It's not that easy. East Germany didn't slaughter many priests and nuns (just made their lives really hard), and now it's the most atheist region of the world, with more than 60% of the population not reporting any religion at all (next in line is Israel with 25% atheists).
L4 is a minimal kernel, it only covers task switching, inter process communication and context protection. Everything else, including memory management, is done by the Linux kernel, which sits on top of L4 and is just modified to hand off task switching and IPC to L4.
And there was me thinking that this is one of the reasons we have judges at all: Telling an erring party that it is indeed erring and ordering it to stop.
I mean, they actually bugged the laptops of children to spy on them in their homes! The who kids accepted that... what kind of adults do you think they're going to become?
If I followed the case correctly, then none of the kids accepted that. In fact it was discovered only because the principal showed a picture taken of the pupil to claim "inapprobriate behaviour". And now the school district is telling everyone they are so sorry that they didn't tell anyone about the remote webcam activation feature.
Those systems are old, indeed. Some of them are twenty years old (not the ones with the Java based interface though;) ). But - they are not software, they are not computers, they are hardware for 24 V, 48 V and 60 V systems with a little bit of software to configure and administer them. And they are owned by the customers we sell our services to. Tell the customer that he has to shred 26 expensive systems because we have issues with IE6! Tell the other one that his large electrical installation which covers several blocks is rubbish, because we have issues with IE6! The electrical part of the installation works completely fine, and there are no known issues. Only the configuration interface is "outdated" by the standards of a network which has no connection at all to those systems.
Moreso if anyone ever is able to detain the author and the deployer of the software and the operator of the botnet, then the nicknaming of it will be the least of their problems.
My corporate laptop is chained to IE6 because lots of the systems I administer have Java and JavaScript based configuration interfaces which only works with IE6. It fails on alternate browsers and even IE8 has issues (not to mention the fact that you have to have Java 1.4, Java 1.5 and Java 1.6 installed in parallel and switch to the right one for each machine).
I just checked: The shelf in front of the african coast is very narrow, and more than 200 m are reached just 20 nm off the shore. Crete itself doesn't have a shelf at all, directly off the coast it goes down to 500 m.
Currently the north shore of Africa is about 200 miles from crete, but what they seem to have failed to take into account (or at least mention in the article) is that in ancient times sea levels were much much lower.
They did. Because the Mediterrean is very deep (average ~1500 metres), especially in the southern part, lowering the shore line doesn't do very much to the distance.
Most problems arise because your program code is not the one that is actually evaluating the input. If you feed for instance a field content which you expect to be a name into a database, then it's the database actually doing the evaluation. It's easy to forget in such a situation that you still have to check the input for sanity, because it's not your code that throws up if the input is malformed.
But it's your coding responsibility what you feed to your backend. Just throwing stuff at it and hoping the error handling of the backend will take care gets you into trouble. I also know that many of us somehow take pride if our input routines somehow make sense of any input, and if someone tries an SQL injection they actually want their programs jump to the "Error: SQL injection attempt!" routine.
But as much fun it is to play silly buggers with potential attackers, I think it makes more sense to stupidly filter out anything that you don't expect. You don't need to outright reject the whole input, but if you just ignore anything that is not [0-9] in my example, e.g. interpreting "1); DELETE * FROM table_1" as "11", you get a program which is very tolerant with user input and still doesn't risk any attacks.
In your special case you wanted your files to be unique, and yet you didn't handle your input accordingly. If you want elements to be unique you have to handle each element separately. So either you handle only one image per message (and either reject all messages with more than one image or stop processing after the first image decoded), or you break down your input into the single elements before feeding them to the storage.
It's fine to say "don't trust user input", but it's pretty much impossible to actually make sure that you've accounted for all possible ways it can be faulty, and this becomes harder the more powerful the program is, since using that power requires more complex input.
It is nearly impossible if you want to enumerate all possible ways input can be wrong. Thus you should just enumerate all ways input is right. If you expecting for instance numerical input, don't look for ";" or ")" or anything that could have been inserted maliciously. Just throw everything away that doesn't fit [0-9]*. You know the input your program can work with. So instead of trying to formulate rules how input may differ from the input you want to catch errors, write down the rules the input has to follow and reject everything else. This is straightforward.
Hm. I never thought DoS attacks would be limited to saturating the requested resource. I always understood that intentionally denying access to the resource in a malicious way was the DoS attack.
In Germany and other EU countries there is special wording in the Author's Right (Urheberrecht) to protect databases even if the single entry in the database is not protected. So while in Germany facts are not protected by the Author's Right, databases of facts are.
Interestingly though since the addition of databases to the Author's Right in the 90ies the market share of EU based companies for databases has dwindled. This is probably pure coincidence.
Someone who needs twice the performance, where double the space costs more than the money saved on MicroTech's offering, and where the processor is only a small fraction of the overall cost.
From an artistic point of view, it is drawn when the intent is to deface or damage instead of create.
I would object to that line. There is something called creative destruction. There are artworks whose purpose it is to be destructed. And I know several ruins which were actually built to be ruins.
If you are in some way responsible for your risk (e.g. you can migitate the risk by adopting your life style) then I am all for calculating it into the price of your individual health care coverage.
There is a big caveat though: How do you separate between the component you don't have any influence on and the component solely under your influence? And how do you measure both in a way that it can be put down in a contract? Human health is very complex, and one action that seems to increase your individual risk can be considered beneficial to the health of another person. Do you get an individual "do/don't" list of things you can do and others you have to do and those you have to avoid at all costs? We don't even know exactly what type of diet actually makes us healthier on average. How do you factor the individual diet into the insurance equation? Shall people exercise? How much? I have arthrosis in both knees because of overexercising in my youth. Should I have gotten a more expensive plan because of my exercises, or should it actually have been cheaper than average because I was exercising (which surely befitted my overall health)?
Aborting a fetus rather than having a baby you can't properly care for, is responsible behavior. (Of course using contraception and not getting pregnant in the first place is even more responsible.)
But what is trying again and again and aborting the fetes until one comes along to your liking?
The problem - the estimated costs for care in the future is directly related to your genetic disposition. The second company advertises that they will do exactly what the first company does - only with other words.
Slashdot Mirror
I wonder how East Germany continues to exist, given that 60% of the populace there is not affiliated with any religion at all.
I heard they even have an application^W religion for that.
It's not that easy. East Germany didn't slaughter many priests and nuns (just made their lives really hard), and now it's the most atheist region of the world, with more than 60% of the population not reporting any religion at all (next in line is Israel with 25% atheists).
L4 is a minimal kernel, it only covers task switching, inter process communication and context protection. Everything else, including memory management, is done by the Linux kernel, which sits on top of L4 and is just modified to hand off task switching and IPC to L4.
And there was me thinking that this is one of the reasons we have judges at all: Telling an erring party that it is indeed erring and ordering it to stop.
I mean, they actually bugged the laptops of children to spy on them in their homes! The who kids accepted that... what kind of adults do you think they're going to become?
If I followed the case correctly, then none of the kids accepted that. In fact it was discovered only because the principal showed a picture taken of the pupil to claim "inapprobriate behaviour". And now the school district is telling everyone they are so sorry that they didn't tell anyone about the remote webcam activation feature.
Those systems are old, indeed. Some of them are twenty years old (not the ones with the Java based interface though ;) ).
But - they are not software, they are not computers, they are hardware for 24 V, 48 V and 60 V systems with a little bit of software to configure and administer them. And they are owned by the customers we sell our services to. Tell the customer that he has to shred 26 expensive systems because we have issues with IE6! Tell the other one that his large electrical installation which covers several blocks is rubbish, because we have issues with IE6!
The electrical part of the installation works completely fine, and there are no known issues. Only the configuration interface is "outdated" by the standards of a network which has no connection at all to those systems.
Moreso if anyone ever is able to detain the author and the deployer of the software and the operator of the botnet, then the nicknaming of it will be the least of their problems.
That's why I called it the corporate laptop, because there I can't (officially at least).
My corporate laptop is chained to IE6 because lots of the systems I administer have Java and JavaScript based configuration interfaces which only works with IE6. It fails on alternate browsers and even IE8 has issues (not to mention the fact that you have to have Java 1.4, Java 1.5 and Java 1.6 installed in parallel and switch to the right one for each machine).
I just checked: The shelf in front of the african coast is very narrow, and more than 200 m are reached just 20 nm off the shore. Crete itself doesn't have a shelf at all, directly off the coast it goes down to 500 m.
Currently the north shore of Africa is about 200 miles from crete, but what they seem to have failed to take into account (or at least mention in the article) is that in ancient times sea levels were much much lower.
They did. Because the Mediterrean is very deep (average ~1500 metres), especially in the southern part, lowering the shore line doesn't do very much to the distance.
No, the bridge was built by apes.
Most problems arise because your program code is not the one that is actually evaluating the input. If you feed for instance a field content which you expect to be a name into a database, then it's the database actually doing the evaluation. It's easy to forget in such a situation that you still have to check the input for sanity, because it's not your code that throws up if the input is malformed.
But it's your coding responsibility what you feed to your backend. Just throwing stuff at it and hoping the error handling of the backend will take care gets you into trouble. I also know that many of us somehow take pride if our input routines somehow make sense of any input, and if someone tries an SQL injection they actually want their programs jump to the "Error: SQL injection attempt!" routine.
But as much fun it is to play silly buggers with potential attackers, I think it makes more sense to stupidly filter out anything that you don't expect. You don't need to outright reject the whole input, but if you just ignore anything that is not [0-9] in my example, e.g. interpreting "1); DELETE * FROM table_1" as "11", you get a program which is very tolerant with user input and still doesn't risk any attacks.
In your special case you wanted your files to be unique, and yet you didn't handle your input accordingly. If you want elements to be unique you have to handle each element separately. So either you handle only one image per message (and either reject all messages with more than one image or stop processing after the first image decoded), or you break down your input into the single elements before feeding them to the storage.
It's fine to say "don't trust user input", but it's pretty much impossible to actually make sure that you've accounted for all possible ways it can be faulty, and this becomes harder the more powerful the program is, since using that power requires more complex input.
It is nearly impossible if you want to enumerate all possible ways input can be wrong. Thus you should just enumerate all ways input is right. If you expecting for instance numerical input, don't look for ";" or ")" or anything that could have been inserted maliciously. Just throw everything away that doesn't fit [0-9]*.
You know the input your program can work with. So instead of trying to formulate rules how input may differ from the input you want to catch errors, write down the rules the input has to follow and reject everything else. This is straightforward.
They never have been. That's why they are called "brands" and not "manufacturers".
Hm. I never thought DoS attacks would be limited to saturating the requested resource. I always understood that intentionally denying access to the resource in a malicious way was the DoS attack.
In Germany and other EU countries there is special wording in the Author's Right (Urheberrecht) to protect databases even if the single entry in the database is not protected. So while in Germany facts are not protected by the Author's Right, databases of facts are.
Interestingly though since the addition of databases to the Author's Right in the 90ies the market share of EU based companies for databases has dwindled. This is probably pure coincidence.
Someone who needs twice the performance, where double the space costs more than the money saved on MicroTech's offering, and where the processor is only a small fraction of the overall cost.
From an artistic point of view, it is drawn when the intent is to deface or damage instead of create.
I would object to that line. There is something called creative destruction. There are artworks whose purpose it is to be destructed. And I know several ruins which were actually built to be ruins.
If you are in some way responsible for your risk (e.g. you can migitate the risk by adopting your life style) then I am all for calculating it into the price of your individual health care coverage.
There is a big caveat though: How do you separate between the component you don't have any influence on and the component solely under your influence? And how do you measure both in a way that it can be put down in a contract? Human health is very complex, and one action that seems to increase your individual risk can be considered beneficial to the health of another person. Do you get an individual "do/don't" list of things you can do and others you have to do and those you have to avoid at all costs?
We don't even know exactly what type of diet actually makes us healthier on average. How do you factor the individual diet into the insurance equation? Shall people exercise? How much? I have arthrosis in both knees because of overexercising in my youth. Should I have gotten a more expensive plan because of my exercises, or should it actually have been cheaper than average because I was exercising (which surely befitted my overall health)?
Can you trust anybody?
The whole point of trust is that it relies on unproven assumptions.
Aborting a fetus rather than having a baby you can't properly care for, is responsible behavior. (Of course using contraception and not getting pregnant in the first place is even more responsible.)
But what is trying again and again and aborting the fetes until one comes along to your liking?
The problem - the estimated costs for care in the future is directly related to your genetic disposition. The second company advertises that they will do exactly what the first company does - only with other words.