Even by overriding the library functions, this does not preclude the possibility of other overflow conditions in code. There are many occasions in C code when a pointer is referenced outside of a standard library function.
For example, how would libsafe stop an overreach condition, like x[i], where x is a char pointer?
It's certainly an interesting approach that they are taking, but I would rather have access to the source, and be able to audit for myself. I don't like black boxes.
I occasionally see some UI shakiness.. Usually when using a text entry widget, or other, less often visited portions of the browser.
I think most people complain about Mozilla being slow because it doesn't always respond how they expect. The actual UI and usability has taken a backseat for a long time, while the team gets the actual rendering and javascript up to speed.
Personally, I rather prefer this approach. I have entirely two more browsers with good UIs and/horrible/ rendering in my toolset. (Netscrape 4.x, IE x.x) I don't need a third.
Perfectly valid, in theory, if we ignore the restrictions on entrapment. But, in practice? The manpower costs, alone, would be tremendous.. Varying national legal systems, rapidly shifting nodes, and public hue and cry would make cracking down on FreeNet sits an expensive proposition.
Take a look at HP's Virtual Vault, which was based off a smaller company's certified B-level refitting of the HP-UX and Solaris kernels.
The latest evolutions of HP, based off HP-UX 10.xx tree, are no longer certified, since this auditing must be done every time the source changes, but there/have/ been OS's other than Multics that achieved B-level.
The question at hand is, will the open source movement be able to halt its endless updates and improvements to sit down and do a full audit of FreeBSD, with these extensions. Even HP is loathe to do it, and VV/HP-UX's march of progress is considerably slower in tempo.
Pooh-pooh'ing aside, I am very eagerly awaiting a BSD with finely grained privileges, and I wish the implementors the best of luck!
How early was the release? The tracker has evolved quite a bit, since the Developer Preview days. Mostly adding various configurability options.
If you are comparing this to the MacOS finder.. Let me engage in a little trolling. Can we said multithreaded?;) Copying a file doesn't hang the tracker. Or slow down the interface, anywhere else.
Be is one of those incredibly conscientious software houses that is becoming more and more rare, these days. From a Quality Assurance point of view, there is no better desktop operating system.
First, the installation is as painless as it gets. Just follow the instructions, put the image file where they tell you, prep a boot floppy, and reboot. There is no clucking about which drivers, irqs, scanlines, etc. It comes up in 640x480x8x60hz, and you can immediately change resolutions. It is an act of frustration when I come back to Windows or Linux to install, and having to think about these things. This was also mostly true for R4.5, although you had to tell it which NIC you have.
Secondly, from a user interface point of view, the quality of BeOS is very apparent. It reacts quickly to the user, placing a high importance on the User Interface server, which handles input events. This is unlike most other OS's, which consider the user to be the slowest part of the system, and give them scraps of time, inbetween more important things, like sleeping.
Finally, the OS design of BeOS is very, very tight. Once you accept that BeOS is not meant to be the next Unix, and accept that innovation occasionally means jettisoning cruft, you will find that underneath this pretty facade is one/very/ customizable system. Take the Be Filesystem, for example. The ability is there to define custom attributes for files, giving the ability to build database-like indexes of a mail directory, for instance, or perhaps an archive of MP3s, and save queries into that index as a new kind of directory. It's fully journaled, which is one of the reason it seems to come up so fast, and why BeOS users are rarely afraid to turn off their computers at night. I know it isn't Open Source, and it may offend the Linux Zealots, with its You-do-it-this-way simplicity, but please, do not judge BeOS until you have downloaded R5 personal, and tried it for yourself. You only have 60 megs of diskspace to lose, and and entire world to gain.
Thompson's hack was not part of a large open source project, with many, many people eyeballing it. We are talking about a very, very pure and special case. Here's why his hack would fail, today:
He's not the only game in town.
The cc/login backdoor was so damned clever, because that was the only C compiler available. You needed a C compiler to compile and generate newer versions of C, therefore the hack was propagated.
Nowadays, there are many C compilers, and they have become the de facto standard for building software. (Not a preferred standard. Python/Perl/Eiffel/Fortran fans please direct your flames to/dev/null or root@microsoft.com)
The point we are trying to make is, if a product is distributed as source, these kinds of blatant backdoors are going to be discovered. If not by someone auditing the code, then by someone who wanted to 'patch' some broken functionality. The/real/ danger are the little buffer overruns, race conditions and other common bugs.
Mmmm.. I always thought the reason that there were more trojans for unix than for dos was.. Dos doesn't have network connectivity out of the box?;) Kinda hard to write Back Orifice for MS-DOS using sneakernet as the transmission medium.
struct Fnord { int X; } struct BigFnord { int X; int Y; } NthFnordX(void* fArray, int index) { return (((Fnord*)fArray)[index])->X; } Whups? (Note that I'm not a big C or C++ user, but I know silliness when I see it.;) )
Re:Too passive, take the AOL approach instead.
on
Free Be
·
· Score: 1
Running out of coasters, AC?
Re:Be will be focusing on Internet appliance
on
Free Be
·
· Score: 1
They didn't drop the BeBox as a business decision. They dropped it, because the BeBox was dependent on the AT&T manufactured Hobbit chips, which, at the time, were tiny miracles. Unfortunately, AT&T stopped making them, and the BeBox went the way of the Dodo and the Amiga.
And, by another metric, the rapid increase in value for anything with Linux in the prospectus is a good indication that there is going to be a correction, soon. BeOS came into the scene before anyone else had started clamouring about Microsoft and monopolies, back when new operating systems weren't quite so fashionable on the market. I think, if we had seen the Be IPO this year, you would have seen the same overinflation you currently see with the Redhat stock. For all of you holding that high-value, low-yield technology stock, I would suggest ensuring that you keep your holdings diversified. Some of these high stock prices are unsustainable.
Well, thankfully, Be isn't quite as foolish as QNX and will be allowing people to download a fully usable version of their OS. QNX seems to want a pound of flesh in exchange for their SDK, even for evaluation purposes.
I would say that this is Be reaching out to grab one of the three things it still desperately needs: mindshare. BeOS is a wonderful environment, and one that hardly anyone uses, which could doom this OS to a life as an orphan if Be's backers lose faith. The kernel currently only lacks in its network layer, which, although it handles a normal client load quite well, doesn't do too well as a server. The third, and final thing Be needs, is software.. Hopefully, in R5, they will improve the Select() call, and fix several POSIX incompatabilities. They have also stated that they will be distributing their Metrowerks-designed IDE in the free distro, which should help out with lack #3. It seems like a very smart strategy to me. Lasso the high-tech home users, then capture the corporate users, later.
My guess is that it either runs in a virtual disk, using a file on the Fat32 partition, or, it uses something like the old UMSDOS filesystem, and uses special files to hold attribute and other values that FAT32 can't support.
For those of you unfamiliar, BeOS's normal file system has some very database-like aspects, including the ability to store additional data about the file, which is visible from a directory listing. This means they have to be doing something interesting to get it to cohabitate on FAT.
I'm still hoping for the FTC to shoot down this deal. Even disregarding my natural suspicion of AOL and its marketing-centric view of the world, and that I'm rather pleased with the fact that all I need to log on to my cable network is a DHCP client, this is/still/ two very large companies forming a bloc that may very well stifle competition in the ISP market, now that AOL has some/real/ content to provide in their service.
FTE is a/wonderful/ text editor.. Every time the old vi/emacs holy war starts up in my office, I hold up my beloved copy of FTE.
If you're looking for a simple, elegant WM that supports multiple workspaces and theming, go check out Blackbox, which is about as simple and elegant as they get. If you're really bold, after you've learned the 0.5x.0 interface, try out the 0.60.0 Alpha branch, which is at least as stable as the Enlightenment 'stable' releases and has even more themability.
Okay, you show me a modern infantry unit with laser sights organic to the unit. Hell, show me one using rifles that are more accurate than the carbines of earlier wars. Not even Task Force XXI, the Army's great experiment in force modernization, has signifigantly improved weapons.
If you'd actually sat down and READ, you illiterate ape, you would have seen that the percentiles being given are NOT accuracy but ratios comparing on the battlefield accuracy to accuracy on the training range. Also, the range at which these men fire, now, is far greater than the range at which they fired in the past. The longer your reach, the further apart you start the shooting. .... You found that infantry unit with the laser scopes? No? Any wizbang-super-neato-keen rocket packs? How about a railgun? No, "I saw it in Quake and The Eraser" don't count.
Those most ignorant are the ones who protest controversy the loudest.
The statistics being cited are a comparison between effectiveness of a soldier on the firing range versus his effectiveness on the battlefield. And US infantry very, very rarely have a scope with the M16, since its a clattering oversensitive piece of scrap.
Slashdot Mirror
Mmmmm... No.. I see plenty of Debian exploits, and generic Linux kernel exploits. Try again? ;)
Even by overriding the library functions, this does not preclude the possibility of other overflow conditions in code. There are many occasions in C code when a pointer is referenced outside of a standard library function.
For example, how would libsafe stop an overreach condition, like x[i], where x is a char pointer?
It's certainly an interesting approach that they are taking, but I would rather have access to the source, and be able to audit for myself. I don't like black boxes.
Oh come now.. I'd buy Plan 9 from Outer Space on DVD, too! Then again.. Plan 9 didn't have Gungans..
I occasionally see some UI shakiness.. Usually when using a text entry widget, or other, less often visited portions of the browser.
I think most people complain about Mozilla being slow because it doesn't always respond how they expect. The actual UI and usability has taken a backseat for a long time, while the team gets the actual rendering and javascript up to speed.
Personally, I rather prefer this approach. I have entirely two more browsers with good UIs and /horrible/ rendering in my toolset. (Netscrape 4.x, IE x.x) I don't need a third.
I /do/ miss URL-completion, though.
The next release of Debian, the Linux distro with a motto of 'We may not be cutting edge, but dammit, we're stable, and people like us.' ;)
Try living on them, and T-rations for a year or so. *shudder* If I ever have to look another omlette in the face..
Perfectly valid, in theory, if we ignore the restrictions on entrapment. But, in practice? The manpower costs, alone, would be tremendous.. Varying national legal systems, rapidly shifting nodes, and public hue and cry would make cracking down on FreeNet sits an expensive proposition.
Take a look at HP's Virtual Vault, which was based off a smaller company's certified B-level refitting of the HP-UX and Solaris kernels.
/have/ been OS's other than Multics that achieved B-level.
The latest evolutions of HP, based off HP-UX 10.xx tree, are no longer certified, since this auditing must be done every time the source changes, but there
The question at hand is, will the open source movement be able to halt its endless updates and improvements to sit down and do a full audit of FreeBSD, with these extensions. Even HP is loathe to do it, and VV/HP-UX's march of progress is considerably slower in tempo.
Pooh-pooh'ing aside, I am very eagerly awaiting a BSD with finely grained privileges, and I wish the implementors the best of luck!
Ever heard of Dosemu? ;)
How early was the release? The tracker has evolved quite a bit, since the Developer Preview days. Mostly adding various configurability options.
If you are comparing this to the MacOS finder.. Let me engage in a little trolling. Can we said multithreaded? ;) Copying a file doesn't hang the tracker. Or slow down the interface, anywhere else.
Be is one of those incredibly conscientious software houses that is becoming more and more rare, these days. From a Quality Assurance point of view, there is no better desktop operating system.
First, the installation is as painless as it gets. Just follow the instructions, put the image file where they tell you, prep a boot floppy, and reboot. There is no clucking about which drivers, irqs, scanlines, etc. It comes up in 640x480x8x60hz, and you can immediately change resolutions. It is an act of frustration when I come back to Windows or Linux to install, and having to think about these things. This was also mostly true for R4.5, although you had to tell it which NIC you have.
Secondly, from a user interface point of view, the quality of BeOS is very apparent. It reacts quickly to the user, placing a high importance on the User Interface server, which handles input events. This is unlike most other OS's, which consider the user to be the slowest part of the system, and give them scraps of time, inbetween more important things, like sleeping.
Finally, the OS design of BeOS is very, very tight. Once you accept that BeOS is not meant to be the next Unix, and accept that innovation occasionally means jettisoning cruft, you will find that underneath this pretty facade is one /very/ customizable system. Take the Be Filesystem, for example. The ability is there to define custom attributes for files, giving the ability to build database-like indexes of a mail directory, for instance, or perhaps an archive of MP3s, and save queries into that index as a new kind of directory. It's fully journaled, which is one of the reason it seems to come up so fast, and why BeOS users are rarely afraid to turn off their computers at night. I know it isn't Open Source, and it may offend the Linux Zealots, with its You-do-it-this-way simplicity, but please, do not judge BeOS until you have downloaded R5 personal, and tried it for yourself. You only have 60 megs of diskspace to lose, and and entire world to gain.
Thompson's hack was not part of a large open source project, with many, many people eyeballing it. We are talking about a very, very pure and special case. Here's why his hack would fail, today:
He's not the only game in town.
The cc/login backdoor was so damned clever, because that was the only C compiler available. You needed a C compiler to compile and generate newer versions of C, therefore the hack was propagated.
Nowadays, there are many C compilers, and they have become the de facto standard for building software. (Not a preferred standard. Python/Perl/Eiffel/Fortran fans please direct your flames to /dev/null or root@microsoft.com)
The point we are trying to make is, if a product is distributed as source, these kinds of blatant backdoors are going to be discovered. If not by someone auditing the code, then by someone who wanted to 'patch' some broken functionality. The /real/ danger are the little buffer overruns, race conditions and other common bugs.
Mmmm.. I always thought the reason that there were more trojans for unix than for dos was.. Dos doesn't have network connectivity out of the box? ;) Kinda hard to write Back Orifice for MS-DOS using sneakernet as the transmission medium.
struct Fnord { int X; } struct BigFnord { int X; int Y; } NthFnordX(void* fArray, int index) { return (((Fnord*)fArray)[index])->X; } Whups? (Note that I'm not a big C or C++ user, but I know silliness when I see it. ;) )
Running out of coasters, AC?
They didn't drop the BeBox as a business decision. They dropped it, because the BeBox was dependent on the AT&T manufactured Hobbit chips, which, at the time, were tiny miracles. Unfortunately, AT&T stopped making them, and the BeBox went the way of the Dodo and the Amiga.
And, by another metric, the rapid increase in value for anything with Linux in the prospectus is a good indication that there is going to be a correction, soon. BeOS came into the scene before anyone else had started clamouring about Microsoft and monopolies, back when new operating systems weren't quite so fashionable on the market. I think, if we had seen the Be IPO this year, you would have seen the same overinflation you currently see with the Redhat stock. For all of you holding that high-value, low-yield technology stock, I would suggest ensuring that you keep your holdings diversified. Some of these high stock prices are unsustainable.
Well, thankfully, Be isn't quite as foolish as QNX and will be allowing people to download a fully usable version of their OS. QNX seems to want a pound of flesh in exchange for their SDK, even for evaluation purposes.
I didn't see anywhere in their press release that R5 will only run on FAT32. I think you might be reading a little too much into things, AC.
I would say that this is Be reaching out to grab one of the three things it still desperately needs: mindshare. BeOS is a wonderful environment, and one that hardly anyone uses, which could doom this OS to a life as an orphan if Be's backers lose faith. The kernel currently only lacks in its network layer, which, although it handles a normal client load quite well, doesn't do too well as a server. The third, and final thing Be needs, is software.. Hopefully, in R5, they will improve the Select() call, and fix several POSIX incompatabilities. They have also stated that they will be distributing their Metrowerks-designed IDE in the free distro, which should help out with lack #3. It seems like a very smart strategy to me. Lasso the high-tech home users, then capture the corporate users, later.
My guess is that it either runs in a virtual disk, using a file on the Fat32 partition, or, it uses something like the old UMSDOS filesystem, and uses special files to hold attribute and other values that FAT32 can't support.
For those of you unfamiliar, BeOS's normal file system has some very database-like aspects, including the ability to store additional data about the file, which is visible from a directory listing. This means they have to be doing something interesting to get it to cohabitate on FAT.
I'm still hoping for the FTC to shoot down this deal. Even disregarding my natural suspicion of AOL and its marketing-centric view of the world, and that I'm rather pleased with the fact that all I need to log on to my cable network is a DHCP client, this is /still/ two very large companies forming a bloc that may very well stifle competition in the ISP market, now that AOL has some /real/ content to provide in their service.
FTE is a /wonderful/ text editor.. Every time the old vi/emacs holy war starts up in my office, I hold up my beloved copy of FTE.
If you're looking for a simple, elegant WM that supports multiple workspaces and theming, go check out Blackbox, which is about as simple and elegant as they get. If you're really bold, after you've learned the 0.5x.0 interface, try out the 0.60.0 Alpha branch, which is at least as stable as the Enlightenment 'stable' releases and has even more themability.
It even supports WindowMaker's dockapps!
Okay, you show me a modern infantry unit with laser sights organic to the unit. Hell, show me one using rifles that are more accurate than the carbines of earlier wars. Not even Task Force XXI, the Army's great experiment in force modernization, has signifigantly improved weapons.
If you'd actually sat down and READ, you illiterate ape, you would have seen that the percentiles being given are NOT accuracy but ratios comparing on the battlefield accuracy to accuracy on the training range. Also, the range at which these men fire, now, is far greater than the range at which they fired in the past. The longer your reach, the further apart you start the shooting.
....
You found that infantry unit with the laser scopes? No? Any wizbang-super-neato-keen rocket packs? How about a railgun? No, "I saw it in Quake and The Eraser" don't count.
Those most ignorant are the ones who protest controversy the loudest.
The statistics being cited are a comparison between effectiveness of a soldier on the firing range versus his effectiveness on the battlefield. And US infantry very, very rarely have a scope with the M16, since its a clattering oversensitive piece of scrap.