Slashdot Mirror


User: Robin+Hood

Robin+Hood's activity in the archive.

Stories
0
Comments
140
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 140

  1. Re:Linux is easy, you are just being difficult. on Windows Domination May End Next Year · · Score: 1
    Because if you're properly security-conscious (read: paranoid), paranoid enough to be *using* ssh instead of telnet, you know that ssh version 1.anything is vulnerable to a particular obscure, difficult man-in-the-middle attack. It's not very easy to do, but it's possible; it involves inserting arbitrary packets (with source IP spoofed, I imagine) into the ssh data stream, causing them to be decrypted into arbitrary commands on the server. This is not a simple bug to be fixed in a patch, it's a vulnerability of the ssh protocol, and is one of the reasons ssh 2 was re-writted almost from the ground up.

    More info can be found in README.DEATTACK in the ssh 1.2.27 distribution.
    -----

  2. Re:Linux != Easy to use on Windows Domination May End Next Year · · Score: 1
    Well, my first advice would be to get another book. I have nothing against the "... For Dummies" series per se, but you'll soon want more technical detail. Although I've never read it myself, I've heard nothing but praise for Running Linux, by Matt Welsh and Lar Kaufman. The second edition is currently in stores, but the third edition is due for publication in August 1999, so you might want to wait and buy that one.

    Second, you may have felt overwhelmed by all the HOWTOs available at the Linux Documentation Project, and you might have missed a few of the handier ones. Well, <FONT FACE="large, friendly letters">DON'T PANIC!</FONT> :-) As a former "dos junkie", you'd probably get the most initial mileage out of the From DOS/Windows to Linux HOWTO. I also recommend the Linux Gazette, which seems aimed at new Linux users and often contains a whole lot of handy tips and tricks that will sometimes make your life simpler.

    As a former DOS junkie myself (who still occasionally amazes Win95 users with my knowledge of CONFIG.SYS and "DOS=HIGH,UMB" and so on) I'll predict that once you get used to Linux's quirks (and yes, it does have a few), you'll feel right at home. It may take a year or two (it did for me), but after a couple of years, you'll wonder how you could have used anything else.

    Have fun, and feel free to E-mail me if you have any questions.
    -----

  3. Re:As well they should on cDc Charges MS w/ Distributing Cracker Software · · Score: 1
    No the point is that SMS is installed and authorized by the System adminstrators who have all legal rights to do so whereas the BO2K is not an administration tool and is installed without authorization.

    Six of one, a half-dozen of the other. BO2K can be installed and authorized by the system administrators. And SMS can be installed by unauthorized users if they have the appropriate permissions (I don't know NT very well, but surely the same permissions -- write access to the C: drive, for one -- would be required to install BO2K as to install SMS).

    Also SMS's remote control facility can be turned off by the user to prevent the admin from connecting.

    Not if the user doesn't know SMS is there. Here's the "evil use of SMS" scenario: I'm a cracker wanting to take remote control of Joe User's computer. So I sneak into Joe's office when Joe isn't there and has forgotten to password-protect his screensaver, and I install SMS from the CD-ROM I always carry with me. Or I find some excuse to be in Joe's office and I watch him type his password (you'd be surprised how slowly some people type their passwords in). Anyway, I get SMS installed and (posing as Joe, the user) check the "allow remote control" box and the "hide" box. Now Joe's computer has SMS installed on it and he doesn't know.

    Run through the scenario above, substituting BO2K for SMS. See? Not so different, are they? Both are remote-control-of-a-computer tools that don't always announce their presence. The only difference is that SMS costs quite a bit of money, while BO2K can be downloaded free of charge. Thus a lot more people will have access to a copy of BO2K than a copy of SMS.

    The point is that both SMS and BO2K can be installed by admins for legitimate purposes, or they can be installed secretly by crackers for security-breaking purposes. A rifle can be used for hunting, or it can be used to murder someone. Rifles aren't inherently evil (let's not start a gun-control flamewar here), but they can be used for evil purposes. Same principle with BO2K.
    -----

  4. Not a violation on Will Digital VCRs Change TV? · · Score: 1
    I don't believe this is a violation of the GPL. Here's the relevant portion of section 3 (emphasis mine), of version 2.0 of the GPL:

    3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

    • a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

    • b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

    • c) [Section C omitted, since it does not apply]

    By my reading of section 3 of the GPL, TiVo has already stated their willingness to comply with section 3a) -- they will distribute the source code with their product if anyone asks for it. This might be a violation of the letter of the GPL -- my reading of the above says that to fully comply with 3a) they must distribute a copy of the source code with each and every product sold -- but it certainly seems in keeping with the spirit. After all, most home users of this product won't care about the source code, and the CD they got would be used as a coaster or something (what do you do with all your AOL "100 Free Hours!" CD's? New poll question!). So TiVo doesn't want to ship thousands of CD's that nobody will ever use, so they just ship them to the people that would use them. Seems fair to me.

    Disclaimer: I am not involved with TiVo in any way; I don't even own one of their units. So my information may be inaccurate, but it's unbiased.
    -----

  5. "Win" anecdote on Caldera Graphic Installation Screenshots · · Score: 1
    An anecdote I heard from a fellow Computer Science student here at college... The computer had MS-DOS and Win 3.1 loaded on it. Someone typed "win". The computer answered "Bad command or file name". He then typed "lose". Windows started up.

    Someone with a sense of humor had renamed the WIN.COM file...
    -----

  6. Re:W2K stability on ESR on his trip to Microsoft · · Score: 1
    why oh why does most win software force a reboot - it isn't needed! the registry can be updated on the fly

    The Registry can be updated on the fly? That's news to me... Sure, it could (and I think it should have that ability), but as far as I can tell, you can't make changes to the Registry on-the-fly; they require a reboot to take effect. I'm speaking from personal experience: I was trying to help someone change the Win95 keyboard layout to Dvorak whenever he logged in to one of the public computers in the computer lab here. I isolated the Registry entry for the keyboard layout, wrote a Registry patch to change it to US-Dvorak, and put a "regedit [patch].reg" line in his login script. It consistently refused to work: the keyboard would still be in QWERTY mode. One time I got frustrated and rebooted the machine after running my Registry patch, and what do you know? When the machine came up again it was now using the US-Dvorak keyboard layout!

    My theory is: Registry patches change the copy of the Registry on disk: the SYSTEM.DAT file. But Windows keeps another copy of the Registry in RAM, and you can't change that -- at least, not with REGEDIT patches. You can change it with the Control Panel, of course, but if you want to install Registry patches the way I did, all you can do is reboot so that the RAM copy gets reloaded from the on-disk copy.

    If anyone's experience contradicts mine (in other words, if you've been able to make on-the-fly changes to the Registry with REGEDIT), I'd love to hear from you.
    -----

  7. Re:These are inevitable on Major Security Flaw in IIS4.0 · · Score: 1
    Namely, once code is made public the crackers can rummage through it as well, and possibly find holes they would not otherwise have known about.

    This is the old "security through obscurity" argument which has been proven false many times. I don't know off-hand what the arguments are (a little research on "security through obscurity" should help you learn more), but basically they boil down to this: the competent "bad guys" already know about the security holes, and the incompetent ones probably won't learn anything from the source. BUT the competent "good guys", having neither as much time nor as much incentive to go cracking through closed-source programs as the "bad guys", will be able to poke at the programs once the source code is made available.

    Oh yeah, and one more argument against "security through obscurity" -- the most telling one, IMHO. If you're afraid that revealing your source code will let thousands of "bad guys" find all the security holes in it, what do you do when (not if, when) someone compromises your system's security and obtains a copy of it? Are you going to recall the thousands of copies of your program that you already sold? Not if you're a company with a reputation to protect. No, you're going to cover it up and keep it quiet. Meanwhile, the "bad guys" will be sharing the knowledge of the security holes, and the "good guys" won't know how to protect themselves.

    There is no way to be 100% certain that a product is bug-free and security hole-free. But if the source is available and has been poked at for a long time by thousands of experts, you can get pretty close to 99% certainty.
    -----

  8. BeOS has a chance... on Dangers of Typecasting OSes · · Score: 2
    How many of you have used OS/2? I've never had a chance to use it, but from all I've heard, the OS/2 Workplace Shell (WPS) was a marvel of good UI design. Unfortunately, it seems to be dead. Sure, some people still use it, but I think I'd have a hard time finding a copy of OS/2 for sale at $LOCAL_COMPUTER_STORE. Let alone finding enough useful applications for it...

    The reason I bring up OS/2 is because I think BeOS has a chance of avoiding what brought down OS/2. Granted, some of what brought OS/2 down is that IBM did a sloppy job of marketing it (or so I've heard). But another problem was that Microsoft successfully altered people's perceptions to see Windows as a "standard" part of their PC, and OS/2 a useful "extra", or an "alternative" OS. These days, Linux (with the help of Linux users and advocates) has been altering people's perceptions and they are realizing that Windows doesn't necessarily have to be their OS by default. It's my hope that the success of Linux will be the wedge to drive open the OS market, making products like BeOS available for those who just want their computer to work and don't want to spend fifteen hours poking around inside the nuts and bolts.

    What I'd like to see is for Linux to bring about a new OS market in which competition can flourish. Of course, what I'd really like to see is for an open-source "category killer" to arise in the OS arena (similar to sendmail, for example) but that doesn't seem likely to happen anytime soon. In the meantime, I hope BeOS succeeds.
    -----

  9. No, they have a choice on More Linux Coverage in the News · · Score: 1
    The difference between the Open Source model of buying support and the "Protection Rackets" you mention is that under the Open Source model, nobody's going to come and break your kneecaps if you don't buy support. :-)

    Seriously, though, you don't have to buy a tech-support contract. If you have someone who has the know-how to read the source and understand it, you can do your tech support in-house and save money on a tech-support contract. (You'll still be paying the salary of your in-house employee, of course, but one person will probably be able to handle several pieces of software in that respect). And, (warning! Generalizations ahead!) since open-source software usually tends to be of a higher quality than proprietary software, you won't need as much technical support anyway.

    As for the worldview/religion aspect of it, well, most long-time Open Source advocates do admit exactly that. Consider the fact that the emacs vs. vi flamewars are usually referred to as "religious wars", for example. (ObFlameBait: Down with bloatware! Long live vi! ;->)
    -----

  10. Sid Meier on Sid Meier's Civilization III -- announced! · · Score: 1

    I was reading an interview with Sid Meier sometime last year (don't remember where) and they had a list of the games he's done. Now my method of buying commercial games (as opposed to shareware) is: I won't buy a game until I've had a chance to play it on someone else's computer or something and I know that it will last me quite a while. Well, looking over the list of games Sid Meier has done, I discovered that with the exception of Dune 2, every game (non-shareware) that I have purchased in the past was done by Sid Meier. Oh yeah, and Starflight -- he didn't do that one either. But yeah; if it has Sid Meier's name on it, you know it'll have good gameplay. Course, I never played Colonization, but still, Sid Meier is a pretty safe bet.
    -----

  11. Re:1 billion! on Slashdot's One Hundred Millionth Page · · Score: 1
    Whoops! Let's try again:

    One hundred hundreds = 100 x 100 = 10,000 = ten thousand. And the American system does makes sense:

    1,000,000 = 1 million
    1,000,000,000 = 1 billion
    1,000,000,000,000 = 1 trillion
    1,000,000,000,000,000 = 1 quadrillion
    1,000,000,000,000,000,000 = 1 quintillion

    etc.
    -----

  12. Re:1 billion! on Slashdot's One Hundred Millionth Page · · Score: 1

    One hundred hundreds = 100 x 100 = 10,000 = ten thousand. And the American system makes sense: 1,000,000 = 1 million 1,000,000,000 = 1 billion 1,000,000,000,000 = 1 trillion 1,000,000,000,000,000 = 1 quadrillion 1,000,000,000,000,000,000 = 1 quintillion etc.
    -----

  13. Re:Stars! The purist turn-based multiplayer game on Review: Civilization:Call To Power · · Score: 1
    You forgot to mention the Stars! website, Waypoint Zero, where you can download a demo. The demo limits you to tech level 10 in all six research fields and the game ends at turn 80. It's a good introduction to this (far too addictive) game. For a huge list of other Stars!-related websites, see the Stars! Websites page on Waypoint Zero. Stars-R-Us is a particularly good one (yes, for once a *good* website in the AOL.COM domain!).

    Another good place for more information about Stars! is the rec.games.computer.stars newsgroup. There you can talk to other people about Stars! strategy, find out about new multiplayer games starting (the usual method is to play one turn per day, sending in the turn files by E-mail. There are also "blitz" games played in about 4 hours on IRC somewhere -- the channel is #Stars! and the server is StarLinkIRC (*not* StarLink), although I could be wrong about those because I haven't been there too often) and read humbling posts by the "greats" of Stars! such as Jason Cawley (hi Jason!) and others. By the way: before you join any multiplayer guide, read the Stars! Strategy Guide, otherwise you will get yourself creamed in your first game.

    How addictive is this game? Let me put it this way: whenever I click on the URL box in Netscape to type in a URL, I have to restrain my fingers' urge to automatically type "www.webmap.com/stars/websites.htm".

    And the authors, Jeff and Jeff (known as "the Jeffs" or "Jeff^2" on the newsgroup) have the best response time I've seen of any closed-source project. Despite the fact that they're trying to devote their entire time to Stars! Supernova (the next version of Stars! which will have fancy graphics and introduce some pretty major play changes), they still respond with new patches not only to bug reports but also to game-balance issues!

    Summary: Get Stars!. Read the Strategy Guide. Read the newsgroup.. Play the game. Be happy.
    -----

  14. Microsoft History (TM) on Heroes of the Computer Age · · Score: 2

    Did you catch the link in the URL section at the bottom to Microsoft's computer history timeline? Still hasn't loaded for me yet, so I can't say anything about it, but it oughta be interesting to compare what Microsoft considers worthy of inclusion to what we would consider worthy of inclusion...
    -----

  15. Re:So, how strong is SSL? on Shamir's new Crypto Gadget · · Score: 1

    I'm no cryptography expert, but I do know this much: 128-bit RC4 is not the same as 128-bit DES, or 1024-bit DES. While 512-bit DES may soon be compromised, and 56-bit RC4 (or was it RC5?) has been compromised (distributed.net cracked the latest 56-bit RC5 (RC4?) contest in under 24 hours, IIRC), 128-bit RC5 (RC4?) is still unbreakable for all practical purposes.
    -----

  16. "Can" != "Does" on Deja News Privacy Questioned · · Score: 2
    There's a world of difference between can and does. Yes, the sysadmin can see who you're sending E-mail to. He can even read your mail if he wants to. However, he doesn't. Why? If he's a decent person (which he hopefully is), it's because he respects your privacy. If he isn't that decent, then it's because company policy forbids it and he would get fired if anyone found out -- and someone would eventually find out.

    Shoot, the sysadmin can even delete all your files if he wants to. "What was your username again? *clickety-click*". But he doesn't. Logfiles aren't necessarily a privacy invasion; it's only a privacy invasion if inappropriate use is made of those logfiles. Using them to track down a spammer would be appropriate use. Using them to sell info to advertising companies would be inappropriate use.

    BTW, by using the pronoun "he" for sysadmins I do not mean to imply that all sysadmins are male. It's just more convenient to use the generic "he".
    -----

  17. Congratulations. You are very wise. on More Stories From The Hellmouth · · Score: 1
    For me, I need to take the time and find something that I really love to do, something that I can define by being who I am instead of something that defines me by being what I do.

    Congratulations. With that attitude, you will be successful. Not the kind of "success" defined by the "score-keeping" culture, but real success: being satisfied with your life. And if you continue to approach life this way, at the end of your life you'll look back and say, "If I had to do it over again, would I change anything?" And you'll find the answer is no.

    The key here is that I have come to understand that this approach to life is not for everyone, in fact it may not be right for anyone besides me.

    I respectfully submit that you're dead wrong. :-) This is the right approach to life. That's what "Live each day as if it were your last" is trying to say, that's what the quote you quoted "... in 100 years the world may be a better place because I made a difference in the life of a child" is trying to say. That's what Bill Watterson was trying to say with the Calvin and Hobbes comic in which Calvin comes in after a summer day and says, "My philosophy is, if you don't have grass stains on your knees by the end of the day, you haven't been playing hard enough." And if you ask anyone aged, say, eighty-five or more, they'll tell you the same thing in their own words. The sad thing is that too many people never realize this until they're on their deathbeds, filled with regrets. They buy the lie that gets fed to them over and over by every aspect of modern, materialistic American culture. "Money is god! Come worship at the altar of the great god Mammon!" (To use the archaic term from the King James Bible). And they blindly bow with everyone else, only to realize that they've been worshipping a god that does nothing but devour their lives, their families, and their happiness, and gives nothing back in return. This is a real tragedy.

    Wow, my language was getting kind of religious there towards the end. I guess my Christian worldview is showing. Anyway, I'm glad you've seen through the lie, and I hope and pray that others will too.
    -----
    The real meaning of the GNU GPL:

  18. Cable Modems vs. *DSL on Get a Cable Modem...Go to Jail · · Score: 1
    With a cable modem, aren't you sharing bandwidth with all your neighbors (since the neighborhood or apartment is usually on the same subnet)? Whereas with DSL, I believe the bandwidth you pay for is yours alone. If I'm wrong, please correct me. But if that's the case, that's yet another reason I'd prefer DSL over cable modems: my connection won't slow when my neighbors sign up.

    ObSlashdot: Rob, WHY is there a banner ad for Microsoft Exchange Server showing up above the "Post" page as I type this? I'm getting worried... :-)
    -----

  19. Yes! No TV! on Television That Watches You · · Score: 1
    <revival-meeting> Amen! Preach it, brother! &lt;/revival-meeting&gt;

    Seriously, I don't own a TV and don't intend to buy one after I graduate from college, either. I might get one with a VCR to watch movies, but I won't even have an antenna to receive broadcast channels, let alone cable. If there are any shows I consider decent enough to watch (e.g., B5), I'll just get a tape from my friends.

    While we're on the subject... April 22-28 is TV Turnoff Week; see the Adbusters site or the TV Turnoff page for more information.
    -----

  20. Otherwise a good article on Linus & Maddog on panel with MS and DH Brown · · Score: 1

    Actually, apart from Ewel's comments, the article was pretty good. They did a good summary of the history of Linux, giving credit to both RMS and Linus for their respective shares of the work. (I thought RMS started the FSF earlier than 1984, but that's the only mistake I found).
    -----

  21. Speaking of Device Drivers... on Gates: "Linux Can't Compete" · · Score: 1

    And, as someone else (also named Robin, apparently -- Hi Robin! :^)) pointed out, this won't do you any good unless those drivers you downloaded were drivers for Linux. Win 98 drivers won't do you any good.
    -----

  22. Speaking of Device Drivers... on Gates: "Linux Can't Compete" · · Score: 1
    Right, let me see if I can help. When you say you have a zip disk on the Linux computer, I assume you mean you have a zip drive. I'll further assume that you have your zip drive set up correctly under Linux (if you need help setting up your zip drive, see the Linux Parallel Port Homepage at http://www.torque.net/parport/, or the Zip Drive Mini-HOWTO at http://njtcom.com/dansie/zip-drive.html).

    Basically, all you're asking is: can Linux read a zip disk that's been written under Windows 98? Short answer: Yes. (I've done it myself with Syquest SparQ disks). Long answer: All you need is to have the appropriate filesystem support (I think vfat is the one you want in this case) compiled into your kernel, and it's the rare distribution that wouldn't have that compiled in these days... Just do a mount -t vfat /dev/pda1 /mnt/zip (replacing /dev/pda1 with your ZIP drive's device name if it's different, and /mnt/zip with whatever mount point you choose). Voila! You can read all the files on your Win98-created zip disk.

    Now if you need help with the drivers once you've got them on your system, or with setting up X, I'm afraid I can't help you. I'd suggest you try the comp.os.linux.x newsgroup in that case. But hopefully this will get you started.

    HTH. HAND.
    -----

  23. Enough with "Halloween"... on ESR responds to Ed Muth · · Score: 1

    All very well and good, and I don't have any nits to pick with the response. But enough with the "Halloween" titles already! It's starting to sound like the umpteenth sequel of a boring, predictable horror flick. (There probably is a horror flick called "Halloween [some Roman numerals]" out there already, in fact -- I just haven't seen it and have no desire to. Let's try to be more creative with our titles next time, eh? :-)
    -----

  24. Waitaminnit... on Microsoft claims Linux provides weak value · · Score: 1

    I'm almost certain I've seen *this* post before, too! "I would given a medal..." [sic]. This is another copy&paste troll. He's submitted the same thing multiple times before, AFAIR (As Far As I Recall).

    Whatever. People have already answered this one. I'm not even going to bother.
    -----

  25. Again? It's the Energizer Post! :-) on Microsoft claims Linux provides weak value · · Score: 1

    Hey, have any of you noticed something about this particular AC? He's posted the *EXACT SAME THING* (spelling mistakes and all) on all the recent Microsoft discussions. Go back and search through old Microsoft articles for yourself: notice "trail" instead of "trial" and "PED" instead of "QED". This guy blitzed out an astroturf (note "good for the consumer", "innovative and bright people" -- obvious Microsoft buzzwords) post and is pasting it in every time he sees a Microsoft discussion.

    This guy's a Microsoft employee doing the "astroturf" campaign. Ignore him.
    -----