Slashdot Mirror
Microsoft, zlib, and Security Flaws
nakhla writes: "News.com is reporting that Microsoft's use of code from the open-source zlib library has led to possible security problems. The flaws in zlib were reported recently, and apply to several key Microsoft technologies, such as DirectX, Front Page, Install Shield, Office, and Internet Explorer. The article also mentions how this is not Microsoft's first use of open-source code in its software, but does point out that since zlib is not GPL'd they are under no obligation to release the source code to any of their products."
how does this compare with Apple's use of GPL code in Darwin? i mean, is zlib used at a low-level, or is it part of MFC?
* Important Stuff: Please try to keep posts on topic. * Try to reply to other people comments instead of starting new threads. * Read other people's messages before posting your own to avoid simply duplicating what has already been said. * Use a clear subject that describes what your message is about. * Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated.
big HP advert in a box! it's happened!
Where do ya think their tcp/ip stack came from...might be BSD...hmmm
Slashdot, the site where everything's made up and the points don't matter
Any bets on how long before Microsoft issues a press release noting that this is yet another risk of using evil open source and open standards?
I do not deploy Linux. Ever.
the real implications behind. I'll proabbly be flamed for just looking for info, but how does this change anything that we have known about MS software being insecure?
Darn, and I thought they were caught with their pants down.
But to me it still is interesting that a company that is trying to stomp every competitor, and is spreading so much FUD about any sort of free or open software is using it themselves. (We all knew that, I just thought I'd emphasize it again.)
Whoops, considering they advise not even reading open source for risk of integration of the code into their codebase and risking breach of the license.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
No way. M$'s doesn't perform well enough to have come from BSD.
It seems to be not the cae since Windows 2000 - did not they redo the stack for it? Am I right?
<^>_<(ô ô)>_<^>
Wrong. They advise not reading GPL code, not open source code.
That is quite a big difference.
How do we know they never used GPL'ed code anywhere?
since zlib is not GPL'd they are under no obligation to release the source code to any of their products.
Gee, well duh.
'Since Bill Gates office is not within the boundaries of the Cleveland zoo, he doesn't have to pay admission each day to go to work.'
I mean, what does 'obligation to release the source code' have to do with anything? Is this going to be one of those 'flog any non GPL license' discussion threads?
I wonder if anyone is keeping a running tally since the security initiative started???
Here is another bug with the MicroSoft SQL server. They've got overflows in their stored procedures. No fix, but you can delete the files if you can live without them....
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Time for today'$ round of +5 Funny Micro$oft ba$hing (I u$e the $ in$tead of a 's' to $ymbolize that they are an axi$ of evil computing, no one has thought of this before me. HAHA!)
Hammer of Truth
I thought the bug was caused by glibc, which made the bug worthless on non-glibc systems.
Has anyone ever noticed that Amazon dotcom lists (A)nal (C)unt as just plain vanilla AC?
What would AC/DC mean then? (A)nal (C)unt or (D)anal (C)unt?
You thought I was going to say (D)ick (C)unt, huh? The reason I came up with Danal can be attributed to a cigarette brand. Have you guys ever seen the brand, Doral? I know it ryjmes with Coral, but I always pronounces it Oral plus a D. Hence, Danal, the only suppository cigarette.
Share the idea with a really drunk buddy, and he'll pee himself.
So now I have 50 karma, might as well turn troll...
"Communism is like having one [local] phone company " - Lenny Bruce
So in other words, Microsoft software sucks because of Open Source. Did anyone NOT see this coming?
Of course, having everything derive code from the same source is a risk; isn't this part of the reason the ping of death was so much of an issue?
You'd be right :), starting with Win2k, and in WinXP, they're using basically Unix TCP/IP sockets. Must admit that it does work much better than Win9x for network connectivity.
...if the government hadn't worked so hard to limit Microsoft's ability to innovate.
InstallShield is written and published by a company named InstallShield, and has been for many years. It is not a "Microsoft technology", but rather a technology that has support for creating software installation routines for Windows, amongst other OSes.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
$7 according to one share. That's only $6 more than K-MART!! Haha hahahah. OSS is NOT a valid business model. http://goatse.cx
that they should post this infoworld article this morning. and I quote
Just for some balance, Linux also has its problems. If you actually compare them, the amount of vulnerabilities found in Windows and all Linux flavors combined are almost the same on a yearly basis. So just choose the best OS platform for the application and PRACTICE SECURE COMPUTING.
Oh the irony.
I don't have any idea why MS chose to use the zlib library but it wasn't for "buglessness". MS creates enough of their own bugs they don't need to go borrow someone elses. Of course they didn't know about the bugs at the time, but still, methinks they used the code for less altruistic purposes.
Here's what I want to know: the zlib maintainers know that their code is heavily used in open source product, and they can easily use ldd on a typical Linux or *BSD install to find out exactly which programs use zlib. So they know who to contact about vulnerabilities. However, if Microsoft just takes open source code and incorporates it into their products, how will the zlib folks know to contact them prior to public disclosure? It surely can't be the responsibility of the zlib team to grep through every single closed-source binary out there in order to make sure that it didn't use zlib.
It seems like if there isn't a mailing list for every single library's security issues, then closed source vendors will become second-class citizens when it comes to getting forewarning about a big security announcement like this. This seems like what has happened to Microsoft in this case; otherwise they would have had a raft of fixes available when the original story was released, right?
The other alternative is the vendor early warning list idea that Microsoft has been pushing, but the problem with that is: the more people on the list (and you'd have to have hundreds of vendors in the case of a base library like zlib, I'd think), the more likely that one of them will leak the story to the black hats, so that the delay while vendors prepare patches becomes a liability for the unpatched public. That doesn't seem like a good scenario to me either.
Your right to not believe: Americans United for Separation of Church and
No... Microsoft will, of course, apply the open source patch to it's zlib package and recompile, thus demonstrating the viability of the open source approach to security (keep the system open, so anyone can patch the security holes, instead of keeping it closed, hoping that nobody will discover the security holes that are inevitably there).
And Open Source scores one point.
Comment removed based on user account deletion
Either way, browsing other competitor products code whether its free, open GPL or whatever is gonna be risky for a business in legal terms.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
Microsoft is still trying to determine which apps incorporated zlib code? My Linux box already has all its apps fixed. How long until M$ gets patches out? Weeks? Months?
How am I supposed to fit a pithy, relevant quote into 120 characters?
And yet again, it is being reported that this zlib issue is leaving a "hefty" portion of systems vulnerable to attack. Forgive my ignorance, but how? In the previous discussion on the topic, I read some posts that sort of explained a possible risk that might occur if there's a full moon and the lighting is just right.
So I ask you: what? From what I've heard the worst that could happen is your system could crash. I hardly see that as any sort of real issue, since programs like to do that all the time.
Of course, having everything derive code from the same source is a risk
Depends on how you look at it. If there were N completely independent TCP/IP implementations out there, wouldn't there be N times as many bugs (each one affecting 1/N as many systems, on average). Homogeneity means only one codebase to debug and fix. But of course when a bug is found, it affects everyone.
Is this another example of why MS needs to be free of regulation in order to Innovat...ively copy other peoples work?
Shame.
Stop Continental Drift! Reunite Gondwanaland!
Naive question probably, but if zlib isn't GPL then does Debian use a different library and if so, is it affected by this issue?
Richard Stallman? Dick, is that you?
Slashdot, the site where everything's made up and the points don't matter
is if when they released the patch for the security flaw they made the patch GPL... just imagine Microsoft having to recode all that stuff for themselves :)
' Ore stabit fortis a fine placet ore stat '
- found on a park bench
2. zlib is not GPL, it's zlib license, DUH.
3. You are a moron
4. So are Slashdot "editors".
Linux sucks twice as fast and 10 times more reliably, and since you have the source, it's your fault.
"The zlib library has been a fundamental open-source software component for almost a decade and can be found in almost every Linux and Unix system. That means the so-called "double free" flaw in the library may leave a hefty portion of Linux and Unix systems open to attack. Because it adopted some of the code, Microsoft apparently has made itself vulnerable to the flaw as well. "
Disclaimer: I am not a security weenie, so I don't know this for fact......*deep breath*....
If this is true, why is it only news for MS? It appears that Linux and Unix is also vulnerable. So why only set up the article as MS related?
*bash MS* bash bash bash....it's popular right?
Sent from your iPad.
Eating a woman's pussy is about the most wonderful thing you can do for her. It makes her feel loved, admired, sexy, and of course it makes her cum like crazy. Many women prefer it to intercourse, and for most, it is the easiest way to cum with a man. You may have the littlest dick on the planet, but if you give great head, you will be appreciated as a fabulous lover. Yes, it's that important. Besides, lots of women expect it these days - you might as well know what you're doing.
First off, guys seem to have a strange love/hate relationship with women's genitalia. Guys that can't wait to get their dick into one are often reluctant to put their face "down there". For every guy who says he loves to eat pussy, there's another one who's squeamish. Women know this, and it affects their ability to lay back and enjoy the experience. There is nothing more exciting to a woman than to know that her partner finds her delicious. Don't be coy; tell her. When a guy fingers a lady and then smells, licks, sucks the juice off his finger and sighs as if in heaven, she knows this is her lucky day.
What if your sweet lady doesn't smell or taste very sweet? Don't suffer. (Don't complain, either.) Take a nice hot shower or bath together. Lather up both of your bodies and slide them together. It's like a whole body fuck. Soap up her vulva, washing between her outer and inner lips. Spread her lips apart and gently wash her clitoris. Hey, don't stop - this feels great! Run your soapy hand down the crack of her ass, and rub a finger all around her anus. You can stick one finger in and wash around inside too, if you anticipate any anal play, and I suggest you do. But don't put those soapy fingers up her vagina. Instead, rinse them off well and stick one or two inside, making a circular motion. Think about washing the inside of a tall glass - same thing. Now wasn't that fun? And now you can feel free to let your tongue wander anywhere it pleases...
So now what? You've found a comfy spot to play, you've been kissing passionately, your tongues darting around each other's mouths like playful otters. You've moved down to nibble one of her hardening nipples and she's starting to groan, grinding her pelvis against your stomach. STOP. I know it was just starting to get good. But was she really groaning and humping you, or was it your own excitement you were detecting? I strongly prefer to be excited before a guy starts plunging his tongue into my inner recesses. Use your judgement, and kiss, lick, and fondle your way down her stomach, up her thighs, until she's arching up her back trying to get you to eat her. Of course, if she really was groaning and grinding, go for it... I also don't particularly enjoy a guy endlessly nibbling my inner thigh while my clit is quivering in anticipation.
POSITIONS
If the woman you are with is somewhat hesitant about your going down on her, start off with her lying on her back, perhaps half-sitting. Lay down between her legs, with her legs over your shoulders. She may enjoy laying or sitting at the edge of the bed with you kneeling. She can also straddle your face, but be prepared to get very wet. There are endless varieties of positions where you can press your face up to her cunt, some of which strike me as more acrobatic than erotic, but feel free to experiment. And then there's 69...
69 is one of my favorite positions. On the plus side, you both get to enjoy the sublime sensations of getting head, simultaneously. The upside down positioning of a woman's pussy and your mouth is an easy fit and there's more room for your hands. On the negative side, it's a less than ideal position for a woman to give head. Plus, if you need to read this article, you may be better off concentrating your energies on pleasing her, without too much distraction. But even for experienced 69'ers, it's easy to short-change your partner. "It feels soooo good, I'm just gonna stop for a second and concentrate on what you're...aaaarrrgghhh". Get the picture? Some show of will-power is in order.
69 can be done male on top, female on top, or side by side. The latter two are easier, though it's more restful with both partners laying down. Some women love being licked on all fours, so if female-on-top 69 drives her wild, take the hint and find some other ways to eat her in this position. I happen to enjoy male on top, but for many women this is a sure choking position. If a woman can, or wants to try, to deep throat you, this is THE position. When her head is thrust back you can really slide your cock all the way down her throat. But don't forget what you're supposed to be doing!
So there you are staring at it - the mysterious hole from whence you came, and into which you hope to cum again... First, an anatomy lesson...
THE CLITORIS
Before I go any further, a few words about the clitoris, accent on the first syllable. Most of you know it, but for those who don't, it is THE woman's sex organ, period. It may feel great to be fucked vaginally, anally or otherwise, but if the stimulation is not right there, on the clitoris, you're ignoring the place that's going to make her cum, and presumably that's why you're reading this, right? It's right there at the top juncture of her inner lips, a small knob of pink flesh. This is where it's at boys, and don't forget it. Almost any licking and sucking of the labia or vaginal entrance is going to feel just dandy; just remember that this is pleasurable teasing, not the main event. I can't tell you how many guys have thrust their tongues up my vagina thinking that this was going to make me cum. They were wrong. Of course, with a little manual stimulation....but I'm getting ahead of myself.
Women feel differently about how much direct stimulation they can take on their clitoris. Some women will adore it if you suck hard on their exposed clits, others will shriek in pain. You may encounter a woman who is completely unable to take direct stimulation of her clit; the goal is still the same, but you'll have to stimulate it indirectly, such as through her labia. IMPORTANT NOTE: Often, what is unacceptably rough at first may be fine after she's very excited. The fact is, most women really need a good bit of stimulation before a targeted attack on their clitoris, but once they're there, that's where you want to devote your attention.
The key here is go slow, ask questions, and if she's comfortable with it, leave the lights on and really explore. Body language often does tell what feels best, but I promise, she will appreciate your attentiveness if you ask outright. If she seems shy, get her to guide your hands and mouth with her own hand, and pay attention. If she starts bucking up against your mouth and gasping in ragged little breaths, for God's sake, don't use this opportunity to try something different. Just keep doing exactly what you're doing.
THE TONGUE
I want to reiterate, there is almost nothing you can do that won't feel terrific, so relax! I promise, you may be confused and uncertain, but she's in heaven. Any licking and sucking of the labia, vaginal entrance, clitoris, or anal area is going to feel just great, and I'd no sooner tell guys to "do it exactly like this" than I would tell every chef to follow the same recipe. But for those who are compelled to RTFM, here are a few techniques that you might like to try:
Try lapping her pussy from vaginal entrance up to her clit, leaving your tongue soft and jaw relaxed. This is a good way to start your tonguing.
Run your tongue between the inner and outer labia on one side, while holding the two together with your lips. Good job, now do the other side.
Fuck her pussy with your tongue - in and out, around and around, etc. This feels nice. Not wonderful or incredible or earth-shaking; nice.
Spread her outer lips with your hand. Then, with your tongue pointed and stiff, gently flick here and there. Feel free to roam, but keep coming back to her clit. This drives some women wild, and others can't take it. Some may prefer that you always leave your tongue soft, so when you try this, pay attention to whether those moans are ecstacy or pain.
The following techniques should not be introduced until your partner is really hot (i.e. she's no longer coherent). These are very intense actions which may be "too much" for some women, even when nearing orgasm.
With her clit still exposed, give it a quick little suck - pulling it into your mouth briefly and letting it go. This is a lot like licking a bit of cake batter off of your pinky. This feels incredible, and is a fine thing to do if you feel like torturing her (see PUTTING IT ALL TOGETHER below).
Take her exposed clit into your mouth and gently (at first, anyway) suck on it, simultaneously flicking your tongue over and around it. This can be done very lightly or very aggressively, and combined with fingering, will usually rapidly produce an intense orgasm.
Another choice technique involves rolling your tongue into a tube. If you can't do this with your tongue, you can't learn it - it's genetic. For those who can, this works best in an inverted or 69 position. Roll your tongue into a tube around the shaft of her clitoris. Slide it up and down; in effect, your tongue makes a tiny pussy for her clit to fuck. This also is likely to bring her over the edge.
FINGERS
Fingers are a valuable adjunct to eating pussy. Most women masturbate by pressing a finger or fingers over their clit, possibly "thru" the skin of their inner or outer lips, and vigorously rubbing in a circular or back-and-forth direction. You can do this too, and it is most helpful to ask, or better yet, have her show you how she likes it done. You will never be a good lover until you can bring your woman to climax with your hands. When you fuck her from behind, or up her ass, or really in any position which doesn't allow her to simultaneously rub her vulva against your body, reach down or around and rub her clit. I know it's distracting, but just do it anyway. One important point to note: make sure that your fingers are well lubricated. There is nothing more uncomfortable (and sometimes downright painful) than a dry finger roughly rubbed across one's clitoris.
Of course, that's not all you can do with your fingers. One technique which is very exciting is to spread her lips wide apart with one hand, and with your index finger straight like a pencil, flick the side of it rapidly across her clit. This motion alone will often bring a woman to orgasm. Combining this with the addition of some tongue action elsewhere is nothing short of bliss.
Sticking one or more fingers inside her vagina is also wonderful. You can simply move them in and out (this feels best with at least two or three fingers, pushed in hard), or wriggling them around. A particularly intense motion is to face your hand so that you have two fingers inside her with your palm facing the front of her body. Now move your fingers rapidly, as if waving hello. You are aiming to stimulate a particular part of the woman's vagina - namely the lower anterior (front) part. When combined with sucking her clit, this is nearly certain to bring her to a fast and intense climax.
An excellent way to begin manual stimulation is to stick one (and later two) fingers inside her, with your palm cupped over the mons area. I'm talking about that fleshy "mound" over her pubic bone. Your finger goes in and out and the ball of your hand is pressed hard against her vulva. You may want to rub or even shake the entire area with your palm.
Fingers also do nice things to tight little butt holes, but that's a whole other story...
ANAL PLAY
This stuff is purely optional. If anal play doesn't turn you on, don't do it. If you're uncomfortable, she'll pick up on your feelings and start wondering if it's her pussy that's turning you off. Don't feel that you can't be a good lover without anal play; you can.
Cleanliness is of the essence. (remember that nice soapy shower?) Scoop out some luscious juices (from a very wet pussy) with your finger and rub it around her anus. (If she isn't well lubricated, saliva works too.) If that's all you or she feels comfortable with, fine - it still feels great. But I think most women enjoy the feel of a finger pushed up their ass while they're being fucked or eaten. You need to be gentle, possibly even leaving your finger still. Try moving it in and out a little, or around in a circle. If she starts moaning, you know you're doing something right.
It's really fun to feel a woman's anus rhythmically squeezing your finger as she cums. (And it's great for her, too) You're probably thinking about what that would feel like around your dick, and it's something you should certainly explore. Ass-fucking is somewhat out of the scope of this article, but suffice to say, if she doesn't like a finger up her butt, she sure as hell won't want your big dick up there. Even if she does enjoy this sort of play, she may still be somewhat apprehensive about putting something so large up there. The keys to success are sufficient (i.e. copious amounts of) lubrication (a water-soluble type such as K-Y, which is safe for condoms), relaxation on her part, and a slow, gentle, approach. She'll certainly tell you if she wants you to thrust harder or deeper. And remember, if you want to feel that delicious squeezing around your cock, reach around and diddle that clit!
As for anallingus - why not? Don't feel like you HAVE to do it to satisfy your woman. But if the idea turns you on, great. Let your tongue rove as it pleases. It's not necessary to actually put your tongue inside her butt to stimulate the area. Back and forth, around and around, you get the picture.
One hygiene note: once that finger (or your penis) has been inside her ass, don't even think about putting it anywhere else. Carelessness in this regard can cause a horrendous infection.
MENSTRUATION
I haven't met a lot of men who are completely comfortable going down on a woman when she has her period. But some are. Most women are at their horniest before and sometimes during their period. You should definitely find a way to make her cum when she's bleeding, be it thru intercourse, manual, or oral stimulation. If you feel comfortable going down on her, great. It's perfectly safe. You may suggest that she insert a tampon, and then wash up. (As you now know, you don't need to get anywhere near her vagina to make her cum.) Or you could lay down a few old towels, turn out the lights, and forget about it.
PUTTING IT ALL TOGETHER
I think variety is crucial. Some guy posted an article detailing a road map of kissing and licking (first here, then here, etc.) Much better to do the unexpected; sometimes a hungry, aggressive approach, other times a laid-back, leisurely one. You can even even include your nose, or your chin into the act. Start slow, that's the key, and let your lover guide the speed of the crescendo. In all cases, start gently. Roughness and clumsiness are big turn-offs. As she gets more and more excited, pay more attention to her clitoris. When she's three breathes away from cumming, moving your mouth off or away from her clit is agony. That's fine if you're intentionally torturing her, just understand that this is what you are doing. The only prohibition is to be reasonably gentle with her clit. Nibbling or biting is fine elsewhere, but we're talking about a sensitive spot.
Speaking of prolonging the agony... I think this is great fun. Bring your partner just to the edge of orgasm, and stop. This is not easy unless you really know your lover well. Instead, just have her help you. Say, "Grab my head and stop me just before you think you're gonna cum." Then take your sweet time. Blow on her clit, take it into your mouth just briefly, flick it just the very slightest bit. You will have this woman squirming and moaning like she's dying. Finger her deeply, enjoy the ecstasy you are imparting, and finally, have pity. Let the poor woman cum.
UUUUNNNNGGGGGHHHHHH!!!!!! (or, I'M COMING!!!)
Okay, she's practically suffocating you, she's pressed so hard against your face; she's screaming and bucking up in the air; you feel her pussy contracting wildly - how long should you keep it up?? The simple answer is, until she makes you stop. Some women may stop you after five seconds from the start of their climax, others may be able to roll right into another orgasm if you keep going. Do come up for air, but remember, her excitement does not drop off as sharply as yours does. Play it safe by continuing the stimulation.
How many times does she need to cum? Some women are very content to have one orgasm. A whole lot of women would really like to cum again, but need about five minutes to recoup. Many women are so sensitive right after they cum that they may push your head violently away. This doesn't necessarily mean they've had enough, only that you need to stop for a few minutes. In fact most women, given a short rest between, are capable of cumming again and again. A smaller percentage of women are able to cum repeatedly with continued stimulation. This is the much-touted multiple-orgasm that is experienced by a minority of women. I know this makes it difficult to know when enough is enough, but there's a simple answer: ask her.
GODI'MSOEXCITEDITFEELSGREATBUTIJUSTCAN'TCOME
It happens to all of us sometimes - distraction, embarrassment, anxiety, or just an inability to "let go". What do you do about it? The first question is, can she easily bring herself to a climax in the privacy of her own home. If the answer is no - then she needs to do some homework. There are two books on the subject that I know of: For Yourself: The Fulfillment of Female Sexuality by Lonnie Barbach, and Sex for One: The Joy of Selfloving by Betty Dodson; pick up one. Then tell her to read it, study it, and practice, practice, practice!
Now if your partner is orgasmic only when alone - ask her point blank: "Is there something different I can do?" Many women are shy about criticizing their lovers, but if asked outright will surprise you with a very specific answer. It may be a simple matter of mechanics, like a little to right please, or not so rough, or more pressure and faster. Ah... perfect.
But suppose everything is wonderful. She says you're doing everything right but she just can't cum. There are two probable causes: selfconsciousness and/or self-loathing. For women who can't help watching themselves, the best approach is to eliminate anything that focuses her attention on what the two of you are doing. This is a "be here now" kind of thing - definitely not an introspective activity. Get that mirror off the ceiling. Dim the lights or turn them off completely. Put on some soft music. Share a glass of port. (I said A glass - getting drunk will definitely not help). Have her lay on her back, or propped up comfortably with some pillows. This is not the time for her to sit on your face, or the edge of the bed, or standing up against a wall. Arrange a time when you can devote a long period to eating her pussy, and then just keep it up. Forget everything I said about asking her questions - just close your eyes and get into it. I know this can be a difficult and exhausting exercise, but she will be extravagantly thankful for your efforts. It gets easier each time. If all else fails, get accustomed to masturbating together. Gradually begin to add your stimulation to her own, right before she's about to cum anyway. Over time, you can take over completely.
For women who themselves feel that their cunts are dirty or distasteful, all of the above methods may be helpful, but the underlying issue must also be addressed. I am amazed at how many women are ambivalent about their own genitals. They don't love "that part" of their body, and they can't believe that you would either. Yes, it is important to be clean. But clean means a daily shower which includes washing the vulva. It doesn't mean vainly attempting to remove every trace of smell or taste. The natural fragrance and secretions of a healthy woman are beautiful and erotic. Hopefully you agree (and if not, try hard to cultivate this attitude). When she learns to love her pussy, she will be infinitely more comfortable with your loving it too.
How to Eat Pussy
Hey, I have a lot of respect for all you guys who like to eat pussy because there are too few of you out there. And I'm not the only woman who says this. Furthermore, some of you guys who are giving it the old college try are not doing too well, so maybe this little lesson will help you out. When a woman finds a man who gives good head, she's found a treasure she's not going to let go of too quickly. This is one rare customer and she knows it. She won't even tell her girlfriends about it or that guy will become the most popular man in town. So, remember, most guys can fuck, and those who can usually do it satisfactorily, but the guy who gives good head, he's got it made.
Most women are shy about their bodies. Even if you've got the world's most gorgeous woman in bed with you, she's going to worry about how you like her body. Tell her it's beautiful, tell her which parts you like best, tell her anything, but get her to trust you enough to let you down between her legs.
Now stop and look at what you see. Beautiful, isn't it? There is nothing that makes a woman more unique than her pussy. I know. I've seen plenty of them. They come in all different sizes, colors and shapes; some are tucked inside like a little girl's cunnie and some have thick luscious lips that come out to greet you. Some are nested in brushes of fur and others are covered with transparent fuzz. Appreciate your woman's unique qualities and tell her what makes her special.
Women are a good deal more verbal than men, especially during love-making. They also respond more to verbal love, which means, the more you talk to her, the easier it will be to get her off. So all the time you're petting and stroking her beautiful pussy, talk to her about it.
Now look at it again. Gently pull the lips apart and look at her inner lips, even lick them if you want to. Now spread the tops of her pussy up until you can find her clit. Women have clits in all different sizes, just like you guys have different sized cocks. It doesn't mean a thing as far as her capacity for orgasm. All it means is more of her is hidden underneath her foreskin.
Whenever you touch a woman's pussy, make sure your finger is wet. You can lick it or moisten it with juices from inside her. Be sure, by all means, to wet it before you touch her clit because it doesn't have any juices of it's own and it's extremely sensitive. Your finger will stick to it if it's dry and that hurts. But you don't want to touch her clit anyway. You have to work up to that. Before she becomes aroused, her clit is too delicate to be handled.
Approach her pussy slowly. Women, even more so than men, love to be teased. The inner part of her thigh is her most tender spot. Lick it, kiss it, make designs on it with the tip of your tongue. Come dangerously close to her pussy, then float away. Make her anticipate it.
Now lick the crease where her leg joins her pussy. Nuzzle your face into her bush. Brush your lips over her slit without pressing down on it to further excite her. After you've done this to the point where your lady is bucking up from her seat and she's straining to get more of you closer to her, then put your lips right on top of her slit.
Kiss her, gently, then harder. Now use your tongue to separate her pussy lips and when she opens up, run your tongue up and down between the layers of pussy flesh. Gently spread her legs more with your hands. Everything you do with a woman you're about to eat must be done gently.
Tongue-fuck her. This feels define. It also teases the hell out of her because by now she wants some attention given to her clit. Check it out. See if her clit has gotten hard enough to peek out of it's covering. If so, lick it. If you can't see it, it might still be waiting for you underneath. So bring your tongue up tot he top of her slit and feel for her clit. You may barely experience it's presence. But even if you can't feel the tiny pearl, you can make it rise by licking the skin that covers it. Lick hard now and press into her skin.
Gently pull the pussy lips away and flick your tongue against the clit, hood covered or not. Do this quickly. This should cause her legs to shudder. When you sense she's getting up there toward orgasm, make your lips into an O and take the clit into your mouth. Start to suck gently and watch your lady's face for her reaction. If she can handle it, begin to suck harder. If she digs it, suck even harder. Go with her. If she lifts her pelvis into the air with the tension of her rising orgasm, move with her, don't fight her. Hang on, and keep your hot mouth on her clit. Don't let go. That's what she'll be saying too: 'Don't stop. Don't ever stop!'
There's a reason for that, most men stop too soon. Just like with cock sucking, this is something worth learning about and worth learning to do well. I know a man who's a lousy fuck, simply lousy, but he can eat pussy like nobody I know and he never has trouble getting a date. Girls are falling all over him.
But back to your pussy eating session...There's another thing you can do to intensify your woman's pleasure. You can finger-fuck her while she's enjoying your clit-licking talents. Before, curing or after. She'll really like it. In addition to the erogenous zones surrounding her clit, a woman has another extremely sensitive area at the roof of her vagina. This is what you rub up against when you're fucking her. Well, since your cock is pretty far away from your mouth, your fingers will have to do the fucking.
Take two fingers. One is too skinny and three is too wide and therefore can't get deep enough. Make sure they're wet so you don't irritate her skin. Slide them inside, slowly at first, then a little faster. Fuck her with them rhythmically. Speed up only when she does. Listen to her breathing.
She'll let you know what to do. If you're sucking her clit and finger-fucking her at the same time, you're giving her far more stimulation than you would be giving her with your cock alone. So you can count on it that she's getting high on this. If there's any doubt, check her out for symptoms. Each woman is unique. You may have one who's nipples get hard when she's excited or only when she's having an orgasm. Your girl might flush red or begin to tremble. Get to know her symptoms and you'll be a more sensitive lover.
When she starts to have an orgasm, for heaven's sakes, don't let go of that clit. Hang in there for the duration. When she starts to come down from the first orgasm, press your tongue along the underside of the clit, leaving your lips covering the top. Move your tongue in and out of her cunt. If your fingers are inside, move them a little too, gently though, things are extremely sensitive just now.
If you play your cards right, you'll get some multiple orgasms this way. A woman stays excited for a full hour after she's had an orgasm. Do you realize the full impact of that information? The potential? One woman was clocked at 56 orgasms at one sitting. Do you know what effect you would have on a woman you gave 56 orgasms to? She'd be yours as long as you wanted her.
The last advice I have for you is this: After you've made her come, make her your slave by giving her the best head she's ever had, don't leave her alone just yet. Talk to her, stroke her body, caress her breasts. Keep making love to her quietly until she's come all the way down. A man can get off and go to sleep in the same breath and feel no remorse, no sense of loss. But a woman by nature requires some sensitivity from her lover in those first few moments after sex.
Oral sex can be the most exciting sexual experiences you can have. But it's what you make it. Take your time, practice often, pay attention to your lover's signals, and most of all, enjoy yourself.
Female Oral Sex Techniques
TASTE:
In my experience, one of the main reasons that partners avoid female oral sex is due to a percieved or even experienced poor taste. While it is true that women run the range from pleasant (tasty!) to sour or uric tasting, there are easy steps to ensure that your partner will be tasting her sweetest.
First and most obviously, a good vigorous shower will do much to neutralize the taste of your partner. In fact, oral sex in the shower, while not a favorite method of mine, has a completely neutral taste if you stick to the upper regions of your partner's sex. If your partner has not showered recently, or has physically exerted herself recently, her taste will be much stronger. This, however, can be a good thing!
Secondly, foreplay will improve upon both the taste and the experience in general if your can get her juices flowing. I have never found an extremely aroused, wet woman to taste unpleasant. Quite the contrary!
FOREPLAY:
Do it! Take your time! Have fun! Experiment! A common male misunderstanding is that females are aroused most through physical contact. Not true. I have aroused women greatly simply by acting sexy. Tension is a wonderful tool, use it. If you can build tension to the point where the barest touch sends electric shivers through both of you, you can't lose! Similarly, even the best love techniques will not turn on a woman who isn't in the mood. (If you can get her in the mood, well then you're talking.)
Take your time, explore your partner (there's a lot more there than nipples and a clitoris!), build tension, have fun.
POSITIONS:
There are two basic positions that I have found very versitile and succesful. For a very comfortable session, have her lie on her back with legs spread and knees bent slightly. Lie on your stomach between her legs, put your right arm under her left leg and your left arm under her right - somewhat of an intimate hug. Now you should find your head situated conveniently and comfortably near the center of your attention.
Less comfortable, but a bit wilder is the following. Lie on your back, prop a couple of pillows (or fold one over) under your head. Have your partner kneel facing you with one knee on each side of your head, above your shoulders. The sexy part of this position (IMHO) is that your partner can look down at you and watch you eating her out. (Yum) Versatility and comfort are reduced for the giver, so I only occasionally partake in this position.
These are by no means the only positions. Again, experiment, have fun. If you can find a bed where your partner can lie down with her legs dangling off the bed and resting flat on the floor, you're in luck. Now you can have her sit just at the edge of the bed, lie back, and give you plenty of access while you kneel/sit in front of her sex.
GEOGRAPHY:
Woman are very different in some respects of their genitalia, but the major parts are the same. A woman's sex from the oral sex point of view consists of two sets of lips (outer and inner) that meet just below the vaginal opening and some variable distance above the clitoris; the vaginal opening (immediately above the nether meeting of above-mentioned lips), a smooth section of skin between the vaginal opening and the clitoris (I have no clue as to its technical name, hereafter it will be refered to as the "scav") and the clitoris and its surrounding folds.
If you get the chance, explore your partner in a location with decent lighting. Use your hand to spread her sex and explore her, find out what's where and what's what. Like I said earlier, women are different. Especially the location and shape of the clitoris. It can be buried, protruding, surrounded by many folds of flesh, or hanging out it the open. The best method I have found for finding your partner's clitoris (If all else fails, ask!), is to place a finger at the very base of her sex and gently run it up her scav until you feel a slight bump. That's it.
OK, ENOUGH OF THE DETAILS, NOW THE NITTY-GRITTY:
So your partner is showered, excited and feeling sexy. It's the big moment, what to do? Don't simply dive in. Take your time, excite her. In my opinion, I can usually tell how good my partner is at oral sex by how she "goes down" on me. By "going down" I mean the process by which she goes from kising my lips to sucking oh-so-wonderfully on my sex.
Depending on your partner, different methods of going down will work more effectively. If you've gotten to this point with your partner, you should have a fair idea of what she likes. Take advantage of that knowledge. One thing that I highly recommend however, is a sexy look. Sexy looks can make all the difference, and the best place to throw one in is as you're licking, sucking and kissing your way down her stomach stop, look up and smile devilishly.
Unbutton your partners jean's, pull the tabs back and kiss her newly exposed flesh. Unzip her pants, pull the tabs back as far as they can go and place light, tender kisses on her abdomen and around the top of her panties. Watch it, some women are very ticklish here!
(Note the above doesn't work so well if she doesn't have jeans on but you're all smart enough to figure it out...) Once you've removed everything but her panties, stop. You have a unique opportunity for further arousal. Kiss her legs and inner thighs with gentle kisses. Work your way up each leg and make a point of stopping at the line of her underwear. Kiss again along the top of her underwear, and along the other two borders.
Now move to her cotton (silk? lace? latex?) covered sex. Plant firm, dry kisses through her underwear on her sex, low and right around the vaginal entrance works best for me. If your partner is really excited, often her underwear will be damp and will smell (pleasantly) of her sex.
Removing the underwear is again a matter of choice. You know your partner best, I prefer either gently sliding it all the way off with my fingers, or pulling it part way down with my teeth first.
DIRECT KISSING:
It is not unusual for your partner's lips to be closed together. A very excited woman's lips may be slightly spread allready ("pouting"). Again, building tension can be accomplished by light kisses on either side of her sex as well as light blowing. (Do not inflate your partner! This can be very dangerous!!) Spreading her lips can be accomplished by placing your tongue first at the base of her sex, and then firmly running your tongue all the way up. Continue with a few long licks from the base of her sex all the way to the top past her clitoris. Vary the firmness of your tongue from hard and pointed to broad and soft.
THE BIG "O":
The best and most proven method of making your partner cum through oral sex is by repeated, rythmic stroking of her clitoris with your tongue. The tongue is uniquely suited for this purpose because of it's texture, versatility, and pliability. It is difficult (and tiring) to apply too much pressure to your partner's clitoris. Some women are much more sensitive than others however. Be receptive to any sharp gasps, you could be being too affectionate. If this is the case, move away from direct contact or adopt a gentler technique.
Repeated, rythmic stroking can be accomplished in a variety of ways. I prefer either rapid, repeated verticle licks with a firm, pointed tongue, or planting your tongue firmly against your partner's clitoris and vigorously shaking your head back and forth. (Tiring, maybe. But it's worth it!) If you are having trouble finding the correct angle or method for rhythmically lingually carresing her clitoris, or if you want to try something fun and new:
Toungue the abc's. No seriously! This is a great oral excercise on any part of the body. Toungue the abc's starting with lower case, and moving though upper case. (Heck, you could do the whole ANSI ASCII set if you'd like!) Be especially perceptive while you do this, vary your speed and watch for sharp intakes of breath - chances are you've hit the right angle. The abc's give a large variety of different strokes, so come back to this excersize as often as you'd like.
A general rule of thumb (tongue?) is to start slow and pick up the pace as you go along. This is definately a general rule though, feel free to break it by varying your rhythm, both slowly and predictably as well as quickly and startlingly.
OTHER FUN THINGS TO DO:
Lick between the inner and outer lips; penetrate the vagina deeply (a much stronger, iron-like taste here); "tease" the entrance to her vagina with rapid pokes of your toungue at varying depths; don't forget your hands, often a woman will feel a need or ache for something inside of her while very aroused, oblige her with a finger or two. Both kissing and manually manipulating your partner is tough, anyone with succesful methods is welcome to pipe in.
Talk to your partner, ask her what she likes. Experiment (if you can) with many different partners. What excites one woman a lot may not excite another as much, but may still be well worth trying. On the other hand, you may not notice a subtle pleasurable technique on one woman that can be easily learned on another. The better you know your parnter, the more effectively you can please her. Have fun!
A FINAL NOTE:
I tried to be a lot less pretentious than the male version of this article for a few reasons. The major one is that women are very different, the above suggestions may work wonderfully with one woman and so-so with another. Some women simply aren't responsive to oral sex due to strong moral constraints. Secondly, I am not an expert, though I love oral sex and have had the joy of pleasuring 10-20 women. Third, I am still young (18) and have a lot to learn.
So feel free to comment on what you've read (men and women) and reply either over the net or to me personally. Thanks. Hope you found this helpfull and enjoy!
Q. What is cunnilingus?
Cunnilingus is the fine art of making love to a vagina with your mouth and tongue. It is a delicate skill, requiring patience, practice, and dedication to get it right, but any woman you learn to do it right for will appreciate you all the more for it.
What applies to the penis applies to the vulva-- every one is different, requiring a different touch to make its owner happy. But few tools can equal the tongue for the amount of pleasure it can deliver to a happy vagina.
This article assumes that you know what a vulva looks like and can identify with some precision the mons veneris, labia majora, clitoral hood, clitoris, labia minora, urethra, vagina, and perineum, to name them (approximately) from top to bottom.
Q. How fast should I go?
This isn't an attack. Don't go after the clitoris like a fireman attacking a fire. Quite often at first, the clitoris is far too sensitive for direct stimulation. Lick around it, stimulating the hood, teasing her inner labia, tasting her. Take your time and listen to her. Some women make noise, and some do not. It will be a while before you learn exactly what your lover prefers as far as oral sex is concerned.
Some women may like additional stimulation-- a finger or two into the vagina, or perhaps even the anus. She may want your hands to reach up and play with her breasts, or she may want your fingers to hold her labia apart so that your tongue can get at her vulva more directly.
Q. I've heard cunnilingus doesn't taste good.
If the taste or smell bothers you or is a concern, ask her to wash first. Most people who enjoy cunnilingus agree that a clean vagina is a good, if acquired, taste.
As a woman nears her climax, she may want more direct stimulation. In general, fast, rhythmic stimulation is most effective at causing climax-- but there shouldn't be a rush to get there. Take your time and learn to appreciate what you can do for her.
Q. What about cunnilingus during menstruation?
Some people are particularly turned off at the suggestion of cunnilingus during menstruation. If it is a concern to you, then wait. A tampon may well hold the blood back, as will a diaphragm, but some men can't stand the taste anyway. If your partner is healthy, however, there is no particular danger in menstrual blood, and some women find that orgasms during their periods allievate cramps.
In my experience, when you try to explain to a man "in the moment" that he is doing oral sex (or sometimes anything) wrong, often the result is a disaster. You aren't into it, because you are trying to direct, and I guess for many guys it comes off as simply insulting. It isn't a very "supportive process," to borrow a friend's phraseology.
Example: "No, not there,...there..." (Quizzical looks, no change in behavior.)
Now, if you go looking for diagrams of women's vaginas, you will find yourself either looking at medical textbooks or special references, such as Our Bodies, Ourselves --- which, is presented as a "for women only" sort of thing. The original edition even gave this little rap to men about not buying it "for" women. Yeesh! Good book, but talk about "attitude." The new edition has thankfully dropped this negative proscription.
You will sometimes NOT even find a clear picture of a woman's vagina in a general sex reference, such as the original The Joy of Sex. And you won't find a discussion of the parts of the vulva in most places. Now, go look for a picture of a man's penis that is reasonably edifying, and you'll find them all over. I only discovered this when I tried to look it up, and since I had never purchased Our Bodies, Ourselves, I was SOL (corrected that, recently). I however, and all women, have a ready-made "reference manual," provided we have gotten over the idea, or never had it, that looking at it will somehow be a "bad thing." Men don't have this reference manual readily "at hand," at least if their partner, if they have one, is not immediately available and cooperative.
I have also read, and just reread, the Cunnilingus FAQ. Though it seemed excellent in terms of mood, style of approach, all the "beginning" stuff, I found when I applied her technique suggestions to me and my experience as a recipient, or my experience as a giver, it was a bit short on specifics. I am sure the described approach works very well for the woman who wrote it
So, you have gone through all the beginning motions, taking a reasonable amount of time, and you are starting to "get down to business." First, PLEASE turn on the lights. Working in the dark is for experts at best. I am assuming you are sitting between her legs, facing her, or some variation on this. Now really LOOK at what is there. Where her hair is (or was, some people shave) is the mons veneris, the pubic mound. If she is not aroused, everything is likely, but not guaranteed, to be enclosed within the outer lips or labia majora, the edges of the pubic mound that comes together to enclose her vulva.
As you spread this apart (she can bring her knees up and out, and/or you can use your hands), you will now see the inner folds of skin of the vulva, the inner lips or labia minora. These (usually) go all around the vaginal opening, and come in a variety of interesting and pleasing shapes and textures.
As you observe that this encircles the vaginal opening, at the top of this you will find what might look like a button or might look like a very tiny penis, covered by an additional flap of skin. The flap of skin is the "hood" of the clitoris, and is very sensitive, as is the clitoris. This is the female equivalent of the male foreskin, though it is much looser than that corresponding organ.
If you see what looks like a button underneath the hood, then what you are seeing is the glans of the clitoris, exactly equivalent to your own penis glans, or head of the penis. If you see a bit more than that, then there is probably some of the shaft of the clitoris extending in your partner. I stress this since most men would not be particularly enthused by a blow job that only gave attention to their penis head and extended not a centimeter below there. Many might find it annoying or even painful, depending on how rough their partner is with them and how sensitive they are to pain in that area. However, told "give attention to the clitoris," by fable and book, many brave soldiers run to do battle on the field of their woman's desires with their tongue, only to find their partner is telling them to please stop, it hurts, or it doesn't do anything for me. This may or may not be a comment on your technique, some women don't like oral sex. I would just like to suggest an approach that probably has a higher average success rate.
The shaft of the clitoris is attached internally, back into the body of the woman. Pressure on the spot above the glans and underneath the hood will generally give you access to the part of the shaft equivalent to the part of your penis that is towards your body, whereas underneath the glans will give you access to the part of the shaft that is equivalent to the part of your penis that is away from your body. It is likely that the skin directly below the glans will be functionally equivalent to what is for most men the most sensitive and pleasurable part of the penis for play, and the inner vaginal lips are also usually quite sensitive "in a good way." Going down/in/back, you may or may not see the urethra, if you do this is the location of the grafenberg spot (g-spot), which we have all heard on this newsgroup is quite varied in response, some women love stimulation there, others do not. Try licking your tongue around there, if it is visible, and see, in the course of your "investigations."
O.K., so now you have the picture. You did trim/file your nails first, didn't you? Play with your hands, play with your mouth, go all over, gently at first, increasing stimulation and focus as her body responds, and coming in "closer on" the clitoral area as she becomes more aroused. Lick, suck, point your tongue and apply pressure, use it like a "miniature penis" under the glans, penetrating her as you go, make little circles with your tongue, lick up and down along the skin in front of the clitoris, up and down the inner vaginal lips, etc. These are ideas, find some others, listen to her responses and comments. Remember to GO SLOW --- I believe impatience and expectations of quick response are "generally recognized as" the most common error in sexual encounters. Eventually the clitoris will become probably become erect, and stimulation that is "more direct" (like enclosing your mouth on the area and gently sucking) will stimulate a sufficient amount of the organ in question to be interesting. Watch what you are doing, and what happens, the entire area will become "engorged" and swollen if things are proceeding closer to orgasm.
Some women may not, or may prefer not, to orgasm this way. Most will probably, however, enjoy the experience a great deal. Hopefully this "explanation and comparison" to the corresponding male body parts will allow you to not be (still) in the dark with the lights on.
Development Team,
Thank you! I have been saying for years that Open Source is EVIL! Now we have even more proof. With this latest failure of open source code we can push even more people into using our products. We can even say that we "tried" to use open source, and look what it brought us. Once again, Thanks! Marketing and I appriciate it.
-Bill
Marie has set up home
With a man who's half my age
A halfwit in a leotard
Stands on my stage
The standards have fallen
My value has dropped
But don't shed a tear
Some walk like they own the place
Whilst others creep in fear
Try if you can
To walk like a man
But you don't come near
You've got to fly like an eagle
Prowl like a lion in Africa
Leap like a salmon
Pulled from the sea
To keep up with me
You've got to walk like a panther tonight
Walk like a panther tonight
The old home town just looks the same
Like a derelict man who has died out of shame
Like a jumble sale left out in the rain
It's not good
It's not right
The standards have fallen
My value has dropped
But don't shed a tear
Some walk like they own the place
Whilst others creep in fear
So try if you can
To walk like a man
But you don't come near
You've got to fly like an eagle
Prowl like a lion in Africa
Leap like a salmon
Pulled from the sea
To keep up with me
You've got to walk like a panther tonight
Walk like a panther tonight
Where did you leave your self-respect?
You look like a reptile
Your house is a wreck
Your existence an insult
And stains that are suspect
Cover your clothes
The standards have fallen
My value has dropped
But don't shed a tear
Some walk like they own the place
Whilst others live in fear
So try if you can
To walk like a man
But you don't come near
You've got to fly like an eagle
Prowl like a lion in Africa
Leap like a salmon
Pulled from the sea
To keep up with me
You've got to walk like a panther tonight
Walk like a panther tonight x5
Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic,nflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) Please try to keep posts on topic.Try to reply to other people comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) > Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic,nflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) Please try to keep posts on topic.Try to reply to other people comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) >Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic,nflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) Please try to keep posts on topic.Try to reply to other people comments instead of starting new threads. Read other people's messages before posting your own to avoid simply duplicating what has already been said. Use a clear subject that describes what your message is about. Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page) >
I R00z j00!!!!!
And Windriver or whoever controlled BSDI at the time made some serious cash in that deal. They got paid to make the tcp/ip stack work well in 2000/XP and they've done a good job of it.
I just wonder if Microsoft was able to taint some of the BSD coders by allowing them to view their code. I'm sure integrating something like a TCP/IP stack required access to some 2000/XP src code. Anyone know?
Can I get an eye poke?
Dog House Forum
I'd really like to see Microsoft as the defendant in the first GPL case, that'd be a blast. I'd buy a ticket.
Cunning linguists
http://www.gzip.org/zlib/apps.html
At least nine of Microsoft's major applications--including Microsoft Office, Internet Explorer, DirectX, Messenger and Front Page--appear to incorporate borrowed code from the compression library and could be vulnerable to a similar attack.
"Borrowed"? Whats the license for zlib?
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
I don't think the point of the article is that Microsoft is insecure ('cept about keeping their market share, of course :).
I think it was interesting that Microsoft used open source code in software they sell externally. I didn't know that before.
It was also interesting that security flaws in Microsoft products was caused by open source code. Kind of turns the tables on those geeks. (Wait... what site am I at? Oh, Slashdot! Damn...)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H ^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^HKind of turns the tables on those Microsofties, doesn't it?
And then comes the interesting question: what will they do about it? Apply the open source patch within 24 hrs, and admit that open source gets fixed damn fast, then hang their head in shame waiting week after week for the patch to reach out to all the end-users. Muahahahhahaha...
So, I dissed Microsoft. Do I get my Karma now?
The next-generation Graphics Device Interface is part of Windows XP, meaning that the operating system itself could be at risk.
:P
the colors were just screaming security flaw already weren't they?
Yet, the incident seemingly proves that Microsoft, despite dismissing open-source code publicly, has used software from others to create their own products.
And now they are forced to admit what we already knew, they haven't written anything original since...well...ever!
The zlib compression library doesn't use the GPL, however.
and the war between MS and GPL coninues, maybe the linux community could use Anime-based uniforms to storm microsoft and take the code back.
"The secret of success is to know something nobody else knows." -Aristotle Onassis
I've seen this so often that it's worth a comment.
The TCP/IP code in Windows NT is streams based - it was written originally by Spider Software in Edinburgh. It's a clean room implementation that does not have any BSD code in it (I know the original architect of it). And it isn't derived from the original Unix streams code - even the underlying streams layer was written from scratch. The same code is in use by many OEM's in embedded devices etc.
But perhaps that is why microsoft is so afraid to let the states in the antitrust case look at their code. If some one were to discovered they actually a lot of open source code, that would be a huge embarrasement.
Microsoft is an old hand at using public domain stuff! They don't dislike it... like all companies they grew used to swallowing it up! It's even cheaper than buying QDOS was.
No, the GPL is not about giving software away, that was already happening. It was about KEEPING software GIVEN AWAY.
-pyrrho
This is particularly critical with something like the TCP/IP stack. Everybody using a stack derived from a common code base means both sides of the interface on many connections, even on different platforms, are based on the same data structures, etc. This is a good thing, no matter how the Linux folk (Linus arbitrarily decided at one point 'he didn't like the Berkeley stack' so they used some other code instead) try to spin it.
You sound authoritive. Any links for proof?
--Giving to trolls for the benefit of us all
1. It was already written and IMHO they are too cheap to write thier own software 2. read #1 over and over ALSO they used it extensivly so if they patch.... look for TONS of new "feature/bug/phone home style apps to be inserted"
""[...]but does point out that since zlib is not GPL'd they are under no obligation to release the source code to any of their products.""
"Darn, and I thought they were caught with their pants down."
Hey, that's a great idea. Find a way to sneak GPL'd code into, say, MFC, without Microsoft knowing it, then go to court to make them release all their software as Open Source.
Microsoft will, of course, apply all the delaying tactics they can... which gives us time to patch and rerelease Windows NT, IE and SQL server while the legal grinds are churning.
It just might work!
Why? Unless you incorporate it wholesale or re-use a patented algorithm, you do have Fair Use rights under existing copyright law.
I do not have a signature
Why?
Unless it's GPL infected it's not illegal to incorporate it.
Plus, once the copyright-abolish fanatics have had their way, all the GPL licensed code (which is all protected by legal structures based on copyright law) will fall into Public Domain anyway.
How is reading, even verbatim copying, of BSD-licensed code risky in legal terms. The license explicitly allows incorporation into any type of software (commercial, open, or free). Microsoft could put out their own version of one of the *BSDs, with the only difference from it's base BSD being having the Windows GUI grafted on top of it and no source included.
The relevant passage in the BSD license (from http://www.freebsd.org/copyright/license.html ):
There are licenses that are the BSD license, less the advertising clause (it is the advertising clause that prevents BSD from being a free license according to the FSF), such as the MIT license. These licenses are the freest of all the licenses (short of public domain).
A guy with the email address 'fake@nospam.org' is challanging someone else's credentials??
heh
you make this up /.
anything to bash MS you spread, don't matter WHO makes it up.
What do YOU want to do today?
/. says "Bash Microsoft"
As long as MS makes heavier use of OSS, they will be less prone to attacks.
They currently use the TCP Stack from BSD, they redesigned SMB services based on Samba (they had to cold room it due to GPL). This helps explain how MS is getting faster and less cracks.
Of course, this also explains why they oppose GPL.
...that Microsoft uses free software, I invite you to take a look at this.
In Windows 2000, open a command prompt window. Type "nslookup". This will drop you into interactive mode for nslookup, which has been ported from UNIX (most likely BSD.)
Now type "help". Check out this line at the bottom of the output:
view FILE - sort an 'ls' output file and view it with pg
Uh, yeah. Oops.
Simpli - Your source for San Jose dedicated servers and colocation!
if the BSA comes knocking?
Now I'd really like to see the sources to all the MS OSes.
Well it's easy to show that they use
code, at least. This is Cygwin / bash on NT4:
andrew@INEGO(22:18:47)
[path...]
Binary file FINGER.EXE matches
Binary file FTP.EXE matches
Binary file RCP.EXE matches
Binary file RSH.EXE matches
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
The next-generation Graphics Device Interface is part of Windows XP, meaning that the operating system itself could be at risk.
Am I right in assuming this won't effect NT4 and is a direct outcome of putting the GDI back in the kernel unlike in the true microkernel architecture like HURD?
heuristic algorithm seeks stochastic relationship
Has anyone ever seen this guy produce an article that doesn't have major factual errors?
I know many people corrected him when he stated that this was a Linux problem in his first article about it... it's not surprising that he still hasn't pulled his head out of this ass.
One word:
You have just received the Amish Virus!
Since we do not have electricity or computers,
you are on the HONOR SYSTEM!
Please delete ALL of your files....
Thank Thee.
Alan Thicke's Journal
My Slashdot ads say "
"I bet that most ppl who bash MS have never spent time with Windows 2000."
I must admit I'm feeling guilty.
I switched to XP after a few months.
:-)
"if" M$ does use GPLed source, somewhere down the line it will come out.
Case in point. A GPLed piece of software has bug X, and strangly enough, a M$ product has the same bug.
It maybe worth the time to test major bugs in GPLed software against M$ programs if such simularities do exist.
Just a thought.
-- Knowing too much can get you killed, but knowing who knows too much can make you rich.
Microsoft is like a prison cell with a bad lock, just when you think all is safe and bend over to tie your shoes you get screwed!
Just when I start thinking that ms is top of the line above all they come out with some security flaw out there, of course tomorrow we'll be able to dload some new service pack, but I hope they start being a little bit more proactive than reactive.
. . . and to all a good night!
Yeah, nothing like finding a bug in one piece of code and having it affect the ENTIRE INTERNET.
Keep your license politics out of technical discussions. And while your at it, try to stick to facts, instead of software development urban legends.
HA HA HA HA FRAT BOY
Rock over London
Rock on Chicago.
Bush Administration:
Creating a permanent corporate police state.
So we expect more Hotfixes or SPs for these products? When?
This highlights taking a dependancy on externally maintained code is risky. Turn around time in fixes and integration into the codebase, verification of the fixes for those products etc...
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
If you are reading this, you most likely have no social skills.
You are correct sir.
- AIX is dying.
- AmigaOS is dying.
- BSD is dying.
- BeOS is dying.
- CPM is dying.
- DOS is dying.
- FreeBSD is dying.
- GNU Hurd is dying.
- HP-UX is dying.
- IRIX is dying.
- Inferno is dying.
- Linux is dying.
- LynxOS is dying.
- MINIX is dying.
- MacOS is dying.
- Mach is dying.
- MicroC/OS is dying.
- NachOS is dying.
- NeXT is dying.
- Nemesis is dying.
- NetBSD is dying.
- NetWare is dying.
- OS-400 is dying.
- OS-9 is dying.
- OS/2 is dying.
- Oberon is dying.
- OpenBSD is dying.
- Palm OS is dying.
- Plan 9 is dying.
- pSOS is dying.
- QNX is dying.
- RTEMS is dying.
- SCO is dying.
- Solaris is dying.
- SunOS is dying.
- TRON is dying.
- ThreadX is dying.
- TinyOS is dying.
- Unix is dying.
- VMS is dying.
- VxWorks is dying.
- Windows 2000 is dying.
- Windows 3.11 is dying.
- Windows 95 is dying.
- Windows 98 is dying.
- Windows CE is dying.
- Windows ME is dying.
- Windows NT is dying.
- Windows XP is dying.
The Free On-Line Dictionary of Computing defines an operating system as: "The low-level software which handles the interface to peripheral hardware, schedules tasks, allocates storage, and presents a default interface to the user when no application program is running. The OS may be split into a kernel which is always present and various system programs which use facilities provided by the kernel to perform higher-level house-keeping tasks, often acting as servers in a client-server relationship. Some would include a graphical user interface and window system as part of the OS, others would not.The operating system loader, BIOS, or other firmware required at boot time or when installing the operating system would generally not be considered part of the operating system, though this distinction is unclear in the case of a rommable operating system such as RISC OS. The facilities an operating system provides and its general design philosophy exert an extremely strong influence on programming style and on the technical cultures that grow up around the machines on which it runs.
The comp.os.research FAQ makes the following distinction between micro- and macrokernels:
"A recurrent topic of discussion in this newsgroup has been the comparison between microkernel (for example Mach and QNX) and `macrokernel' (traditional Unix) operating systems. The basic notion of a microkernel consists of devolving as much functionality as possible into processes rather than the kernel itself; different systems take different approaches to implementing this.
For example, some systems (such as Mach) leave device drivers in the kernel, and place higher-level services (such as file systems) outside; others (such as QNX) move device drivers outside of the kernel.
However, anecdotal evidence [93-03-03-07-56.52] suggests that the distinction between microkernel and monolithic architectures is becoming more blurred as time goes on, as the two advance. For example, most modern monolithic kernels now implement multiple threads of execution and fine-grained parallelism. Architecturally, this approach begins to appear similar to a microkernel with several kernel-space processes working from shared memory.
As an aside, people often complain that the Mach system can't be a `real' microkernel, because it is so large (at least, this is the argument most frequently cited). However, I have been told that automatically-generated code stubs contribute very significantly to the size of the kernel, and that some size reduction would be likely if MIG (the stub generator) produced better code. [Can someone from CMU comment on this?] As mentioned above, the leaving of device drivers in the kernel also contributes to Mach's size.
Debating microkernels versus monolithic kernels on the basis of kernel size misses the central, architectural point. In the same way as the point of a RISC processor is not to minimise the instruction count, but rather to make a different tradeoff between what is implemented in the processor instruction set and what is implemented in other ways, the microkernel architectural issue is to determine which services are implemented in the microkernel, and which services are implemented external to that microkernel. By making appropriate choices here, the goal is to enhance various OS attributes in a manner that might not be addressable with a monolithic kernel OS. System attributes such as performance, flexibility, realtime, etc. are all variables which are taken into account.
MS want to bve able to change there EULA after you've bought the product, I'd love to see the zlib people GPL theres, then sue MS when they don't comply.
This would force MS eithe to pay up, or go to court and fight against the very thing they want.
The Kruger Dunning explains most post on
Please tell me: what does HURD rhyhme with?
Trollnificent!
even if that is true, ftp, telnet, and several other command-line network utilities are obviously of almost pure BSD origin.
Slashdot, the site where everything's made up and the points don't matter
it's a double-free problem. the two are totally different.
read all about it : http://www.gzip.org/zlib/advisory-2002-03-11.txt
-c
I have discovered a truly remarkable proof which this margin is too small to contain.
Firstly, I have heard this several times before, so I suspect it is true. Secondly, the telnet and ftp *clients* are hardly critical parts of the TCP/IP *stack*.
I bet some is in there! I just bet! For god's sake, someone less lazy... um I mean less busy, than me, find GPLed code in Microsoft. I want RMS to make us all call XP GNU/XP.
-pyrrho
Well first off I've gotta say:
HA HA!!!!!
Are any of us REALLY surprised at this though? This is Microsoft afterall. Even my chemistry TA was complaining about them today...
Derek Greene
It means nothing. It's just a widespread () but low-intensity) disaster, and MS customers happen to be among the victims.
If there's a lesson about security in all this, it has something to do with static linking. Or maybe something to do with extreme (over??) standardization, where everyone and their dog ended up using the excellent zlib.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I realize that as time goes by many fixes will be needed for WinXP.
Fortunatly, it has a pretty cool feature called Windows Update. It scans your system and tells you what fixes you need.
Even cooler is that it will also look for fixes that your other programs and hardware need - like new drivers for your vid card or an update to Office.
They also keep a record of all the fixes and updates that you have installed and makes it easy for you to remove them. So far my system has had 26 upgrades.
So I am sure that when and if a fix is needed, XP users will get it extra fast.
On a side note, I was always a cathedral fan. Proof? Name one DECENT game that was produced with OSS. Yep, thought so.
From the advisory
I know most people here know this, but for some reason this bug has gotten an almost hysterical spin in the media. This is an example of the community responding to a potential risk, before any damage is done.
All these articles that rave about millions of systems being vulnerable seem to forget the fact that nobody has been affected.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
No. When one types "help", the command listed above "view FILE" is (surprise!) "ls". So it's not a mistake per se (as implied by your 'oops').
Of course, it's still an indication that yes, they probably ported nslookup from elsewhere.
From the ZLib page:
There is a security vulnerability in zlib 1.1.3 that can be exploited by providing a specially crafted invalid compressed data stream to zlib's decompression routines that results in zlib attempting to free the same memory twice. On many systems, freeing the same memory twice will crash the application. Such "double free" vulnerabilities can be used in denial-of-service attacks, and it is remotely possible that the vulnerability could be exploited in some application to execute arbitrary code with that application's permissions. There have been no reports of any exploitations of this problem, but the vulnerability exists nevertheless.
It would take some pretty slick work to actually get something to execute arbitary code with this particular bug, but, it's possible. So it does raise the risk level back to what you originally stated, Garett.
Davis Ray Sickmon, Jr - looking for something to read? Check out my three free novels at MidnightRyder.org
Ah, but what if we made GPL'd code that was so good and so far ahead of everything else, Microsoft didn't have any choice but using it in their products... nah. They wouldn't be able to sell any licenses that way. It would be financial suicide.
'Cept if it's some product they give away for free anyway, like IE.
...since DOS doesn't have a command called "pg".
Simpli - Your source for San Jose dedicated servers and colocation!
"I beg your pardon, this looks like the same level of Inovation microsoft has been doing since Day one.
port basic
buy qdos
borrow from Apple and Xerox
borrow from BSD
borrow from open source.
...."
Ah, much like Red Hat, SuSE and Mandrake then.
Seems like Microsoft got the point of Open Source long before Linus Torvalds started hacking away: it's all about borrowing.
Your information is slightly outdated.
The BSD license no longer contains the advertisement clause, and has not contained it for some time.
If one must troll, one must learn some facts first.
Probably not, does the name Trumpet WinSock ring a bell?
But knowing microsoft, IE is probably inter-mixed with the TCP/IP stack
You should take a look at this.
I guess that explains it all, and if not, you had a good laugh.
And if you didn't laugh, you should learn to relax but
Doesn't this violate the GPL?
As I recall, this was only an issue if you had a double-free because of glibc, and I believe the original article specifically singled out Linux because it was dependant on the specific behavior of glibc.
How is this an issue for Microsoft software?
I took the license from the FreeBSD website
Check the url in my post
This just points out the difference between proprietary code and open code. Those using open code incorporating this flaw have had a fix available for days (if they choose to patch and compile the source). Those using proprietary code incorporating this flaw will have to wait for the vendor to release a fix, if ever.
If that's not a good arguement against depending on proprietary code (as for running a business), try this: If the flaw was not in open code incorporated into the proprietary code, but rather existed exclusively in the proprietary code alone (yeah, right -- proprietary code with bugs! LOL :-) then we might never know the flaw existed, let alone get a fix, unless some cracker with ethics told the world when they found the flaw rather than keep the exploit to themselves.
If all this should have a reason, we would be the last to know.
Okay, I'd like to make several points about the comments in response to this topic.
...He wasn't some bumbling code-stealing idiot that you guys would make him out to be.
Where do you guys get the idea that Microsoft is full of inept and lazy programmers? That just doesn't make any sense. I, for one, have talked to several Microsoft employees that have come out to my university (Michigan State) for presentations, and they all say the same thing: People who work there have a genuine passion to make good software. If you don't have the drive and motivation, you won't succeed. I mean honestly, I'm certain there are many great open source programmers, BUT, they've got to earn a living some how. If you are very talented, I'm sure a large corporation like Microsoft would pay you VERY well for your skills. I'm sure they have a lot of applicants, and as a result only hire the best. It would only make sense.
Last year the lead developer of the C++ compiler team made quite the lengthy presentation in a nearby hotel auditorium. I don't know compilers that well (I'm EE, not CS), but I'll tell you this much...that man is a genious. He really knew his stuff, and it was evident by the reactions of the CS professors in attendance. He, as many of the Microsoft employees have stated, seemed to really like his job.
Its stupid to bring up the GPL or other open source licenses or argue about whether Microsoft is stealing code. I'm glad they use zlib. I'm glad they used portions of the BSD tcp/ip stack. I'm glad they decided to support (to the best of their ability) standards like C and HTML. I'm glad I don't have to depend on Microsoft anymore. But if they hadn't used open source programs I'd have never been exposed to other options except for the likes of Novell and Sun.
The real issue is that there is now a direct comparison on a shared bug (for which no exploit exists yet, let's not forget -- it's still theoretical) in both the free and proprietary systems.
You can see the cooperation and disclosure *and* resolution on the open source side. Did Microsoft even admit to the vulnerability which they surely (one hopes) knew existed in their own systems? No. That's not the issue either.
The great benefit that comes to open source from this is that now you can observe the different security and development models in action from a purely objective point of view.
Fortunately, for Microsoft and their customers at least, this is not so serious a flaw that it will likely be exploited before they can get fixes out -- if they really want to. Even more fortunately for Microsoft, there are already enough vulnerabilities with easy and existing exploits, that the zlib vulnerabilities will probably be a non-issue. Hackers will tend to follow the path of least resistance.
Actually, it comes from VMS. VMS is so alien to the UNIX way of thinking. So, Windows is basically a hodge-podge of VMS plus some System V additions, and a pretty shell.
If you're not a Liberal in your 20's, then you have no heart.If you're still a Liberal in your 30's you have no brain.
Microsoft hires a lot of smart programmers and system designers who make intelligent decisions about how to design software and what code to re-use. Microsoft's programmers use open source code because it's good, it's standard, and it's familiar to them.
There are also a lot of competent programmers squashing out the bugs at Microsoft, but a large company has a lot more red tape to go through before anything is released.
The majority of Microsoft's products are good, but not always the best in their field.
Microsoft's flagship product, Windows NT/2K/XP, is an advanced operating system that strikes a good balance between security and backwards compatibility. Except for the tacked-on Internet Explorer interface, it's robust, feature-rich and modern with a very broad hardware support.
Microsoft is also very skilled in both adapting to and manipulating the market, and at using it's dominance in one market to gain dominance in others.
Microsoft knows that putting GPL code in a closed source product would open them up to lawsuits, so they avoid it at all costs. The article even mentions that Microsoft developers are banned from using GPL source code. They have used non-GLP code before, and in every case they have complied with the associated license. I wish we could put these silly accusations to rest. The only supporting evidence anyone has given is "because they're Microsoft".
Yes, I am a somewhat technical person, and that's why I'm asking. I know what buffer overflow is, and the zlib issue is not it. This may be an issue, but surely something that doesn't require this much coverage or worrying.
"...However, the team hasn't yet determined which applications use the library and whether those applications are vulnerable. "
You're telling me their own people don't know what products uses what? Either they want to see if they can deny the use of zlib or they're just clueless. The lather seems more possible.
[alk]
It is NOT a buffer overflow. Every is happy that your karma whoring because you know what a 'buffer overflow' is but your also helping spread this FUD.
The problem in zlib is a double free. It is only, and I repeat, only theoritically possible to exploit this in the same way that it is theoritically possible to exploit any undefined behavior.
Please don't counter with a traceroute exploit being an example of a double free because it wasn't. That was an example of free a garbage random data. There is quite a difference.
At any rate, please think before you post. I cannot believe everyone is making such a fuss over this. It's funny because XP's whole TCP/IP had a remote root hole in it and less noise was made here then is being made now over something that is only theoritically possible to exploit and also not yet proven to be reproducable.
Right now, this 'security issue' is entirely theoritical.
int func(int a);
func((b += 3, b));
They're not dealing with a fairly small number of reasonably savvy users who go to read slashdot, discover that zlib has a bug and decide to go fix their systems. MS deals with millions upon millions of 'ordinary users' who run dozens of programs that have zlib linked statically (we've just been told) and who have absolutely no idea what zlib is, what their systems use it for or how to patch it (well, they can't, because it's statically linked). So it makes sense for MS to determine first which apps are affected, in what way (is DirectX ever going to run into this problem? if yes, what are the consequences? if no, or if the consequences aren't serious enough, getting millions upon millions of clueless users to download a DirectX patch ASAP isn't worth the trouble). I agree with you that they should have information handy on which of their apps link to zlib, but who's to say they don't and they're just taking this time to conduct a risk inventory (they're a big ass bureaucratic monstrosity after all)?
News and bla for computer musicians: http://lomechanik.net/
I'm curious too. Why should we believe a fish tale like that when Win2K still has an /etc/hosts file embedded into it?
A Pirate and a Puritan look the same on a balance sheet.
I have spent alot of quality time with 2000 (migrate from NT4 to Win2000 AD = no fun ). Most people hate it because the have to use it at work, even though there are better alternatives. MS bashing goes on because their products .... WTF why am I explaining this to you, SHUT UP TROLL.
The zlib incident has clearly demonstrated how well the Linux security model works. Within 24 hours after publishing the vulnerability, Linux servers were fixed all over the world, and still nobody seems to know how much Microsoft products are vulnerable.
We will probably see more and more software and code that runs on both open-source platforms and on Windows, which means that we will also see more incidents where Microsoft's security service performance can be measured against the competition.
InstallShield has lost the lead in ease of use to InstallAnywhere. It doesn't use anything from Microsoft, and performs better for the other platforms as well.
I dig it.
http://www.zerog.com
/plug
Your Technology General Contractor http://www.birddogdigital.com
Well no crap...I didn't say they were part of the stack...my point was that Microsoft uses open source code all the time...I just used the example of BSD
Slashdot, the site where everything's made up and the points don't matter
That's the 4.4BSD license, a license that predates FreeBSD (and the other open-source BSDs). It contains the dreaded "advertising clause," which is (IMHO) rightfully viewed as non-free. That's why FreeBSD uses this license which drops the advertising clause and is almost universally viewed as a free license; the other open-source BSDs did the same thing.
I hear all these people about a flaw in the MS OS ?
Maybe there, but its fixxed probably, now what i wonder about is when they come with the patch.
But then i also read some thing about the a difrent C version of MS, so maybe they dont need the fix.
Now i wonder why i even wrote this..
Quazion
Can someone please explain why zdnet and news, etc. are all on a non-existent domain?
; > DiG 9.2.0rc3 > news.com.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER
I don't get it. com.com seems to be some kind of travel agency. Any ideas?
(Sorry for the offtopic question)
Microsoft's fast responces to security issues is a recent event. They do not have a history of fast responce. But they do have a history of putting out fixes that cause problems. It is common practice to delay rolling out hotfixes and service packs to allow for discovery of these bugs and subsequent fixes.
Yep. That's why CodeRed and Nimda weren't able to do much damage. Oh. Wait.
Nice statistic. Got a valid reference for it? Or is that just a bogus number to make your rant sound nice?
People often confuse Microsoft's marketing savvy with their technical ability. They are a technical company who excels at marketing. You're crowing about their marketing. This is a technical issue (information security is not a marketing issue - despite how many companies, MS included, tend to handle it).
If the BSD license no longer has the dreaded advertising clause, then how does it differ from the MIT license? Why doesn't FreeBSD simply switch to the MIT license? Maybe there is some university rivalry.. or maybe they don't want to rename their project to "FreeMIT". ;-)
cpeterso
Name a better alternative. Windows 2000 is easy to deploy on a variety of harware, easy to use, and has well supported software. The gotcha is that it costs lotsa money to license. Can you honestly tell me there is a better alternative? The only alternative I have as a 3D Artist is Macintosh. And though I'd like to have one, Windows works on the hardware investment I've already made.
Linux is hard to install, requires a more knowledgable support people, and has less driver support. This is why Windows is big in the corporate world. Obviously Microsoft isn't so bad if it's doing what people are paying for it to do.
As for being a troll, a troll rarely makes a good point. Getting back to my original point, this attitude of "It sure is cool to hate Microsoft" is blinding people to alternatives that may very well work for them. Call me a troll for disagreeing with you if you like, but I'm not-anti Linux.
"Derp de derp."
I hope this forces more people to use the GPL and get away from the "steal this software" type of licenses like the BSD. I think M$ owes a lot of open source developers some serious money and has another person pointed out maybe they can change their license to the GPL and sue sue sue!
Give me a Gundam: Mobile Armor suit and I'll make the world a better place!
NOT crashing on a double free might be just as bad (or worse) than crashing on a double free, since it generally means somebody is accessing a free'd pointer for other reasons (prior to the second free). In *this* particular case, allowing a double free might be better than not allowing it, but in general, ANY program that does a double free probably has far more destructive bugs hiding in it.
I bet part of the reason MSFT is so averse to having its precious source code inspected is the possibility it contains GPL'd code that infringes on the license.
This is exactly why software is not all GPLed! There are some things that are good for everyone and keeping it all to yourself is just as fucking shithead of you as it is of MS.
doubtful...
http://research.microsoft.com/university/ntsrcli ci nfo.asp
Microsoft® makes source code to Microsoft operating system products like Windows XP, Windows 2000 and Windows CE available to universities and other "not-for-profit" research institutions at no charge. Currently, there are over 100 universities worldwide with our source licenses.
This is again Mundie piping up with that stupid argument, that the GPL is bad because it limits the licensees choices. Now where's my choice when i want to develop using Microsofts sourcecode (if i can get my hands on it, even some governments can't)? Well, i have to accept Microsofts conditions. With the GPL and similar licenses i have to agree to the conditions of the respective authors (which choose the GPL as a license). So where's the difference? I'm sure it's easier to satisfy the GPL than Microsoft anyway. If only someone would ask what Microsofts conditions are for using their sourcecode when Mundie goes on a rampage again, that should shut him up for good.
Meanwhile the TCP/IP stack and now the zlib (and probably some other open source software Microsoft choose to make money off) shows what all that rhetorics of Mundie really is about: They want to take without giving, and they have seen that there's some nice open source software they'd like to get their hands on if only it weren't for that pesky GPL. Apparently that there's some open source software, that's too good to ignore, even for innovative Microsoft. It's really unfair that the GPL is asking Microsoft to share with others if they want to benefit from that software.
--
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
This is a "bug" in the webpage... someone forgot to update it apparently, since the 4.4BSD license has been updated years ago. Check the addendum here:
L ic ense.Change
/usr/src/gnu or make sure he doesn't ship any of them, which for a lot of applications is not necessary anyway.
ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.
The removal of the advertising clause retroactively applies to any BSD licensed sources that Berkeley has the copyright of, including 4.4BSDLite which FreeBSD is based on, and since the FreeBSD additions are covered with the FreeBSD license which is the BSD license without the advertising clause and references to the "Berkeley Regents" replaced with "FreeBSD Project", this effectively means that there is absolutely no advertising clause issue.
There are of course some non-free (in the BSD sense, I am not trolling!) sources, most of them GPL, however if one is looking to release modified FreeBSD binaries without providing the source, he can simply rm -rf
I'm glad it demonstrates something. It sure as hell doesn't demonstrate that OSS is more secure because of more eyes!
Installshield that is. MS has the "Windows Installer." Installshield is a separate entity.
How could this affect PHP4's use of zlib? I assume this is used when you use gzip compression on pages using the ob_handler?
You couldn't tell SysV from VMS by their installations. Shut the fuck up you naive teenager and stop "flashing words" to make yourself appear somehow intelligent. You appear stupid and pompous. LASTLY, The shell model Windows followed was dropped long ago. Fuck off.
When this "security flaw" affects LINUX, you simply title the article "software bug" but when it affects Microsoft straight away its a "security flaw".
TALK ABOUT BIASED!!!
I will ignore your comment as you have NO idea what you are talking about.
If you're not a Liberal in your 20's, then you have no heart.If you're still a Liberal in your 30's you have no brain.
That's true, they never have written an OS from scratch. Windows 9X is DOS-plus-GUI-shell and DOS was derived from QDOS; Windows NT is DEC's MICA, broken and in fancy clothes, and 2k, XP, Longhorn etc are all derived from that. What about CE? Maybe that's why you need an expensive mega-micro-beast to run it on.
If MS truly want OS security, why not just wrap their user interface around OpenBSD? The licence allows it, provided credit is given (and that can be done in very fine print).
Got time? Spend some of it coding or testing
Mandrake, for example. That and any other package for which this was straightforward to do.
Got time? Spend some of it coding or testing
For your compiling pleasure, Mandrake 8.2 includes a tool to do just that. But you will also have to grep the entire source tree to catch self-included static copies of zlib. Just be glad that you can do this. (-:
``Hello, Microsoft Technical Support here. Can I have your money, er, support number please? ... Thanks, OK, now what seems to be the problem? ... Rebuild from source? Sir, don't you mean reboot...?''
Another fine reason to give money to Mandrake instead of Microsoft.
Got time? Spend some of it coding or testing
:%s,rebotted,rebooted,g
The security vulnerability is due to zlib trying to free the same section of memory twice. The glibc memory allocation routines aren't very smart, and will cause heap corruption if you try to do this. This heap corruption can be exploited.
The Microsoft runtime libraries have smarter memory allocation and deallocation - attempting to free the same area of memory twice does not result in heap corruption. Consequently the zlib bug isn't a security vulnerability in Windows.
Gosh, what else do they make besides a second rate search engine? That there is no security on M$ is no secret.
Their response according to the article is:
Microsoft representatives said that the software giant's security response team is investigating the zlib flaw and that some Microsoft applications use code from that compression library.
Meanwhile, in a dark Seatle back room someone is running "apt-get update" for a fix! Well, that's what I did. No problems now.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Yeah thats true.. I mean when you have alot more eyes looking at something no matter how long it takes to find it'll eventually be found, one way or another.
When you have a small pool of eyes not even bothering looking you don't find anything.. So obviously it's more secure.
Dumbass.
Well, that could be. I don't have any problems with my M$ software. It sits on floppies and CD's where it can be installed to use some obscure piece of hardware on a second rate computer never attached to the internet. Most of the time, however, it never causes problems.
Bad Microsoft, bad! Quit saying that free software is unusable while using it. Oh yes, good luck hunting thought that vast tree of poorly documented closed source junk you have been purchsing from other companies for the last ten years. Is this what you will build the Digital Rights Management Operating System, TM and patented use of other people's code? Slap! Crack! What a joke of a company. What shall become of all the M$ stock when the world figures out that M$ is the equivalent of an Ice Vendor in Antartica?
They wanted to be the asshole in the middle, stripping ideas and programs from others, to sell as The Sole Operating System. All the people they ruined could be hard at work fixing their codes. Now, those codes will continue to be distributed unmodified. The task is too great for a single company. Like most such ventures, in the end Microsoft can only manage to be assholes.
Friends don't help friends install M$ junk.
Do you think linux does not use zlib ?
Dude, the King of the World doesn't bother challenging. He merely questions with a smile. Surely, I cannot be expected to believe a post without evidence as to do so would pollute the mind.
--Giving to trolls for the benefit of us all
Seriously - they should come up with some small little product that it doesn't matter if they have to release the source code to. They should put some GPL'd code in there - perhaps not even try to hide it too much.
And then they should see what happens. I guess they figure not many in the GNU crowds care much for them anyway, so they won't lose "loyal customers".
However, it'd either do two things:
a) show MS that it doesn't matter cause no one dared to file a suit
b) give the GPL it's day in court and see what happens.
The only downside is that whoever decides to take this to court better be loaded. It could be a long uphill battle.
It would be interesting to see the outcome though...however with MS's legal team, perhaps it may not be a good outcome.
There is another interesting point to make here. The origional poster implys updates will be slow to trickle in to the Linux install base, while Windows Update offers a shortcut to the process. Microsoft's Windows Update service is not unique. Its not even first of its kind. Linux distributers such as Redhat and Mandrake have long offered a simular service. Debian has had such a system in place even earlier.
In short, Windows Update provides neither a panacea nor unique solution to the issue.
I'm afraid you misunderstand the license. What you suggest still involves linking your program to the GPLed code at runtime, which is expressly forbidden by the GPL.
Besides, you have to release the code of the wrapper library under the GPL, which in turn requires you to release the code of your other program under the GPL as well. The chain will continue no matter how many "wrappers" you write.
still nobody seems to know how much Microsoft products are vulnerable.
No Microsoft products are vulnerable, just like no Net/Open/FreeBSD programs are vulnerable. The zlib bug doesn't ripple down into the system and become a security flaw except on the only OS that has embraced glibc, and that is Linux.
Get it through your thick fucking head, dude.
Sorry. There are eye and there are eyes. Clearly this demonstrates that just throwing it out into the world and hoping that eyes at random will find the bug isn't a foolproof strategy.
I am really tired of the 'few eyes/many eyes' meme and how it's turned into a dogma.
Sorry, Eric Raymond didn't reinvent Software Engineering when he wrote his diatribe. There are many other far more experienced people out there doing a better job, some not even based on crappy neo-pagan metaphors and matchbook-cover political economy.
add C:\windows\command\fdisk /mbr to your friend's autoexec.bat file. It prevents certain boot sector viruses.
Slashdot requires you to wait 20 seconds between hitting 'reply' and submitting a comment.
It's been 14 seconds since you hit 'reply'!
If this error seems to be incorrect, please provide the following in your report to SourceForge.net:
Browser type
User ID/Nickname or AC
What steps caused this error
Whether or not you know your ISP to be using a proxy or some sort of service that gives you an IP that others are using simultaneously.
How many posts to this form you successfully submitted during the day
* Please choose 'formkeys' for the category!
Thank you
-------
yeah, fuck off, Rob. I had a constructive comment, but now I'll just leave this shit instead.
"Bug found in open source software"
And so Microsoft gets ranted against?
I know Microsoft has lots of security flaws, but subscribe to bugtraq, debian security etc... and linux has a LOT of bugs too. Seriously people...
Um, what the heck are you talking about?
Does anybody know if Trumpet Winsock uses zlib?
We all know Microsoft doesn't use Trumpet Winsock, but this fellow, er, asked first...
Windows 95/98/ME/NT3/NT4 all have a hosts file, too.
It's, umm, a functional method of establishing a static host table. Hell, I use mine to block images.slashdot.org so I don't get any of the spam or pretty BS when I read this site.
Yet again, the slashcode censors my comment.
Slashdot requires you to wait 2 minutes between each successful posting of a comment to allow everyone a fair chance at posting a comment.
It's been 1 minute since you last successfully posted a comment
If this error seems to be incorrect, please provide the following in your report to SourceForge.net:
Browser type
User ID/Nickname or AC
What steps caused this error
Whether or not you know your ISP to be using a proxy or some sort of service that gives you an IP that others are using simultaneously.
How many posts to this form you successfully submitted during the day
* Please choose 'formkeys' for the category!
Thank you
strings will display ASCII strings embedded in a binary.
With the additional '--print-file-name' option for the GNU binutils version, it's even more useful.
From Windows NT 5.0:
[trisk@kainga:/vfat/windows/system32]% strings --print-file-name *.exe | grep 'Berkeley'
nslookup.exe: @(#)nslookup.c 5.39 (Berkeley) 6/24/90
nslookup.exe: @(#)commands.l 5.13 (Berkeley) 7/24/90
nslookup.exe: @(#)debug.c 5.22 (Berkeley) 6/29/90
nslookup.exe: @(#)list.c 5.20 (Berkeley) 6/1/90
nslookup.exe: @(#)subr.c 5.22 (Berkeley) 8/3/90
nslookup.exe: @(#)skip.c 5.9 (Berkeley) 8/3/90
nslookup.exe: @(#)getinfo.c 5.22 (Berkeley) 6/1/90
nslookup.exe: @(#)send.c 5.17 (Berkeley) 6/29/90
[trisk@kainga:/vfat/windows/system32]% strings --print-file-name *.exe | grep 'Regents.*University of California'
finger.exe: @(#) Copyright (c) 1980 The Regents of the University of California.
ftp.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
nslookup.exe: @(#) Copyright (c) 1985,1989 Regents of the University of California.
rcp.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
rsh.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
The double free bug in zlib doesn't affect MS systems since the msvcrt lib isn't affected by a free of a NULL pointer. This article on CNet shows the need for pageviews.
Never underestimate the relief of true separation of Religion and State.
If I open ftp.exe (for Win95) with Notepad I see the following information:
Copyright (c) 1983 The Regents of the University of California. All rights reserved.
Looks like they do believe in inovation.
P.
And ofcourse they now support raw-sockets in WinXP. For average users by default. Who'll say "I saw that one coming" when a major WinXP based DDoS attack starts to rage the net?
Not Buzzword 2.0 compliant. Please speak english.
Reading up on the zlib licence, which is short and easy to understand, I find this clause:
The way I read this, if software uses zlib code, then the authors of their software must not claim to have written the code. Microsoft are not obliged to acknowledge the zlib authors anywhere, but if they make a copyright statement saying that the code was written by Microsoft, then surely they are claiming that they wrote the zlib code in their product, and are therefor breaking this clause?Does anyone know if Microsofts' copyright statements comply?
I am probably too late for this point to be discussed.
But microsoft tried to remove this protection in one of their Visual Studio services packs - the result - Microsoft's ( and other's ) programs crashing randomly all over the place. They quickly reversed the 'optimization'
More worryingly -that means that alot of programs are actually relient on that thin safety net!
As I've said before, non-GPL opensource licenses lead you to being a sucker. And that microsoft has used zlib so much should make the author(s) of zlib feel like big time suckers: Microsoft made the cash, you got blamed for M$'s lack of security auditing!
The current Slashdot moderation system is made by gay communists!
How would any university user know - they would not be GPL coders because of the NDA and fear of contamination. Perhaps Eben Moglen should find someone who can thoroughly examine the MS code who won't be writing anymore GPL code - but I guess MS would find some way of stopping that!
In your view, the society moves forward as a side affect of individuals pursuing BIG MONEY. I suspect that if you do some reading on just who are the people who create innovative technology you will find that they are people motivated only partly by money but much more for having a burning desire for the subject area they are addressing. BIG MONEY is made by those who can take other people's innovations and market them. Frequently, the winner is as much politically connected as they are financially astute. What motivates open source developers is the burning desire to "make a difference" in some way...in the area they care about - programming and software development. How about this, we won't worry about the "starving programmers" of the world if you stop worring about the "starving Billionaires" of the workd.
I want to be alone with the sandwich
The fact that people spent their own time on zlib is a liability.
/. readers believe it to be.
Spending money is a liability too, because all money is a representation of the amount of work it would take to mine an equal portion of gold. One has to also work to get money.
Their time is gone. They have nothing other than free source code which gains them nothing more than the ability to use that source code. They were not rewarded financially, nor was anyone else able to be rewarded financially for that particular program
Example: A free park would only be useful to society if people are restricted from charging and restricting others from and entering the park. Why then do we have parks? The makers are not rewarded, and no one else is entitled to be rewarded financially.
There are other factors that influence people to do things, e.g. emotional costs. If you see an addressed, stamped envelope on the ground, would you pick it up and mail it? If you answer yes, then, why did you do it? No one is paying you to do it, you did it for emotional reasons. If you answer no, then you are a defector. You better hope that no one knows about it. With anonymity comes increases in defectors, as people realize they don't have to contribute, they can just take. That's why the government makes taxation mandatory and not voluntary.
Humans are very emotional and that's what drives people to cooperate. Without that cooperation, society would never work. Individuals that fail to cooperate are viewed as defectors. People hate defectors and will go out of their way to punish them because they reduce the quality of... life.
(not that is matters too much, since there are many other compression tools).
Then why are you complaining?
Society does not move forward without using other's tools, but society does not move at all without monetary incentive.
Read what I said earlier.
There is a reason for money, and it is not for "evil" purposes despite how bad
No one is saying that money is evil.
Throwing out software because of how it was created is plain ignorance and wasteful.
Who is "Throwing out software?"
There are more useful things to be done than paying someone to rewrite a compression library.
And there are more useful things than rotting in jail, hence why smart people don't break the law, lest they get punished. As for lazy people, the punishment for not doing anything is that you have to write a compression library.
Do you really want "starving programmer" to become an actual phrase, much like "starving artist" or "starving musician?" This is what will happen, if FSF has its way.
You don't know that any of that would happen.
"This software" in the clause you've cited probably refers to the zlib library, not to the complete product it is used in (otherwise the "use this software in a product" wouldn't make any sense). Since Microsoft is not distributing a standalone zlib library, there isn't anything to misrepresent. I'm pretty sure they left the original copyright notice in the library's code.
BTW, I've been told that on the Windows XP installation CD, you'll find a file which contains copyright ackknowledgements for much of the software that they're using in Windows (e.g. the BSD license requires reproduction of the copyright notice "in the documentation and/or other materials provided with the distribution" when distributing binaries, so you'll find the BSD license in that file). I don't have Windows XP, so I can't tell you the file name. On the Windows 2000 CD or in the installed system I haven't found the file, but I guess they put it somewhere (anything else would be pretty dumb, given how simple it is to comply with the licenses we're talking about here).
Sig (appended to the end of comments I post, 54 chars)
Only Slashdot could be so arrogant/ignorant to attempt to present the zlib security issues as if it were an MS problem. Even the sub-title of the News.com article says: "A security flaw in open-source software used by Linux and Unix systems for compression may affect some Microsoft products that also use the code. " Slashdot is starting to make Microsoft look like a reliable sorce for non-biased information.
and going away....
Moments before I made the post I was reading about gzip's current buffer overflow in which you can pass a path on the command line that's more than 1020 characters and you will cause the overflow.
:O)
I confused this with zlib's problem and hence my claiming that zlib had an overflow.
I was wrong and I realized this a few minutes after posting. D'OH!
Anyway I still hope that my post helped someone to understand what buffer overflow's are about, even if it doesn't apply to zlib at present
--
Garett
Actually the stripping of the copyright notice from the bianary was a source of sore contention.
rpm-rebuilder
Got time? Spend some of it coding or testing
There are more than 10x as many OSS projects with more than 100k installations in the field than there are M$ products in the same boat. There are more than 100 distinct OSS products (not counting libraries and such, but including games) installed on this Mandrake Linux box which see use at least once a week, and it's doing nothing special. How many copies of Mandrake Linux are there in the field? Now add in packages unique to RedHat, SuSE, Debian...
Got time? Spend some of it coding or testing
If spending money is not a liability, then why are you complaining?
Money doesn't grow on trees, people have to work for that money. Spending money to buy a piece of software is therefor, a liability. Why is it a liability to m$ to have to work or spend money, but not to people? You seem to have this view that anything that stops you from getting money or that makes you have to work is a liability, since all that money comes from some magical pipe dream in the sky, just waiting for you to collect it.
It's an awfully slippery slope from GPL to Apocalypse. Don't be dramatic. All software is NOT open source. You could never have all software open source.. or all software closed source. You would have to make one of them illegal first, and there would still be underground OSS people. The only person trying to outlaw anything is M$ by lobbying lawmakers to stop the GPL, along with their heavy FUD campaign.
There are free parks all over the place. Some are run and owned by the government, others are small and run by their communities respectively. Where I live, we have a free community-run park where people grow plants, vegetables, and flowers. People who use the park have to cooperate and follow the rules, or they can't use the park. Without that punishment cooperation falls apart. It all manages itself with the threat of punishment for defection. The makers of the free park put restrictions on it, after all, free park does not mean "free for all," or free land for the taking, do what you want with it. Another example, the government gave away buildings and land recently via essay contest. They gave the buildings to community organizations, not to McDonalds, Kmart, or M$. If someone comes along and takes the land, puts toll booths in, then no one can use it.
Most people who code OSS have other jobs too. They still have to put restrictions on their code just like any other person. They have a right to license their code, M$ never had a right to their code in the first place, just as we never had a right to M$ code. Since OSS can be used to run a business, it does have economic value, just like "Central Park."
How did we get from one person picking up one envelope to trash-mail picker-upper? People drop their things all the time, some people who find them may choose to ignore or keep them, (Defection,) while some people choose to cooperate. I'm just giving you an example of defection vs cooperation, you changed the example, so now defection would be throwing all your trash all down the sidewalk, the reverse would be if the trash men threw out your trash can with the trash or vandalized your home and dumped the trash all over your lawn. Cooperation would be Not doing those things.
That is only one form of cooperation, (money for product) as I pointed out there are other forms of cooperation. The question is how good are the goods? When consumers buy a product that self-destructs via deactivation; if the computer box is deceptive, or has nothing in it; if the product forces you to pay for all sorts of other tied services, that's viewed as defection.
People make decisions on emotions all the time. When people see a label they feel good about, they may think there is equity in that product because they see it all over the place and are familiar with it. The cheep, no-label brand may be viewed with suspicion even though it may be better and cheaper.
Money is not what makes people cooperative, it's the ability to punish the free-rider, the threat of punishment; and the removal of anonymity, so that everyone knows who the free-rider is. Without these things, cooperation falls apart.
What you fail to understand is that cooperation takes two people; a business can defect too. Enron is a defector, M$ is also a defector. It has nothing to do with how much money bill has, but how he got it, through lies and deception. With the Iterated Prisoner's Dilemma Tit-for-tat is the best strategy. This means consumers need to defect to other platforms or find a way to punish m$ in the courts.
And so would everybody who has to reinvent the wheel every time M$ changes their closed source OS, closed document formats and interfaces, etc, etc.. That was the point of OSS, you don't have to reinvent the wheel. How is m$ any different when they put must-abide-by restrictions and limitations on their code?
I never mentioned M$. You seem to be on the defensive for them so forcefully. Do you work for them? My point is how can you complain about rewriting, e.g., GPLed code when you never wrote the code. That's like complaining because you can't "do nothing," and have a product in the end. People who are constant defectors sometimes end up wasting away in jail, but they can only blamed themselves, not the people they stole from. I should have said: The punishment for never having written a compression library, is "paying someone to" write a compression library.
"Let not him who is houseless pull down the house of another; but let him labor diligently and build one for himself, thus by example assuring that his own shall be safe from violence when built." -- Abraham Lincoln
That's amazing! Where are these numbers? Just Curious.
Software has greater value if it is high quality. The monetary concept can be a distraction where people start to demand money over quality, a model where the bottom line is all that counts, getting that vapor ware out the door, all bugs included. Some companies turn un-ethical when they realize they don't have to do anything at all, they could just gain from the money invested by others, and can take without giving, like Enron and as I said with vapor ware.
Your concept is that monetary value is the only value and it is wrong. An antique may have a higher monetary value because some crazy person collects them, or may have no monetary value whatsoever, yet someone may never part with it.
PS - M$ is saying OSS is bad, and BSD is the only good OSS, yet they're not even licensing their code under BSD, instead, they came up with this Shared Source that is afflicted with most of the same things they are complaining about under OSS. If BSD is so good, then why don't they use it? The message is: "BSD is good for our competitors." Anyone who takes advice from M$ on what to do with their code is naive. And lets see the taxes billy g has paid?! He doesn't, he just gets tax free stock options. Lastly, Scarcity and Artificial Scarcity are not the same thing.
http://www.newscientist.com/news/news.jsp?id=ns
http://www.nature.com/nsu/020107/020107-6.html
http://www.thegamesjournal.com/articles/Aggress
See also: The Voter's Paradox, The Volunteer's Paradox, The Prisoner's Dilemma, and The Tragedy of the Commons.
It's really cool to hate Microsoft. It sure is great that we get news of MS screwing up. Too bad nobody ever pays attention to the good things MS does. I bet that most ppl who bash MS have never spent time with Windows 2000.
Are those our only options?? We have to like all the bad things that M$ does and focus on only the good, or we can't ever complain or have any opinion at all? Is there ever any time that we can in fact, complain? If they do 3 bad things and 3 good things do we have to just let them do whatever they want?
"M$ destroyed the econemy, the software market, netscape, Java, etc... But they did that ONE good thing. Come on! That one good thing??? Huh?? One good thing?? We simply Have To let them go."
No, [M$] is using legally licensed code in their operating system, which happens to be BSD licensed. They are on an anti-GPL crusade, which is largely different. Get your facts straight.
M$ is against "OSS because it's viral" because they can't take without giving. They say "The least viral is BSD" because they CAN take without giving. Then they come out with Shared Source. Show me that M$ license that you can take without giving? Shared Source is not it. There is no relevant difference between Shared Source and GPL.
Microsoft is saying: "Don't use GPL, it's communism. Use BSD instead."
How is GPL communism and BSD not?! Is M$ opposed to communism in favor of socialism?!
It's like saying: "Killing is wrong because: Thou shalt not kill... But if you do, let me be the one who does the Killing. Other wise, it's wrong."
It's one thing to use BSD code, that's fine. But it's another to say "No one should put restrictions on their code except for me, because that's, like, communism." M$ is rationalizing again, and poorly.
So, Get YOUR facts straight.
A liability is something that drains your money. An asset is something that brings in money. Money is used to trade goods. In the old days people would make things and trade them. If I make a chair and you make a log of cheese, I can trade my chair for your cheese. Today we use money for trading of services. I work at the chair factory and you work at the cheese factory but we trade money. When one buys a product, they want to get it for the least amount they can get it, and conversely, the seller wants to sell it for the most amount of money they can get, because you are trading labor for labor. It goes both ways -- people value their labor. Spending it IS a liability.
Well, we could certainly give value to air and make people pay air tax, this would produce jobs, and money will magically materialize, since, as you said, society having to spend money is not a liability.
I hope that example shows you that you're wrong. When society needlessly has to spend money it is a liability. Things have value if people (in the market place) find them valuable. If people aren't willing to pay for your product you can leave the market place. The market has spoken and it said, "You lose." Simple, easy, Market driven. Ever notice how the free market is great until m$ starts losing their monopoly, and then they start crying about wanting to change the rules?
The Federal Reserve controls the value of money. One ounce of gold has use value equal to other commodities on the market that take approximately the same labor expenditure. When they raise the value of gold, the value of money goes down. In a free market, products are supposed to compete via improvements. The better product is rewarded. As products get better, the older products depreciate in value. Good or bad, that's a fact of reality. If you can't make better products, then the value of your software doesn't deserve value. That's what we call market driven. M$ doesn't want to play by the rules, they want to be the Federal Reserve of software. They want to raise or lower the value of software whenever they want to kill the competition, corner the market, or rob consumers. Increasing the value of software means that it will cost more for people to buy it.
You might call it "dramatic," but I call it the future. Read what I wrote to the other guy in the posts above. It's not the end of the world, but it may very well be the end of the consumer computer as we know it. Apple computer is in a very good position right now, as they own the hardware and the software. Once the anarchy takes its toll upon Microsoft's architecture everyone will move to bashing Apple. Why? Because Apple provides a single solution for consumer problems. They will then inherit all Microsoft customers. Forget choice of hardware. That will be long gone. Keep in mind, though, that this is if FSF philosophy becomes the norm. When "average" people start demanding free (no-cost) software. It's a stretch, yes. I do believe it is plausible, though. There is much value in coherent architecture, which I find very lacking in open source land (infact, it's the one thing I hate most about using Linux).
I call it dramatic bullshit fiction.
1. People bash M$ because they are chronic defectors.
2. Apple is not a propagandizing fascist monopoly at this time, M$ is.
3. More free software on the x86 platform would not make x86 platform obsolete, but have the opposite effect. That's one reason why m$-anticompetitive actions had little effect on people switching to Apple.
4. Apple is so isolated because they would be crazy to go up against m$ or suffer the same fate as OS2. I think Apple currently runs *nix software and would obviously choose to run x86 ware, if not for that obstacle.
5. How will FSF philosophy become the norm over night. I never saw any philosophy become the norm ever. It sounds like one argument against gays: "If people are gay then no one will make babies, all humans will die, blah blah." You don't like OSS, You're part of everyone.
6. Then, what are you getting so worked up about? Did you take your medication today?
Yes, it does. But, at what cost to programmers? If a business finds value in a open source program, then they will not pay programmers to build them one. Then programmer jobs will be lost, I'm sure. Should the business be entitled to a free ride? Someone had to spent time and money building the program they are now using. Which leads to the next quote.
Oh, my heart bleeds for the victims of a free market! You're going to have a heart attack when I tell you how the scribes lost their job when someone invented the printing press, Luddite. If programmers think they can make one piece of software and rake in the money for eternity then they won't have a job for long anyway. That's competition for you. Even m$ has to compete with themselves. How many new features can M$ add to a word processor? If people already have office97 they don't need officeXP. One of their bad solutions: software as a service, and Software Activation to help force people to upgrade when their software expires. There's that defection again. People already traded their service to you in the form of $$ for your software and they get a self-destructing product. Nothing! M$ is out of control. Consumers are angry.
You're going to shit yourself when I tell you m$ destroyed the browser market through anticompetitive actions. Netscape is a cottage industry. Please explain to me how it is ok for m$ to destroy the browser market but it's not ok for someone to make a better product? I guess they only like the rules when they work to their advantage. With its open nature, OSS can't be anticompetitive, unless you think that making the superior product is anticompetitive. But then you'd be misunderstanding capitalism or free market.
M$ is again defecting. Instead of playing by the rules and improving their products, they spend all their effort destroying competition any way they can, so they don't have to do anything. It costs less to attack and eliminate software advancement, or launch a propaganda campaign than to actually do work As long as they are a monopoly, they can sit back and still get paid.
Everyone should be able to get a good word processor without spending an arm and a leg, like AbiWord. Why should a business have to spend thousands of dollars on a word processor only to send out letters?! Does M$ want to reinvent the word processor for the next century? Why not just get that out of the way and move on to bigger challenges than office vapor ware. Nothing about OSS is forcing anyone to use it. Everyone in the world is not going to work for free just because one person can.
Downloading OSS software is not defection, it's already free. Taking source code, stamping your name on it, and never contributing back is defection. 'A' is not selling software, they are running a web based store. If they wanted to sell software they wouldn't make it free. 'A' has every right to license their code however they want. The rest of your argument is invalid.
I doubt that. Quality plays a part, but consumers today want features and coherency. Which is why many people will accept a Windows crash every once in awhile. They want to be able to print from any application and use the network from any application. They don't want to mess with configuration and installation details.
People don't accept a windows crash. Given the option, they would choose no crashing. I want to be able to configure whatever I want to, and even if I didn't, I know not a computer that never needs configuration. Windows needs more installation configuration than say, mandrake Linux, as it stands. People have this narrow minded idea that windows is so easy, only because they're familiar with it. Many foreigners will tell you how hard English is, but that's just because they don't know it. A good example of this is Opera. When I first used it I thought it was fast but weird and hard to use. Now I find it the most innovative browser around and can safely say with certainty, Opera has a better interface than IE. It has configurations out the wazoo, and I'm always learning new tricks with it. If you are a power user you need these things. People should not be reduced to the lowest common idiot. The fact that people use such products is not proof they choose crashes, and less features available to them.
In this sense, open source software based on the GPL mirrors the
That's just a slippery slope comparison to frighten people. A mighty claim even for a hypocrite. M$ "puts at risk the continued vitality of the independent software sector," in and of themselves, outside of M$, when they break the law. Why should they get upset if these companies are not going to make any money, ever. Isn't that what M$ wants? Should we punish people who offer free content? Where would the Internet be today? What about public TV or regular TV and radio, with commercials. They work by the same principal of Free content? Public parks, charity, free museums, mp3 musicians etc.
And, M$ said OSS is viral because one can't take without being tainted, yet shared source is viral in that same way. Microsoft gives away its browser and Internet mail client and free e-mail accounts. It must be m$ to which you're referring? M$
Ximian can do whatever they need to. No one is forcing you to use GPLed code. No one ever said that OSS was a get rich quick scheme. If you seek money, use another license. If you can't handle that, you have serious problems.