Slashdot Mirror
Slashback: Dell, 800, Disclosure
Spinning so had they can feel it in Ft. Worth. L-Wave writes: "This Story is running on linux.com. Apparently Dell has written an open letter toLinux users. 'Dell has published an open letter to its Linux customers "clarifying" its position as regards the insurgent OS. Actually, the letter is headed "Clarifying Dell and Linux," but either of these would be a massive task, and we think we know what they meant to say.'"
Please note that all Dell is saying here is that they will load customer-specified software at the factory -- it's probably convenient for some customers, but nothing new for Dell. In the case of software with expensive licenses, it means some simplified paperwork. With Free software, it just means convenience. The letter is therefore rather lukewarm, but at least a lot better than refusing to install software that doesn't include a licensing markup.
Brush up on your polite conversation skills. doublem writes: "This site lists the toll-free numbers of known Spammers, so they can be called, harassed and otherwise vented against for their crimes. Something tells me the ./ crowd will like this sort of thing as evidenced by this recent article. I'd like to add 1-888-288-9043 as the number for the well-known VORTEX SUPPLIES, a collection of jerks who refuse to take me off their mailing lists." I started doing the same a few months ago, but this guy has me beat by miles, even if he doesn't list Miss Cleo's number thanks to Psychic spam that knew I'd react with a call.
Yessir, our team goes into action right after the first fortnight. jeffy124 writes "Microsoft has admitted knowledge of an IE bug a full week before a security firm announced it. Turns out sec firm Online Solutions privately informed MS of the bug Nov. 1, but MS initially said they first heard of it Nov. 9 after Online made the find public the same day. MS claims standard procedure of allowing themselves two weeks in order to make sure someone's not cryin wolf and write a patch. They also claimed that no breaches occured during that wait. MS says that Online acted responsibly in their actions, and "'apologizes for innacurate statements.'"
You mean the lawsuits didn't kill it? Far from certain conpiracy theories advanced after Bleem published their own epitaph ShadeEagle writes: "Here we find out that Sony didn't know about Bleem's death until they were asked about it. Gamespot has more relevant information as to the possible (or impossible) future of Bleem." And another gaming note: mickeyreznor writes "According to this article on CNet, Sega appears to be in good financial shape despite the trouble they've had with the dreamcast. In addition, 60 games are being planned for X-box and PS2 over the next year. Sega's future looks bright, and that can only be a good thing for gamers."
It upsets me personally to see the death of various console emulators. I have a friend who did work on such a project while completeing a Math degree here at the University of Tokyo. This was in 1996/7 if I remember correctly.
;_;
He released some tools such as a disassembler which while of course not for emulations, Sony did not like so much. Sony sent him an unfriendly letter and unfortunately my friend removed his tools from public access
It is especially bad since he was simply trying to assist the hobbyist PlayStation programmer. It is too bad Sony does not realize their loss.
R. Suzuka
Also, he talks about some 800 lines being on a flat monthly rate. Don't let that stop you from calling up and wasting their time anyway (or calling and setting the phone down for the 3-minute message). When 10,000 bored Slashdot readers call these guys and rack up the minutes, believe me, the phone company will notice. Enough calls might be enough to make the telco selling a flat rate line think twice about renewing a contract.
-Legion
Autodialing laws by state.
....
If you are so inclined
---
http://slashdot.org/moderation.shtml
got to http://www.goto.com and do a search for "bulk email" each link you click will cost the spam companys up to several dollars per click It's a great way to fight back it would be nice to /. their bank account
http://Lenny.com
4 great justice!
The importance is not that they load the OS, it's that they are treating Linux the same as Microsoft. PHB's like to feel secure, and knowing that Dell, a major player in the OEM server / PC market, is offering Linux as a platform they stand behind just like Netware and NT/2000 - makes them feel secure. It all comes down to big management catch words like "Enterprise" "Scalable" and maybe even a little "TCO."
The fight for Linux is not a fight of technical profecciency, that is already achieved, it is a fight of making managers at 35,000 feet feel comfotable with it. (IMO)
Jesse Wolfe Sr. Manager Systems Integration
Dell has been losing face for a while IMHO.
First they jumped on the almighty Linux bandwagon a few years ago, claimed open source this and that, but in reality they never did anything to help the cause.
In fact, when they were selling linux on machines you could configure two exact systems - one with linux and one with windows, and the windows box was always around $200 less than the same linux box! It makes economic sense to buy the window box then wipe the drive and install your own linux. No wonder they had no demand.
Dell does not give a sh*t about their customers, their employees, or GNU/Linux.
"We are obviously not going to
respond instantly--we have to sieve the wheat from the chaff to determine how reliable the vulnerability warning is," said Neil Laver, Windows product marketing manager for Microsoft. "Until we can investigate the issue, we are not going to issue a bulletin, as that would create a crying wolf situation."
can anyone argue with this?
I can. It doesn't take a week to recreate an exploit like this and say, "OH shit!"
br>Microsoft is a large enough company to have someone on the job whose exclusive responsibility is to read incoming exploit reports and IMMEDIATELY test the described method. Immediately after that (ten minutes after the report arrived, if they have a bunch of configured machines immediately available - again, MS is big enough to afford this) they can say, "Report verified. Issue a bulletin and get the engineers on the job fixing that bug."
In the case of a major (or any) exploit, there is no excuse for a large outfit like MS to require more than an hour or two to verify that a problem exists. Actually fixing it will probably take longer, but the fact that the expolit exists should be immediately published so those running the affected software can decide if they want to take their servers off-line or take some kind of self-protective action.
If you're a zombie and you know it, bite your friend!
Nice Try Dell,
... This letter is a reaction to the bad karma that they got from "he Register Cable Select Debacle"
A buddy of mine bought 5 rackmount servers with cabinet and a kit to convert his company's current server to a rackmount.
We had to call Dell multiple times and sit through at least half a dozen nested menu options (the dead end ones that force you to hang up suck) trying to get the bundled Red Hat deal with them. Half of the reps didn't even know they offered linux, this is from the server people mind you. And then, come to find, the linux options are just as expensive as the windows options, if not more.
"No, I want Linux, I don't want you to email me information about win2k advanced server." Say that a few dozen times. sigh.
So, the poor wretch bought the Red Hat 7.1 package "specialy certified to run on Dell hardware" for $150.
When the servers arrrives he gets the cardboad box for RH7.1 (no cover, so you can't even put it on a shelf to look cool), and NO STICKERS. Oh yeah, a photocopied sheet of instructions for installing Redhat.
Dell buys Red Hat, and then jacks up the price, THEY COULD HAVE AT LEAST GIVEN US THE DAMN REDHAT STICKERS!!
Don't let any of these OEMs try to kiss up and say that they support linux, and they are doing everything they can to help the community blah blah
So far, IBM is the only large company that is doing a damn to help Linux. At least HP was smart enough to say "We don't know shit about Linux or their community, let's hire Bruce Perens...."
All these phone numbers are taken from spam mailings. The whole reason these numbers were put in the emails was because spammers WANT people to call them. Most of these numbers are just automated machines with menus you have to endlessly punch through before you can get to a real person. It's just like trying to reply to a spam mailing itself asking to be taken off the mailing list.
Outdoor digital photography, mostly in New Engl
I never understand why companies would discourage university students reverse engineering and learning about there product. If anything, Sony should make technical documents more public so that people could learn more about there systems and be more inclined to program on Sony's platform than a competitors.
only loseing $100 dollars a box.
It would be to freely release Bleem source code and contribute it to the public, or at least one of the many open-source PS emulation projects, since none of the open-source ones out there are in any sort of viable state now, for the most part.
George W. Bush
President, United States of America
My understanding is that spammers usually pre-pay for their 1-800 lines with a flat fee. That way they can get any number of calls for a finite period of time and not worry about anti-spammers ringing them constantly and driving up their bill. Any substantiation/refutation of this?
Everyone here is all upset because the X-Box runs Windows. Well, guess what. So did the much-beloved Dreamcast. When the Dreamcast came out, I didn't hear anyone moaning and groaning about Microsoft trying to take over the gaming world. What's different this time? So Microsoft is "making" the X-box: so what. That's just outsourced hardware. The Dreamcast ran WinCE and it eventually ran Linux, we can expect the same from the X-box, as well as the upcoming NetBSD port.
Operating system is hardly the most important consideration with regard to the X-Box. All consoles are sold at a loss, so if Microsoft decides to start selling outsourced hardware at a loss that runs Linux, that's pretty much a victory for us right there.
That said I think it's obvious to everyone in the industry that the X-Box is by far and away the most technically advanced console ever built. With nearly five times the polygon fill rate of a PS2 and 5 times the MHz of comparable Sega systems, this thing puts the wimpy PowerMac-wannabe "GameCube" to shame.
Don't let your prejudices blind you. The X-Box is an impressive piece of hardware - once everyone starts using them as Linux web servers you'll stop bitching.
If guns kill people, then CmdrTaco's keyboard misspells words.
There are a couple scripts and other ideas here
http://www.lenny.com/spam/
http://Lenny.com
4 great justice!
Nov. 20: Don't mess with RedHat Package Manager files
RedHat Package Manager (RPM) files are compiled and prepackaged programs which can be downloaded and installed on Linux systems. It is possible corrupt the data in an RPM file so code is executed on a Linux system when the RPM is queried for version information. This is a difficult thing to do since the memory location of the hacker shellcode would need to be known. However, It's possible so don't mess with RPM files from untrusted sources.
I'd suspect Taco is moonlighting over there if it weren't for the correct use of the apostrophe in "It's."
What I'm listening to now on Pandora...
getting something like this done in 2 weeks isn't bad for a large corporation, and considering how meeting centric MS is, 2 weeks is pretty damn fast.
The Kruger Dunning explains most post on
What a brilliant idea - props to you (or whatever they say, these days, these young folk :-)
Question, though - can a spammer really afford to pay nearly $6 per *clickthrough*??
getting something like this done in 2 weeks isn't bad for a large corporation
But THIS is security! To take a real-world example, if you break into a bank at night and start carrying out the cash, the security guards don't have to stop and ask their supervisor to wait for the next board meeting (in three weeks) to obtain permission to apprehend the criminals.
There's no room for bureaucratic bullshit in matters of security. You set a policy that affords the maximum protection to your customers, and follow that. No ad-hoc decision-making required. If there's a possible exploit, test it NOW and report NOW and release an advisory RIGHT NOW. Period. Just like apprehending the criminals on the way out of the bank. "Halt! You're under arrest!"
If you're a zombie and you know it, bite your friend!
By jacking up sales, you actually make it cheaper for them to make them, so eventually they make money on the XBox - economies of scale. Its expensive at the start, but in the end they make money, even off the box, once they get production ramped up and going hard. So you are really just helping them along to making money on it.
"Of all days, the day on which one has not laughed is the most surely the one wasted." -Sebastian Roch Nicol
If you have a newer dell machine that has Windows (tm) on it, check the uptime of the os (seems to be only machines that were built before may of 2001). If you are unsure on how to do this, just go to download.com, search for windows uptime, and download the Windows Uptime 1.3.3, its a tiny download, but you will be able to check this quickly... The problem with these machines is that they are not reporting a correct uptime of windows. I am not sure if this happens with other os's, my job only lets me see these that have Windows on them.. I saw a dell machine last week, it was a week old, but reported an uptime of 40 days. Ive seen another dell machine that said it had a 6 hour uptime on a fresh boot, and an hour later it says 30min uptime.
Dell isn't taking any responsibility in this.. I am really not too sure if it is Dell's fault, but it is only happening on new Dell machines. I have had 4 people call them up, and ask them why their machine does this, and they get one of 2 answers:
1 - We have never heard of this problem before, but don't worry about it
or
2 - This is a Windows problem, call Microsoft
Soo.. if you do have one of these newer dell machines, try looking at the uptime for windows. Heck, if it has linux on it, check it too. I know of a few games that will base their internal clock off of the Windows Uptime (dont ask me why, im really not too sure why they use windows uptime, Links 2001 is an example of a game that will use the uptime for the internal clock.) If you have a machine with this problem, document it and send the info to dell. They do have responsibility over the OS that ships with a new machine, but they are just pawning it off and screwing customers over.
Well there is my rant, I used to like dell quite a bit but lately their support is just utter crap. I am really suprised that if someone spends 3 grand on a machine, and then gets that from dell when asked about the problem, I would take the machine back myself..
If anyone knows/has a fix, or knows why this might be happening, please reply back, im kinda dying to know you could say =)
Zeno
So now all I need to do is to get busy with wget | sed, make some chat scripts and have my computer dial these guys when I'm not doing anything.
:(
Of course, I'll have to modify the init string so that it doesn't try to negotiate a modem connection, otherwise it will fail too many times and the numbers will become BLACKLISTED.
Oh - and I need to move to the US since it won't be free otherwise
-- Mike
As for the disassembler question, if it in fact simply dumped MIPS instructions of hobbyists programs there would be no way for Sony to pursue legal action because the MIPS/mipsel instruction set is open. However, if the tool could be used to reverse-engineer games written for the console, Sony could have grounds for a lawsuit.
A solution to the problem with music today
In the case of a major (or any) exploit, there is no excuse for a large outfit like MS to require more than an hour or two to verify that a problem exists.
Wow! you really have no idea how software development and engineering departments work. With an engineering department that can switch gears and start projects as fast as the one you described we would be able to get a new version of windows ever 2 months.
I will explain to you how most large bug reporting/engineering systems work. First a secretary or intern will be assigned to read the bug mail and sort out the legitimate problems from the lunatics writing in that your product just SUCKS.
If it is a legitimate bug report and it includes all the information necessary to reproduce it then it gets entered in the bug tracking/administration system. An email or memo will be sent to the manager of the division that handles testing.
The manager will assign the bug to a tester who will try to reproduce it. That is after he has worked on all the other items in his queue that have a higher priority. Once he has reproduced it he identifys what component causes the problem (or guesses). And add adds the item as a reproduced bug to the bug tracking system.
The manager in charge of the division that handles that system or component will get the notice and eventually get around (depending on priority) to assigning the bug to an engineer.
The engineer will then start working on the bug, but only after he has already completed what he was working on at the time, and cleared any higher priority items out of his queue as well.
It would take at least a day to go through any one of these steps. And even more time depending on how busy people are and what priority rating the bug gets. Plus in larger companies these things actually go through more steps such as priority assignment meetings and impact analysis.
In short your expenctations are insane. When you are dealing with a company of any size about 30 employees you have to use a system to kepp all of them working, or you are loosing money. That means you need to manage tasks and verify bugs before assigning them to engineers. And you don't have 30 engineers just sitting in the back room waiting to work on whatever you give them. They are probably already working on fixing another terrible exploit. The resources have to be allocated as you go based on what you see the threat as.
Anyway i hope this gives you a little more respect for the engineers who actually do this.
Regards,
----- 70% of all statistics are completely made up.
I'm a kernel developer at the world's largest computer company. (No, not MS.) If a customer has a showstopper bug, that thing flies through tech support and lands on my desk. I fix it NOW. Overtime? Holiday? Too freakin' bad. Now means NOW. If one of my customers' big retail backend databases crashes on black Friday due to my networking code, I won't be sleeping off the Thanksgiving triptophan. I'll be at work, hacking. The only way it might take a while is if it isn't easily traceable to a particular component.
In the case of a well-documented application security hole, there's no excuse for not passing it to the owner immediately.
As "Benchmark Print Supply", Khuri nearly went to jail for spewing out of his spamhole, and is really under a court order that prohibits him from spamming. He's just hoping that nobody would notice that it's really him.
Well, at least it's not splashback. I hate when that happens. I mean, unless the bowl was flushed with alcohol, you never know what you might catch from that. Therefore, I propose the government mandate that all public toilets for #2 use should have at least a 6 foot drop to the water line. Sure some little kid might fall in and drown, but at least I won't have to deal with splashback.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
That's nice. Now if only they let consumers have the option of not having to have one of those damned crappy Conexant winmodems. It wouldn't surprise me one bit if those machines with Linux installed still have said winmodems in them...
>Anyway i hope this gives you a little more respect for the engineers who actually do this.
:-)
I'm not the original poster, but I still agree with him. And I have respect for the engineers, as you'll soon see.
>The manager will assign the bug to a tester who will try to reproduce it. That is after he has worked on all the other items in his queue that have a higher priority.
There's the weak link right there. Get rid of the manager. If it is a security bug send it directly to the people who handle it.
My lack of respect is for the manager that's so lazy they can't take 1 minute out of their lunch break to email the security bug of the day. And if you are getting more than 1 security bug a day from "tested" software I'd suggest you fire yourself for hiring incompetent engineers and testers!
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
First and foremost, I would like to say that it was good when Dell offered Linux on their machines, I got my Inspiron 8000 and GX1 for about $200-500 less than a windows version.
-BUT-
The installations REALLY sucked. I had to go back and re-install Linux on both. On top of that, I also needed to dload the newest Linux (at the time, Dells shipped w/ RH7.0, when Red Hat had been shipping 7.1 for a long time). The problems ranged from not being able to have the CD drive toast CD's, or even read stuff to having the computer randomly lock up. All problems were fixed upon the re-installation, but it was a (minor) inconvience. I think that all Dell did was make one install image and then use them for all the machines, from laptop to desktop. I seemed to have fewer problems on the OptiPlex...Oh well
Just letting the public know about how *much* Dell cares about Linux. Next time I want a computer, I'll just buy the parts. (I would have done that, but these damned grants don't let you do that, now do they?) If people are really interested in getting a quality linux box, they should go to Penguin Computing at . My buddy just got a machine from them, and he tells me that they are the Alienware of the linux world.
think how easily a crapflood of spurious security vulnerability reports could erode MS' product reputation
Perhaps. However, in this case, the people who found the vulnerability provided Microsoft with working exploit code so it wouldn't have taken a single Microsoft employee more than a few hours at most to see that the exploit worked and that they had a problem.
Things you think are in the Constitution, but are not.
This doesn't answer my big question - can I buy a Dell (or some other common) laptop without any operating system?
While having a Linux preinstalled may be good for some people, I don't really care. I'd probably re-install my own fav distro anyhow (especially as some manufacturers preinstall Caldera or something equally exotic/nonstandard).
Most essentially, I absolutely refuse to pay for any Microsoft software, especially if I wouldn't even use it.
Is that that was his 43rd post - I wonder what he has cooking for his next post?
:-)
Jim in Tokyo
-- My Weblog.
The proposal: make a central database of 800 numbers,e-mail addresses and websites advertised through spam (rather big I figure). Then, anytime you get annoyed (about 10 times per day probably) by a spammer, first report the contact details and then run a script that randomly grabs say 100 email addresses from the database and sends loads of crap to them. Do the same with 800 numbers and website forms. If we get 10000 angry sysadmins sending loads of random crap or just angry letters to poor souls who decided to advertise through spam we may quickly make them get some clue and stop annoying us.
Of course, reasonable filters are mandatory - e.g. an 800 number gets added to the database only after 10 people from different subnets report it.
------------------------ Optimists learn English; pessimists learn Chinese; realists learn Kalashnikov
I'll explain this process in terms of the popular Bugzilla tracking system.
First a secretary or intern will be assigned to read the bug mail and sort out the legitimate problems from the lunatics writing in that your product just SUCKS.
The user enters the bug into the bug tracking system, and the system marks it UNCONFIRMED. If it is a legitimate bug report and it includes all the information necessary to reproduce it then it gets entered in the bug tracking/administration system. An email or memo will be sent to the manager of the division that handles testing.
And the bug becomes NEW.
The manager will assign the bug to a tester who will try to reproduce it. That is after he has worked on all the other items in his queue that have a higher priority.
Bugathon. Also note that this step may be less necessary if an experienced user attaches a reproducible test case to the bug report.
Once he has reproduced it he identifys what component causes the problem (or guesses). And add adds the item as a reproduced bug to the bug tracking system.
In the process, he adds keywords to the 'summary' and 'keywords' fields and more description such as a stack trace. He also "triages" the bug, marking it as high, medium, or low priority.
The manager in charge of the division that handles that system or component will get the notice and eventually get around (depending on priority) to assigning the bug to an engineer. The engineer will then start working on the bug
ASSIGNED.
but only after he has already completed what he was working on at the time, and cleared any higher priority items out of his queue as well.
Bugzilla sometimes calls its queues "plates" or "radars".
Once a patch gets r= and sr= (two types of approval from two different groups of code reviewers), somebody with write access to the CVS tree checks it in and marks the issue RESOLVED.
Sound more familiar? In other words, the primary difference between Microsoft's bug tracking system and Bugzilla is that Bugzilla work happens in a public forum as opposed to a private forum.
Will I retire or break 10K?
Of course they don't care about Linux. Dell is a public company and companies only care about making money. Period. It's their obligation to their stockholders. You're just being naive if you think they would promote anything out of the goodness of their heart or because they think it's the "right thing" to do.
Money spent on good works comes back in the form of increased value of the corporate brand. This is the "goodwill" jeffphil speaks of in a previous comment. What PR exists better than giving customers what they want?
you're just plain silly if you want to get angry at Dell or any other company for that matter.
But if you get upset publicly and throw up a well-written anti-Dell web page that some widely read weblog like Kuro5hin or Slashdot picks up, you may hurt Dell's brand value and thus its bottom line.
Will I retire or break 10K?
OK, I buy my parts directly from a wharehouse that has the SAME exact parts. (Often they are in Dell packaging.) I was introduced to this place by a friend. He works full time, selling parts he purchases there on Ebay, and to local computer stores. So, there it's backed up.
BTW - My website does suck. For that I will appologize.
Um, this is my sig.
Anyone else notice that L-wave's submission takes a sentence directly from The Register's John Lettice? Look at http://www.theregister.co.uk/content/4/22928.html.
-Paul Komarek
But even if you're simplistic enough to argue that the laws of economics dictate that The Best Product Shall Prevail, that's not a "law" you are obligated to obey! Expressing your opinion is a fundamental right, even if you do it with your wallet. That's democracy, baby.
The 800 (or more generally, toll-free) point will get your number regardless of your caller ID blocking status. This has to do with how the numbers are billed, and the billing data has to be available.
If you want to obscure your ID, call from a payphone, or use a third party's phone.
What part of "gestalt" don't you understand?