Slashdot Mirror


User: bcrowell

bcrowell's activity in the archive.

Stories
0
Comments
3,732
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,732

  1. slashdot not filtering well enough on Linux Kernel 2.6 Local Root Exploit · · Score: 3, Insightful

    It seems to me that slashdot's system for filtering submissions is doing a very poor job these days with stories about security bugs.

    Within the last day or two, we've had the following:

    1. Adobe PDF Exploits In the Wild - IMO this was not sufficiently well thought out to be useful. There has been a long series of problems with AR related to the fact that it allows javascript in pdf files to be executed, and that leads both to privacy problems (authors can track readers) and security problems (buffer overflows). But the article didn't specify whether it was such a problem. If it is such a problem, then the correct solution is to disable js in AR. In fact I'd already done that in AR 7, but if I'd blindly followed the advice from the article, here's what would have happened. I would have just upgraded to AR 8 and assumed the problem was fixed. But upgrading to AR 8 reenabled js, so in fact I'd be less secure than I'd been before.
    2. Serious Vulnerability In Firefox 2.0.0.12 -- Turns out to be FUD.
    3. OpenBSD Will Not Fix PRNG Weakness -- Possibly of interest to openbsd users, but basically what seems to be happening here is that each BSD's maintainers are making their own judgments about how serious the problem is, and the seriousness of the problem is a complicated and controversial question.
    4. Linux Kernel 2.6 Local Root Exploit -- The summary makes it sound as though this affects Ubuntu, but later on we get this post pointing out that it doesn't affect a default install of Ubuntu.

    This is really getting to be a Boy Who Cried Wolf thing.

  2. Re:Not exactly.... on Serious Vulnerability In Firefox 2.0.0.12 · · Score: 1

    That's why there are really serious portability problems with closed source companies providing plugins compiled only for a handful of operating system (often without 64bits support).
    I keep hearing slashdotters complain about this, and it totally baffles me. I have an x64 system, and binary plugins (flash, java, ...) work fine for me. X64 is compatible with x86. Is there some issue I'm not aware of?

  3. disable javascript on Adobe PDF Exploits In the Wild · · Score: 4, Informative

    The article doesn't say explicitly, but I'm assuming this is related to the fact that the default configuration of AR will execute javascript that's embedded in pdf files. This is both a privacy issue (people can track readers) and a security issue (more than one stack overflow bug has been discovered that's related to js). To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

    There have been a lot of posts along the lines of "why the hell even use AR?" Well on Linux, I actually have Firefox set to open pdf files in xpdf, because it's faster, and I also habitually use xpdf to view pdf files when I'm not in a browser. (Evince is a little slower, but a little more full-featured and modern.) But I also have a copy of AR 8 installed on my Linux box, because it has some features that I find really useful once in a while, and also I want to be able to test my pdf files sometimes and make sure they'll look right for AR users. It's one of only two proprietary apps I have on my machine, the other being Flash. It would be great if the OSS community could produce a pdf viewer that was just a little more full-featured than Evince. (Flash is a whole different issue -- many of the things Gnash can't do, it can't do because of patents.)

  4. different bugs on Torvalds On Desktop Linux's Slow Uptake · · Score: 4, Insightful

    This is the argument Linus makes in the article. I agree with it to some extent, but I also think the way he presents it is a little misleading. He makes it sound like Windows and Linux are just different, so there's absolutely nothing the Linux community can do to encourage adoption of Linux on the desktop -- it's all a matter of users' ingrained prejudices. But Windows and Linux aren't just different by design, they're also different in terms of their bugs. If you use Windows as your desktop, you encounter bugs. If you use Linux as your desktop, you encounter bugs. For instance, I've just spent half an hour this morning dealing with an issue in CUPS where every time I boot my Linux box, it starts spewing page after page of raw postscript. (Deleting the job from the queue didn't help. It just reappared the next time I booted the machine.) Well, this is a bug that I know about now, and I have workarounds for it. (Delete the printer and then reinstall it in CUPS's web interface.) Bugs in the Windows desktop aren't a strong motivation for Windows users to switch to Linux, because they're used to those bugs, never really think about them much. But if they were to try Linux, they'd say, "Oh my god, this OS is a total piece of crap. Look at the printer spewing page after page of garbage, and it starts again every time I reboot. This is pathetic. I'm sticking with Windows." They notice the Linux bugs more because they're unfamiliar and mysterious, and also when you switch OSes, you get hit with lots of these new and unfamiliar bugs all at once.

    So it's not just a matter of user preference, and it's not something that's outside the control of developers in Linux's OSS ecosystem. The quality of the Linux desktop sucks -- sometimes I think it sucks almost as much as the quality of the Windows desktop -- and it needs to be improved. If that happens, it will increase adoption of Linux on the desktop.

  5. Re:Hmm? on Online Parent-Child Gap Widens · · Score: 2

    Yeah. As a parent, it also strikes me as pretty silly to lump together ages 9-18. Nine is way different from 18.

    'The child needs similar tools that teach them to be [wary] of dangers in the park, the mall or wherever. The same rules in the real world apply online as well.'
    I'd rather have my kids out on the sidewalk getting some exercise and fresh air than have them cowering in their bedrooms, being afraid of child molesters lurking behind bushes. I don't want my kids to be wary. I'd like to teach them to be adventurous, inquisitive, and independent. My 8-year-old fell off the bars at school a few weeks ago and broke her arm. It's just part of growing up.

  6. Re:Sure... on US Pulls Plug on Low-CO2 Powerplant Project · · Score: 1

    And it's only available 12 hours a day
    Those 12 hours happen to coincide with peak demand for electricity. Most people aren't using electricity at 3 am.

    costs a fortune to tap
    Depends on where you live, which way your roof faces, and how much shade you have on your roof. I have photovoltaics on my roof, and it was quite a reasonable investment, given the high electric rates in my area, and the sunny weather we have. If you live in Nova Scotia, your roof faces east, and you have trees shading your roof, then no, it's not a good deal.

    and battery backup is extremely expensive
    My system produces more energy during the day than I use, and at night I get my power from the grid. No need for battery backup. It's a great deal for the utility to be able to use residential and business PV systems for load balancing. We produce our excess when they need it, and get some energy back from them when they have excess capacity. The only people who buy non-grid-tied PV systems, with batteries, are people who live in extremely remote rural areas, where the grid isn't available. Those of us who are on the grid don't buy batteries and don't need them.

    Please go away and actually do some research into the costs of the various energy options
    I think you're the one who actually hasn't done your research, and your tone is offensive. How about a little civility?

  7. Re:Tk on Desktop Environment for Proprietary Applications? · · Score: 1

    I'm not sure what you mean by "handles pointers as if this was 1978", unless you're talking about pre-unsigned code that used (char *) as an integral type to get unsigned integers.
    I mean being very sloppy with pointers, and not using any systematic approach to memory management. Back then, the attitude used to be that if your program crashed, it was no big deal, because you could just restart it. That changed a lot with the advent of the internet, when people started to realize that those coding practices created huge security problems.

  8. Re:Tk on Desktop Environment for Proprietary Applications? · · Score: 4, Interesting

    Hmm...so are you advocating writing GUI apps completely in Tcl, or writing the app in some other language, but doing the GUI parts in Tk? From what I've heard, Tcl itself is a reasonably nice language. But personally I don't want to learn a whole new language just so I can use a particular GUI toolkit, and if I'm going to write my app in a scripting language I'd prefer to use Perl or Python, due to their excellent, comprehensive libraries.

    I've done a Perl/Tk GUI app, and my experience was decidedly a mixed bag. On the one hand, I found it very pleasant and efficient to code to the Perl/Tk interface. On the other hand, I ran into some major issues with code quality and the fact that nobody is actively maintaining the code base. If you look through the Perl/Tk source code, you see page after page of C that handles pointers as if it was still 1978. This led to one major snafu that made me decide never to touch Perl/Tk again: there was a null-pointer bug that interacted badly with a GTK release that came out ca. 2005, causing Perl/Tk applications to crash randomly. I submitted a patch, but it took ages for it to be applied, and during that time all Perl/Tk apps were crashing frequently on, e.g., all the recent releases of Ubuntu.

  9. Re:Never attribute to malice... on Time Warner Filtering iTunes Traffic? · · Score: 1

    As a TW customer, the stupidity hypothesis works for me. Unfortunately TW has a broadband monopoly where I live. If they didn't, I would have dumped them long ago, because we've experienced constant intermittent connectivity problems for years now, which they've never been able to solve. I suspect they're simply oversubscribed and/or incompetent.

  10. wrong question on Best Super Tuesday Candidate for Technology? · · Score: 3, Insightful

    It's disturbing to me that anyone would even think of basing their vote in this presidential election on tech issues. My god, we're involved in a ruinous war, and when it comes to civil liberties we're sliding down the slippery slope into fascism.

  11. Re:Ron Paul on Best Super Tuesday Candidate for Technology? · · Score: 2, Interesting

    Yeah, I'm a libertarian, but Ron Paul makes me shudder. It was an interesting exercise to go through the US Libertarian Party platform and compare with all Ron Paul's positions that I think are way wrong. On every single one (abortion, free trade, anti-immigrant xenophobia), his positions are the opposite of the party's planks.

  12. Re:It's a race on Python 3.0 To Be Backwards Incompatible · · Score: 2

    And what did that do to perl... Nothing good. Perl was once a really big language use for almost every app out there. Then by the time from the move to perl 6 the apps went away and more Python Apps starting appearing.
    Oh, please. How about not pontificating about things you have actually no clue about. Perl has never been used "for almost every app out there;" its niche has always been CGI and scripting. When you say "by the time from the move to perl 6," it sounds like you're unaware that there's not yet a full implementation of Perl 6. "...and more Python Apps starting appearing" -- you mean in the future, which you're a visitor from?

  13. philosophy on Python 3.0 To Be Backwards Incompatible · · Score: 2, Insightful

    IIRC, even dot-releases of python are not source-compatible. I assume that's why my install of Ubuntu has multiple versions of every library, e.g., /usr/lib/python2.4/smtplib.py and /usr/lib/python2.5/smtplib.py.

    I think this is partly a matter of philosophy. The people in charge of a particular language tend to be computer language enthusiasts, and they like to tinker with them. They say things like, "The language has to be able to continue to evolve, or else it will die," or "We don't want to lock in things that, in retrospect, were really mistakes." But people actually using the language typically put a higher priority on not having their code break. Obviously we wouldn't all want to still be writing old-style fortran, with fixed columns, Hollerith codes, etc., but I also don't agree with the philosophy that "bit rot" is inevitable, and every piece of code you write is like a baby that you have to tend for the rest of your life. Personally, one of the things I really like about Perl is that it's got an excellent, mature implementation, and it's been mature for a long time. This is a lot less true for Ruby, for example, in my experience. It's true that Perl 6 is going to break backward compatibility with Perl 5, but the Perl 6 interpreter is going to automatically recognize Perl 5 code, and handle it correctly.

  14. Re:Scantron on E-Voting Undermines Public Confidence In Elections · · Score: 4, Insightful

    I'm a teacher, and I give scantron tests once in a while. They're extremely error-prone. If you don't fill in the space completely, or if you try to erase and change your answer, it will often grade it wrong, i.e., someone looking at it would say that the student probably intended B, but the machine scored it as D or something. I've been told that the error rates are lower on a carefully calibrated and maintained machine, but ... then we just have to sit around wondering whether Florida went the wrong way because a certain district didn't maintain their scantron machines properly.

    I'd be happy with any system that let me have a printout to take home. I could verify that it really recorded my vote the way I thought. I know there's the argument that this makes it possible to buy people's votes, because the buyer can verify that the seller really voted as he was paid to do. But in fact it's already trivial to buy votes: get the person you're bribing to vote absentee. Voter fraud is one of these silly Republican vote-getting issues (like flag burning) that is a total non-issue in reality. For that matter, let's just do all voting by mail. It's the 21st century, and I don't see any rational reason to make a busy person go to a particular place on a weekday in order to transmit 67 bits of information.

  15. Why should Grandma pay? on Canadian Songwriters Propose Collective Licensing · · Score: 4, Insightful

    Say Grandma has an internet connection, and uses it only for sending email. She lives on a fixed income. Why should she pay $5 a month to subsidize other people so they can get free music by violating copyright? For someone on a fixed income, another $5/mo bill is a significant hit. Maybe that's $5 she could have spent having lunch with her bridge club at IHOP.

    Basically the problem is that copyright is unenforceable, and a majority of the population feels no moral compunctions about violating it. (I happen to disagree with the majority, but that battle is lost, and it's time to move on.) How exactly does it follow from these circumstances that every single member of the population should be forced to pay a subsidy?

    Realistically, the music industry is going to have to shrink. Boo hoo. There's no law of nature that dictates that x% of GDP should be spent on recorded music. A hundred years ago, nobody had recorded music, and the only way you got to hear any was either (a) by making music yourself, or (b) going out to hear a band. Then there was a long period where the default way to get music was to listen to commercially produced recordings, you didn't get much choice because the distribution channels (radio and LPs) couldn't cater to the long tails, and the record companies made out like robber barons. Now we're entering a new period, where the record companies have no legitimate function, and the distribution channels can cater to the long tails. It's just a change that's dictated by technology. The good news is that even if the industry shrinks, cutting out the middleman could actually increase remuneration to artists. We don't need a tax to make that happen.

  16. Re:Will any of them ever match AllOfMp3's prices? on Amazon MP3 Store to Go Global in 2008 · · Score: 1

    I've got a better idea. If you're so interested in compensating the artists, just send the $.90 that you save on the music buying from mp3sparks and send it directly to the artist.
    Is that what you do? If so, then how many times have you done it?

  17. Re:"out of date"? on New VIA x86 CPU Takes Aim At Intel Silverthorne · · Score: 1

    Also the gOS boards are quite nice, though at micro-ATX are harder to fit in to a low power solution.
    One of the things I appreciate about my daughter's gPC is that the power management stuff mostly works. That's a lot better than the typical experience I've had with Linux power management, where basically nothing works.

  18. shielding on Cell Phone Radiation Detectors Proposed to Protect Against Nukes · · Score: 1

    "It's impossible to completely shield a weapon's radioactive material without making the device too heavy to transport," Jenkins said.
    Doesn't make much sense to me. Alpha particles with typical energies are stopped by a few inches of air. Last time I checked, air was pretty light. Betas will stop in a piece of paper or cardboard. Yeah, you'd have to find a source that only emits alphas and/or betas and/or low-energy x-rays, and no gammas. That doesn't seem like it would be difficult at all. We have a polonium-210 alpha source at work, and when I put it inside a wooden box, 100% of the alphas are stopped, and you can't detect any counts above background with a Geiger counter. Okay, now it's a very weak source, whereas the source they'd use for a dirty bomb would be millions of times stronger. The WP article on Po says 210Po does emit some gammas, and maybe those would be detectable through shielding, if you had a blazing hot source. But the bad guys would have the ability to pick any isotope they wanted. For instance, pick an odd-mass isotope that beta decays with a low Q value, emitting a beta and some low-energy x-rays. There are tons of isotopes that fit that description.

  19. Re:HTML5 is the wrong path on W3C Publishes First Public Working Draft of HTML 5 · · Score: 1

    Anyway, HTML5 doesn't take a position on this XML vs HTML issue -- it defines both an XML syntax and a text/html syntax, and lets the author pick which he prefers.
    What does this mean when it comes to inline MathML? The only reason I care about xhtml is that it's currently the only sane, standards-compliant way to do inline MathML.

  20. Re:Turn turn turn... on Followup On Java As "Damaging" To Students · · Score: 1

    This reminds me of the controversy when Feynman diagrams were first shown. These diagrams were a much simpler way of expressing complex summations - but the old-school (some pretty impressive names) felt that these diagrams were a dumbing-down and that the historical mathematics were the proper way to express these systems.
    Interesting, if true, but I find it hard to believe. Can you give any evidence that this really happened?

  21. regulation, licensing, liability; choices on Geekonomics · · Score: 1

    The /. summary talks about three completely different things: regulation, licensing, and liability. Regulation seems completely nutty to me; legislators don't have the expertise to do it right, and if they do it wrong they could easily, e.g., strangle the open-source movement in the cradle. Licensing historically has has very little to do with safety or quality; in my state, IIRC, hairdressers are licensed, and it's basically a way of reducing competition in the labor pool so that the hairdressers who lobbied for the licensing requirement can make more money. Liability already exists, and has nothing to do with government regulation. If the software in your car malfunctions and you end up a paraplegic, you certainly can sue the company that wrote the software.

    I think the big problem is that the way the software market works, buyers tend to make a lot of bad choices. Often that's because there just aren't that many choices; the MS monopoly means that many people don't perceive any other choices besides windows as being viable. Sometimes buyers make bad choices because they aren't well enough educated about software to know what to look for. People are also reluctant to change once they're locked in to a particular piece of software, even if it's bad. Government intervention isn't going to change any of this.

  22. Re:What's the Goal? on Asteroid Missions May Replace Lunar Base Plans · · Score: 1

    The quote at the end of TFA explains the REAL goal - we need a permanent colony somewhere other than here.
    The quote you're referring to seems to me to be long on sentiment and short on sense. Why do we need such a colony? If it's to provide for the survival of the human race in case of a big asteroid impact, then the relevant timescale is at least thousands of years, so there's no rational reason to spend vast amounts of money to accomplish it within the next 50 years. If you just think it would be cool to have a moon base, then by all means feel free to spend your own money on it, but please don't assume that I want my tax money spent on the modern equivalent of building the pyramids. If we stopped spending such a big portion of NASA's budget on crewed spaceflight, maybe more would be left for uncrewed spaceflight, which actually accomplishes scientific goals.

  23. doable; cold war on Asteroid Missions May Replace Lunar Base Plans · · Score: 3, Insightful

    One big advantage of a crewed mission to a near-earth asteroid over a crewed mission to Mars is that we simply don't have the technology to get to Mars. A transfer orbit to Mars takes 1.4 years (total round-trip time). (This is simply the period of a body in a Keplerian orbit that's tangent to the Earth's orbit at perihelion and tangent to Mars's orbit at aphelion. A spaceship isn't like a car, which takes less time to get there if you drive faster. A spaceship only thrusts with its engines in order to change its orbit.) The big unsolved scientific and engineering problem is how to keep a crew of human beings from getting exposed to unacceptable doses of radiation when they're in Earth-Mars orbital space for that long. The radiation intensity from galactic cosmic rays is much, much higher out there than it is in Earth orbit. Feasible amounts of shielding actually make the problem worse rather than better, because of secondary radiation. According to this article, the duration of a mission to a near-earth asteroid could be 60-90 days, so it avoids this very tough, unsolved problem. There are many other aspects of a near-earth asteroid mission that are also a heck of a lot easier than a Mars mission. You don't have to land in a deep gravity well and then take off again, for one thing. If you look at the history of uncrewed Mars missions, it's pretty damn scary -- the success rate is very low, and that's for missions that don't have to take off and return to Earth, and don't have to provide life support.

    The big question in my mind is what is the rational justification for government-funded crewed spaceflight at this point. There's no scientific justification; uncrewed probes give more bang for the buck. The shuttle's only mission is to go to the ISS, and the ISS's only mission is to give the shuttle somewhere to go. Thirty or forty years ago, this was all basically cold war propaganda stuff. It seems to me that the U.S. is having a hard time dealing with an unanticipated outbreak of peace. The rational thing to do would have been to continue harvesting the peace dividend, start ramping down our foreign military commitments, and let both crewed and uncrewed space exploration make the transition to the private sector. Instead we've been blundering around like idiots with our ridiculously large military, and in terms of space exploration we've been choking the scientifically productive uncrewed program by diverting the available money into extremely expensive projects like the ISS that have no rational justification.

  24. Re:From the article on Bizarre Self-Destructing Palm Tree Found · · Score: 1

    I have some rose bushes in big pots on the balcony of my house, and I can see them in Google Earth. I'm still waiting for the call from a BBC reporter.

  25. Re:Consistent connection on Time Warner Cable to Test Tiered Bandwidth Caps · · Score: 1

    Yeah, same here. I have Time Warner because it's a monopoly in my area. The reliability is just horrible. If they offer me a menu of bandwidth options, I'll happily choose the lowest one, because I simply don't need more. If this new system has the effect of improving reliability, that would be great.