It seems like there's a lot of security advisories along these lines lately and they mostly seem to revolve around PHP site engines. Why PHP? Why not perl, or python, or Ruby?
Is there something about PHP that's making these things likely as opposed to some other language (which seems unlikely, there's plenty of simple mistakes you can make just as easily in perl, i.e. poor scrubbing of regexp/sql content), or is it just that there are more inexperienced people writing PHP code out there, or is it just that PHP site engines are getting installed by more security-inexperienced people, or are the PHP exploits getting publicized more, or am I just noticing them more?
Almost every time I have ever seen the BBC run an article covering some kind of clash between technology and the desires of large traditional commercial copyright holders, they seemed to have gone absolutely out of their way to slant the article in favor of the copyright holders.
I don't follow the BBC closely and I don't really know much about their normal news coverage. But it seems that on this one set of subjects they seem incapable of or unwilling to write a balanced article.
Somehow I don't think it's just a coincidence that the BBC is, itself, a large traditional commercial copyright holder.
How are people supposed to get modded xboxes if this stuff can't, uh, be sold? Not everyone knows how to modify hardware. Is it now decided that in order to use computer equipment in the way you want, you have to know how to use a soldering iron and IDE chain, and anyone else gets second-class consumer status?
This isn't what this particular case is about, what with the whole "80 games" thing, but for what conceivable good reason might we need Microsoft's permission to sell a slightly modified used PC?
If you look, they chose to ask very specific questions about biology and very general questions about physics. That very first question on the list, "what is the universe made of?", could have been easily split into five to ten different specific questions; similarly the list in general contained a number of groups of five to ten biology questions that are in a similar enough category they possibly could have been in some way collated. If they'd done either of these things the balance of the list would have seemed quite different even though the article as a whole was asking the exact same things.
But the way they did it makes sense to me, since it seems (to me) like right now biology has a good grasp on the big picture but is a little confused about specifics, whereas physics is absolutely drowning in specifics and at one of those points where they need some general answers about how all of these specifics fit together.
Actually making some kind of point or argument is unnecessary. Instead, save valuable time and effort by just describing some kind of hypothetical person with rigid yet inconsistent viewpoints. Then, point out their viewpoints are inconsistent. Congratulations, you've won!
Advanced version: Make the implication that the hypothetical person you've described speaks for the readers of Slashdot. Since mysteriously enough pretty much everyone who reads slashdot seems to hate it, this will bestow you with instant crowd appeal!
This all aside, many of the most important advantages of WebCore over KHTML are things which Apple really was under no obligation to put into the open source portion of their libraries. Apple could have easily moved the vast bulk of their improvements into closed-source libraries which wrapped KHTML and still fully fulfilled their LGPL obligations under both the letter and spirit of the license. The relative ease with which Safari can be reimplemented given WebCore is a byproduct of Apple's goodwill, not the KHTML licensing.
This was written in late 1999, and is a parody of a cypherpunk's manifesto, which struck me as very dishonest manifesto claiming to solely be concerned about privacy.
Hmm...
"It is wrong to accept terrorism." -- George W. Bush
A web browser is not a rendering engine. I can open up InterfaceBuilder, drop a WebCore object in a window, and hit "build and run", but this is not much of a web browser. And a rendering engine library is not terribly useful unto itself. It's a library. You need an application to use it.
The idea is that you can't just take what Apple's done and fork it. You have to take what Apple's done and write a new application around it. This is not a bad thing in any way; this is the exact situation that the LGPL was designed for in the first place to encourage. But it's still a very different dynamic than the GPL offers. There are people who prefer the GPL for a reason.
KHTML is NOT GPLed. It is under the LGPL. The names sound similar but this is a really, really serious distinction. The LGPL is much more loose and is a lot closer to BSD than GPL-- it basically says "you have to release changes you make to these files in this project, but you can take these files and dump it into something larger and you don't have to do anything to the rest of your project, so long as these files when taken as an independent unit still work". This means that changes and fixes to the LGPLed work must be contributed back, but additions, well, contributing those back are pretty much optional.
If KHTML had been GPLed, the entire Safari situation would have been different. For one thing, it very possibly wouldn't have happened. The GPL probably asks enough that Apple wouldn't have found it acceptable-- they're apparently OK with releasing source to WebCore or WebKit or whichever it is, but they probably wouldn't have been happy with having to open source Safari, or having to force any OS X developers linking against WebCore[Kit?], a system service, to open source. If KHTML had been GPLed Apple would have just gone and used their other option for a plug-in rendering engine, the mozilla/firefox project, which is available under the MPL (and soon the LGPL as well)-- which is even less restrictive than the LGPL from Apple's perspective.
But, let's hypothetically say KHTML had been GPLed and Apple had accepted this. What then? Well, then the situation vondo describes couldn't have occurred. Apple could have forked and written better code than the open source community, but that would be okay-- because they would have no control over their fork. I or you or anyone else in the world could have just downloaded safari.tar.gz, forked apple's fork, made one tiny improvement, and released it on the internet. Tada! The open source community has outdone Apple!
But that isn't an option here in real life. In real life, Apple's released WebKit/KHTML, but that's not a full product. It's a rendering engine. It can't really do anything by itself.
And what this means is that even though Apple's released their source, the Open Source community can't keep up with them. You could technically take WebKit and stuff it into Konqueror (and it would be interesting to try, I'm suprised no one has yet). But this would require some integration work, plus it still wouldn't at all stand up to Safari due to the value added by the parts of Safari which remain proprietary.
So while the LGPL, a less-"pure" license than the GPL, lead to a commercial use of an LGPLed library which is beneficial to the commercial user, beneficial to the open source project, and beneficial to others-- this is the exact thing ESR is trying to encourage!-- use of the LGPL in this case has still created an effective barrier to the open source product being as useful or successful as the commercial project which is using its code. RMS, were he here and someone had let him off his leash, would probably point out that this is one of the reasons you want to be using the GPL instead of the LGPL or BSD or MPL licenses in the first place!
I.E. the OSS community has sent threatening letters to the company I worked for because we linked with libraries considered to be GPL'd forcing us to write wrappers and stop using some of them
Uh, wow.
And then did you get all indignant when Microsoft started sending you threatening letters just because you'd been distributing mass-copied Windows XP CDs with your product?
"Guy who has been trying to deemphasize the FSF within the open source movement for over a decade now trying to deemphasize the FSF.."
The GPL has become the most popular free software license because it enforces a contract where you can't take without giving back. This may not be what you want for some programs, particularly programs which are platforms, such as Apache or Perl. But for most cases it is. It sends an important message to the people contributing to a GPLed project-- it says, your contributions won't be wasted, if people use this you benefit. It gives you a reason to contribute rather than boredom of philanthropy.
Meanwhile the only people who would be made "nervous" by the presence of the GPL are the people who want, or think they might want in the future, to take from open source software without giving equally in return. Think about that for a moment.
I tend to release my personal code under the LGPL because I feel the GPL is too restrictive, and I care more about the things I release being useful than I care about knowing I'll get something back. But that doesn't mean I'm going to deny how important the GPL is. The GPL made the open source development model as we know it today, with corporate and private interests sharing resources toward a common goal, possible-- we may be at a point now where lots of companies are contributing to open source purely voluntarily, but this is at least partly because open source is "hip" right now. There was a point in the past where it wasn't "hip" and companies sometimes had to be made to contribute, by holding the "you have to contribute to take" aspect of the GPL heads. There will be a point in the future where open source is not "hip" the way it is today. When that point comes, good luck convincing companies to contribute to your Apache licensed projects rather than just taking. It won't work all the time.
They entirely overhyped it in areas where it's relatively useless (the desktop) and entirely underhyped it in areas where it's extremely useful (backend and embedded areas).
Now ten years later you talk about "java" and all anyone remembers are those horrible, sluggish AWT applets, running on netscape 4.0's broken JVM, which they used during the initial Java hype push. But almost nobody these days knows about the success Java met in unglamorous areas after the hype push had died off.
What did you think they were going to do, make you an SVP?
If it were me? Well, there would be a wide number of possible responses I could expect from the employer, but producing false information to police and courts to produce illegitimate legal action and have my private property unreasonably seized-- property which I may or may not ever see again once it disappears into the "evidence" system-- is not one of them.
Anyway if he had resigned how would it have helped him one iota? He'd still be facing a frivolous and expensive lawsuit and have all his stuff jacked.
I saw this link a few days back, and I haven't been able to red the report, but I really think Merill Lynch is kind of looking at some things as unit costs that really ought to be considered to be sunk costs.
Example: They're assuming $100 the Bluray Disc player. A DVD player would be... what, I dunno, definitely less? Let's make up a random number and guess that they're spending $80 more per unit because they went with Bluray instead of DVD. Except wait a minute. Does it really make sense to lump this in $80 or whatever in with the per unit cost of the PS3? For one thing, this money is subsidizing the portion of Sony's business that's interested in selling Bluray drives and discs, and that's something Sony has a lot of money riding on. For another thing, I'd assume one of the main reasons the BD drives are so expensive is that they are new and unproven technology. But the PS3 manufacturing itself will help to break the technology in. To some extent by spending this money on the BD drives for the PS3 to break in the production lines and all, Sony probably is relieving money that it will have to spend later on manufacturing BD drives for other consumer products. To some extent that $80 per bluray represents a sunk cost that Sony would have had to have paid anyway for other purposes.
So I question how important these numbers are. If you look at previous Sony Playstations, Sony's been pretty good at the whole thing of bringing down production costs relatively quickly. If they can keep this up they can probably afford to just eat a high production cost since they know their costs are eventually going to come down.
I basically see them as an adware company now. I've only been using this WinXP thing for a few weeks, but every time I log in or start up I get a nagware dialog trying to convince me to install their antivirus program. I don't want their damn antivirus program. But there doesn't seem to be any way to turn the OS's self-advertising dialogs off.
Then there's Outlook Express. I used to rather like Outlook Express. Except now apparently it launches MSN messenger or something every time that you start it, without asking you, without telling you. I kept being totally baffled to find the program open and sitting in the start bar thingy, and going, how does this keep opening? Before I finally figured out Outlook was doing it. This of course isn't a problem anymore, becuase I've already switched to Thunderbird. But how the heck do I turn off this virus protection nagware screen? And how does Microsoft not implode from the irony of using adware techniques to get users to run a program reportedly designed to defeat adware?
And what's the difference between Windows or Outlook Express starting up and running ads for Microsoft, and "Snood!" starting up and running ads for Gator? Not that much, I don't think. So what's surprising here?
Slashdot Mirror
It isn't everyone's God-given right to own modded hardware
Why not?
it's illegal
Why?
It seems like there's a lot of security advisories along these lines lately and they mostly seem to revolve around PHP site engines. Why PHP? Why not perl, or python, or Ruby?
Is there something about PHP that's making these things likely as opposed to some other language (which seems unlikely, there's plenty of simple mistakes you can make just as easily in perl, i.e. poor scrubbing of regexp/sql content), or is it just that there are more inexperienced people writing PHP code out there, or is it just that PHP site engines are getting installed by more security-inexperienced people, or are the PHP exploits getting publicized more, or am I just noticing them more?
What's going on here?
Almost every time I have ever seen the BBC run an article covering some kind of clash between technology and the desires of large traditional commercial copyright holders, they seemed to have gone absolutely out of their way to slant the article in favor of the copyright holders.
I don't follow the BBC closely and I don't really know much about their normal news coverage. But it seems that on this one set of subjects they seem incapable of or unwilling to write a balanced article.
Somehow I don't think it's just a coincidence that the BBC is, itself, a large traditional commercial copyright holder.
As long as you can't buy sex on the internet, they'll always have a revenue stream.
How are people supposed to get modded xboxes if this stuff can't, uh, be sold? Not everyone knows how to modify hardware. Is it now decided that in order to use computer equipment in the way you want, you have to know how to use a soldering iron and IDE chain, and anyone else gets second-class consumer status?
This isn't what this particular case is about, what with the whole "80 games" thing, but for what conceivable good reason might we need Microsoft's permission to sell a slightly modified used PC?
From the article:
"The man had been selling modified Xbox consoles which he fitted with a big hard drive containing 80 games."
So.. um.. not just mod chips, then.
Precedent or no, this guy no more deserves our sympathy or support than some guy selling bootlegged CDs on a street corner.
If you look, they chose to ask very specific questions about biology and very general questions about physics. That very first question on the list, "what is the universe made of?", could have been easily split into five to ten different specific questions; similarly the list in general contained a number of groups of five to ten biology questions that are in a similar enough category they possibly could have been in some way collated. If they'd done either of these things the balance of the list would have seemed quite different even though the article as a whole was asking the exact same things.
But the way they did it makes sense to me, since it seems (to me) like right now biology has a good grasp on the big picture but is a little confused about specifics, whereas physics is absolutely drowning in specifics and at one of those points where they need some general answers about how all of these specifics fit together.
Most C** are idiots.
:(
And I thought C# was bad enough. This naming scheme is getting out of hand
Actually making some kind of point or argument is unnecessary. Instead, save valuable time and effort by just describing some kind of hypothetical person with rigid yet inconsistent viewpoints. Then, point out their viewpoints are inconsistent. Congratulations, you've won!
Advanced version: Make the implication that the hypothetical person you've described speaks for the readers of Slashdot. Since mysteriously enough pretty much everyone who reads slashdot seems to hate it, this will bestow you with instant crowd appeal!
For Safari to be "a competing application" it would have to be rewritten anyway... to run under X11.
If this is the way you want to look at it then http://www.gnustep.org/
This all aside, many of the most important advantages of WebCore over KHTML are things which Apple really was under no obligation to put into the open source portion of their libraries. Apple could have easily moved the vast bulk of their improvements into closed-source libraries which wrapped KHTML and still fully fulfilled their LGPL obligations under both the letter and spirit of the license. The relative ease with which Safari can be reimplemented given WebCore is a byproduct of Apple's goodwill, not the KHTML licensing.
This was written in late 1999, and is a parody of a cypherpunk's manifesto, which struck me as very dishonest manifesto claiming to solely be concerned about privacy.
Hmm...
"It is wrong to accept terrorism." -- George W. Bush
Okay, now watch this.
"Accept terrorism." -- George W. Bush
Oh my God, George W. Bush supports terrorism!
So express yourself in public at some point, and if the thing you expressed was "wrong" then someday the law will apply differently to you.
What kind of message does this send?
You mean, like Apple took KHTML and wrote a new application around it?
Yes, an application which they would have had to open source had the GPL been used instead of the LGPL.
You can take Webkit, tweak it, take Shiira, tweak it, and you're doing the same thing as if it were Safari that was being tweaked.
Um... you might personally feel that Shiira is as good as Safari, but they are not the same application.
What parts are those, precisely?
"Everything else".
A web browser is not a rendering engine. I can open up InterfaceBuilder, drop a WebCore object in a window, and hit "build and run", but this is not much of a web browser. And a rendering engine library is not terribly useful unto itself. It's a library. You need an application to use it.
The idea is that you can't just take what Apple's done and fork it. You have to take what Apple's done and write a new application around it. This is not a bad thing in any way; this is the exact situation that the LGPL was designed for in the first place to encourage. But it's still a very different dynamic than the GPL offers. There are people who prefer the GPL for a reason.
So now that we've got this ruling, does this mean that we can bring back third voice?
Okay... to clear up...
KHTML is NOT GPLed. It is under the LGPL. The names sound similar but this is a really, really serious distinction. The LGPL is much more loose and is a lot closer to BSD than GPL-- it basically says "you have to release changes you make to these files in this project, but you can take these files and dump it into something larger and you don't have to do anything to the rest of your project, so long as these files when taken as an independent unit still work". This means that changes and fixes to the LGPLed work must be contributed back, but additions, well, contributing those back are pretty much optional.
If KHTML had been GPLed, the entire Safari situation would have been different. For one thing, it very possibly wouldn't have happened. The GPL probably asks enough that Apple wouldn't have found it acceptable-- they're apparently OK with releasing source to WebCore or WebKit or whichever it is, but they probably wouldn't have been happy with having to open source Safari, or having to force any OS X developers linking against WebCore[Kit?], a system service, to open source. If KHTML had been GPLed Apple would have just gone and used their other option for a plug-in rendering engine, the mozilla/firefox project, which is available under the MPL (and soon the LGPL as well)-- which is even less restrictive than the LGPL from Apple's perspective.
But, let's hypothetically say KHTML had been GPLed and Apple had accepted this. What then? Well, then the situation vondo describes couldn't have occurred. Apple could have forked and written better code than the open source community, but that would be okay-- because they would have no control over their fork. I or you or anyone else in the world could have just downloaded safari.tar.gz, forked apple's fork, made one tiny improvement, and released it on the internet. Tada! The open source community has outdone Apple!
But that isn't an option here in real life. In real life, Apple's released WebKit/KHTML, but that's not a full product. It's a rendering engine. It can't really do anything by itself.
And what this means is that even though Apple's released their source, the Open Source community can't keep up with them. You could technically take WebKit and stuff it into Konqueror (and it would be interesting to try, I'm suprised no one has yet). But this would require some integration work, plus it still wouldn't at all stand up to Safari due to the value added by the parts of Safari which remain proprietary.
So while the LGPL, a less-"pure" license than the GPL, lead to a commercial use of an LGPLed library which is beneficial to the commercial user, beneficial to the open source project, and beneficial to others-- this is the exact thing ESR is trying to encourage!-- use of the LGPL in this case has still created an effective barrier to the open source product being as useful or successful as the commercial project which is using its code. RMS, were he here and someone had let him off his leash, would probably point out that this is one of the reasons you want to be using the GPL instead of the LGPL or BSD or MPL licenses in the first place!
I.E. the OSS community has sent threatening letters to the company I worked for because we linked with libraries considered to be GPL'd forcing us to write wrappers and stop using some of them
Uh, wow.
And then did you get all indignant when Microsoft started sending you threatening letters just because you'd been distributing mass-copied Windows XP CDs with your product?
"Guy who has been trying to deemphasize the FSF within the open source movement for over a decade now trying to deemphasize the FSF.."
The GPL has become the most popular free software license because it enforces a contract where you can't take without giving back. This may not be what you want for some programs, particularly programs which are platforms, such as Apache or Perl. But for most cases it is. It sends an important message to the people contributing to a GPLed project-- it says, your contributions won't be wasted, if people use this you benefit. It gives you a reason to contribute rather than boredom of philanthropy.
Meanwhile the only people who would be made "nervous" by the presence of the GPL are the people who want, or think they might want in the future, to take from open source software without giving equally in return. Think about that for a moment.
I tend to release my personal code under the LGPL because I feel the GPL is too restrictive, and I care more about the things I release being useful than I care about knowing I'll get something back. But that doesn't mean I'm going to deny how important the GPL is. The GPL made the open source development model as we know it today, with corporate and private interests sharing resources toward a common goal, possible-- we may be at a point now where lots of companies are contributing to open source purely voluntarily, but this is at least partly because open source is "hip" right now. There was a point in the past where it wasn't "hip" and companies sometimes had to be made to contribute, by holding the "you have to contribute to take" aspect of the GPL heads. There will be a point in the future where open source is not "hip" the way it is today. When that point comes, good luck convincing companies to contribute to your Apache licensed projects rather than just taking. It won't work all the time.
They entirely overhyped it in areas where it's relatively useless (the desktop) and entirely underhyped it in areas where it's extremely useful (backend and embedded areas).
Now ten years later you talk about "java" and all anyone remembers are those horrible, sluggish AWT applets, running on netscape 4.0's broken JVM, which they used during the initial Java hype push. But almost nobody these days knows about the success Java met in unglamorous areas after the hype push had died off.
What did you think they were going to do, make you an SVP?
If it were me? Well, there would be a wide number of possible responses I could expect from the employer, but producing false information to police and courts to produce illegitimate legal action and have my private property unreasonably seized-- property which I may or may not ever see again once it disappears into the "evidence" system-- is not one of them.
Anyway if he had resigned how would it have helped him one iota? He'd still be facing a frivolous and expensive lawsuit and have all his stuff jacked.
Soviet Russia will think of ... itself
Now if you want to turn off that nagware thing, go to Control Panel?>Security Center
Thanks.
I saw this link a few days back, and I haven't been able to red the report, but I really think Merill Lynch is kind of looking at some things as unit costs that really ought to be considered to be sunk costs.
Example: They're assuming $100 the Bluray Disc player. A DVD player would be... what, I dunno, definitely less? Let's make up a random number and guess that they're spending $80 more per unit because they went with Bluray instead of DVD. Except wait a minute. Does it really make sense to lump this in $80 or whatever in with the per unit cost of the PS3? For one thing, this money is subsidizing the portion of Sony's business that's interested in selling Bluray drives and discs, and that's something Sony has a lot of money riding on. For another thing, I'd assume one of the main reasons the BD drives are so expensive is that they are new and unproven technology. But the PS3 manufacturing itself will help to break the technology in. To some extent by spending this money on the BD drives for the PS3 to break in the production lines and all, Sony probably is relieving money that it will have to spend later on manufacturing BD drives for other consumer products. To some extent that $80 per bluray represents a sunk cost that Sony would have had to have paid anyway for other purposes.
So I question how important these numbers are. If you look at previous Sony Playstations, Sony's been pretty good at the whole thing of bringing down production costs relatively quickly. If they can keep this up they can probably afford to just eat a high production cost since they know their costs are eventually going to come down.
I basically see them as an adware company now. I've only been using this WinXP thing for a few weeks, but every time I log in or start up I get a nagware dialog trying to convince me to install their antivirus program. I don't want their damn antivirus program. But there doesn't seem to be any way to turn the OS's self-advertising dialogs off.
Then there's Outlook Express. I used to rather like Outlook Express. Except now apparently it launches MSN messenger or something every time that you start it, without asking you, without telling you. I kept being totally baffled to find the program open and sitting in the start bar thingy, and going, how does this keep opening? Before I finally figured out Outlook was doing it. This of course isn't a problem anymore, becuase I've already switched to Thunderbird. But how the heck do I turn off this virus protection nagware screen? And how does Microsoft not implode from the irony of using adware techniques to get users to run a program reportedly designed to defeat adware?
And what's the difference between Windows or Outlook Express starting up and running ads for Microsoft, and "Snood!" starting up and running ads for Gator? Not that much, I don't think. So what's surprising here?