Slashdot Mirror

jwambach writes: "This brief article over at Yahoo! describes how scientists are attempting to create molecular electronic circuits using DNA. They say that they could potentially create circuits 10,000 times smaller than with current technology." The article says that "[r]esearchers have already created molecular wires, logic gates (a building block of computers) and switches, which could be hooked up to make a working computer a fraction of the size of ones based on silicon chips." The coolest part is that assembling the tiny components could be done with DNA-tagged components, shaken (or stirred) in a test tube.

Logic Bomb writes: "Twenty-eight states filed a federal lawsuit today against the five largest record labels alleging price fixing on compact discs. The Federal Trade Commission has dealt with this before, through an out-of-court settlement that was supposed to fix the problem. A Reuters article provided by Yahoo gives good details."

Logic Bomb writes: "Twenty-eight states filed a federal lawsuit today against the five largest record labels alleging price fixing on compact discs. The Federal Trade Commission has dealt with this before, through an out-of-court settlement that was supposed to fix the problem. A Reuters article provided by Yahoo gives good details."

Iapetus asks: "Apple has sued (or threatened to sue) a number of Web sites for displaying information / pictures of products that they have not yet announced. My question is what is the legal basis for Apple forcing these sites to remove the information? It seems to me that unless the Web sites had a non-disclosure agreement with Apple, they should be free to display whatever information they can gather. I understand Apple going after the supposed employee that leaked the info, that I can see, but not going after sites that are simply displaying this information. Personally I don't believe that this has done any harm to Apple, the Mac freaks are going to buy the stuff no matter what Apple does, and no one else gives a damn anyway. So I don't see any 'material harm' being done either way." I honestly don't see the big deal here, either, and I wonder why Apple would do such a thing which only, in the end, alienates their own customer base.

OnlyNou writes "IBM Develops Prototype of Wrist Watch Running Linux only a prototype, but it shows big blue has a lot of time on it's hands." The article is pretty vapourous: Its just a press release saying that they've done it. No pictures of linkage, so if anyone finds something informative, please post it. Update by HUNQ: Here is the picture of the watch, and it's DAMN CUTE! (credits goes to Linux Weekly News)

jackstaley sent us an article about Transmeta testing mass production of its Crusoe processor. They talk about IBM (which can make copper chips, but interestingly enough, has licensing deals with Intel that should protect Transmeta from potential lawsuits) as well as exporting the production to Taiwan.

Ed Matthews writes " Yesterday's Wall Street Journal profiles the coolest gadgets that either aren't available in the USA or are slow to emerge. It questions whether the U.S.'s reliance on PCs is a ball and chain, and highlights the mistake made by the US in not adopting a single standard for wireless communication. It also refers to the cell-phone carriers as "slow-moving, bureaucratic," and "having a chokehold on innovation." The regular B section requires a paid login, but you can read Walter Mossberg's column for free." Having dealt with the US-cellular companies for the last two weeks, and been extraordinarily unhappy with one company that's sucked away fourteen off my life, I'm curious what everyone else thinks will be the emerging technology - and where it will be.

Ever more information for you, the loyal photographic memory-blessed reader. That is to say, more on Linux on Macs -- and not just the sexy new ones. Evolving attitudes in Kansas. Misinformation about Survivor. And cheap, cheap boxes for your node-in-every-room home network.

Pardon me sir, are you going to finish that Apple? Marco van de Voort writes: "MkLinux now has official support for these much sold first Nubus based PowerMac generation, that is rotting away in basements. These machines make excellent X-Terms." And the same models can naturally run NetBSD, too. [Updated 6:26GMT by timothy] Reader vkulkarn corrects me here. Mea culpa, you're right -- only some of the old Nubus PowerMac models actually run NetBSD. But I bet someone, somewhere is plotting to change that.

Garage sales can now support Linux.GigsVT writes "Coollogic has released a new set-top box, this one with Linux already installed. Sounds like ripe hacking material to me. Blurb: The Internet Ready 7200 uses a National Semiconductor MediaGX processor, 16MB of flash memory instead of a hard disk, 32MB of RAM and has the ability to connect to the Internet via DSL, Ethernet or a modem. It uses a TV instead of a monitor and comes with Netscape's Web browser." And MrRobahtsu writes "Want a 64MB diskless 200MHz Linux box cheap? Try egghead. With IDE, USB, 10/100 ethernet, and Linux and Netscape in flash ram, it looks pretty cool. Even says "can be upgraded to a pc." Not bad for $129."

Toto, I don't think we're in the Pleistocene anymore! Claudius writes: "This cnn.com article reports that Kansas voters now support the teaching of evolution in their public schools, as evidenced by recent election results. They have voted to remove two incumbents to the Kansas Board of Education who have supported standards diminishing the importance of evolution, and a third, anti-evolution candidate was unable to defeat an opponent who opposes the current standards. The issue is still far from settled, however, since five of the ten seats on the board remain to be filled in November." For a refresher on the sticky state of evolution in Kansas education, see Hemos' story on it from a while ago.

Ha ha fooled ya good. TeacherReviews.com writes "Gervase just got voted off the Survivor island, meaning that RealWorldBlows discussed in a past story produced a false result and the actual winner of Survivor is still unknown." True enough. What was going through the collective CBS head when they failed to follow the directive of their own Web site?!

Still horrifying after all these days. chaidawg writes: "According to this article in the New York Times (free registration req.), author Stephen King's experiment with payment for e-publishing seems to be working. After the first of three promised chapters he has made back all but $10,000 of the more than $100,000 he spent on advertising." This still doesn't mean Jamie is wrong -- yet.

Three days ago, a small group called Interhack was featured in an AP wire story about some curious data transmission they'd found. The company receiving the data, Coremetrics, tracks unique visitors through its clients' corporate websites, and promises those clients "seamless performance," because: "data tags load invisibly as small transparent gifs, and information is encrypted to appear invisible to your customer." The customer is you, the user. The GIFs are web bugs. The information can be personally identifying, which most of its clients' privacy policies fail to mention. But -- importantly -- the company promises that "Any data Coremetrics tracks and reports is owned solely by our customers and we are contractually precluded from reselling or using this data." Is that enough? Emmett and I talked both to Coremetrics and to the hackers who put the spotlight on them.

Emmett Interviews Interhack

Slashdot: For those uninitiated, what's interhack all about?

Basically, we're a firm of hackers interested in pushing technology forward through research, making computing apply to people by developing custom products and consulting for folks who want to put the technology to use, and helping people understand exactly what the ramifications of these systems are. That's a pretty broad way of saying that we're all about the Internet and making it work.

Slashdot: When did you start researching this story, and how long did it take to put the pieces together?

Sometime in May, someone sent us a tip about Coremetrics and what it's doing. We took a quick look over their web site to see their advertised services and then started to look at how the service is actually implemented on various client sites. We examined several sites, most of which very clearly stated in their privacy policies that they're using Coremetrics for site monitoring and provided links necessary for people who don't like it to opt out of the system. Most of the sites with clear, full disclosure policies weren't even sending Coremetrics personally-identifiable information like names and addresses.

The more interesting part of our find was in the sites that did send personal information to Coremetrics, particularly those that carried the TRUSTe privacy seal. Over the course of about three weeks, we performed an investigation of these sites, gathering as much information as possible from them. We reverse-engineered the system by reading the sites' code, reading through the obfuscation, and comparing logs of our network's activity with the activity that would be perceived by an end user.

What we found was a clear difference in user expectations and what was actually happening, as well as a clear difference between what Coremetrics says it offers and what its eLuminate service makes technically feasible. After writing drafts of our report and press release, we decided to take a wait-and-see approach to the release. Specifically, we wanted to ensure that sites that just started to use the Coremetrics service had adequate time to update their policies and to have an accurate idea of what was happening with the system after having been in production.

After waiting and watching for more than a month, we decided to release our findings. So, on Monday morning, we sent a pre-release copy of our report to Richard Smith and some folks at Zero Knowledge Systems. In addition, we contacted each of the firms named in our report and Coremetrics so that if the failure to disclose or the ability to profile people across web sites was unintentional, there would be time for some investigation and a decision about how to fix the problem. After the end of business Monday, we released our report.

Slashdot: What needs to change? In a perfect world, how do we deal with this?

This is a very interesting question. In my perfect world, detailed levels of profiling would not take place at all. There would be no such thing as persistent cookies. In general, I'm just not comfortable with the level of privacy that the industry as a whole has given up for the sake of a little convenience.

How big of a deal, really, is it to have to enter your password when you login to a web site? Don't forget that the reason why we have passwords in the first place is so that you'll have to do something at the beginning of the session to prove who you are.

Web browsers also need to be more intelligent. That is, they need to be able to identify things like dependencies on third parties so the user can know whether those images should be fetched or ignored. Right now, browsers -- for the most part at least -- just aren't very defensive. The model of parsing everything you're given worked fine in the Old Days for which some of us long so much but the fact of the matter is that you really can't blindly trust anyone on the Internet.

I'm not suggesting becoming a luddite. I'm suggesting that folks take a sort of "trust, but verify" approach a la Ronald Reagan. Right now, there's a lot of trust and almost no way to verify.

Slashdot: This all comes down to trust. How many policies are just there so people will shut up about personal information so they'll start buying stuff online?

I couldn't say. Policies are almost always written by lawyers. That probably speaks to the covering-one's-posterior-position value of privacy policies.

Slashdot: Since we can't trust written policies, what should people be doing before they start conducting business with these websites?

Verify everything. As I said earlier, though, we're severely lacking in tools that are accessible to most people that can help in that regard. I think Zero Knowledge Systems' Freedom network is a huge step in the right direction. Tools like Muffin (muffin.doit.org) also help, but it would be cooler for that kind of functionality to live right in the browser itself. There are opportunities for eager hackers on this front.

It's also important to stress that tools alone won't do it -- there is no silver bullet. People are going to have to have some understanding of what's happening in order to use these tools effectively.

Finally, where you see discrepancies, point them out. Most of the time, they're oversights. Look at how Lucy.com and Fusion.com dealt with this problem: they updated their sites. So although the problem shouldn't have happened in the first place, they did the right thing. Contrast that with Toys "R" Us, which issued a statement saying that what they're doing isn't a violation. And their privacy policy still doesn't say a word about Coremetrics. They still haven't said anything to address the issue of having information collected on children.

Companies that don't fix their problems don't take your privacy seriously, no matter how much lip service they pay. So don't go to their sites. Don't buy their stuff. Tell them why you're not buying their stuff. Tell their competitors why you shop where you do, lest the new places you shop get the bright idea to try to hide something.

Jamie Talks to Coremetrics

Here's the service Coremetrics provides to corporate websites:

Many companies demand accurate knowledge of how their sites are being used: what sections are popular, what paths visitors take through the site, where people click over from, and so on. It's like web log analysis but more specialized for large shopping sites.

Since these demands are very much the same, and the code to do the analysis is similar, outsourcing happens. From a CEO's viewpoint, Coremetrics fiddles with the website to do better-quality tracking than the company could do on its own, and then makes the resulting statistics available over SSL.

But from your viewpoint and mine, that "fiddling" results in cookie-carrying web bugs all over the sites we visit -- web bugs which usually send back to the Coremetrics servers a unique visitor tag, like any other cookie, but one that sometimes includes your name, email address or other personally identifying information.

Coremetrics promises that this information remains private. When DoubleClick collects data from <img> cookies across multiple websites, they do so with the stated intention of tracking you personally; this is part of their business plan.

According to Coremetrics, they do things very differently. Data is not cross-correlated between their client websites, they say, because their contracts with their clients prohibit this. In fact, their contract forbids them from doing much of anything with that data except statistical analysis.

I gave the Coremetrics PR person I talked to a chance to explain, using the example of their client Toys 'R' Us:

"Coremetrics is merely an agent that collects this data on behalf of an individual customer, for that individual's sole use only. We do not collect data, as was inferred very incorrectly by Interhack, across multiple unrelated websites, with any intention of selling it to third parties -- or even distribution to third parties. That's because we, as the agent, do not own that data, nor do we have any rights to that data. Toys 'R' Us, and Toys 'R' Us only, is the sole owner of that data. So legally, we cannot do any of the possibilities that Interhack had alluded to in their report."

But here's the interesting thing.

If I'm browsing my favorite website, Coremetrics is clearly a third party. They have a special contractual relationship to keep my data private, which we shouldn't ignore. But nevertheless -- a third party.

So why do some of their clients' privacy policies not mention this?

Toys 'R' Us is a good example. As Interhack made clear, they do send personal data to Coremetrics' servers. But their privacy policy reads, "We do not share any personally identifying data about our guests with anyone outside of Toysrus.com, its parent, affiliates, subsidiaries, operating companies and other related entities."

So is Coremetrics one of their affiliates or a related entity? I wouldn't think so, but I'm not a lawyer. One interesting thing is hidden in that privacy policy's HTML; after the closing </html> tag is the hidden message: "<!--CoreMetrics Information if enabled-->." Hmmmmmm.

Coremetrics lists twenty clients; I tried to contact seventeen of them for comment, with marginal success by press time. Three reported that they had not yet activated Coremetrics or had decided not to use the service at all. One (guru.com) reported not sending any personal information -- presumably, only tracking visitors with a non-identifying unique ID.

Two sites (lucy.com and fusion.com) began mentioning Coremetrics in their privacy policies on August 1, the day after the Interhack report. One site (thewest.com) did not even have a privacy policy until yesterday; they'd been working on it, and my email may have made it a priority because it was on their site three hours later.

According to Coremetrics, they encourages all their clients to disclose the use of their service in their privacy policy, and include a link for users to opt out. But some sites reported as using or planning to use Coremetrics' services have privacy policies that could use some clarification.

Altrec.com informs me that "...in the near future ... we plan to add to our privacy statement our use of Coremetrics and the fact that Coremetrics neither owns, distributes, nor has rights to the data it sorts on Altrec.com's behalf." However, their current privacy policy states very simply: "Altrec.com will never sell or give your e-mail address (or any other information about you) to anyone else without your permission. Period."

(Last-minute update -- just before press time, Altrec.com clarified that they are "sending unique ID (unique to Altrec.com) and city, state and zip. No other personally identifiable information is being sent to Coremetrics.")

Bravanta.com bounced me between different people until I got to leave voicemail that wasn't returned by press time. Their policy says they "do not and will not sell, trade or rent the personal information of our customers or gift recipients to any third parties."

(Update two hours later: Bravanta reports that they also have decided not to use Coremetrics' service, and are not currently using it.)

Mall.com didn't get back to me either, and their policy reads "We will NEVER release your name and personal information to a third party..."

Getplugged.com has a rather confusing privacy statement that begins, "Any personally identifiable information GetPlugged.com collects will be used solely for the purposes stated within this Privacy Statement" and wanders around from there. I'm not sure what to make of it, frankly.

All these polices may indeed be correct, if the sites are stingy with personal data. Like guru.com (and altrec.com), they may be using the Coremetrics service only with non-personal IDs. But, as with Toys 'R' Us, that may also not be the case.

(fusion.com, getplugged.com, and altrec.com also happen to be TRUSTe licensees, but TRUSTe wasn't able to comment by press time. In the AP wire story on Monday, they had harsh words but were speaking hypothetically; no comment since then.)

It's hard enough to read privacy policies already. Most of them are designed to protect companies legally, and mostly manage to confuse users. The distinction between Coremetrics as a third party; or affiliate; or agent, is a little too fine for the average consumer, and needs to be spelled out in each policy, as Coremetrics itself recommends.

But is all this a tempest in a teapot? If a signed contract forbids a company from misusing data, is that all we need to know?

I don't think so. In the first place, at the very least, companies like Toys 'R' Us need to disclose such things in their privacy policies. That's just common sense.

In fact, according to Coremetrics privacy advisor Dave Farber, they plan contractually to require such disclosure with future clients. (The company could not confirm or deny this at this time.)

More importantly, we as consumers are being asked to trust a third party whose reputation we know nothing about. In fact, 99% of us will never even have heard of them and might not understand what they do. We're told that a contract protects us, but we're still being asked to trust something we can't see. And when evidence of policy violations is turned up by a group of hackers, that erodes our trust.

After speaking at length with Coremetrics' PR, I get a general feeling of trust from them. (Of course that's a large part of their PR staff's job, earning reporters' trust.) More importantly, Dave Farber is well-respected, and his confidence carries weight -- with me at least.

Still, as Interhack says, our motto should be "trust but verify." That's why I proposed, to Coremetrics, that they publicly post, on their website, the paragraphs from their clients' contracts which assure that our private data remains private. If the actual legal words that protect our data are up there for us to see, we don't have to trust anyone.

When I mentioned this to Coremetrics' PR person, he promised to consider it; Dave Farber thought it was "a very good idea." It's unusual for corporations to make contracts public, even in part, but in this case it would do a great deal to put everyone's fears to rest.

Lady and Gentlemen, sit back and brace yourself for the assault of the quickies: AlexPixel sent us the curiously named Bilbo.com which actually sells feet keyboards for key modifiers and mouse clicks. cadfael sent us a sordid tale of a coder scorned. Some billboards: first from Ant we have a windows error and from mazur we have a bit of unix (must be california ;) mmca noted that scientists have discovered why candy wrappers are loudest in movie theaters. IcesTorm-I noted a supposed windows bug that will make ya wonder. DuncMonk sent us a cool comic strip called Sinfest that you might wish to add to your morning coffee. How about the x86 Still for those of you who believe that controlling your stereo, lights, garage door, and neighbors dog just isn't enough for your PC. Not out there enough for ya? How about RSA implemented entirely in javascript? (Doesn't work for me ... I leave that crap turned off ;) And finally to leave everyone on the proper melodic note, gribbly Symphony #2 for Dot Matrix Printers. Fortunately it's available in MP3 just in case you don't have a dot-matrix printer still handy...

Lady and Gentlemen, sit back and brace yourself for the assault of the quickies: AlexPixel sent us the curiously named Bilbo.com which actually sells feet keyboards for key modifiers and mouse clicks. cadfael sent us a sordid tale of a coder scorned. Some billboards: first from Ant we have a windows error and from mazur we have a bit of unix (must be california ;) mmca noted that scientists have discovered why candy wrappers are loudest in movie theaters. IcesTorm-I noted a supposed windows bug that will make ya wonder. DuncMonk sent us a cool comic strip called Sinfest that you might wish to add to your morning coffee. How about the x86 Still for those of you who believe that controlling your stereo, lights, garage door, and neighbors dog just isn't enough for your PC. Not out there enough for ya? How about RSA implemented entirely in javascript? (Doesn't work for me ... I leave that crap turned off ;) And finally to leave everyone on the proper melodic note, gribbly Symphony #2 for Dot Matrix Printers. Fortunately it's available in MP3 just in case you don't have a dot-matrix printer still handy...

Moby-One GNUbie writes: "Kansas voters reject 2 of 3 anti-evolution state school board members, proving that my home state has more brains than many gave it credit for. Some good news on that front should be refreshing for everyone." Check out the initial war of words when I had posted this originally.

Moby-One GNUbie writes: "Kansas voters reject 2 of 3 anti-evolution state school board members, proving that my home state has more brains than many gave it credit for. Some good news on that front should be refreshing for everyone." Check out the initial war of words when I had posted this originally.

ayejay asks: "Are there any models/designs for a totally distributed operating system, possibly utilizing AI to learn patterns of use, resource need, and anything else that might be relevant? What -would- be relevant to such a thing? Given Napster and all the load balancing kernel enhancements and SETI@home type programs out there, it seems the idea is ready to be developed into a feasible paradigm. What do you think some of the major concerns/design issues are? I'm talking about nuts and bolts..." Now I'm all for distributed applications, but applying such paradigms to something as critical as the operating system seems to be taking the issue a bit too far. Would creating a 'distributed' operating system gain us any advantage over what we are currently familiar with?

Noctrnl writes: "Just caught this review of the new Apple optical mouse over at CNN. Looks like Microsoft may finally have some competition for the optical IntelliMouse."

Bahumat asks: "I remember hearing about a year back about credit-card size solid-state hard drives that were to revolutionize the storage industry, with the capacity for 2300 gigabytes stored, and the cost of manufacture to be less than $50. The old news release [ C : dated 8/99] is posted here. Does anybody know of any updates or press releases about this technology?"

OctaneZ asks: "While I know very few of us would consider a set top box as a good solution for a replacement of a home PC; there are individuals for whom these products would be perfect. I am looking for a solution for completely computer-illiterate relatives; and was wondering if a set top box might be a solution. I am not looking for sheer power, bragging rights, or gaming; just e-mail and Web access. Has anyone had luck with preconfigured set top boxes? and with those, how is the service? Also has anyone made a "roll-your-own" set-top box out of a MicroATX machine? Could a MicroATX implemetation be "deployable" to 3-4 users running LINUX or another OS, and not require regular maintenance or excessive amounts of teaching?"

sdodson writes: ""Researchers at the Bell Laboratories of Lucent Technologies have created the first solid laser from organic materials... which have been dubbed 'plastic lasers'... " and "can be relatively easily manipulated to emit light ranging from ultraviolet to infrared." These new lasers will require less power, and will have many applications in communications as well as medicine. The New York Times has the article." This will be big. Of course, it's still a long way down the road.

CalamityJones writes: "This Reuters blurb briefly describes a comet erupting while researchers were tracking it with the Hubble Space Telescope. A slightly more complete article covering the event is on CNN.com. What are the chances of actually catching this event just at the moment you have the earth's most powerful telescope pointing right at the comet? Maybe these guys should be playing the lottery more often. :-)"

StoryMan was the first of a flood of readers to note: "Napster ruling has been stayed. Doesn't have to close by midnight! Woohoo!" As of 10:15 GMT, CNN is displaying a note that says "The injunction barring Napster from trading music online has been stayed. Details to come." Watch this space for updates.Update: 07/28 10:26 PM by H :Thanks to Sgt. Owen for the first real link about the stay. Update: 07/28 10:58 PM by t : And to michael hirschorn, who points to this story at inside.com.

zookie writes "A story on Yahoo says that DoubleClick and other Internet advertisers have agreed, under strong government pressure, to new privacy restrictions. Those restrictions would require prominent notification of cookie usage, and restrict using SSNs, medical data, financial info, and sexual behavior(!) for targeting ads. Does this mean Yahoo will stop bombarding me with those racy Maxim ads?" Well, except there's no legislation. The government has agreed on "self-regulation" for the time being. It will be interesting to see what happens.Update: 07/28 12:53 PM by E :D. Ian Hopper did point out, however, that if a NAI member breaks the agreement, the FTC can sue them, which is something, at least.

Wordman writes "A story on Yahoo indicates that Apple (working with Wacom) has plans to provide pen-based computing in place of/in addition to keyboard input on future power books. The story quotes an unnamed source saying "The idea is to do away with the keyboard." The scheme would include the handwriting recognition system from Newton OS 2.x (which, contrary to popular rumors, is excellent). The "erase" abiliy of Wacom tablets would also be supported." I dunno - I really do find a keyboard a wonderful way to get things done - better than my handwriting, that's for sure. Thanks to Matthew for pointing out the original article at ZD-Net.

FlyingSheep writes "British pop star Sting has lost a case at an international panel to evict the holder of the Internet address sting.com, becoming the first celebrity to suffer such a defeat" This is pretty good news... Words in the dictionary are totally different then, say, JuliaRoberts.com. An interesting stat in the article is that 81% of the WIPO rulings have led to an eviction. Unfortunately the WIPO sided with Microsoft over the Microsof.com domain name: Typo sites should be allowed (and I even get flame mail because of the various Slashdot typo sites!)

Manjit writes: "An article on Yahoo! reports that Sen. John McCain (R-Ariz.) has introduced an Internet Privacy Bill which would require Web sites to disclose how personal information will be used. I'm not really much for government regulation but I think that the privacy problems will not be resolved without laws forcing businesses to safeguard personal data. My favorite quote from the article: 'The bill would enable consumers to sue Web sites who violate the bill's agreements to sue for up to $22,000.' This would be great! The best way to get businesses to follow the rules is to hit their bottom line if they don't."

The actual bill text isn't available online yet (I think it'll show up here), so I'd be remiss to start evaluating it. I also don't see anything yet at EPIC.

Keep in mind that McCain is the same senator who in January 1999 introduced a bill to withhold e-rate funds from schools and libraries who did not install censorware. That bill's stalled, but he introduced an amendment last month with the same idea. The government giveth with one hand and taketh away with t'other.

Imagine a novelist, trapped in a nightmarish world of credit cards and micropayments, facing devilish odds and the belligerent stares of publishers everywhere ... picture a team of hackers brazen enough to break into dozens of secure government sites without incurring a single lawsuit ... scream in terror at the thought of mutant penguin-kangaroo hybrids swimming deviously onto our shores ...

Revenge of the naysayers' naysayers: Just yesterday, jamie sallied forth with the theory that Stephen King was setting himself up for disappointment by expecting enough paying customers for his new online book to justify the experiment.

jheinen writes, though, "According to MSNBC, of the 41,000 downloads for the first installment so far, 32,000 (~78%) have already paid via credit card. Kinda shoots to hell the theory that people won't pay."

[Jamie adds: I stand by my prediction that "Stephen King is never going to have to publish the end of his novel." I'd love to see him succeed, but I just don't think so this time around. We'll see in September!]

Red Five, I'm going in. You may recall the story a little while ago about a distributed anti-cracking bot at Sandia National Laboratory. Rest assured, those clever folks don't confine themselves to practicing only one side of the ol' thrust-and-feint.

In fact, leb writes: "Over the past two years, a group at Sandia National Laboratories known informally as the Red Team has, at customer invitation, either successfully invaded or devised successful mock attacks on 35 out of 35 information systems at various sites, along with their associated security technologies. Their work - challenged only by a new style of defense, also developed at Sandia, called an "intelligent agent" - demonstrates that competent outsiders can hack into almost all networked computers as presently conformed no matter how well guarded, say spokespeople for the group, formally known as the Information Design Assurance Red Team or IDART. Check out their site here."

Stir, leave plot overnight to thicken. vjlen writes: "Now it sounds like corinthians.com is just another cybersquatting case. From an article in USA Today: 'But the case is not as black-and-white as it seems, says Dave Fogelson, a spokesman for the team, which recently put up its own site in Brazil. Fogelson says the arbitrator had to consider several factors, including the fact that Sallen did not use the site for Bible quotes until after he contacted the team to talk about selling the name, which suggests his main motive was profit.'"

Or ... or ... or ... we'll strike! stattouk writes "The BBC has a story on a court case currently happening in France over whether Yahoo France can be held responsible for people being able to access auctions of Nazi memorabilia. The courts say that even though fr.yahoo.com has blocked access, the fact that www.yahoo.com can still be used to get them amounts to no action by Yahoo." Asking Yahoo! to block Internet auctions in the first place seemed rather stretchy; now it seems that Yahoo! is supposed to police the entire world.

Penguins do come from that hemisphere, after all ... Tsujigiri writes "To follow up a previous story on Slashdot about the Australian InstallFest 2000, Fairfax IT is running this story about the recently held (well, July the 15th) Adelaide InstallFest 2000 and its "unexpected surge in interest". Quite successfull all round. Congratulations to all involved, and good luck to the rest of the Australian Install Season. (For anyone who'd like to see some pictures, go here)"

If there's an "install season" down there, one questions leaps to mind: Is there a limit on those things?

Imagine a novelist, trapped in a nightmarish world of credit cards and micropayments, facing devilish odds and the belligerent stares of publishers everywhere ... picture a team of hackers brazen enough to break into dozens of secure government sites without incurring a single lawsuit ... scream in terror at the thought of mutant penguin-kangaroo hybrids swimming deviously onto our shores ...

Revenge of the naysayers' naysayers: Just yesterday, jamie sallied forth with the theory that Stephen King was setting himself up for disappointment by expecting enough paying customers for his new online book to justify the experiment.

jheinen writes, though, "According to MSNBC, of the 41,000 downloads for the first installment so far, 32,000 (~78%) have already paid via credit card. Kinda shoots to hell the theory that people won't pay."

[Jamie adds: I stand by my prediction that "Stephen King is never going to have to publish the end of his novel." I'd love to see him succeed, but I just don't think so this time around. We'll see in September!]

Red Five, I'm going in. You may recall the story a little while ago about a distributed anti-cracking bot at Sandia National Laboratory. Rest assured, those clever folks don't confine themselves to practicing only one side of the ol' thrust-and-feint.

In fact, leb writes: "Over the past two years, a group at Sandia National Laboratories known informally as the Red Team has, at customer invitation, either successfully invaded or devised successful mock attacks on 35 out of 35 information systems at various sites, along with their associated security technologies. Their work - challenged only by a new style of defense, also developed at Sandia, called an "intelligent agent" - demonstrates that competent outsiders can hack into almost all networked computers as presently conformed no matter how well guarded, say spokespeople for the group, formally known as the Information Design Assurance Red Team or IDART. Check out their site here."

Stir, leave plot overnight to thicken. vjlen writes: "Now it sounds like corinthians.com is just another cybersquatting case. From an article in USA Today: 'But the case is not as black-and-white as it seems, says Dave Fogelson, a spokesman for the team, which recently put up its own site in Brazil. Fogelson says the arbitrator had to consider several factors, including the fact that Sallen did not use the site for Bible quotes until after he contacted the team to talk about selling the name, which suggests his main motive was profit.'"

Or ... or ... or ... we'll strike! stattouk writes "The BBC has a story on a court case currently happening in France over whether Yahoo France can be held responsible for people being able to access auctions of Nazi memorabilia. The courts say that even though fr.yahoo.com has blocked access, the fact that www.yahoo.com can still be used to get them amounts to no action by Yahoo." Asking Yahoo! to block Internet auctions in the first place seemed rather stretchy; now it seems that Yahoo! is supposed to police the entire world.

Penguins do come from that hemisphere, after all ... Tsujigiri writes "To follow up a previous story on Slashdot about the Australian InstallFest 2000, Fairfax IT is running this story about the recently held (well, July the 15th) Adelaide InstallFest 2000 and its "unexpected surge in interest". Quite successfull all round. Congratulations to all involved, and good luck to the rest of the Australian Install Season. (For anyone who'd like to see some pictures, go here)"

If there's an "install season" down there, one questions leaps to mind: Is there a limit on those things?

Imagine a novelist, trapped in a nightmarish world of credit cards and micropayments, facing devilish odds and the belligerent stares of publishers everywhere ... picture a team of hackers brazen enough to break into dozens of secure government sites without incurring a single lawsuit ... scream in terror at the thought of mutant penguin-kangaroo hybrids swimming deviously onto our shores ...

Revenge of the naysayers' naysayers: Just yesterday, jamie sallied forth with the theory that Stephen King was setting himself up for disappointment by expecting enough paying customers for his new online book to justify the experiment.

jheinen writes, though, "According to MSNBC, of the 41,000 downloads for the first installment so far, 32,000 (~78%) have already paid via credit card. Kinda shoots to hell the theory that people won't pay."

[Jamie adds: I stand by my prediction that "Stephen King is never going to have to publish the end of his novel." I'd love to see him succeed, but I just don't think so this time around. We'll see in September!]

Red Five, I'm going in. You may recall the story a little while ago about a distributed anti-cracking bot at Sandia National Laboratory. Rest assured, those clever folks don't confine themselves to practicing only one side of the ol' thrust-and-feint.

In fact, leb writes: "Over the past two years, a group at Sandia National Laboratories known informally as the Red Team has, at customer invitation, either successfully invaded or devised successful mock attacks on 35 out of 35 information systems at various sites, along with their associated security technologies. Their work - challenged only by a new style of defense, also developed at Sandia, called an "intelligent agent" - demonstrates that competent outsiders can hack into almost all networked computers as presently conformed no matter how well guarded, say spokespeople for the group, formally known as the Information Design Assurance Red Team or IDART. Check out their site here."

Stir, leave plot overnight to thicken. vjlen writes: "Now it sounds like corinthians.com is just another cybersquatting case. From an article in USA Today: 'But the case is not as black-and-white as it seems, says Dave Fogelson, a spokesman for the team, which recently put up its own site in Brazil. Fogelson says the arbitrator had to consider several factors, including the fact that Sallen did not use the site for Bible quotes until after he contacted the team to talk about selling the name, which suggests his main motive was profit.'"

Or ... or ... or ... we'll strike! stattouk writes "The BBC has a story on a court case currently happening in France over whether Yahoo France can be held responsible for people being able to access auctions of Nazi memorabilia. The courts say that even though fr.yahoo.com has blocked access, the fact that www.yahoo.com can still be used to get them amounts to no action by Yahoo." Asking Yahoo! to block Internet auctions in the first place seemed rather stretchy; now it seems that Yahoo! is supposed to police the entire world.

Penguins do come from that hemisphere, after all ... Tsujigiri writes "To follow up a previous story on Slashdot about the Australian InstallFest 2000, Fairfax IT is running this story about the recently held (well, July the 15th) Adelaide InstallFest 2000 and its "unexpected surge in interest". Quite successfull all round. Congratulations to all involved, and good luck to the rest of the Australian Install Season. (For anyone who'd like to see some pictures, go here)"

If there's an "install season" down there, one questions leaps to mind: Is there a limit on those things?

Imagine a novelist, trapped in a nightmarish world of credit cards and micropayments, facing devilish odds and the belligerent stares of publishers everywhere ... picture a team of hackers brazen enough to break into dozens of secure government sites without incurring a single lawsuit ... scream in terror at the thought of mutant penguin-kangaroo hybrids swimming deviously onto our shores ...

Revenge of the naysayers' naysayers: Just yesterday, jamie sallied forth with the theory that Stephen King was setting himself up for disappointment by expecting enough paying customers for his new online book to justify the experiment.

jheinen writes, though, "According to MSNBC, of the 41,000 downloads for the first installment so far, 32,000 (~78%) have already paid via credit card. Kinda shoots to hell the theory that people won't pay."

[Jamie adds: I stand by my prediction that "Stephen King is never going to have to publish the end of his novel." I'd love to see him succeed, but I just don't think so this time around. We'll see in September!]

Red Five, I'm going in. You may recall the story a little while ago about a distributed anti-cracking bot at Sandia National Laboratory. Rest assured, those clever folks don't confine themselves to practicing only one side of the ol' thrust-and-feint.

In fact, leb writes: "Over the past two years, a group at Sandia National Laboratories known informally as the Red Team has, at customer invitation, either successfully invaded or devised successful mock attacks on 35 out of 35 information systems at various sites, along with their associated security technologies. Their work - challenged only by a new style of defense, also developed at Sandia, called an "intelligent agent" - demonstrates that competent outsiders can hack into almost all networked computers as presently conformed no matter how well guarded, say spokespeople for the group, formally known as the Information Design Assurance Red Team or IDART. Check out their site here."

Stir, leave plot overnight to thicken. vjlen writes: "Now it sounds like corinthians.com is just another cybersquatting case. From an article in USA Today: 'But the case is not as black-and-white as it seems, says Dave Fogelson, a spokesman for the team, which recently put up its own site in Brazil. Fogelson says the arbitrator had to consider several factors, including the fact that Sallen did not use the site for Bible quotes until after he contacted the team to talk about selling the name, which suggests his main motive was profit.'"

Or ... or ... or ... we'll strike! stattouk writes "The BBC has a story on a court case currently happening in France over whether Yahoo France can be held responsible for people being able to access auctions of Nazi memorabilia. The courts say that even though fr.yahoo.com has blocked access, the fact that www.yahoo.com can still be used to get them amounts to no action by Yahoo." Asking Yahoo! to block Internet auctions in the first place seemed rather stretchy; now it seems that Yahoo! is supposed to police the entire world.

Penguins do come from that hemisphere, after all ... Tsujigiri writes "To follow up a previous story on Slashdot about the Australian InstallFest 2000, Fairfax IT is running this story about the recently held (well, July the 15th) Adelaide InstallFest 2000 and its "unexpected surge in interest". Quite successfull all round. Congratulations to all involved, and good luck to the rest of the Australian Install Season. (For anyone who'd like to see some pictures, go here)"

If there's an "install season" down there, one questions leaps to mind: Is there a limit on those things?

Ant was the first of a number of folks to write about the press release that came out from LucasArts and Bioware. Bioware, you probably remember, has done Icewind Dale and Baldur's Gate with their Infinity Engine. Pretty cool stuff - the setting of the game is going to be prior to the Star Wars movies. I don't know whether that means prior to Episode I or Episode IV, but the real-world ship date is supposed to be 2002. So, donna hold your breath.

qbasicprogrammer writes: "Security Portal has a review on the security of Red Hat, SuSE, TurboLinux, and Caldera Linux distributions." Debian and Slackware are absent, but its a decent piece.

helleman asks: "I'm interested in finding out more about open source school administration tools. Elementary and high school system administrators (often working on a volunteer basis - like myself!) are just too busy fighting fires trying to keep the school systems running (like printers, tape backups and fileservers) than to really have time to step back and evaluate/test/develop administration software properly. I could really use some advice picking some open source software either to run with (something extendable so we could code our own custom modules) OR some pointers to which software our committee should start designing our own open source school administration software with! There are many closed source options - there HAS to be some open source ones! Report Cards, Membership reports, health records, transcripts, resource administration (room bookings) and finance/contributions are a few examples of things that need to be tracked. Help!"

Welcome to another episode of Slashback, laden with bits about the psychology of the Apple Cube, damage-control parity among handhelds, mourning the passing of a Linux-friendly ISP, technicalities of credit, and aliens. Can you ever read enough about aliens, anyhow? Enjoy.

Its maddening combination of color and shape drive one completely in -- No, wrong cube. Savage Henry Matisse writes: "There's a really super article analyzing the psychology behind Jobs' most recent flight of fancy, posted here. The thrust of it is that, rather than being a replay of the NeXT FUBAR or another instance of being too-far-ahead-of-his-time, the CUBE is really a very sly piece of manuevering meant to shoehorn Macs into the corporate compu-hierarchy from the top down. Very insightful-- an analysis kinda along the same lines as Neal Stephenson's In the Beginning was the Command Line" And for those who prefer the practical to the theoretical, RevAaron writes: "Many of us have been wondering about some of the details of Apple's newly released Power Macintosh G4 Cube, including whether or not it has an AGP slot or just a chip soldered onto the board. Listen to the story from the lead designer of the cube here at MacSlash."

Well technically, they'd still block excess light from your eyes ... FroBugg writes "Handspring has just released an OS upgrade for all their Visor handhelds, which is supposed to fix the DRAM problem that caused crashes and data corruption. Go get it here." This is the same RAM Problem Palm devices have as reported a few weeks ago, at which point no fix was out for Visors.

The end of a (very brief era): dubious_1 writes "The free internet service provider http://www.freewwweb.com has ceased operation. The service provided by freewwweb used ppp and pap authentication for its dialup making it available to users of any operating system. Users of freewwweb agreed to set their web browsers home page to a page used by freewwweb, to allow them to support the service through ad revenue. According to the web page you are redirected to when accessing the previous freewwweb.com site, the service lost by the demise of freewwweb is now being filled by Juno however, this service is only available for users of MS Windows 9x and nt. Unlike freewwweb, Juno uses a proprietary front end to authenticate users on their service. The web site specifically says that this client program is not available for either Linux or MacOS."

One recurrent Ask Slashdot question is about this very issue -- Where are free ISPs for Linux users? I wonder if there are any good answers now that freewwweb has snuffed it. Surely if billions of dollars are there to be made with free-for-the-viewing television programming, there's no reason that ad-supported ISPs should be uncommon. Can you say "target market"?

Credit where credit is due. We mentioned a fraudulent site established to mimic the look of online personal credit-card site PayPal. Jawed Karim writes, "You incorrectly mention that your credit card can get stolen by becoming a victim to the fake PayPal site. This is not true. The credit card is not exposed when you log into your PayPal account. Just wanted to make this clear. (The same correction has been made to the MSNBC article, at the bottom of it)"

Well, isn't the danger that customers lulled into thinking they were on the right site would be also lulled into giving their information away? Someone sure wants to steal credit card information with this site, but yes, it's more of a social engineering trick than an automated number grabber.

Yes sir, we know that the damn cat is still in the box. Swede2048 writes: "Lots of people think that SETI is a hopeless adventure, and mostly a waste of time and processing cycles. [including many who read yesterday about the "SETI-on-a-board product" ;) -- t] For those who haven't read it yet, last month's Scientific American had a great article describing the results SETI has already provided. By NOT finding e.t.life in the searched sky, SETI has placed some restrictions on what kinds of e.t life can exist."

Several readers pointed to the announcement that 3-D Graphics tool Maya will be ported to Linux. Darkfell quotes the release : "Responding to demand from leading studios worldwide, Alias/Wavefront will deliver Maya on Red Hat Linux in early 2001. story at biz.yahoo.com" The high-end graphics world has sure seen some strange convergences and redirections in the past few years, what with the prematurely announced death of the Macintosh, concerted marketing efforts to replace UNIX with NT, and now ... welcome to the turn of the century, guys.

Several readers pointed to the announcement that 3-D Graphics tool Maya will be ported to Linux. Darkfell quotes the release : "Responding to demand from leading studios worldwide, Alias/Wavefront will deliver Maya on Red Hat Linux in early 2001. story at biz.yahoo.com" The high-end graphics world has sure seen some strange convergences and redirections in the past few years, what with the prematurely announced death of the Macintosh, concerted marketing efforts to replace UNIX with NT, and now ... welcome to the turn of the century, guys.

Last Tuesday you asked Ingo Molnar, Red Hat kernel hacker, about the means by which his TUX Web server recently achieved such fantastic results in SpecWeb99 . He was kind enough to respond with at-length answers addressing licensing, the reality of threads under Linux, the realism of benchmarks, and more. Thanks, Ingo!

1) TUX Architecture
by dweezil

"You appear to have take an "architectural" approach to designing TUX, so I have some architectural questions.

1.The choice of a kernel space implementation is probably going to be a controversial one. You suggest that HTTP is commonly used enough to go in the kernel just as TCP/IP did years ago. What performance or architectural advantages do you see to moving application protocols into the kernel that cannot be achieved in user space?

Ingo Molnar The biggest advantage i see is to have encapsulation, security and performance available to dynamic web applications *at the same time*.

There are various popular ways to create dynamic web content. Encapsulation, security is provided by CGI, various scripting and virtual machine models - unpriviledged/prototype/buggy CGIs are sufficiently isolated both from HTTP protocol details, from the webserving context, from the web-client and from each other.

But all CGI/scripting/virtual-machine models (including fast-CGI) lack the possibility of performing with 'maximum performance' if the webserver is in another process context. 'maximum performance' means that there should be only one context running (no context switching done), and the application writer should have the freedom to use C code, or even assembly code. (not that using assembly in web-applications would be too common.)

ISAPI, NSAPI dynamic webserver applications can have maximum performance because they run in the webserver's context, but they do not provide enough security - ie. a buggy ISAPI DLL which is loaded into IIS's address space can take down IIS and the whole site, including unrelated virtual sites. Not a very safe programming model. Additionally ISAPI/NSAPI modules often have to care about HTTP protocol details, and can cause HTTP-nonconform replies being generated. Additionally, debugging ISAPI/NSAPI modules is hard and a pain, and nobody does it on live servers. [i intentionally omitted Apache modules, because Apache modules are primarily used to extend the capabilities of Apache, they are not ment to provide a platform for dynamic applications.]

The TUX dynamic API is implemented through a kernel-based subsystem, which is accessible via a system-call which is available to 'unpriviledged' user-space code. There is no context switching (ie. we can have maximum performance) and still no user-space code can take the webserver down, because kernel-space is isolated from user-space. Obviously the TUX subsystem checks user-space parameters with extreme prejudice. It's a goal of TUX to also enforce RFC-conform replies being sent to the web-client - just like CGIs. Plus TUX modules can be in separate process contexts as well. (in this case there is going to be casual context-switching between these process contexts.)

TUX also has kernel-space modules - for the truly performance-hungry and kernel-savvy web coder. Some TUX features (such as CGI execution) are implemented as TUX kernel-space modules. Here are the various layers of modularity in TUX:

• 'accelerated requests', automated by TUX. (static GETs, etc.)
• 'kernel-space TUX modules'
• 'user-space TUX modules'
• 'fast socket-redirection to other webservers'
• 'external CGIs'

2. What is your approach to concurence? In particular, you refer to "event driven". What do you mean by that and what did you choose as the core to your event engine? Also, how do you handle threading to scale on SMP machines?

Ingo: This is how it works, simplified:

there is a 'HTTP request' user-space structure that is manipulated by the TUX kernel-space subsystem. Whenever a requested operation (eg. 'send data to client', or 'read web-object from disk') is about to block then TUX 'schedules' another request context and returns it to user-space. User-space can put event codes (or other private state) into the request structure, so that it can track the state of the request. This programming model is harder to code than other, more 'synchronous' solutions, but avoids the context-switch problem. Whenever there is no more work to be done by user-space, TUX suspends the process until there are new connections or any other progress.

3. Are there any plans to generalize the infrastructure elements of TUX so that other protocol servers can take advantage of the TUX architecture and also go fast as hell?"

Ingo: Yep i think so - i'm thinking about writing a FTP TUX component ...

2) Relative Impact
by Caballero

TUX includes a variety of kernel and apache changes. Can you give a rough measure of how each of the changes improved the http performance? I'm interested in the amount of improvement as well as why it improved performance. Do those particular changes have negative impact on the performance of other applications?

Ingo: i have no exact numbers because TUX advances in an 'evolutionary' way and closely followed/follows the 2.3/2.4 kernel line - the impact of particular changes is hard to judge exactly. Here are a couple of new features of the 2.4 kernel that are used by TUX and make a visible performance impact (without trying to list all the improvements):

• the single biggest change that enabled TUX was the inclusion of the new Linux TCP/IP architecture into 2.3 early this year. This is the 'softnet' architecture which has been written by David Miller and Alexey Kuznetsov, and is a very SMP-centric rewrite of the Linux TCP/IP stack. In Windows speak: 'the Linux 2.4 TCP/IP stack is completely deserialized'.
• another important change for TUX were the many VFS cleanups and scalability improvements done by Alexander Viro and Linus.
• a patch from Manfred Spraul went into the kernel recently, the per-CPU SLAB cache (the concept is this: when freeing buffers the kernel keeps them in variable-size per-CPU pools, and if the same type of buffer gets allocated shortly afterwards then the kernel picks from the pool that belongs to that CPU. This leads to dramatically better cache-locality.) Per-CPU SLAB pools are used by TUX, obviously.
• another feature which made a noticeable difference is the I/O scheduler rewrite by Andrea Arcangeli and Jens Axboe.
• large file support (up to 2TB files) from Matti Aarnio and Ben LaHaise is crucial as well - the logfile of the 4200 connections SPECweb99 result was bigger than 5 GB.

other TUX-related "generic kernel changes" are included in the mainstream 2.4.0-test3 kernel already: IRQ affinity, process pinning, polling-idle, better IRQ scalability, highmem support.

there are other important scalability improvements all around the place in 2.4 Linux, i think it's fair to say that almost every single line in the 'main kernel' got replaced by something else.

TUX includes no Apache changes right now - the 'redirection' feature can be used to feed connections to an (unchanged) Apache setup. But enabling a future mod_tux.c was definitely a goal, to get deeper Apache integration.

3) Caching
by JohnZed

I have a few questions about TUX's caching system. Before I go any further, I want to say that I'm incredibly impressed by the results. I've been following specWeb99 for a while and have been wondering when someone would manage to build a great dynamic cache like this one. I hope it'll get the wide acceptance it seems to deserve.

First, it seems that basically the entire test file set was loaded into memory ahead of time for use by TUX. [...]

Ingo: no, this was not the case actually. In the 1-CPU Dell system the fileset size was 4182 MB, RAM size was 2GB. In the 4-CPU Dell system the total fileset size was 13561 MB, RAM size was 8GB. So the IO and cache capabilities of TUX and the hardware were tested heavily. Eg. the best Windows 2000 + IIS result had a fileset size of 5241 MB, with 8GB RAM. (ie. fully cached, only logging IO.)

[...] How adaptable is TUX to more dynamic, limited-memory environments in terms of setting cache size limitations, selectivity (e.g. "cache all .GIFs, but not .html files"), and expiration/reloading algorithms?

Ingo: i do not want to raise expectations unnecesserily, but it's an integral part of TUX to perform async IO and 'cachemiss' operations effectively. Cached objects are timed out by a LRU mechanizm, so objects accessed less frequently will get deallocated if memory pressure rises.

Second, can a tux module programmer modify the basic tux commands, or do they always do the same thing? For instance, if I were adapting TUX to work with a web proxy cache, I'd want TUX_ACTION_GET_OBJECT to actually go out over the network and do a GET request if it couldn't find a requested object in the cache. You can imagine lots of other circumstances where this would come up as well. [...]

Ingo: TUX is a webserver, and has no proxy capabilities yet. It would be a reasonable and natural extension of the GET_OBJECT mechanizm to fetch objects from a cache hierarchy or from origin servers, yes.

Third, is it possible to execute more than one user-space TUX module at one time? [...]

Ingo: yes. TUX modules right now are compiled as shared libraries and thus can be loaded/unloaded runtime. An unlimited number of user-space modules can be used without performance impact. Fourth, when can we play with the code? Thanks a lot!

Ingo: SPEC rules which regulate the acceptance of not-yet-released products require us to release TUX sometime in August - the whole TUX codebase is going to be released under the GPL.

4)Integration into RedHat?
by ErMaC

How will the TUX Webserver integrate with RedHat's Linux distributions? Will RedHat create a special distribution with an identical setup to yours?

Ingo: there are going to be RPMs which can be installed on Red Hat 6.2, plus source-code which can be used with any distribution. Since TUX is a kernel-subsystem mainly, TUX is fundamentally distribution-neutral.

Will RedHat start releasing more specialized distributions, preferably ones more suited to a secure server environment but focused on performance like your setup was?

Ingo: well i cannot comment on specific products (being a kernel guy), but we always try to maximize the security and performance of all our products. TUX itself can be safer than user-space webservers, simply due to the fact that the kernel is a much more controlled, predictable and dedicated programming environment. Nevertheless we try to minimize the amount of code put into the kernel.

5) Performance using dynamic content
by Paladin128

How would TUX perform using CGI/Servlets/PHP/etc. compared to Apache or IIS? The ability to serve static pages fast is not that useful in the real world, as all the sites that get really big hits-per-second are those with dynamic content (Yahoo, Slashdot, Amazon.com, etc.)"

Ingo: SPECweb99 is based on real-life logged web-traffic and as a result of that it includes 30% dynamic content -- which dynamic content uses the same fileset as static replies. So the dynamic workload of SPECweb99 is neither trivial, nor isolated.

as explained earlier, TUX is designed to generate very fast dynamic content, the possibility to accelerate static content is a natural step enabled by the kernel-space HTTP protocol stack. After all the kernel does eg. TCP handshake fully in kernel-space as well, and the user gets the simpler 'connect()' functionality. Nevertheless static content is still very important, if take a look at the workload of really big sites like Yahoo, Slashdot or CNN then you'll notice that lots of content (especially content that attracts many hits) is still static. But TUX tries to provide an environment for 'next generation' web-content (ie. web applications), where dynamic output is just as natural as static.

6) Threading and Linux
by Chainsaw

Unix programmers seems to dislike using threads in their applications. After all, they can just fork(); and run along instead of using the thread functions. But, that's not important right now.

What is your opinion on the current thread implementation in the Linux kernel compared to systems designed from the ground up to support threads (like BeOS, OS/2 and Windows NT)? In which way could the kernel developers make the threads work better?"

Ingo: thats a misconception. The Linux kernel is *fundamentally* 'threaded'. Within the Linux kernel there are only threads. Full stop. Threads either share or do not share various system resources like VM (ie. page tables) or files. If a thread has 'all-private' resources then it behaves like a process. If a thread has shared resources (eg. shares files and page tables) then it's a 'thread'. Some OSs have a rigid distinction between threads and processes - Linux is more flexible, eg. you can have two threads that share all files but have private page-tables. Or you can have threads that have the same page-tables but do not share files. Within the kernel i couldnt even make a distinction between 'processes' and 'threads', because everything is a thread to the kernel.

This means that in Linux every system-call is 'thread-safe', from grounds up. You program 'threads' the same way as 'processes'. There are some popular shared-VM thread APIs, and Linux implements the pthreads API - which btw. is a user-space wrapper exposing already existing kernel-provided APIs. Just to show that the Linux kernel has only one notion for 'context of execution': under Linux the context-switch time between two 'threads' and two 'processes' is all the same: around 2 microseconds on a 500MHz PIII.

programming 'with threads' (ie.: with Linux threads that share page tables) is fundamentally more error-prone that coding isolated threads (ie. processes). This is why you see all those lazy Linux programmers using processes (ie. isolated threads) - if there is no need to share too much state, why go the error-prone path? Under Linux processes scale just as fine on SMP as threads.

the only area where 'all-shared-VM threads' are needed is where there is massive and complex interaction between threads. 98% of the programming tasks are not such. Additionally, on SMP systems threads are *fundamentally slower*, because there has to be (inevitable, hardware-mandated) synchronization between CPUs if shared VM is used.

this whole threading issue i believe comes from the fact that it's so hard and slow to program isolated threads (processes) under NT (NT processes are painfully slow to be created for example) - so all programming tasks which are performance-sensitive are forced to use all-shared-VM threads. Then this technological disadvantage of NT is spinned into a magical 'using threads is better' mantra. IMHO it's a fundamentally bad (and rude) thing to force some stupid all-shared-VM concept on all multi-context programming tasks.

for example, the submitted SPECweb99 TUX results were done in a setup where every CPU was running an isolated thread. Windows 2000 will never be able to do stuff like this without redesigning their whole OS, because processes are just so much fscked up there, and all the APIs (and programming tools) have this stupid bias towards all-shared-VM threads.

7) Kernel modules decrease portability?
by 11223

You mentioned in the second Linux Today article that you intend to integrate TUX with Apache. However, Apache has always been a cross-platform server and is heavily used on *BSD and Solaris. Do you feel that this integration will undermine the portability work of the Apache team, or will it simply provide an incentive for web servers to be running Linux? [...]

Ingo: TUX is a kernel subsystem with a small amount of user-space glue code to make it easier to use the TUX system-call. I believe that integrating kernel-based HTTP protocol stacks into Apache makes sense - i dont think this will 'undermine' anything, to the contrary, it will enable similar solutions on other OSs as well.

" If you intend to encourage people to move to Linux, can a similar idea as TUX be applied to an SQL server to make up for the speed deficit between Linux SQL servers and Microsoft SQL?

Ingo: I dont care about Microsoft SQL Server being too slow. ;-)

Database servers are not networking protocols - so the concepts of TUX and SQL servers cannot be compared. While there are a couple of simple RFCs describing the HTTP protocol, SQL is a few orders more complex, has programming extensions and all sorts of proprietary flavors.

8) Load balancing
by Ex Machina

Does/Will TUX provide any sort of load balancing for a cluster of heterogenous TUX servers?

Ingo: not the initial release, but yes, it's on the feature list :-)

9) It works with Apache...
by Ex Machina

It works with Apache but is TUX generic enough to be interfaced with another server?

Ingo: yes, i think so.

10) Version 1
By An Unnamed Correspondent

"This is a version 1 of the web server, and it has proven itself to be pretty nifty when it comes to serving both static webpages (through a kernel level httpd) and dynamic webpages. Do you see TuX getting more lean and faster as time wears on, past versions 2, 3, ... or do you see it getting bogged down in mostly unnecessary cruft and bloat?

Ingo: actually if you watch the development of Apache, Apache got faster with every major release. No, i dont think that additional features will slow TUX down, once the internal architecture is extensible enough there is no problem if additional features are *added*. It brings an obvious performance penalty if you *use* a given feature (eg. SSI). A webserver is badly designed if it gets slower doing the very same task.

Will there be a way to port an existing Apache configuration across to the TuX configuration? How about IIS, Netscape, Zeus, etc? Will TuX have the option of a GUI setup screen for those who don't like the command line? Will TuX have a simple installer?

Ingo: i dont know. The initial release will have no 'fancy' tools, this will implicitly 'encourage' the early adopters to be technically savvy. (and thus helping TUX development indirectly.) The initial TUX release is expected to be raw and uncut.

11) Re:Versions for other OSs?
by Jason Earl

Actually there is a specific feature that would probably make TUX incompatible with the BSDs. TUX is licensed under the GPL and the BSD maintainers would probably be very reluctant to port it to their OSes. Especially since it is possible that this would require them to release the derivative work under the GPL.

Which leads to the obvious question for Ingo. You mention a specific disclaimer that would allow the Apache to be linked with TUX, do the BSDs get the same privilege?

Ingo: TUX is not 'linked' to Apache. Apache can use the TUX system-call, and applications are 'isolated' from the GPL license of the kernel. Can BSD-licensed software use the TUX system-call? Of course!

Not that I particularly care, as I am not a BSD user, but the putting such a nifty program as TUX under the GPL is bound to cause weeping and gnashing of teeth in the BSD camp. Which brings up another question. How much pressure do you get from your BSD compatriots to release software like this under a more liberal BSD-friendly license?

Ingo: TUX has to be under the GPL because it's a Linux kernel subsystem, and because Red Hat releases all source code as open-source. That having said, i wouldnt write Linux kernel code if i didnt agree with the ethics of the GPL. Putting it simply, the GPL guarantees that all derivatives of source code that *we* have written stay under the GPL as well.

Isnt this a reasonable thing? Nobody is forced to use *our* source code as a base for their project, but if you freely chose to use our source-code, then isnt it very reasonable to ask for the same kind of openness that enabled you using this source code in the first place?

To put in another way, you get our source code only if you agree to be just as open to us as open we are to you. You always have the option to not use our source code. You are free to weigh the benefits of using our source code, against the 'disadvantage' of having to show us your redistributed improvements.

but again, the GPL is only about *our* *source* code. You are completely free to put your source code under whatever license you wish to. I respect BSD kernel hackers and closed-source kernel hackers just as much as Linux kernel hackers, based on the code they produce. It's their private matter to decide under what license they put their code. It's their godsent right to do whatever they wish to do with the source code they wrote.

More on the conflict of interest in the 2600 / DeCSS case. More on the South African penguins trapped in a world of petroleum, currents and love beneath the panopticon world of satellite observation. And congratulations to Distributed.Net for setting in place their new milestone. All below!

Why no, gentlemen, I see no conflict of interest. You may recall reading that Lewis Kaplan, the judge in the DeCSS trial underway in New York right now, consulted for Time-Warner, raising questions about conflict of interest. Jim Tyre of The Censorware Project writes: "Yesterday, CT posted a piece on 2600's attempt to disqualify Judge Kaplan in the New York DeCSS trial. Last night, Kaplan's 51 page Order denying the motion made it to the Net. No doubt he spent the weekend writing it, putting him in a nice mood for when trial commenced yesteday. Interesting reading for those who like to slog through such things."

The first 1000 days. emerson writes "According to their RC5-64 Stats Page, distributed.net's RC5-64 project turns 1000 days old today (July 18th; the stats page will show 1000 days when today's stats are digested and displayed tomorrow), with just over 28% of the keyspace checked out. Makes me feel pretty safe about RC5-64 versus brute-force attacks ..." Oskuro writes: "Today is the 1000th day distributed.net is searching for a winning key on RSA's RC5-64 contest. In that long time, the 28% of the keyspace has been tested, so there's a long way to go still. Maybe you want to download a client and start crunching for Team Slashdot?" Note: this means that as of today (day 1001), the stats reflect the 1000-day figure.

Wish I had scientists helping find me a mate ... John B. Hayes writes "Yahoo! News has a great story on an heroic high-tech penguin and his surviving the impossible. I wonder if there is a deeper meaning here... I mean, he made it 600 miles without a re-boot; ok, so there were some unexpected obstacles to deal with and the programmer had to step in, but that's the beauty of it. I'm charged!" cvd6262 writes "It seems that all's weel that ends well. Our Beloved Jackass Pequin, Peter, arrived home. I quote from the site: 'At 0456 this morning, Peter's satellite tag reported that he was at 33 48 S 18 22 E. Wait a moment. Those are the coordinates for Robben Island. Peter is home.' Now he only has to find a suitable Jackass Penquin mate."

All the same, I think I'd prefer some privacy. Oostendorpophile writes "I got this email today:

'Thank you for your inquiries into the FBI's "Carnivore". We have received many inquiries, many Kudos and many sneers for what has been in the news in the last couple weeks. Much of the information that the press has published has been inaccurate or misleading. Earthlink takes the following stance (in quotes below).

"We do not allow the installation of Carnivore on our network because it has the potential to compromise the privacy of our legitimate users and the performance of our network. We have an internal solution which allows us to comply with court orders without the presence of government personnel or equipment in our buildings. The government accepts this solution since they still receive the requested information about the criminal suspect, and we sleep well knowing that our customers are safe from unauthorized surveillance."

Sincerely,
Mary Youngblood
Privacy Policy
Earthlink/Mindspring Abuse Team Manager'"

This isn't the most satisfying possible answer, but at least it's nicer than block committees and "an enthusiastic welcome to the nice gentlemen who'll be sharing the building with us" ... Earthlink / Mindspring is one of the largest if not the largest ISP, though -- will smaller ISPs be able to stare down Carnivore as well?

And Apple Legal hasn't said a thing about this yet? Hollis writes "After months of discussion and work, linuxppc.org has been rewritten and is hosted at penguinppc.org. The new site has a slick design and lots of new content... check it out." And today's announcement of the new cube PowerMac puts a different light on the criticism Ryan Meader received for posting about such a thing on MacOS Rumors. It's a good thing to be wrong about! Dual G4 in a cube. Linux on PPC. Repeat.

More on the conflict of interest in the 2600 / DeCSS case. More on the South African penguins trapped in a world of petroleum, currents and love beneath the panopticon world of satellite observation. And congratulations to Distributed.Net for setting in place their new milestone. All below!

Why no, gentlemen, I see no conflict of interest. You may recall reading that Lewis Kaplan, the judge in the DeCSS trial underway in New York right now, consulted for Time-Warner, raising questions about conflict of interest. Jim Tyre of The Censorware Project writes: "Yesterday, CT posted a piece on 2600's attempt to disqualify Judge Kaplan in the New York DeCSS trial. Last night, Kaplan's 51 page Order denying the motion made it to the Net. No doubt he spent the weekend writing it, putting him in a nice mood for when trial commenced yesteday. Interesting reading for those who like to slog through such things."

The first 1000 days. emerson writes "According to their RC5-64 Stats Page, distributed.net's RC5-64 project turns 1000 days old today (July 18th; the stats page will show 1000 days when today's stats are digested and displayed tomorrow), with just over 28% of the keyspace checked out. Makes me feel pretty safe about RC5-64 versus brute-force attacks ..." Oskuro writes: "Today is the 1000th day distributed.net is searching for a winning key on RSA's RC5-64 contest. In that long time, the 28% of the keyspace has been tested, so there's a long way to go still. Maybe you want to download a client and start crunching for Team Slashdot?" Note: this means that as of today (day 1001), the stats reflect the 1000-day figure.

Wish I had scientists helping find me a mate ... John B. Hayes writes "Yahoo! News has a great story on an heroic high-tech penguin and his surviving the impossible. I wonder if there is a deeper meaning here... I mean, he made it 600 miles without a re-boot; ok, so there were some unexpected obstacles to deal with and the programmer had to step in, but that's the beauty of it. I'm charged!" cvd6262 writes "It seems that all's weel that ends well. Our Beloved Jackass Pequin, Peter, arrived home. I quote from the site: 'At 0456 this morning, Peter's satellite tag reported that he was at 33 48 S 18 22 E. Wait a moment. Those are the coordinates for Robben Island. Peter is home.' Now he only has to find a suitable Jackass Penquin mate."

All the same, I think I'd prefer some privacy. Oostendorpophile writes "I got this email today:

'Thank you for your inquiries into the FBI's "Carnivore". We have received many inquiries, many Kudos and many sneers for what has been in the news in the last couple weeks. Much of the information that the press has published has been inaccurate or misleading. Earthlink takes the following stance (in quotes below).

"We do not allow the installation of Carnivore on our network because it has the potential to compromise the privacy of our legitimate users and the performance of our network. We have an internal solution which allows us to comply with court orders without the presence of government personnel or equipment in our buildings. The government accepts this solution since they still receive the requested information about the criminal suspect, and we sleep well knowing that our customers are safe from unauthorized surveillance."

Sincerely,
Mary Youngblood
Privacy Policy
Earthlink/Mindspring Abuse Team Manager'"

This isn't the most satisfying possible answer, but at least it's nicer than block committees and "an enthusiastic welcome to the nice gentlemen who'll be sharing the building with us" ... Earthlink / Mindspring is one of the largest if not the largest ISP, though -- will smaller ISPs be able to stare down Carnivore as well?

And Apple Legal hasn't said a thing about this yet? Hollis writes "After months of discussion and work, linuxppc.org has been rewritten and is hosted at penguinppc.org. The new site has a slick design and lots of new content... check it out." And today's announcement of the new cube PowerMac puts a different light on the criticism Ryan Meader received for posting about such a thing on MacOS Rumors. It's a good thing to be wrong about! Dual G4 in a cube. Linux on PPC. Repeat.

jjr writes "An article over at TechWeb states the date for the release of the source code Star Office 6.0 is on Oct. 13 and it will be released at openoffice.org." We've been hearing rumors of this for some time now, but I'm still looking for confirmation of the license, but the rumor is that it will be Open Source compliant, and hopefully GPL (especially considering the (well deserved) heat they took over their previous license). Rumors about the license in German. I've also heard that the among the major goals is a GTK port of the suite. Update: 07/19 01:31 PM by CT : It's apparently official: Finally a story in English proclaiming that it will be released under the GPL!

sonnerbob noted that Yahoo is running a story about the ongoing controversy surrounding metabrowsing. This one mentions eBay of course, but others like Priceman and Ticketmaster. The long term effects of this stuff is incredibly significant: if the courts go the wrong way, it could even make things messy for the big search engines.

sew2902 writes "If you didn't know, the aforementioned Tenchi Muyou series is going to be on the Cartoon Network. Theres an article over at Media Junkies that talks about it, including the fact that it will be censored." Tenchi is among my favorite anime series, but they'll definitely have to edit it for TV since there is the occasional nude scene. The article itself talks about Cartoon Networks increased anime content. I've been hoping they'd create a Toonami channel to counterpart their Boomerang channel: I figure somewhat censored anime is better then none at all. Oh, and the next episode of Cowboy Bebop is now out: my copy should arrive today or tomorrow: I'm stoked about this one.

dilip writes: "An Associated Press story mentions that new TLD's have been given the green light. It also mentions that there is no decision on how they will be doled out, what they will be or how trademarks will be handled. Please note however that ICANN's own website doesn't have any mention of this yet (The story is dated the 16th, which is a Sunday, no doubt that the ICANN site will be updated on the Monday)" [timothy butts in:] John Jorsett points to this ZDNet article which says the domains include .shop, .tel and .news.

For those of you who think Ask Slashdot is lacking in the technical questions department, I hope this query from (yet another) Anonymous Coward will spark your interest: "I have written a forking server in Perl that is exibiting a phase change in its response characteristics around 10 simultaneous connections. As the number of simultaneous connections passes through 10 connections the connection time increases by two orders of magnitude and becomes very random. At the same point the transmission times drop slightly and continue to have small standard deviations. Although I posted this question to a variety of Perl and Unix usenet usegroups over a week ago, I never received a response. Since the most important part of the post is the performance plot, I placed it and relevant code snipits at: http://www.geocities.com/nawkboy The memory, io, and cpu usage never exceeded more than 80% at any time during the tests and were seldom above 50%. The test results were very similar between remote and local clients. The server is running on a Sun Enterprise 420R running Solaris 2.6. I do not understand the behavior and would appreciate any guidance in understanding it."

Eric Harlow writes: "Microsoft's newly released Internet Explorer 5.5 is trying to do something Microsoft was worried that Netscape might do -- make the browser a platform. Of course, now that IE has 86% of the market, it can lure developers into using flashy new tools that leave Netscape users out of the dust since the new IE has all kinds of 'IE only' features -- and they haven't managed to fix standard items as CSS." Here's the CNET story; a snippet reads: "Together, the proprietary innovation and the purported faults in standards compliance mean that Web pages created to work for IE--widely considered to be the dominant browser--won't work with browsers from Netscape, Opera Software and other providers."

Similarly, jchristopher writes: "The Web Standards project has come out against Microsoft again, this time blasting them for the proprietary "enhancements" found in their recently released IE 5.5 Web browser. Microsoft is up to their tricks again. Meanwhile, the browser still does not fully support CSS1. Here is the press release from the Web Standards Project."

I wish companies would stop touting incompatibility with others as a desirable feature rather than a liability. Would you buy a wrench that said "Works only on Ford"?

If you've tossed and turned wondering whether the Plan 9 License is Free or merely free, or tossed back the warm milk and cookies waiting for the first stabilizations for XFree86 4.0 to arrive, or counted sheep as you daydream about a cheap Linux-based terminal without monthly fees, or forced deep breathing exercises to get over the thought that perhaps you could doing something to stamp out discourteous Web page behavior ... relax. Go to sleep right after you read these updates.

How soon is now? Unlike a lot of cool-sounding soon-to-be-released, wouldn't-it-be-cool promiseware, it's interesting to see hardware that actually makes it to market before its underlying idea is doomed by advances sweeping past. Larry Ellison's $199 Linux box mentioned on Slashdot a while back appears to have reached that point. The NIC Web site has changed, and no longer is the only way to order one donating it to an underserved school.

Why don't you find out for yourself? jesser writes "Many slashdotters asked on the lock-in attack story whether/when mozilla would be safe from this type of attack. Here are some links to bugzilla bug entries in case any slashdotters would like to work on making mozilla more secure:

• bug 29346: Prevent repeating pop-up windows
• bug 33448: disable 'new window' when close box clicked
• bug 22049: javascript alert should not put up extermely modal dialog"

You've got everything now. Patrick Mullen writes "I just finished my review of XFree86 4.0.1. I've had a lot of requests to see a feature on this when it hit (apparently they liked the last article), and here it is. There's benchmarks, overview of the bug fixes, and new features. In addition to the review, I've also got the new NVidia 0.9-4 drivers which allow NVidia's line of cards to function correctly on XFree86 4.0.1 available on the website-and these are not available on even NVidia's website at the time."

That joke isn't funny any more. A number of readers wrote in with harsh words about the report that Apple forced the removal of rumors regarding an alleged next-generation translucent-cased machine.

Kaufmann, for instance, wrote: "Remember the whole story about MOSR's article regarding the new generation of Macs getting pulled at the request of Apple Legal? Well, an Alan Smithee is claiming that it's a hoax. To prove it, he's put up the very same article on the Personal Homepage service provided by Apple at Mac.com. Further investigation seems necessary." Note: not that putting an article on Apple's Personal Homepage service proves it's worthiness, but it does beg the question of Apple being quick to pounce on it. "Alan Smithee" doesn't exactly inspire confidence either, though -- that's the pseudonym directors traditionally use to distance themselves from films they consider too bad to bear their real names;)

Similarly, an unnamed correpsondent had this to say: "The Apple cube that has been talked about the past few days is a total hoax. Some guy sent an email with fake specs to MacOSRumors and they posted it. Kind of makes one question the credibility of Ryan Meader saying that Apple forced him to take it down. Anyways you can see the fake email at: [this link]."

Stop me if you think you've heard this one before ... QBasic_Dude writes "Richard Stallman wrote about the Problems of the Plan Nine License. Technocrat has a discussion about this, and so does Advogato."

Richard cites what he considers odious provisions in the putatively "open source" Plan 9 license (like this one: "You agree to provide the Original Contributor, at its request, with a copy of the complete Source Code version, Object Code version and related documentation for Modifications created or contributed to by You if used for any purpose.") and responds with typical Stallman pithiness, "This prohibits modifications for private use, denying the users a basic right." There's much more to read there, and worth your time. (As are the discussions at Advogato and Technocrat!)

Bryan Mattern writes: "An adapted version of Red Hat 6.2 centered around Linux Virtual Server/cold failover is now available. The price is $1995, but includes a year of support for a node." This is also known as Red Hat High Availability Server 1.0.

Nostradumbass told us about HandHeldCrime. This is cool for people that like to read on their Palm. jleader shared a link to a revolutionary new airplane design being built at the Van Nuys airport in Los Angeles. As if you couldn't tell from his name, linuxsucks_dot_com thinks that Linux Sucks! Use it as a tool, not as flamebait. SEWilco told us about a little cyber kid-leashing, and while you?re making sure the kids are where they need to be, kawlyn told us about the x86 Still. Beinoni shared a link to some interesting nonlinear emergent phenomena. An Anonymous Coward sent in a link to an interesting Scientific American story about anti-aging. dolanh sent in a cool question: What was your first computer? Okay, you caught me. My first real computer of note was an Apple //c. Still have the monitor. Zeitgeist gave us a link to a tool for the paranoid, Mindguard.

QBasic_Dude writes "Freshports, a BSD-centric service similar to Freshmeat, has been upgraded to 1.1. Freshports now has 100% automation, and improved homepage, and of course, more ports."

QBasic_Dude writes "Christian Weisgerber on the openbsd-advocacy list, wrote a summary of his experiences at LinuxTag 2000 in Stuttgart, Germany. Interesting read for anyone in the Stuttgart area."

CalamityJones writes "In the 'Well, DUH!' department, this story from the AP shrieks 'Cities May Make Their Own Weather.' As if anyone with half a brain could possibly have missed this point." Not having a weather supercomputer to crunch the numbers, it wasn't quite that obvious to me, but then what do I know. Living in Michigan I'm used to the lake effect - if I lived east of some major asphalt, I guess I'd get the L.A. effect.

BgJonson79 writes "A Yale computer scientist has published his views on what will be the next 15 years of computing. He says the last breakthrough operating system was for the Mac and that Linux is obsolete. He also says the present file system is obsolete, as are some filenames." Many good points in this one. great discussion fodder: talks about how we just sort accept flaws in the systems we use. Also talks about how in the future the net will be less about computers and more about the net (eg astronomy isn't about telescopes) Definitely worth a read.