Slashdot Mirror
Microsoft, zlib, and Security Flaws
nakhla writes: "News.com is reporting that Microsoft's use of code from the open-source zlib library has led to possible security problems. The flaws in zlib were reported recently, and apply to several key Microsoft technologies, such as DirectX, Front Page, Install Shield, Office, and Internet Explorer. The article also mentions how this is not Microsoft's first use of open-source code in its software, but does point out that since zlib is not GPL'd they are under no obligation to release the source code to any of their products."
Any bets on how long before Microsoft issues a press release noting that this is yet another risk of using evil open source and open standards?
I do not deploy Linux. Ever.
Darn, and I thought they were caught with their pants down.
But to me it still is interesting that a company that is trying to stomp every competitor, and is spreading so much FUD about any sort of free or open software is using it themselves. (We all knew that, I just thought I'd emphasize it again.)
what?
Whoops, considering they advise not even reading open source for risk of integration of the code into their codebase and risking breach of the license.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
No way. M$'s doesn't perform well enough to have come from BSD.
It seems to be not the cae since Windows 2000 - did not they redo the stack for it? Am I right?
<^>_<(ô ô)>_<^>
Wrong. They advise not reading GPL code, not open source code.
That is quite a big difference.
How do we know they never used GPL'ed code anywhere?
I wonder if anyone is keeping a running tally since the security initiative started???
Here is another bug with the MicroSoft SQL server. They've got overflows in their stored procedures. No fix, but you can delete the files if you can live without them....
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Of course, having everything derive code from the same source is a risk; isn't this part of the reason the ping of death was so much of an issue?
You'd be right :), starting with Win2k, and in WinXP, they're using basically Unix TCP/IP sockets. Must admit that it does work much better than Win9x for network connectivity.
...if the government hadn't worked so hard to limit Microsoft's ability to innovate.
InstallShield is written and published by a company named InstallShield, and has been for many years. It is not a "Microsoft technology", but rather a technology that has support for creating software installation routines for Windows, amongst other OSes.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
I don't have any idea why MS chose to use the zlib library but it wasn't for "buglessness". MS creates enough of their own bugs they don't need to go borrow someone elses. Of course they didn't know about the bugs at the time, but still, methinks they used the code for less altruistic purposes.
Here's what I want to know: the zlib maintainers know that their code is heavily used in open source product, and they can easily use ldd on a typical Linux or *BSD install to find out exactly which programs use zlib. So they know who to contact about vulnerabilities. However, if Microsoft just takes open source code and incorporates it into their products, how will the zlib folks know to contact them prior to public disclosure? It surely can't be the responsibility of the zlib team to grep through every single closed-source binary out there in order to make sure that it didn't use zlib.
It seems like if there isn't a mailing list for every single library's security issues, then closed source vendors will become second-class citizens when it comes to getting forewarning about a big security announcement like this. This seems like what has happened to Microsoft in this case; otherwise they would have had a raft of fixes available when the original story was released, right?
The other alternative is the vendor early warning list idea that Microsoft has been pushing, but the problem with that is: the more people on the list (and you'd have to have hundreds of vendors in the case of a base library like zlib, I'd think), the more likely that one of them will leak the story to the black hats, so that the delay while vendors prepare patches becomes a liability for the unpatched public. That doesn't seem like a good scenario to me either.
Your right to not believe: Americans United for Separation of Church and
Comment removed based on user account deletion
Either way, browsing other competitor products code whether its free, open GPL or whatever is gonna be risky for a business in legal terms.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
Microsoft is still trying to determine which apps incorporated zlib code? My Linux box already has all its apps fixed. How long until M$ gets patches out? Weeks? Months?
How am I supposed to fit a pithy, relevant quote into 120 characters?
And yet again, it is being reported that this zlib issue is leaving a "hefty" portion of systems vulnerable to attack. Forgive my ignorance, but how? In the previous discussion on the topic, I read some posts that sort of explained a possible risk that might occur if there's a full moon and the lighting is just right.
So I ask you: what? From what I've heard the worst that could happen is your system could crash. I hardly see that as any sort of real issue, since programs like to do that all the time.
Of course, having everything derive code from the same source is a risk
Depends on how you look at it. If there were N completely independent TCP/IP implementations out there, wouldn't there be N times as many bugs (each one affecting 1/N as many systems, on average). Homogeneity means only one codebase to debug and fix. But of course when a bug is found, it affects everyone.
Is this another example of why MS needs to be free of regulation in order to Innovat...ively copy other peoples work?
Shame.
Stop Continental Drift! Reunite Gondwanaland!
Naive question probably, but if zlib isn't GPL then does Debian use a different library and if so, is it affected by this issue?
is if when they released the patch for the security flaw they made the patch GPL... just imagine Microsoft having to recode all that stuff for themselves :)
' Ore stabit fortis a fine placet ore stat '
- found on a park bench
"The zlib library has been a fundamental open-source software component for almost a decade and can be found in almost every Linux and Unix system. That means the so-called "double free" flaw in the library may leave a hefty portion of Linux and Unix systems open to attack. Because it adopted some of the code, Microsoft apparently has made itself vulnerable to the flaw as well. "
Disclaimer: I am not a security weenie, so I don't know this for fact......*deep breath*....
If this is true, why is it only news for MS? It appears that Linux and Unix is also vulnerable. So why only set up the article as MS related?
*bash MS* bash bash bash....it's popular right?
Sent from your iPad.
Argh! Bad statistics alert!
"vulnerabilities found in Windows and all Linux flavors combined are almost the same"
So if I am running RedHat, Mandrake, SUSE, and Debian simultaneously, I have the same number of flaws as a single run of Win2k?
They should either use the average (among linux dists) or the max (ditto), vs Win. Or sum across all current Win flavors (ME, Win2k. maybe NT) to compare against all linux flavors (summed).
Argh!
A.
Development Team,
Thank you! I have been saying for years that Open Source is EVIL! Now we have even more proof. With this latest failure of open source code we can push even more people into using our products. We can even say that we "tried" to use open source, and look what it brought us. Once again, Thanks! Marketing and I appriciate it.
-Bill
And Windriver or whoever controlled BSDI at the time made some serious cash in that deal. They got paid to make the tcp/ip stack work well in 2000/XP and they've done a good job of it.
I just wonder if Microsoft was able to taint some of the BSD coders by allowing them to view their code. I'm sure integrating something like a TCP/IP stack required access to some 2000/XP src code. Anyone know?
Can I get an eye poke?
Dog House Forum
http://www.gzip.org/zlib/apps.html
At least nine of Microsoft's major applications--including Microsoft Office, Internet Explorer, DirectX, Messenger and Front Page--appear to incorporate borrowed code from the compression library and could be vulnerable to a similar attack.
"Borrowed"? Whats the license for zlib?
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
Heh yah I've noticed that. It's really cool to hate Microsoft. It sure is great that we get news of MS screwing up. Too bad nobody ever pays attention to the good things MS does. I bet that most ppl who bash MS have never spent time with Windows 2000.
"Derp de derp."
The next-generation Graphics Device Interface is part of Windows XP, meaning that the operating system itself could be at risk.
:P
the colors were just screaming security flaw already weren't they?
Yet, the incident seemingly proves that Microsoft, despite dismissing open-source code publicly, has used software from others to create their own products.
And now they are forced to admit what we already knew, they haven't written anything original since...well...ever!
The zlib compression library doesn't use the GPL, however.
and the war between MS and GPL coninues, maybe the linux community could use Anime-based uniforms to storm microsoft and take the code back.
"The secret of success is to know something nobody else knows." -Aristotle Onassis
I've seen this so often that it's worth a comment.
The TCP/IP code in Windows NT is streams based - it was written originally by Spider Software in Edinburgh. It's a clean room implementation that does not have any BSD code in it (I know the original architect of it). And it isn't derived from the original Unix streams code - even the underlying streams layer was written from scratch. The same code is in use by many OEM's in embedded devices etc.
But perhaps that is why microsoft is so afraid to let the states in the antitrust case look at their code. If some one were to discovered they actually a lot of open source code, that would be a huge embarrasement.
No, Microsoft sucks because they've been on an anti-opensource crusade and are using open source in all their products. It's the hippocricy(sp?).
Can I get an eye poke?
Dog House Forum
Microsoft is an old hand at using public domain stuff! They don't dislike it... like all companies they grew used to swallowing it up! It's even cheaper than buying QDOS was.
No, the GPL is not about giving software away, that was already happening. It was about KEEPING software GIVEN AWAY.
-pyrrho
1. It was already written and IMHO they are too cheap to write thier own software 2. read #1 over and over ALSO they used it extensivly so if they patch.... look for TONS of new "feature/bug/phone home style apps to be inserted"
Why? Unless you incorporate it wholesale or re-use a patented algorithm, you do have Fair Use rights under existing copyright law.
I do not have a signature
Why?
Unless it's GPL infected it's not illegal to incorporate it.
Plus, once the copyright-abolish fanatics have had their way, all the GPL licensed code (which is all protected by legal structures based on copyright law) will fall into Public Domain anyway.
Yeah, I've got plenty of karma to burn as well, so those mods who feel it's appropriate to mod me down because I don't march to the drums can kiss my ass.
BTW, I use XP on my desktop and I love it. I use Debian on my servers and I love that too. Windows does not fit well on a server just as Linux does not fit well on the Desktop, why can't people understand that?
Hammer of Truth
Well, I could hope that maybe the reason is that lots of people might be familiar with zlib, but not know that it is under a non-GPL free software license, and they were just trying to stave off "Does Microsoft have to release their code now?!" type crap...
No, I don't think that's true either.
The enemies of Democracy are
How is reading, even verbatim copying, of BSD-licensed code risky in legal terms. The license explicitly allows incorporation into any type of software (commercial, open, or free). Microsoft could put out their own version of one of the *BSDs, with the only difference from it's base BSD being having the Windows GUI grafted on top of it and no source included.
The relevant passage in the BSD license (from http://www.freebsd.org/copyright/license.html ):
There are licenses that are the BSD license, less the advertising clause (it is the advertising clause that prevents BSD from being a free license according to the FSF), such as the MIT license. These licenses are the freest of all the licenses (short of public domain).
A guy with the email address 'fake@nospam.org' is challanging someone else's credentials??
heh
> have never spent time with Windows 2000.
I'm sure this is a typo. You must have meant "did time".
-pyrrho
As long as MS makes heavier use of OSS, they will be less prone to attacks.
They currently use the TCP Stack from BSD, they redesigned SMB services based on Samba (they had to cold room it due to GPL). This helps explain how MS is getting faster and less cracks.
Of course, this also explains why they oppose GPL.
I use Win2k on a daily basis and I hate it. But I take comfort in that my main workstation is a linux box, and the win2k box is there just because I'm porting code at the moment. But yes, I have spent much time with win2k. Much like a venereal disease, intimite knowledge of the subject doesn't make me want to bash it -less-.
The enemies of Democracy are
...that Microsoft uses free software, I invite you to take a look at this.
In Windows 2000, open a command prompt window. Type "nslookup". This will drop you into interactive mode for nslookup, which has been ported from UNIX (most likely BSD.)
Now type "help". Check out this line at the bottom of the output:
view FILE - sort an 'ls' output file and view it with pg
Uh, yeah. Oops.
Simpli - Your source for San Jose dedicated servers and colocation!
Heh yah I've noticed that. It's really cool to hate Microsoft. It sure is great that we get news of MS screwing up. Too bad nobody ever pays attention to the good things MS does. I bet that most ppl who bash MS have never spent time with Windows 2000.
I'll be more than glad to cheer when MS does something good. Wake me up if it happens.
ZZzz..
Well, I spend time with 2000, and its almost as good as kde and gnome.
And i've only got to crashes, which cause the machine to auto-reboot.
To have a really crappy product(s) then releasing something thats better doesn't mean the new thing is good, just not as crappy.
So what, exactly, has MS done thats good?
The Kruger Dunning explains most post on
That would be a great test of the GPL actually, considering it's never been actually tested legally. Remember that.
If something like that were to happen, I'd imagine that the GPL would probably be killed in court by high powered lawyers from all the major software companies (not just MS.)
Well it's easy to show that they use
code, at least. This is Cygwin / bash on NT4:
andrew@INEGO(22:18:47)
[path...]
Binary file FINGER.EXE matches
Binary file FTP.EXE matches
Binary file RCP.EXE matches
Binary file RSH.EXE matches
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
The next-generation Graphics Device Interface is part of Windows XP, meaning that the operating system itself could be at risk.
Am I right in assuming this won't effect NT4 and is a direct outcome of putting the GDI back in the kernel unlike in the true microkernel architecture like HURD?
heuristic algorithm seeks stochastic relationship
"if" M$ does use GPLed source, somewhere down the line it will come out.
Case in point. A GPLed piece of software has bug X, and strangly enough, a M$ product has the same bug.
It maybe worth the time to test major bugs in GPLed software against M$ programs if such simularities do exist.
Just a thought.
-- Knowing too much can get you killed, but knowing who knows too much can make you rich.
First off, its nice to know you'll stand up for what you think only if you have karma to burn. i.e. nothing to lose.
I won't use XP, because I don't trust it, at all. I'd like to see MS put together a nice OS thats trustworthy to me, not to the varies media orginiations, not to MS, to me.
The Kruger Dunning explains most post on
I think it would be better to take the -union- of the vulnerabilities across all Linux distributions. This would prevent duplicates being counted (if you did the operation correctly), but would give an idea for flaws that may exist in distros.
Though really, that doesn't give you a good view, because if certain flaws only exist in certain distros, then you would be free from those flaws in another distro.
And if you just took the max, that might show you that a certain distro is really bad for security, but not much about linux in general. If the max was much larger than the mean, then that would just mean you shouldn't get that distro.
Probably the best is to just compare each version of windows and each distro separately, and you can then make a decision that way.
The enemies of Democracy are
People have a stigma that there should be one solution to every single problem out that. It's like that in the 3D space. There are purists that believe that when you 3D render a scene, the image must be perfect when they go to hit the render button. They don't undrestand that it is okay to divide up your 3D work into layers and tweak each one of those seperately (i.e. color correction or sharpening). I guess they feel that the render program should be a 'perfect simulation of light' and that they shouldn't have to 'fix an image'. They fail to see that the best simulation of light we have (reality) even needs to be touched up from time to time.
I think there are anti-ms people who think that becaues IIS is insecure as a webserver, that MS themselves should die. There are people of the Linux world that wishes everybody would use Linux and forget Microsoft. They fail to realize that the adoption of Linux isn't slow because of MS, it's slow because it's not beating MS at doing what they like to do.
There's room in this world for both. If Linux becomes what Windows is in terms of usability, it will be every bit as bloated as MS. Don't believe me? Look at Redhat. Their default install wants to eat up a gig of space. Granted it comes with lots of apps, but it has its share of bloat too.
In any case, this isn't an anti-Linux/pro-Microsoft rant, this is more of a 'Be happy to have what you've got' rant. If MS disappears, what will fuel the fire to make Linux better?
It's in everybody's best interest if Microsoft does well, believe it or not.
"Derp de derp."
So we expect more Hotfixes or SPs for these products? When?
This highlights taking a dependancy on externally maintained code is risky. Turn around time in fixes and integration into the codebase, verification of the fixes for those products etc...
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
MS want to bve able to change there EULA after you've bought the product, I'd love to see the zlib people GPL theres, then sue MS when they don't comply.
This would force MS eithe to pay up, or go to court and fight against the very thing they want.
The Kruger Dunning explains most post on
maybe... try 'hippoCrickey' this is the sound the happy hippo hunter from Australia makes when successful in his hippo hunt
heuristic algorithm seeks stochastic relationship
it's a double-free problem. the two are totally different.
read all about it : http://www.gzip.org/zlib/advisory-2002-03-11.txt
-c
I have discovered a truly remarkable proof which this margin is too small to contain.
I can imagine porting code being a pain in the ass. I know MS's API is a little weird, and I can certainly understand you having issues getting down that deep into it.
Where I come from is I use Win2K for doing 3D animation. A lot of people I know doing 3D stuff are running on Win2k. We have to rely on a machine constantly rendering overnight, over weekends etc, and we cannot afford to have it crash. I've built a number of Win2k boxes in my time, and Win2k installation and setup is a breeze. I cannot say that for my experiences with installing Linux.
I've witnessed a number of Win2k machines of a huge variety of hardware (i.e. not custom made all from one provider) render for many many hours at a time and never crash. I have never lost rendering time to a Windows 2000 problem. None of my artist friends have ever complained about that.
Seems to me if a program can use so much Windows resources for so long and still behave properly, Microsoft must have done something right.
"Derp de derp."
Windows isn't for everyone. It's built from the bottom up (meaning it's targeted at the lowest common denominator user). For you, I'm sure that a trustworthy OS is one that you can pick apart and see the guts of... AND THAT'S FINE! I'm not saying that Linux is better than Windows or vice versa, I'm simply saying that some people don't care how their OS works and what dependency tree they need to check if they want to install an update for their laptop speakers. It's about ease of use versus lookig under the covers. Some of us don't care how the OS works as long as it does.
Hammer of Truth
then go to court to make them release all their software as Open Source.
More than likely, this wouldn't happen. The most likely outcome would be that a judge would uphold the clause in the GPL that forbids future distribution of GPL'ed code -- but I doubt that a few lines of GPL'ed code would cause a judge to require M$ to GPL, say, Windows.
Even if Microsoft had to GPL something, it's likely they could limit it to one application or library -- for instance, if they used GPL'ed code for something in Word, they would probably only have to GPL that version of Word and could excise the GPL'ed code from that version and release the next version under their normal licensing. Even if they violate the GPL, they still hold the copyright and the worst that could be done is force them to release one GPL'ed version of source code. But using GPL'ed code in one app wouldn't require them to release everything.
It would, however, be a big embarrassment to M$ and I wouldn't mind seeing them squirm a little.
I bet some is in there! I just bet! For god's sake, someone less lazy... um I mean less busy, than me, find GPLed code in Microsoft. I want RMS to make us all call XP GNU/XP.
-pyrrho
Well first off I've gotta say:
HA HA!!!!!
Are any of us REALLY surprised at this though? This is Microsoft afterall. Even my chemistry TA was complaining about them today...
Derek Greene
It means nothing. It's just a widespread () but low-intensity) disaster, and MS customers happen to be among the victims.
If there's a lesson about security in all this, it has something to do with static linking. Or maybe something to do with extreme (over??) standardization, where everyone and their dog ended up using the excellent zlib.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
From the advisory
I know most people here know this, but for some reason this bug has gotten an almost hysterical spin in the media. This is an example of the community responding to a potential risk, before any damage is done.
All these articles that rave about millions of systems being vulnerable seem to forget the fact that nobody has been affected.
It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
maybe because I use linux on my desktop and love it much more than XP and 2K, which I have also used.
to each their own!
From the ZLib page:
There is a security vulnerability in zlib 1.1.3 that can be exploited by providing a specially crafted invalid compressed data stream to zlib's decompression routines that results in zlib attempting to free the same memory twice. On many systems, freeing the same memory twice will crash the application. Such "double free" vulnerabilities can be used in denial-of-service attacks, and it is remotely possible that the vulnerability could be exploited in some application to execute arbitrary code with that application's permissions. There have been no reports of any exploitations of this problem, but the vulnerability exists nevertheless.
It would take some pretty slick work to actually get something to execute arbitary code with this particular bug, but, it's possible. So it does raise the risk level back to what you originally stated, Garett.
Davis Ray Sickmon, Jr - looking for something to read? Check out my three free novels at MidnightRyder.org
Actualy I do, at a rate of 2 BSOD's a week.. Of course that's only for unimportant "work related" stuff. My home system runs linux and hasn't been unvoluntairly down for a real long time now.. Neither have the systems which run my websites and databases..
Nobody expects the spanish inquisition!
...since DOS doesn't have a command called "pg".
Simpli - Your source for San Jose dedicated servers and colocation!
"So what, exactly, has MS done thats good?"
What, you mean besides using Windows 95 to make the appeal of computers so broad that nearly everybody has one? Or maybe bringing the internet out of the geek neighborhood and out into the main stream? Or how about making an OS that can install on such a broad range of hardware that you can cheaply put together a system running Windows?
Did MS do this singlehandedly? Nope, I'm not saying that. They were instrumental in it though. Despite how much everybody hates to admit it, Windows 95 had a HUGE part in making computers as broadly supported as they are today. I remember when having a computer meant you were a nerd.
Did MS use illegal tactics? Yep. They've done shitty stuff. They've made shitty products. I'm not disputing that. But they're not entirely bad either. As a matter of fact, it's MS's shortcomings that are making people fight to make Linux as a replacement to MS.
You can hate MS all you want, more power to ya, but if you're successful in the IT industry, MS was probably instrumental in that either directly or indirectly. No Microsoft? Computers = toys for geeks.
"Derp de derp."
As I recall, this was only an issue if you had a double-free because of glibc, and I believe the original article specifically singled out Linux because it was dependant on the specific behavior of glibc.
How is this an issue for Microsoft software?
"Name one DECENT game that was produced with OSS. Yep, thought so."
NETHACK!!!!
OK, I'll be quiet now.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
I took the license from the FreeBSD website
Check the url in my post
This just points out the difference between proprietary code and open code. Those using open code incorporating this flaw have had a fix available for days (if they choose to patch and compile the source). Those using proprietary code incorporating this flaw will have to wait for the vendor to release a fix, if ever.
If that's not a good arguement against depending on proprietary code (as for running a business), try this: If the flaw was not in open code incorporated into the proprietary code, but rather existed exclusively in the proprietary code alone (yeah, right -- proprietary code with bugs! LOL :-) then we might never know the flaw existed, let alone get a fix, unless some cracker with ethics told the world when they found the flaw rather than keep the exploit to themselves.
If all this should have a reason, we would be the last to know.
Okay, I'd like to make several points about the comments in response to this topic.
...He wasn't some bumbling code-stealing idiot that you guys would make him out to be.
Where do you guys get the idea that Microsoft is full of inept and lazy programmers? That just doesn't make any sense. I, for one, have talked to several Microsoft employees that have come out to my university (Michigan State) for presentations, and they all say the same thing: People who work there have a genuine passion to make good software. If you don't have the drive and motivation, you won't succeed. I mean honestly, I'm certain there are many great open source programmers, BUT, they've got to earn a living some how. If you are very talented, I'm sure a large corporation like Microsoft would pay you VERY well for your skills. I'm sure they have a lot of applicants, and as a result only hire the best. It would only make sense.
Last year the lead developer of the C++ compiler team made quite the lengthy presentation in a nearby hotel auditorium. I don't know compilers that well (I'm EE, not CS), but I'll tell you this much...that man is a genious. He really knew his stuff, and it was evident by the reactions of the CS professors in attendance. He, as many of the Microsoft employees have stated, seemed to really like his job.
Its stupid to bring up the GPL or other open source licenses or argue about whether Microsoft is stealing code. I'm glad they use zlib. I'm glad they used portions of the BSD tcp/ip stack. I'm glad they decided to support (to the best of their ability) standards like C and HTML. I'm glad I don't have to depend on Microsoft anymore. But if they hadn't used open source programs I'd have never been exposed to other options except for the likes of Novell and Sun.
The real issue is that there is now a direct comparison on a shared bug (for which no exploit exists yet, let's not forget -- it's still theoretical) in both the free and proprietary systems.
You can see the cooperation and disclosure *and* resolution on the open source side. Did Microsoft even admit to the vulnerability which they surely (one hopes) knew existed in their own systems? No. That's not the issue either.
The great benefit that comes to open source from this is that now you can observe the different security and development models in action from a purely objective point of view.
Fortunately, for Microsoft and their customers at least, this is not so serious a flaw that it will likely be exploited before they can get fixes out -- if they really want to. Even more fortunately for Microsoft, there are already enough vulnerabilities with easy and existing exploits, that the zlib vulnerabilities will probably be a non-issue. Hackers will tend to follow the path of least resistance.
People have a stigma that there should be one solution to every single problem out that. It's like that in the 3D space. There are purists that believe that when you 3D render a scene, the image must be perfect when they go to hit the render button. They don't undrestand that it is okay to divide up your 3D work into layers and tweak each one of those seperately (i.e. color correction or sharpening). I guess they feel that the render program should be a 'perfect simulation of light' and that they shouldn't have to 'fix an image'. They fail to see that the best simulation of light we have (reality) even needs to be touched up from time to time.
no. This "tewaking" only means that they have -failed- to get the correct result from their scene description in the first place, and that they must resort to manually tweaking the result instead of actually going back and modifying what was wrong in the first place.
You can and should modify your lightsources whenever you render something, because a 3D rendered scene is just that, 3D rendering. NOT a so called "perfect simulation of light" because that is left to the creator of the scene.
it is the scene creator that has to make sure he gets his lighting, world and all other factors correct for the desired result.
Bah. Paintbrush artists.
I didn't do this, now did I?
Actually, it comes from VMS. VMS is so alien to the UNIX way of thinking. So, Windows is basically a hodge-podge of VMS plus some System V additions, and a pretty shell.
If you're not a Liberal in your 20's, then you have no heart.If you're still a Liberal in your 30's you have no brain.
Microsoft knows that putting GPL code in a closed source product would open them up to lawsuits, so they avoid it at all costs. The article even mentions that Microsoft developers are banned from using GPL source code. They have used non-GLP code before, and in every case they have complied with the associated license. I wish we could put these silly accusations to rest. The only supporting evidence anyone has given is "because they're Microsoft".
Yes, I am a somewhat technical person, and that's why I'm asking. I know what buffer overflow is, and the zlib issue is not it. This may be an issue, but surely something that doesn't require this much coverage or worrying.
"...However, the team hasn't yet determined which applications use the library and whether those applications are vulnerable. "
You're telling me their own people don't know what products uses what? Either they want to see if they can deny the use of zlib or they're just clueless. The lather seems more possible.
[alk]
It is NOT a buffer overflow. Every is happy that your karma whoring because you know what a 'buffer overflow' is but your also helping spread this FUD.
The problem in zlib is a double free. It is only, and I repeat, only theoritically possible to exploit this in the same way that it is theoritically possible to exploit any undefined behavior.
Please don't counter with a traceroute exploit being an example of a double free because it wasn't. That was an example of free a garbage random data. There is quite a difference.
At any rate, please think before you post. I cannot believe everyone is making such a fuss over this. It's funny because XP's whole TCP/IP had a remote root hole in it and less noise was made here then is being made now over something that is only theoritically possible to exploit and also not yet proven to be reproducable.
Right now, this 'security issue' is entirely theoritical.
int func(int a);
func((b += 3, b));
"no. This "tewaking" only means that they have -failed- to get the correct result from their scene description in the first place, and that they must resort to manually tweaking the result instead of actually going back and modifying what was wrong in the first place."
Err okay. It's not a black and white situation. 3D programs do different things than 2D programs do, and its silly to limit your toolset by expecting it to come out of the renderer perfect.
Getting back on topic, it's like complaining that Windows 2000 is a crappy 3D workstation because it sucks as a webserver . The truth of the matter is that there isn't one grand unified solution that works for every little thing. Me personally, I'd rather use a Macintosh for my mobile needs, Windows 2000 for my 3D Workstation and gaming platform, and Linux running Apache as my web server, and Linux again as a mailserver.
"Derp de derp."
They're not dealing with a fairly small number of reasonably savvy users who go to read slashdot, discover that zlib has a bug and decide to go fix their systems. MS deals with millions upon millions of 'ordinary users' who run dozens of programs that have zlib linked statically (we've just been told) and who have absolutely no idea what zlib is, what their systems use it for or how to patch it (well, they can't, because it's statically linked). So it makes sense for MS to determine first which apps are affected, in what way (is DirectX ever going to run into this problem? if yes, what are the consequences? if no, or if the consequences aren't serious enough, getting millions upon millions of clueless users to download a DirectX patch ASAP isn't worth the trouble). I agree with you that they should have information handy on which of their apps link to zlib, but who's to say they don't and they're just taking this time to conduct a risk inventory (they're a big ass bureaucratic monstrosity after all)?
News and bla for computer musicians: http://lomechanik.net/
I'm curious too. Why should we believe a fish tale like that when Win2K still has an /etc/hosts file embedded into it?
A Pirate and a Puritan look the same on a balance sheet.
I have spent alot of quality time with 2000 (migrate from NT4 to Win2000 AD = no fun ). Most people hate it because the have to use it at work, even though there are better alternatives. MS bashing goes on because their products .... WTF why am I explaining this to you, SHUT UP TROLL.
So your W2K box crashes 2 times a week and you haven't fixed it? Have you even tried?
My W2K server has been up 196 days and counting. I've NEVER encountered a BSOD on my XP notebook.
Perhaps you should try upgrading your drivers to MS cerftified ones.
The zlib incident has clearly demonstrated how well the Linux security model works. Within 24 hours after publishing the vulnerability, Linux servers were fixed all over the world, and still nobody seems to know how much Microsoft products are vulnerable.
We will probably see more and more software and code that runs on both open-source platforms and on Windows, which means that we will also see more incidents where Microsoft's security service performance can be measured against the competition.
That's the 4.4BSD license, a license that predates FreeBSD (and the other open-source BSDs). It contains the dreaded "advertising clause," which is (IMHO) rightfully viewed as non-free. That's why FreeBSD uses this license which drops the advertising clause and is almost universally viewed as a free license; the other open-source BSDs did the same thing.
Open Source was never about plagarism.
That is ALL that Microsoft is about.
They only look similar if you aren't paying attention.
A Pirate and a Puritan look the same on a balance sheet.
I've built a number of Win2k boxes in my time, and Win2k installation and setup is a breeze. I cannot say that for my experiences with installing Linux.
Maybe, just out of curiosity, you should try one of the newer distros - SuSE or Mandrake are laughably easy to setup nowadays. Pop in the cd, tell it what kind of hardware you have, done. Although I must say I agree with you that if you're looking for a platform to do 3D, image processing, video or audio on, Win2K is probably a better choice.
News and bla for computer musicians: http://lomechanik.net/
I hear all these people about a flaw in the MS OS ?
Maybe there, but its fixxed probably, now what i wonder about is when they come with the patch.
But then i also read some thing about the a difrent C version of MS, so maybe they dont need the fix.
Now i wonder why i even wrote this..
Quazion
Can someone please explain why zdnet and news, etc. are all on a non-existent domain?
; > DiG 9.2.0rc3 > news.com.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER
I don't get it. com.com seems to be some kind of travel agency. Any ideas?
(Sorry for the offtopic question)
Microsoft's fast responces to security issues is a recent event. They do not have a history of fast responce. But they do have a history of putting out fixes that cause problems. It is common practice to delay rolling out hotfixes and service packs to allow for discovery of these bugs and subsequent fixes.
Yep. That's why CodeRed and Nimda weren't able to do much damage. Oh. Wait.
Nice statistic. Got a valid reference for it? Or is that just a bogus number to make your rant sound nice?
People often confuse Microsoft's marketing savvy with their technical ability. They are a technical company who excels at marketing. You're crowing about their marketing. This is a technical issue (information security is not a marketing issue - despite how many companies, MS included, tend to handle it).
If the BSD license no longer has the dreaded advertising clause, then how does it differ from the MIT license? Why doesn't FreeBSD simply switch to the MIT license? Maybe there is some university rivalry.. or maybe they don't want to rename their project to "FreeMIT". ;-)
cpeterso
Name a better alternative. Windows 2000 is easy to deploy on a variety of harware, easy to use, and has well supported software. The gotcha is that it costs lotsa money to license. Can you honestly tell me there is a better alternative? The only alternative I have as a 3D Artist is Macintosh. And though I'd like to have one, Windows works on the hardware investment I've already made.
Linux is hard to install, requires a more knowledgable support people, and has less driver support. This is why Windows is big in the corporate world. Obviously Microsoft isn't so bad if it's doing what people are paying for it to do.
As for being a troll, a troll rarely makes a good point. Getting back to my original point, this attitude of "It sure is cool to hate Microsoft" is blinding people to alternatives that may very well work for them. Call me a troll for disagreeing with you if you like, but I'm not-anti Linux.
"Derp de derp."
I just wanted to respond and let you know I appreciate the tone of your answer. I've had a couple of people recommend SuSE, and it's on my list to try.
Again, thank you for being civil.
"Derp de derp."
Well, as has been said many a time before, this would not be a good thing for microsoft or any other vendor. The GPL is the agreement that grants you the right to use the code in your product and distribute it. If the GPL should fail, then vendors would have NO right to distribute software based on GPL'ed source. The GPL is not a restriction on public domain, it is a set of rights granted by the holder of the copyright.
I think you're right there. I can't help but wonder if the new file system they announced is intended to keep people from dual booting Linux boxes. How much ya wanna bet that Lilo doesn't work with it without some kind of patch?
The good news is that every time MS closes a freedom with people (like XP requiring registration, or a security flaw in their software), Linux has an opportunity to be more attractive.
"Derp de derp."
I've been NT since '94. It peaked with 3.5.1 and has been downhill from there. I've spent plenty of time with NT5. It is my workday OS. I even had dellusions about improving the computing condition of my family members by subjecting them to it.
It either failed to live up to immediate requirements or failed to live up to the performance of it's DOS based predecessors in daily use.
The problem with Microsoft is that it's main focus is not technology but market domination. Technology is a far distant second (or worse) and merely a means to and end for them.
What makes Bill a better megalomaniac doesn't necesarily make for a better product.
If GNU, software development sloth encarnate, could sneak up behind Microsoft then there are some serious problems out there in Redmond.
A Pirate and a Puritan look the same on a balance sheet.
NOT crashing on a double free might be just as bad (or worse) than crashing on a double free, since it generally means somebody is accessing a free'd pointer for other reasons (prior to the second free). In *this* particular case, allowing a double free might be better than not allowing it, but in general, ANY program that does a double free probably has far more destructive bugs hiding in it.
I bet part of the reason MSFT is so averse to having its precious source code inspected is the possibility it contains GPL'd code that infringes on the license.
Win95? Apple achieved better 11 years earlier.
The whole "random collection of spare parts" thing has still yet to be completely managed by Microsoft. They still screw it up often enough for Linux to be in a position to recover the situation.
Microsoft deserves NO credit for PC hardware compatibility. The hardware usability standards were pioneered by Intel and Apple and only grudgingly adopted by Microsoft.
It's the hardware vendors MANUFACTURERS that make installing new hardware on WinDOS easy.
No, Microsoft wasn't the one that make computers more than "toys for geeks". That credit goes to the developers of the Web and early web browsers. THAT is the killer app that pulls in the sixpack family.
Microsoft was late on that technology too, and had to muscle it's way into marketshare when they finally got off of their posteriors.
A Pirate and a Puritan look the same on a balance sheet.
Ah, but what if we made GPL'd code that was so good and so far ahead of everything
It will never happen. Most GPL projects never go anywhere because agreements can't be met, and the people contributing have to go to a normal job.
doubtful...
http://research.microsoft.com/university/ntsrcli ci nfo.asp
Microsoft® makes source code to Microsoft operating system products like Windows XP, Windows 2000 and Windows CE available to universities and other "not-for-profit" research institutions at no charge. Currently, there are over 100 universities worldwide with our source licenses.
This is again Mundie piping up with that stupid argument, that the GPL is bad because it limits the licensees choices. Now where's my choice when i want to develop using Microsofts sourcecode (if i can get my hands on it, even some governments can't)? Well, i have to accept Microsofts conditions. With the GPL and similar licenses i have to agree to the conditions of the respective authors (which choose the GPL as a license). So where's the difference? I'm sure it's easier to satisfy the GPL than Microsoft anyway. If only someone would ask what Microsofts conditions are for using their sourcecode when Mundie goes on a rampage again, that should shut him up for good.
Meanwhile the TCP/IP stack and now the zlib (and probably some other open source software Microsoft choose to make money off) shows what all that rhetorics of Mundie really is about: They want to take without giving, and they have seen that there's some nice open source software they'd like to get their hands on if only it weren't for that pesky GPL. Apparently that there's some open source software, that's too good to ignore, even for innovative Microsoft. It's really unfair that the GPL is asking Microsoft to share with others if they want to benefit from that software.
--
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
This is a "bug" in the webpage... someone forgot to update it apparently, since the 4.4BSD license has been updated years ago. Check the addendum here:
L ic ense.Change
/usr/src/gnu or make sure he doesn't ship any of them, which for a lot of applications is not necessary anyway.
ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.
The removal of the advertising clause retroactively applies to any BSD licensed sources that Berkeley has the copyright of, including 4.4BSDLite which FreeBSD is based on, and since the FreeBSD additions are covered with the FreeBSD license which is the BSD license without the advertising clause and references to the "Berkeley Regents" replaced with "FreeBSD Project", this effectively means that there is absolutely no advertising clause issue.
There are of course some non-free (in the BSD sense, I am not trolling!) sources, most of them GPL, however if one is looking to release modified FreeBSD binaries without providing the source, he can simply rm -rf
Installshield that is. MS has the "Windows Installer." Installshield is a separate entity.
WTF?
Your reply has nothing to do with my post. It really has nothing to do with the parent post that I responded to.
How could this affect PHP4's use of zlib? I assume this is used when you use gzip compression on pages using the ob_handler?
No, Microsoft sucks because they've been on an anti-opensource crusade and are using open source in all their products. It's the hippocricy(sp?).
No, microsoft is using legally licensed code in their operating system, which happens to be BSD licensed.
They are on an anti-GPL crusade, which is largely different.
Get your facts straight.
I will ignore your comment as you have NO idea what you are talking about.
If you're not a Liberal in your 20's, then you have no heart.If you're still a Liberal in your 30's you have no brain.
When you install either OS, you're also installing a lot of auxillary software. Red Hat gives you a C/C++ compiler for free, while you would have to buy VC++6 from Microsoft. Red Hat includes an IRC client, which is a separate download under Windows. Red Hat gives you more text editors than you can possibly be interested in (joe, several variations of VI, Emacs and XEmacs, gEdit, NEdit, Abiword, Kate). You even have the option of installing StarOffice 5.2, free. With MS, you get Notepad, Wordpad, and EDIT (command-line). And last I heard, Notepad *still* had that 64K limit, which is simply braindead. Red Hat gives you TuxRacer, while you would have to shell out $50 for Microsoft's HALO.
Finally, the docs that ship with Red Hat are probably way more thorough (though less organized) than anything Microsoft gives you.
The point is, if you can see where the bloat is coming from, then it really isn't bloat. Most Linux distros have big installs because they provide a lot of different utilities and a lot of documentation. I'm hard pressed to figure out where the bloat in Windows comes from.
If, by "does well," you mean "continues to exist, continues to improve its software, and continues to provide incentives for competitors to improve theirs" then I fully agree. If you mean, "continues to pursue Complete World Domination(TM), continues to lock customers into proprietary formats and solutions, and continues to force customers along expensive upgrade paths," then you would be wrong. Microsoft has its place in the world, I'll agree. But that place is not the center of the world's information economy.
You want the truthiness? You can't handle the truthiness!
That's true, they never have written an OS from scratch. Windows 9X is DOS-plus-GUI-shell and DOS was derived from QDOS; Windows NT is DEC's MICA, broken and in fancy clothes, and 2k, XP, Longhorn etc are all derived from that. What about CE? Maybe that's why you need an expensive mega-micro-beast to run it on.
If MS truly want OS security, why not just wrap their user interface around OpenBSD? The licence allows it, provided credit is given (and that can be done in very fine print).
Got time? Spend some of it coding or testing
Mandrake, for example. That and any other package for which this was straightforward to do.
Got time? Spend some of it coding or testing
For your compiling pleasure, Mandrake 8.2 includes a tool to do just that. But you will also have to grep the entire source tree to catch self-included static copies of zlib. Just be glad that you can do this. (-:
``Hello, Microsoft Technical Support here. Can I have your money, er, support number please? ... Thanks, OK, now what seems to be the problem? ... Rebuild from source? Sir, don't you mean reboot...?''
Another fine reason to give money to Mandrake instead of Microsoft.
Got time? Spend some of it coding or testing
The security vulnerability is due to zlib trying to free the same section of memory twice. The glibc memory allocation routines aren't very smart, and will cause heap corruption if you try to do this. This heap corruption can be exploited.
The Microsoft runtime libraries have smarter memory allocation and deallocation - attempting to free the same area of memory twice does not result in heap corruption. Consequently the zlib bug isn't a security vulnerability in Windows.
Gosh, what else do they make besides a second rate search engine? That there is no security on M$ is no secret.
Their response according to the article is:
Microsoft representatives said that the software giant's security response team is investigating the zlib flaw and that some Microsoft applications use code from that compression library.
Meanwhile, in a dark Seatle back room someone is running "apt-get update" for a fix! Well, that's what I did. No problems now.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Uhhh...
/. says he'll be done in a few weeks.
/. Seems as though Open Source advocates aren't as "Open" as they claim.
Then why do so many of the "new" window managers that Linux zealots are promoting look so much like Windows?
I can see it now..
Linux Zealot: Boss, we've got to change all of our desktops to Linux now! It's finally ready for the desktop.
Boss: I thought it was hard to use.
Linux Zealot: Not at all. It's MUCH better than anything a company of professional developers working full time could create. And it doesn't have ANY security vulnerabilities, and it NEVER crashes.
Boss: Sounds pretty good. Have they made the User Interface any better?
Linux Zealot: Oh yes, much better. KDE has added a start menu, right-click context menus, My Computer, Control Panels and even a way to (almost) automatically install/uninstall programs.
Boss: Sounds like Windows 95 that was released 7 years ago. I guess that's ok, but does Linux support our hardware?
Linux Zealot: Not all of it, but there are some close driver matches, and if I hack away at it enough, maybe our hardware will work. There's also a guy in his basement in Cleveland working on a driver for our video cards. His latest post to
Boss: Well, I don't like the idea of not knowing when/if our hardware will be supported, but we'll be upgrading soon, so that's not a really big deal. What about software? We've got hundreds of thousands of dollars invested in several custom VB applications that make our lives 1000x easier. Will they run?
Linux Zealot: No, not yet. But there's a new project started by some college kids in Arizona that will allow us to quickly convert VB applications to X applications. Right now it doesn't do shit, but I'm sure in a few years they'll get it to run flawlessly!
Boss: Well, what about all of the documents and spreadsheets we've typed over the last 10 years. Will we be able to read those? Oh yeah, and if we switch, will we still be able to use Office?
Linux Zealot: Office? What is that? Oh, Star Office, yeah, it'll run just fine...
Boss: No.. Word. Excel. Powerpoint. The tools that the entire civilized world relies upon to get WORK done?
Linux Zealot: Well, not yet, but there's some guys working on this thing called WINE that...
I'm sure you get the point. I'm also quite certain that this post will "disappear." Don't belive it happens? ANY post too MS or too anti-OSS seems to magically vanish from
This whole comment on plagarism just pisses me off. Get a fscking clue.
I don't think we have compatible definitions of the word 'bloat'. When I used it, Red Hat (KDE) had so much going on it was difficult to track down very specific items. It was slow to repond, and flat out frustrating to use. Windows 2000, on the same machine, was much more responsive. That's either bloat or inefficiency. When Windows takes too long to access the registry, that's sometimes considered bloat. Programs take up too much space (70 megs to download Star Office, for example...) is considered bloat. For me, Windows 2000 is the OS of choice on this machine. If I had the "It's cool to hate MS" attitude and went with Red Hat, I woudln't be any better off. I'd be hurting myself, and that was the point I was making.
.DOC format, right? Well that proprietary format keeps other people out, that's true. But it also allows MS to make changes and make the format do more. Look at what a .DOC file can do that a .TXT file can't. You can attach other files inside it, format your text, etc. If MS was adhering to a standard like HTML for example, how would they be able to innovate without bending it towards proprietry at some point?
.GIF files, the .PNG standard was developed. .PNG Is a totally kick ass format for us artists who need lossless compression and alpha channel support. This format came around BECAUSE somebody tried to strangle a format they owned.
" If you mean, "continues to pursue Complete World Domination(TM), continues to lock customers into proprietary formats and solutions, and continues to force customers along expensive upgrade paths," then you would be wrong."
I disagree. Let's talk about proprietary formats for a sec, those aren't 100% bad for everybody. Although I realize this can be used to leverage a monopoly, there's a lot to be said for having a format that MS can diddle with. This gives MS some room to innovate. MS invented the
When they do this, they create an opportunity for somebody else to come in and make a better format. When Unisys tried to make people pay for using
Long story short? Every time MS tries to leverage their monopoly, a new opportunity arises. Embrace that philosophy, because that is exactly the type of thing that will make Linux a big player out there.
"Derp de derp."
Well, that could be. I don't have any problems with my M$ software. It sits on floppies and CD's where it can be installed to use some obscure piece of hardware on a second rate computer never attached to the internet. Most of the time, however, it never causes problems.
Bad Microsoft, bad! Quit saying that free software is unusable while using it. Oh yes, good luck hunting thought that vast tree of poorly documented closed source junk you have been purchsing from other companies for the last ten years. Is this what you will build the Digital Rights Management Operating System, TM and patented use of other people's code? Slap! Crack! What a joke of a company. What shall become of all the M$ stock when the world figures out that M$ is the equivalent of an Ice Vendor in Antartica?
They wanted to be the asshole in the middle, stripping ideas and programs from others, to sell as The Sole Operating System. All the people they ruined could be hard at work fixing their codes. Now, those codes will continue to be distributed unmodified. The task is too great for a single company. Like most such ventures, in the end Microsoft can only manage to be assholes.
Friends don't help friends install M$ junk.
Seriously - they should come up with some small little product that it doesn't matter if they have to release the source code to. They should put some GPL'd code in there - perhaps not even try to hide it too much.
And then they should see what happens. I guess they figure not many in the GNU crowds care much for them anyway, so they won't lose "loyal customers".
However, it'd either do two things:
a) show MS that it doesn't matter cause no one dared to file a suit
b) give the GPL it's day in court and see what happens.
The only downside is that whoever decides to take this to court better be loaded. It could be a long uphill battle.
It would be interesting to see the outcome though...however with MS's legal team, perhaps it may not be a good outcome.
There is another interesting point to make here. The origional poster implys updates will be slow to trickle in to the Linux install base, while Windows Update offers a shortcut to the process. Microsoft's Windows Update service is not unique. Its not even first of its kind. Linux distributers such as Redhat and Mandrake have long offered a simular service. Debian has had such a system in place even earlier.
In short, Windows Update provides neither a panacea nor unique solution to the issue.
I'm afraid you misunderstand the license. What you suggest still involves linking your program to the GPLed code at runtime, which is expressly forbidden by the GPL.
Besides, you have to release the code of the wrapper library under the GPL, which in turn requires you to release the code of your other program under the GPL as well. The chain will continue no matter how many "wrappers" you write.
Sorry. There are eye and there are eyes. Clearly this demonstrates that just throwing it out into the world and hoping that eyes at random will find the bug isn't a foolproof strategy.
I am really tired of the 'few eyes/many eyes' meme and how it's turned into a dogma.
Sorry, Eric Raymond didn't reinvent Software Engineering when he wrote his diatribe. There are many other far more experienced people out there doing a better job, some not even based on crappy neo-pagan metaphors and matchbook-cover political economy.
BTW, Notepad does not have a 64K limit in Windows NT4/2000/XP..
strings will display ASCII strings embedded in a binary.
With the additional '--print-file-name' option for the GNU binutils version, it's even more useful.
From Windows NT 5.0:
[trisk@kainga:/vfat/windows/system32]% strings --print-file-name *.exe | grep 'Berkeley'
nslookup.exe: @(#)nslookup.c 5.39 (Berkeley) 6/24/90
nslookup.exe: @(#)commands.l 5.13 (Berkeley) 7/24/90
nslookup.exe: @(#)debug.c 5.22 (Berkeley) 6/29/90
nslookup.exe: @(#)list.c 5.20 (Berkeley) 6/1/90
nslookup.exe: @(#)subr.c 5.22 (Berkeley) 8/3/90
nslookup.exe: @(#)skip.c 5.9 (Berkeley) 8/3/90
nslookup.exe: @(#)getinfo.c 5.22 (Berkeley) 6/1/90
nslookup.exe: @(#)send.c 5.17 (Berkeley) 6/29/90
[trisk@kainga:/vfat/windows/system32]% strings --print-file-name *.exe | grep 'Regents.*University of California'
finger.exe: @(#) Copyright (c) 1980 The Regents of the University of California.
ftp.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
nslookup.exe: @(#) Copyright (c) 1985,1989 Regents of the University of California.
rcp.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
rsh.exe: @(#) Copyright (c) 1983 The Regents of the University of California.
The double free bug in zlib doesn't affect MS systems since the msvcrt lib isn't affected by a free of a NULL pointer. This article on CNet shows the need for pageviews.
Never underestimate the relief of true separation of Religion and State.
And ofcourse they now support raw-sockets in WinXP. For average users by default. Who'll say "I saw that one coming" when a major WinXP based DDoS attack starts to rage the net?
Not Buzzword 2.0 compliant. Please speak english.
Reading up on the zlib licence, which is short and easy to understand, I find this clause:
The way I read this, if software uses zlib code, then the authors of their software must not claim to have written the code. Microsoft are not obliged to acknowledge the zlib authors anywhere, but if they make a copyright statement saying that the code was written by Microsoft, then surely they are claiming that they wrote the zlib code in their product, and are therefor breaking this clause?Does anyone know if Microsofts' copyright statements comply?
I am probably too late for this point to be discussed.
But microsoft tried to remove this protection in one of their Visual Studio services packs - the result - Microsoft's ( and other's ) programs crashing randomly all over the place. They quickly reversed the 'optimization'
More worryingly -that means that alot of programs are actually relient on that thin safety net!
How would any university user know - they would not be GPL coders because of the NDA and fear of contamination. Perhaps Eben Moglen should find someone who can thoroughly examine the MS code who won't be writing anymore GPL code - but I guess MS would find some way of stopping that!
Bloat is not how many Gigs of hard drive you need to install all packages - on this basis Debian would be the most boated release ever. Bloat is requiring ever more RAM and ever faster CPU's to run an OS and a reasonable set of apps. On this basis while Linux does seem to be following the same increasingly bloated path as Windows at least you have an option of running a lean system with a windowmanager or light desktop environment such as Windowmaker or XFce respectively. However I have given into bloat - at home away from this goddam Windows machine I run Gnome.
In your view, the society moves forward as a side affect of individuals pursuing BIG MONEY. I suspect that if you do some reading on just who are the people who create innovative technology you will find that they are people motivated only partly by money but much more for having a burning desire for the subject area they are addressing. BIG MONEY is made by those who can take other people's innovations and market them. Frequently, the winner is as much politically connected as they are financially astute. What motivates open source developers is the burning desire to "make a difference" in some way...in the area they care about - programming and software development. How about this, we won't worry about the "starving programmers" of the world if you stop worring about the "starving Billionaires" of the workd.
I want to be alone with the sandwich
If something like that were to happen, I'd imagine that the GPL would probably be killed in court by high powered lawyers from all the major software companies (not just MS.)
The only way you could "kill" the GPL would be to void copyright protection on software. Effectivly every piece of proprietary software would immediatly enter the public domain.
Dijkstra Considered Dead
"This software" in the clause you've cited probably refers to the zlib library, not to the complete product it is used in (otherwise the "use this software in a product" wouldn't make any sense). Since Microsoft is not distributing a standalone zlib library, there isn't anything to misrepresent. I'm pretty sure they left the original copyright notice in the library's code.
BTW, I've been told that on the Windows XP installation CD, you'll find a file which contains copyright ackknowledgements for much of the software that they're using in Windows (e.g. the BSD license requires reproduction of the copyright notice "in the documentation and/or other materials provided with the distribution" when distributing binaries, so you'll find the BSD license in that file). I don't have Windows XP, so I can't tell you the file name. On the Windows 2000 CD or in the installed system I haven't found the file, but I guess they put it somewhere (anything else would be pretty dumb, given how simple it is to comply with the licenses we're talking about here).
Sig (appended to the end of comments I post, 54 chars)
and going away....
Moments before I made the post I was reading about gzip's current buffer overflow in which you can pass a path on the command line that's more than 1020 characters and you will cause the overflow.
:O)
I confused this with zlib's problem and hence my claiming that zlib had an overflow.
I was wrong and I realized this a few minutes after posting. D'OH!
Anyway I still hope that my post helped someone to understand what buffer overflow's are about, even if it doesn't apply to zlib at present
--
Garett
Actually the stripping of the copyright notice from the bianary was a source of sore contention.
"Some of us don't care how the OS works as long as it does. "
Of course, but the issue only exsists at the point in time where it *doesn't* work, at which point the "welded-shut car hood" system goes to crap.
Also a concern is not just if the OS does what I tell it to, but what else its doing that I can't tell it to stop doing...
Dijkstra Considered Dead
So the major OS's in the world that are NOT dying
are VM, MVS, VSE, OS/390. I guess we all have to
learn SNA, VTAM, and JCL to make our way in the
world.
Yawn. It's an old story. "If you bash Microsoft, you're jealous."
I bash Microsoft because that would desperately love to make open source software illegal.
Despite all their claims, open source software is a viable commercial alternative. I'm proof of that. I've used open source software for my clients, and written new software for organizations that are largely using open source.
Microsoft wants to force people to buy software from a large company. They don't want people to realize that software can be produced by a single coder in a reasonable ammount of time.
They lie to accomplish this goal. Microsoft's history has been one long lie. They lied in court, they faked evidence, they lie about open source, etc, etc. Then they have the gall to use open source software after saying it'll destroy the economy.
I want to know why they can get away with this shit. It seems to be just because they're rich. If anyone else lied to a judge like that they'd be spending a month or two in jail for contempt, at a minimum.
No, I don't dislike Bill because he's rich. I dislike Bill because he's doing his upmost to make sure that I'll never be rich, by destroying the business oportunities of anyone who isn't Microsoft.
How much does MS pay you to astro-turf for them?
rpm-rebuilder
Got time? Spend some of it coding or testing
There are more than 10x as many OSS projects with more than 100k installations in the field than there are M$ products in the same boat. There are more than 100 distinct OSS products (not counting libraries and such, but including games) installed on this Mandrake Linux box which see use at least once a week, and it's doing nothing special. How many copies of Mandrake Linux are there in the field? Now add in packages unique to RedHat, SuSE, Debian...
Got time? Spend some of it coding or testing
Dijkstra Considered Dead
Dijkstra Considered Dead
You know, your cut and paste arguments would be better if you tailored them to the people you were arguing with. I didn't talk about capitalism or communism. Where do you come up with it?
I make money, in a capitalist system, by programming.
I just don't want Microsoft getting that declared to be illegal just because I work with open source software.
Let's use this capitalist thing that you keep going on about. How is Bill buying laws against open source (which he's trying to do, having Mundy say it destroys economies) a capitalist act? Shouldn't MS be competing? Releasing a better product?
There are many do-it-yourself markets in the world. Nobody bitches on Slashdot that handy homeowners are putting plumbers out of business by unclogging their own toilets and fixing their own broken pipes.
That's because people have had time to realize that this isn't bad in any way. Money saved on plumbers gets spent elsewhere, to raise the standard of living. Plumbers can find another line of work, or get good enough to compete in a smaller field.
You're the one proposing a corporate welfare state. Let's pass laws making it illegal for people to do their own programming, just to keep Microsoft making their money.
And then with the 401k plans. Wah! If you invest in a volatile market you expect risk. I don't see anybody crying over my retirement fund, so why should I go out of business over theirs?
Truly, the open source programmers and I are arguing for the only true capitalist point of view here. If a big company can't compete with us, let them go the way of the dinosaur.
Don't forget, I'm perfectly willing to compete. If Microsoft can fill the niche I do, without simply making it illegal for me to do it, then I will move on to another job. Either I'll find a new niche, or a new career. Unlike the world's richest man, I don't expect everyone to take care of me.
Why do we have this idea that capitalism excuses all actions? A capitalism should say "Welcome to our market", and then try to make sure that their products are better and cheaper. Microsoft has continually used illegal product linking and direct sabotage to destroy the markets of their competitors. ("DOS ain't done till Lotus don't run.")
The Free Software Foundation stresses that free software means freedom, but their logic that "free software does not mean no-cost software" is completely broken. They are not willing to see that once source code has been released it is inherently no-cost.
If all software is free software, then no new software will get created (like I said earlier). Do you know the price tag of something like MS Office or AutoCAD being created? I'm sure it is well into the million dollar range. Who in the world would pay that much and then have it released for public consumption? No one! They may purchase the software and resell it (like MS has done many many times), but they will not release under the GPL. The only time payment can be collected on GPL'd software is at the initial transfer. Once two parties have free software you can be sure that the entire world will have access to that software. Do you understand where I'm going here? There will be no support system to continue the development of the software. It will be left up to thousands of development shops to pick up development and the entire computing world will become fragmented. There will be no defacto standards that hold computing systems together. The computing world will become one big spaghetti system. All software talking different protocols, using different file names, and some not even having concepts of "files." If you think the communication between Windows and Linux/BSD is bad, wait until anyone can come along and stomp on protocols. You can already see this happening between Red Hat and various other Linux distros. Certain assumptions about what a "Linux system" is don't hold true and things tend to break. Once computing systems get larger, free software methods break down quick. Try compiling and installing GNOME by hand and you will see that it takes a near miracle to install correctly. It is much easier to download RPMs and install like that. Do you see now, where the value of software is. It isn't being able to modify it (as long as the software is still supported). The value is having it work and work correctly and together. How many times do you really have an urge to modify the source code for bash? Mozilla? X? Not much, I bet. As software becomes more complex, the need for source code diminishes (think of the push for OO programming, and why abstraction is such an important part). There may be a market for you to sign some sort of NDA with a company to let you access source code and modify it (provided you don't distribute). I see nothing wrong with that. I also don't see a problem with software becoming GPL after it has expired (such as id Software did with Quake, Quake2, and Doom). Those, IMO, are valid reasons for having source code. What the FSF wants is too much for me, and their views are very extremist.
Here is another way to look at this: Maybe Microsoft does want software dictatorship (and Apple wants the whole freaking computer!). Who wouldn't, if they were in that position? They have an obligation to raise their stock price and they have to keep control of their architecture. But, FSF wants software anarchy. If you were an end-user who didn't know a serial port from USB, what would you rather have? My money would be safe with Microsoft. It would be a fairly simple choice, too. The cheap x86 architecture and the numerous applications available because of the cheapness. Who controls the middle is really a non-issue, as long as everything works. Microsoft makes everything work. How well is subjective, though...
Dijkstra Considered Dead
Dijkstra Considered Dead
You're stuck in assuming that because Microsoft is a large part of the software world now, that it must always be so.
Not only were standards developed before MS was around, but most of the important standards we use today still predate MS. MS in fact has a habit for trying to stifle the development of standards.
As for the development of large software - consider the BSD system, and the Linux system. Both contain large parts (kernels, filesystems) which took a lot of development and didn't provide functionality until done. Then there's Gnome, KDE, PERL, PYTHON, RUBY, and so on. The free software world has created huge projects, on its own, with no direct profit motive. KDE provides a ton more functionality than early MS desktops. (IMHO it's between 95 and 2k, with less OLE, but much better usability.) Either way, it's an example of a project that took probably millions of dollars of time, were it billed, to create and yet was written by hobbyists, for free. And they all realized that to do their favorite part (the itch) they had to help get the rest working, so they cooperated to write the less-fun bits.
GNOME may be hard to install by hand, but there are RPMs (free software created with a profit motive) and DEBs and likely other smaller package systems.
Free software is raising the bar on paid software. Much the way that home repairs with help from Home Depot are raising the bar on professional carpenters and plumbers. Why don't you feel that this is a trajedy? Are there going to be no standards for nail or lumber size, just because most of the work is done by individuals?
I think that individuals benefit the most from standards... They're the ones who would take a large hit from having to code up a ton of file-translation code. Or, in a home-repair metaphor, have all lumber custom-cut to their specified sizes. Experience bears this out. Microsoft is the creator of weird new formats. Free software tends to use either standard formats, documents it, or at least provides the source code for reading it.
I highly doubt my salary will get cut in half. I'm already in what you for some reason call the service industry (most of my work is writing new custom programs, not providing troubleshooting or help). Really, it's the same thing I did while employed to work on a large software project, except that I work much more closely with the end users. (You don't understand the power of custom software until a user asks for a feature on Monday and you can demo it on Wednesday and merge it into stable code by the end of the week. They love this.)
RMS doesn't say all software MUST be free. He says he believes it should, but he's also said he's not willing to force people. The choice to use GPLed software (and thus release their own) is theirs to make.
Microsoft on the other hand appears to be trying to force people to not use free software. Normally a company doesn't speak out against their competitors, essentially calling them communists and hinting that they destroy the economy by reducing tax, etc, etc. It appears they're lobbying for legal protection. Only time will tell though.
And as for MS being more than Bill Gates... Who cares? Even though he's not the CEO anymore he still appears to be the driving force. A lot of people might have tied their money to him, but that doesn't change how you should see his actions. It's basically him saying he wants more money and control and he's continuing his policy of crushing others (through illegal or quasi-legal means) to get it. It's been a long time since MS has just released a competing product and let the market choose. You may see him as a model capitalist. Whatever. I see him as a threat to the livelihoods of everyone, including myself.
It's just a real chuckle how you think that MS promotes standards. Haven't you paid any attention to how MS perverts existing standards, ignores them to make their own formats, and tries to disrupt anyone who uses their standards? (SAMBA, File converters from MS-Word, etc.)
Once again, you're saying things that make me think you must either be getting paid, or perhaps are trying to defend MS because you've got stock and don't want the price to drop.
The reason your salary has not been cut is because software, for the most part, still has value. What I find perplexing about the situation of Microsoft's perceived monopoly, is they may have a monopoly by good they may have done. Let me explain. When Bill Gates decides to sell proprietary software, no one was doing it. There were paid programmers, I'm sure. But, I'm willing to bet that they were paid very modest sums. I believe they were viewed more as "secretarial" positions, rather than professions such as Doctors or Lawyers. If you read the history of Microsoft it has been said that Bill Gates worked his employees very hard with, what I assume, minimal pay. They are a start-up, after all. Now that Microsoft is growing they can afford to pay higher salaries for higher talent. Why is there a need for "higher talent?" Perhaps because Microsoft's key selling point is the features they have and ease-of-use. Before proprietary, software was simply made to do a job. Who cared about talent then? This is why Unix stressed efficiency, while DOS grew features and ease-of-use that other systems didn't have. Are they responsible, in part, for raising programmer's salary? I would think they played a big part. This is where I also believe they, inadvertently, created a barrier to entry in the market. Programmer time is now expensive. Thus, they have a lock on barrier to entry. You can either get the software you want, or the pay you want. Ultimately you can not have both.
The fact that you can start out entry-level in the 40-50k range while teachers remain in the 20-30k range says plenty about the perceived value of programmer time and of software. Why would anyone want to destroy this perceived value by making it appear as if software is easy to create and doesn't really matter? When mom-and-pop understand fully that compatible quality software can be made with programmer's free time, for free, what is stopping them from demanding this from Microsoft, Intuit, etc.? This is what I am arguing is Microsoft's viewpoint. This is what I truely believe is their "beef" with open source. I honestly do not think they worry about Linux or KDE/GNOME taking their market as much as they worry about the philosophy of the FSF and RMS spreading like wildfire. Linux may hurt Microsoft's market, but it will be the FSF that brings the entire software industry to its knees.
Dijkstra Considered Dead
It's funny that you complain about the number of projects on Freshmeat. That's not where you're supposed to go to find a finished project. It hosts development projects. Some of them are finished, but the majority, not suprisingly, are under development. It's like blaming GeoCities for the bad web pages they host.
.1% of customers who want it.
Yes, and who do you suppose will fund this if all software is free software?
I presume the same people as now. The developers. Interested users.
Why? All this excess baggage that Linux carries around--consumers don't need this.
Why get rid of it? All the formats are open and documented. All the shells except Bash are deprecated, etc. The rest are just there for people who grew up with old systems.
And proprietary vendors tend to either make their formats work,
Nobody is claiming that proprietary formats don't work. People are claiming proprietary formats don't work with anything else.
If WordPerfect can't import MS Word files, WordPerfect gets blamed, despite the fact that MS made to convoluted and undocumented format.
Each shell is practically a whole new incompatible platform that software must work with.
When a script runs it specifies the shell it wants. Programs that run under a shell (such as an installer script) pick one and support it. They then work fine when run under any shell.
Have you used unix? For more than a day or two perhaps?
And plumbers get the same treatment after they fix a nasty leak.
Perhaps after they install new plumbing perhaps. But what's wrong with that? I don't see why programming should be held to be anything other than a specialized trade. I'm not ashamed at the idea that I provide a valuable product/service and get paid for it.
There were paid programmers, I'm sure. But, I'm willing to bet that they were paid very modest sums. I believe they were viewed more as "secretarial" positions, rather than professions such as Doctors or Lawyers. [snip] Are they responsible, in part, for raising programmer's salary?
Chuckle. An older friend of mine bitches about the low wages these days. He made $150k+ per year, once over $220k, 1970s dollars, for programming back on old IBM mainframes. Today he makes $60k or something. Not a bad wage by any means, but a fraction of what he made before.
Why would anyone want to destroy this perceived value by making it appear as if software is easy to create and doesn't really matter? When mom-and-pop understand fully that compatible quality software can be made with programmer's free time, for free, what is stopping them from demanding this from Microsoft, Intuit, etc.?
I'm sure you also argue against including compilers with an OS, or making them freely available. I mean, if people see that they can write programs they're going to write their own and never use Microsoft's right?
I am very glad that I can program. I automate many tasks that take my friends hours. Even the ones who can use 3rd-party macro programs can't compete with a perl script I can hack together. If I want to see how a fractal changes if I modify the formula, I can. They have to ask me or hope that someone on the net had the same curiosity as them.
This is a gift that I want to share with everyone. They may never use it, but they'll be able to. Linux will never be locked down, but I can easily imagine a day when to "combat viruses" all code run on a Windows computer must be cryptographically signed. When users are crippled because a company wants to potentially squeeze more money from them in the future.
The reason your salary has not been cut is because software, for the most part, still has value.
One of the contracts I've taken was an ordering/tracking system for a company that made circuit boards. Previously an order (of anything complex) could take up to 30-40 minutes, with a few binders full of pricing charts, to price. The calculation screen(s) I made had space for 80+ variables, accessing hundreds of tables for pricing data. But you could give the customer a price as soon as you were done entering the data. It saved further time by passing the order to work stations at the various steps in the process. From ordering to a sealed computer hung over the drill press in the machine room, to accounting and shipping at the end.
The project saved an average of 15 minutes per order. It also meant that they passed notes and all design docs (the cirsuit diagrams) along as files, instead of taking a folder from station to station.
They mentioned a years or so after the project was finished that they hadn't lost an order since it was put in, and that they loved being able to pull up a spreadsheet that told them how many dollars worth of product were due to be done at any time, where work was backed up, etc. They were working to integrate it into a bonus system for the workers, as well as to let them know ahead of time about potential work shortages.
At my estimate (just of time saved initially) it let them do three times as much work per customer service rep. It eliminated one job (a guy who was moved into customer service instead of fired) of lugging paper around, keeping files straight, etc. It removed the requirement for a room of files, plus the printing costs, storage for old files, probably 5% of machinist time... Hell, even one of the accountants said he was happier because he didn't get stinky files with fiberglass shavings and etching fluid stains on them.
And you don't think that has value? Probably $400 / day, or more. That was the best $20k they ever spent.
But there's no way an off-the-shelf package would do what they want. Too much custom stuff. I've seen some systems for designing a pricing layout by drag and drop... fairly nice, but nowhere near the level of complexity something like this takes. And I doubt anyone will bother making it that good, for the
I've seen places where almost any business could benefit from custom software. Let me talk to the employees and identify their bitches and I can find even more. 10 minutes a day of hassle doesn't seem like much, but if you're paying $20/hour that's $3.33. Multiply by five employees, times 250 (working days per year) and you're at $4k. Figure in saved training time, and it's starting to look pretty sweet. (That was solved by a few simple batch files to open the right applications, perform incremental backups, etc.)
This will always have value.
[...] but it will be the FSF that brings the entire software industry to its knees.
Once again. Only if the work of paid professionals can't match the hobby work of a bunch of geeks. (Which you seem to think is really really crappy...)
But if they can't match the free software, what right to they have to bitch? They just want corporate welfare. "Rise up Joe Sixpack, cast down the shackles of free software made by the people and send half a month's wage to the world's richest man to sustain his lifestyle." It's not really concerning anyone except the rich who've sunk their mutual funds into MS stock.
Dijkstra Considered Dead
So? One company decided they didn't like the GPL, mostly based on RMS. Oh well.
For a single counter-example, http://www.merilus.com/ is a company making a linux-based encrypted VPN router/packet filter on a card based on the Crusoe chip. They release all their software.
Companies may find it hard to make money when giving software away for free, but they can always leverage their trademark and sell it retail. Nobody can forge it or they can sue. Sure, you can get it for free, but the average consumer isn't going to know that. If you include a nice installer on the CD and don't on the downloaded version you've got the attention of most regular users.
But... Let's play pretend for a minute. Let's imagine that there isn't a market for selling GPLed software.
Oh wow! The twisting worldview. There also isn't a market for selling ice to eskimos. Or really, to anyone with a fridge/freezer. But you don't hear the president of an ice-cube company complaining that putting the power of ice making in the hands of the common man is destroying the economy and rendering millions unemployable.
Things change. There's no reason the software industry has to be this big. I might even find myself out of a job, but if I'm displaced by someone who can do a better job for less money, I'm willing to go. I don't want a job that exists only because of a government mandate.
It's amazing that for a professed capitalist you have all these facist, big-government leanings. I thought the idea was that the market would sort it out. If mega-corporations can't manage because of competition from hobbyists then they aren't providing anything of value. (See Artificial Scarcity.)
I agree. You don't have to be socialist to want big government.
I was trying to point out some hypocrisy on RR's arguments though. He lambastes open source as being communist, and says there (basically) "needs to be a law!" I'm just pointing out that for someone who thinks might makes right and has a generally Randian point of view, he sure seems to want government protection when something comes along that threatens him or his comfortable world.
I know he can be greedy and want a strictly regulated economy (for his benefit). But he shouldn't throw around terms like "socialist" and "communist" as slurs unless he's against a regulated market.
Myself, I'm quite socialist. Both because I think it's "right" that people don't starve, but also because I'd rather pay slightly higher taxes to ensure that the poor aren't so poor or downtrodden they feel the need to overthrow society. However, I get a kick out of tweaking psuedo-libertarians who want a free market (for them to abuse) but a set of very strict rules that force people to put up with it, and not pull similar tricks on them.
Let me go ahead and call you a Nazi and a Hitler-wannabe before you imagine me saying it. Thus, I am enacting Godwin's Law and am admitting defeat. It is obvious you will believe what you want without consideration to what I am saying, or simply invent what you believe I stand for.
Dijkstra Considered Dead
Dijkstra Considered Dead
And your entire "better product wins" drivel is simply defeated by mentioning the word "brand." See? I can do *poof* also. You think Nike shoes are better than cheaper ones? How do you think MS came into power? People had to believe in paying for proprietary software (or that their old word processors weren't good enough and needed a computer).
Dijkstra Considered Dead
You conjecture that because some software is free, a manager will object to the idea of paying someone an hourly rate to make other software?
Carpentry is an easy at-home task and almost everyone has done some. However, carpenters seem to make a living.
It's a market economy. If they can find someone as qualified as I am, who will work cheaper coding annoying doo-dads for their database, they're free to hire them. It's happened before. Sometimes I've been called back by the sheepish client to fix the mess they made.
If I have a job though, I want it to be providing a real service to a customer with freedom of choice. I'm sorry you don't have confidence in your job options in a new economy.
If you're accusing me of not paying full attention to what you're saying, I suggest you look in a mirror.
I'm not trying to deny Microsoft the right to anything. I'm simply calling for them to be honest for once. If they say open source is bad, let them avoid using it. If they use it, maybe they should say that it's not a bad thing.
If they can't be honest about something that obvious it really makes you wonder what else they're lying about.