Slashdot Mirror


A Highly Portable Sandbox Facility For OpenBSD

An Anonymous Coward writes: "A new facility called 'systrace' has been developed by one of the OpenBSD developers. It allows enforcement of system call policies on untrusted binaries. For now it is only available OpenBSD-current, but the author claims it is highly portable and can easily be integrated into GNU/Linux systems. Eventually binary-only software is going to become more and more common in Linux, so this could be a another 'Good Thing(TM)' from the paranoids that brought us OpenSSH."

40 comments

  1. What we can learn from BSD by Chinese+Karma+Whore · · Score: -1

    What We Can Learn From BSD
    By Chinese Karma Whore, Version 1.0

    Everyone knows about BSD's failure and imminent demise. As we pore over the history of BSD, we'll uncover a story of fatal mistakes, poor priorities, and personal rivalry, and we'll learn what mistakes to avoid so as to save Linux from a similarly grisly fate.

    Let's not be overly morbid and give BSD credit for its early successes. In the 1970s, Ken Thompson and Bill Joy both made significant contributions to the computing world on the BSD platform. In the 80s, DARPA saw BSD as the premiere open platform, and, after initial successes with the 4.1BSD product, gave the BSD company a 2 year contract.

    These early triumphs would soon be forgotten in a series of internal conflicts that would mar BSD's progress. In 1992, AT&T filed suit against Berkeley Software, claiming that proprietary code agreements had been haphazardly violated. In the same year, BSD filed countersuit, reciprocating bad intentions and fueling internal rivalry. While AT&T and Berkeley Software lawyers battled in court, lead developers of various BSD distributions quarreled on Usenet. In 1995, Theo de Raadt, one of the founders of the NetBSD project, formed his own rival distribution, OpenBSD, as the result of a quarrel that he documents on his website. Mr. de Raadt's stubborn arrogance was later seen in his clash with Darren Reed, which resulted in the expulsion of IPF from the OpenBSD distribution.

    As personal rivalries took precedence over a quality product, BSD's codebase became worse and worse. As we all know, incompatibilities between each BSD distribution make code sharing an arduous task. Research conducted at MIT found BSD's filesystem implementation to be "very poorly performing." Even BSD's acclaimed TCP/IP stack has lagged behind, according to this study.

    Problems with BSD's codebase were compounded by fundamental flaws in the BSD design approach. As argued by Eric Raymond in his watershed essay, The Cathedral and the Bazaar, rapid, decentralized development models are inherently superior to slow, centralized ones in software development. BSD developers never heeded Mr. Raymond's lesson and insisted that centralized models lead to 'cleaner code.' Don't believe their hype - BSD's development model has significantly impaired its progress. Any achievements that BSD managed to make were nullified by the BSD license, which allows corporations and coders alike to reap profits without reciprocating the goodwill of open-source. Fortunately, Linux is not prone to this exploitation, as it is licensed under the GPL.

    The failure of BSD culminated in the resignation of Jordan Hubbard and Michael Smith from the FreeBSD core team. They both believed that FreeBSD had long lost its earlier vitality. Like an empire in decline, BSD had become bureacratic and stagnant. As Linux gains market share and as BSD sinks deeper into the mire of decay, their parting addresses will resound as fitting eulogies to BSD's demise.

  2. What's the overhead? by Drishmung · · Score: 3, Insightful

    What sort of performance hit does this impose? For instance, is it low enough to run nearly everything in the sandbox as a matter of course?

    --
    Protoplasm. Quiet Protoplasm. I like quiet protoplasm.
    1. Re:What's the overhead? by Espen+Skoglund · · Score: 3, Informative

      I can't imagine that the overhead is too large. As far as I can see, the intuitive way to implement this would be to generate a separate system call table for each sandboxed binary (i.e., in the same manner that you have separate syscall tables for running, e.g., emulated Linux binaries). This would impose no overhead on other executables and would for the most part not impose any overhead for the sanboxed binary either. A syscall which is unconditionally allowed simply works as usual. Other system calls like open(2) which often require a more complex test will have some overhead, though, but such open calls should not be in any time critical code anyway.

    2. Re:What's the overhead? by ghassanm · · Score: 1

      I believe the simplest way to do this would be to use the ptrace(2) system call. You can specify that a process should be stopped before any
      system calls are made and then inspect the registers to see what the arguments to the system call are. This would naturally result in extra context switching every time a system call is made, but it is very simple and keeps the added complexity outside of the kernel.

  3. BSD vs. Linux by Anonymous Coward · · Score: 0, Funny

    BSD vs Linux:

    They say a picture is worth 1000 words. I'll let the pictures do the talking.

    Look who shows up when BSD users get together. Now look what happens when Linux users get together. That's right! They immdiately start buggering each other! This picture shows the reaction of the receiver of such activity. A smile from ear to ear.

    Note the look of disgust when a member of the BSD crowd actually has to look at a Linux user. Truly truly sad.

    1. Re:BSD vs. Linux by Anonymous Coward · · Score: 2, Funny

      "BSD: We've got hot babes."

    2. Re:BSD vs. Linux by Anonymous Coward · · Score: 0
      "BSD: We've got hot babes."

      Heh, when everything's said and done, what else really matters? :P

  4. Why *BSD is dying - an insider's analysis by Anonymous Coward · · Score: -1, Redundant
    The End of *BSD

    [ed. note: in the following text, former FreeBSD developer Mike Smith gives his reasons for abandoning FreeBSD]

    When I stood for election to the FreeBSD core team nearly two years ago, many of you will recall that it was after a long series of debates during which I maintained that too much organisation, too many rules and too much formality would be a bad thing for the project.

    Today, as I read the latest discussions on the future of the FreeBSD project, I see the same problem; a few new faces and many of the old going over the same tired arguments and suggesting variations on the same worthless schemes. Frankly I'm sick of it.

    FreeBSD used to be fun. It used to be about doing things the right way. It used to be something that you could sink your teeth into when the mundane chores of programming for a living got you down. It was something cool and exciting; a way to spend your spare time on an endeavour you loved that was at the same time wholesome and worthwhile.

    It's not anymore. It's about bylaws and committees and reports and milestones, telling others what to do and doing what you're told. It's about who can rant the longest or shout the loudest or mislead the most people into a bloc in order to legitimise doing what they think is best. Individuals notwithstanding, the project as a whole has lost track of where it's going, and has instead become obsessed with process and mechanics.

    So I'm leaving core. I don't want to feel like I should be "doing something" about a project that has lost interest in having something done for it. I don't have the energy to fight what has clearly become a losing battle; I have a life to live and a job to keep, and I won't achieve any of the goals I personally consider worthwhile if I remain obligated to care for the project.

    Discussion

    I'm sure that I've offended some people already; I'm sure that by the time I'm done here, I'll have offended more. If you feel a need to play to the crowd in your replies rather than make a sincere effort to address the problems I'm discussing here, please do us the courtesy of playing your politics openly.

    From a technical perspective, the project faces a set of challenges that significantly outstrips our ability to deliver. Some of the resources that we need to address these challenges are tied up in the fruitless metadiscussions that have raged since we made the mistake of electing officers. Others have left in disgust, or been driven out by the culture of abuse and distraction that has grown up since then. More may well remain available to recruitment, but while the project is busy infighting our chances for successful outreach are sorely diminished.

    There's no simple solution to this. For the project to move forward, one or the other of the warring philosophies must win out; either the project returns to its laid-back roots and gets on with the work, or it transforms into a super-organised engineering project and executes a brilliant plan to deliver what, ultimately, we all know we want.

    Whatever path is chosen, whatever balance is struck, the choosing and the striking are the important parts. The current indecision and endless conflict are incompatible with any sort of progress.

    Trying to dissect the above is far beyond the scope of any parting shot, no matter how distended. All I can really ask of you all is to let go of the minutiae for a moment and take a look at the big picture. What is the ultimate goal here? How can we get there with as little overhead as possible? How would you like to be treated by your fellow travellers?

    Shouts

    To the Slashdot "BSD is dying" crowd - big deal. Death is part of the cycle; take a look at your soft, pallid bodies and consider that right this very moment, parts of you are dying. See? It's not so bad.

    To the bulk of the FreeBSD committerbase and the developer community at large - keep your eyes on the real goals. It's when you get distracted by the politickers that they sideline you. The tireless work that you perform keeping the system clean and building is what provides the platform for the obsessives and the prima donnas to have their moments in the sun. In the end, we need you all; in order to go forwards we must first avoid going backwards.

    To the paranoid conspiracy theorists - yes, I work for Apple too. No, my resignation wasn't on Steve's direct orders, or in any way related to work I'm doing, may do, may not do, or indeed what was in the tea I had at lunchtime today. It's about real problems that the project faces, real problems that the project has brought upon itself. You can't escape them by inventing excuses about outside influence, the problem stems from within.

    To the politically obsessed - give it a break, if you can. No, the project isn't a lemonade stand anymore, but it's not a world-spanning corporate juggernaut either and some of the more grandiose visions going around are in need of a solid dose of reality. Keep it simple, stupid.

    To the grandstanders, the prima donnas, and anyone that thinks that they can hold the project to ransom for their own agenda - give it a break, if you can. When the current core were elected, we took a conscious stand against vigorous sanctions, and some of you have exploited that. A new core is going to have to decide whether to repeat this mistake or get tough. I hope they learn from our errors.

    Future

    I started work on FreeBSD because it was fun. If I'm going to continue, it has to be fun again. There are things I still feel obligated to do, and with any luck I'll find the time to meet those obligations.

    However I don't feel an obligation to get involved in the political mess the project is in right now. I tried, I burnt out. I don't feel that my efforts were worthwhile. So I won't be standing for election, I won't be shouting from the sidelines, and I probably won't vote in the next round of ballots.

    You could say I'm packing up my toys. I'm not going home just yet, but I'm not going to play unless you can work out how to make the project somewhere fun to be again.

    = Mike

    --

    To announce that there must be no criticism of the president, or that we are to stand by the president, right or wrong, is not only unpatriotic and servile, but is morally treasonable to the American public. -- Theodore Roosevelt
  5. Elegy for *BSD by Anonymous Coward · · Score: -1, Offtopic

    I am a *BSD user
    and I try hard to be brave
    That is a tall order
    *BSD's foot is in the grave.

    I tap at my toy keyboard
    and whistle a cheerful tune
    but keeping happy is so hard,
    *BSD will be die real soon.

    Each day I wake and softly sob
    Nightfall finds me crying
    Not only am I a zit faced slob
    but *BSD is dying.
  6. Lucent? by akharon · · Score: 1

    I seem to remember Lucent making something similar to this a few years back that could encapsulate a binary to stop buffer overflows. I know that's not the same, but it is similar. I'm too lazy to look for a link, so one of you karma whores (smnolde) can dig up a link.

    1. Re:Lucent? by evilviper · · Score: 2
      Lucent making something similar to this a few years back that could encapsulate a binary to stop buffer overflows. I know that's not the same, but it is similar.

      No, that's not even close. This monitors what the program is attempting to access, not monitoring buffers, return values, etc. Very different.
      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  7. *BSD is dying by Anonymous Coward · · Score: -1, Troll
    It is official; Netcraft confirms: *BSD is dying

    One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the hels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.

    You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.

    FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.

    Let's keep to the facts and look at the numbers.

    OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.

    Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.

    Fact: *BSD is dying

  8. Great news! by Lomby · · Score: 2, Interesting

    This is really a great advacement for security. I hope it will be ported to Linux as soon as possible.

    With this mechanism, basically every program can be sandboxed. Basically it would be very useful to restrict the access to the filesystem: applications do not need to access certain directories, or even better they should only access /home and /tmp.

    Still the permissions should be defined mainly at system level: for example the mozilla binary must not be allowed to access /etc or /sbin for any user.

    1. Re:Great news! by Anonymous Coward · · Score: 0

      I don't understand what's great about this!"OPEN" source software will forever have the source so a Binary file sandbox would only benefit some closed source app which wont allow access to source. In which case the company would be held accountable for whatever nastiness the application caused anyway. I think that people hear security and get to caught up. I remember when HTML, HTTP, were buzzwords. Now crypto, ultra secure this and encrypted file systems are the new ones.

    2. Re:Great news! by Anonymous Coward · · Score: -1, Troll

      Please try to stay on topic, everyone knows that this is thread about *BSD being neary dead. No one cares about what you do in your sandbox with linux. Fact: *BSD is nearly dead.

    3. Re:Great news! by Anonymous Coward · · Score: 2, Informative

      Sandboxes are good for open sourced apps also. Ever seen a bug in an open sourced app? Yup, me too. Till those bugs get fixed, a sandbox will help ensure apps don't go tromping on files, accessing devices, spewing network packets, etc.

    4. Re:Great news! by Anonymous Coward · · Score: 0

      I hope it will be ported to Linux as soon as possible.

      Given the 190+ linux versions, and people willing to go from version to version for 'this feature or that widget', why not move to OpenBSD for this feature?

    5. Re:Great news! by evilviper · · Score: 2
      the mozilla binary must not be allowed to access /etc or /sbin for any user.

      Hope you either use a http proxy or always type in IP addresses, or else you wont be surfing the web any more. /etc/resolv.conf is just one of several files in /etc that user-level processes use.
      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
    6. Re:Great news! by adamsc · · Score: 2

      This would be an excellent addition for a package management system - when you install foo.(deb|rpm) it could automatically put a set of sane defaults in some master directory under /etc which could be extended (or overriden if the sysadmin allows it) by a file in a similar directory (.sandbox?) in your home directory.

  9. How does this compare to Jail? by Anonymous Coward · · Score: 2, Interesting

    Does this isolate the programs from each other like Jail in FreeBSD or is it more of a system protection?

    I've messed around with jail in FreeBSD and see there is a porting to Linux. Nice to see this in OpenBSD. Hey Microsoft, what have you got?

    1. Re:How does this compare to Jail? by Anonymous Coward · · Score: 1, Funny

      They have IIS, Exchange, and Internet Explorer running wholly in kernel space.

      Running programs as SYSTEM makes them fast!
      Whoops!
      Where's all my files!
      I are hacked!

    2. Re:How does this compare to Jail? by benhaha · · Score: 2, Informative

      Since Windows 2000 microsoft have had sandboxing of arbitrary processes with Job objects.

      (FWIW, a Job object is a container for processes which can impose multiple restrictions on all children. Obvious, overdue stuff such as memory and processor quotas are included, but so is the ability to restrict which USER (windowing) objects a process can have access to. In principle this allows you to run untrusted GUI apps with lower privilages without the DOS/intrustion problems that come from features such as the clipboard, DDE, COM and so forth. Unfortunately you have to do this programattically, and MS don't appear to have done anything much with it yet from the perspective of the end user).

      And of course system calls have always had restrictions on them, (though not on a per-function basis) via user rights.

      --
      NO ID: BEING FREE MEANS NOT HAVING TO PROVE IT
    3. Re:How does this compare to Jail? by benhaha · · Score: 2, Insightful

      Running as System is NOT the same as running in Kernel space.

      It means running without local security restrictions, and is precisely equivalent to running things as root. Administrator has reduced privilages compared to root or System.

      The main (only?) reason to do this is if you need to do things with the privilages of other users, and even here NT provides proper impersonation facilities, so that's largely unneccessary if you are using an NT-supported authentication system, such as NTCR or X509 (I don't have a complete list, but you can write your own, like PAM in Linux -- if you trust yourself).

      Also, FYI:

      Internet Explorer runs neither in Kernel Space (I assume you mean kernel mode) nor as System, but as a user-mode process with the privilages of the user who started it.

      The default installation of IIS has not run as System for about four years (maybe more, not sure, but at least four). Now it runs as IUSR_, which is a normal user and uses impersonation to check for file access privilages.

      I don't know about Exchange, but I would be surprised if it ran a system these days.

      --
      NO ID: BEING FREE MEANS NOT HAVING TO PROVE IT
  10. Could be a long time comming by BagOBones · · Score: 1
    Eventually binary-only software is going to become more and more common in Linux
    From a user stand point that should make things much easyer, but the core systems of all the differant Distros would need to be standardized in some way.. Or dependancy managment would have to be more automatic.. Even as a programmer I HATE having to compile packages when all I want to do is download and test an app.
    --
    EA David Gardner -"... but the consumers have proven that actually what they want is fun."
  11. haiku by Anonymous Coward · · Score: -1, Troll

    helicopter crash
    dead flesh stinking charred flesh
    freebsd death

  12. What we can learn from BSD by Anonymous Coward · · Score: -1, Troll
    What We Can Learn From BSD
    By Chinese Karma Whore, Version 1.0

    Everyone knows aboutBSD's failure and imminent demise. As we pore over the history of BSD, we'll uncover a story of fatal mistakes, poor priorities, and personal rivalry, and we'll learn what mistakes to void so as to save Linux from a similarly grisly fate.

    Let's not be overly morbid and give BSD credit for its early successes. In the 1970s, Ken Thompson and Bill Joy both made significant contributions to the computing world on the BSD platform. In the 80s, DARPA saw BSD as the premiere open platform, and, after initial successes with the 4.1BSD product, gave the BSD company a 2 year contract.

    These early triumphs would soon be forgotten in a series of internal conflicts that would mar BSD's progress. In 1992, AT&T filed suit against Berkeley Software, claiming that proprietary code agreements had been haphazardly violated. In the same year, BSD filed countersuit, reciprocating bad intentions and fueling internal rivalry. While AT&T and Berkeley Software lawyers battled in court, lead developers of various BSD distributions quarreled on Usenet. In 1995, Theo de Raadt, one of the founders of the NetBSD project, formed his own rival distribution, OpenBSD, as the result of a quarrel that he documents on his website. Mr. de Raadt's stubborn arrogance was later seen in his clash with Darren Reed, which resulted in the expulsion of IPF from the OpenBSD distribution.

    As personal rivalries took precedence over a quality product, BSD's codebase became worse and worse. As we all know, incompatibilities between each BSD distribution make code sharing an arduous task. Research conducted at MIT found BSD's filesystem implementation to be "very poorly performing." Even BSD's acclaimed TCP/IP stack has lagged behind, according to this study.

    Problems with BSD's codebase were compounded by fundamental flaws in the BSD design approach. As argued by Eric Raymond in his watershed essay, The Cathedral and the Bazaar, rapid, decentralized development models are inherently superior to slow, centralized ones in software development. BSD developers never heeded Mr. Raymond's lesson and insisted that centralized models lead to 'cleaner code.' Don't believe their hype - BSD's development model has significantly impaired its progress. Any achievements that BSD managed to make were nullified by the BSD license, which allows corporations and coders alike to reap profits without reciprocating the goodwill of open-source. Fortunately, Linux is not prone to this exploitation, as it is licensed under the GPL.

    The failure of BSD culminated in the resignation of Jordan Hubbard and Michael Smith from the FreeBSD core team. They both believed that FreeBSD had long lost its earlier vitality. Like an empire in decline, BSD had become bureaucratic and stagnant. As Linux gains market share and as BSD sinks deeper into the mire of decay, their parting addresses will resound as fitting eulogies to BSD's demise.

  13. Cool, but... by jfeasel · · Score: 1

    This sounds like a great idea - however, on OpenBSD, how useful could this be? I don't know of any program that is released as a "binary-only" for OpenBSD. In Linux this could definately useful, as there are many binary only programs. It seems to me that with OpenBSD, you are basically required to compile. Which isn't really a problem - as long as you only want to use OSS.

  14. Slashdot is dying by Anonymous Coward · · Score: -1, Troll

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  15. Slashdot is dying by Anonymous Coward · · Score: -1, Troll

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  16. Slashdot is dying by Anonymous Coward · · Score: 0

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  17. Slashdot is dying by Anonymous Coward · · Score: -1, Troll

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  18. Slashdot is dying by Anonymous Coward · · Score: -1, Troll

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  19. Slashdot is dying by Anonymous Coward · · Score: -1, Troll

    (Reposted from an earlier story -- worth reading.)

    It is now official - a Slashdot poll has confirmed: Slashdot is dying

    Yet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.

    You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.

    Let's keep to the facts and look at the numbers.

    Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.

    Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.

    All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.

    So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.

    Fact: Slashdot is dying

  20. been done... by ghassanm · · Score: 1

    This isn't a really novel project as it has allready been done by David Wagner and Tal Garfinkel. I highly recommend people read the Janus paper located at the bottom of this page. They did something very similar although it uses some funny Solaris /proc interface hack. Notice that the paper presents the exact same idea for isolating web browsers. This Systrace mechanism seems a bit more complete though.

    1. Re:been done... by Anonymous Coward · · Score: 0

      And it's under a BSD license, the other implementations were too restrictive for the OpenBSD source tree (GPL is no-go).

  21. security in BSD by spunkykuma · · Score: 1

    I like that idea, though I see would be a more useful thing in Linux or FreeBSD than in OpenBSD. For those of you that use NetBSD, there's an exec denier (restircts specified users from executing things in /sbin, /usr/sbin, etc.) and there's a jail module as well which restricts processes, such as jailing ssh and running top in an ssh session will disallow you to see other processes other than your own - Both of which are kernel modules (LKM).
    As for binary-only software in Linux, I don't believe the number of binary only applications will increase very much more other than commercial or restricted licensed apps.

  22. Re:Could be a long time comming (sic) by TeaDaemon · · Score: 1

    Isn't that what the Linux Standards Base is for?

    IMHO, however, I almost always compile from source, especially with a new piece of software, though if you're running less powerful hardware it can be a bit of a drag.

  23. Thank God by Groganz · · Score: 1

    "it is highly portable and can easily be integrated into GNU/Linux systems"

    Otherwise it wouldn't be newsworthy.

  24. UML by Anonymous Coward · · Score: 0
    From a user stand point that should make things much easyer, but the core systems of all the differant Distros would need to be standardized in some way.. Or dependancy managment would have to be more automatic.. Even as a programmer I HATE having to compile packages when all I want to do is download and test an app.

    User Mode Linux

  25. Highly portable? by pdqlamb · · Score: 2

    It's part of OBSD. You have to crank through a kernel mod to use it. And it's still "highly portable?" Sure, and command line Linux is "user friendly" and Winblows is "highly secure."