

- :last-child (WHY!?)

and more .

Simon is still working on and in Haskell.
However, he has been working closely with Don Syme, the creator of F#. And yes, F# rocks. It's an absolutely beautiful language. Easy to learn (for a functional language) and with an extremely clean syntax. I do scientific computing, and I use it for everything now. (Except for plots, which I still do in Python).

You forgot about one more:

C. The guys writing platforms (.NET & Java) will introduce more functional constructs into existing languages, and provide library-level solutions to parallelize them efficiently. Case in point is C# 3.0 and PLINQ.

Today (VS2008):

var result = xs.Where(x => SomeExpensiveCalculation(x) == 0)).Aggregate((x, y) => x + y)
 
Next year (VS2010):
 
<ecode>
xs.AsParallel().Where(x => SomeExpensiveCalculation(x) == 0)).Aggregate((x, y) => x + y)

They're also providing a similar API for C++, only that one is STL-centric.

I think that, overall, it's the most pragmatic approach, and is most likely to succeed in short term. In long term, we'll have to live and see; perhaps stuff like STM will take over.

OK, so why is it so hard to create a hybrid language?

It's not hard, and there are plenty of them:

• Objective Caml
• F#
• Nemerle
• Scala
• Clojure

From the list above, OCaml is presently production-quality, and used rather widely. It also has a good performance profile, rivalring C/C++ with carefully written code. Of the others, the fastest-growing seems to be F# (mostly because Microsoft announced that they're making it into "Visual F#" and likely including it into Visual Studio 2010 alongside C# and VB as the third out-of-the-box .NET development language). Scala has a pretty large following in the Java land, so much so that some call for freeze of Java language spec for the sake of stability, and moving onto Scala for further language development.

Also, most modern dynamic languages (Perl, Python, Ruby, JavaScript) have many functional traits, and so do quite a few mainstream static ones (C#, VB).

Finally, we have a variety of programming paradigms OO, Functional & procedural and more each of which has a problem niche.

We have also seen the merging of those paradigms over the years. Every mainstream language today, with the exception of C, has some form of OOP. Every mainstream language either has or is getting (e.g. C++0x lambdas) first-class function values - with the unfortunate (for Java) exception of Java, now that Neal Gafter has moved from Google to Microsoft. Many languages are introducing lazy sequences and libraries centered around them (Scala, LINQ, Python 3000) Also related is syntactic sugar for list comprehensions (Scala, Python). Then, there are languages that are specifically designed to be combined OO/FP - Scala, OCaml, F#.

Actually, it's worth learning FP today solely for this reason. FP has found its way into mainstream by piggybacking on top of existing OO solutions. For example, if you want to be a good C# or VB programmer today, you have to learn LINQ - and that is all about FP. You may not even be fond of it yourself, but there will be code written using it, and you'd better understand it well enough to be able to maintain and extend it!

Nice the way you reply to only one of the points I made.

FWIW, According to MS, your assertion about being turned on is not accurate.

"On most computers, PAE is disabled by default. "
http://msdn.microsoft.com/en-us/library/aa366796(VS.85).aspx

Windows XP memory management is painful!

Actually yes, MS had released specs for a lot of their proprietary formats in the last two years under their "Open Specification Promise" (e.g. full docs for Office binary file formats and CIFS). Exchange is not on the list yet, but that list grows pretty fast, so I wouldn't be surprised to see it there eventually.

It is worse than that.

Please check this tool and see what it does. Also such a thing should be part of OS, not "Genuine Validated Windows" !

http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en

"The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP."

On Windows 2000 you can benefit from this service if the application event log shows event id 1000 where the message text indicates that the profile is not unloading and that the error is "Access is denied". On Windows XP and Windows Server 2003 either event ids 1517 and 1524 indicate the same profile unload problem."

That's just bunk. There's no inherent limit to 32 bit systems since the PPro:
http://www.microsoft.com/whdc/system/platform/server/PAE/PAEdrv.mspx
Sucks that a microsoft document answers my questions when all this crap about 32-bit addressing floats around.
http://blogs.msdn.com/oldnewthing/archive/2004/08/18/216492.aspx
There's another microsoft document that states the obvious.
The so-called 'limit' is a per-process limit, and is artificially imposed on the whole of non-enterprise versions of windows by microsoft. There's lots of issues with using more than 4GB, you can't really blame them. But you can blame the hardware vendors.
But even the idea of a large video card using memory address space is an artificial limit imposed by poor design of hardware, and dumbed-down versions of windows.
In most cases you're correct (and kudos for being more correct than those who are just plain wrong,) but the limit is, technically, a bug, and not inherent.

I cannot compare costs of patching Windows vs Linux, but I know for Windows you can use Windows Server Update Services. It is free, admins have the ability to control settings via group policies, and can check status of workstations/servers via the WSUS web interface. If it is configured properly then the cost of keeping computers updated is not that high. As for other security measures, there is always other group policy options available such as configuring Windows Firewall.

Of course these steps are only as useful as the Administrator who oversees them.. network infrastructure security, audits, training employees, following procedures, etc must be followed.. but how is that any different than other operating systems?

Have a look at the descriptions of the VirtualAlloc(), MapViewOfFile() and CreateFileMapping() API calls, which are used for virtual memory and shared memory, resp.; Shared memory on Windows is always backed by a file. Virtual memory is automatically backed by the paging file if pages are committed (so that's programmer-dependent). This means Windows has to access the DISK to allocate committed virtual memory or shared memory pages. That's one of the prime reasons why Windows is so slow (another reason is the lazy task switcher which can switch away from a process for 50 msecs or more, which is an eternity to modern CPUs). So, the OP is correct: If Windows was written properly, it would not stuff in the virtual memory statistics when there's still enough physical RAM available, no matter if the virtual memory is currently allocated in RAM; It means there's also space allocated on disk!

Have a look at the descriptions of the VirtualAlloc(), MapViewOfFile() and CreateFileMapping() API calls, which are used for virtual memory and shared memory, resp.; Shared memory on Windows is always backed by a file. Virtual memory is automatically backed by the paging file if pages are committed (so that's programmer-dependent). This means Windows has to access the DISK to allocate committed virtual memory or shared memory pages. That's one of the prime reasons why Windows is so slow (another reason is the lazy task switcher which can switch away from a process for 50 msecs or more, which is an eternity to modern CPUs). So, the OP is correct: If Windows was written properly, it would not stuff in the virtual memory statistics when there's still enough physical RAM available, no matter if the virtual memory is currently allocated in RAM; It means there's also space allocated on disk!

Have a look at the descriptions of the VirtualAlloc(), MapViewOfFile() and CreateFileMapping() API calls, which are used for virtual memory and shared memory, resp.; Shared memory on Windows is always backed by a file. Virtual memory is automatically backed by the paging file if pages are committed (so that's programmer-dependent). This means Windows has to access the DISK to allocate committed virtual memory or shared memory pages. That's one of the prime reasons why Windows is so slow (another reason is the lazy task switcher which can switch away from a process for 50 msecs or more, which is an eternity to modern CPUs). So, the OP is correct: If Windows was written properly, it would not stuff in the virtual memory statistics when there's still enough physical RAM available, no matter if the virtual memory is currently allocated in RAM; It means there's also space allocated on disk!

"... but I'd still like to see some more effort placed into demonstrating that semiconductor RAM remains a scarce resource."

Well, considering in 32 bit Windows-land each process is allocated 4GB of "virtual address space" (the set of virtual memory addresses the process has available to it; 2GB for user and 2GB for kernel by default) you can quickly demonstrate that ram is a scarce resource. Multiply the # of processes running on your system by 4GB and you'll see the exact amount of virtual address space windows is allocating :)

64 bit Windows-land allocates 8TB per 64 bit process, fwiw.

reference:

http://msdn.microsoft.com/en-us/library/aa366778.aspx

With XP, I had a similar problem related to a Maxmem setting in the boot.ini. I had just added another stick of mem, but sysinfo didn't reflect it and there was major swapping. I got rid of the maxmem option, which was set by an old Matrox video driver, and all was right in the world. MS on maxmem: http://msdn.microsoft.com/en-us/library/ms791488.aspx There might be something similar in Vista.

Win32 apps can access more than 2/3GB of physical memory.. if they're written properly. http://msdn.microsoft.com/en-us/library/aa366527.aspx

1GB is around four times the original requirements for running Windows XP

Nope. 1GB is 16x the minimum required for XP Home and XP Pro, which require a minimum of 64MB. Even if you follow Microsoft's recommended minimum of 128MB, 1GB is still 8x the minimum.

1GB is around four times the original requirements for running Windows XP

Nope. 1GB is 16x the minimum required for XP Home and XP Pro, which require a minimum of 64MB. Even if you follow Microsoft's recommended minimum of 128MB, 1GB is still 8x the minimum.

I have a 0 byte paging file.

XP does have a RAM fragmentation problem. See
http://support.microsoft.com/?kbid=330909

I have had good experience with Fast defrag freeware from http://www.amsn.ro/

Windows memory management stinks

... another RIA platform. Only this one doesn't have a userbase yet and I don't think it'll have one to speak of in the near future; it is Windows and Mac OS only (though Sun promises that Linux and Solaris support is underway http://blogs.sun.com/javafx/entry/a_word_on_linux_and). Microsoft has been pushing Silverlight hard and still has only about 30% market penetration in the US (they claim 50% mp in 'some countries' - I'm very curious which countries are these: http://www.microsoft.com/presspass/press/2008/oct08/10-13Silverlight2PR.mspx). With Flash+Flex having a comfortable user base of some 90+%, let's not even begin to compare Microsoft's vs Sun's power to push stuff to the desktops of the masses, it's not even funny.

See Mark Russinovich's (author of SysInternals tools) blog that describes how windows uses memory resources,

Pushing the Limits of Windows - Virtual Memory:
http://blogs.technet.com/markrussinovich/archive/2008/11/17/3155406.aspx

Pushing the Limits of Windows - Physical Memory:
http://blogs.technet.com/markrussinovich/archive/2008/07/21/3092070.aspx

I think he is referring to the userspace/kernelspace split in Windows NT. On 32bit Windows XP, by default, the userspace (ring3) will have at most 2 GB of the physical RAM, and the kernel space would get the rest (some of it paged and some of it not). On systems with more than 3G of RAM (a lot by 2002 standards), it was kinda pointless to reserve that much for the kernel space, so they added a boot.ini flag that changed the split to _AT_MOST_ 3GBytes for the userspace and the rest for kernel space.
In Vista the split for 3G/1G of RAM is default. Actually on a system with 4G of RAM running in 32bit mode, you can't use all of them even if you try (in Windows XP), because right under the 4G limit you would have the PCI memory address mappings, that can be as large as 512M for a common video card with half a gig of RAM. Add to that the RAID controllers and the other hardware, and you have about 800megs of RAM unused because they can't be addressed, as their address-space is used by the installed devices.
I think that http://support.microsoft.com/kb/823440/ and http://support.microsoft.com/kb/171793/ should describe what I'm talking about pretty clearly.