Do you watch the instant replays on the game and wonder if it will be different this time?
Hey, maybe it won't hurt this time if you smash your hand with a hammer. Maybe it'll feel good. Maybe you'll find a cookie.
Let's try not to be too cynical, Slashdotters.
How about if we just learn from experience and history then? Is learning okay with you?
There are very simple and very clear ways that Microsoft COULD go about to provide those formats and patents to Open usage.
But Microsoft isn't doing that. So until I see the exact legal wording, I'm going to be suspicious.
Microsoft is doing a good thing here.
How do you know that? Have you read the legal paperwork about the limitations on it will be? There WILL be limitations. But you think you already know them (and someone mod'ed you "insightful" for it).
This doesn't forgive them for all the other naughty things they do, not by a long shot, but it's still a big deal and a big step forward.
So, you refuse to learn from history, you believe things are great when you haven't read the fine print and you think other people who don't follow your lead are wrong.
Hip hip hooray!
Why don't you take Mr. Hammer to meet Mr. Hand again? Maybe the result will be different this time.
But, since the original has now been altered, there will never be any more tests run by 3rd parties to confirm or discredit the results of the original test.
Which moves this out of the realm of science and into the realm of religion.
The reason for doubting the original test is religion. Religion is what limited access to the shroud. And now the shroud has been compromised.
At this point, any "tests" done to "disprove" the original tests are pure religion. And the reason for that is that they don't want their sacred artifact to be shown to be faked.
Far better an unproved artifact than a validated fake.
No, I'm afraid that's where you're wrong. It's the problem of the Linux kernel developers and their reputation.
Hmmm, somehow I just can't imagine Linus (one of the kernel developers) being unable to sleep because he's worried about his reputation.:D
That's what's at stake, and if that community of people chooses to make people jump through a bunch of hoops just to submit a patch for a security related problem then I wish them the kernel security they deserve.
Ha!:) Yeah, "jump through a bunch of hoops".
Translation: "You must be smart enough to read one of the email addresses attached to the changelog attached to the code you're reading."
Like I said, I'm not a developer yet I can find the addresses without any problem.
Congratulations. When I've looked through the Changelog or through the source for a particular module, I've largely found out-of-date email addresses unless it's for something recent. It's not reliable, and it's a stupidly obscure process.
"out-of-date"? They were just submitted in the last update.
Go ahead, show that I'm wrong. What address did you send to and when?:D
You know you didn't. I know you didn't. So who are you trying to fool?:D
Such an email address does not have to send email to just one person. So, there might be a single point of failure, but it would be the server for the email address, not a particular person.
I take it you don't understand the term "single point of failure". It doesn't have to be a person, it can be an address or a machine or anything. As long as there is just one and it is the point through which everything flows.
Yep, everybody who has a problem with how the current system works must be dumb. You sure showed me with your marvelous rhetorical style. I'll be sure not to argue with you again. The crushing grip of logic is just too much to bear.
Well, when you mature a bit more, you'll be able to just leave the conversation. If you ever mature beyond that, you'll be able to admit that you were wrong.
The simple fact is that there are LOTS of different ways to get a patch into the kernel. Listing the person's address on the changelog is one of the ways to support distributed development.
The guy you're talking about had an ego problem when Linus himself didn't congratulate him on finding a flaw in Linus's kernel. That's an ego problem, not a problem with the patch submission process.
If you mean that a user that is competent to run Linux but not Windows should use Linux, then yes. The reverse is also true.
No. I said what I meant. You can read it the way I wrote it.
Competent users prevent the machine from becoming infected in the first place, making such tools unnecessary.
And when 90%+ of the Windows machines in the field are NOT managed that way, no, that isn't a matter of user incompetence.
Example: Firefox uses a "block everything except that which is specifically allowed" scheme for installing extensions.
IE uses a "allow everything except that which is specifically forbidden".
Now, a "competent" user could configure both so that they have the same level of protection.
But the reality is that IE has a really bad security model and to become "competent" would require lots of very specific training on that application, MS's security model (including "zones"), ActiveX, etc.
While a user of Firefox wouldn't need any of that to achieve the same level of protection.
At which point, it isn't "competency", it's "design flaws".
Sure, you can depend upon the user to compensate for the design flaws, but that doesn't mean the flaws aren't there.
And that has been Microsoft's approach for years.
#1. Ship the product full of holes.
#2. Have the default installation turn on everything even if it isn't needed and even if it can be used to attack the machine.
#3. Expect the user to use 3rd party virus protection as a band-aid to some of those holes.
#4. Expect the user to train to become an expert at work-arounds to protect those holes.
#5. Claim that your product has more "ease-of-use" than the competion's.
In other words, the difference between your usage of "competent" and what would be "expert" is practically non-existant.
I know MCSE's who were hit by slammer and blaster. And these people were certified by Microsoft. Microsoft certified them as "competent".
Sorry, kid. But in the Real World, depending upon the users to become experts in the systems they're using just so they can keep them from being compromised isn't a viable option. The system defaults need to be secure enough for the way the average user will use the system.
Remember this, the computer is there to make your job easier. Not to give you something else to worry about. Not to give you something else to become an expert at.
I don't care who looks at it, I just want a single email I can send a security flaw to no matter what system it's in.
That's your problem.
It's all about what OTHER PEOPLE should do to make YOUR life easier.
Looking up a name in a list is TOO HARD for YOU!
There should be a link on kernel.org so YOU can send something to some OTHER PERSON who will spend the time and effort to determine what it is and who's responsible for that and then make sure it gets to that person.
I, personally, wouldn't have had any idea how to figure out who to send the patch to without you having just outlined the process right here. That process is not obvious and too complicated.
Not obvious? It's where you go to get the source for the latest kernel.
I can't write patches for the kernel and even I can find it.
There needs to be one single email address listed in a prominent place where you can send such things to.
Right. It's all about how to make YOUR life easier by having OTHER PEOPLE do it for you.
Rather than you spending 20 seconds to find the email addresses, you expect someone else to be able to read the patches, find out who maintains that subsystem and get the patches to that person.
...but the process you outline is not a tenable process for a kernel used by millions of people, some who are programmers who may have no familiarity with the Linux kernel development process, but are none-the-less capable of finding and fixing a security flaw all by themselves.
No. The fact is that many hundreds of people manage to get patches submitted in the current structure.
Yet there was one example of one person who couldn't understand that structure...
So the whole structure is wrong and has to be replaced.
Rather, it seems that that one person has a problem and your "solution" would only make MORE work for someone(s) who had to be the single point of failure (do you know that term) for processing patches.
The current system has so many ways to get a patch submitted that even the dumbest individual will eventually stumble across one. As was shown with your example.
Why switch from such a distributed, de-centralized system to one with a single point of failure?
Just to make life easier for the dumb people? I don't think so.
And I'm telling you that the "community" is a group of individuals.
If you have a problem with the "community", then identify the person who was or would have been responsible and who failed.
From reading that article, it looks like the people had a security patch they wanted to submit, and couldn't figure out who to submit it to. They got all kinds of conflicting answers, and there were no obvious "Submit Security Patches Here" email address listed anywhere.
Why not just look at the patch log for the system that the patch was for?
That would tell them who submitted the stuff with the flaw. Which should also tell them who the maintainer is.
Those things should've been in place already.
They are in place. Because someone doesn't want to bother to look doesn't mean that they aren't.
From all the backpatting about security that happens around here, you would've thought they were in place.
Just click on "Changelog" next to the kernel version and you get a list of name and addresses of who submitted what.
Suppose you found a flaw in the hostraid system for the aic79xx series?
You'd find out who submitted a patch for that and who signed off on that patch.
So you'd have the names and email addresses of two specific people who definately have something to do with that particular subsystem and who have had patches successfully submitted to the kernel.
It doesn't get any easier than that.
And that level of definition (talking to the person who actually wrote the subsystem) is why Linux's security is so much better than Windows'.
You find a flaw... You go to kernel.org... You look up who submitted that code... You talk to that person... You both work on the patch... The flaw gets fixed...
It's just that easy. As long as you aren't burdened by an ego that demands that Linus himself accept and praise your contribution.
*nod* Judging from the number of ssh attempted login scans, there are a fair number of comprimised Linux boxes out there.:-(
Would 5 boxes be "a fair number"?
I'm starting to get really annoyed with Open Source people patting themselves on the back over security when stuff like that last thing where the people tried to get someone responsible for Linux kernel development to accept a security related patch, and ended up having to get an article on Slashdot before it happened.
I think you need to re-read that story. The person sent the patch to the wrong person.
Once it was brought to the attention of the right people, it was incorporated.
Security doesn't just magically happen. The Open Source development model is the only way to go if you want real security, but it actually requires effort on the part of maintainers to make it happen.
Are you saying that Linus is not putting enough effort into it?
Is that what you're saying?
If it isn't, then would you please identify exactly which of the "maintainers" you believe is not putting in enough "effort".
After all, you did say that "it actually requires effort on the part of maintainers to make it happen."
Fact: Much of what winders suffers from is incompetent users.
And the corollary to that is: Competent users leave Windows and move to Linux.
If by "incompetent" you mean "does not update a 3rd party app to kill viruses the the original software does not try to prevent", then you could be correct.
Nothing is really stopping the developers from writing spam bots for windows because idiot users on Linux could run bad code just as easily as idiot users on windows.
No. Outlook used to automatically run certain executables sent to it.
So, no, users of Linux have not had the same ease-of-infection that Windows users have had.
Microsoft is just now waking up to the problems and is now trying to deal with them.
But that leaves a LOT of machines out there that are infected because of Microsoft's decisions and will remain infected.
OTOH, you don't have such dumbass tricks ass tying your browser right to the OS or ActiveX, so you make spyware and whatnot less of a factor.
That's one of the key points against TFA. Microsoft has made bad technological decisions to further their marketing ambitions.
On yet another hand, however, you have the problem of moron users running sendmail daemons that listen for connections from the Internet and other stupid things.
Huh? Isn't that what sendmail is supposed to do?
Plus, Linux has security holes. If stupid people don't patch them just like they don't path winders, what good is the security?
The security system is what prevents a minor flaw from compromising the whole system.
Running named in a chroot jail is an example. One flaw in one system will not result in a 100% compromised machine.
Windows USED to run services that the average home user would never use and it ran them as the system account and it ran them with access to everything else.
So, a flaw in DCOM resulted in your entire machine being compromised.
That is the difference between a good security model running an app with a hole and...
a bad security model running an app with a hole.
Again: You can protect the stupid people from the world if you want, but you can't protect them from themselves.
Sure you can. Just make the default install (stupid people always take the default, right) as secure as possible.
Microsoft is getting better with XP, but they still have years of flaws to deal with.
And their recent decisions to NOT offer patches to "illegal" machines is also a problem. If they make it harder for people to get patches, more people will be running unpatched machines.
Therefore, Microsoft is making it harder for their systems to be patched.
His article isn't about FACTS, it is about INSINUATIONS.
From TFA:
"The biggest challenge we need to face centres on the myth and reality. There are lots of myths out there as to what Linux can do. One myth we see is that Linux is more secure than Windows. Another is that there are no viruses for Linux," said McGrath.
Okay, he identifies one "myth". So, in the next statement, you would expect him to provide support for that statement with facts, right? But what do you get instead?
"Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux.
You get QUESTIONS.
Suppose it went like this, instead.
"There's a myth that the world is not flat, that it is round."... "Well, what happens to the ships that sail over the horizon and NEVER COME BACK?"
"In Microsoft's world customers are confidant that we take responsibility. They know that they will get their upgrades and patches."
Actually, they don't know that. How many years has it been since ServicePack 6a for NT and NT's "end of life"?
Microsoft has a history of dropping support for all but the most extreme problems on their "legacy" systems.
And the article continues like that. It isn't about illustrating the specifics of problems with Linux.....
It's political. It's about getting the IDEA that Linux's security is a myth into general acceptance.
The way to do that is to have your people and "journalists" repeat it endlessly. Stay on message.
Don't address the facts or real issues.
Keep repeating that there are "myths" and that these "myths" are not true and that the smarter people are starting to see through the "myths".
The credibility of Linux in the enterprise is beginning to suffer, according to McGrath, as companies complete trials and find the platform wanting.
Smart people KNOW what the myths are.
Don't you want to be smart, too?
If you were smart, you'd see the fabric. You'd see how beautiful it is.
If you were smart, you see the clothes made from that fabric. You'd see how nice they looked on the king.
Only dumb people cannot see the clothes on the king.
Oh, sorry. I seem to have wandered into an old fairy tale for children. I did not mean to imply in any way that Nick is playing the same part as the "tailors" in that story.
Anyway, back to the article. Smart people see the "myth" in Linux. Only dumb people cannot see it.
Death War Famine Plague Grievous Bodily Harm Cruelty To Animals Things Not Working Properly Even After You've Given Them A Good Thumping but secretly No Alcohol Lager and, last but not least... Really Cool People
So, we have General Grievous....
Will we see Captain Cruelty? Maybe Lt. Things (alias Lt. Lager)?
I was zooming in and out while moving the mouse in circles and I lost the data off screen.
Also, my keyboard arrow keys are on the right of my keyboard. So I have to reach across by body with my left hand to control the arrow keys while moving the mouse. Bad design.
Other than that, I'm not impressed by the zoom function. Sure, it's a cool hack for a webpage, but maps.yahoo.com has been doing similar things for years (and better as in the data set changes the closer you get).
He might be a pin-head, yet it should be stressed that a manager isn't hired to do the same job as their subordinates.
That's right. He's hired to manage them so that they are as productive as can be at their jobs.
They should know how to help you by removing barriers, not how to replace you.
But without knowing the job, they won't know the real barriers from the crap any lazy slob claims is a problem.
Tech note - I've run into a LOT of people who constantly blame their computers for "problems" which cause them to miss deadlines and such. No matter which computer they're given.
I would bet that it would be impossible for someone to acquire your extensive skills and aquire the equally extensive skills it takes to manage people.
Hardly. If that was the case, no one would ever be able to switch careers.
If your manager can only hold one skill set in memory, you need another manager.
A manager must be judged on management skills alone.
Two different areas:
#1. Auto assembly line (10 workers)
#2. Software company (10 programmers)
The skills needed to manage these two are completely different.
They aren't (nor should be) geniuses, and the must know how to encourage you to reach your highest potential in your position.
But if they don't know what the job requires, how will they encourage that? How will they be able to evaluate that?
If you don't know the jobs of your workers, you'll have to base your assessments upon something other than their skills.
And that's the first step to becoming a bad manager.
I agree with most of that, but you're off on the "common carrier" bit.
The phone company isn't held responsable if a bank robbery is planned over the phone only because they make no effort to control what is said. (In other words, because they are a common carrier).
As soon as you start controling what your users can put out on the net, you lose common carrier protections.
The phone company won't control what you say, but they can do some things like having the corner pay phones only able to make outgoing calls so that criminals won't be able to setup shop with them.
The same methodology can be used to fight spam.
You don't care what is in the email the customers send, they just have to send it via your email server. This will stop almost every zombie spammer out there.
And that's how spam will be fixed. By looking at each characteristic of spam and dealing with each one, individually.
Other things that hinder spam prevention include pointy headed morons who report legitamate mails as spam because they can't be bothered to unsubscribe to double opt-in lists that they DID subscribe to,...
I've had users specifically request info from a site and then dump the email with that info into the spam folder.
Fortunately, Spamassassin handles enough so that I only have to confirm 10 - 15 of those a day.
Ultimatly, spam will go away when people stop buying things from spammers. Nothing else will likely manage it.
If so, that day is very far away. People do buy things like penis pills and they do it online because they feel better not having to face another human being while doing it. Sad, but true.
Raise the monthly rate by $5 and give customers a $5 DISCOUNT if they'll accept "secured" service (read: blocking port 25).
"Hi! Thanks for calling Big-Internet-Service. This month we're having a special of $5 off our monthly bill with "secured service". This service will help make sure your email to your friends gets to them by making sure your machine doesn't end up on a blacklist somewhere. Would you like the $5 discount?"
"What's the alternative?"
"You pay us $5 extra a month and we cut your connection whenever we confirm that you've been spamming."
Then: teenage girls arguing with each other via blogs Now: CEOS of multi-million dollar corporations arguing with each other via blogs/Emma Bunton
Tomorrow - CIEIO's with LiveJournal accounts.
"iBM iz such loosers. i not let them on my Freinds list. ha ha! i tell them to port DB2 and i might think about it. Loosers. Sam will not tell me my poetry sux N E more now. i write what i feel. i want to ask the Q T girl out but i am shy. Maybe i will send her some of my poetry. iBM better port WebSphere 2 or i still keep them off my Freinds list. ha ha! Take that you loosers!"
Let's say we implement at a bare minimum the kind of strategies required to make Kyoto a reality. Not just window-dressing, but actually enforce upon the population of North America a cutback in energy use. How many people will die? Perhaps worse, how many people end up in basically third-world living conditions with no access to health care because there isn't any transportation available?
If people didn't have cars, they would rather die than ride a bicycle to the doctor?
Sure, we'd still have ambulances and fire trucks and so forth, but you have to look at the situation from the stand point of someone living in it.
For years we've gotten by with horses, ox-carts and so forth. We can do better than that now, without the pollution.
There is always some type of disaster that is "going" to happen. It's all propoganda just to keep everyone frightened into doing whatever it is the flavor of the month wants you to do. Here's an idea, let's just live.. because when the time comes to die, you will.
And that was mod'ed "Insightful"?
This isn't about you or your death.
This is about leaving the planet in a habitable condition for the next generation.
Or do you also suck on loaded revolvers because "when that time comes.. big deal.. death is the completion of life in whatever form it may take"?
State's Rights are only sacrosanct when you are trying to do something the Federal government does not want.
The same people who cry "State's Rights" to prevent something they do not like from impacting their state will be the first people to push for Federal authority when they're in control and some state doesn't want to follow their rules.
I'm afraid it's you who has completely misunderstood; the technology is irrelevant here, and the issue would be the same whether or not the filter is Bayesian, keyword based, random, or whatever.
No one ever said that there weren't false positives. The issue was whether they were political.
The filters have false positives. These false positives include mail that is very similar to stuff that CBS News should be reporting on; if I discover a scandal about a politician, CBS News do not want to be ignoring it if there's a good story there.
You don't understand the technology. Suppose you found a new scandal involving Bush and Meitnerium.
That would probably get through their filters. Unless their filters were also trained on the word Meitnerium.
I fully understand the technology; I know why there are false positives and false negatives.
Well, you believe you do.
However, this is a political issue; a corrupt politician can pay a spammer to poison spam filters such that discussion of their corrupt behaviour is treated as spam, thus increasing the likelyhood that they'll get away with it.
I thought you understood the technology.
So, what you're saying is that a corrupt politician...
Would pay a spammer...
To use certain words...
In a spam flood...
Against a specific news organization...
So that that specific news organization's filter will learn those key words as spam...
And someone with info on a new story involving that politician and those words will have their email eaten by the spam filter...
Interesting theory. Of course, no one at CBS would wonder why all of their email to their news shows suddenly stopped mentioning "Bush" (all emails mentioning Bush were eaten).
The US post office. People never send paper letters.
This would only affect CBS. What if the story was sent to MSNBC also? ABC? CNN?
Regardless of why or how a system generates false positives, these false positives are bad, as CBS News should be reporting on corrupt politicians.
No, not "regardless of how or why".
To be political, it has to be "why".
Do you understand yet? Strings are part of content, and if CBS News's Bayesian filter ends up ignoring mail about a genuine news story (confusing it with spam), this is politically bad, even though the technology is apolitical.
I understand far better than you do.
First off, I understand that email is NOT the only means of communication. Even if someone could block email traffic about Bush / scandal / whatever, they couldn't block the others. Nor could they block the email traffic to other news organizations. Even your extreme example is meaningless.
I understand that CBS news gets TONS of spam and TONS of ham about Bush and scandal.
I understand that it takes a ton MORE messages to alter a Bayesian filter.
If CBS has 1,000 ham emails that had Bush / scandal / whatever... just sending 1,000 spam messages would only bring the likelyhood of it being marked as spam up to 50%.
The spammer would have to FLOOD their mail server with those tailored messages. The spammer would have to send 100x the previous TOTAL number of ham messages, at once.
How does the spammer know what that previous total was? Was it 100? Send 10,000? 1,000? Send 100,000? 10,000? Send 1,000,000? 100,000? Send 10,000,000?
All to CBS news. Of course, you'll assume that their servers can handle that load.
All to shutdown one avenue of contact (email) for one phrase (whatever the sc
All you have to do is to show that someone on the other side (Democrats/Republicans) also did it or were linked to it.
This isn't about determining whether something is "good" or "bad".
It's all about showing how your team isn't "wrong" because the other team did "bad" things, too.
Which is why you'll never see non-partisan statements such as "we will not sell weapons to non-Democracies" -or- "we will fix the problems in our voting system and ensure a verifiable paper trail".
But you will see lots of references to "well, Clinton also did that" or "well, Bush started it".
Slashdot Mirror
Hey, maybe it won't hurt this time if you smash your hand with a hammer. Maybe it'll feel good. Maybe you'll find a cookie.How about if we just learn from experience and history then? Is learning okay with you?
There are very simple and very clear ways that Microsoft COULD go about to provide those formats and patents to Open usage.
But Microsoft isn't doing that. So until I see the exact legal wording, I'm going to be suspicious.How do you know that? Have you read the legal paperwork about the limitations on it will be? There WILL be limitations. But you think you already know them (and someone mod'ed you "insightful" for it).So, you refuse to learn from history, you believe things are great when you haven't read the fine print and you think other people who don't follow your lead are wrong.Why don't you take Mr. Hammer to meet Mr. Hand again? Maybe the result will be different this time.
Maybe.
Hip hip hooray!
I'll wait until I see the EXACT wording of the license.
If Microsoft was serious about allowing open access to those patents, there are avenues they can take to allow that.
Just saying "royalty-free" only means that you won't have to pay to use them.
Freeware is not the same a Open Source.
You are mostly correct on that.
But, since the original has now been altered, there will never be any more tests run by 3rd parties to confirm or discredit the results of the original test.
Which moves this out of the realm of science and into the realm of religion.
The reason for doubting the original test is religion. Religion is what limited access to the shroud. And now the shroud has been compromised.
At this point, any "tests" done to "disprove" the original tests are pure religion. And the reason for that is that they don't want their sacred artifact to be shown to be faked.
Far better an unproved artifact than a validated fake.
Translation: "You must be smart enough to read one of the email addresses attached to the changelog attached to the code you're reading."
Like I said, I'm not a developer yet I can find the addresses without any problem."out-of-date"? They were just submitted in the last update.
Go ahead, show that I'm wrong. What address did you send to and when?
You know you didn't. I know you didn't. So who are you trying to fool?
The simple fact is that there are LOTS of different ways to get a patch into the kernel. Listing the person's address on the changelog is one of the ways to support distributed development.
The guy you're talking about had an ego problem when Linus himself didn't congratulate him on finding a flaw in Linus's kernel. That's an ego problem, not a problem with the patch submission process.
Example:
Firefox uses a "block everything except that which is specifically allowed" scheme for installing extensions.
IE uses a "allow everything except that which is specifically forbidden".
Now, a "competent" user could configure both so that they have the same level of protection.
But the reality is that IE has a really bad security model and to become "competent" would require lots of very specific training on that application, MS's security model (including "zones"), ActiveX, etc.
While a user of Firefox wouldn't need any of that to achieve the same level of protection.
At which point, it isn't "competency", it's "design flaws".
Sure, you can depend upon the user to compensate for the design flaws, but that doesn't mean the flaws aren't there.
And that has been Microsoft's approach for years.
#1. Ship the product full of holes.
#2. Have the default installation turn on everything even if it isn't needed and even if it can be used to attack the machine.
#3. Expect the user to use 3rd party virus protection as a band-aid to some of those holes.
#4. Expect the user to train to become an expert at work-arounds to protect those holes.
#5. Claim that your product has more "ease-of-use" than the competion's.
In other words, the difference between your usage of "competent" and what would be "expert" is practically non-existant.
I know MCSE's who were hit by slammer and blaster. And these people were certified by Microsoft. Microsoft certified them as "competent".
Sorry, kid. But in the Real World, depending upon the users to become experts in the systems they're using just so they can keep them from being compromised isn't a viable option. The system defaults need to be secure enough for the way the average user will use the system.
Remember this, the computer is there to make your job easier. Not to give you something else to worry about. Not to give you something else to become an expert at.
It's all about what OTHER PEOPLE should do to make YOUR life easier.
Looking up a name in a list is TOO HARD for YOU!
There should be a link on kernel.org so YOU can send something to some OTHER PERSON who will spend the time and effort to determine what it is and who's responsible for that and then make sure it gets to that person.Not obvious? It's where you go to get the source for the latest kernel.
I can't write patches for the kernel and even I can find it.Right. It's all about how to make YOUR life easier by having OTHER PEOPLE do it for you.
Rather than you spending 20 seconds to find the email addresses, you expect someone else to be able to read the patches, find out who maintains that subsystem and get the patches to that person.No. The fact is that many hundreds of people manage to get patches submitted in the current structure.
Yet there was one example of one person who couldn't understand that structure...
So the whole structure is wrong and has to be replaced.
Rather, it seems that that one person has a problem and your "solution" would only make MORE work for someone(s) who had to be the single point of failure (do you know that term) for processing patches.
The current system has so many ways to get a patch submitted that even the dumbest individual will eventually stumble across one. As was shown with your example.
Why switch from such a distributed, de-centralized system to one with a single point of failure?
Just to make life easier for the dumb people? I don't think so.
If you have a problem with the "community", then identify the person who was or would have been responsible and who failed.Why not just look at the patch log for the system that the patch was for?
That would tell them who submitted the stuff with the flaw. Which should also tell them who the maintainer is.They are in place. Because someone doesn't want to bother to look doesn't mean that they aren't.Again, it is. http://www.kernel.org/pub/linux/kernel/v2.6/Chang
Just click on "Changelog" next to the kernel version and you get a list of name and addresses of who submitted what.
Suppose you found a flaw in the hostraid system for the aic79xx series?
You'd find out who submitted a patch for that and who signed off on that patch.
So you'd have the names and email addresses of two specific people who definately have something to do with that particular subsystem and who have had patches successfully submitted to the kernel.
It doesn't get any easier than that.
And that level of definition (talking to the person who actually wrote the subsystem) is why Linux's security is so much better than Windows'.
You find a flaw...
You go to kernel.org...
You look up who submitted that code...
You talk to that person...
You both work on the patch...
The flaw gets fixed...
It's just that easy. As long as you aren't burdened by an ego that demands that Linus himself accept and praise your contribution.
Once it was brought to the attention of the right people, it was incorporated.Are you saying that Linus is not putting enough effort into it?
Is that what you're saying?
If it isn't, then would you please identify exactly which of the "maintainers" you believe is not putting in enough "effort".
After all, you did say that "it actually requires effort on the part of maintainers to make it happen."
Competent users leave Windows and move to Linux.
If by "incompetent" you mean "does not update a 3rd party app to kill viruses the the original software does not try to prevent", then you could be correct.No. Outlook used to automatically run certain executables sent to it.
So, no, users of Linux have not had the same ease-of-infection that Windows users have had.
Microsoft is just now waking up to the problems and is now trying to deal with them.
But that leaves a LOT of machines out there that are infected because of Microsoft's decisions and will remain infected.That's one of the key points against TFA. Microsoft has made bad technological decisions to further their marketing ambitions.Huh? Isn't that what sendmail is supposed to do?The security system is what prevents a minor flaw from compromising the whole system.
Running named in a chroot jail is an example. One flaw in one system will not result in a 100% compromised machine.
Windows USED to run services that the average home user would never use and it ran them as the system account and it ran them with access to everything else.
So, a flaw in DCOM resulted in your entire machine being compromised.
That is the difference between a good security model running an app with a hole and
a bad security model running an app with a hole.Sure you can. Just make the default install (stupid people always take the default, right) as secure as possible.
Microsoft is getting better with XP, but they still have years of flaws to deal with.
And their recent decisions to NOT offer patches to "illegal" machines is also a problem. If they make it harder for people to get patches, more people will be running unpatched machines.
Therefore, Microsoft is making it harder for their systems to be patched.
Bad move.
From TFA:Okay, he identifies one "myth". So, in the next statement, you would expect him to provide support for that statement with facts, right? But what do you get instead?You get QUESTIONS.
Suppose it went like this, instead.
"There's a myth that the world is not flat, that it is round."
"Well, what happens to the ships that sail over the horizon and NEVER COME BACK?"Actually, they don't know that. How many years has it been since ServicePack 6a for NT and NT's "end of life"?
Microsoft has a history of dropping support for all but the most extreme problems on their "legacy" systems.
And even on their current systems, Microsoft waits MONTHS AND MONTHS without publishing a patch:
http://www.eeye.com/html/research/upcoming/index.
And the article continues like that. It isn't about illustrating the specifics of problems with Linux.....
It's political. It's about getting the IDEA that Linux's security is a myth into general acceptance.
The way to do that is to have your people and "journalists" repeat it endlessly. Stay on message.
Don't address the facts or real issues.
Keep repeating that there are "myths" and that these "myths" are not true and that the smarter people are starting to see through the "myths".Smart people KNOW what the myths are.
Don't you want to be smart, too?
If you were smart, you'd see the fabric. You'd see how beautiful it is.
If you were smart, you see the clothes made from that fabric. You'd see how nice they looked on the king.
Only dumb people cannot see the clothes on the king.
Oh, sorry. I seem to have wandered into an old fairy tale for children. I did not mean to imply in any way that Nick is playing the same part as the "tailors" in that story.
Anyway, back to the article. Smart people see the "myth" in Linux. Only dumb people cannot see it.
Many thanks to Mr. Pratchett.
...
Death
War
Famine
Plague
Grievous Bodily Harm
Cruelty To Animals
Things Not Working Properly Even After You've Given Them A Good Thumping but secretly No Alcohol Lager
and, last but not least
Really Cool People
So, we have General Grievous....
Will we see Captain Cruelty? Maybe Lt. Things (alias Lt. Lager)?
I was zooming in and out while moving the mouse in circles and I lost the data off screen.
Also, my keyboard arrow keys are on the right of my keyboard. So I have to reach across by body with my left hand to control the arrow keys while moving the mouse. Bad design.
Other than that, I'm not impressed by the zoom function. Sure, it's a cool hack for a webpage, but maps.yahoo.com has been doing similar things for years (and better as in the data set changes the closer you get).
Tech note - I've run into a LOT of people who constantly blame their computers for "problems" which cause them to miss deadlines and such. No matter which computer they're given.Hardly. If that was the case, no one would ever be able to switch careers.
If your manager can only hold one skill set in memory, you need another manager.Two different areas:
#1. Auto assembly line (10 workers)
#2. Software company (10 programmers)
The skills needed to manage these two are completely different.But if they don't know what the job requires, how will they encourage that? How will they be able to evaluate that?
If you don't know the jobs of your workers, you'll have to base your assessments upon something other than their skills.
And that's the first step to becoming a bad manager.
17 screen shots of games? And most of the others were shots of menus.
I use Ubuntu at home and I really like it, but this article doesn't show anything about it.
Ubuntu is clean and lean and handles hardware detection just fine on my box.
Of course, since it is based on Debian, the installer isn't important. You'll only use it once.
The same methodology can be used to fight spam.
You don't care what is in the email the customers send, they just have to send it via your email server. This will stop almost every zombie spammer out there.
And that's how spam will be fixed. By looking at each characteristic of spam and dealing with each one, individually.I've had users specifically request info from a site and then dump the email with that info into the spam folder.
Fortunately, Spamassassin handles enough so that I only have to confirm 10 - 15 of those a day.If so, that day is very far away. People do buy things like penis pills and they do it online because they feel better not having to face another human being while doing it. Sad, but true.
Distributed processing is where it is at.
If you own your own ISP, you're limited to the bandwidth that you're paying for (and you can be blocked easily).
With a bunch of zombie machines, you have TONS more bandwidth and you're not paying for it!
Plus - all those processors sending spam.
Just 10 zombies on 256K upload cable modems is 2.5Mb.
A regular T1 is only 1.54Mb.
Someone (Joe) inside your company sends email to another account of their's.
Joe then reports that email as "spam" to a blacklist.
BAM! You're identified as a spammer.
You see the reject comments on your mail server.
You check the blacklist and look up the emails that were reported.
BAM! Joe is fired.
You show the blacklist site that you're not an open relay or proxy or whatever and you get removed from the blacklist.
If it's coming through YOUR network, it is YOUR responsibility. You can filter spam/viruses going out of your servers (and you should be doing that).
Raise the monthly rate by $5 and give customers a $5 DISCOUNT if they'll accept "secured" service (read: blocking port 25).
"Hi! Thanks for calling Big-Internet-Service. This month we're having a special of $5 off our monthly bill with "secured service". This service will help make sure your email to your friends gets to them by making sure your machine doesn't end up on a blacklist somewhere. Would you like the $5 discount?"
"What's the alternative?"
"You pay us $5 extra a month and we cut your connection whenever we confirm that you've been spamming."
Suppose you are an ISP with a single T1.
You don't just sell the available bandwidth. You over-sell it. You might sell 2x your bandwith or 3x or 4x or 5x.
You do that because you know that each of your customers will not be using their entire bandwidth all the time.
But spammers use up a lot more bandwidth than the average customer.You don't do that. You show your boss how that idiot is using 10x the average bandwidth but only paying 1x the average fee.
That should be easy to do.There isn't one government. I get a ton of crap from
The key here is money. The people who behave irresponsibly use more bandwidth than the responsible people (yet pay the same monthly fees).
If you want to clean your own house, that's the way to do it.
That's the carrot. The stick is when your entire block is blacklisted because you did NOT deal with the problem that you knew about.
"iBM iz such loosers. i not let them on my Freinds list. ha ha! i tell them to port DB2 and i might think about it. Loosers. Sam will not tell me my poetry sux N E more now. i write what i feel. i want to ask the Q T girl out but i am shy. Maybe i will send her some of my poetry. iBM better port WebSphere 2 or i still keep them off my Freinds list. ha ha! Take that you loosers!"
Sure, we'd still have ambulances and fire trucks and so forth, but you have to look at the situation from the stand point of someone living in it.
For years we've gotten by with horses, ox-carts and so forth. We can do better than that now, without the pollution.
This isn't about you or your death.
This is about leaving the planet in a habitable condition for the next generation.
Or do you also suck on loaded revolvers because "when that time comes
State's Rights are only sacrosanct when you are trying to do something the Federal government does not want.
The same people who cry "State's Rights" to prevent something they do not like from impacting their state will be the first people to push for Federal authority when they're in control and some state doesn't want to follow their rules.
No one ever said that there weren't false positives. The issue was whether they were political.
You don't understand the technology. Suppose you found a new scandal involving Bush and Meitnerium.
That would probably get through their filters. Unless their filters were also trained on the word Meitnerium.
Well, you believe you do.
I thought you understood the technology.
...
...
...
...
...
...
...
So, what you're saying is that a corrupt politician
Would pay a spammer
To use certain words
In a spam flood
Against a specific news organization
So that that specific news organization's filter will learn those key words as spam
And someone with info on a new story involving that politician and those words will have their email eaten by the spam filter
Interesting theory. Of course, no one at CBS would wonder why all of their email to their news shows suddenly stopped mentioning "Bush" (all emails mentioning Bush were eaten).
The US post office. People never send paper letters.
This would only affect CBS. What if the story was sent to MSNBC also? ABC? CNN?
No, not "regardless of how or why".
To be political, it has to be "why".
I understand far better than you do.
... just sending 1,000 spam messages would only bring the likelyhood of it being marked as spam up to 50%.
First off, I understand that email is NOT the only means of communication. Even if someone could block email traffic about Bush / scandal / whatever, they couldn't block the others. Nor could they block the email traffic to other news organizations. Even your extreme example is meaningless.
I understand that CBS news gets TONS of spam and TONS of ham about Bush and scandal.
I understand that it takes a ton MORE messages to alter a Bayesian filter.
If CBS has 1,000 ham emails that had Bush / scandal / whatever
The spammer would have to FLOOD their mail server with those tailored messages. The spammer would have to send 100x the previous TOTAL number of ham messages, at once.
How does the spammer know what that previous total was? Was it
100? Send 10,000?
1,000? Send 100,000?
10,000? Send 1,000,000?
100,000? Send 10,000,000?
All to CBS news. Of course, you'll assume that their servers can handle that load.
All to shutdown one avenue of contact (email) for one phrase (whatever the sc
If there is something that is "bad"...
And you know it is "bad"...
And other people know it is "bad"...
All you have to do is to show that someone on the other side (Democrats/Republicans) also did it or were linked to it.
This isn't about determining whether something is "good" or "bad".
It's all about showing how your team isn't "wrong" because the other team did "bad" things, too.
Which is why you'll never see non-partisan statements such as "we will not sell weapons to non-Democracies"
-or-
"we will fix the problems in our voting system and ensure a verifiable paper trail".
But you will see lots of references to "well, Clinton also did that" or "well, Bush started it".