Sure, DOS has had scripting and pipes from day one (well, unless you tried MSDOS 1.0). Were they as useful as their Linux counterparts? No freakin' way.
Why does TYPE not take stdin? Why is "copy con" equivalent to "copy con:"? (And, why is "copy con.txt" ambiguous?)
How can a batch file determine if a directory exists? Hint:
if exists c:\foo\con yields different results in different DOS versions
DOS for the longest time failed the basic tests. And for the longest time, I was working with the MKS toolkit, replacing the ones that didn't quite do what I wanted them to do with copies ported from comp.sources. But it never became UNIX.
NT is still rife with inconsistencies in the CMD shell, and I don't know (nor care to know) if or when they get partially fixed.
The point is: if you want to use Windows, use Windows tools. Learn how to use VB Script to its effect. Learn MSVC if you must. Prentending that it's another UNIX if you squint right will hurt you. Windows is not designed to be UNIX.
Every time I use Windows on the premise that an OS is an OS and a command shell is a command shell I get hurt. I should have learned that lesson from VMS years before.
Does anyone knows if the Posix subsystem still exists in Windows XP? That was the worst checkmark compatibility I ever saw. You could run Posix code on NT, to allow NT to be purchased by the federal government. And unless you wanted to do actual work with it, the compatibility was fine.
It is completely beyond me why people are porting Apache to Windows. NT comes with a perfectly functional web server, why bother replacing it? Don't get me wrong, I hate IIS with a vengeance, but the loopholes in the underlying operating system (like the $::DATA bug) will have to be special cased in Apache too. And the $DEITY like privilege issues that plague the IIS indexing server will plague Apache just as well.
Possibly even worse, because code ported from UNIX will have to be modified to suit NT's security model, a redesign from scratch really is the only appropriate way to deal with such huge gaps in design philosophy.
Re:I want a version of this...
on
e-Denounce
·
· Score: 2
Just forward the offending missive to: uce@ftc.gov . Works for me.
I used to report spam to the ISP it came from. It appears many of the employ a guy called Dave Null, who seems to be very apt at filing all of them. As it turns out, the FTC employs the very same person as well.
Just look at their web page. Out of a gazillion reports, they prosecuted, what, a couple of dozen of folks that would have gotten caught if they distributed fliers in mall car parks instead.
Frankly, I've got the feeling they nailed most of them because of fliers left on FTC staff cars in the FTC car park.
Can you say "spin doctoring?" I knew you could!
on
e-Denounce
·
· Score: 3, Insightful
Or an IT manager in a company may want to make sure his employer isn't inadvertently doing something illegal.
Yeah right. An IT manager who is not sure of that should look for another job. And if he doesn't have the balls (or whatever the PC equivalent for female managers is) to do that, chances are s/he won't rat on his/her employer either.
So it is rather safe to read this sentence as "Or a disgruntled IT manager who has an axe to grind with his employer".
We got ratted on a couple of years ago, had to burn several man months to prove our case, and we got a thank you note in the end because we had way too many licenses. No compensation for being fraudulently accused of theft, obviously. It hasn't crossed the minds of the lyncing mob that having, say, 1000 PC's, only 300 of them were licensed to run version X of a certain excuse for an OS, could mean that we would be legal if 700 of them ran an outdated but perfectly paid-up OS. Hmmm, running wasn't the word actually, we had a stockpile of 486's that we couldn't get rid of because they were technical write-offs, but financially on the books.
Even when you encrypt your traffic, it will not protect you from traffic analysis.
I happen to be the dude in between management and the users on my site. I refuse to eavesdrop on my users. Not all of my users realize it, but we've got a pretty liberal policy (don't break the law, don't be offensive to others, don't use excessive bandwidth during business hours; that basically sums it up).
Some of my users know me for cracking down on porn or MP3 downloads, and think I'm reading their every keystroke. Because if I wasn't, then how would I know that they were doing stuff that they weren't supposed to do?
The reality is, when I get complaints about Internet performance, I run some quick scripts on the logs to find out who is hogging the system. If, after eliminating the obvious business use connections, I'm left with a top ten and number two is downloading a gazillion of.xls spreadsheets from an server in Poland and all the URL's have/..%20%20/ in the path, I give that user a call.
Usually, the user will accept the lecture that his contractual obligation to stick to the corporate guidelines is not optional. I sometimes learn through the grapevine that such a user thinks I'm a fascist. So be it. If other people can't work because of egregious abuse, I have to intervene.
Do I even look at the stuff they're downloading? Not if I can avoid it. The only times I look at what they're downloading is when they start yanking my chain, giving me the go around that there is no law against downloading Warez or porn. Maybe there isn't, I've got no clue. I do know what's in their contracts though.
Most of these issues are dealt with amically. People sometimes don't realize how big their impact on the corporate network is, and even if they do I usually let them get away with it if the abuse stops. They're usually pretty happy when I tell them I've got no clue what they were downloading, but could find out when forced to.
Over the last year, IM became a bit of an issue because of the way their stupid tools communicated (if only they used persistent connections they'd fly right under the radar). At some stage, 30% of our proxies capacity was used to serve a few dozen IM sessions and it really started to hurt web performance.
It's always funny when they let it escalate to management level, and I can at that stage let them rant about the invasion of their presumed privacy, and then drop the bombshell that I didn't even look at what they were downloading, and that it was trivial traffic analysis that gave them away, and that the reason they were in that meeting was because they incriminated themselves.
Metric vs Imperial is a hard problem, or so it appears to be. Switching between them is always bolted on to a software product as the very last thing, and hard coded defaults have a tendency to rear their ugly heads at the worst moment (especially if you prefer to use the en_US locale for menus and dialogs, but require metric sizes).
I have long believed that every developer should spend time fielding support calls, just to make 'm feel the pain they inflict on their customers.
It just occurred to me that developers should also be encouraged to switch between localization preferences from time to time. Heck, alternating their printers between A4 and Letter sized paper every week would either take a significant bite out of user frustration, or save acres of trees.
You need foam, not water, to effectively put out burning jet fuel.
There's a difference between putting the fire out, and keeping it from damaging the structure. I'm not aware of any solution that would bring a sprinker-like foam system to office buildings.
However, a flow of water droplets is major deterrant against both flash-over and heat damage. In the wake of the Piper Alpha disaster (an off-shore oil rig that burned out of control), British Gas did some life-sized experiments with sprinkler and found that starting the sprinkler as early as possible slows down the fire, as well as cooling it (which prevents flash-over).
Classic sprinklers just dump a lot of water. Modern sprinklers saturate the air with tiny water droplets. The modern ones are very effective.
In the wake of september eleven, I hope that sprinkler will get the attention it deserves. And that includes trying to figure out how to get enough water from smaller tanks on each floor, rather than from huge tanks with vulnerable pipes.
I'm not a fire safety engineer, so take my opinions with a grain of salt, but all footage I've seen of fire control with modern sprinkler at least convinced me.
Hmmm... The moon bouncer I once met was bragging about the output power he had sent up. When confronted with the issue of getting enough input power to the transmitter without blowing his home's fuses he suddenly became a bit quiet.
I still think he powered his transmitter from the unfused lamp post in front of his house (in other words, straight from the city grid), even though he won't admit to it:-)
Oh. don't get me wrong, I'm not complaining. It worked out for the better in the end (I'm still stunned the developers pulled it off:-)
On that Pentium 75, the performance of Mozilla is a bit worse than IE's. That is largely offset by not having to deal with IE's braindead implementation of the privacy features I'm using (hello Microsoft; I do not need to be reminded that "Scripts are usually safe" every time, I took the trouble to set that feature to "prompt" so I want to know what the heck the script is attempting to do). And of course, big chunks of IE being hidden in the OS also gives it the edge in a low-memory configuration (by booting Windows, you already paid the memory footprint price of IE).
Mozilla is getting more feature-complete every release (for the longest time, I used 0.9.7 and was very irritated by it's incomplete Page Info). I've yet to re-evaluate 0.9.9 for e-mail use; 0.9.7 had relatively minor differences with Netscrape 4.7, but the way I use it it's a show stopper for me (NS;s hierarchical menus for filing stuff quicky are essential to me). I've since found that running NS for mail and Moz for browing has a big advantage; my NS is configured not to have web access so all those spammed web bugs are rendered ineffective.
MsGeek put it pretty much the way it is. My company uses Exchange, and I hate it with a vengeance, but it does the job and I'd hate to be tinkering with user administration all day. Meanwhile, I'm doing the Postfix border e-mail gateways, as a minor aside to my job.
The thing that gets on my nerves in this eternal Microsoft spin doctoring is the implicit denial of the simple fact that trained monkeys will not be able to run an all-Microsoft shop, and any company above mom-and-pop size will need to hire Really Good Geeks to get the work done. Learning Windows properly is at least as hard as learning Unix properly (screw user friendliness, a decent sized Windows shop needs folks who know what to tweak in the registry and what not to).
There is no amount of Microsoft support that will compensate for having experienced staff. Whatever OS you pick, there is no substitute for having employees who know their stuff. And that's the bottom line.
I'm blessed with a bunch of colleagues who know NT inside and out. They trust me to keep the border e-mail flowing, and I trust them to keep the users off my back. I don't want their jobs, not even if it could be moved to UNIX.
Now, back to the topic of this/. article, the big danger is that managers believe NT is the easy solution. It is not. At one stage, my company needed an NT sysadmin for a remote location. Something like 20 people applied, most of the MCSE's, one a former taxi driver. We hired the taxi driver. He was the only one who, when confronted with a broken machine, asked the right questions and got the problem solved. If the MCSE's had their hearts in this business, they'd have gotten the MCSE because they had the experience and wanted to get proof of it. The ones we encountered in the job market approached it the other way around, had no innate interest in the field but believed getting certified would compensate for that.
In another few years, our guy will be as theoretically underpinned as the MCSE's are, but in the mean time, he's running the shop, and will move up or move on to another company where he can apply his talents and his experience. Those are the people you need, and they're hard to come by, and harder still to retain if they outgrow the position they were hired for.
I'm actually amazed that the developers have gotten that development framework to the state it is in right now. When the switch from native Win32/Motif to XUL was made, I had sinking feelings over whether the whole thing wasn't going to collapse under it's own weight, and until 0.9.7, experience surely didn't contradict that gut feeling.
As a browser user, I don't want a frigging development environment. I couldn't care less about skins and other window dressing. I want the pages I wish to view to render, that's about it.
My acid test is my Win95 machine at work. It's a Pentium 75 with 64MB of RAM and a slow disk (and the only reason I still have it is that I want to be able to see how my own code behaves, if it works there it'll work anywhere). Starting with 0.9.7, it has become bearable. That's one heck of a job by the Mozilla team.
The killer feature for me is the granularity with which you can set your preferences. "The site AdsTillYoureBlueInTheFace.com wants to load an image. Do you wish to allow this?" I've thought about hacking the thing up to even store JavaScript preferences per site. Push never came to shove though.
Sorry, should've mentioned more context on the adslreports site. It's a forum where users (and occasionally, a vendor employee) exchange ideas, ripe and green.
The brilliant polarization idea came from the users, not Linksys, but I've seen it so often that the myth is all over the place.
The plugin API is cast in concrete. Plugins for Netscape 6 ought to drop in to Mozilla just fine.
I'm happy that Mozilla doesn't come with all the plugin crap that's part of Netscape 6 and IE.
I browse with paranoid settings, and I'm constantly amazed by the amount of crap that sails right through IE's settings. That bit is done much better by Mozilla (still far from perfect though). But plugins like Flash still give away your whole machine to the nasties.
On more than one occasion, I've seen.swf animations called from spams and trying to call back home to mention that my e-mail address was alive and kicking and begging for more spam. God thing the firewall caught it.
I've been out of the Mozilla developer scene for some time, but as one of the perpetrators of making the thing work on BSD/OS I can say that changing compilers can be quite painful. 99.99% of the code will just compile fine, but debugging those few lines of code that get miscompiled is a daunting task.
There is also a (very small) piece of code in Mozilla that needs to know the exact memory layout of the C++ vtables. Took me a week to come up with a four line diff to make it work on my platform.
If it was as easy as
CC=ccc./configure
make someone would've done it by now. Performance has always been of prime concern (and fear:-) of the developers.
Not that 100 watts at 2.4Ghz is easy to come by...
You might be surprised... Years ago, I was browsing a surplus store in my town and was absolutely amazed by the amount of radar gear that was just sitting there. I was even more surprised that the stuff was selling.
The guy got the equipment from both the army and the national airport. No clue which frequency the stuff works on, but it's at least in the right ballpark (and yes, buyers were informed that they should clear the area of people before hooking it up:-)
I'd hate to think of this. The author mentions reprogramming the off-the-shelf device to use another frequency range (that of Australia -- go figure). It's not the people that know what they're doing that I'm worried about, it's the radio equivalent of script kiddies... Chances are that your microwave oven will produce more interference than a 1 Watt transmitter in the city center, provided that the range is suitably offset, but I know some people that would put a transmitter capable of roasting passing pigeons behind their standard 802.11 device.
I just loved the bit where the author mentions that you just have to use a different polarity then "everyone else". Go over the adslreports and you'll find that Linksys users are recommended to put their antennae at a 90 degree angle w.r.t. each other. Now just which polarity is not being used in your area?
It'll only be a matter of time before people start jamming 802.11 just for the heck of it.
NetSoil simply helped themselves to my credit card... Without an invoice or anything, they took $35 bucks. Wrote to them, and sure, they were willing to help me out. Just fax them the invoice.
Followup e-mail went unanswered (and at the time they still held my domain hostage, so I couldn't just get it back from the credit card company either).
I'm glad I've seen the last of them. And even moving was like pulling teeth. Their e-mail system ate the transfer request (delivered according to my mail logs), and after a week they had the guts to send me a thank-you not for not tranferring the domain. Needless to say, followup e-mail to the assistance mailbox mentioned in the thank-you note went unanswered. A second try succeeded mere days before they would've been able to block the transfer for non-payment of the renewal.
That 1,400 number may not be surprising to anyone who's been on the net for a while, but you also got to look at the balancing act that kept it that low so far.
Of the spam you receive, chances are that about a third is from spam outfits that spam from their own IP space, and about two thirds is real sleazy stuff sent through compromised servers around the world. Little if any is from companies you want (or need) to do business with.
Those two are not my main concern. The first category can (and eventually will) be blocked by IP address, and the second category will be battled in leaps and bounds by new block list initiatives.
Why is the first category being blocked? Simple: as ISPs get complaints from their customers, an increasing number is going to block them on their customers behalf, with no loss other than the spam messages.
The big thing that most people tend to forget is that the Real Big Firms have not really started spamming you, because of concerns over customer acceptance. If those concerns were to get less, then the real spam barrage starts.
Ever complained to your bank about the leaflets they insist on inserting in your monthly statements? If you expand this to the brave new world of cyberspace, it means you will not have much of a chance to stop the flood without losing your bank statements.
Fear is the only thing that keeps the thing from exploding beyond the current upward slope, and *that*'s why keeping up the pressure is so important.
Look at what happens if a company is near failure these days. In total desperation, an increasing number of them turns to spamming (hint: Google for Enron's involvement in spam).
I think it was Alan Ralsky who bragged about that figure per spam run. I remember reading an interview with one of the more persistent spammers who reported a 1-to-100,000 sell rate, but at 10,000,000 spams that's still a hundred sells.
If you google around, you'll find some web sites where anti-spammers (called "anti"s in spammer jargon) post their insight into the spammers world and psyches. One of the best is the venerable Behind Enemy Lines -- Premier Services Exposed" website.
Lots of info on how they communicate, harvest AOL accounts (that's now dated info, they have devised other techniques for their spam runs), and share the loot. A Must Read!
For documentation on organized spamming, there are two repositories with the dull date: SPEWS and spamhaus.
Spam is reaching the epidemic proportion that I now with increasing frequency receive the same spam on the same address several times, spaced a week apart...
I will rail against all of them as a class, based on my experiences with the bad ones. I feel justified calling them ALL vigilantes, because the term fits precisely. "One who takes or advocates the taking of law enforcement into one's own hands."
Hmm. So the ISP's and not the block lists are the worst test designers? Interesting.
Dunno about the others, but ORDB at least only tests upon request, usually as the result of someone investigating a spam. But even if others were to test random swaths of netspace, it still doesn't merit the word "vigilante". I'm not sure of the dictionary definition of vigilante, but in common speach it is used most often in the context not of fact gathering, but in the context of handing out punishment.
The alternative of delegating the task of testing a server for being an open relay to a service such as ORDB is to not test and just block the suspected IP space. This is, in fact, what a lot of Internet sites now do in response to spam from China and Korea.
Oh, I almost forgot, of course there's the alternative of delegating it to the government of your choice. Do the math on that solution:-)
There are some of these groups that we've never had problems with because their testing methods are better.
Could you name man and horse, please? I think the volunteers who set up the block lists deserve better than to be called vigilantes, especially if you then proceed to mention that there are some that are less evil than others.
And likewise, which block lists publish the address of hosts that drop probes on the floor silently? I'd like to know what block lists to avoid or only use for tagging.
For the longest time, I ran an outdated release of Postfix that would silently eat some of the probes, but I never wound up on any block list (and I know I was tested by a bunch of them because Postfix would forward the failed probe to me).
At least, the playing field should be level
on
Patent Nonsense
·
· Score: 3, Interesting
I'm not a big fan of the patent system and particularly its gradual expansion into the realm of software engineering, but my biggest concern is that the playing field isn't level.
If someone files a patent that in my mind is obvious, I'd have to challenge it in court, and even if I were to win, it would cost me significant money.
I wouldn't mind the European Patent directives as much if I could file a complaint for a reasonable fee, say EUR 100, refundable if the patent is revoked as a result of the re-examination. That would pretty much level the playing field.
I have written a piece of software that I can't publish because of a frivolous patent. On my reading of the patent, it doesn't apply to my case, but the patent owner will offer no guidance as to the applicability (but for US$25000 they'll allow my in-house usage of the patent, and they don't care if the patent applies in the first place). So, I'm stuck with two options: getting a patent lawyer to look at the case to find out if it applies (that would set me back at least EUR 1500), or not doing it. I opted for the latter.
While I'm at it, bumping the price offenders pay for new patent applications would be cool too. If they employ their own patent lawyers their incremental costs for filing frivolous patents are pretty low, and if those lawyers get bonuses per patent passed the temptation to skimp on their homework becomes pretty big.
You're pretty lucky to have managers that will stand up for the good stuff. Where I work, I've been pretty lucky with management that's supportive of anything stuff that gets the work done.
That said, it's a continuous battle to make sure that the right questions get asked if people do things outside of the standards. Standards have the nice property of being understood as far as understanding goes. Questions to ask include "What's our exposure if things go wrong?", even more important than asking "what can go wrong?". Too many companies get sucked into complacency precisely because standards are followed, and the risks are lost from sight.
I've been in several corporate battles where my insight contradicted departmental wisdom. Most have come out right, with proper measures being put in place to plug obvious issues. But on the other hand, there have been several incidents where departmental management has allowed completely unsecured servers to make a quick buck.
The trick is to get management across the board realize that managed risk is sometimes unavoidable, but that hiding solutions from the folks that could help securing it (which is the usual reaction when corporate policies mandate certain solutions to the exclusion of other technologies) doesn't work in the long run.
Too many corporations fall for a control model that eliminates local initiative, and the practical upshot is that security expertise that is available is not being used.
Actually, one in 250 would be a spammers dream. One in 100,000 is more realistic.
A pathetically low percentage of spam winds up in actual peoples mailboxes, most of it is undeliverable (mailboxes that I discontinued in 1995 are still on the spammers "Verified! All Fresh! 10 Million addresses" CD-ROMs).
Then, of course, even if a sufficiently gullible person is reached by the spam, that person has to feel a need for the product or service. TV Shopping Channels are surprisingly effective, but not effective enough to turn every person watching it into a buyer. Spam is no different in that respect.
Hrrrmmmp. The idea to stoop down to M$'s level and create software that only runs on Unix is dangerous and self defeating.
We've been their with web servers. A Unix based web server would beat an M$ based web server hands down. Guess what? M$ found it was an important market, and invested serious money into speeding up IIS, to the point where the "it runs better on Unix" argument broke down.
Now don't get me wrong. I still think IIS sucks eggs, because of the opacity of the thing (do you know what your webserver is doing?), and its propensity for doing things the Microsoft Way. But I think it's dangerous to focus on "Linux only" server solutions.
It's keeping the playing field level that counts. One thing that would help in new protocol development is to create mandatory compliance testing. Java's model, in this sense, is one I like, except I think it is a bit too lopsided in Suns favor.
Being able to enforce standards compliance will provide the disincentive for an "embrace and extend" approach (and, if successful, will get M$ in "extinguish" mode -- the best thing M$ has done for open software lately has been their all-out attack on Linux and the GPL: ask any CIO in private about this war on Linux).
Slashdot Mirror
Use the right tool for the right platform.
Sure, DOS has had scripting and pipes from day one (well, unless you tried MSDOS 1.0). Were they as useful as their Linux counterparts? No freakin' way.
Why does TYPE not take stdin? Why is "copy con" equivalent to "copy con:"? (And, why is "copy con.txt" ambiguous?)
How can a batch file determine if a directory exists? Hint:
if exists c:\foo\con
yields different results in different DOS versions
DOS for the longest time failed the basic tests. And for the longest time, I was working with the MKS toolkit, replacing the ones that didn't quite do what I wanted them to do with copies ported from comp.sources. But it never became UNIX.
NT is still rife with inconsistencies in the CMD shell, and I don't know (nor care to know) if or when they get partially fixed.
The point is: if you want to use Windows, use Windows tools. Learn how to use VB Script to its effect. Learn MSVC if you must. Prentending that it's another UNIX if you squint right will hurt you. Windows is not designed to be UNIX.
Every time I use Windows on the premise that an OS is an OS and a command shell is a command shell I get hurt. I should have learned that lesson from VMS years before.
Does anyone knows if the Posix subsystem still exists in Windows XP? That was the worst checkmark compatibility I ever saw. You could run Posix code on NT, to allow NT to be purchased by the federal government. And unless you wanted to do actual work with it, the compatibility was fine.
It is completely beyond me why people are porting Apache to Windows. NT comes with a perfectly functional web server, why bother replacing it? Don't get me wrong, I hate IIS with a vengeance, but the loopholes in the underlying operating system (like the $::DATA bug) will have to be special cased in Apache too. And the $DEITY like privilege issues that plague the IIS indexing server will plague Apache just as well.
Possibly even worse, because code ported from UNIX will have to be modified to suit NT's security model, a redesign from scratch really is the only appropriate way to deal with such huge gaps in design philosophy.
Just forward the offending missive to: uce@ftc.gov . Works for me.
I used to report spam to the ISP it came from. It appears many of the employ a guy called Dave Null, who seems to be very apt at filing all of them. As it turns out, the FTC employs the very same person as well.
Just look at their web page. Out of a gazillion reports, they prosecuted, what, a couple of dozen of folks that would have gotten caught if they distributed fliers in mall car parks instead.
Frankly, I've got the feeling they nailed most of them because of fliers left on FTC staff cars in the FTC car park.
Or an IT manager in a company may want to make sure his employer isn't inadvertently doing something illegal.
Yeah right. An IT manager who is not sure of that should look for another job. And if he doesn't have the balls (or whatever the PC equivalent for female managers is) to do that, chances are s/he won't rat on his/her employer either.
So it is rather safe to read this sentence as "Or a disgruntled IT manager who has an axe to grind with his employer".
We got ratted on a couple of years ago, had to burn several man months to prove our case, and we got a thank you note in the end because we had way too many licenses. No compensation for being fraudulently accused of theft, obviously. It hasn't crossed the minds of the lyncing mob that having, say, 1000 PC's, only 300 of them were licensed to run version X of a certain excuse for an OS, could mean that we would be legal if 700 of them ran an outdated but perfectly paid-up OS. Hmmm, running wasn't the word actually, we had a stockpile of 486's that we couldn't get rid of because they were technical write-offs, but financially on the books.
Even when you encrypt your traffic, it will not protect you from traffic analysis.
.xls spreadsheets from an server in Poland and all the URL's have /..%20%20/ in the path, I give that user a call.
I happen to be the dude in between management and the users on my site. I refuse to eavesdrop on my users. Not all of my users realize it, but we've got a pretty liberal policy (don't break the law, don't be offensive to others, don't use excessive bandwidth during business hours; that basically sums it up).
Some of my users know me for cracking down on porn or MP3 downloads, and think I'm reading their every keystroke. Because if I wasn't, then how would I know that they were doing stuff that they weren't supposed to do?
The reality is, when I get complaints about Internet performance, I run some quick scripts on the logs to find out who is hogging the system. If, after eliminating the obvious business use connections, I'm left with a top ten and number two is downloading a gazillion of
Usually, the user will accept the lecture that his contractual obligation to stick to the corporate guidelines is not optional. I sometimes learn through the grapevine that such a user thinks I'm a fascist. So be it. If other people can't work because of egregious abuse, I have to intervene.
Do I even look at the stuff they're downloading? Not if I can avoid it. The only times I look at what they're downloading is when they start yanking my chain, giving me the go around that there is no law against downloading Warez or porn. Maybe there isn't, I've got no clue. I do know what's in their contracts though.
Most of these issues are dealt with amically. People sometimes don't realize how big their impact on the corporate network is, and even if they do I usually let them get away with it if the abuse stops. They're usually pretty happy when I tell them I've got no clue what they were downloading, but could find out when forced to.
Over the last year, IM became a bit of an issue because of the way their stupid tools communicated (if only they used persistent connections they'd fly right under the radar). At some stage, 30% of our proxies capacity was used to serve a few dozen IM sessions and it really started to hurt web performance.
It's always funny when they let it escalate to management level, and I can at that stage let them rant about the invasion of their presumed privacy, and then drop the bombshell that I didn't even look at what they were downloading, and that it was trivial traffic analysis that gave them away, and that the reason they were in that meeting was because they incriminated themselves.
Metric vs Imperial is a hard problem, or so it appears to be. Switching between them is always bolted on to a software product as the very last thing, and hard coded defaults have a tendency to rear their ugly heads at the worst moment (especially if you prefer to use the en_US locale for menus and dialogs, but require metric sizes).
I have long believed that every developer should spend time fielding support calls, just to make 'm feel the pain they inflict on their customers.
It just occurred to me that developers should also be encouraged to switch between localization preferences from time to time. Heck, alternating their printers between A4 and Letter sized paper every week would either take a significant bite out of user frustration, or save acres of trees.
Just a thought.
You need foam, not water, to effectively put out burning jet fuel.
There's a difference between putting the fire out, and keeping it from damaging the structure. I'm not aware of any solution that would bring a sprinker-like foam system to office buildings.
However, a flow of water droplets is major deterrant against both flash-over and heat damage. In the wake of the Piper Alpha disaster (an off-shore oil rig that burned out of control), British Gas did some life-sized experiments with sprinkler and found that starting the sprinkler as early as possible slows down the fire, as well as cooling it (which prevents flash-over).
Classic sprinklers just dump a lot of water. Modern sprinklers saturate the air with tiny water droplets. The modern ones are very effective.
In the wake of september eleven, I hope that sprinkler will get the attention it deserves. And that includes trying to figure out how to get enough water from smaller tanks on each floor, rather than from huge tanks with vulnerable pipes.
I'm not a fire safety engineer, so take my opinions with a grain of salt, but all footage I've seen of fire control with modern sprinkler at least convinced me.
Hmmm... The moon bouncer I once met was bragging about the output power he had sent up. When confronted with the issue of getting enough input power to the transmitter without blowing his home's fuses he suddenly became a bit quiet.
:-)
I still think he powered his transmitter from the unfused lamp post in front of his house (in other words, straight from the city grid), even though he won't admit to it
Oh. don't get me wrong, I'm not complaining. It worked out for the better in the end (I'm still stunned the developers pulled it off :-)
On that Pentium 75, the performance of Mozilla is a bit worse than IE's. That is largely offset by not having to deal with IE's braindead implementation of the privacy features I'm using (hello Microsoft; I do not need to be reminded that "Scripts are usually safe" every time, I took the trouble to set that feature to "prompt" so I want to know what the heck the script is attempting to do). And of course, big chunks of IE being hidden in the OS also gives it the edge in a low-memory configuration (by booting Windows, you already paid the memory footprint price of IE).
Mozilla is getting more feature-complete every release (for the longest time, I used 0.9.7 and was very irritated by it's incomplete Page Info). I've yet to re-evaluate 0.9.9 for e-mail use; 0.9.7 had relatively minor differences with Netscrape 4.7, but the way I use it it's a show stopper for me (NS;s hierarchical menus for filing stuff quicky are essential to me). I've since found that running NS for mail and Moz for browing has a big advantage; my NS is configured not to have web access so all those spammed web bugs are rendered ineffective.
MsGeek put it pretty much the way it is. My company uses Exchange, and I hate it with a vengeance, but it does the job and I'd hate to be tinkering with user administration all day. Meanwhile, I'm doing the Postfix border e-mail gateways, as a minor aside to my job.
/. article, the big danger is that managers believe NT is the easy solution. It is not. At one stage, my company needed an NT sysadmin for a remote location. Something like 20 people applied, most of the MCSE's, one a former taxi driver. We hired the taxi driver. He was the only one who, when confronted with a broken machine, asked the right questions and got the problem solved. If the MCSE's had their hearts in this business, they'd have gotten the MCSE because they had the experience and wanted to get proof of it. The ones we encountered in the job market approached it the other way around, had no innate interest in the field but believed getting certified would compensate for that.
The thing that gets on my nerves in this eternal Microsoft spin doctoring is the implicit denial of the simple fact that trained monkeys will not be able to run an all-Microsoft shop, and any company above mom-and-pop size will need to hire Really Good Geeks to get the work done. Learning Windows properly is at least as hard as learning Unix properly (screw user friendliness, a decent sized Windows shop needs folks who know what to tweak in the registry and what not to).
There is no amount of Microsoft support that will compensate for having experienced staff. Whatever OS you pick, there is no substitute for having employees who know their stuff. And that's the bottom line.
I'm blessed with a bunch of colleagues who know NT inside and out. They trust me to keep the border e-mail flowing, and I trust them to keep the users off my back. I don't want their jobs, not even if it could be moved to UNIX.
Now, back to the topic of this
In another few years, our guy will be as theoretically underpinned as the MCSE's are, but in the mean time, he's running the shop, and will move up or move on to another company where he can apply his talents and his experience. Those are the people you need, and they're hard to come by, and harder still to retain if they outgrow the position they were hired for.
Mozilla is a development framework.
I'm actually amazed that the developers have gotten that development framework to the state it is in right now. When the switch from native Win32/Motif to XUL was made, I had sinking feelings over whether the whole thing wasn't going to collapse under it's own weight, and until 0.9.7, experience surely didn't contradict that gut feeling.
As a browser user, I don't want a frigging development environment. I couldn't care less about skins and other window dressing. I want the pages I wish to view to render, that's about it.
My acid test is my Win95 machine at work. It's a Pentium 75 with 64MB of RAM and a slow disk (and the only reason I still have it is that I want to be able to see how my own code behaves, if it works there it'll work anywhere). Starting with 0.9.7, it has become bearable. That's one heck of a job by the Mozilla team.
The killer feature for me is the granularity with which you can set your preferences. "The site AdsTillYoureBlueInTheFace.com wants to load an image. Do you wish to allow this?" I've thought about hacking the thing up to even store JavaScript preferences per site. Push never came to shove though.
Why linksys would recommend this is beyond me
Sorry, should've mentioned more context on the adslreports site. It's a forum where users (and occasionally, a vendor employee) exchange ideas, ripe and green.
The brilliant polarization idea came from the users, not Linksys, but I've seen it so often that the myth is all over the place.
The plugin API is cast in concrete. Plugins for Netscape 6 ought to drop in to Mozilla just fine.
.swf animations called from spams and trying to call back home to mention that my e-mail address was alive and kicking and begging for more spam. God thing the firewall caught it.
I'm happy that Mozilla doesn't come with all the plugin crap that's part of Netscape 6 and IE.
I browse with paranoid settings, and I'm constantly amazed by the amount of crap that sails right through IE's settings. That bit is done much better by Mozilla (still far from perfect though). But plugins like Flash still give away your whole machine to the nasties.
On more than one occasion, I've seen
I've been out of the Mozilla developer scene for some time, but as one of the perpetrators of making the thing work on BSD/OS I can say that changing compilers can be quite painful. 99.99% of the code will just compile fine, but debugging those few lines of code that get miscompiled is a daunting task.
./configure :-) of the developers.
There is also a (very small) piece of code in Mozilla that needs to know the exact memory layout of the C++ vtables. Took me a week to come up with a four line diff to make it work on my platform.
If it was as easy as
CC=ccc
make
someone would've done it by now. Performance has always been of prime concern (and fear
Not that 100 watts at 2.4Ghz is easy to come by...
:-)
You might be surprised... Years ago, I was browsing a surplus store in my town and was absolutely amazed by the amount of radar gear that was just sitting there. I was even more surprised that the stuff was selling.
The guy got the equipment from both the army and the national airport. No clue which frequency the stuff works on, but it's at least in the right ballpark (and yes, buyers were informed that they should clear the area of people before hooking it up
I'd hate to think of this. The author mentions reprogramming the off-the-shelf device to use another frequency range (that of Australia -- go figure). It's not the people that know what they're doing that I'm worried about, it's the radio equivalent of script kiddies... Chances are that your microwave oven will produce more interference than a 1 Watt transmitter in the city center, provided that the range is suitably offset, but I know some people that would put a transmitter capable of roasting passing pigeons behind their standard 802.11 device.
I just loved the bit where the author mentions that you just have to use a different polarity then "everyone else". Go over the adslreports and you'll find that Linksys users are recommended to put their antennae at a 90 degree angle w.r.t. each other. Now just which polarity is not being used in your area?
It'll only be a matter of time before people start jamming 802.11 just for the heck of it.
NetSoil simply helped themselves to my credit card... Without an invoice or anything, they took $35 bucks. Wrote to them, and sure, they were willing to help me out. Just fax them the invoice.
Followup e-mail went unanswered (and at the time they still held my domain hostage, so I couldn't just get it back from the credit card company either).
I'm glad I've seen the last of them. And even moving was like pulling teeth. Their e-mail system ate the transfer request (delivered according to my mail logs), and after a week they had the guts to send me a thank-you not for not tranferring the domain. Needless to say, followup e-mail to the assistance mailbox mentioned in the thank-you note went unanswered. A second try succeeded mere days before they would've been able to block the transfer for non-payment of the renewal.
That 1,400 number may not be surprising to anyone who's been on the net for a while, but you also got to look at the balancing act that kept it that low so far.
Of the spam you receive, chances are that about a third is from spam outfits that spam from their own IP space, and about two thirds is real sleazy stuff sent through compromised servers around the world. Little if any is from companies you want (or need) to do business with.
Those two are not my main concern. The first category can (and eventually will) be blocked by IP address, and the second category will be battled in leaps and bounds by new block list initiatives.
Why is the first category being blocked? Simple: as ISPs get complaints from their customers, an increasing number is going to block them on their customers behalf, with no loss other than the spam messages.
The big thing that most people tend to forget is that the Real Big Firms have not really started spamming you, because of concerns over customer acceptance. If those concerns were to get less, then the real spam barrage starts.
Ever complained to your bank about the leaflets they insist on inserting in your monthly statements? If you expand this to the brave new world of cyberspace, it means you will not have much of a chance to stop the flood without losing your bank statements.
Fear is the only thing that keeps the thing from exploding beyond the current upward slope, and *that*'s why keeping up the pressure is so important.
Look at what happens if a company is near failure these days. In total desperation, an increasing number of them turns to spamming (hint: Google for Enron's involvement in spam).
I think it was Alan Ralsky who bragged about that figure per spam run. I remember reading an interview with one of the more persistent spammers who reported a 1-to-100,000 sell rate, but at 10,000,000 spams that's still a hundred sells.
If you google around, you'll find some web sites where anti-spammers (called "anti"s in spammer jargon) post their insight into the spammers world and psyches. One of the best is the venerable Behind Enemy Lines -- Premier Services Exposed" website.
Lots of info on how they communicate, harvest AOL accounts (that's now dated info, they have devised other techniques for their spam runs), and share the loot. A Must Read!
For documentation on organized spamming, there are two repositories with the dull date: SPEWS and spamhaus.
Spam is reaching the epidemic proportion that I now with increasing frequency receive the same spam on the same address several times, spaced a week apart...
I will rail against all of them as a class, based on my experiences with the bad ones. I feel justified calling them ALL vigilantes, because the term fits precisely. "One who takes or advocates the taking of law enforcement into one's own hands."
:-)
Hmm. So the ISP's and not the block lists are the worst test designers? Interesting.
Dunno about the others, but ORDB at least only tests upon request, usually as the result of someone investigating a spam. But even if others were to test random swaths of netspace, it still doesn't merit the word "vigilante". I'm not sure of the dictionary definition of vigilante, but in common speach it is used most often in the context not of fact gathering, but in the context of handing out punishment.
The alternative of delegating the task of testing a server for being an open relay to a service such as ORDB is to not test and just block the suspected IP space. This is, in fact, what a lot of Internet sites now do in response to spam from China and Korea.
Oh, I almost forgot, of course there's the alternative of delegating it to the government of your choice. Do the math on that solution
There are some of these groups that we've never had problems with because their testing methods are better.
Could you name man and horse, please? I think the volunteers who set up the block lists deserve better than to be called vigilantes, especially if you then proceed to mention that there are some that are less evil than others.
And likewise, which block lists publish the address of hosts that drop probes on the floor silently? I'd like to know what block lists to avoid or only use for tagging.
For the longest time, I ran an outdated release of Postfix that would silently eat some of the probes, but I never wound up on any block list (and I know I was tested by a bunch of them because Postfix would forward the failed probe to me).
I'm not a big fan of the patent system and particularly its gradual expansion into the realm of software engineering, but my biggest concern is that the playing field isn't level.
If someone files a patent that in my mind is obvious, I'd have to challenge it in court, and even if I were to win, it would cost me significant money.
I wouldn't mind the European Patent directives as much if I could file a complaint for a reasonable fee, say EUR 100, refundable if the patent is revoked as a result of the re-examination. That would pretty much level the playing field.
I have written a piece of software that I can't publish because of a frivolous patent. On my reading of the patent, it doesn't apply to my case, but the patent owner will offer no guidance as to the applicability (but for US$25000 they'll allow my in-house usage of the patent, and they don't care if the patent applies in the first place). So, I'm stuck with two options: getting a patent lawyer to look at the case to find out if it applies (that would set me back at least EUR 1500), or not doing it. I opted for the latter.
While I'm at it, bumping the price offenders pay for new patent applications would be cool too. If they employ their own patent lawyers their incremental costs for filing frivolous patents are pretty low, and if those lawyers get bonuses per patent passed the temptation to skimp on their homework becomes pretty big.
You're pretty lucky to have managers that will stand up for the good stuff. Where I work, I've been pretty lucky with management that's supportive of anything stuff that gets the work done.
That said, it's a continuous battle to make sure that the right questions get asked if people do things outside of the standards. Standards have the nice property of being understood as far as understanding goes. Questions to ask include "What's our exposure if things go wrong?", even more important than asking "what can go wrong?". Too many companies get sucked into complacency precisely because standards are followed, and the risks are lost from sight.
I've been in several corporate battles where my insight contradicted departmental wisdom. Most have come out right, with proper measures being put in place to plug obvious issues. But on the other hand, there have been several incidents where departmental management has allowed completely unsecured servers to make a quick buck.
The trick is to get management across the board realize that managed risk is sometimes unavoidable, but that hiding solutions from the folks that could help securing it (which is the usual reaction when corporate policies mandate certain solutions to the exclusion of other technologies) doesn't work in the long run.
Too many corporations fall for a control model that eliminates local initiative, and the practical upshot is that security expertise that is available is not being used.
A pathetically low percentage of spam winds up in actual peoples mailboxes, most of it is undeliverable (mailboxes that I discontinued in 1995 are still on the spammers "Verified! All Fresh! 10 Million addresses" CD-ROMs).
Then, of course, even if a sufficiently gullible person is reached by the spam, that person has to feel a need for the product or service. TV Shopping Channels are surprisingly effective, but not effective enough to turn every person watching it into a buyer. Spam is no different in that respect.
We've been their with web servers. A Unix based web server would beat an M$ based web server hands down. Guess what? M$ found it was an important market, and invested serious money into speeding up IIS, to the point where the "it runs better on Unix" argument broke down.
Now don't get me wrong. I still think IIS sucks eggs, because of the opacity of the thing (do you know what your webserver is doing?), and its propensity for doing things the Microsoft Way. But I think it's dangerous to focus on "Linux only" server solutions.
It's keeping the playing field level that counts. One thing that would help in new protocol development is to create mandatory compliance testing. Java's model, in this sense, is one I like, except I think it is a bit too lopsided in Suns favor.
Being able to enforce standards compliance will provide the disincentive for an "embrace and extend" approach (and, if successful, will get M$ in "extinguish" mode -- the best thing M$ has done for open software lately has been their all-out attack on Linux and the GPL: ask any CIO in private about this war on Linux).
It's totally beyond me why Smit Tak registered the latter. It doesn't make sense in Dutch, it doesn't make sense in English.