Slashdot Mirror


User: ctembreull

ctembreull's activity in the archive.

Stories
0
Comments
69
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 69

  1. Re:Maliciousness on CERT Advisory On Malicious HTML Tags · · Score: 1
    That's one side of it. However, the CERT advisory listed more than just the SCRIPT tag - it also mentioned OBJECT, APPLET and EMBED. Meaning things like evil ActiveX controls could be sent to and from a windows-based server. A malicious Java applet could be executed. And so on and so forth.

    You're right, the JavaScript side of it is very little more than an annoyance. But there's other things out there which are far, far more dangerous.

    HTH.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  2. Re:How about this? on Win2k Security holes found · · Score: 1
    If, as you say, MS takes its testing very seriously, then how exactly is it that so many bugs and holes go out the door with every single version of Windows?

    But, in the real world, ship dates can only slip so far before the team becomes accountable and dissolved. So, stop bashing us MS testers. I'd rather have you blame the devs (whose fault it often is).

    This is a very true statement. But it begs the question: who is accountable for the major issues that don't get caught or fixed? This is precisely my point. If, as you say, MS testers work very hard, then maybe the company needs to quit rushing its products out the door. For once, sacrifice time-to-market for exhaustive thoroughness. It's not as if MS has anyone competing with them in the OS space, so they won't lose an iota if they factor in more and more testing as the product progresses. Accountability is good, but it must NOT be limited to prerelease products.

    you can't look at Linux and say it's ready for consumers.

    I don't. You're right, it isn't. But it isn't being aimed at consumers, not yet. Windows, on the other hand, is. And there's the rub. Windows is being aimed precisely at the consumer market, and is, because of the aforementioned lack of thorough testing, providing an inferior-quality product to those same consumers.

    My aim isn't generalized MS-bashing. I'm not into that - look at who I work for. I wouldn't be at NEC if I had that big a problem with Microsoft. My complaint is that Microsoft just doesn't devote enough time and effort to quality assurance. And that lowers my opinion of them substantially - their product is what determines my opinion of them, and their product is all too frequently shot through with critical bugs that a really proper test sequence would expose.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  3. Re:Gold Master != Beta, Unless You Live In Redmond on Win2k Security holes found · · Score: 2
    Sure.

    It's been said before by others in this thread, but I'll say it again here (whoever posted this bit earlier, kudos).

    Not one of those fixes affected the kernel. They may have been in relation to one or another package, but they weren't security fixes in Linux.

    There's also the point that security issues and other bugs in Linux and other free software are an integral part of the evolution process of those packages/systems. On average those fixes are published far faster than fixes for Windows. Those fixes do not destroy other functionality in the fashion of this newest patch or SP6.

    And, I should mention, that there are far fewer of them necessary for Linux and similar packages than there are for Windows. How many security updates have there been for NT this year, anyway? 6?

    My point is that security mistakes happen. The speed and effectiveness of those responses pretty well defines how secure an operating system is, since someone's always going to have a new attack. Fixes to Linux packages are fast and clean. Windows fixes have this nasty habit of breaking other parts of the OS.

    Either way, Microsoft blew it.

    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  4. Re:How about this? on Win2k Security holes found · · Score: 1
    neither security nor quality can be "tested" into a system. They must be a part of the original goal to be achieved by the system being designed and implemented.

    According to MS, they were. This was to be Microsoft's most secure OS ever, and by far its best. This has been one of their stated design goals since the project was still NT5, long, long ago.

    I would disagree on your point of quality, though - that's what testing is for, to identify errors, bugs, and other assorted oddments that detract from the quality of a software product. Security might be one thing (and I'm not totally sold on your point, there), but quality is quite another.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  5. Re:How about this? on Win2k Security holes found · · Score: 1
    How utterly tiresome.

    I'd like you to think about it for half a goddamn second. You don't think it just SLIGHTLY odd to have the "Shut Down" button located on the "Start" menu?! Isn't that a contradiction in terms? Not to mention that "Shut Down" is apparently also a euphemism for "Reboot" and "Reboot in DOS Mode". That's not usability, that's idiocy. Period.

    There are something like 200 million Windows users

    There are something like 300 billion cockroaches, too. Remember what I said about quantity winning out over quality? Windows has a few good features, but overall piss-poor UI design.

    btw...you can adjust the size of the min/max/close buttons

    You can make them the size of the rock of Gibraltar, if you want to have the titlebars of your windows occupy almost the entire viewable area. That doesn't alter the fact that the minimize and close buttons are actually touching each other, and no matter how much bigger you make them (rendering windows themselves ugly and nearly unusable), they're still touching.

    another score for Windows Usability!

    You call that a score? That's the most ridiculous notion I've ever heard. I'm glad you said it, though, because now I know you haven't the first clue about what you're talking about.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  6. Re:How about this? on Win2k Security holes found · · Score: 1
    > You are a complete idiot

    Really? We'll see about that.

    > who probably has never worked for a real software company.

    I define a "real" software company as one who produces "real" software. OTOH, I define a "good" software company as one who produces "good" software. Microsoft, on its best day, is only one of the above, and more frequently neither.

    > I contract at MS

    Well, that would seem to be the problem, wouldn't it?

    > MS testing varies from group to group, but[...] it's more hardcore than I've seen

    Then how the hell do you explain Windows 95? How, furthermore, do you explain security cockups like this? Like ANY that Microsoft has released? How do you explain the fact that SP6 nuked Winsock? How do you explain the fact that the fix for this particular problem breaks a bunch of other stuff?

    Well? How do you explain it? Don't bother, I'll do it for you. The way you explain it is that what you call "hardcore" testing is in fact very little in the way of testing at all. It's piss-poor and enslaved by the artificial deadlines cascading down from on high. It's obviously superficial at best, else these kinds of very basic and thoroughly preventable problems would not happen.

    >every company I have worked for rushes products. This is the real world

    It's yours, perhaps, but it's not mine. Maybe I'm just old-school, but I'd prefer to move only as fast as continual QA testing allows. If you can't ship a good product, then why bother shipping at all?

    > where investors and bottom lines matter. Don't ever forget that anyone who purchases a product is also investing in a company. They are investing their trust, their money, their productivity, and the safety of their computers into the company whose software they buy. And it seems that as Microsoft's stock price has gone up, it has repaid the public, who has invested to the tune of umpteen bazillion copies of Windows, very poorly indeed.

    And as for bottom lines, well, I'm quite sure Microsoft's bottom line would be much, much better served if they would produce a good, solid, quality product right out of the gate, instead of having to continually offer fixes and updates hand over fist. It's always better for business to do it right the first time.

    It's funny, really. My brother works for MS, too. And he has the same "reality distortion field" going as you apparently do. The simple, plain fact of the matter is that Microsoft has achieved domination by quantity over quality. They could have quite simply had it all if their software had worked more than half of the time.

    A little QA testing (and don't even start with me about it being "hardcore" - it just plain sucks) would have prevented this whole issue. And where, pray tell, does that leave your argument, my dear idiot?



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  7. Re:How about this? on Win2k Security holes found · · Score: 1
    Really?

    Then how do you explain the "Shut Down" command being in the Start Menu? Or, for another matter, the buttons in Windows being so close together that a minor mis-point can lead to windows minimizing, maximizing, closing.. regardless of what you wanted them to do.

    Or did you just have no clue what I was talking about when I said "usability?"



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  8. Re:Gold Master != Beta, Unless You Live In Redmond on Win2k Security holes found · · Score: 1
    Not to mention that including a floppy and accompanying documentation would probably make them miss their ship date again. Big surprise there.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  9. Re:Gold Master != Beta, Unless You Live In Redmond on Win2k Security holes found · · Score: 2
    > Until it's in the boxes on the shelves, it's not finalized.

    How can it not be finalized when CDs have been sent off to the printers for mass duplication? How in the world is that not a final product?! The documentation is being printed, the boxes, too. The discs are flying off the printers - do you really, really believe that this product is in Microsoft's hands anymore? They certainly considered it finalized enough to put on store shelves.

    And that's really the sad thing about how Microsoft does business. They go too damn fast, and leave all sorts of mistakes, bugs, security holes, etc. in the shipping version of the product. And that's a real shame, because there are going to be millions of people who buy this product, bugs and all - Microsoft's folly has just been writ large in the world's computer users.

    Would it help if I told you that this bug will be in the shrinkwrapped product that will be on store shelves two and a half weeks from now? It's too late to go back and fix it - the bug will be there.

    And the fix won't.

    I hope that impresses upon you the gravity of these sorts of errors.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  10. How about this? on Win2k Security holes found · · Score: 2
    Ok, I won't bash them for having an inferior product, since it's been beaten into the ground already.

    How about if I point out that they:

    - have terrible testing processes
    - rush too fast to get products out the door
    - Are almost totally inept in terms of security
    - apparently have NO usability staff on hand
    - should take the time they currently spend "decommoditizing protocols" and applying it to proper software engineering processes

    Would any of those be acceptable as an alternative?



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  11. Re:Microsoft security. on Win2k Security holes found · · Score: 1
    Oh, lord, I hope you're being a smartass.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  12. Gold Master != Beta, Unless You Live In Redmond. on Win2k Security holes found · · Score: 4
    Of course new software has problems. You're stating the obvious here.

    The point is that this is a security hole - in an operating system that was promised to be secure. Further exacerbating the problem is that this software Is Not Beta. It is a GM release, and there is supposed to be a world of difference between a beta and a GM product.

    Were this software a real beta, then it wouldn't require a downloadable patch when it finally hits store shelves. Win2k will - unless, of course, Microsoft is planning to destroy all existing shrinkwrap copies before they hit the shelves and issue a brand new GM, one which incorporates the patch. Instead, anyone who purchases Win2k will have to go download an upgrade.

    There's a huge difference between beta and GM, and that difference is called "proper testing". Learn it. Live by it. Unless, of course, you make a practice of considering improperly tested, thoroughly buggy software to be of release quality. In which case, I wish you all the luck in the world. You're going to need it.

    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  13. If I have to pick newer stuff... on Forum: Future Ports of Games to Linux · · Score: 1
    I wanna see Baldur's Gate, Diablo II, and Alpha Centauri on Linux. I don't know if anyone's doing a SMAC port, but if not, they damn well should. Falcon 4.0 would be a lot of fun, too.

    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  14. Re:How will the Gvmt respond... on China Hits Internet With Secrecy Rules · · Score: 1
    First point, I'm not rich, and what the hell gave you the idea that I'm an American?

    Second point, you're going to try to tell me that people who can't get enough food, who live in fear of practicing a religion, who can't speak freely are *happy* that way? I for one don't believe you, and history doesn't bear out your conclusions. If these people were happy with their lives, there would *be* no such thing as a student revolutionary. There would have been no Tiananmen Square. Chinese would feel no need to emigrate to the United States or Europe.

    I submit to you that the Chinese are *not* happy campers. They might blame their condition on the government, but that doesn't mean that the government is the sole source of dissatisfaction.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  15. Re:Why do we accept the Reds as equals?! on China Hits Internet With Secrecy Rules · · Score: 3
    > The communists and socialists of the world
    > want nothing more than to tear down the
    > freedom that we have online Maybe you could be a little bit more ridiculous next time, hmm?

    Communist governments (which China, no matter how loudly it claims otherwise, is NOT) have no fear of releasing information to the public, because they know that the public, as good Communists, will not in turn release that information to the world. At the same time, until a worldwide revolution is in place, then Communist governments must keep their cards close to their vests, because they're well aware that not everyone is a good Communist.

    You might go so far as to compare the free software movement to a burgeoning Communistic revolution. We, the people who use free software, are encouraged (possibly expected) to contribute to the spread of this mode of software distribution, whether it be by enhancing the kernel, creating new software, integrating old software, porting software from other platforms, running informational websites, evangelizing, and so on and so forth. All the tools and information we need are provided freely to us, so long as we pass these tools and data on to others, also for free, and incorporating any modifications we make. In this way, we spread the revolution across the world, and the Internet is what makes it all possible. We have no fear of our source code falling into capitalist hands (e.g. Microsoft) because we know that it already has and it is powerless to stop our advance - we come with a better way of life, and let capitalism tremble at our footsteps!

    You see, we who participate in this glorious software revolution are, after a fashion, Communists. Everything we do is for the enhancement of our community - our State.

    Your mistake, my anonymous friend, is in thinking that governments such as the old Soviet Union and China and the Eastern Bloc were Communist. They were not. They were, in fact, Socialist governments, which are sort of a blend of Communism and ordinary, garden-variety totalitarianism. They are a middle point, a semi-secure position to take after the revolution has begun, the communization of the country is in progress - they are a bulwark against the rest of the world while the State waits for the worldwide revolution that Marx, Engels, and Lenin stated *must* come for Communism to succeed.

    Sorry 'bout the rant there, but I really dislike having people make such foolish statements about my political beliefs. Oh, that's right, I forgot to tell you - you see, I am a Communist, and proud to be one. We're not about suppression of freedom, not by any stretch of the imagination. We're about the idea that a unified state can best take care of its people if their production is guided and utilized by the state itself, and then returned to them in the form of the things they require to live and thrive. And the Internet, to us, is the best way we've yet seen to encourage the rest of the world to join us in making life better for ALL citizens of the world - not just the wealthy.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  16. Re:How will the Gvmt respond... on China Hits Internet With Secrecy Rules · · Score: 1
    > From the article, I got the impression
    > that money is one of the driving factors
    > of the production of news items.

    Not necessarily true. The general populations of many East Asian nations have a strong streak of dissidence in them. Chinese society in particular exhibits this behavior - it has a great deal to do with growing dissatisfaction over the disparity between the quality of life in the PRC and in Western nations. It has been noted that this dissident behavior shows up most often in university-level students - the very people most likely to understand the internet, and the people most likely (outside of government officers themselves) to have internet access.

    Here's how a likely scenario would play out: A group of students much like those at Tiananmen Square a decade ago come upon (by hook or by crook) some information damaging to the Chinese government. Using an anonymizer, they post the information to Geocities/Xoom/WebJump/so on and so forth. Or they smuggle it out as an attachment or an encrypted email to someone outside the country. In the former case, the information is posted and the Chinese government will have a singularly difficult time tracing it because I doubt Yahoo! or Xoom or any other hosting company is particularly anxious to make their information known to governments. As a result, then, the Chinese go into spin overload mode, trying to deny what's been publicized.

    In the second, the information isn't necessarily made public, and the government may in fact be none the wiser - it's impossible for a government - especially one responsible for over a billion people - to review each and every individual piece of information that leaves its borders electronically.

    In either situation, though, the Chinese will probably not hesitate to backtrack on their stated goal not to restrict the Internet in China. There's a definite tradeoff - if the Net becomes a significant source of leakage, which it very, very easily could become, then the government will take definitive - and quite possibly violent - steps to close down those leaks and the structures which made them possible. Any leakage, if discovered, will *not* last long.

    But that doesn't mean it's not possible. After all, once the information's out.. well.. you know what happened to DeCSS.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  17. Re:key point: this isn't copy protection on DVD Cases: Help by Commenting to Feds on DMCA · · Score: 1
    Sorry about the formatting, btw.

    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  18. Re:key point: this isn't copy protection on DVD Cases: Help by Commenting to Feds on DMCA · · Score: 1
    Thanks for making this point. It dovetails nicely into some thoughts I had a few days ago. I apologize beforehand for the length of this
    post.

    It seems to me that the LiViD project and any similar efforts on other platforms are very similar to the Rio MP3 player and other hardware-based means of playing back copyrighted information. If I remember right, the courts refused to grant an injunction on behalf of the music companies against Diamond, because it could not be proven that the Rio was intended to aid illegal duplication of copyrighted works. And so we now have a plethora of MP3 players on store shelves, and on computers everywhere.

    What, then, if anything at all, makes a Linux-based software DVD playback mechanism any different? Its purpose is *not* duplication,
    but playback. If MP3 is okay, why not DVD?

    The notion of copy protection as applied to digital media seems somewhat absurd, anyway. There are always going to be ways to circumvent it. What, for example, is to prevent me from cabling my Sony DVD player to a computer with a video capture card, and saving everything that comes down that cable as an AVI or something similar? So, fine, I've got a copy of this movie,
    some umpteen gigabytes of video and sound. And I did it legally, unless the DMCA is suddenly going to be applied to Radio Shack or Fry's or anywhere else where I can get those cables.

    (I know this is rambling. Sorry.)

    Here's another thought: Aren't those DVD's licensed for in-home viewing? Unless I'm mistaken, that license does not restrict the method of playback - they only prohibit distribution and public broadcast/display. So,
    the DVD itself, which I own or have rented, is
    mine to play back wherever I wish.

    And right now, we have this antitrust trial going
    on in Washington against a certain Washington-based software company. You might have heard of it. I'm not sure, and I'm not a lawyer, but couldn't the refusal of the DVD Consortium to license playback on Linux-based personal computers (they've licensed it on most other major platforms) be construed as anticompetitive?
    Linux software developers have as much right as
    Apple or Microsoft to publish DVD playback software for their particular operating systems.

    Can you imagine that? The DOJ hauling a whole bunch of consumer-electronics company into court for antitrust violations? Two words: never happen. They still don't care what happens to
    Linux users. So forget about that...

    As I understand the history of DeCSS, didn't one of the publishers of a DVD leave their encryption
    key on the disc? I'm not sure about that, but if
    it's true, how can anyone claim that the creator of DeCSS reverse-engineered anything? After all,
    the DVD disc was his. He was allowed to play it back in his home - the license for DVDs doesn't specify that it *can't* be read by anything but
    a DVD player, does it? - and if he found that key
    lying around through the course of playing back
    the DVD (albeit in a nonstandard way), doesn't that sort of make copy protection null and void? It's like handing a key to your house and your address to some Joe Random on the street.

    I don't know. It seems to me that this whole thing is more of a CYA on the part of the DVD Consortium in general, trying to disguise the fact that they a) blew it and b) wrote a poor
    encryption system.

    I could go on for a lot longer, but I'll leave this here. I'd love to see what the community thinks - it'll clear up my thinking and it just might raise a few new ideas.



    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.

  19. Here's a thought on UPDATED: Transmeta's Crusoe Unveiled · · Score: 3
    So, Linus has written "Mobile Linux" for these chips. The chips themselves are low-power and
    low-cost. This is all very, very good.

    Given the mention of the "touchpad screen", is it possible that a Crusoe/MLinux system would
    be able to serve as the basis for kiosk-class systems, like ATM machines, information stands,
    and so on and so forth?

    If the chip is that cheap, and the OS is free, wouldn't it sort of make sense to harness that
    and direct it towards those sort of ubiquitous consumer machines that you are starting to see all over the place?


    Chris Tembreull
    Web Developer, NEC Systems, Inc.

    My opinions are my own, and nobody else's.