Slashdot Mirror


User: Deus+Ex+Machina

Deus+Ex+Machina's activity in the archive.

Stories
0
Comments
45
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 45

  1. So what is the solution? on Korean Mozilla Binaries Infected · · Score: 2, Interesting

    Really, I look at a situation like this and, rather than lament about the sorry state of the software involved, I really just want to know how to make it not happen. With UNIX systems, this shouldn't be an impossibility - right off the bat many people have said "don't be root to install",which does stop one point of failure in the process, but it doesn't solve the problem of _running_ the application as root.

    Some solutions come to mind for things that you should be doing anyway (firewall traffic on ports not being officially served by a system; make /bin binaries immutable), but these only make it so that the actions taken by the virus fail (relatively) silently. No big klaxons going off to tell the admin that a program is misbehaving as root.

    Is there any sort of system-wide watchdog that can be put in place to monitor programs and catch actions that are outside the scope of its auspice? I think chroot can be used in a manner somewhat consistent with this idea, but not without resulting in some serious systemwide design complexity if you want to do it right. Any other thoughts?

    And might this be an arguement for a Security Levels sort of system whereby things like "remove the immutable flag from /bin/bash" is made impossible without a reboot even for root, a la BSD?

  2. Re:Firewire vs Ethernet on Serial ATA and AGP 8X motherboards · · Score: 1

    Heh, actually a company called Cinonic Systems sells Fibre Channel Tester Cards (which can be chained and made into a loose array) that use STP Cat-5 as their transmission medium. It looks pretty cool, though I still consider it a tad ballsy to network your harddrives... *thinks to himself*

    eagle:~$ ping /dev/da0
    PING /dev/da0 (192.168.3.4) from 127.0.0.1 : 56(84) bytes of data.

    ...

    --- /dev/da0 ping statistics ---
    6 packets transmitted, 0 packets received, 100% packet loss

    *shiver*
    I sincerely recommend this product and/or service...

  3. Re:Yu Yu? on New Anime Block Starts Tonight Cartoon Network · · Score: 1

    Hmm...

    *visualizes kids seeing Evangelion, possibly missing all the side and back references that give the show its 'reputation', and going to see/get the movie when it comes out in the states...*

    *visualizes kids after seeing the End of Eva movie, proceeding in a mass exodus toward therapists and screaming every time they hear the song "Jesus Bleibet Meine Freude"...*

    Not that I wouldn't want to see this one on TV as well, but either the editing would be extreme, or Anime would suddenly come under the gun of the Religious Right (which is so very Wrong).

  4. The mythical idiot-proof distro/OS on HP-LX 1.0 Secure Linux · · Score: 2, Interesting

    Call me on this if I am wrong here, but is the major factor in spending $3000 on this gem of software is chroot jails (or a reasonable facimile)? The article was rather brief, but from the look of it, aside from that feature - which the article even admits is not new - we have one other feature, that it is "secure by default". Well, does it keep you from installing Telnet ever? What about the Berkeley R-tools? The SSH root admin thing looks clever at first, but how many places have you worked at where the same root password was used across multiple boxen - even those of different OSs? Now, how much do you want to bet that the password over the SSH key is going to be the same, or similar, to the password for root itself in most installations? How is this any different than simply having a second login prompt for root?

    Look, I'm sure someone else has said this already a million times here, and I know Bruce Schneier makes it his mantra, but I'll repeat it for those of us who came late: Most of security has nothing to do with software, and everything to do with poor procedure. All the chroot jails in the world cannot restrain the sheer magnitude of people's apathy toward secure practice and process.

    And yes, sometimes even the best security is broken. Let's face it, if you want your data secure, you are already outnumbered millions to one. Yet, this is a default condition - the majority of security vulnerabilites are relative to the actions of script kiddies, who use network flooding and other lame attacks to force people off the net and crash systems. Adding another security layer will make it harder to brute-force your way in, certainly, but what's the point of sealing the door with concrete if lazy administration practice leaves the windows wide open?

    And, how does this differ from OpenBSD? I'm not a BSD zealot, but way too much of this sounds like the exact practice taken toward OpenBSD development. Does this software deserve extra creds because it costs more? Are people more likely to take security seriously if they spend $3000 on an operating system than if they get it for free? How much of this code is audited? All the default packages? Did they audit anything, or did they just implement chroot jails and assume they have found a "workaround" for a malignent problem in UNIX security?

    I'm not saying that this is a bad idea. I'm sure this distro will provide for a more secure environment by default, for those of us who don't have the time to audit our production boxes. But I just don't see reason to presume that this distro is any more secure than a properly configured SELinux or OpenBSD box. And please, if you think I'm wrong, enlighten me, because I'm no expert. I just think that building a better mouse trap is pointless when the trap operators don't know how to operate it.

  5. Re:Initial Designs on Intel Wakes Up To DDR-SDRAM · · Score: 1

    The long and short of it is that RAMBUS - the company - created a type of memory which was legally provable to be different from the known standard, and then they tried to claim that they had a patent on SDRAM as well. The chip itself is a perfect example of "Market-engineering"... it was marketed as being much faster and more powerful than SDRAM or DDR, but in real-life conditions it was almost laughably slow and even unstable - overheating being one of its worst problems. As a result, it is frankly the honest-to-god truth that RAMBUS just wanted to usurp the memory market with an inferior product. Don't take my word for it though - go read the articles about RAMBUS at Tom's Hardware and see it for yourself. The numbers there don't lie, at least in my experience. Intel stuck with RAMBUS because they stood to gain a strong ally in the hardware market, but RAMBUS buggered it all up by being greedy...

  6. Here we go... on VA Linux Dropping "Linux" From Name · · Score: 2, Interesting

    In a relativistic sense, this could be bad for Slashdot - the website. However, if CmdrTaco and the others who run this site really love doing it, I can't imagine them not figuring out another way to support this, or some other site with a similar purpose. You have to remember that it is the people who made this site in the first place, and the thousands of people who come here every day, that make this site what it is.

    I don't mean to sound "peppy" or anything, but let's be realistic, rather than freaking out because a company ruled by suits (which all companies are) makes a decision that sheds a negative light upon the marketability of Slashdot, or of Linux. Yeah, the suits probably never understood Linux - they don't teach OS design and the fundamentals of software engineering at schools of management (unless it is a really odd school). And frankly, if their hearts aren't in it (yeah, sappy again), then why the hell should we want their help, and why should we bitch when they jump ship? I come to Slashdot every day, and post very rarely. I would be very sad to see it go, but if this site dies because VA {ARGV0} no longer supports it, it isn't entirely the fault of VA - this site existed well before VA was a glint in the eye of someone, and will exist long after if we keep our heads. And for God's sake, don't worry about how this will affect Linux's development or acceptance. Clued individuals who need the power of Linux already use Linux, and they aren't going to suddenly use Windows (which they can't work with for whatever reason) because Linux suddenly doesn't have much (or any) presence on Wall Street.

  7. Re:Where AIX kicks butt (and others need to catch on IBM Wants Linux · · Score: 1

    Just a note on the analogy... it is in fact a quote, and you have a very screwed up version of it. I won't post the real quote, and I'll explain why in a moment, but if you want to find it, google for it and you'll find it rather quickly. The reason I won't post the actual quote here (and the reason why I'm replying at all) is because the original quote is by a Monk from alt.sysadmin.recovery, and the FAQ for that group specifically prohibts reproduction or usage of anything said in there that isn't authorized by the author. They are a right bunch of Bastards, so I'd beware of incoming ballistic missiles and other such LARTs ;-) . And for the record, the real quote gives a suggested "negative" depiction of AIX... yours is likely a paraphrasing of the original to show AIX in a better light, and that will be the rub, as it were.

  8. Handicap distress... on Review of a 3D LCD · · Score: 4

    I realize that my concern may be unnecessary (I haven't tried these out, of course) but I do find it rather distressing to think that this sort of 3D display might be the wave of the future. My concern about this comes from the fact that I am blind in one eye, and do not perceive 3D the way that other people do - things like the red and blue glasses or other visual tricks of that sort do not work for me, they only give me a massive headache. Inversely, there have been other 3D techniques which did work for me, and so I am not without hope - but I do hold a small bit of fear for the day that I find I cannot use a normal computer monitor because they have evolved beyond my ability to perceive them correctly. Does anyone have greater knowledge about this sort of perception, who might have some advice or ideas concerning my predicament? I'd appreciate it.

  9. Re:Need to speak... on Evangelion Movies Coming This Fall · · Score: 1

    Yeah, I know that Kircher doesn't "own" the Tree of Life. However, that particular varient of the Tree is attributed to Kircher's design. Specifically, that tree is almost like a set of notes on the subject of the Tree of Life. If you want a real Tree, just draw one - I doubt that the Tree as intended by the Kabbalists had all the intricisies of the Kircher varient. ;)

  10. Need to speak... on Evangelion Movies Coming This Fall · · Score: 1

    I don't normally contribute to Slashdot, but I felt it worth noting that the sheer number of religious/mystical undertones in Evangelion is enough to put anyone who studies mysticism into veritible seizure. Also, it is worth noting that during the course of creating the series, the director went into a nervous breakdown, and I believe that progression into (temporary) madness does show as the series goes on. Anyway, I personally found the series facinating, both for the amazing story, and for the concepts that were presented "on the side" so to speak. I just wonder though... when someone sees the image of Kircher's Tree of Life in the opening sequence, what do they think it is - presuming that they haven't ever seen it before? I don't think that image is exactly well-known, at least here in the States.

  11. Re:Apple hatred on Themes.org Returning · · Score: 1

    Eh, well the concept comes from the fact that Apple told Themes.org to remove a couple of themes which they claim to have encroached upon their trademark in the past. The manner in which they have pursued their trademark has at times bordered (but not broken) the "ruthless" level. However, I do agree that it is more than a bit of a knee-jerk reaction to believe that Apple would charge these guys in some legal manner which resulted in a seizure of hardware. I keep getting images of an insane Steve Jobs rushing in, punching people out and smashing computers with a crowbar *snicker*.

  12. Re:What's all the fuss ? on But You Can Download It For Free, Right? · · Score: 1

    Well, licensing is a big issue with a lot of people - look at the BSD vs. GPL wars and the like. This issue is worth a story IMHO because it is something that really hasn't been done before with a linux distro and may cause something of a trend to occur (worst case scenerio).

    Frankly the whole thing really doesn't matter to me since I use stock Debian, and really this probably won't matter to most people - just the vocal minority of Slashdot.

    As for any comments about Libranet having the "best" linux distro, well... I've never tried it, but I haven't read anyone's message about how "good" it is either, so I don't know what that's all about, but I doubt it is of any real note. :)

  13. First Rant. on Cantametrix Plans To Track All MP3s On The Web · · Score: 1

    Okay, this idea has basically broken the bounds of good sense in my mind here. At this point, it has become clear to me that the RIAA and the whole music industry who are against the transmission of copyrighted work over the Internet are totally without a clue. Think I'm being overly harsh, judgemental and trollish? Well, look at what's gone on through jaded eyes shall we? First they see that people are getting copyrighted music for free on the Net, and rightfully see it as being dangerous to their capital, so they threaten to sue everyone and actually sue the biggest offenders. Then they realize that they were basically the LAST ones to show up at the party per say, since everyone and their cat now downloads MP3s (unless you simply don't, which of course is possible, but everyone I know does, and everyone they know does too). So then they start a guilt/FUD campaign (ads like that "Artists against music piracy" or whathever it is) and in the meantime decide that they have to compete in the "digital arena" rather than in court, so they develop SDMI. Right off, we know that SDMI is a joke, no one will use it when they can have just as good for free, but let's humor them. They develop SDMI, thereby trying to trump MP3 in terms of technological brilliance, and in the process stick a bandaid on a gushing headwound. So now it's time to REWORK OUR STRATEGY FOLKS!! Yup, when lawsuits and technology don't work, let's combine the two so that we can fight MP3s all over the net and censor search engines! That'll keep human nature from manifesting!

    Okay, I'm sorry about the vehemnance, but this whole issue has gotten very ridiculous. The RIAA/Music Industry couldn't have gone about this in a worse way if they had gone to the Supreme Court and asked for a law to make it a capital offense to distribute copyrighted material, punishable by death. I'm not going to lie and say that getting copyrighted material for free is not stealing, but the RIAA has screwed this whole issue up so badly, that it has become a laughingstock and an object of ridicule. If they had acted in a manner befitting of supply and demand in a consumer-friendly fashon, MP3s would never have caught on so well, and they might have been prepared for online digital music ahead of time. But this is it, in my mind. Pack up your suitcases and lawyers boys, you've lost. You took out your guns, pointed them at your respective heads and fired, and you deserved every bit of it. The Music Industry as a whole will survive, in some form or another, without you. And stay the hell away from my search engines and my Internet, because you don't know how to play our game.

  14. Re:NES? Why? on NESs 15th Anniversary · · Score: 1

    Exactly what kind of more sophisticated games came out for home computers in the mid-80's? Mind you, I'm talking back then... all I can think of is Ultima - but in terms of playability and addictive nature, the NES would win hands-down on all counts. Unless you like text-based adventures, which means you were probably a very boring child. (last quip was tongue-in-cheek, don't hit me!)

  15. Debian user in support of RedHat! on An Open Letter From Bob Young · · Score: 5

    Well, there is a lot here to digest, both in terms of what Mr. Young wrote, and in terms of the larger debate about RedHat. Personally though, I feel that there is, in fact, a lot of paranoia in the Open Source Community - and rightly so, for we effectively LOST our community back in the early 80's. So here we are, in fear of RedHat becoming another Microsoft, or at the very least, a Sun (which I find to be an infinitely more likely situation, and a totally different debate altogether). Well, I can say in all honesty that I have used RedHat's products before, and I have kept up with all the various claims against them - and as a Debian user, I can say that I believe RedHat has done NOTHING to deserve the kind of claims against them that people have levied against them.

    Now, this issue is moot in my mind - Young, in effect, seems to be feeding the trolls more than anything else here. No one who had actually researched this debate would claim RedHat to be acting like Microsoft. Again, as a Debian user, I feel that there is a hell of a lot WRONG with RedHat's distro - for ME. This more of a personal taste though - and don't anyone dare tell me that Debian hasn't had it's share of crippling bugs.

    In the end, this is all just incredibly silly for me, and I have finally made my decision about RedHat. RedHat is a company, like SuSE and the Turbolinux guys... they are selling a product. RedHat has supported it's product admirably, and though it isn't in my decision the product that I want to use, that doesn't mean that when something goes wrong we should all point our fingers and scream "REDHAT IS BECOMING MICROSOFT!!!" RedHat, as a company, had done a great deal of work for the Linux community and for the acceptance of Linux in places that in turn have made Linux a better OS (IBM, Dell, etc...). So I think we should back off and turn down our flamethrowers here - if you want to criticize RedHat, fine, but at least find a good reason.

  16. Tulip Networking... on 2.4 Kernel Delayed, Says Linus · · Score: 1

    Alright, well of course any delay that results in the betterment of the 2.4 series is well worth the wait. Alas, I have one single infuriating issue which I have yet to resolve - my new networking card requires a new kind of tulip driver that either requires me to compile a special tulip module against the kernel source (a module which does not want to compile), or use a 2.4 kernel - which seems to gloriously crash after ten minutes of use! If there were anything I could ask, it would be for a back-porting of the tulip code in 2.4 to be brought to the 2.2 series now - networking support is very importent for a Linux distro, especially Debian!
    And I'm not the only one... I've checked the Usenet, and I'm not the only one having this problem.

  17. Re:So bloody off-topic... on Merits Of The Different Journaling Filesystems? · · Score: 1

    Dammit, first time I ever really flame someone (not really a flame, but anyway) and I get an intelligent response. I shall, in the future, endeavor to pick my battles with greater care.

  18. So bloody off-topic... on Merits Of The Different Journaling Filesystems? · · Score: 1

    Oh gosh... you mean that be-fan is going to take time out to regale us with the merits of his favorite OS? Geez, that would be amazing. I mean, be-fan sure doesn't do this in EVERY OTHER POST HE MAKES. Seriously, come on, all you do is rank on Linux for it's inadequacies and talk about how wonderful BeOS is. Well guess what - a niche operating system where every bloody useful tool is expensive, isn't going to last very long. BeOS is powerful and pretty, but it is lightyears behind anything - including Linux - in terms of the basic requisite application support.

    Can't fill a niche in the BeOS software line? Then go to slashdot.com and whine about every other operating system until people use BeOS out of pity or just to shut you up!

  19. Serious about a Linux port?? on Baldur's Gate 2 Gold · · Score: 1

    It is seriously cool that Baldur's Gate 2 has gone gold - I loved the original. Now, I can remember having read something about Bioware being interested in porting the game to Linux. I'm not a "Linux must rule all things" zealot, but I think it would be really cool if I didn't have to keep Windows around for games all the time. Does anyone know if a Linux port of Baldur's Gate 2 is being worked on, or will it be given over to Loki to be worked on, or anything?

  20. Re:In other news: on Micron sues Rambus for antitrust violations · · Score: 1

    Now now, your post is the one that is fake -- we all know that Segfault isn't popular with anyone. (j/k)

  21. Re:Strangeness... on Java Security Hole Makes Netscape Into Web Server · · Score: 1

    Yes, /etc/inetd.conf is the place to disable daemons, but /etc/services is where you go to disable data transfer over a specifc port. Like, for instance, if you disable the syslogd port, syslogd won't work, etc... And trust me, I have tried this, and I recommend that others do so as well, as this is a means of securing a box (though nothing beats a wall of fire)

  22. Strangeness... on Java Security Hole Makes Netscape Into Web Server · · Score: 1

    As with most people who read this story, I found that it was worrying though I don't run Java on Netscape normally (as it has a tendancy to explode when Java is on). Nonetheless, I tested a couple of things with this applet. As should be obvious, the applet doesn't work if you don't run Java applets on Netscape (duh)... but what I found worrying is that when I commented out the specific ports in /etc/services , the applet still worked. Why would this be - I have commented out the ftp ports in /etc/services before, and the ftp server didn't work as a result, so why should it be different with a Netscape web proxy port acting as a server?

  23. Acronyms of Satan... on JPEG2000: Is It The Future Of Imaging? · · Score: 3

    "The Joint Photographic Experts Group (JPEG) and the Joint Bi- Level Image experts Group (JBIG) are joint committees of the ITU (Telecommunications branch, ITU-T) and ISO/IEC JTC1 SC29 WG1. They have been meeting for over ten years, initially starting as a working group of SC2, responsible for character coding."

    I sure am glad that the ITU-T and ISO/IEC JTC1 SC29 WG1 started as SC2. This allows for many more useless acronyms to spawn. Maybe the final group will be the JPEGJBIGITU-TISO/IECJTC1SC29WG1SC22/7 group. Did they translate their original group names from German?

  24. The rights of consumers... on 3dfx Voodoo5 vs NVIDIA GeForce Preview · · Score: 1

    Oh, I beg to differ. I'm sorry, but though you make a good case for your opinions, I must object to your main point of view - We, as the purchasers of NVIDIA cards, have every right to "DEMAND" drivers. Though I know you probably will disagree on principle, hear me out...

    Back last summer or so when I was in CompUSA looking at video cards, I was thinking about what I would use it for. I was upgrading from an AGP 3dLabs FireGL 1000 Pro, and I wanted to get a card that would both be a good 2d/3d performer and would work well under Linux. Obviously therefore, my options were relatively limited, but I did have two competitors... the Voodoo3 and the up-and-coming TNT2. I chose the TNT2, because I was under the impression that soon, there would be Linux support. NVIDIA gave the impression that there would be such support, and they dragged this farce along for quite a long time, even releasing drivers which would allow for passable 2d in X, though the 3d support was always a farce. And as 3dfx and Matrox joyfully released drivers to our operating system (I love to say that in reference to Linux) the fact remained that they did not follow through with their promises - late is not always better than never, when I lose $200 of my hard-earned money for the simple fact that I trusted a company to come through for me.

    Though I wanted nothing more than to play Quake3, the actions of NVIDIA were totally unacceptable in this respect. We, as the consumers, should not have to deal with companies that string us along like this. I am ashamed to be using a TNT2 card now, and rest assured, I will upgrade to a card from another company that has acceptable Linux support when I can. I am also ashamed to have been duped like this, but that doesn't mean I have to like it, and neither does it mean that I can't do something about it. NVIDIA will have no more of my money, and given my opinions, that is how it should be.
    Finally, please understand something... I do not in any way mean to say that NVIDIA cards aren't good Windows cards, nor am I claiming that all of you should buy 3dfx or anything else. But I believe that as a consumer, I do and always will have the right to demand a company to do what I pay it to do. My views may be old-fashioned, but I will always claim the right to be disgusted at the poor use of my money by a company I trusted.

  25. Re:all I want to know... on Wonderful World Of Linux 2.4 - Final Candidate · · Score: 1

    Can't really be sure of that one, but I bet that when it is out, it'll be SuSE who has it out first. That said, I think I'll wait for Slackware to upgrade to it - 7.0 has been out for a while, so I figure it's only a matter of time.