Slashdot Mirror

http://blogs.zdnet.com/security/?p=173
So I wonder if this invalidates the contest. This just revealed vulns that aren't patched on the contest machines.

I'm living in South Korea at the moment, and Windows/IE is pretty much 100% here because a certain ActiveX control is used by most sites for encryption (they use their own SEED encryption or something, here are some links...

"The key reason ActiveX is mandated by financial institutions is that Korea has its own national encryption scheme called SEED that is used in place of SSL. The reason this came to be stemmed from the fact that US export law in the late 1990s didn't permit the export of web browsers with more than 40 bit encryption. This meant that an ActiveX SEED plug-in was used in place of browser SSL. While there are Java and Netscape implementations of SEED, it was almost never implemented. ActiveX is so dominant that KFTC (Korea Financial Telecommunications and Clearings Institute) won't even assign users security certificates unless they're using Internet Explorer with ActiveX."

http://blogs.zdnet.com/Ou/?p=412

http://www.zdnet.co.kr/etc/eyeon/internet/0,390369 62,39154849,00.htm ...)

Neither, I am refering to California's non-compliance with federal law that a central database system be used, and they have paid 1.2 billion dollars in fines over the last decade for this. If you work in the California system, you should already know this. They have almost 3 billion tied up in software and fines now, including the first software package they abandoned.

As for South Carolina, I have no idea why, but I have lived in North Carolina over a decade and visit SC often enough to have a pretty good idea. Not exactly the most progressive place in the US.

This is Russell Shaw. I do the BlackBerry beat blog for ZDNet. I've just called all the carriers, and RIM, and have just posted the latest at: http://blogs.zdnet.com/blackberry/?p=135

Verizon slammed for 'chronically poor' service
http://news.zdnet.com/2100-1035_22-6176934.html
"New York Attorney General Andrew Cuomo criticized telecommunications company Verizon Communications on Tuesday for "chronically poor" telephone repair service in the state."

Hey, leave Verizon alone! They're busy protecting their patents.
They could go out of business and provide NO SERVICE if they let Vonage walk all over them!!

I found a blog, which goes into some detail, about 3 patents in this dispute.

Verizon-Vonage patent analysis Part One: 6,282,574
Verizon-Vonage Patent analysis Part Two: 6,104,711
Verizon-Vonage Patent analysis Part Three: 6,359,880

I found a blog, which goes into some detail, about 3 patents in this dispute.

Verizon-Vonage patent analysis Part One: 6,282,574
Verizon-Vonage Patent analysis Part Two: 6,104,711
Verizon-Vonage Patent analysis Part Three: 6,359,880

I found a blog, which goes into some detail, about 3 patents in this dispute.

Verizon-Vonage patent analysis Part One: 6,282,574
Verizon-Vonage Patent analysis Part Two: 6,104,711
Verizon-Vonage Patent analysis Part Three: 6,359,880

"1-3 its called a corporate firewall (or proxy or gateway) ... If a company made a whole new program based just on what they can reverse engineer to fight one program, I personally would sit back and laugh at the fools."

You didn't answer the question, though the answer seems apparent, but that statement is dead wrong. To its users, the best thing about Skype is that it "just works" no matter where you install it. It doesn't matter how draconian the firewall policy is, Skype gets through in less than a second. Skype can even connect from PC's cut off from the Internet entirely, though it takes a minute or so to scan your LAN for other Skype clients to relay traffic through. See http://blog.tmcnet.com/blog/tom-keating/skype/bloc k-skype.asp for more details.

That blog article lists 3 companies for you to laugh at (there are other companies doing it as well), along with a number of reasons you'd be the fool for laughing. This one lists even more: http://blogs.zdnet.com/ip-telephony/?p=984. EADS, a European defense agency, has reverse engineered Skype and explained a lot about it. They explained a number of ways in which Skype is a security risk. They even told hackers how to reverse engineer it, which means it could already be some hacker's faithful servant. If so, I doubt he will act like Richard Pryor in Superman 3. ;-)

You do realize that the paper that really blew this is The Detroit News - a highly conservative paper. A paper that seems to criticize every single expenditure on education excepting only vouchers for religious schools.

So, it's not unlikely that there's another side to this story.

teachers podcasting lectures:
- http://www.apple.com/education/solutions/itunes_u/ profiles/umich.html

learn chinese in michigan schools - while the schools save money on teachers:
- http://education.zdnet.com/?p=934

info about ipods for educational institutions:
- http://campustechnology.com/articles/40744/
- https://segue.middlebury.edu/index.php?action=site &site=achapin-ipod

And $38m is a lot, but the benefits of the plan were conveniently left out of the editorials - and it's just possible that some of that cost will be offset by savings.

On OSX: Eeewww. I did not know that. But, still, serialized objects aren't THAT bad compared to the registry. That seems like a way of simplifying reading in the config files more than anything else... And it's similar to a flat file system, isn't it? You can still edit them, right?

As far as Gnome goes, XML files are flat files. You can hand edit them, as you said. I prefer XML for config files, myself.

I don't think finding flat files is all that difficult. The program documentation or man page usually mentions any config file you need to know about. I don't think there's an issue here.

As far as Microsoft's intent for how companies use the registry, set that aside for a second. How is it actually USED? What are people doing with it? What is Microsoft doing with it? You yourself admit that Microsoft uses it to hold license key information for MS Word. What is a license key but a tool for restricting piracy? One key per computer, right? Take Windows Genuine Advantage for example. How does it "know" a system has been pirated? Serial numbers? License keys? Where would those be kept? The registry? If not, where else?

I'm not saying they don't have a zillion other reasons why they went with a registry, I'm just saying this one CERTAINLY figures in. I don't believe their motives were pure.

Now, on paranoia. I'm going to give you a big pile of buttery link goodness! It's an interesting story anyway. Here goes:

1. About what might be stored in a word document (very amusing!):
http://support.microsoft.com/kb/223790

2. Those wacky hidden tags!
http://chronicle.com/weekly/v52/i33/33a04101.htm

3. Microsoft embeds a Global Unique Identifier in Word Files. This is interesting
because they used the GUID embedded in the Melissa virus, plus the MAC ID stored when
it was uploaded to a website, to identify files on another site written by the same
copy of Word (or something along those lines). This nabbed them the author.
http://news.zdnet.com/2100-9595_22-514170.html

4. Here's some info on GUID:
http://en.wikipedia.org/wiki/Globally_Unique_Ident ifier

See? NOT PARANOID. But it's interesting, isn't it? Anyway, the registry is the obvious place to store settings like this. If they put them in flat files, people would go in and change them to bogus numbers. In the registry doing so is a pain in the ass, and most people would be afraid to even TOUCH the registry. Nobody's afraid of a config file; you can always back it up and put it back if you break something. Not so with the registry... Or at least, not as easily.

ABOUT WINDOWS 98: Norton Ghost was probably out by then, so the cat was out of the bag and Microsoft didn't care anymore. Or other solutions had been released.

About your 2 justifications of a database approach, I agree that those are very nice, but you can get them using XML flat files without having to deal with a registry. And each application should still maintain their own config files as a matter of principle. Otherwise, who knows if one application won't accidentally step on another?

I like flat files. Mmm... Flat files. :)

You mean Amazon's patent? http://blogs.zdnet.com/BTL/?p=4788

"Nowadays, security guys break the Mac every single day. Every single day, they come out
with a total exploit, your machine can be taken over totally. I dare anybody to do that
once a month on the Windows machine."

    -- Bill Gates, Newsweek interview, Feb. 3, 2007

[*] - http://talkback.zdnet.com/5208-10533-0.html?forumI D=1&threadID=30419&messageID=565878&start=143

From Wireless LAN security hall of shame:

"MAC filtering: This is like handing a security guard a pad of paper with a list of names. Then when someone comes up to the door and wants entry, the security guard looks at the person's name tag and compares it to his list of names and determines whether to open the door or not. Do you see a problem here? All someone needs to do is watch an authorized person go in and forge a name tag with that person's name. The comparison to a wireless LAN here is that the name tag is the MAC address. The MAC address is just a 12 digit long HEX number that can be viewed in clear text with a sniffer. A sniffer to a hacker is like a hammer to a carpenter except the sniffer is free. Once the MAC address is seen in the clear, it takes about 10 seconds to cut-paste a legitimate MAC address in to the wireless Ethernet adapter settings and the whole scheme is defeated. MAC filtering is absolutely worthless since it is one of the easiest schemes to attack. The shocking thing is that so many large organizations still waste the time to implement these things. The bottom line is, MAC filtering takes the most effort to manage with zero ROI (return on investment) in terms of security gain."

So I wonder if this[0] was just a run-of-the-mill dare where nobody really cares if you do it or not, or a double-dog dare, or the greatly feared TRIPLE-dog dare? Especially since "We made it way harder for guys to do exploits" [1]

[0] - http://blogs.zdnet.com/Apple/?p=422
[1] - http://www.toptechnews.com/story.xhtml?story_id=49 854

This article is so 2006. :-)

http://blogs.zdnet.com/web2explorer/?p=196 explains the patent back in 2006. No, Morfik didn't copy it. They even hypothetically showed it to Google before GWT was released.

I haven't delved deeper into those things because I *don't need* those things. I'm just your average ordinary user. Well, I'm more than that actually, but I still don't need those things, so Joe Six Pack is almost surely not going to need them either. Which was the entire point.

To a huge chunk of the population, all Vista will end up being is a new face. I'm not bitching about the appearance changes, I'm just pointing out that without those, a ton of users wouldn't even know they weren't using XP any more.

I have to concur with you. The cell phone market has reached a lull in the U.S. in terms of pushing forward with new ideas. I don't see EVDO or EDGE as new ideas, just an extension of an existing idea. The same can be said of almost all of the features of the iPhone itself. (Not withstanding the use of OS-X on an embedded platform: where's my Apple iTablet?)

The biggest thing Jobs and Co. is revolutionizing with the iPhone isn't the phone itself, it is how the consumer purchases services from the service provider. If we recall, Verizon Wireless was offered exclusive rights to sell the iPhone but turn the offer down when Apple required that the iPhone purchaser could not be bound by a contract and that no promotional offers tied to a contract were allowed. VZW, using the age-old telco mantra of "rest of your contract and recurring monthly revenues (RMR) generated by locking in customers" model, was reluctant to take on a new business model. Now that Verizon's largest competitor, AT&T, has taken on the mantle of contractless RMR, there is a potential that the US cell phone market will finally be liberated from the US cell phone service contract.

Separating the sale of a cell phone from the service contract in the US is nothing short of revolutionary: a war VZW has been reluctant to fight and one they will ultimately lose to AT&T

Ok, I just pasted the wrong URL:

http://blogs.zdnet.com/BTL/?p=4747

Regardless of the greenness of Linux, you still need Windows to run it. Sounds ungreen to me.

Speaking of standards:

* "Microsoft breaks with standards effort" 03-25-2003
* "Microsoft quits W3C standardisation panel" 03/24/2003

How about a free and open standard in gaming?
* "Microsoft DirectX killing innovation" 03-27-2003

For instance, here's a comparison of Linux and Windows boot times; it shows that in all but ONE of the tests (Windows with antivirus software installed using 96MBs of RAM) Windows trounces OpenSUSE and Linspire in boot times.

That chart compares two of the most bloated distros and is nearly a year and a half old. I use Kubuntu (admittedly not the most streamlined distro around), and I've timed boots at 45 seconds. A slackware or gentoo install could put that to shame. My Windows install, having turned off any unnecessary startup options, takes about 2 minutes to a usable desktop - a significant improvement from the 5 minutes it took before tweaking the startup options (something the average user wouldn't know how to do).

But honestly, boot time is the last thing I concern myself with so long as I can hibernate and suspend. On either OS, I reboot maybe once a week, the rest of the time is hibernate and suspend.

I've never seen this happen. Reapeating this FUD does not convince me it is true.

"FUD" refers to something that is untrue. What you mean is "inconvenient truth". For instance, here's a comparison of Linux and Windows boot times; it shows that in all but ONE of the tests (Windows with antivirus software installed using 96MBs of RAM) Windows trounces OpenSUSE and Linspire in boot times.

You've got your head in the sand. What's wrong with just holding up your hands and saying "Yes, Linux boot times are shit, but we're working on it"? There's far less shame in that than in just making shit up.

But it is doing what the customer wants

It is doing what the customer (US Government) wants, but not what the users (scientists, analysts, etc. who need specialized programs) want or need.

You're trying so hard to turn this around and make it about Microsoft but they have little to do with it.

MS has little (as far as has been shown so far) to do with the policy itself, but once the policy is implemented they have full control over the systems and what software can and cannot run on it. This mandate states that "No Vista application will be able to be sold to federal agencies if the application does not run on the secure version of Vista." Now this could mean that as long as you can click through the "This isn't a Windows Certified program" (or whatever the error is) and it still works that it will be allowed. Or it could, more likely, mean that all software that the government runs needs Microsoft to certify it. If that doesn't give MS a lot of (imo unnecessary) power, I don't know what does. Not only that, but MS will make a ton of cash, not just from the Vista boxes, but from the thousands of government contractors with millions in government money that will need to get their software certified.

Oh please, don't act like open source doesn't exist in Win32.

This relates to my last point, how much open source software is MS certified? Also, how many open source projects can afford to get certified?

<tinFoilHat>Finally, what I see in this is a move to stop the Open Document movement that many state governments are moving towards. What better way to cut it off than to talk the federal government into adopting a software infrastructure that is largely incompatible.</tinFoilHat>

Is this the same guy who doesn't know Gerbils from Goebbels?

This all sounds a little fantastic to be true. Most folks at Apple I know don't have time for an agenda. And speaking of agendas, George Ou's definitely got a hard-on for Apple.

SuSE was a privately-held company before the Novell purchase. Novell bought SuSE for $210 million in cash.

OMG! Whatever is Linux to Do?!

Linux can't run without Windows...

To read some people here, though, you'd think that we were fighting a constant, losing battle to get the truth out past the MS shills in the press.

It's mostly a matter of ignorance perpetuated by M$'s $1 billion/month marketing and legal budget. Take this story about M$ threats to Dell over Linux in 2002, for example. Despite reading the emails, the author publishes the M$ party line, "we didn't take any retaliatory action against Dell. In fact, we very clearly increased our investment with Dell." That's not just wrong, it misses the meat of the story as I did myself. The most important admission of the M$ email tread was that one of M$'s own executives thought it was in Dell's best interest to adopt Linux. That email tread has been put into the memory hole along with the rest of the case, though I imagine Dell took note. The combination of feeding reporters BS, shiny feel good advertising, paying people to BS Wikipedia and other forums and removing evidence of their wrong doing is very powerful. Most people have a favorable view of M$ which is demonstrably wrong.

It doesn't look like a joke. Here it is in context. Inconceivable!

Gem from a comments list attached to this article:

You are kidding arent you ?

Are you saying that this linux can run on a computer without windows underneath it, at all ? As in, without a boot disk, without any drivers, and without any services ?

That sounds preposterous to me.

If it were true (and I doubt it), then companies would be selling computers without a windows. This clearly is not happening, so there must be some error in your calculations. I hope you realise that windows is more than just Office ? Its a whole system that runs the computer from start to finish, and that is a very difficult thing to acheive. A lot of people dont realise this.

Microsoft just spent $9 billion and many years to create Vista, so it does not sound reasonable that some new alternative could just snap into existence overnight like that. It would take billions of dollars and a massive effort to achieve. IBM tried, and spent a huge amount of money developing OS/2 but could never keep up with Windows. Apple tried to create their own system for years, but finally gave up recently and moved to Intel and Microsoft.

Its just not possible that a freeware like the Linux could be extended to the point where it runs the entire computer fron start to finish, without using some of the more critical parts of windows. Not possible.

I think you need to re-examine your assumptions.

So, apparently, like man-caused-global-warming, the discussion about Linux is closed.

http://blogs.zdnet.com/open-source/?p=946
http://www.fourm.info/Politics/Politics_Item.2005- 01-10.2353
http://athens.indymedia.org/front.php3?lang=en&art icle_id=657314
and, of course,
http://www.theregister.co.uk/2000/07/31/ms_ballmer _linux_is_communism/

For more links, try:
http://www.google.com/search?hl=en&q=Microsoft+Lin ux+communist&btnG=Google+Search

Because they will be so useful when broadcasting goes all-digital. Feds unveil digital-TV subsidy details, HD Radio rising

The taxpayers will own your TV set in 2009 if you are still watching OTA Broadcast.

Yay for the continued fleecing of Americans over this shift all of which benefits the coffers of the government when they resell the spectrum for billions.

Top of the page. It's a small PDF, and the patents are near the back. I'll leave it up to the rest of you to find and read (and understand) the patents yourself.

Well, when MicroSoft announced that they're about to enter the console business they also noted that they won't make a profit on the first generation and that they knew it and that this was okay since their goal was to get into the peoples' living rooms. And I think for Sony, it's really important for them to push Blueray with the PS3, if that ship sinks like Betamax it'll really hurt.

A few links:

• Forbes: Xbox lost Microsoft $4 billion (and counting)
• Microsoft's Red-Ink Game (about XBox360)
• Is Sony eating hundreds of dollars on each PS3?

A new kind of flash was developed last year that had much faster read/write (closer to RAM) and didn't deteriorate. I suspect that kind is what these will use. (Unfortunately I don't remember the name...)

The answer is: Phase-change Random Access Memory (PRAM); also know to the marketing types as "Perfect RAM".

http://blogs.zdnet.com/hardware/?p=93

Hope it helps.

I've never heard of the alpha releases of Chicago. I had heard of some "demos" that were shown, but never that anyone actually got their hot little hands on Chicago code.

You might like this as well: Chicago, Cairo, Longhorn, Vista, it's kind of interesting :)

Consider for a moment the debit card machines that were emplaced at Office Max. Using your criterion as a checklist, you would think debit card machines would be very secure. But they're not secure for reasons having nothing to do with your checklist.

The fact is Diebold branded the voting machines as Diebold machines so they would sell more voting machines. The implied sales pitch was "we make ATMs which you trust so you know you can trust our voting machines." Now that we don't trust their voting machines, the sales pitch is working against their original product which is why they're trying to distance the two products.

The key point is that poorly designed security products are going to be breached. If Diebold couldn't figure out how to design a secure voting architecture, then it's not at all clear they can design a secure ATM architecture.

If it's not a threat then why is Microsoft 'partnerning' with Novell to get SLED in the door at Wal-mart, in the process giving Linspire the big heave-ho.

'By dropping software from Microsoft and avoiding "Intel inside," retailer Wal-Mart Stores is offering a $199 computer it says is a hot seller on its Web site', Dec 2002

Microsoft and Novell Alliance Embraced by Wal-Mart, Jan. 22, 2007

'MS won't care if everybody uses the ODF standard, because at the end of the day, just like with Windows, people will continue buying their software in large numbers because'

How do people get to choose their software when the OEM contract with Microsoft prevents them from selling any other OS, else they are penalized with higher prices. The last time DELL tried to get into the LInux Desktop market MS moved very quickly to shut it down.

'A PC dealer in Europe has begun selling Dell desktop computers equipped with Linux, but Dell has distanced itself from the announcement, saying that the systems were customized by the dealer, and that it is not the first time a reseller has loaded Linux onto Dell computers'

'Questar claims that in the 24 hours since it began shipping the Linux computers, which can be delivered to 20 countries in Europe, its Web site has received over 200,000 hits'

'The question remains, why devote 150 staff to a business unit, spend millions investing in start-ups, only to can the exercise a few weeks later?'

'Lewis Mettler sums up the story from trial documents'

'Microsoft held a series of meetings with Dell in regard to Linux'

'Dell in June of 2001 informs Microsoft that Dell has canceled their Linux business unit'

was: Not necessarily a "threat" at all (Score:1, Insightful)

ps: I'd prefer to be a 'zealot' rather than a bought and paid for media whore like you ..

What this is going to mean is that Microsoft will toughen up WGA, putting more of a squeeze on legitimate users.

I have nothing to worry about as I'm running Solaris. Despite the fact that people are continuously trying to hack me I have no worries.

ROFL! As if Solaris were immune to bugs.

You might want to check out the Solaris telnet problem. Yeah, it's been fixed. But if you wait eight months to install the update that fix ain't gonna do you any good.

No software of any consequence is bug free.

if one has a big case (front to back) the card pictured is not an issue. One machine I have now has a 7800GTX with the extender on it so it can slide into an extra bracket. It helps keep the card aligned. There are cases out there that can handle these long cards. But changing a case can be a pain.

If you open up a link in the article there are a picture that shows a power connector. The link is here:
http://content.zdnet.com/2346-10741_22-57089-2.htm l
I know zdnet there goes any karma I had....

OK it shows two connectors. One six way plug and one (it looks like anyway) eight way plug. I haven't seen any power connector that has an 8-way plug yet. Granted I am no expert, but the 1000 watt power supplies I have seen do not have this connector yet.

Huh, I thought it would be higher

Well, one could argue that they have the important 50% - the 50% that also has excess cash to spend on advertisers offerings. Look at who's making money and who ain't ...

Also, I question the 50% number. According to zdnet

According to estimates close to 90 percent of Google's visits are search-related, compared to about 10 percent for Yahoo. Google has also proven that search offers better financial rewards, outpacing Yahoo in revenue by close to $3 billion for the first three quarters of 2006.

From: http://news.zdnet.com/2100-9595_22-6162729.html

  NEW YORK--The discussions at a music conference here Tuesday started with an all-around bashing of Apple CEO Steve Jobs before moving to the plethora of issues plaguing the music industry.

Apple, digital rights management (DRM) and the public's willingness to pirate music were discussed, debated and lamented once more by attendees of the Digital Music Forum East conference.

"We're running out of time," Ted Cohen, managing director of music consulting firm TAG Strategic, told the roughly 200 attendees. "We need to get money flowing from consumers and get them used to paying for music again."

But ... nobody has ever paid for music. Think about it. Music has always been freely available, from your church choir music, to your drunk Uncle Henry singing his lungs out at a family party, to your buddies jamming on instruments in your basement.

No, what people have paid for over the years are things like packaging, convenience, better quality (yeah, Britney Spears sucks, but probably sucks less than your Uncle Henry), copyability, and portability.

The RIAA is so freaking stupid. Don't try to monetize the sale of music. Monetize those other things. Make it more convenient, more aesthetic, more copyable and portable, etcetera, to use a paid service than DIY CD-ripping or what have you. People don't buy music. They buy other things which are packaged with music.

In fact, I would not be surprised if we see a chimaera which has PPC and AMD chips on the same MB in less than 3 years.

IBM is already building a supercomputer that uses both Opterons and Cells.

IBM to build Opteron-Cell hybrid supercomputer

Agreed - Nokia are the top mobile phone manufacturer in the US, followed by Motorola and Samsung.
However, I consider Sony Ericsson's "walkman" branded mobiles the most direct competitor to the iphone...
http://blogs.zdnet.com/ITFacts/index.php?p=12419