Slashdot Mirror

/me ducks

This sounds to me like they're fighting the symptoms, not the problem. Worms can only spread successfully because of the sorry state of software security. If we fix that, we will not only get rid of worms, but also of other problems, such as targeted attacks for information theft. Using better languages to write software in can eliminate the bulk of security problems we're currently seeing. Security through diversity and not relying on known insecure software also help.

line 10 column 2435 - Warning: inserting implicit
line 10 column 2547 - Warning: discarding unexpected
line 12 column 46 - Error: is not recognized!
line 12 column 46 - Warning: discarding unexpected
line 14 column 980 - Warning: discarding unexpected
line 24 column 6844 - Warning: is not approved by W3C
line 24 column 6997 - Warning: is not approved by W3C
line 24 column 7004 - Warning: is not approved by W3C
line 24 column 7166 - Warning: is not approved by W3C
line 24 column 7173 - Warning: is not approved by W3C
line 24 column 7423 - Warning: is not approved by W3C
line 24 column 7574 - Warning: is not approved by W3C
line 24 column 7581 - Warning: is not approved by W3C
line 24 column 7729 - Warning: is not approved by W3C
line 24 column 7736 - Warning: is not approved by W3C
line 24 column 8210 - Warning: is not approved by W3C
line 6 column 115 - Warning: inserting "type" attribute
line 8 column 381 - Warning: inserting "type" attribute
line 8 column 449 - Warning: inserting "type" attribute
line 10 column 58 - Warning: proprietary attribute "topmargin"
line 10 column 58 - Warning: proprietary attribute "leftmargin"
line 10 column 58 - Warning: proprietary attribute "marginwidth"
line 10 column 58 - Warning: proprietary attribute "marginheight"
line 10 column 289 - Warning: proprietary attribute "height"
line 10 column 938 - Warning: proprietary attribute "linkarea"
line 10 column 938 - Warning: proprietary attribute "linkid"
line 10 column 1230 - Warning: proprietary attribute "linkarea"
line 10 column 1230 - Warning: proprietary attribute "linkid"
line 10 column 1423 - Warning: proprietary attribute "height"
line 10 column 1570 - Warning: attribute "bgcolor" had invalid value "FFFFFF" and has been replaced
line 10 column 1612 - Warning: proprietary attribute "linkarea"
line 10 column 1612 - Warning: proprietary attribute "linkid"
line 10 column 2554 - Warning: proprietary attribute "linkarea"
line 10 column 2554 - Warning: proprietary attribute "linkid"
line 10 column 3339 - Warning: proprietary attribute "height"
line 10 column 3460 - Warning: proprietary attribute "linkarea"
line 10 column 3460 - Warning: proprietary attribute "linkid"
line 10 column 3761 - Warning: proprietary attribute "linkarea"
line 10 column 3761 - Warning: proprietary attribute "linkid"
line 10 column 4066 - Warning: proprietary attribute "linkarea"
line 10 column 4066 - Warning: proprietary attribute "linkid"
line 10 column 4363 - Warning: proprietary attribute "linkarea"
line 10 column 4363 - Warning: proprietary attribute "linkid"
line 10 column 4672 - Warning:

proprietary attribute "url"
line 10 column 4818 - Warning:

proprietary attribute "menu"
line 10 column 5121 - Warning: proprietary attribute "linkarea"
line 10 column 5121 - Warning: proprietary attribute "linkid"
line 10 column 5258 - Warning:

proprietary attribute "menu"
line 10 column 5561 - Warning: proprietary attribute "linkarea"
line 10 column 5561 - Warning: proprietary attribute "linkid"
line 10 column 5706 - Warning:

proprietary attribute "menu"
line 10 column 6009 - Warning: proprietary attribute "linkarea"
line 10 column 6009 - Warning: proprietary attribute "linkid"
line 10 column 6144 - Warning:

proprietary attribute "menu"
line 10 column 6447 - Warning: proprietary attribute "linkarea"
line 10 column 6447 - Warning: proprietary attribute "linkid"
line 10 column 6578 - Warning:

proprietary attribute "menu"
line 10 column 6881 - Warning: proprietary attribute "linkarea"
line 10 c

I spend atleast one lunch break a week answering questions in the programming forum or some subforum at experts-exchange.

To keep a premium account with them for free, you need to get atleast 3000 expert points a month ... it's always a good excuse to spend time answering people's questions, which usually involves coding - i always write/test the code for people so I A) practice coding B) can get the source later if i need it for a project.

They have forums for abunchof languages ... depending on the forum, the questions may generally be too easy for you, but most questions are posted by IT professionals like yourself, so they can be fun to figure out and answer.

Besides that ... I read a lot of books and I refactor old projects using new methods or I test design patterns or ... I do a lot of .NET coding so I couldn't live without my MSDN firefox search engine (also made one for the codeproject, which has some GREAT articles).

if FreeBSD is so great, why don't they still use it?

It took them at least two cuts at it, as I recall. The first time went rather badly, with delays and even brief outages. The second time they made it.

There was an interesting white paper, originally meant for internal consumption but later leaked (I have a vague recollection that it ended up in a public ftp directory by mistake) that described some of the issues involved. I read it back then and found it a pretty balanced work (perhaps why it had to be leaked.) Their offical public paper is also available.

It's worth noting that Hotmail worked just fine with a FreeBSD front end (the back end was a combination of NT SQL boxes and various Sun systems providing files services and handling incoming mail.) I'm not entirely clear just how much of the site is Windows even now -- they explicitily describe switching over the web servers, but don't really get into the back-end machines -- but I'm sure they're working on it if it isn't. It's a good showcase for them, after all.

" ... Maybe I'm mistaken, but isn't Fair Play a Microsoft thing, you know that little badge that shows up on their mp3 players and cdroms? Isn't Fair Play the CD DRM that Apple refuses to support? ..."

Umm, yeah, sort of, but not quite, exactly.

Microsoft's Fair Play program is a promotional tool used in some countries. It's a registered trademark of Microsoft, and basically gives sales staff prizes for selling software. For example, here's a link for those of you who speak Russian:
http://www.microsoft.com/rus/fairplay/

If you don't speak Russian, well, note the URL.

Apple's FairPlay is a DRM encoding/decoding scheme for music files. It's added onto Advanced Audio Codec format audio (which is not, as you hear often, a proprietary Apple format and works fine in many players) to create a file in the encoded format (which is proprietary).

So it's Microsoft Fair Play (TM) versus Apple FairPlay (TM). And it's AAC with the .m4a (everyone), and FairPlay encoded AAC with the .m4p extension (iTunes, the iTMS, and iPods only).

http://www.microsoft.com/windowsserver2003/technol ogies/clustering/default.mspx

Looks like you caught Microsoft red handed. You know, since there's no such thing.

Judging by the comments, they are clearly losing the battle. You should support the losing side to even the balance, then near the end, when they're about to be mutually destroyed, we post a story with a largely exaggerated title and a couple of links: http://www.microsoft.com/ http://www.riaa.com/ and watch all our dreams come true (except for a date.. but considering those are both the biggest time-wasters in Slashdot, if they're gone we may get bored quickly and actually *gasp* leave our parents basements!)

In all the furor over this, everyone seems to have missed Microsoft's major announcement that the upcoming Microsoft Office 12 (modestly priced from $149 to $499, more or less, depending on who you know) will allow users to export a document in PDF format.
Woweeee! Whoop-de-doo! And thank you, Redmond
If this cutting edge Microsoft technology doesn't permanently kill Google and Sun, and probably even Linux and Macs, then I don't know what will.

Microsoft has collaborated on a new P2P system which is supposedly more efficient than current P2P networks.
Perhaps this will be in Vista?

http://research.microsoft.com/~pablo/papers/nc_con tentdist.pdf

maybe now Microsoft will stop pushing this stupid Marketing ploy..

http://www.microsoft.com/windows/windowsmedia/play sforsure/default.aspx

Plays fer sure my ass.

Enjoy,

Add the so many million that Microsft lost on the X-Box, I know I cost Microsoft a cool $76 by only purchasing Halo 2 and a $10 copy of GTAIII with my X-Box.

Profit loss per XBox: $100 per $199 console.
Units sold since 2001: Approx 15M.

Let's say the loss of $1.5B is wildly exaggerated because Microsoft began selling their unit for $150 at some point in time (I don't remember when). Well consoles bought at $150 lose $50, assuming their manufacturing process didn't get any cheaper. If all 15M consoles were bought at 15M, then that would make a loss of $750M.

Now, I've also heard that buying more than 10 games for your XBox will profit MS from the royalties or whatever such fees exist for developing on their platform. According to this survey, Only 50% of XBox unit owners purchased more than 10 games. Let's be statistically illogical and say this cuts their losses in half, now we're still at $375M.

This magically makes the profit of the XBox and Halo2 combined come out to -$125M. Now we have a reasonable profit goal for Peter Jackson to achieve with this movie. He can probably take a bigger nap than he did making King Kong. I actually saw the whole video documentary of Bryan Singer having to come in and direct for Peter Jackson 'cause he was napping on the couch. It was superb.

You have to.. compile.. these options in? Ewww. Is Linux really that monolithic and stagnant? So far your machine exists solely for the purpose of being set up. What exactly is the point here?

FYI, there is a completely pre-built solution that requires minimal set up. You may have heard of it. And it's not that expensive either ($129 from NewEgg).

Sorry, but the "install and run" ease of use vastly outweighs the "install, sync source, recompile, swear loudly, tweak, recompile, reinstall, guess, finally get working then a new version comes out and you have to start all over again" mess that is dealing with Linux. If I was employed as a sysadmin maybe I'd give a damn. Otherwise, what really is the point? Especially for a home entertainment center. Getting repeatedly punched in the throat by Linux was fun.. about 10 years ago.

(A one-time Linux advocate who loves that Windows XP on the desktop is effectively hassle-free compared to Linux).

"Proprietary software authors do not have to do things "properly", they just kludge things together that may or may not work in every possible weirdy case, and rely on nobody ever seeing what an awful job they made of it in the first place."

This indicates that you don't know how a proprietary software development environment works, nor do you understand how an open-source development environment works.

Yes, there are many closed-source products where code is never reviewed or audited. But if you've ever coded in the aerospace or other life-critical industries, it becomes abundantly clear that code reviews are regular practice, and that your job is put on the line very quickly if you don't measure up. Even Microsoft now has detailed security practices, and, after hearing from some of my Microsoft friends, they are taken very seriously.

As for open source, yes, code is often tightly audited, particularly in well-known projects. But many smaller projects, particularly ones with small development teams, never audit code. Even the Linux kernel has many instances of abysmally poor code.

The point is this: open source is not immune from poor coding. And a tightly managed closed-source project can produce high-quality code.

This is such a no-brainer I'm legitimately surprised MS hasn't done something like it.
MS has done what you described - sharepoint in Office suite. It comes with exchange integration and all that jazz.. http://www.microsoft.com/office/sharepoint/prodinf o/default.mspx&e=42

It turns out that the hardest part to adopting something like this was the work involved in creating the empirical signal maps for every single place that you wanted to use the service but the service itself could be very accurate.

MS DOS 6 Technical Reference: DoubleSpace Integrated Compression

I note that this technote does not warn against its use.

Good Call: http://www.microsoft.com/technet/archive/msdos/04_ dblsp.mspx

while it appears drivespace was the MS 6.20 fix. http://kb.iu.edu/data/abid.html

"You won't, Microsoft doesn't understand the hoopla around AJAX."

Atlas

ASP.NET "Atlas" is the codename for a set of technologies to add Ajax (Asynchronous JavaScript And XML) support to ASP.NET. It consists of a client-side script framework, server controls and more.

The compiler from the company everyone loves to hate, did this way back in VC++ 4.1, around 10 years ago. People like to talk about how optimized JVM's are, but they forget that compilers not only had a head start but also continue to receive optimizations. I'm sure by now all C runtimes include this.

http://support.microsoft.com/default.aspx?scid=kb; en-us;821442

None of the applications which were actually broken by XP SP2 are something granny would run. On the other hand some of the applications that were affect were, but those were generally minor problems.

None of the applications which were actually broken by XP SP2 are something granny would run. On the other hand some of the applications that were affect were, but those were generally minor problems.

It's a real struggle between the typical programmer's desire to loosely specify what they want in quick-and-dirty code, vs the operating system's desire to enforce this moving "security" target we keep talking about. And all sandwiched around the limitations of current hardware. Researchers wanting to play in the hardware space have it tough as well; the hardware/software co-design needed (to hack the FPGA breadboards together, get kernels booting, figure out why the VHDL compiler is segfaulting on valid code, user-space gcc hacks to emit new instructions, etc) are pretty demanding.

There's been huge amount of work on the rigorous software theory side in the last few decades, which eliminates the need for hardware to dynamically enforce things that can be statically proven away. Peter Sewell and his team recently successfully formally specified the socket API and machine-proved it. Projects like Microsoft's Singularity, or Cornell's Typed Assembly Language are looking at making practical, high-performance type-safe operating systems. I'd expect that, in the next few years at least, we'll see one of these approaches come to fruition before fine-grained hardware enforcement. And as a long-term goal, isn't it more desirable to have higher quality software than more paranoid hardware?

Actually freed blocks go on a per application list, and on Win2k an up they go at the top of the list so they will be allocated next time you malloc

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/apcompat/apcompat/do_not_read_or_wr ite_from_freed_memory_blocks.asp

This exposed bugs where applications touch a freed block, so they came up with app verifier

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/dnappcom/html/AppVerifier.asp

This marks all the pages on the per app free list as invalid, so you are guaranteed to get clobbered if you touch them. I'd bet there is a AppCompatibility flag in the registy which does the opposite somewhere, i.e. it keeps freed blocks valid for longer (for ever?). That way, if they find some 'commercially important' application would break with the new heap allocation algorithm when they test it, they can set the flag and no one will see a problem. Except the company who wrote it, who presumably get an error report.

Actually freed blocks go on a per application list, and on Win2k an up they go at the top of the list so they will be allocated next time you malloc

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/apcompat/apcompat/do_not_read_or_wr ite_from_freed_memory_blocks.asp

This exposed bugs where applications touch a freed block, so they came up with app verifier

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/dnappcom/html/AppVerifier.asp

This marks all the pages on the per app free list as invalid, so you are guaranteed to get clobbered if you touch them. I'd bet there is a AppCompatibility flag in the registy which does the opposite somewhere, i.e. it keeps freed blocks valid for longer (for ever?). That way, if they find some 'commercially important' application would break with the new heap allocation algorithm when they test it, they can set the flag and no one will see a problem. Except the company who wrote it, who presumably get an error report.

And windows doesnt support clustering yet - in any decent way shape or form Ummm.. yes it does: http://www.microsoft.com/windowsserver2003/technol ogies/clustering/default.mspx

In fact, Microsoft Windows has supported clustering for quite some time. At least the better part of seven years as it was available on Windows NT Server 4.0.

If you want to see the latest Microsoft offering on clustering services, check out this site http://www.microsoft.com/windowsserver2003/technol ogies/clustering/default.mspx

What is this then:

http://www.microsoft.com/windowsserver2003/technol ogies/clustering/default.mspx

Clustering (NOT performance clustering mind you, which is NOT the topic at hand anyway) has been around in Windows NT as far back as I can remember. With NT4, you needed to have Enterprise Edition, but it was there.

I'd like to see Cahokia push *somebody* into making a trip planning/mapping client for this. Yes, *if* you have WiFi or a phone with GPRS|EDGE, you could use Google Maps.

If.

You.

Like.

To.

Wait.

But a local mapping client on this would be great. Granted, I somehow doubt that Cahokia could get Streets and Trips or Street Atlas, but if they partnered with Rand McNally or somebody like that they could get a 1G flash drive with the map data on it.

I've seen them pretty effectively used for taking notes in classes where text wouldn't do the job. Same could work with meeting notes needing math, drawings, and such.

Better than a sheet of paper? Maybe. Cooler than a sheet of paper? Definitely.

Microsoft put up this article articulating some of the possible uses they can serve.

You mean the Data Execute Protection from Microsoft? OpenBSD has had that for a long time already, only they named it w^x.

This new feature from OpenBSD is the use of guard pages and the immediate freeing of memory. In essence this means that both bad programming and exploit attempts are much more likely to result in a core dump then some unidentifiable and non reproducible corruption or a working exploit. Many people consider that a good thing because it will result in bugs being found in userland applications that would have otherwise stayed unnoticed. So even if you don't use OpenBSD yourself this is helping your system becomming more secure and better. And if you are running OpenBSD there is o need to worry too much about the stability of this feature, it was actually enabled shortly after the 3.7 release and has been in every snapshot on the way to 3.8.

And I have to agree with the author that the best thing is that we get all the goods without ever having to switch them on!

DEP from Microsoft is only enabled by default on some system binaries. Here is how to enable it for everything: http://www.microsoft.com/technet/security/prodtech /windowsxp/depcnfxp.mspx

My CPU doesn't support DEP in hardware, so I imagine the software-based method of doing this will create quite a speed hit. Anybody have any experience with turning on DEP for all programs?

As BSD is my other favorite OS (I tend to use XP for desktops and FreeBSD for servers), I'm glad to know that they've finally caught up with Microsoft in this important area.

Symantec is trying to sell a product that doesn't really apply in the Linux/OS X environments.

I'm not saying Viri and Worms don't or couldn't exist on a *nix platform. What I am saying is that security patches are released within the same timeframes as virus updates, so why not just set your box to auto-update those patches and skip the Anti-virus software route all together?

On other vendor's platforms, there are both a greater frequency of attacks and longer delays between patches (probably due to the shear number) so Anti-virus software serves a market there.

So it isn't hubris that the Linux and OS X are imune, it is that the OSS community and Apple work quickly to patch any vulnerability ASAP.

Well, if you're copying whole directories, may I recommend ROBOCOPY. Produced by Microsoft themselves, it's part of the Windows 2000 and Windows 2003 resource kit tools.

The syntax is slightly different (very slightly) - robocopy source-directory destination-directory [optional wildcard]. But it's free, fast, console, has a percentage counter (optional ETA as well), can mirror one tree into another. (ie: only copy files that have different dates/times/sizes, deleting files in the target that no longer exist in the source), and can copy NTFS Security while it's at it.

It may have originally been a demo for the Win32 API "FileCopyEx" call.

Seriously, if you do much file copying at all (especially as an automated/scheduled task), check this tool out.

Well, if you're copying whole directories, may I recommend ROBOCOPY. Produced by Microsoft themselves, it's part of the Windows 2000 and Windows 2003 resource kit tools.

The syntax is slightly different (very slightly) - robocopy source-directory destination-directory [optional wildcard]. But it's free, fast, console, has a percentage counter (optional ETA as well), can mirror one tree into another. (ie: only copy files that have different dates/times/sizes, deleting files in the target that no longer exist in the source), and can copy NTFS Security while it's at it.

It may have originally been a demo for the Win32 API "FileCopyEx" call.

Seriously, if you do much file copying at all (especially as an automated/scheduled task), check this tool out.

You're mistaken. I know someone who worked at RadioShack. You are thinking of SCO Unix, another product from SCO.

Never mind the fact that SCO Linux never existed until a few years ago. SCO was Santa Cruz Operation 10 years ago, and sold SCO Openserver and later Unixware, and no other Operating Systems. The SCO Group was in-fact known as Caldera 10 years ago, and thus their products were called Caldera Linux, not SCO Linux. SCO Linux only went on sale after Caldera changed their name to the SCO Group in 2002ish, shortly before you say RadioShack switched to Windows. Obviously, SCO Linux only sold for a little over a year before they caesed distribution due to their Linux related extortion scheme *cough cough* erm...litigation I mean.

Santa Cruz Operation != The SCO Group/Caldera

There is no possible way Radio Shack ran SCO Linux 10 years ago. According to them and Microsoft also, they ran Unix.

http://www.microsoft.com/resources/casestudies/Cas eStudy.asp?CaseStudyID=17131

This is the longest rant I think I've ever seen that was composed based on zero knowledge of the technical subject at hand, but rather on some kind of on-the-fly interpretation of the three words "service" "oriented" and "architecture" used in juxtaposition.

Your points:

1. [...]being "service oriented" is roughly as new as dirt.

   See above.

2. how in the world this would relate to software reuse

   SOA makes software reuse not only easy but unavoidable - through tooling. See my other posts here for other thoughts in this vein, including use of ESB (Enterprise Service Bus).

3. ...they haven't really told you anything about how to facilitate reuse in general, or how SOA is supposed to contribute to that...

   Interesting. What else have you tried to read besides this sales-oriented (I call it marketecture ) web page? Any actual technical articles?

Since everybody else is posting the os's of POS systems and there backends, I can't think of a more appropriate place to post the ones I know of(which is only one for myself).

RadioShack:
POS: Windows XP Embedded
Backend: SCO Unix (I believe its version 5, I might be mistaken).

In fact Microsoft has posted a story on how RadioShack supposedly saved millions of dollars by using windows. I can say personally that is far from the case and Linux would of been the better choice.

http://www.microsoft.com/resources/casestudies/Cas eStudy.asp?CaseStudyID=17131

"In my limited experience, there are a lot of "software methodologies" out there, all claiming to make software better (i.e. more scalable, efficient, better re-use, etc.). Of course it all comes down to modular programming, good documentation, and agreement among the developers in an organization on a plan for how everyone is going to do things so that everyone is on the same page."

Software Factories

TCSEC has apparently been superseded, and Windows 2000 is rated at Common Criteria level 4 out of 7.

Here's a link to search for "open document format" on Office Online.

So it's easy! Just click on this pre-filled search link for "OpenDocument format support" 30,000 times a week and you will get OpenDocument format support in MS Office!

microsoft security a feature they are trying to copy!? there is your first problem. if you are looking at security as a feature then your product is already an insecure piece of software. security is something that is part of every step of development: design, implementation, testing, deployment, post-deployment.

so no, microsoft is probably not "copying security" they are the ones on the front lines. who does redhat go to when they realize they need security as a part of the product life cycle? who wrote the leading book on writing secure code? let me tell you, it didnt come from oracle, linux, redhat... it was microsoft.

yes, microsoft is definitely reactive. but they also react with a bang. they realized their shit was insecure, and they were losing billions on it. being capitalist pigs they wanted to keep their shareholder value. like everything else they do they have a common pattern: they discover something they want, they go after it, the conquer it. and thats exactly what they are doing with security. just like they did with xbox, office, operating systems, server market.

http://msdn.microsoft.com/security/default.aspx?pu ll=/library/en-us/dnsecure/html/sdl.asp
http://www.amazon.com/exec/obidos/tg/detail/-/0735 617228/qid=1128243706/sr=8-1/ref=pd_bbs_1/102-9647 408-6932144?v=glance&s=books&n=507846

Just to see what happens, I'm gonna search for LaTeX support 30,001 times a week.

isnt it supposed to be

http://office.microsoft.com/en-us/results.aspx?Sco pe=DC%2CEM%2CES%2CFX%2CHA%2CHP%2CQZ%2CRC%2CTC%2CXT &Query=open+document+support&SubmitSearch=+Go+

From the article: "Currently, on our OfficeOnline site, we are seeing over 30,000 searches per week for PDF support. That makes a pretty easy decision"

So, how's about you, me, and a few thousands of our friends search for OpenDocument support?

From the article: "Currently, on our OfficeOnline site, we are seeing over 30,000 searches per week for PDF support. That makes a pretty easy decision"

So, how's about you, me, and a few thousands of our friends search for OpenDocument support?

Try fc.

Works not-too-bad.