and outline that this happened precisely because Microsoft does not truly participate in 'white hat cracking' efforts. They finally have some levels of acknowledgment of Bugtraq, but they haven't fully embraced it. (let alone extend or extinguish, but perhaps that's the legal focus yet to come.)
That is to their detriment, and what they have refused to learn from the white-hat community has contributed to this break-in.
That's the story we need to put forward, now!
Haven't even gotten to SUBTLE Win-security holes..
on
Microsoft Cracked
·
· Score: 3
.. because there have been so many blatant ones. How can anyone say that there isn't a Win32 equivalent of buffer overflows, or string format errors? One of those things they did somewhere down the line for performance was to yank some of the API parameter checking.
But so far, crackers haven't had to look for holes or real problems in the code, because *THE PUBLISHED API, ITSELF CAUSES HOLES*. Windows is still back at the "Morris Worm" days of security, if even that far along. How long ago was that?
>About all that would happen that way is a denial-of-service. Default gateway has to be one hop away. A remote attacker can't specify
>his own IP address as your gateway, he has to specify another machine on your network. So he can shut you down remotely, but
>that's about all.
Understood. I was presuming this MITM attack from someone on my cable network. The subnet mask is 255.255.254.0, so I'm potentially sharing it with almost 500 others. Plus a rogue server could come in on a 10. (or other RFC1918) net.
>Security is a process, not a state. The more secure you think you are, the less secure you tend to be. Andy Grove would love this
>field -- 'only the paranoid survive':-)
I keep seeing, "I got a really tight firewall from linux-firewall-tools," show up out there, and that mindset bothers me, for just your reason. So far firewall rules tend to be less Open Source than other software. I suspect part of the reason is because people are scared to expose their protection. But IMHO the good side is that firewall rules should be a process, not a thing that you trust. Recently rc.firewall V5 came out. I'm looking at it not to use, but to tighten my own ruleset.
One of the parameters passed by DHCP is the gateway. If a rogue server passes a bum gateway address, they can route all of your traffic through them, and sniff it all.
Veracity check:
Does DOCSIS prevent this?
On a DOCSIS net, is the gateway essentially a null field, and your head end is always the gateway?
Or can you be spoofed into going through your own head end, and gate through the rogue's system?
I admitted being restrictive in the electro-mechanical aspect. But I was more thinking about being "modified", and trying to press that point. I don't think clothing modifies me in any meaningful way, because it comes off as easily as changing my clothes.
I'm much more willing to grant eyeglasses, hearing aids, and pacemakers to cyborg status. As mentioned, maybe something clothing-like that just isn't as easy to remove as clothing. (I know, corsets, etc.)
I always thought of cyborgs as much more than just donning computerized clothing. I usually think of something more permanent. I also think of the combination electrical AND mechanical, so a simple joint replacement doesn't quite qualify, and I don't think a pacemaker does, either.
By that token, I'd think someone with a cochlear implant and the electronics to run it more of a cyborg than the army guy. The experimental myoelectric or nerve controlled arms for amputees clearly qualify.
Perhaps a powered exoskeleton qualifies, but it's got to be hard to take off. The gizmo Ripley used in Aliens doesn't qualify, either.
Keep in mind that I'm neither affirming nor condemning Brin's writing, merely bring up two salient issues.
I used to be a great welfare-hater. A coworker spoke of taxes as being 'wealth-redistribution', taking upper and middle class money and giving it to the poor. Then came the savings and loan scandal, and I realized that quite probably more of my tax dollars go to people making more than me than to people making less than me. Something of an epiphany, and that's when I began to have more respect for the cleaning people than for a lot of financial wheelers and dealers. At least the cleaning people are working, paying taxes, and not screwing anyone.
The second point is that *the wealthy are getting more out of the country than the poor.* Just about all of us get a stable place to live in, even if we may not own it. But how about the 'inner city battlegrounds' we see on the news. I guess they're better than Chechnya, but perhaps some of them would argue the point. I would argue that the wealthy pay more taxes, but in some sense, they're getting more services for what they pay. And NONE of us should sit here and say, "I did it myself," because none (or virtually none) of us really did. Public schools, playgrounds, safe places to play, a HOME that isn't getting shelled, a highway to drive our car on, a stable environment where a car dealership even feels safe to set up business so he can sell us that car!
I've no problem whatsoever with upward mobility. It is essential that downward mobility be preserved, as well.
Another point of Brin's:
In the novel Earth he presents three culturally-independent criteria for sanity. The third never stuck, but two were really good.
1: Able to be satiated. At some point, one has enough, and quits eating. Same for other facets of life, like collecting wealth or wives.
2: Able to change plans when circumstances change. Adaptability when necessary. (Arguably, aristocracy can be poor at this, and spends more time isolating their comfort zone, and influencing society so they can stay that way.)
From another perspective, a level of cache cuts the bandwidth requirement by about an order of magnitude. (VERY rough approximation, I agree.) In the 386 world, we saw L1 cache beginning at about 25MHz, though there were some uncached 33MHz designs. When we moved to the 486, in addition to the L1 being moved on-chip, the cycles-per-instruction improved, so it worked faster at a given clock speed, and required a better memory system behind it. So round about 66MHz, we saw the L2 cache start becoming normal. This continued with Pentium, though there were a few miserable failures that attempted to do without the L2.
At the same time, main memory is improving. Straight full-RAS-access begat page mode, which begat fast-page mode, which begat EDO, which bagat SDRAM, which begat DDR. But at the same time as main memory moved from 150nS access, 300nS cycle to 40nS access, 70nS cycle, with 7.5nS burst rate, CPUs have moved from 4.77MHz to 1.1 GHz.
I've already heard of an experimental Micron Northbridge chip that incorporates a bunch of fast DRAM-based L3 in otherwise unused area. Northbridge chip sizes are driven by pincount, not circuit area. They are prone to waste silicon just to get enough I/O pins bonded out.
I anticipate the widespread deployment of L3, any month now.
Yes. The lines in the exclusive L2 got there because they were kicked out of L1 by a miss. But there's still a chance that they'll be needed again, soon. That's why they're kept in L2. When a line gets thrashed out of L1, but manages to stay in L2, it can be quickly gotten when L1 needs it, again.
The same is essentially true of a normal, 'inclusive' L2 cache.
The reason an exclusive L2 *now* makes sense is that they're both on the same chip! That's the fundamental difference, because now it's cheap in terms of silicon and circuitry to do the bookkeeping between L1 and L2. This lets you avoid storing a second copy of the data in L1.
I was listening last night, and at least part of the problems were that they had to redirect dataflows because of the Ku antenna mishap.
Almost as annoying as not being able to watch the Z1 truss go up is that most feeds appear to be Windows mediaplayer. You have to dig for Real, and of course there's NOTHING non-proprietary at all.
I have a pretty decent job. There are ups and downs, but overall I can't complain. Of course I'd like more money, etc, wouldn't we all? But essentially I get to play in silicon fantasy land, and get paid for it.
As for making a mark on the world, maybe my patents aren't much, but my father made it so I could do at least that much, and it's better than he was able to do. I hope to pass better opportunities on to my kids.
Besides, kids are something of a dream, the most open-ended potential most of us get to participate in. Most dreams are rather mundane, anyway.
What if your parents had decided to follow their dreams instead of having you?
I am a father of two, and take that job very seriously. My day job lets me provide for them, and give them a start in the world. It also allowed my wife to stay home with them when they were young, and still allows her to be in an employment situation where she's home when they come home from school.
On the work side, it's great to see one of my (memory) chip designs actually working in a computer. Of course there are other competing chips, but this was one I worked on.
While patents are a questionable thing in many respects, my employer expects them of me. In another perspective, they are a piece of posterity. It's even better when you see one of your patents get referenced. That's when you know your work went on, at least a little.
It certainly appears that AMD is poised to overtake Intel in the PC arena. IMHO, Intel is coasting on their reputation, fab capacity, and product line breadth, at the moment. They are not the CPU performance or value leaders. The introduction of Mustang and Athlon SMP around the end of this year will chip at Intel's last stronghold.
But will it matter?
We speak of the post-PC era. I don't expect to see the PC go away. I'd rather expect it to look more like the end of the mainframe era of a decade or two ago. The mainframes didn't go away, they even kept growing their market. But the wild growth was in the PCs.
Now in the post-PC era, expect to see the PC market growing, just not wildly. Knowing exactly what will be the wild growth area is what will make some people VERY rich.
But Intel's product breadth, particularly ownership of the StrongARM, is going to help them more than AMD's CPU leadership will. IMHO, AMD may well have won a Pyhrric (sp?) victory. The big question will be how they are poised to play in the post-PC era.
While it is usually desirable to make precise copies, at times imprecise copies have their advantages. This patent focuses on making imprecise copies by combining design information from two templates, each of which are assumed to have been copied by prior application of this same process.
This process is enabled by having each item carry redundant design information for each aspect. On each aspect of construction, an arbitrary function of the two copies of design information may be used, ranging from exclusive use of one copy to complete merging of both copies. The imprecise copy is made by using one copy of each design aspect from each template, and merging all of these design materials for the new copy.
In practice, one template will form the host for the new copy, and the other template will contribute design information. Since the construction of the new copy may be a lengthy process, both templates are optimally required for the duration.
In a preferred embodiment, at least the beginning of this process is pleasurable to both templates. Also in a preferred embodiment the continued association of templates is considered beneficial to all parties involved. In the most preferred embodiment, the copy eventually assumes independent function, and ultimately continues the process, providing the first templates with yet another copy to fuss over, and hand back when it messes itself.
This came up months ago on the kernel list - simply the weekly summary, even.
Journalling requires changes in the VFS. Rather patch the VFS many times for each member of the 'buffet' of journalling filesystems becoming available, Linus said he'd prefer to find the common elements, and make VFS "journalling-ready".
The individual journalling filesystems would have to work with the new VFS to make sure it was suitably changed, and to make sure their code would work with it.
This sounds like the correct approach to me, even if it does delay things a bet. Better than letting ad-hoc adaptations creep into the kernel.
There's that quote, "Those who don't understand Unix are doomed to reinvent it, poorly."
Well, what the @#$% are we doing continually trying to reinvent Windows? Are we doomed to do it, poorly?
As a former OS/2 user, I'll say that the WPS was the only GUI that has EVER significantly reduced my dependence on a command line. Nothing else has even come close. But you might take a look at DFM (http://dfm.online.de/dfm.html) or the ROX desktop. (Search for ROX Filer on freshmeat.)
b) No artist is REQUIRED to deal with the RIAA. They can't force you...
For that matter, nobody is REQUIRED to buy pasteurized, homogenized milk. But just try to buy any other kind. You can't.
Yes, an artist can try and distribute music on a minor label, or by him/her self. But by that path the artist is also guaranteed to remain small-time. If you want ANY chance at wide distribution or airplay, you MUST sign with an RIAA member.
There's even less choice than trying to buy a PC without Windows.
edged out, and made noncompetitive by the court decision and royalty agreement. Meanwhile, the industry-backed ventures go ahead without that little boat anchor.
So the new guy on the block, who found the path and showed the way, gets the shaft. The establishment who fought it every step of the way follows the formula and gets the money.
On the side, a little note in Courtney Love's diatribe seemed to indicate that artists don't get any royalties from "clubs". She stated that she feared that artists would get no royalties from the Napster suits, because the industry would consider Napster a "club". Is this true? By participating in a "CD-club" are we depriving the artists of income, and sending ALL of the money to the poor, starving recording houses?
I practically cut my teeth on Heathkits. I kind of miss the 'good old days' of electronics you could really build from scratch - not that I'd ever leave VLSI behind.
I have no MP3 collection, but this is almost reason to start one.
Cloaking seems to be a great idea, but it falls on a few counts. First off, you really shouldn't block all ICMP messages. You really do need some of them for efficient operaion. I don't know if the ones that need to be open can be used in a ping-like fashion, but I wouldn't put it past someone to figure out a way.
Second, you really need at least some opening for IDENT, or else you'll get terrible throughput on your email. You can filter based on the source IP, but that can be spoofed. (Of course the responses then go to the mailrelay...) Some web sites seem to generate IDENT requests, but I'm not sure what they do if you DENY them.
This is even before we get to scans with illegal packets. I'm under the impression that there are some scans that will get responses from some firewalls even if a port is "stealthed".
In general, it just might be better to look "boringly visible" and offer no services, just closed ports. Nothing to offer, nothing to hide. At the same time, it would be useful to get the kernel patch that lets you change your TCP fingerprint - make your box look like OS/2, for instance.
The situation will change when Kernel 2.4 gets out with netfilters. Stateful filtering will make it possible to DENY more effectively if you want to fly with "stealth", and the general architecture should make it easier to look boring, including changing the TCP fingerprint. (Netfilter or ipchains will allow you to offer ports to some IPs while hiding from others, netfilters will just let you do a better job of it.)
In the past week it came out that HTML bugs can be inserted into Word documents that can phone home when the document is read into Word, and there is no user interaction of notification involved.
To be perfectly fair, I have to add two things:
First, it's a basic capability, so it's done by the originator of the document, not necessarily MS.
Second, the same 'feature' is in one of the other Big Word Processors, StarOffice, I believe.
On a quick perusal I can't find the story, I'll have to look through some of my saved stuff at home.
One doesn't even need to assign evil to all of this. MS simply has a rather cavalier toward security, and for a company of their size, that supplies software to some of the customers they supply to, that's dangerous. Also in the past week, there's a problem in the IP stack of Win9X that they have no intention of fixing, because it's too "troublesome".
Slashdot Mirror
and outline that this happened precisely because Microsoft does not truly participate in 'white hat cracking' efforts. They finally have some levels of acknowledgment of Bugtraq, but they haven't fully embraced it. (let alone extend or extinguish, but perhaps that's the legal focus yet to come.)
That is to their detriment, and what they have refused to learn from the white-hat community has contributed to this break-in.
That's the story we need to put forward, now!
.. because there have been so many blatant ones. How can anyone say that there isn't a Win32 equivalent of buffer overflows, or string format errors? One of those things they did somewhere down the line for performance was to yank some of the API parameter checking.
But so far, crackers haven't had to look for holes or real problems in the code, because *THE PUBLISHED API, ITSELF CAUSES HOLES*. Windows is still back at the "Morris Worm" days of security, if even that far along. How long ago was that?
Show the wife, parents, S.O., boss this article!
See here! My computing power is hopelessly inadequate. I NEEEEED faster hardware!
They even agree on Slashdot!
>About all that would happen that way is a denial-of-service. Default gateway has to be one hop away. A remote attacker can't specify
:-)
>his own IP address as your gateway, he has to specify another machine on your network. So he can shut you down remotely, but
>that's about all.
Understood. I was presuming this MITM attack from someone on my cable network. The subnet mask is 255.255.254.0, so I'm potentially sharing it with almost 500 others. Plus a rogue server could come in on a 10. (or other RFC1918) net.
>Security is a process, not a state. The more secure you think you are, the less secure you tend to be. Andy Grove would love this
>field -- 'only the paranoid survive'
I keep seeing, "I got a really tight firewall from linux-firewall-tools," show up out there, and that mindset bothers me, for just your reason. So far firewall rules tend to be less Open Source than other software. I suspect part of the reason is because people are scared to expose their protection. But IMHO the good side is that firewall rules should be a process, not a thing that you trust. Recently rc.firewall V5 came out. I'm looking at it not to use, but to tighten my own ruleset.
One of the parameters passed by DHCP is the gateway. If a rogue server passes a bum gateway address, they can route all of your traffic through them, and sniff it all.
Veracity check:
Does DOCSIS prevent this?
On a DOCSIS net, is the gateway essentially a null field, and your head end is always the gateway?
Or can you be spoofed into going through your own head end, and gate through the rogue's system?
I admitted being restrictive in the electro-mechanical aspect. But I was more thinking about being "modified", and trying to press that point. I don't think clothing modifies me in any meaningful way, because it comes off as easily as changing my clothes.
I'm much more willing to grant eyeglasses, hearing aids, and pacemakers to cyborg status. As mentioned, maybe something clothing-like that just isn't as easy to remove as clothing. (I know, corsets, etc.)
I always thought of cyborgs as much more than just donning computerized clothing. I usually think of something more permanent. I also think of the combination electrical AND mechanical, so a simple joint replacement doesn't quite qualify, and I don't think a pacemaker does, either.
By that token, I'd think someone with a cochlear implant and the electronics to run it more of a cyborg than the army guy. The experimental myoelectric or nerve controlled arms for amputees clearly qualify.
Perhaps a powered exoskeleton qualifies, but it's got to be hard to take off. The gizmo Ripley used in Aliens doesn't qualify, either.
Keep in mind that I'm neither affirming nor condemning Brin's writing, merely bring up two salient issues.
I used to be a great welfare-hater. A coworker spoke of taxes as being 'wealth-redistribution', taking upper and middle class money and giving it to the poor. Then came the savings and loan scandal, and I realized that quite probably more of my tax dollars go to people making more than me than to people making less than me. Something of an epiphany, and that's when I began to have more respect for the cleaning people than for a lot of financial wheelers and dealers. At least the cleaning people are working, paying taxes, and not screwing anyone.
The second point is that *the wealthy are getting more out of the country than the poor.* Just about all of us get a stable place to live in, even if we may not own it. But how about the 'inner city battlegrounds' we see on the news. I guess they're better than Chechnya, but perhaps some of them would argue the point. I would argue that the wealthy pay more taxes, but in some sense, they're getting more services for what they pay. And NONE of us should sit here and say, "I did it myself," because none (or virtually none) of us really did. Public schools, playgrounds, safe places to play, a HOME that isn't getting shelled, a highway to drive our car on, a stable environment where a car dealership even feels safe to set up business so he can sell us that car!
I've no problem whatsoever with upward mobility. It is essential that downward mobility be preserved, as well.
Another point of Brin's:
In the novel Earth he presents three culturally-independent criteria for sanity. The third never stuck, but two were really good.
1: Able to be satiated. At some point, one has enough, and quits eating. Same for other facets of life, like collecting wealth or wives.
2: Able to change plans when circumstances change. Adaptability when necessary. (Arguably, aristocracy can be poor at this, and spends more time isolating their comfort zone, and influencing society so they can stay that way.)
From another perspective, a level of cache cuts the bandwidth requirement by about an order of magnitude. (VERY rough approximation, I agree.) In the 386 world, we saw L1 cache beginning at about 25MHz, though there were some uncached 33MHz designs. When we moved to the 486, in addition to the L1 being moved on-chip, the cycles-per-instruction improved, so it worked faster at a given clock speed, and required a better memory system behind it. So round about 66MHz, we saw the L2 cache start becoming normal. This continued with Pentium, though there were a few miserable failures that attempted to do without the L2.
At the same time, main memory is improving. Straight full-RAS-access begat page mode, which begat fast-page mode, which begat EDO, which bagat SDRAM, which begat DDR. But at the same time as main memory moved from 150nS access, 300nS cycle to 40nS access, 70nS cycle, with 7.5nS burst rate, CPUs have moved from 4.77MHz to 1.1 GHz.
I've already heard of an experimental Micron Northbridge chip that incorporates a bunch of fast DRAM-based L3 in otherwise unused area. Northbridge chip sizes are driven by pincount, not circuit area. They are prone to waste silicon just to get enough I/O pins bonded out.
I anticipate the widespread deployment of L3, any month now.
> Am I missing something??
Yes. The lines in the exclusive L2 got there because they were kicked out of L1 by a miss. But there's still a chance that they'll be needed again, soon. That's why they're kept in L2. When a line gets thrashed out of L1, but manages to stay in L2, it can be quickly gotten when L1 needs it, again.
The same is essentially true of a normal, 'inclusive' L2 cache.
The reason an exclusive L2 *now* makes sense is that they're both on the same chip! That's the fundamental difference, because now it's cheap in terms of silicon and circuitry to do the bookkeeping between L1 and L2. This lets you avoid storing a second copy of the data in L1.
Bless you!
I was listening last night, and at least part of the problems were that they had to redirect dataflows because of the Ku antenna mishap.
Almost as annoying as not being able to watch the Z1 truss go up is that most feeds appear to be Windows mediaplayer. You have to dig for Real, and of course there's NOTHING non-proprietary at all.
I have a pretty decent job. There are ups and downs, but overall I can't complain. Of course I'd like more money, etc, wouldn't we all? But essentially I get to play in silicon fantasy land, and get paid for it.
As for making a mark on the world, maybe my patents aren't much, but my father made it so I could do at least that much, and it's better than he was able to do. I hope to pass better opportunities on to my kids.
Besides, kids are something of a dream, the most open-ended potential most of us get to participate in. Most dreams are rather mundane, anyway.
What if your parents had decided to follow their dreams instead of having you?
I am a father of two, and take that job very seriously. My day job lets me provide for them, and give them a start in the world. It also allowed my wife to stay home with them when they were young, and still allows her to be in an employment situation where she's home when they come home from school.
On the work side, it's great to see one of my (memory) chip designs actually working in a computer. Of course there are other competing chips, but this was one I worked on.
While patents are a questionable thing in many respects, my employer expects them of me. In another perspective, they are a piece of posterity. It's even better when you see one of your patents get referenced. That's when you know your work went on, at least a little.
It was a parody on dumbentia, but this Microsoft page really LOOKS like it!
http://www.dumbentia.com/pdflib/scared.pdf
It certainly appears that AMD is poised to overtake Intel in the PC arena. IMHO, Intel is coasting on their reputation, fab capacity, and product line breadth, at the moment. They are not the CPU performance or value leaders. The introduction of Mustang and Athlon SMP around the end of this year will chip at Intel's last stronghold.
But will it matter?
We speak of the post-PC era. I don't expect to see the PC go away. I'd rather expect it to look more like the end of the mainframe era of a decade or two ago. The mainframes didn't go away, they even kept growing their market. But the wild growth was in the PCs.
Now in the post-PC era, expect to see the PC market growing, just not wildly. Knowing exactly what will be the wild growth area is what will make some people VERY rich.
But Intel's product breadth, particularly ownership of the StrongARM, is going to help them more than AMD's CPU leadership will. IMHO, AMD may well have won a Pyhrric (sp?) victory. The big question will be how they are poised to play in the post-PC era.
While it is usually desirable to make precise copies, at times imprecise copies have their advantages. This patent focuses on making imprecise copies by combining design information from two templates, each of which are assumed to have been copied by prior application of this same process.
This process is enabled by having each item carry redundant design information for each aspect. On each aspect of construction, an arbitrary function of the two copies of design information may be used, ranging from exclusive use of one copy to complete merging of both copies. The imprecise copy is made by using one copy of each design aspect from each template, and merging all of these design materials for the new copy.
In practice, one template will form the host for the new copy, and the other template will contribute design information. Since the construction of the new copy may be a lengthy process, both templates are optimally required for the duration.
In a preferred embodiment, at least the beginning of this process is pleasurable to both templates. Also in a preferred embodiment the continued association of templates is considered beneficial to all parties involved. In the most preferred embodiment, the copy eventually assumes independent function, and ultimately continues the process, providing the first templates with yet another copy to fuss over, and hand back when it messes itself.
Bingo!
This came up months ago on the kernel list - simply the weekly summary, even.
Journalling requires changes in the VFS. Rather patch the VFS many times for each member of the 'buffet' of journalling filesystems becoming available, Linus said he'd prefer to find the common elements, and make VFS "journalling-ready".
The individual journalling filesystems would have to work with the new VFS to make sure it was suitably changed, and to make sure their code would work with it.
This sounds like the correct approach to me, even if it does delay things a bet. Better than letting ad-hoc adaptations creep into the kernel.
Annoys the living daylights out of me, too.
There's that quote, "Those who don't understand Unix are doomed to reinvent it, poorly."
Well, what the @#$% are we doing continually trying to reinvent Windows? Are we doomed to do it, poorly?
As a former OS/2 user, I'll say that the WPS was the only GUI that has EVER significantly reduced my dependence on a command line. Nothing else has even come close. But you might take a look at DFM (http://dfm.online.de/dfm.html) or the ROX desktop. (Search for ROX Filer on freshmeat.)
It's just that simple. It appears that Microsoft construes the defeat of fast-track to be a victory, and an endorsement of their business techniques.
Look for more of this type of conduct.
b) No artist is REQUIRED to deal with the RIAA. They can't force you...
For that matter, nobody is REQUIRED to buy pasteurized, homogenized milk. But just try to buy any other kind. You can't.
Yes, an artist can try and distribute music on a minor label, or by him/her self. But by that path the artist is also guaranteed to remain small-time. If you want ANY chance at wide distribution or airplay, you MUST sign with an RIAA member.
There's even less choice than trying to buy a PC without Windows.
edged out, and made noncompetitive by the court decision and royalty agreement. Meanwhile, the industry-backed ventures go ahead without that little boat anchor.
So the new guy on the block, who found the path and showed the way, gets the shaft. The establishment who fought it every step of the way follows the formula and gets the money.
On the side, a little note in Courtney Love's diatribe seemed to indicate that artists don't get any royalties from "clubs". She stated that she feared that artists would get no royalties from the Napster suits, because the industry would consider Napster a "club". Is this true? By participating in a "CD-club" are we depriving the artists of income, and sending ALL of the money to the poor, starving recording houses?
I practically cut my teeth on Heathkits. I kind of miss the 'good old days' of electronics you could really build from scratch - not that I'd ever leave VLSI behind.
I have no MP3 collection, but this is almost reason to start one.
Cloaking seems to be a great idea, but it falls on a few counts. First off, you really shouldn't block all ICMP messages. You really do need some of them for efficient operaion. I don't know if the ones that need to be open can be used in a ping-like fashion, but I wouldn't put it past someone to figure out a way.
Second, you really need at least some opening for IDENT, or else you'll get terrible throughput on your email. You can filter based on the source IP, but that can be spoofed. (Of course the responses then go to the mailrelay...) Some web sites seem to generate IDENT requests, but I'm not sure what they do if you DENY them.
This is even before we get to scans with illegal packets. I'm under the impression that there are some scans that will get responses from some firewalls even if a port is "stealthed".
In general, it just might be better to look "boringly visible" and offer no services, just closed ports. Nothing to offer, nothing to hide. At the same time, it would be useful to get the kernel patch that lets you change your TCP fingerprint - make your box look like OS/2, for instance.
The situation will change when Kernel 2.4 gets out with netfilters. Stateful filtering will make it possible to DENY more effectively if you want to fly with "stealth", and the general architecture should make it easier to look boring, including changing the TCP fingerprint. (Netfilter or ipchains will allow you to offer ports to some IPs while hiding from others, netfilters will just let you do a better job of it.)
In the past week it came out that HTML bugs can be inserted into Word documents that can phone home when the document is read into Word, and there is no user interaction of notification involved.
To be perfectly fair, I have to add two things:
First, it's a basic capability, so it's done by the originator of the document, not necessarily MS.
Second, the same 'feature' is in one of the other Big Word Processors, StarOffice, I believe.
On a quick perusal I can't find the story, I'll have to look through some of my saved stuff at home.
One doesn't even need to assign evil to all of this. MS simply has a rather cavalier toward security, and for a company of their size, that supplies software to some of the customers they supply to, that's dangerous. Also in the past week, there's a problem in the IP stack of Win9X that they have no intention of fixing, because it's too "troublesome".