Slashdot Mirror


User: cehf2

cehf2's activity in the archive.

Stories
0
Comments
51
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 51

  1. Re:Deal breaker on Updated Mac Mini Aims For the Living Room · · Score: 1

    One of the best things about the old mac minis is they had optical digital audio output in the 3.5mm jack as well - if they have kept that then you should be able to get proper surround sound....

    Crispin

  2. Re:why remove it? on Firefox Moving On From SSL 2.0 · · Score: 1

    You don't end up using the worst SSL version, a well written server will use the best common SSL version.

    The SSL handshake is a multi-step process, it is only the initial 'ClientHello' record that is in the SSLv2 format. Inside that record is information telling the server the maximum SSL version the client supports. The SSL server will then respond with an SSLv3 (or TLS) 'ServerHello' record, and from that point on, the server and client will complete the SSLv3 handshake.

    There isn't any security problems leading with an SSLv2 ClientHello message, the only problems come from when the server only support SSLv2 and so an SSLv2 handshake has to be completed.

    If you don't believe me with any of this, download ethereal or ssldump and see what SSL versions each of the encoded SSL records is returned as.

  3. Re:Sky Plus? on TiVo Basic · · Score: 2, Informative
    Sky Plus is completly different from the UK version of Tivo. Sky Plus is created by Sky and embedded into its set-top-boxes, allowing it to only record programs from Sky.

    Thompson made a Series 1 Tivo for the UK, but have recently stopped production, it has much better functionlity, plus it can be hacked to add a network card, and extra capacity.

    For a comparison between Sky Plus and Tivo, see http://www.garysargent.co.uk/tivo/TIVOvsSKY.htm.

  4. Re:Overclocking on Athlon Xp 3200+ 400FSB is Coming · · Score: 1

    Overclocking does not mean having lots of noisy fans or shortening the life of a chip. I have a Celeron 300A, which although over 3 years old has performed perfectly at 450Mhz for all of its life.

    As for fans, I started out adding them, but recently I have resorted to removing them and adding some ducting to keep everything cool. The only nosiy thing in my PC is the hard disks which are 5 years old :)

    The nice thing about the Celeron for o'clocking is that as you only increase the FSB from 66 to 100, you only o'clock the chip, not the m'board or RAM.

  5. Re:Well then on New Terminator 3 Trailer Released · · Score: 1
    Another Arnie film already beat ya there. True Lies featured a railgun in it as the gimicky plot device.
    Don't you mean Eraser?
  6. Re:virtualhosting/ssl on Slashdot over IPv6 · · Score: 1
    You are indeed correct that SSL sites need to be unique per ip/port combination, however there is an extension to TLSv1.0 (the IETF SSL standard) that allows the client to tell the server the host it is attempting to contact, (just as HTTP passes this information in the Host Header).

    I believe that this extension will become standard soon, but then of course you need all the SSL browsers and servers to implement the extension before we can solve that particular problem.

  7. Re:I need a clean desktop on Gnome 2.2 Released · · Score: 2, Informative
    Nautilus draws the desktop normally, and it seems as thugh they have removed the UI element to configure whether you can put icons on the desktop, however by digging through the gconf scehema, you can stop nautilus from drawing the desktop by running:
    $ gconftool-2 -t boolean -s /apps/nautilus/preferences/show_desktop false
    However this removes all icons from the desktop, not just the trash and home icons.

    Crispin

  8. Re:Couple of points on An Offer Tivo Owners Can't Refuse · · Score: 1

    Actually it is not 112 GBP per tv, it is 112 GBP per household that owns a TV. There are however special rules for university halls and the like.

  9. Re:View Source on Mozilla Tree Closes for 1.0 · · Score: 1

    Well maybe they should close the real bug then: http://bugzilla.mozilla.org/show_bug.cgi?id=55583. Although it seems as though the actual feature is implemented, from following bug 55583, it is not clear whether it is or not.

  10. How is this relevant to BT's patent? on 82-Year-Old Coder Trumps BT's Hyperlink Patent · · Score: 1, Insightful

    This guy claims he invented the 'escape' key. Which is necessary for BT's hyperlink patent.

    I can't see how that can have any relevance to this patent, which covers a very specific method of linking content together. Any patent can use information from another patent, but you would not be able to use what you invented (assuming it uses the other patent) without coming to an agreement with the other party. The fact remains that in that situation, both patents can be valid.

    Please correct me if I am wrong - IANAL

  11. Re:Static PHP + scripts running as users on Covalent's Version of Apache 2.0 To Drop Monday · · Score: 4, Informative
    With any application running on a web server there is a trade off between performance and security. because the PHP module is running inside the core of the web server, it should be fairly fast, however if you want the ability to change what users the php scripts run as, your only option is to use CGI scripts. CGI by its very nature is *very* slow. This is due to the overhead of the fork/exec/load program.

    You may also be able compile PHP as a FastCGI program, you could then run several external FastCGI's as different users and configure Apache to run the particular script with a particular FastCgi program. I have no idea how to do this with apache, as I use Zeus myself.

    If Apache 2 does have a way to switch users for PHP scripts, it will not be secure. Under UNIX, once you have dropped your permissions you can never gain them again. The work around is to have 'real' and 'effective' users that programs run as. As long as you only change your efective user, you can re-gain permissions, but anything can regain permissions. You can also only change users when you are root. This would be a big security hole, in that if there was a buffer overflow attack root could trivially be optained by anyone.

    security, performance, configurability - pick 2

  12. OpenSSh - no problem on SSH Taking Stand On Vulnerability · · Score: 3, Interesting

    It appears, using openssh 2.9p2 (that currently in debian/unstable) that it sends the entire password in one TCP packet, so no problem there then.

  13. Re:comparisons on The Speed Demon That Is Tux 2.0 · · Score: 1

    Zeus is not a threaded server, or even like Apache, it uses a select() based model where one process can handle many hundreds of simultaneous connections.

  14. Abit GPL violation on Slashback: Juveniles, Sand, Trickery, MoBos · · Score: 2

    IANAL, however if they release code that was under the GPL, under a different violation, they should be taken to court about it and told to release the code. I understand that only the code creator can take the case to court and sue Abit, but perhaps we could set up a fund to finance actions against companies that violate the GPL, either wilfully or not.

    Even after being told they have a violation, they refuse to release the code (Abit and nVidia) and then proceed to praise the open source movement for it's work, well get do what you preach companies, you are quite happy to use open source code, however when it comes to releasing a few thousand lines of code back to the community, then you should do.

    Give something back to the community, open YOUR code

  15. Anonymity is a good thing on Seagram Declares War On Napster · · Score: 2

    This is nothing more than the digital equivalent of putting on a ski mask when you rob a bank.

    This is not the equivalent. In the real world you are allowed to wear a ski mask down the high street and be anonymous. You are also allowed to wear a ski mask while robbing a bank (the robbing the bank part is the illegal part). I can see what is wrong with piracy, however being anonymous while online is the ONLY way that people who don't usually surf the web will get on it. Having a unique ID in ALL you communication over the internet seems to be what this guy thinks, which is definately NOT a good thing.

  16. Alan's Todo list on Linux 2.4.0-test1 Released · · Score: 5

    Before people get their hopes up, you should check out the length of Alan Cox's Todo list. It is not small :(

    Capable Of Corrupting Your FS
    -----------------------------
    E820 memory setup causes crashes/corruption on some laptops
    Use PCI DMA by default in IDE is unsafe on VIA VPx x<3

    Security
    --------
    Fix module remove race bug (mostly done - Al Viro)
    exec loader permissions
    Semaphore races (fix in 2.2)
    Semaphore memory leak (fix in 2.2)
    Exploitable leak in file locking (Willy)
    TTY and N_HDLC layer called poll_wait twice per fd and corrupt memory
    ATM layer calls poll_wait twice per fd and corrupts memory
    Random calls poll_wait twice per fd and corrupts memory
    PCI sound calls poll_wait twice per fd and corrupts memory
    sbus audio calls poll_wait twice per fd and corrupts memory
    access_process_mm oops/lockup if task->mm changes (Manfred) [user can cause deliberately]
    RtSig limit handling bug
    Signals leak kernel memory (security) [FIX in ac tree]

    Boot Time Failures
    ------------------
    IDE fails on some VIA boards (eg the i-opener)
    AHA29xx driver appears to stomp other cards
    Use PCI DMA 'lost interrupt' problem with some hw [which ?]
    (NEC Versa LX with PIIX tuning)
    HT6560/UMC8672 ide sets up stuff too early (before region stuff can be done)
    Crashes on boot on some Compaqs ? (may be fixed)
    IBM MCA driver breaks on Device_Inquiry at boot
    DEFXX driver appears broken
    ACPI hangs on boot for some systems

    In Progress
    -----------
    Dcache threading (Al Viro)
    Merge the network fixes (DaveM)
    Finish I2O merge (Intel/Alan)
    Fix all remaining PCI code to use new resources and enable_Device (mostly done)

    Fix Exists But Isnt Merged
    --------------------------
    Update SGI VisWS to new-style IRQ handling (Ingo)
    64bit lockf support
    Support MP table above 1Gig (Ingo)
    Finish sorting out VM balancing (Rik Van Riel, Juan Quintela et al)
    Dont panic on boot when meeting HP boxes with wacked APIC table numbering (AC)
    Scheduler bugs in RT (Dimitris)
    Fix eth= command line
    HFS is still broken
    AIC7xxx doesnt work non PCI ? (Doug says OK, new version due anyway)
    8139 + bridging fails
    Fix hpfs_unlink (Al Viro)
    put_user is broken for i386 machines (security) - sem stuff may be wrong too
    BusLogic crashes when you cat /proc/scsi/BusLogic/0 (Robert de Vries)
    Loopback fs hangs

    To Do
    -----
    SHM code corrupts memory
    Floppy driver broken by VFS changes. Other drivers may be too
    (Stuff gets called after _close now - unload race possibly too)
    Tulip hang on rmmod/crashes sometimes
    Devfs races, Sockfs (removing NULL ->i_sb stuf) (Al Viro)
    Restore O_SYNC functionality
    Debian report that the gcc 2.95 possibly miscompiles fault.c or mm/remap.c
    (Perl script available from Arjan)
    Fix further NFS races (Al Viro)
    Trace numerous random crashes in the inode cache
    Test other file systems on write
    The netdev name changing stuff broke GRE
    Audit all char and block drivers to ensure they are safe with the 2.3
    locking - a lot of them are not especially on the open() path.
    Stick lock_kernel() calls around driver with issues to hard to fix nicely
    for 2.4 itself
    PCMCIA/Cardbus hangs, IRQ problems, Keyboard/mouse problem (may be fixed ?)
    pci_socket crash on unload
    truncate_inode_pages does unsafe page cache operations
    Linux sends a 1K buffer with SCSI inquiries. The ANSI-SCSI limit is 255.
    Linux uses TEST_UNIT_READY to chck for device presence on a PUN/LUN. The
    INQUIRY is the only valid test allowed by the spec.

    To Do But Non Showstopper
    -------------------------
    Make syncppp use new ppp code
    Finish 64bit vfs merges (lockf64 and friends missing)
    NCR5380 isnt smp safe
    DMFE is not SMP safe
    Go through as 2.4pre kicks in and figure what we should mark obsolete for
    the final 2.4
    Union mount (Al Viro)
    Per Process rtsigio limit
    Fix SPX socket code
    Boot hangs on a range of Dell docking stations (Latitude)
    iget abuse in knfsd
    Some people report 2.3.x serial problems
    USB hangs on APM suspend on some machines
    PCMCIA crashes on unloading pci_socket
    ISAPnP IRQ handling failing on SB1000 + resource handling bug
    TB Multisound driver hasnt been updated for new isa I/O totally.
    Fix boards with different TSC per CPU and kill TSC use on them
    DVD-RAM is apparently not working for write currently (Rogier Wolff)

    Compatibility Errors
    --------------------
    Xterm broke in 2.3.99pre6 (FIONREAD/select loop)

    Probably Post 2.4
    -----------------
    per super block write_super needs an async flag
    addres_space needs a VM pressure/flush callback (Ingo)
    per file_op rw_kiovec

    Drivers In 2.2 not 2.4
    ----------------------

    To Check
    --------
    Check O_APPEND atomicity bug fixing is complete
    Protection on isize (sct) [Al Viro mostly done]
    Mikulas claims we need to fix the getblk/mark_buffer_uptodate thing for
    2.3.x as well
    Network block device seems broken by block device changes
    Fbcon races
    VFS?VM - mmap/write deadlock (demo code seems to show lock is there)
    rw sempahores on page faults (mmap_sem)
    kiobuf seperate lock functions/bounce/page_address fixes
    Fix routing by fwmark
    Some FB drivers check the A000 area and find it busy then bomb out
    rw semaphores on inodes to fix read/truncate races ? [Probably fixed]
    Not all device drivers are safe now the write inode lock isnt taken on write
    File locking needs checking for races
    Multiwrite IDE breaks on a disk error [minor issue at best]
    ACPI/APM suspend issue - IDE related stuff ?
    NFS bugs are fixed
    Floppy last block cache flush error
    Chase reports of SMB not working
    Locking on getcwd
    floppy fails on some machines
    IRDA calls get random bytes before random is set up
    Some AWE cards are not being found by ISAPnP ??
    SHM segments not always being detached and destroyed right ?

  17. Re:Not Helix Gnome 1.2 on Gnome 1.2.0 Released · · Score: 1

    I agree with you. however they really ought to go through the list with a fine toothcomb and clean the bugs list out. When I want to report a bug, it takes ages to search the lists (especially for gnome-core) to see if it has already been reported.

  18. Not Helix Gnome 1.2 on Gnome 1.2.0 Released · · Score: 3

    This is actually Gnome 1.2. As Helix code often point out, they simply re-package Gnome. Having said that, this is a great leap forward for gnome, now if only they went through the bug reports and fixed them all. In the current state, Microsoft could say, look at all these bugs, they have thousands to fix as well.

  19. Re:Universities on Oxford Yanks Student Page Over Spoof DeCSS · · Score: 1

    You should read the rules for use of University equipment. Although I am "at the other place" (tm) I imagine that the rules will be much the same, and if they are anything like they are here, they will be buried somewhere in the midst of the comptuer service web site. The rules will probably say that they reserve the right to pull web sites or some other such thing.

  20. Inevitable on New, More Destructive Love Bug Variant · · Score: 1

    This was inevitable, the interesting thing about this virus is that it morphs as well as changing the subject, well according to this BBC report. What we need is a foolproof of making users check what they are doing when they use their computer, to ensure all the files don't get deleted.....oh.....wait a minute, isn't that what Linux is for?

  21. WAP on palm on Google Releases WAP Search Tool · · Score: 1

    Are there any WAP browsers for Palm V's ?

    It does seem like a bit of a gimmic to me, however I suppose if I had a mobile phone then it may be more useful.

    Crispin

  22. legitimate copies? on Attacking Open Source · · Score: 1

    Mozilla.org - has released exactly zero legitimate copies of its browser.

    Surely, Mozilla.org has released many thousand legitimate copies, every time someone downloads it they are getting a legitimate (legal) copy.

    Yet another worthless comment in an otherwise worthless artical.

  23. Re:My critique of /. on Attacking Open Source · · Score: 2

    I actually agree with you here, even though I run Linux as my main OS, I also run Windows 98 and Windows 2000.

    There are many things wrong with slashdot - namely the large number of people from the US who think their law is the world's law (storie about UK email thingy yesterday, Russian lyrics site).

    There are also many good things about slashdot, a general alround summary of what is happening in the world of technology, well Linux technology :)

    However, I suggest you read the article, you may not like Linux, and I do suggest you try it, just once even, not everyone is a zealot. The article referred to here is not the sort of thing that is not good for open source in general, it is very narrow minded and badly-informed, or else is just flaimbait.

  24. Re:US laws in Russia? on New Russian Site Carries Unlicensed Song Lyrics · · Score: 1

    We seem to have a few crossed wires - If you read my comments I have never said it is a matter for US law. I am in fact saying it is NOT a matter for US law. You are however right in saying that I not well versed in the treatys, however I am happy to accept what you say as you obviously know more than me :)

    I still claim however that the orginal comment in the post that:

    ...in Russia, where U.S.law ... seems to mean little or nothing.

    is not a good thing to say, as US law has no meaning whatsoever in other countries even with treaties. For instance, US can't make a new law and then enforce it on other countries.

    It is however, I agree, a matter of International law, but even so, the chances of anything happening in Russia are negligable as they have slightly more pressing problems than either worryng about this sort of thing.

  25. Re:Legal Clarifications on UK Building Eavesdropping Infrastructure · · Score: 1

    and, you can't sue one individual agent for a law that Britain made that you just happen not to like.