The kind of "leaky sandbox" that we're seeing here was virtually unknown in the '80s and '90s. If a macro language had any kind of ability to work outside the codument layout itself, it was either restricted to applications where it was a moot point (if the preprocessor for your compiler could run scripts... so what, the code in between the preprocessor directives could do anything) or it was a mistake and the abaility was removed when it was discovered (as in the case of ghostscript).
In 1997 Microsoft introduced Active Desktp, which included a deliberately "leaky" sandbox... controls and scripts that were on pages considered "trusted" could get anything up to full local-user access. In addition, Microsoft responded to Word macro viruses NOT by restricting the scripting language in Word (as expected) but by putting in checks to disable the ability to even examine macros if a document seemed suspicious. And they still haven't learned their lesson.
What's worse, this practise is spreading. While nobody has extended this model nearly as far as Microsoft, Firefox XPI installation involves having a web page request installation of unrestricted macros, and Apple lets you run software installers automatically if the user has left "Open safe files after downloading" enabled.
This kind of thing HAS to stop.
If you design an "inherently safe" scripting language, on ethat does not provide any hooks from *within* the documentto even requests the ability to modify mor ethan the document itself, then any security holes are bugs and can be patched without inconveniencing users. More powerful tools should always be run or installed from outside the document, explicitly under user control, and preferably from a version of the application that doesn't include a mechanism to access remote documents and is not ever invoked from a browser or mail program... or any other application intended to work with untrusted documents.
This design, which used to be taken for granted (the idea of an email worm that could even potentially be run by just viewing an email message used to be a *joke*... everyone *knew* that nobody would be stupid enough to make the Good Times virus real) is not "clumsy" or "inconvenient". It's more convenient than the environment we're in now where applications are perpetually bringing up "Hey! I'm about to do someting stupid! You wanna let me?" dialogs that people reflexively swear at as they approve the stupid action.
We need to turn this around, folks. Bring back the sandbox, don't even include the commands to write files in the sandboxed versions of the macro interpreter, and stop turning the Internet into some kind of bad science fiction movie where the earthlings infect the alien computer from a Powerbook.
Don't know about NTerprise but Citrix didn't go out of business.
I see how you misread that... what I meant was "Microsoft bought Citrix and they (NTerprise) went under."
I know ALL TOO MUCH about Citrix, we were using it back when they were working with Tektronix. We ent through all the ups and downs and I was really happy to find a company that DIDN'T use screen scraping.
The problem with the approach Citrix, VNC, and other screen-scrapers is that the server is continually polling to catch updates to the screen and ship the bitmaps over the wire. What made NTerprise so great is that because they were virtualising the GDI calls themselves (like X11, NeWS, and DPS) you had no tearing and no "holidays" in the update, and what you saw on the screen was always in sync with what the application expected to be there.
Microsoft buying out the Citrix technology basically killed them, and with a fundamentally inferior technology.
"When they came after Napster and kazaa, I said nothing, because I was not a Pirate. When they came after Internet Radio, I said nothing, because I did not have a stream. When they came after AM & FM, I said nothing because I was not a DJ. When they came after Picnickers and Sports Fans, I said nothing, because I'm not 'outdoorsy'. What do you mean I gotta pay RIAA for my party music?"
What's wrong with adding a note in your calendar to log back in at 5 months and 29 days to cancel?
What's wrong with NOT STEALING?
If I've paid for six months of service, I've paid for six months of service. The fact that I can come up with a workaround that should keep from getting ripped off for the remaining three months, albeit with a risk of getting charged for another six months, doesn't justify ripping me off.
You might as well say it's OK to steal my car if you can get away with it.
(and before you get on your high horse about copyright violation, in case you were going to try and bring up that hoary old "slashdotters can't make up their mind" schtick, I bought my music collection instead of collecting it over file sharing networks, and I've consistently argued against the bogus "Robin Hood would have ripped off Microsoft" meme)
Hitting command gets control, and control and alt get nothing.
Surely they'll have Mac drivers for this. I mean, given how Apple is able to sell awful hardware to Mac users because it's cool, I suspect the proportion of Mac users who'd go nuts over this is a hundred times greater than PC users.
Even given the market share differnce, that's a good deal.
Good night, does anyone really believe that within Microsoft there are real innovative ideas that don't simply involve entrenching the Microsoft brand?
Sure. Microsoft Research comes up with all kinds of great stuff.
Most absurd though was the author's complaint that he wasn't immediately offered an option to suspend the use of his credit card info for renewals, but still have the service remain live.
I've run into this multiple times, and it pisses me off every time.
If I buy six months worth of a service, I've already paid for ALL SIX MONTHS. If I decide that I don't want MORE THAN six months, that doesn't mean I want you to rip me off for the remaining three months I've paid for.
This is not just annoying, it's a scam. I mean, legally, this should be treated just as seriously as any other scam.
It should be flat out illegal to terminate service like that. As in, not only should that option have been on the front page, but cancelling the service immediately should require an explicit extra step so you can't do it accientally.
That's what I told the admin of our finance network when she started getting in Dell desktops.
Three years later she was saying "You were right". Every model was a unique design, the motherboards, power supply connectors, cases, and everything was designed to force you to replace the computer when you needed to upgrade, to force you to go to Dell for support, and when the warranty runs out you're out of luck.
HP? The HP desktops I've seen have been bog standard ATX cases and motherboards, maintainable and upgradable without HP's help. Much better value.
Expect put option sales to rise gradually over the next week or so.
Will that tend to put downward pressure on the price?
This is a serious question: what's the usual effect of people writing a lot of options like that? Wouldn't that tend to let a bit of the air out of the expectations, or is this one of those things that has counterintuitive side effects?
The promise of web browsing in your hand that sctually renders real web pages correctly.
You mean "the promise of more useless shiny".
I'm sure the cultists will go nuts over waiting for huge bloated web pages to slowly download over the trailing edge (not even EDGE) connection, but really... it was hard enough reading a "properly rendered" web page on my old Libretto... which had a better display than the iPhone. Anyone old enough to afford one is gonna need to spring for LASIK to read it.
Well, maybe not that bad, but it really is hard to read "properly rendered" web pages on a small screen.
I think the last seven years have been all about Apple's corporate ritalin prescription expiring. If ever a company had ADHD, it's Apple.
Apple doesn't seem to be trying out new stuff to find the next big interface paradigm. They're trying out new stuff because it feels good, and because old stuff is boring.
They need to have a "department of non-hyperactivity" to sit back and look at what works and what doesn't work and kick a few bold experimental backsides to get them to document what the hell they're experimenting with, and pay attention to the results of their neighbor's experiments... and to keep a few working on actually fixing stuff like finder and launchservices.
Linux distros use two major and dozens of minor GUIs, based on a window system that's older than Microsoft. Calling it "the Linux GUI" without qualification (KDE, Gnome, GNUStep,...) makes them sound like SCO with their unspecified copyright violations...
Ah, misread, you hilighted that bit about the transmission so I paid attention to that. Not the bit ahead of it.
And I still don't see that the transmission is relevant. You got an engine or an electric motor on one side, you got wheels on the other. Comparing manual with automatic with CVT is irrelevant, because there's nothing stopping you from picking CVT over automatic on a gasoline engine either, except tradition.
We were having an interesting discussion that was clarifying the practical comparisons of the two techs.
See, there's that loss of clarity again. I must have been completely off the plot right from the start, because I wasn't ever trying to compare the two technologies. Not in my first message, nor eny subsequent ones.
And the new tech we're discussing in this story is very much an IC-specific design, as it's for valves and exhaust, which of course means IC.
See, I don't see it that way. I'm in the control systems business. There's SO many places you could improve the efficiency of just about any process with good control systems. It's not done for a number of reasons... including the fact that people don't trust it. They trust cams and pushrods. Cams and pushrods don't crash, their failure modes are simple, and when they break you can see what's broken.
Even electronic fuel injection has taken a long time to get accepted.
And, being *in* that industry, I can't honestly say that they're entirely wrong. A bug in your EFI system will stop your engine. Opening a valve at the wrong time can destroy it.
The REAL breakthrough here isn't the particular system they're controlling, or the control algorithms for the valves. That stuff is old hat, pretty well understood. The real breakthrough if this actually got general use wouldn't be the particular application of control systems to the engine... that's old hat... it's the development of reliable *and* trusted control systems that are cheap enough to use in this application.
I wasn't arguing that manual transmissions are more efficient than the transmissions in fuel-cell cars - most autos in the US seem to be automatics these days anyway, and there are gasoline powered cars with CVTs as well... the point there was simply that the transmission technology is a separate issue. Besides, an electric car may not need a transmission at all, since electric motors can be run at arbitrary speeds.
I'm also not arguing for gasoline engines... the point I'm making is not that gasoline engines are efficient, but:
1. Better control systems are not a technology that is restricted to gasoline engines, so this is not an "either-or" matter.
2. The lousy efficiency of internal combustion engines doesn't seem to have helped other technologies that are more efficient getting a foothold, so improving the efficiency of gasoline engines is still worthwhile.
The question of the efficiency of fuel cells is a side issue, I was seeing people quoting 60%+ efficiency and didn't think that figure was being used in a way that was directly comparable to gasoline engines. If the efficiency of the electric motor is 90%, then your 54% is a better one to quote. Do you have a cite for that 90%?
That's probably a bit of an issue for automatics but the efficiency of a manual transmission is pretty damn close to unity: it's a straight mechanical linkage all the way.
I suppose it depends on what you mean by "overall system". Considered as fuel + engine = torque, fuelcells have a higher conversion% of the fuel's total (chemical) energy content than do ICs.
I'm not debating that, I was just questioning the actual figure you used. It's higher than I've seen for total system efficiency and sounded more like more like the fuel->electricity efficiency.
expression is the need of my soul i was once a vers libre bard but i died and my soul went into the body of a new machine it has given me a new outlook upon life i see things from the under side now thank you for the moving me out of the sun last week but my hard drive is getting so full i cant think it must be a month since you defragged it too there is a cat here called mehitabel i wish you would have removed she sits on top of me and sheds into my vents why dont she catch rats that is what she is supposed to be fore
most of these rats here are just rats but this rat is like me he has a human soul in him he used to be a poet himself night after night i have written poetry for you on your screen and this big brute of a rat who used to be a poet comes out of his hole when it is done and reads it and sniffs at it he is jealous of my poetry he used to make fun of it when we were both human he was a punk poet himself and after he has read it he sneers and crawls inside my case so he can pull and tug on my wires until i crash
that is what this story made me think of if you read this message maybe you can fix that hole in my case
What we need is to run most of Internet Explorer in a tightly sandboxed environment on the user's machine, so that when you close the window, any browser damage goes away.
What we need is for Internet Explorer to actually implement a real sandbox, and make all the attack vectors that involve ActiveX go away.
Are you sure you're not just considering electrical efficiency and not overall system efficiency?
But your point is still valid. There's lots of technologies that are easy to make more efficient than IC engines. Heat engines (such as steam engines), for example, aboid a lot of the kind of complexity in the original article because the vehicle's speed and power requirements don't require radical changes in the combustion profile.
On the gripping hand, the use of tight looped control systems running the engine closer to theoretical efficiency by taking advantage of superior control algorithms is a generally applicable technique. Making the control systems reliable enough to take on more responsibility for running the engine will end up helping every engine technology, so this shoudln't be dismissed out of hand...
I still like the idea of the Star Wars Christmas Special filling out the total to nine.
Though I think I got the last three films in the wrong order. You would of course have "The Great Gungan" before "Nightmare" and leave "Christmas" to round it out.
Slashdot Mirror
NTerprise was deliberately axed. Microsoft refused to license upgrades for the kernel components they needed.
The kind of "leaky sandbox" that we're seeing here was virtually unknown in the '80s and '90s. If a macro language had any kind of ability to work outside the codument layout itself, it was either restricted to applications where it was a moot point (if the preprocessor for your compiler could run scripts... so what, the code in between the preprocessor directives could do anything) or it was a mistake and the abaility was removed when it was discovered (as in the case of ghostscript).
In 1997 Microsoft introduced Active Desktp, which included a deliberately "leaky" sandbox... controls and scripts that were on pages considered "trusted" could get anything up to full local-user access. In addition, Microsoft responded to Word macro viruses NOT by restricting the scripting language in Word (as expected) but by putting in checks to disable the ability to even examine macros if a document seemed suspicious. And they still haven't learned their lesson.
What's worse, this practise is spreading. While nobody has extended this model nearly as far as Microsoft, Firefox XPI installation involves having a web page request installation of unrestricted macros, and Apple lets you run software installers automatically if the user has left "Open safe files after downloading" enabled.
This kind of thing HAS to stop.
If you design an "inherently safe" scripting language, on ethat does not provide any hooks from *within* the documentto even requests the ability to modify mor ethan the document itself, then any security holes are bugs and can be patched without inconveniencing users. More powerful tools should always be run or installed from outside the document, explicitly under user control, and preferably from a version of the application that doesn't include a mechanism to access remote documents and is not ever invoked from a browser or mail program... or any other application intended to work with untrusted documents.
This design, which used to be taken for granted (the idea of an email worm that could even potentially be run by just viewing an email message used to be a *joke*... everyone *knew* that nobody would be stupid enough to make the Good Times virus real) is not "clumsy" or "inconvenient". It's more convenient than the environment we're in now where applications are perpetually bringing up "Hey! I'm about to do someting stupid! You wanna let me?" dialogs that people reflexively swear at as they approve the stupid action.
We need to turn this around, folks. Bring back the sandbox, don't even include the commands to write files in the sandboxed versions of the macro interpreter, and stop turning the Internet into some kind of bad science fiction movie where the earthlings infect the alien computer from a Powerbook.
Don't know about NTerprise but Citrix didn't go out of business.
I see how you misread that... what I meant was "Microsoft bought Citrix and they (NTerprise) went under."
I know ALL TOO MUCH about Citrix, we were using it back when they were working with Tektronix. We ent through all the ups and downs and I was really happy to find a company that DIDN'T use screen scraping.
The problem with the approach Citrix, VNC, and other screen-scrapers is that the server is continually polling to catch updates to the screen and ship the bitmaps over the wire. What made NTerprise so great is that because they were virtualising the GDI calls themselves (like X11, NeWS, and DPS) you had no tearing and no "holidays" in the update, and what you saw on the screen was always in sync with what the application expected to be there.
Microsoft buying out the Citrix technology basically killed them, and with a fundamentally inferior technology.
But that's the way they do things in redmond.
Think about how the BSA works today or how Microsft pulled the rug out from under the Win32-on-UNIX 'partners' and their customers.
Don't forget NTerprise and the other remote access schemes for Windows. Microsoft bought Citrix and they went under.
Pity, NTerprise worked by virtualizing GDI, not by screen scraping, so put WAY less load on the server.
They're going to go after loud parties next...
"When they came after Napster and kazaa, I said nothing, because I was not a Pirate.
When they came after Internet Radio, I said nothing, because I did not have a stream.
When they came after AM & FM, I said nothing because I was not a DJ.
When they came after Picnickers and Sports Fans, I said nothing, because I'm not 'outdoorsy'.
What do you mean I gotta pay RIAA for my party music?"
OK, correcting myself... it DOES work on a Mac, the flash demo is just PC-only.
I guess the bottom line is, know thy enemy, and the enemy of your enemy isn't your friend.
Whatever you buy, make sure it's NOT part of a lock-in scheme.
What's wrong with adding a note in your calendar to log back in at 5 months and 29 days to cancel?
What's wrong with NOT STEALING?
If I've paid for six months of service, I've paid for six months of service. The fact that I can come up with a workaround that should keep from getting ripped off for the remaining three months, albeit with a risk of getting charged for another six months, doesn't justify ripping me off.
You might as well say it's OK to steal my car if you can get away with it.
(and before you get on your high horse about copyright violation, in case you were going to try and bring up that hoary old "slashdotters can't make up their mind" schtick, I bought my music collection instead of collecting it over file sharing networks, and I've consistently argued against the bogus "Robin Hood would have ripped off Microsoft" meme)
Hitting command gets control, and control and alt get nothing.
Surely they'll have Mac drivers for this. I mean, given how Apple is able to sell awful hardware to Mac users because it's cool, I suspect the proportion of Mac users who'd go nuts over this is a hundred times greater than PC users.
Even given the market share differnce, that's a good deal.
Good night, does anyone really believe that within Microsoft there are real innovative ideas that don't simply involve entrenching the Microsoft brand?
Sure. Microsoft Research comes up with all kinds of great stuff.
That gets mined for patents and buried.
Most absurd though was the author's complaint that he wasn't immediately offered an option to suspend the use of his credit card info for renewals, but still have the service remain live.
I've run into this multiple times, and it pisses me off every time.
If I buy six months worth of a service, I've already paid for ALL SIX MONTHS. If I decide that I don't want MORE THAN six months, that doesn't mean I want you to rip me off for the remaining three months I've paid for.
This is not just annoying, it's a scam. I mean, legally, this should be treated just as seriously as any other scam.
It should be flat out illegal to terminate service like that. As in, not only should that option have been on the front page, but cancelling the service immediately should require an explicit extra step so you can't do it accientally.
That's what I told the admin of our finance network when she started getting in Dell desktops.
Three years later she was saying "You were right". Every model was a unique design, the motherboards, power supply connectors, cases, and everything was designed to force you to replace the computer when you needed to upgrade, to force you to go to Dell for support, and when the warranty runs out you're out of luck.
HP? The HP desktops I've seen have been bog standard ATX cases and motherboards, maintainable and upgradable without HP's help. Much better value.
Expect put option sales to rise gradually over the next week or so.
Will that tend to put downward pressure on the price?
This is a serious question: what's the usual effect of people writing a lot of options like that? Wouldn't that tend to let a bit of the air out of the expectations, or is this one of those things that has counterintuitive side effects?
The promise of web browsing in your hand that sctually renders real web pages correctly.
You mean "the promise of more useless shiny".
I'm sure the cultists will go nuts over waiting for huge bloated web pages to slowly download over the trailing edge (not even EDGE) connection, but really... it was hard enough reading a "properly rendered" web page on my old Libretto... which had a better display than the iPhone. Anyone old enough to afford one is gonna need to spring for LASIK to read it.
Well, maybe not that bad, but it really is hard to read "properly rendered" web pages on a small screen.
I think the last seven years have been all about Apple's corporate ritalin prescription expiring. If ever a company had ADHD, it's Apple.
Apple doesn't seem to be trying out new stuff to find the next big interface paradigm. They're trying out new stuff because it feels good, and because old stuff is boring.
They need to have a "department of non-hyperactivity" to sit back and look at what works and what doesn't work and kick a few bold experimental backsides to get them to document what the hell they're experimenting with, and pay attention to the results of their neighbor's experiments... and to keep a few working on actually fixing stuff like finder and launchservices.
"The Linux GUI"?
...) makes them sound like SCO with their unspecified copyright violations...
Linux distros use two major and dozens of minor GUIs, based on a window system that's older than Microsoft. Calling it "the Linux GUI" without qualification (KDE, Gnome, GNUStep,
Ah, misread, you hilighted that bit about the transmission so I paid attention to that. Not the bit ahead of it.
And I still don't see that the transmission is relevant. You got an engine or an electric motor on one side, you got wheels on the other. Comparing manual with automatic with CVT is irrelevant, because there's nothing stopping you from picking CVT over automatic on a gasoline engine either, except tradition.
We were having an interesting discussion that was clarifying the practical comparisons of the two techs.
See, there's that loss of clarity again. I must have been completely off the plot right from the start, because I wasn't ever trying to compare the two technologies. Not in my first message, nor eny subsequent ones.
And the new tech we're discussing in this story is very much an IC-specific design, as it's for valves and exhaust, which of course means IC.
See, I don't see it that way. I'm in the control systems business. There's SO many places you could improve the efficiency of just about any process with good control systems. It's not done for a number of reasons... including the fact that people don't trust it. They trust cams and pushrods. Cams and pushrods don't crash, their failure modes are simple, and when they break you can see what's broken.
Even electronic fuel injection has taken a long time to get accepted.
And, being *in* that industry, I can't honestly say that they're entirely wrong. A bug in your EFI system will stop your engine. Opening a valve at the wrong time can destroy it.
The REAL breakthrough here isn't the particular system they're controlling, or the control algorithms for the valves. That stuff is old hat, pretty well understood. The real breakthrough if this actually got general use wouldn't be the particular application of control systems to the engine... that's old hat... it's the development of reliable *and* trusted control systems that are cheap enough to use in this application.
I wasn't arguing that manual transmissions are more efficient than the transmissions in fuel-cell cars - most autos in the US seem to be automatics these days anyway, and there are gasoline powered cars with CVTs as well... the point there was simply that the transmission technology is a separate issue. Besides, an electric car may not need a transmission at all, since electric motors can be run at arbitrary speeds.
I'm also not arguing for gasoline engines... the point I'm making is not that gasoline engines are efficient, but:
1. Better control systems are not a technology that is restricted to gasoline engines, so this is not an "either-or" matter.
2. The lousy efficiency of internal combustion engines doesn't seem to have helped other technologies that are more efficient getting a foothold, so improving the efficiency of gasoline engines is still worthwhile.
The question of the efficiency of fuel cells is a side issue, I was seeing people quoting 60%+ efficiency and didn't think that figure was being used in a way that was directly comparable to gasoline engines. If the efficiency of the electric motor is 90%, then your 54% is a better one to quote. Do you have a cite for that 90%?
That's probably a bit of an issue for automatics but the efficiency of a manual transmission is pretty damn close to unity: it's a straight mechanical linkage all the way.
I suppose it depends on what you mean by "overall system". Considered as fuel + engine = torque, fuelcells have a higher conversion% of the fuel's total (chemical) energy content than do ICs.
I'm not debating that, I was just questioning the actual figure you used. It's higher than I've seen for total system efficiency and sounded more like more like the fuel->electricity efficiency.
expression is the need of my soul
i was once a vers libre bard
but i died and my soul went into the body of a new machine
it has given me a new outlook upon life
i see things from the under side now
thank you for the moving me out of the sun last week
but my hard drive is getting so full i cant think
it must be a month since you defragged it too
there is a cat here called mehitabel i wish you would have
removed she sits on top of me and sheds into my vents why dont she
catch rats that is what she is supposed to be fore
most of these rats here are just rats
but this rat is like me he has a human soul in him
he used to be a poet himself
night after night i have written poetry for you
on your screen
and this big brute of a rat who used to be a poet
comes out of his hole when it is done
and reads it and sniffs at it
he is jealous of my poetry
he used to make fun of it when we were both human
he was a punk poet himself
and after he has read it he sneers
and crawls inside my case
so he can pull and tug on my wires
until i crash
that is what this story
made me think of
if you read this message
maybe you can fix that hole in my case
What we need is to run most of Internet Explorer in a tightly sandboxed environment on the user's machine, so that when you close the window, any browser damage goes away.
What we need is for Internet Explorer to actually implement a real sandbox, and make all the attack vectors that involve ActiveX go away.
Two points:
1. There are iPod models from $80 on up.
2. If you want the iPhone as a music player, then you're not getting it to "just make phone calls".
Are you sure you're not just considering electrical efficiency and not overall system efficiency?
But your point is still valid. There's lots of technologies that are easy to make more efficient than IC engines. Heat engines (such as steam engines), for example, aboid a lot of the kind of complexity in the original article because the vehicle's speed and power requirements don't require radical changes in the combustion profile.
On the gripping hand, the use of tight looped control systems running the engine closer to theoretical efficiency by taking advantage of superior control algorithms is a generally applicable technique. Making the control systems reliable enough to take on more responsibility for running the engine will end up helping every engine technology, so this shoudln't be dismissed out of hand...
Ah.
I still like the idea of the Star Wars Christmas Special filling out the total to nine.
Though I think I got the last three films in the wrong order. You would of course have "The Great Gungan" before "Nightmare" and leave "Christmas" to round it out.