Slashdot Mirror


User: b4dc0d3r

b4dc0d3r's activity in the archive.

Stories
0
Comments
2,042
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,042

  1. your company's lawyer, Subpoena, ask registrar B on Defending Self In a Case of On-Line Identity Theft? · · Score: 1

    Lawyer is the best option. A fallback is to see the company's lawyer. You can tell your employer/their lawyer that they need to subpoena the records of the registrar B to determine who filed it. If it truly is a third party, they are losing time by not getting the true story. If it actually isn't you, they are not fulfilling their obligations to the company, instead handling this ineptly.

    If they want to pursue legal action against you, they need to start it, and it will involve getting proof from the other registrar. So they might as well go ahead and do that part. If it is an anonymizing registrar they will have proof neither for nor against you. But the party used your contact details, so that's not the case. The registrar should have more information. Lawsuit and discovery might find the real culprit, or at elast get the right documentation for you to prove innocence.

    Or just ask the registrar for details, preferably printed and mailed to you. Date of registration, payment records, any other contact information. Since you seem to be the contact, you should be able to get all the information a subpoena would provide. If registrar B refuses to provide this information since they don't think you are the rightful owner, have them sign and mail/fax that refusal to your employer.

    Of course, there is no incentive for you to do so while suspended. So either they can reinstate you and you can work with them. Or you wait for them to sue you, which is the only way they will get proof. Then you meet with the company's laywers and explain to them how DNS registration works, and that they need to get more information from Registrar B. Back to the first plan. Or sue John Doe using the alternate anon address, but you seem to want to avoid that. Most likely you will have to request the information, though, since your employer shoots first and asks questions later.

    If you explain the options like that, hopefully with more clarity, they should see reinstating you and having you assist as the cheaper option. Especially since you are seeming to make it easier to gather evidence against you.

    Someone paid for the registration - if it was a credit card you have your third party. If it was cash or prepaid card it might end up as a dead end. But if you are as innocent as they say, at most they will find what they already know. But then you will be able to say there is no proof, or you provided what you could.

  2. Re:Yawn . . . on Orchestra To Turn Copyright-Free Classical Scores Into Copyright-Free Music · · Score: 1

    Not sure what your point was here, but the perspective you presented is warped. The orchestra, venue, and production team works for between $30-$250 per concert. This represents ticket sales for the live performance.

    The DRM free iTunes subscription is selling a product with almost zero marginal cost. They already record every performance, in case it turns out to have critics glowing, then they can turn it into the CD of the month. Selling the download does nothing to create the work - if people didn't buy tickets to see it live the recording wouldn't happen.

  3. Re:Where can I buy a 50 year old CD? on Orchestra To Turn Copyright-Free Classical Scores Into Copyright-Free Music · · Score: 1

    I'm not as familiar with British copyright law, having more familiarity with the American version, but from what I understand:

    Part of the re-recording is whatever creative skill went into the remastering. I've read a lot about the process on various remastering projects, and there are decisions that have to be made - it's not an automated set-and-forget process. The re-mastering is thus a copyrightable work due to the creative element. It's the same as taking a public domain book or score and adding your own editing. Footnotes, minor corrections, updating spelling to a more modern or cultural usage (such as using Britich vs. American English spellings). These are all creative additions and are protected. Or taking public domain music and re-recording it. The version you produce is new and copyrighted, the public domain does not change status.

    That's how Penguin Classics stays in business - public domain work with an introduction and a footnote or two. Now you can't put it on a copier, or scan it, or OCR, or whatever copyright violation you want. But you can go back to the original public domain and do your own editing. Or add zombies or put the characters in outer space if you want.

    So you would have to go back to the vinyl. If you had access to the original tracks, you could do a better job cleaning and re-mixing, but good luck getting your hands on those. That's where posession is 9 tenths of the law - the tracks could be public domain but the owners would never lend them out since they can keep the copyright alive by remastering them. A dirty trick, but if you had a piles of piles of money you could maybe buy the tracks.

  4. It's actually a more than complete replacement to listening to music in my opinion. Different conductors try to emphasize/hide certain things, get a certain style, or tempo. It's the whole reason music snobs prefer one performance over another. If you take the music yourself, your own way, you are more than the conductor. That annoying piccolo player can't rush through the trills, the trumpet player can't add schmaltzy vibrato to the heavy parts. It sounds like you want it to sound, limited only by what the composer indicated. Tempo markings and dynamics are all contextual and relative, after all, so you get to re-mix it.

    The most important part is you are aware of all of the instruments. Psychoacoustical modeling (like lossy mp3) represents the fact that certain sounds get covered up by other sounds. It's impossible for someone to distinguish every instrument. Not just difficult, or like a superhuman with training could do it. I mean that unless you are born as a mutant with extra auditory parts, you cannot hear everything that's in the score. Critical Bands are basically the foundation of lossy encoding.

    I routinely follow along with large works in order to fully comprehend it. Anything more than 8 or 10 parts, and the score is like an added dimension. I use the recording as a crutch, because I don't routinely study things with that many parts, so I'm not used to processing it all at once. But when I do I get a greater understanding. There are so many nuances you will never get out of a recording. It's especially nice for things I have memorized, because I know how the recording goes and I look at the score, and there's something I never would have heard. Then I try to find a recording where it's audible. It's like watching a movie for the 10th time and seeing something you missed, only you'll probably never hear it on your own.

    Anyone who can look at music and hear it should be able to see this, I'm completely at a loss as to how you don't. I'm sure BrokenHalo was not saying that sheet music is a complete replacement, but it definitely wasn't a joke.

  5. Re:Gross oversimplification on Child Abuse Verdict Held Back By MS Word Glitch · · Score: 1

    Thank you for this, the gp post did not "smell" right. If you put someone in jail because they might flee the country, release them, and they don't flee, it's more likely that they feel safer having been let go than to assume they would not have left in the first place. The circumstances have changed, in other words, so it doesn't show the original decision was invalid.

    And holding someone that maximum amount of time until charges have to be filed then releasing them sounds perfectly legal. Not very suspect-friendly, but when you don't know who to keep and who to release the law allows time to figure it out.

    And it went downhill from there.

  6. Re:I work for Adobe and... on New Adobe PDF Zero-Day Under Attack · · Score: 1

    If you took security seriously, you'd make a READER that is READ_ONLY and does not do scripting, audio, video, URLs, or any other the other attack vectors.

    I know people will want the additional features, but for people who want to be able to read the existing PDF files without worrying about security, let's have a read-only reader that only reads.

    http://it.slashdot.org/comments.pl?sid=1782110&cid=33523718

    A PDF/A option would be an alternative, but there's no reason you can't make a fairly secure reader just by removing the features most people don't use.

  7. Re:Past Due! on Pirate Bay Down; Police Raids Across Europe · · Score: 5, Informative

    I got pulled over once after blowing through 2 stop signs in under 10 feet. I had been playing GTA for 4 days straight since my car was iced in, so wasn't used to stopping. The cop informed me why I was pulled over, and then got an alert and hurriedly said "I could give you a ticket for both of those" and ran back to his car.

    So yeah, it's possible. I can't find a source off hand, but a few weeks ago either /. or Fark had a story about reducing missing persons investigators, and a few months before that ramping up copyright operations. So my little anecdote aside, the sizes of the teams responsible for different types of crime are being re-allocated. That takes it from 'possible' to 'happening'. Maybe not on the scale of gp post, and certainly not to the extent of your binary logic, but yes happening.

  8. Re:Making use of a database on Programming Things I Wish I Knew Earlier · · Score: 1

    I hate Oracle, but it's not as bad as you make it. I'm no DBA, I only have a few pass-through queries that go through Oracle, but I can diagnose problems and debug and profile and do all of that without having DBA-level access to the system. Knowing how to use a tool is vital for getting good results, and people who know how to use it do get good results.

    In fact, I'm going to take issue with every statement you made, except for SQL being more primitive. It is, because it's already complicated enough dealing with low-level data. I won't take the time to deconstruct everything, because you work with Oracle and I try to avoid it so I don't want to get called out on technicalities when I am close but not perfect. But if you choose the right tool for the job, and learn how to use it, every other one of your complaints goes away. SQL will remain primitive, though (unless you move to MS-SQL with .NET CLR procs, which I'm certainly not suggesting).

    You work with poor decision makers, that's hard to fix.

  9. Re:Making use of a database on Programming Things I Wish I Knew Earlier · · Score: 1

    Stored procedures are not hard to test, they just require some preparation. You should be able to write a script with a few DELETE, INSERT, EXEC, and SELECT statements and check the results. Depending on your platform, you can SELECT the results of a proc that returns a data set into another table, checking the results either visually or with a script.

    Automated unit testing for each procedure is a lot easier than unit testing statements scattered throughout the code. In fact, if you declare that this project will never use ad-hoc SQL, and everything is done through sp, you can see all of your data operations in one place. Make a table change, recompile all your procs, and see if any other logic needs to be updated.

    In my experience you'll usually get the task done better and faster (in coding time) with your programming language

    What if SQL is one of your programming languages? Would you concede that you can possibly get the task done faster in SQL in that case?

    Also, I don't see the "hiding logic in the data layer" problem. If you limit results to a one week time period, you'd prefer that the same clock be used to generate the timestamps and calculate the date difference. So you could pass in the number of days and select something WHERE timestamp > sysdate()-N if you want. Or use a View, parameterized if necessary, to have the number of days in a single place.

    In other words, the data arrangement is one layer, the stored procs and views are the low-level operations that may be repeated frequently. "Give me last week's revenues" is business logic, but it's best handled by the database. "Log in this user with this salted password" seems simple, but the database can be programmed to return 0 results or a specific error message if the user has wrong password, nonexistent user name, expired or banned or inactive account, whatever. Instead of selecting the relevant data and deciphering it application side, the database can return only the data you need. That is a much more scalable solution.

    Think about it this way. If the database has to join things and select things and put it together, it can either return all of that up the pipe, or since it's already in memory just go ahead and act on it and return the results. You would never select values from the database and add them in the application layer unless you actually needed to show the values. So where do you draw the line? Let the database play with the data and filter and sort and you still have a layer you can point to as the business layer - the procs and views.

    At work, I have 7 web servers and a single shared database cluster (2 nodes) for one of my projects. The web part of the app is mostly a dumb display - the only complicated part is validating security (because we interface with an external identity management tool and that's where the security data is, web side). The web app executes stored procs and puts the results into repeaters for display. It handles the business logic quite well, and I don't have to go searching for every reference to a table in the code if I need to make a change. Sure you can write your own data access layer that has everything in one place, but your webserver is doing both data and render work at that point.

    It makes no sense. If I had to use Oracle, I probably would put business logic in the app because I hate working with Oracle*, but I get to use MS-SQL, and it gets the job done, efficiently. Of course, I'm the kind of guy who appreciates writing an analog clock in T-SQL, just because you can.

    http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=33357

    *(how can you get up to version 10g of a database server and still fail to issue "ambiguous column name" errors consistently, instead arbitrarily taking one or the other depending on how you feel?)

  10. Re:TFA is not very informative. on Senate Candidate Sued By Copyright Troll · · Score: 1

    The law allows them to sue for any reason. I could sue you because you're wearing a purple tie. You'd be a "John Doe" until I subpoenaed Slashdot's IP data, then used that to subpoena your ISP to find out who you are, and then replace "John Doe" with your information. You're sued.

    The chance of it not being thrown out is another story. If you can prove that 3 words were vital to the story or some argument, you might keep the case alive. Most likely, it's going to go nowhere.

    Anyone can file a suit for anything.

  11. Re:LOLWUT? on Newspapers Cut Wikileaks Out of Shield Law · · Score: 1

    Did you know that most defendants who claim they aren't guilty under oath are never tried for perjury?

    It is explicitly assumed, especially in felony cases, that the accused will say anything to get out of jail. It's only the cases where the person succeeds in their misdirection that perjury is even considered. And then you have to wonder - how many instances are there where you are unable to counter someone's story, but are able to prove that they were lying for perjury charges?

    Most of the time it's some evidence found after a trial is over, then you know a witness is lying. But usually they lied because of something else, and we put them on trial for that. Lying to cover embezzlement usually involves prosecution of embezzlement, in other words, not perjury.

    He's the top dog, but he's still just a person. Not saying that it's ok, or that it doesn't abuse public trust. But I hardly think our society in general thinks it's anything other than expected.

    The only real difference here is this wasn't some mundane task where he could say he didn't recall meeting some random intern, or what their conversation was about, because he meets lots of people and has lots of people working at the White House. You can't claim "I don't recall, Senator" in this context, which is just as much of a lie if you do actually recall and just don't want to admit to it.

    Our legal system puts it as low priority, and prosecution puts it as low priority, and society in general pretty much expects it. Bill said the same thing any spouse caught cheating would say, he just said it better, and to more people.

    The original point was that Drudge brought something out that most news organizations were not covering, not how important it was. Regardless of their intentions, they were hiding information about "the chief executive officer, constitutionally, the top law enforcement officer of the land." Or choosing not to report because they figured most people wouldn't give two craps, which to me seems more likely. One maybe, but not two craps. Mainstream media can bury a story, and places like Wikileaks can expose it. Or Drudge, when he's not covering celebrity side-boob at the Oscars or whatever else he does.

  12. Re:Editors, please clearly define which side to ha on A New Species of Patent Troll · · Score: 1

    It doesn't matter if there's harm. I'm sure you just stopped reading, but for the rest of you: You can't claim you have a patent when you don't have one. Once your patent expires, you don't have one. It's a technicality and plugging a loophole, not preventing harm.

  13. Re:Definitely on Another Gulf Oil Rig Explodes · · Score: 1

    It is part of the problem.

    http://www.google.com/search?q=disabled+alarms+so+workers+could+sleep&btnG=Search

    A chief engineer on the doomed Deepwater Horizon drilling rig has told federal investigators that fire and gas-leak alarms had been turned off for at least a year because the platform's managers didn't want workers' sleep disturbed by false alarms, the Los Angeles Times tells us.

  14. Re:Editors, please clearly define which side to ha on A New Species of Patent Troll · · Score: 1

    Very simply, a patent expires. If you have a patent, you can put that number on your product. If you don't have a patent, you can't claim you have one. That leaves a grey area where you have a valid patent, but it expires. If your patent is invalidated, or your "patent pending" is rejected, you can't have a number on it. An expired patent is simply a loophole where you can advertise a patent which is no longer valid. It exists, but it does not protect the product.

    The loophole is that you leave the patent number on there, indicating to the customer that no other company can provide this tool as-is. The per-offense fine reflects how many people potentially bought your tool understanding that it was the only solution available. Also known as the number of times you claimed you had a valid patent but don't.

    Fluffeh was on the right path, but took the conclusion in the wrong direction. Regardless of the benefit, the per-offense fee is intended to reflect the market impact of the patent advertisement. If you sell one toothbrush, you lied to one person. If you sold a million, you lied to (potentially) a million people. Or one person a million times.

  15. Re:BillG hated the concept! on Microsoft Patents OS Shutdown · · Score: 1

    For a stable, useful operating system, in-memory cache is just stuff that the disk has only faster. And unsaved user work is irrelevant if the user wants to power off.

    I remember a power outage corrupting my first linux install, due to unflushed inodes or something. I had no recovery options, and was informed that's what happens. I was also told to use a different filesystem if I didn't want that. How was I supposed to know that, and why would you ship a CD with a default unstable filesystem?

    Point is, if something needs saved then save it - especially in the Win95 era. I can understand the need for lazy flushes today with NTFS and terabyte hard drives and the general hugeness of the registry and profile data, but Win95 had no excuse for not being ready to turn off at a moment's notice. In fact, there is an option for external drives so you can optimize for speed (lazy writes) or unsafe removal (always flushed). Why can't the OS do the same thing? That was rhetorical btw.

  16. Re:Hmm - App bugs on Microsoft Patents OS Shutdown · · Score: 1

    If you shut down, it gets aborted, then shut down again without changing anything, it's not legitimate.

    More likely the application accpets the shutdown, but returns the wrong value to the OS. The app shuts itself down but says 'abort'. Try again and the app is already gone, and shutdown proceeds normally. This is an application bug.

    Or something else like the app gets sent the shutdown message and takes too long to process. The OS thinks it's hung, so it starts hung app processing. But the app finishes working and goes away in the meantime. The OS thinks there's a hung app, but there isn't. This is a Windows bug, assuming nothing has changed since you went through the previous list.

  17. Re:How Does It Encapsulate the Source Code? on Many Hackers Accidentally Send Their Code To Microsoft · · Score: 1

    Wow you're wrong and have no idea how wrong you are. Almost everything the GUI does is thread-safe, except for the odd MUTEX. In the GUI, those are really very well handled, although the rare mishap does occur. I routinely debug the window management code from another window. Even under SoftIce, which is supposed to run under the OS (Win9x), it actually runs inside the OS as a kernel level service and simply manages its own window. You can still see the other windows being managed, while debugging the window management.

    The key is that it is thread-safe. It loads its context usually from fs:0 and continues on its way, unaware that it's being debugged. Hit a breakpoint and you stop that thread, but all other threads continue. Each process is separate, and you can have separate instances of the shell. It's the checkbox in Win9x that says to run explorer in separate process, or something like that - the folder options. So one crash doesn't crash the whole shell. They are not just separate threads, but separate processes that continue executing regardless of how bungled what you're debugging gets. Until you fault in kernel mode, in which case BSOD brings the whole house down.

    So I'd like to know more information on just how wrong the past 20 years of assembly-level debugging on Windows have been for me, if you have an explanation.

    WinDBG runs as a GUI app (it's actually a terrible bolt-on of a GUI onto a command-line interface), but you can debug the GUI all day long with it. Most of the GUI is not in the kernel, and in Vista they actually moved almost the whole thing out of the kernel. They moved it back in Win7 becuase of context-switching performance problems, which is why it was kernel mode to begin with. But most of it is outside. So you can debug the majority of the GUI at user mode. Things like SoftIce, which are really kernel-mode debuggers, can debug the kernel mode GDI code while it's running. Only if you use something like kdb, which is set up to run remotely, do you run into not being able to debug the GUI, and that's only a small fraction of the code.

    Not sure if I'm being repetitive, or merely repeating myself enough times that you might think about reading some of this and learning.

  18. Re:Possible Treatment For Ebola on Possible Treatment For Ebola · · Score: 1

    It's not just your taxes, it's mine too, and I'm ok with this. You got your interstate highway system, I got my Ebola cure, just like I always wanted.

    Based on what I'm seeing, without the NCI this would probably not exist, so we're all better off. I'd say this falls under the 'general welfare' part of the Constitution, so it's money well spent. The only thing that matters here is whether BMS got special treatment. Did all companies bid on this and BMS offered more? Or did someone make a sweetheart deal? Are competitors complaining about this deal?

    You're falling into the camp of "governmnet should never spend money to make life better for anyone unless there is profit involved."

    Also, did you know that you can request funding for cancer-related research from NCI? It's entirely possible that someone could request funding and come up with Taxol, and financially it equates to the same thing - a subsidy paid by the government for private research. The difference is, the governmnet does not want to produce drugs, nor be responsible for the inevitable lawsuits. so they had to get someone to make it. How does one entice a private entity to produce a good for the betterment of the population? Financial incentive.

    If Taxol does what it's supposed to do, actual costs of cancer treatment should go down overall, with part of the savings going to BMS as incentive to make the drug and take responsibility. This seems like the way forward for government to me.

    That said, most of the Ebola cases happen in countries too poor to afford Taxol. My only concern isn't whether some company gets exclusive rights to Ebola cure, it's whether the cost allows people with Ebola to benefit from it. If someone profits from production, import, and sales in the types of areas where Ebola is a concern, more power to them. I'm not going anywhere near the stuff, not even to give doses to people who need it. But it can't be a supply/demand pricing where you measure the cost of a poor person's life. If it's not affordable there will be outrage, otherwise not so much.

  19. Re:To those who would reply in harshness... on The Strange Case of Solar Flares and Radioactive Decay Rates · · Score: 1

    You are oversensitive on the subject. GP was ridiculing those who believe the earth is 6000 years old, not all religious people.

    If someone claims to be a scientist and sells you snake oil, you can ask them point blank how this works and/or do a double-blind test. The results should speak for themselves, and you get to call the guy a loon after you test the idea or product.

    But there is no similar test for religious people. They believe certain things despite all evidence to the contrary. Not everything is incompatible with science, and in fact large numbers of deeply religious people as you have mentioned are interested enough in how the world works that they have sought explanations that don't necessarily involve divinity. But there are the loons whose beliefs get stronger as more contrary evidence arises, because God said that Satan would test their faith. Those people are mocked and derided the same as they mock and deride scientists - for unerring reliance on a single source of truth or explanation for a subject.

    And of course the people with unorthodox views are usually the ones posting on websites telling science how wrong and ignorant it is, so they are the vocal minority which seems like it represents more people than it should.

    The best you could do to help, if you feel offended, is to try correcting people who say the world is 6000 years old, or science is heresy, or other nonsense. I think in this audience you are preaching to the choir, because we know that science is a "current understanding" and subject to change at any time. We discover a new particle and suddenly the classical model falls apart, and quantum physics rules. Decay rates are non-constant and suddenly all of our older dates are wrong. Oil disappears in the Gulf of Mexico and we realize nature probably already had a solution for when oil leaks out of the sea floor, in the form of naturally occurring oil eaters.

    You fix the loons on our side, we'll fix the loons on our side. But it's like whack-a-mole, only every time we win someone says it's a conspiracy trying to silence the truth.

  20. Re:Not guilty??? on Apple Exec Stashed $150,000 In Shoe Boxes · · Score: 1

    A third of those are probably mine, but I consider it money well spent.

  21. Re:No app for that? on Apple Exec Stashed $150,000 In Shoe Boxes · · Score: 1

    If he was getting enough kickbacks to be investigated, the shoebox is probably the red herring stash. High enough to make it look like they recovered what he hadn't spent, but nowhere near what he stashed elsewhere. So now they stop looking for money, he pays a fine or goes to jail for a bit, and retires with his stash of green.

    Now that I think about it, a few years in jail is a good substitute for decades of hard work, when the end result is retiring in an impoverished nation and living like a king. If your hobbies involve things you can do in a jail cell, it's even more attractive.

    And you're forgetting they look in the freezer too. After that, they'll be tossing the whole freezer, not just opening it up and saying "nothing but food".

  22. Re:Educational Problems on Union Boycotts LA Times Over Teacher Evaluation Disclosure · · Score: 1

    I'm a software developer too. I used to be a teacher. The teacher's union never once came in to play while I was teaching. Local decisions were how things got done, no teacher or group felt like they had to escalate the problem.

    Lots of areas do have problems, however, so their stories are different.

    The biggest difference between you and a teacher is that you won't ever have a parent who believes their child is a perfect, angelic creature, watch over your shoulder for everything you do, to try to catch you doing anything they can file a complaint about and get you fired. With tenure, the burden of proof lies more with the parent. In addition, a teacher requires very specific certification in order to even qualify for the position. I develop software all day long for a Fortune 10 company, and I have a Master's degree in Education. My certificate is expired, so I can't just go teach software. It wasn't in computer science so I am limited to 1 subject. And if not for my chosen specialty I'd have elementary, middle, or high school certification. You can't put an elementary teacher into a high school classroom. Since technology changes quickly, however, you can put a Java guy on C# and with some reading he'll be fine. Yes some IT employers have specific certification requirements, but not every single one.

    There are many instances where tenure fails, but that is usually a sign that the principal or board or district has failed. The first year, my kids had no idea what to do, or what the expectations were because the teacher I replaced, and I use that term loosely, talked 4 days a week and taught half of that last day. He should have been out long before, regardless of tenure or unions. And there are ways to make that happen, but no one had the will to do it because the parents thought he did a great job. To restate, the parents were the ones holding back their child's education, not the union.

    I know, it's anecdotal. But the teachers' union and tenure cause fewer problems that poor administration do. If a tenure system is in place, the poor teachers have to be removed before they achieve tenure. But if you don't have anyone to replace them with, you're stuck. The best you can do is to cut the position for a year, then open it next year. What do you do for that year? It's hard to accomplish because you don't have an infinite supply of qualified teachers, and parents are more interested in their child's performance than overall education, if they are interested at all.

  23. Re:Shared Objects / Dynamically Linked Libraries on 40 Windows Apps Said To Contain Critical Bug · · Score: 1

    Now that I've read the vulnerability more, it seems like the vulnerability loads remote content from a network share or through WebDAV. In that case, the "local" context is actually the remote location, so you get the person to load your non-restricted DLL from a remote location instead of from their computer.

    Fixing this would break some apps that require WebDAV type functionality, or running off of a share legitimately. For example, I host an executable with a library on a share. Without this functionality, the OS will look on the local drive and not find the library, and the app doesn't run. So you can't just say "no remote libraries", and you can't add this to the list of restricted libraries. Instead you have to fix the app to look in specific locations, or use a restricted library for its purposes.

  24. Re:Shared Objects / Dynamically Linked Libraries on 40 Windows Apps Said To Contain Critical Bug · · Score: 1

    You can choose to include certain libraries statically (so you include the binary code) or dynamically (so you have a reference to a .dll). You can also use the OS to dynamically load a library on-demand so that it is neither opened nor initialized until it is needed. For example, MFC has its own radio button in MS Visual Studio - do you want it static or dynamic? I believe the C runtime (msvcrt.dll) has the same choice but can't be bothered opening it to check. Plus, if it's only an estimated 40 apps, it might be something like zlib but less popular, so you can choose between static linking and building/supplying the .dll for it.

    But that's not important. The SecurityFocus note for iTunes says "All a remote attacker has to do is plant a malicious DLL with a specific name on a network share and get the user to open a media file from this network location in iTunes." This suggests that you are replacing a dynamically loaded file with your file of the same name. To understand the implications read the following article. The short version is: if I name a file kernel32.dll and put it in the same folder as my application, previous versions of Windows would load my kernel32 instead of the operating system's. Only important files are protected, most files are not "known DLLs" and are handled differently but the idea is the same.

    http://technet.microsoft.com/en-us/magazine/2007.01.windowsconfidential.aspx
    http://msdn.microsoft.com/en-us/library/ms682600

    There are certain files which will be loaded from the system always, instead of from the local folder. It appears that this bug has simply found a commonly used .dll which is not on the protected list, so no .local override is needed. Just put your malicious file in the same folder and it gets loaded.

    iTunes advisory suggests it includes WebDAV somehow, but I don't think iTunes uses webDAV intentionally. So it must be something like the protected media player libraries (which should be protected) which always load something that's not on the protected dll list.

    To answer your question: if an application depends on certain behavior, such as loading local .dll files without requiring a .local override, and this bug is fixed (the example I gave, regardless of whether it's the actual bug), the application will fall back into .dll hell and possibly break apps which expect specific versions of a library instead of whatever is in the system protected location.

    Not that I know what the vulnerability is, I'm just giving an example based on the information available.

  25. Re:A fool and his money... on Calling Shenanigans On Super SATA's Claimed Audio Qualities · · Score: 1

    You are conflating two separate groups. There are people who genuinely can tell the difference, and have tried a blind test on themselves, if not double-blind. It's fairly inexpensive to do at wine tastings, and discover what you like. I've done it with apples and cheese and beer and wine, so I know what I like. These are not the "snobs", these people know what is different among the choices, and know what they prefer.

    There are people who order a single entree, wine, or whatever, knowing in advance what the price is, and rate their experience without any additional context. Those people tend to rate higher when it is more expensive. They are the "snobs".

    As for the tasting, 9 of 11 judges were French, and only their scores were used, and they likely spent most of their life discriminating French wines made with French grapes on French soil. They probably didn't spend a lot of time trying to guess the country of origin as many elite tasters can do, but that is obviously irrelevant based on the results. They were not asked which one tasted the most French, they were asked to use their own criteria and grade the quality. The 30th anniversary states that they were honest when they believed a foreign wine had bested France: "Despite the French tasters, many of whom had taken part in the original tasting, 'expecting the downfall' of the American vineyards, they had to admit that the harmony of the Californian cabernets had beaten them again." So it's possible, if not probable, that the 30-year evaluations knew which was which and voted for their choices best anyway.