Slashback: Quiesence, Jazz, RAND

Welcome to Slashback for 20011018 -- read below for an update on Code Red (is Red Dead?), RAND patents in Web standards (some semi-good news on that front), the sad death of some MIDI software, and an upgrade for Thailand.

Please write your elected W3C representative. haplo21112 writes "The W3C has posted a next-steps comment on the mailing list for the Patent Policy Frame Work proposal.

It announces among other things that two Open Source People have been added to the working group as Invited experts, Eben Moglen (General Counsel, Free Software Foundation) and Bruce Perens (Co-Founder of the Open Source Initiative). They have also announced a home page for the Working Group at: http://www.w3.org/2001/ppwg/

Especially interesting is the Second Objection noted on the page from IBM, where basically they are revealed as one of the drivers of the proposal. They grumble about RF and pretty much say they would vastly prefer RAND."

You'd like to think so, eh? ColaMan writes: "Is CodeRed finally dead? I've had a counter on my webserver (yay apache!) that tracks attempts, but since the start of the month only 1 lone attempt has been logged on our permanent IP dialup connection (and that was just overnight). This compares to 2490 attempts for August and 931 for September. Nimda still seems to be plodding along though - I've had 159 unique ip's so far this month and 466 for September. Knowing that my IP address is in some bandwidth-forsaken backwater of the internet, I was wondering how things were going CodeRed-wise in the Real Internet?"

I forget -- does the M stand for "Microsoft," or "Macintosh"? An Anonymous Coward writes: "Remember this story from last Tuesday asking about audio applications on linux? Today the Jazz++ mailinglist declared jazz++ dead (find the message here). While not the perfect midi sequencer, jazz++ is robust and GPL'd. Since jazz++ only appeared twice in the postings (each moderated at +1 ...) related to the earlier story, it would seem this fine product has low visibility among the /. crowd. The only viable GNU/Linux midi solution died the same week ./ had a call for audio solutions on Linux. Gotta love irony..."

From Bundesrat to Bangkok Germany may be considering it, but Thailand is doing them one better. TheMMaster writes "According to this article on newsbytes, the Thai government will switch to open-source software, linux on the desktop, StarOffice. This is a nice example of OSS, and probably why a lot of people contribute, to help people (OK and for fun)"

As usual, the actual developers float high above the flames on their behalf. Yep, KDE is 5 years old -- and fm6 writes: "A nice contrast to the usual GNOME-versus-KDE flamage: the users of news.gnome.org wish KDE a happy 5th birthday." Remember, the flame wars you see about these two projects have little to do with the fact that both have already created killer desktops, and are continuing to do so faster than human beings should be allowed to travel.

Comments

jazz++ dead?

[smunt]

So why is this rubust and successfull, gpl'ed program dead? Just because it won't link against new libraries doesn't make it dead.

And it's ofcourse GPL, which means that you can reuse parts of it in other software.

Code Red

[ogesII]

Over the last 3 days my site has been receiving one Code Red hit per day. The interesting this is that the original 'N' padding is being used again similar to CR1. Prior to this I hadn't had a hit since Sep. 30th.

Nimda is still going like made but at a much reduced pace. 8 unique hosts 423 hits today. I sure wish it would give up after the first GET and it realizes I'm not running IIS. I'm about to start dynamically updating my IPTables

Re:Code Red

[jsveiga]

Code Red II killed (sterilized?) himself on September 30.

I've submitted an "ask Slashdot" by October 4 asking everybody to check their logs, but I was rejected.

Because Code Red I doesn't have the suicide code, it may show up again (CR2 had displaced it, but now it may come back. This is why you get NNNNNN again).

Although it stopped spawning, it does leave the backdoor installed. Unfortunately it does not "announce" it anymore.

Just when I was having fun... I hope CR1 gets back in the top parade.

Happy B-Day KDE!

[coupland]

I've gotta wish KDE a happy birthday -- it was my first Linux GUI and arguably my favourite. The "winds of change" have prompted me to switch to GNOME and while I have to admit I adore Ximian/GNOME I'll always have a soft spot in my heart for KDE. Isn't it great to see how alive and well competition in the Linux scene is? Thank God for KDE (and GNOME) because they've made each other a tonne better simply by their existence.

Re:Happy B-Day KDE!

[coupland]

> Don't forget cooperation.

I couldn't agree more. Working in the M$ world has gotten me accustomed to assuming that only competition can better a product. Thx for pointing out there's more to success than that...

my nimda stats

[cr@ckwhore]

I've got a small apache server running on the "dirty front lines" of the internet... right in the middle of the 2nd largest cable network in the US, where every tom, dick and harry goes nuts with p2p, porn, spam, and of course, IIS without having a clue about anything significant.

Anyway, my current NIMDA stats: 55,522 hits in the access_log, and they've only slowed down noticeably within the past week. 196 so far today, and today isn't over yet.

I've successfully been able to shut down some of these machines remotely by randomly picking IPs from the log, checking for either open SMB shares or win2k remote administration. With either of those, especially since these sysops are usually the height of insecurity, its been quite easy to contribute my part of NIMDA disinfection.

All I can say is "thank you"

[trilucid]

to those on the Gnome side who were gracious enough to be this polite regarding KDE's birthday :). We've all seen a lot of battle damage on both "sides of the fence" when it comes to the desktop wars, and I for one am glad to see (maybe just momentary) a truce.

It kinda makes one wonder, though, how much energy and how many good ideas are wasted by all the lobbing of insults in the general community. This is a fact of life when it comes to closed-source applications apparently, but in the world of open source it's just dumb. Elitism and smugness hinder progress.

Now, if only the database trolls could take a lesson on this one... sometimes the wars between the various open source factions (mySQL, PostgreSQL, etc) can be worse than anything seen between KDE/Gnome (at least in my opinion).

As to what's better, all I can say is that I use *both* Gnome and KDE (well, KDE a bit more than Gnome these days), and *both* mySQL and PostgreSQL personally (more mySQL than the others, blah blah).

It's all progress, folks. Let's keep it that way :).

die MIDI die

[DNS-and-BIND]

I can't be too sad that a MIDI program died...I hate MIDI music. I especially hate web pages that play .mid files...it's one of my most-hated web designer screwups, right up there along with the tag and directing people whose User-Agent does not match "MSIE" to a "sorry, use Microsoft" error page.

One of my Chinese co-workers has a collection of MIDI tunes he likes to play from time to time. I'm telling you, you haven't lived until you've listened to "Raindrops Keep Fallin' On Your Head" as a MIDI tune, 20 times in the course of one day.

Re:die MIDI die

[Freedryk]

Some of us actually use midi to make interesting music (if you consider techno to be interesting music), since it is the primary way to control hardware synthesizers and samplers. The lack of good midi/audio support in linux is actually the main reason I don't have linux on my home computer. If this program is dead, it's just one more reason for me to stay with Windows...

Re:die MIDI die

[AirLace]

The article was referring to MIDI used in the context of an intermediary protocol between music hardware and sequencing software. It's the only open and documented interface for musical information interchange between devices and so should be promoted by the community, before the proprietary formats manage to get a foothold. I sympathise with what you say about MIDI songs being played on computers, but you should recognise that that's not what MIDI is all about.

jazz is not dead, and its not the only or best

[paulbd]

MusE is a more powerful, more appealing, more actively developed MIDI editor and sequencer than Jazz or Jazz++ ever was. And besides, Jazz is not dead. The message is simply one user expressing their concerns, which although they may be realistic, are not definitive.

The 'M'

[sheetsda]

I forget -- does the M stand for "Microsoft," or "Macintosh"?

Maybe I'm misunderstanding this question, but the M in MIDI stands for "Musical". Musical Instrument Digital Interface.

Code Red is dying

[Shoeboy]

We should all keep in mind this simple truth: Code Red is dying.

You don't need to be Kreskin to predict Code Red's future. The hand writing is on the wall: Code Red faces a bleak future. In fact there won't be any future at all for Code Red because Code Red is dying. Things are looking very bad for Code Red. As many of us are already aware, Code Red continues to lose market share. Red ink flows like a river of blood.

Let's keep to the facts and look at the numbers.

Famed Code Red using hacker mafiaboy states that there are 7000 machines that are victims of Code Red. How many users of Nimda are there? Let's see. The number of Code Red versus Nimda posts on Usenet is roughly in ratio of 1 to 4. Therefore there are about 7000*5 = 35000 Nimda users. Code Red on Linux posts on Usenet are about half of the volume of Code Red on Windows posts. Therefore there are about 700 victims of Code Red on Linux. A recent article put Code Red on *BSD at about .008 percent of the virus infection market. Therefore there are (7000/100)*.008 = .56 Code Red on FreeBSD machines. This is the result of one guy working in his spare time to port Code Red and consistent with the number of Code Red on FreeBSD Usenet posts.

Due to the troubles of Sircam, abysmal infection rates and so on, Sircam is getting out of the virus business and becomming a flight simulator. Code Red is still dying and the corpse of Code Red will soon be turned over to another charnel house.

All major surveys show that Code Red has steadily declined in market share. Code Red is very sick and its long term survival prospects are very dim. If Code Red is to survive at all it will be among virus hobbyists, dabblers, and dilettantes. Code Red continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Code Red is dead.

--Shoeboy

Code Red is not dying, it's Self-Terminating

[Cryptimus]

Code Red deliberately self terminates on October 1st 2001.

There's a check inside the code that essentially sends the server into an endless reboot loop if the month is greater than 9 or the year is greater than 2001.

This pretty much ensures you either fix your server or stay offline.

I guess even a worm writer wants to use the 'Net. Building self-termination into a worm seems like an oddly moral thing to do, however closer examination will probably reveal the author was concerned about the worm making the net completely unusable.

And that would never do.

My cable modem lights don't say so...

[hyrdra]

The activity light is still on rock solid, and there's nothing wrong with the modem. No, I don't have any of the worms because I'm using a broadband firewall.

At my last count, I receive around 500 attempts by these worms each day, usually by other cable users. Before I got a firewall, loading up my Apache log file crashed notepad. My favorite past time has become tracerouting the IPs to see what nearby city they're in. I live in Columbus, Ohio and can easily discern those from nearby towns and locations throughout the city (e.g. pos1-2-colswest or pos4-0-dublin).

I then like to load up Telnet and go searching for root.exe on these computers. When dumped into a root cmd, a carefully placed command copies a file from a share on my computer to the other machine. The file, of course, is an MS update patch or lately one of the clean utilities posted around the net. Another command runs the program and when finished the system is reboot and no longer bothers me.

Now there's an idea...fixing worm systems through their own security holes. I even wrote a little script to automatically attempt to 'fix' an attacking system. Don't just bitch when the same IP keeps pounding you...do something about it!! There's plenty of info out there, and you can get most of the info from the attacking HTTP GET strings.