I do Apache work, and like the flexibility of the license. But my day job involves LGPL work ( http://smartfrog.org/ ), so I've come to appreciate the strategic benefits of GPL.
And this is it:
Microsoft hate it.
And that is a metric of its wondrous power. MS dont hate BSD because it lets them use BSD code. MS hate GPL because if they adopted it, the ugliness of their code and its lack of real value would show. And they couldnt get lock in through non-standard hacks -all hacks would be public.
So yes, there is a place for GPL, even if you or I find it an inconvenience at times. RMS doesnt want you to use FSF code in closed source apps, so would never adopt a BSD license.
Agreed, it is the point of GPL, but not LGPL, which says 'apps are OK, but other libs must be LGPL or GPL'.
In java, everything is a lib, so a strict interpretation of the situation says that you cannot import LGPL code into an Apache or BSD licensed project. Apache takes that strict interpretation; there is no clear urgency on the FSF side to fix it (as LGPL is somewhat deprecated).
I think it is a shame that BSD/Apache code and LGPL cannot coexist better.
A lot of J2EE is about scalability, not efficiency.
Which means that it can scale up by throwing more hardware at the problem, but the amount of hardware you need for any particular task is higher than with other solutions.
Which is what you expect when you let hardware vendors (Sun, IBM) design the spec.
Also you may find that it will take a lot of effort to get your EJB solution working, at which point you pull in consultants. Like IBM.
The good news: Apache Geronimon. Free, documented. 'nuff said.
If you look at the Global Grid Forum you will see that a derivative of SOAP (first OGSA, now WS-RF) is used as the underpinnings of the proposed Grid architecture.
Just because it is being pushed there and in OASIS does not mean that is is the right approach. Nor is EJB, IMO. EJB is designed to do distributed transactions against something that may or may not be a relational database. Grid stuff is very often computation against a large datastore; potentially chained stuff. It is not classic three tier J2EE.
It seems to me we need something like network pipes, where you can construct pipelines of computation and have the resource manager place parts of the pipe on the right machines. There is some work in the OGSA-DAI working group looking at this.
I just checked; its a 'Pilot Radio', three band (MW, LW, SW); voltage taps are 205, 215, 225.
I am very tempted to hook the "gramaphone in" to the sound out from the PC; it'd be a cool little speaker/amp to have at the end of the wire. What scares me is the quality of the insulation on the wiring; that stuff looks like fabric, not plastic, and old fabric at that...
I hate my inbox being full of bounce mail from viruses; domainkey and SPF can make it easier for auth systems to silently kill it.
Of course, I suspect this won't happen because even today, when all virus mail uses forged sender addresses, too many virus scanners insist on sending "your email has a virus, here it is attached" responses, despite the fact the up-to-date virus scanner could trivially have a flag to say "spoofed, delete it" next to the fancy virus signature stuff you have to pay $$ for.
I have my grandfathers 1938 AM radio; all valves inside. It still works. No PCB; just valve sockets hand wired, thread to go from the tuning dial to the variable capacitor. Its fascinating that a piece of tech from nearly 70 years ago still powers up (and that after 30 years in an attic).
Some amusing features of it
-you have to manually set the voltage of AC power to one of three taps: 240, 230 or 220. (this is the UK BTW). Power must have been less consistent in those days.
-it has a stamp on the back to say that it has paid marconi for use of the patents on radio. Radio! Can you imagine radio being patented.
I am busy writing the stuff to run JUnit (the main java unit test harness) distributed; a vmware image of solaris is just like a vmware image of winXP: Something to deploy to, run tests against and then report failures on.
so a free x86 solaris would be good -create an image, run it in VM before release, alongside the other distros. Hey, a sparc emulator that wasnt too slow could host it too, for close to real testing.
One issue: hardware problems dont surface in VMs, or multithreading. But its better than none.
Laptop support is still hairy, and power management is it. Full ACPI has the os powering off everything that isnt needed; even bits of the mainboard like the sound card or LAN, which complicates things. And the trouble with laptops is you cannot easily juggle parts (except external or mini-PCI WLAN kit) till it all works. Plus the displays adapters are usually tier 2 junk.
But linux does work pretty on recent systems, especially if you are a bit trailing edge in your kit. The big problem I had with RH9 on mine (apart from power) was the WLAN. I had to get Jaques 'WLAN-man' himself to do that bit of setup, for which I was very grateful.
Imagine a perl script to generate spoof statistics. Imagine a million./ readers running the script as a cron job.
They'd soon stop trying to spy on the users, if the data was all that everyone keep on printing the same url all the time, something with "goat" in the URL...
I'm running a hand-me-down LaserJet at home; it sits on the lan, has power saving, etc, etc. Refills are possible (no DMCA laws) and the printer's own web page provides the configuration GUI (warning, Java applets).
The inkjet printers are built on a different model -revenue through ink- than the laser printers, where third party refills are mainstream. Indeed what Lexmark were trying to do with their DMCA gig was do the same lock in in firmware that ink cartridges do in hardware. They lost.
So: look at laser printers, especially those on the LAN. make sure they talk LPD and dont need a windows only app for management. That is, take your laptop and some cat-5 cable to the showroom, and test it. Colour laser printers do pretty cheap colour prints too, and are becoming low cost.
I dont understand lexmark. They crossed the boundaries of the sensible with the DMCA suit, now they are up with this spyware print driver thing.
Are they in league with the MPAA or something? Or do they just want to get extra money from users.
The fact is, refill cartridges perform a valuable role: they keep the retail cartridges within bounds. If it wasnt for the refill biz, the vendors would be tempted to charge even more.
As for the spyware stuff -if this is in UK print drivers (as the zdnet UK article implies), then it could be illegal under our data protection laws. It certainly ought to be banned. All spyware should be illegal.
That is the nice thing about OSS -you can check the print drivers, and anyway, like linux.org or sf.net cares about your printing. Interestingly, spyware is very rare in the macos world too. There is something about windows that just encourages it. I think it is the fact that Ms effectively ship windows with spyware-to-MS preinstalled, then the home PC vendors join in, giving the green light to everyone else.
Yeah, you are right there -untainted data is the classic attack on a web site, and managed code doesnt do anything there, not in the Java or.NET world where there is no tainted bit on stirngs.
I'm the maintainer of the Apache Axis
security doc, so if you have any input there, I'd be
grateful. We try and be paranoid, but are probably
not devious enough.
Yeah, and you can get that one copy of Suse Pro and stick on as many boxes as you have to hand.
They do have a point about the RH pricing model; my home machine(s) and the work box ('but not the laptop) are all Suse 9.1, with a 9.2 upgrade planned. The laptop is winXP as (a) its a dodgy ACPI BIOS that everything hates (even XP), and I need a windows box to cross test the java stuff I write to make sure it still works on the old platform.
They didnt, of course, get involved with X11; pushing NeWS instead; shame that little beast died.
To an extent, Solaris is a better kernel than Linux, at least from an enterprise perspective. Hey, even AIX has some better features there. Too often in Linux we cheat and take the "recompile everything" tactic of backwards binary compatibility.
But: where is the ACPI support in Solaris? The power management needed to make it work on a laptop, or the dynamic WLAN binding? And the Java APIs to go with them? Missing, that is where they are.
And that is the problem with Solaris: too server side, and even today, too enterprise centric.
Linux: it may be a lot less technically elegant, but it works on almost every random PC or laptop that Taiwan have ever made.
IE is embedded everywhere in Windows, even when you bring up an HTML dialog box. Add/Remove Programs? DHTML. System Restore? DHTML.
Windows Update? Active-fucking-X. So unless you move http://*.microsoft.com/ into trusted zone (ramped up to medium security), you cannot get security updates without enabling ActiveX download and scripting.
Even in WinXPSP2, there is still that trusted zone that gives unlimited rights. Like download unsigned activeX controls without prompting. There is nobody I'd give that right to, not even myself. Yet they have it.
Plus all the MSN content pushes AX at you. At least Expedia are not that daft; you can shop there with Firefox. But check out a pure MS site like the channel9 developer site; ActiveX, windows everywhere. No attempt made to evangelise to the rest of us:)
Well, use the unsafe keyword and you are entering buffer overflow land. but they go out of their way to make that hard to do, and mostly unneeded.
I know that Sun like to point to "unsafe" as a recipe for disaster, but every time you see the word "native" in Java, you know that they are binding to a potentially unsafe language, and in the same boat.
IMO, a move to managed languages will stop buffer overflows, and we should do it for all UI stuff and other apps where performance is not #1 priority. Which means most apps. Which particular language platform is another issue - C#, Java, Python, they all have their strengths.
I think the difference is the attempt to scale this thing up no end; all the data coming of the CERN LHC will be grid processed; this is one of those problems where the grid is ideal: The data is not secret, you need lots of CPU power and you have PhD students to throw at the engineering of the whole thing.
I dont know about google, but I believe the dreamworks rendering used for shrek2 (that was theirs, right), was deployed onto a supercluster of 500+ nodes, not some fancy grid fabric.
Office has the best margins, which makes sense. $300 for what, four-five apps; apps whose core strength is "best in class at reading a format we made up".
the OS is more expensive -all that beta testing, all those drivers, all those support calls saying ten year old apps dont work property. They have put much more effort into backwards compatibility of binary code than linux has done (where we rely on recompile-your-code as the compatibility process).
But what does that os bring them. It gives them
fantastic cash flow
$60-100 per PC
ability to dictate the default web browser
ability to dictate the default music format and store
ability to dictate which VM runtime ships with the system -and its.NET instead of Java.
The OS is justifiable for the control it gives the company, plus it 'encourages' people to develop for windows rather than for other platforms. What hurts them is not so much the linux apps, or a migration to java apps, but web-based apps that dont care what browser you use. Because ActiveX never succeeded, you can go to almost any web site with linux+firefox. And that is what has set us free.
It still niggles me that PCs ship with windows; it is interesting to note that the biggest piracy of windows is not end users, but white box system builders who sell PCs prestocked with lots of apps including cracked copies of Word and photoshop. This irritates me, as if people get all the windows junk for nothing, the fact that they can get the linux app suite for the same price -legitimately- is less compelling.
1. My grandfather was born in Portadown, co. Armagh, in pre-partition ireland.
2. my father was born in Portadown too. so could also qualify. he actually lives in france now, for extra complexity.
I think this means that I qualify, but my two year old child doesn't. As he was born in the US, he already has dual nationality, and so gets to go through the fast passport queue.
I have bookmarked the site and may start with the process, which looks like it will take a while.
yeah, he is more than many in the conservative party were -and gets away with it.
The scary thing is: I think this is because a lot of people agree with him. They think that asylum seekers are a real problem, and that ID cards will fix it. Or that ID cards will somehow prevent terrorism. It will do neither, but we will end up paying for an oppressive state.
Slashdot Mirror
I do Apache work, and like the flexibility of the license. But my day job involves LGPL work ( http://smartfrog.org/ ), so I've come to appreciate the strategic benefits of GPL.
And this is it:
Microsoft hate it.
And that is a metric of its wondrous power. MS dont hate BSD because it lets them use BSD code. MS hate GPL because if they adopted it, the ugliness of their code and its lack of real value would show. And they couldnt get lock in through non-standard hacks -all hacks would be public.
So yes, there is a place for GPL, even if you or I find it an inconvenience at times. RMS doesnt want you to use FSF code in closed source apps, so would never adopt a BSD license.
Agreed, it is the point of GPL, but not LGPL, which says 'apps are OK, but other libs must be LGPL or GPL'.
In java, everything is a lib, so a strict interpretation of the situation says that you cannot import LGPL code into an Apache or BSD licensed project. Apache takes that strict interpretation; there is no clear urgency on the FSF side to fix it (as LGPL is somewhat deprecated).
I think it is a shame that BSD/Apache code and LGPL cannot coexist better.
A lot of J2EE is about scalability, not efficiency.
Which means that it can scale up by throwing more hardware at the problem, but the amount of hardware you need for any particular task is higher than with other solutions.
Which is what you expect when you let hardware vendors (Sun, IBM) design the spec.
Also you may find that it will take a lot of effort to get your EJB solution working, at which point you pull in consultants. Like IBM.
The good news: Apache Geronimon. Free, documented. 'nuff said.
If you look at the Global Grid Forum you will see that a derivative of SOAP (first OGSA, now WS-RF) is used as the underpinnings of the proposed Grid architecture.
Just because it is being pushed there and in OASIS does not mean that is is the right approach. Nor is EJB, IMO. EJB is designed to do distributed transactions against something that may or may not be a relational database. Grid stuff is very often computation against a large datastore; potentially chained stuff. It is not classic three tier J2EE.
It seems to me we need something like network pipes, where you can construct pipelines of computation and have the resource manager place parts of the pipe on the right machines. There is some work in the OGSA-DAI working group looking at this.
I just checked; its a 'Pilot Radio', three band (MW, LW, SW); voltage taps are 205, 215, 225.
I am very tempted to hook the "gramaphone in" to the sound out from the PC; it'd be a cool little speaker/amp to have at the end of the wire. What scares me is the quality of the insulation on the wiring; that stuff looks like fabric, not plastic, and old fabric at that...
I hate my inbox being full of bounce mail from viruses; domainkey and SPF can make it easier for auth systems to silently kill it.
Of course, I suspect this won't happen because even today, when all virus mail uses forged sender addresses, too many virus scanners insist on sending "your email has a virus, here it is attached" responses, despite the fact the up-to-date virus scanner could trivially have a flag to say "spoofed, delete it" next to the fancy virus signature stuff you have to pay $$ for.
yes, tubes were the core of electronics.
I have my grandfathers 1938 AM radio; all valves inside. It still works. No PCB; just valve sockets hand wired, thread to go from the tuning dial to the variable capacitor. Its fascinating that a piece of tech from nearly 70 years ago still powers up (and that after 30 years in an attic).
Some amusing features of it
-you have to manually set the voltage of AC power to one of three taps: 240, 230 or 220. (this is the UK BTW). Power must have been less consistent in those days.
-it has a stamp on the back to say that it has paid marconi for use of the patents on radio. Radio! Can you imagine radio being patented.
I am busy writing the stuff to run JUnit (the main java unit test harness) distributed; a vmware image of solaris is just like a vmware image of winXP: Something to deploy to, run tests against and then report failures on.
so a free x86 solaris would be good -create an image, run it in VM before release, alongside the other distros. Hey, a sparc emulator that wasnt too slow could host it too, for close to real testing.
One issue: hardware problems dont surface in VMs, or multithreading. But its better than none.
Laptop support is still hairy, and power management is it. Full ACPI has the os powering off everything that isnt needed; even bits of the mainboard like the sound card or LAN, which complicates things. And the trouble with laptops is you cannot easily juggle parts (except external or mini-PCI WLAN kit) till it all works. Plus the displays adapters are usually tier 2 junk.
But linux does work pretty on recent systems, especially if you are a bit trailing edge in your kit. The big problem I had with RH9 on mine (apart from power) was the WLAN. I had to get Jaques 'WLAN-man' himself to do that bit of setup, for which I was very grateful.
Imagine a perl script to generate spoof statistics. Imagine a million ./ readers running the script as a cron job.
They'd soon stop trying to spy on the users, if the data was all that everyone keep on printing the same url all the time, something with "goat" in the URL...
I'm running a hand-me-down LaserJet at home; it sits on the lan, has power saving, etc, etc. Refills are possible (no DMCA laws) and the printer's own web page provides the configuration GUI (warning, Java applets).
The inkjet printers are built on a different model -revenue through ink- than the laser printers, where third party refills are mainstream. Indeed what Lexmark were trying to do with their DMCA gig was do the same lock in in firmware that ink cartridges do in hardware. They lost.
So: look at laser printers, especially those on the LAN. make sure they talk LPD and dont need a windows only app for management. That is, take your laptop and some cat-5 cable to the showroom, and test it. Colour laser printers do pretty cheap colour prints too, and are becoming low cost.
I dont understand lexmark. They crossed the boundaries of the sensible with the DMCA suit, now they are up with this spyware print driver thing.
Are they in league with the MPAA or something? Or do they just want to get extra money from users.
The fact is, refill cartridges perform a valuable role: they keep the retail cartridges within bounds. If it wasnt for the refill biz, the vendors would be tempted to charge even more.
As for the spyware stuff -if this is in UK print drivers (as the zdnet UK article implies), then it could be illegal under our data protection laws. It certainly ought to be banned. All spyware should be illegal.
That is the nice thing about OSS -you can check the print drivers, and anyway, like linux.org or sf.net cares about your printing. Interestingly, spyware is very rare in the macos world too. There is something about windows that just encourages it. I think it is the fact that Ms effectively ship windows with spyware-to-MS preinstalled, then the home PC vendors join in, giving the green light to everyone else.
I despair.
I'm the maintainer of the Apache Axis security doc, so if you have any input there, I'd be grateful. We try and be paranoid, but are probably not devious enough.
Yeah, and you can get that one copy of Suse Pro and stick on as many boxes as you have to hand.
They do have a point about the RH pricing model; my home machine(s) and the work box ('but not the laptop) are all Suse 9.1, with a 9.2 upgrade planned. The laptop is winXP as (a) its a dodgy ACPI BIOS that everything hates (even XP), and I need a windows box to cross test the java stuff I write to make sure it still works on the old platform.
They didnt, of course, get involved with X11; pushing NeWS instead; shame that little beast died.
To an extent, Solaris is a better kernel than Linux, at least from an enterprise perspective. Hey, even AIX has some better features there. Too often in Linux we cheat and take the "recompile everything" tactic of backwards binary compatibility.
But: where is the ACPI support in Solaris? The power management needed to make it work on a laptop, or the dynamic WLAN binding? And the Java APIs to go with them? Missing, that is where they are.
And that is the problem with Solaris: too server side, and even today, too enterprise centric.
Linux: it may be a lot less technically elegant, but it works on almost every random PC or laptop that Taiwan have ever made.
IE is embedded everywhere in Windows, even when you bring up an HTML dialog box. Add/Remove Programs? DHTML. System Restore? DHTML.
:)
Windows Update? Active-fucking-X. So unless you move http://*.microsoft.com/ into trusted zone (ramped up to medium security), you cannot get security updates without enabling ActiveX download and scripting.
Even in WinXPSP2, there is still that trusted zone that gives unlimited rights. Like download unsigned activeX controls without prompting. There is nobody I'd give that right to, not even myself. Yet they have it.
Plus all the MSN content pushes AX at you. At least Expedia are not that daft; you can shop there with Firefox. But check out a pure MS site
like the channel9 developer site; ActiveX, windows everywhere. No attempt made to evangelise to the rest of us
I will point out that Win64 on Itanium is not vulnerable to this problem, primarily because nobody has recompiled the virus for it.
Well, use the unsafe keyword and you are entering buffer overflow land. but they go out of their way to make that hard to do, and mostly unneeded.
I know that Sun like to point to "unsafe" as a recipe for disaster, but every time you see the word "native" in Java, you know that they are binding to a potentially unsafe language, and in the same boat.
IMO, a move to managed languages will stop buffer overflows, and we should do it for all UI stuff and other apps where performance is not #1 priority. Which means most apps. Which particular language platform is another issue - C#, Java, Python, they all have their strengths.
I'd pay for Frame. It used to be on Unix, now it is windows only. For those with money, it kicks the low-cost but brittle but of OOo.
I think the latest Frame version for windows comes with good DocBook support, BTW. I'd love that most of all.
yeah, I lost something serious, shdocvw.dll, in some failed OS upgrade.
This sounds like a harmless file, but is the underpinnings of the shell and IE, leaving only taskman, cmd.exe and mozilla fully functional.
And of course, system restore, which I worked out after some effort to find out the command line for system restore.
The only recovery that did work was mount the disk remotely, copy the file over, reboot.
Sysrestore depends on too much of the system being available, to restore from a serious outage.
I think the difference is the attempt to scale this thing up no end; all the data coming of the CERN LHC will be grid processed; this is one of those problems where the grid is ideal: The data is not secret, you need lots of CPU power and you have PhD students to throw at the engineering of the whole thing.
Classic web sites and the like are a different problem, one where the goal is not so much infinite scalability, but infinite flexibility. The deployment stuff I work on is designed to deal with deployment on single boxes, clusters and grid sized systems, and the grid environment does bring many new problems to the table, not least being the need to use XML-based-RPC underneath (that is what SOAP is, after all). If this work pans out, then you will be able to deploy classic systems (yes, even LAMP servers) to a grid fabric, and have it all work. Come and help, if you think that is a nice idea; the ''research'' I am doing is all LGPL.
I dont know about google, but I believe the dreamworks rendering used for shrek2 (that was theirs, right), was deployed onto a supercluster of 500+ nodes, not some fancy grid fabric.
the OS is more expensive -all that beta testing, all those drivers, all those support calls saying ten year old apps dont work property. They have put much more effort into backwards compatibility of binary code than linux has done (where we rely on recompile-your-code as the compatibility process).
But what does that os bring them. It gives them
- fantastic cash flow
- $60-100 per PC
- ability to dictate the default web browser
- ability to dictate the default music format and store
- ability to dictate which VM runtime ships with the system -and its
.NET instead of Java.
The OS is justifiable for the control it gives the company, plus it 'encourages' people to develop for windows rather than for other platforms. What hurts them is not so much the linux apps, or a migration to java apps, but web-based apps that dont care what browser you use. Because ActiveX never succeeded, you can go to almost any web site with linux+firefox. And that is what has set us free. It still niggles me that PCs ship with windows; it is interesting to note that the biggest piracy of windows is not end users, but white box system builders who sell PCs prestocked with lots of apps including cracked copies of Word and photoshop. This irritates me, as if people get all the windows junk for nothing, the fact that they can get the linux app suite for the same price -legitimately- is less compelling.oh, that's complex.
1. My grandfather was born in Portadown, co. Armagh, in pre-partition ireland.
2. my father was born in Portadown too. so could also qualify. he actually lives in france now, for extra complexity.
I think this means that I qualify, but my two year old child doesn't. As he was born in the US, he already has dual nationality, and so gets to go through the fast passport queue.
I have bookmarked the site and may start with the process, which looks like it will take a while.
yeah, he is more than many in the conservative party were -and gets away with it.
The scary thing is: I think this is because a lot of people agree with him. They think that asylum seekers are a real problem, and that ID cards will fix it. Or that ID cards will somehow prevent terrorism. It will do neither, but we will end up paying for an oppressive state.