If the users don't have enough memory to run the program, they won't buy it and the developer won't get their money. If the users do have enough memory to run the program, then there isn't any problem with it using more memory. I don't see anything unethical about writing a program that uses lots of memory, as long as you are honest about its memory usage on the box. Whether the users want to buy a memory hogging program is up to them to decide.
With fully self-contained apps, we could do away with those silly shared libraries
I don't see how 0install implies doing away with shared libraries. If your 0install app needs a shared library, it can just specify the version of the shared library it needs, and 0install can take care of making sure that library is installed (in its own appropriate 0install location) before your app runs.
So you are suggesting that the only way to have a stable system is to keep your hard drive mostly empty? If so, I'd say you have much bigger problems to worry about than which installer to use.
As for memory being cheaper, you're right -- the cost of computer resources goes down every year, while the value of the user's time goes up. So if we can save the user some time by throwing more computer resources at the problem, then that's generally a win.
The big difference is, with this device (potentially) nobody knows you are recording them.
The slightly less big (but still significant) difference is, with this device it is practical to record everything all the time -- with a regular video camera it would be too tedious, and so most people would stop doing it after a few hours at most.
Think of it this way: this system can do for voyeurism what file sharing did for music bootlegging -- change it from something that took a certain amount of effort into something that anyone can do without even trying.
Oh, and no one will be allowed into any factory or remotely secure environment with one of these cameras.
I think that should be, "no one will knowingly be allowed in". Once these cameras are small enough to be undetectable, things are going to get very interesting...
Yes, and this is where it goes 'wrong': recording a song non-digitally (analoge) isn't really good for the song's quality.
Neither is encoding a song into mp3 format, or transmitting it over FM radio. The thing is, most people don't care, if they can get it for free. The small percentage of people who do care will either pay the subscription fee, or find a way around the DRM on the digital side.
GOD how I hate BUZZ WORDS and PHRASES like "security through obscurity", and the stupid people that use them.
Wow, you should really switch to decaf. If you get this worked up over a technical discussion, I can't imagine trying to discuss something controversial with you. I'd probably be beaten to death by your jerking knees.
That said, nobody ever said it was bad to have obscurity in the system, only that is was bad to rely on that obscurity to provide security. To use your example, it's okay that the protocol used in the microchip in your ID card isn't published on a web site somewhere -- as long as the act of publishing the protocol wouldn't make the chip insecure.
And yes, there are a lot of systems out there that DO rely on "security through obscurity". That does not make security through obscurity a good idea. (and yes, I am purposely repeating the phrase "security through obscurity", just to annoy you;^))
I completely agree. The tab character was a design abortion that lost its applicability when we switched from typewriters to teletypes. I propose we modify the ASCII character set to remove it, and replace it with a happy-face glyph instead.
Nor I... if one wants to create a new scripting language to overcome perceived weaknesses, why make it look 99% like something else that is already out there?
Because the #1 problem for a new language is getting people to actually use it. That is why C++ looks so much like C, why Java looks so much like C++, and why C# looks so much like... well, whatever you want it to look like...
Come on, you've NEVER encountered a clueless "power user"/admin in the *IX world?
Sure, but those people aren't the real problem. They are rare enough that they won't spread too many viruses. The people I'm worried about are the secretaries, the housewives, the grandparents, etc -- the people who don't even try to understand computers, and just want to get their work done.
No system can survive an idiot with root access.
I agree. That's why the clueless newbies shouldn't be running with root access. Obtaining root access should be non-trivial enough that the chances of someone clueless being able to do it are slim to none. Root access should also be unnecessary for anything a newbie might want to do, so that they never feel the urge to acquire it.
How did the code get onto the user's system? Outlook downloaded it. How was the code allowed to execute and corrupt the system? Windows allowed it to be executed, and ran it in a privileged mode. Why are both of these operations so easy to do that even a clueless newbie can do them, sometimes without even meaning to? Because the software was designed that way.
The same people who execute the above code, received via Outlook on Windows, would also execute it after having read the message in pine, saved the attachment, su'd to root (if they even ever logged in as an unprivledged user)
No, they wouldn't. We are talking about clueless people here, not deliberately self-destructive ones. Clueless people wouldn't know how to su to root or build source code. They only know to click on the pretty icons, and then they wonder why clicking the icon caused their system to go crazy.
Allow me to reiterate: The particular problem I mentioned is not the fault of Outlook.
The destruction we see was made possible by combining an insecure OS with an insecure email program. I don't have an axe to grind against Microsoft; certainly many other OS's have the same problems. I'm only saying that the situation could have been avoided, had the people who designed the OS and email client given more thought to security, and didn't assume their users were all computer literate.
True. Which is why the real killer app for this type of device is to throw in a WiFi card and a web browser. Who cares about stupid proprietary content when there's an Internet out there?
And who among us would like to take the time to teach my mom Linux?
Who said anything about Linux? I never claimed Linux was any better. In fact, I specifically said "Note that Linux is not that [secure] system". I only said that it is possible to develop a secure system that would make it difficult or impossible for even a naive user to contract a virus, and therefore blaming the user for being human is a cop-out.
Outlook and Windows are both made by the same company and are designed to work closely with each other; I don't think it is necessary to debate what is the fault of Windows and what is the fault of Outlook. In either case, the Microsoft email solution (Windows+Outlook) is insecure unless the user knows what he is doing, and yet it is marketed as a solution appropriate for people who don't know what they are doing. Hence the problem. Blaming the user for not being careful enough isn't a solution, since Windows users aren't supposed to have to be careful... it's supposed to be a newbie-friendly OS.
The operating system could tag the executable as "untrusted: downloaded-via-email", and therefore know to run it in a sandbox where it won't be able to bork up the system. Better yet, a properly designed operating system would maintain fine-grained permissions for all software, and only allow programs to do the operations they actually need to do, and nothing more. EROS is a (toy) example of such an OS.
You cannot realistically compare random criminal acts against which there is little to no defense to contracting an email virus -- which is defensible.
Sure you can -- both are random crimes, and you can take steps to reduce your likelihood of being a victim of either. To not get mugged, don't walk in dangerous neighborhoods at night, travel with a friend, carry a weapon, etc etc. To not get virused, keep your system up to date, don't open attachments, run antivirus software, etc etc.
It's called prevention. An ounce of which (updates and antivirus) is worth a pound of cure.
I agree, prevention is great. I just think that the majority of the prevention should be handled by Microsoft, instead of leaving it up to the end user not to do something dumb. If Windows was marketed as a product for experts, I could excuse the current situation, but it's marketed as the OS for everybody (including your mom) and therefore it should be designed with the non-security-savvy in mind. I don't think that is too much to ask.
I've been to New York many times, and I've NEVER been mugged. Not once. Therefore, anybody who gets mugged there must have been doing something wrong, and it's their own fault. I wish they would quit whining about it.
The problem only exists between the chair and the keyboard because the software allows it to exist -- there is nothing that says email software HAS to let the user execute viruses contained in incoming email. Or if you insist that there must be such a feature, there is nothing that says the executed code must be run with the sorts of privileges necessary to allow viruses to spread. I can certainly imagine a system where security was designed in from the start, such that even the most clueless user wouldn't be able to shoot himself in the foot. (Note that Linux is not that system)
Maybe Microsoft should re-code Outlook so that the incoming-email-handling-and-viewing code runs in some sort of Java-style untrusted sandbox mode. That way even if there is some problem like this, the damage would be contained to that one process and wouldn't subvert the rest of the system.
I wasn't addressing the liability issue, just the bandwidth problems. As for whether a network provider is liable for the traffic that goes over its equipment, I was under the impression that the "safe harbour" laws held the provider exempt as long as they cooperated with DMCA take-down orders...
Slashdot Mirror
Scammers masquerading as eBay? That's unpossible!
If the users don't have enough memory to run the program, they won't buy it and the developer won't get their money. If the users do have enough memory to run the program, then there isn't any problem with it using more memory. I don't see anything unethical about writing a program that uses lots of memory, as long as you are honest about its memory usage on the box. Whether the users want to buy a memory hogging program is up to them to decide.
I don't see how 0install implies doing away with shared libraries. If your 0install app needs a shared library, it can just specify the version of the shared library it needs, and 0install can take care of making sure that library is installed (in its own appropriate 0install location) before your app runs.
As for memory being cheaper, you're right -- the cost of computer resources goes down every year, while the value of the user's time goes up. So if we can save the user some time by throwing more computer resources at the problem, then that's generally a win.
The slightly less big (but still significant) difference is, with this device it is practical to record everything all the time -- with a regular video camera it would be too tedious, and so most people would stop doing it after a few hours at most.
Think of it this way: this system can do for voyeurism what file sharing did for music bootlegging -- change it from something that took a certain amount of effort into something that anyone can do without even trying.
I think that should be, "no one will knowingly be allowed in". Once these cameras are small enough to be undetectable, things are going to get very interesting...
Neither is encoding a song into mp3 format, or transmitting it over FM radio. The thing is, most people don't care, if they can get it for free. The small percentage of people who do care will either pay the subscription fee, or find a way around the DRM on the digital side.
Charlatan? Care to back that one up (with something other than Bush campaign ads)?
Plus, you get mascot that is on par with barny for lamenes!
I'll take an overweight penguin instead of an idiotic man in a butterfly suit any day...
That is correct. Exactly which 2/3 of your car you get back varies, but it's usually the parts that weren't easily removable.
Wow, you should really switch to decaf. If you get this worked up over a technical discussion, I can't imagine trying to discuss something controversial with you. I'd probably be beaten to death by your jerking knees.
That said, nobody ever said it was bad to have obscurity in the system, only that is was bad to rely on that obscurity to provide security. To use your example, it's okay that the protocol used in the microchip in your ID card isn't published on a web site somewhere -- as long as the act of publishing the protocol wouldn't make the chip insecure.
And yes, there are a lot of systems out there that DO rely on "security through obscurity". That does not make security through obscurity a good idea. (and yes, I am purposely repeating the phrase "security through obscurity", just to annoy you
Hmm? How could this 10 mile-wide meltdown occur? I don't understand...
I completely agree. The tab character was a design abortion that lost its applicability when we switched from typewriters to teletypes. I propose we modify the ASCII character set to remove it, and replace it with a happy-face glyph instead.
Because the #1 problem for a new language is getting people to actually use it. That is why C++ looks so much like C, why Java looks so much like C++, and why C# looks so much like... well, whatever you want it to look like...
Sure, but those people aren't the real problem. They are rare enough that they won't spread too many viruses. The people I'm worried about are the secretaries, the housewives, the grandparents, etc -- the people who don't even try to understand computers, and just want to get their work done.
No system can survive an idiot with root access.
I agree. That's why the clueless newbies shouldn't be running with root access. Obtaining root access should be non-trivial enough that the chances of someone clueless being able to do it are slim to none. Root access should also be unnecessary for anything a newbie might want to do, so that they never feel the urge to acquire it.
Just about EVERY other OS has this problem.
Yup. That doesn't mean it's not a problem.
The same people who execute the above code, received via Outlook on Windows, would also execute it after having read the message in pine, saved the attachment, su'd to root (if they even ever logged in as an unprivledged user)
No, they wouldn't. We are talking about clueless people here, not deliberately self-destructive ones. Clueless people wouldn't know how to su to root or build source code. They only know to click on the pretty icons, and then they wonder why clicking the icon caused their system to go crazy.
Allow me to reiterate: The particular problem I mentioned is not the fault of Outlook.
The destruction we see was made possible by combining an insecure OS with an insecure email program. I don't have an axe to grind against Microsoft; certainly many other OS's have the same problems. I'm only saying that the situation could have been avoided, had the people who designed the OS and email client given more thought to security, and didn't assume their users were all computer literate.
True. Which is why the real killer app for this type of device is to throw in a WiFi card and a web browser. Who cares about stupid proprietary content when there's an Internet out there?
Who said anything about Linux? I never claimed Linux was any better. In fact, I specifically said "Note that Linux is not that [secure] system". I only said that it is possible to develop a secure system that would make it difficult or impossible for even a naive user to contract a virus, and therefore blaming the user for being human is a cop-out.
Outlook and Windows are both made by the same company and are designed to work closely with each other; I don't think it is necessary to debate what is the fault of Windows and what is the fault of Outlook. In either case, the Microsoft email solution (Windows+Outlook) is insecure unless the user knows what he is doing, and yet it is marketed as a solution appropriate for people who don't know what they are doing. Hence the problem. Blaming the user for not being careful enough isn't a solution, since Windows users aren't supposed to have to be careful... it's supposed to be a newbie-friendly OS.
No, it doesn't.
The operating system could tag the executable as "untrusted: downloaded-via-email", and therefore know to run it in a sandbox where it won't be able to bork up the system. Better yet, a properly designed operating system would maintain fine-grained permissions for all software, and only allow programs to do the operations they actually need to do, and nothing more. EROS is a (toy) example of such an OS.
little to no defense to contracting an email virus -- which is defensible.
Sure you can -- both are random crimes, and you can take steps to reduce your likelihood of being a victim of either. To not get mugged, don't walk in dangerous neighborhoods at night, travel with a friend, carry a weapon, etc etc. To not get virused, keep your system up to date, don't open attachments, run antivirus software, etc etc.
It's called prevention. An ounce of which (updates and antivirus) is worth a pound of cure.
I agree, prevention is great. I just think that the majority of the prevention should be handled by Microsoft, instead of leaving it up to the end user not to do something dumb. If Windows was marketed as a product for experts, I could excuse the current situation, but it's marketed as the OS for everybody (including your mom) and therefore it should be designed with the non-security-savvy in mind. I don't think that is too much to ask.
I've been to New York many times, and I've NEVER been mugged. Not once. Therefore, anybody who gets mugged there must have been doing something wrong, and it's their own fault. I wish they would quit whining about it.
The problem only exists between the chair and the keyboard because the software allows it to exist -- there is nothing that says email software HAS to let the user execute viruses contained in incoming email. Or if you insist that there must be such a feature, there is nothing that says the executed code must be run with the sorts of privileges necessary to allow viruses to spread. I can certainly imagine a system where security was designed in from the start, such that even the most clueless user wouldn't be able to shoot himself in the foot. (Note that Linux is not that system)
Maybe Microsoft should re-code Outlook so that the incoming-email-handling-and-viewing code runs in some sort of Java-style untrusted sandbox mode. That way even if there is some problem like this, the damage would be contained to that one process and wouldn't subvert the rest of the system.
I wasn't addressing the liability issue, just the bandwidth problems. As for whether a network provider is liable for the traffic that goes over its equipment, I was under the impression that the "safe harbour" laws held the provider exempt as long as they cooperated with DMCA take-down orders...