And of course, we are going to allow the State, and socialists like yourself, to be the ultimate arbiters of truth, right?
I don't see how this is different then the laws we have about slander, libel etc except that that don't seem to apply when it is not about a particular person or when they are not explicitely challenged. In order to make good decisions they have to be made on good information and so if you are going to present something as NEWS you have to do due diligence in checking facts and report what happened as best as you are able. If you can be shown not to have done your research before reporting stuff then you can be fined. The more you do it the more you get fined. Don't we have truth in advertising stuff already? I don't see how this is socialist or really anything else. I just want the information presented to be as accurate as possible. If Fox, CNN etc want to represent themselves as comedy shows then they would not be held to that standard. It just seems if you are going to represent yourself as X to the world then you need to actually be doing X. Just like you should not be able to mark food as organic that is not and candy bars can't be sold as healthy for you. Misinformation makes it too hard for people to make accurate decisions and there is too much out there for people to find that information on their own through other sources.
"As such, the assets of these groups and their membership lists are to be siezed immediately. Those who comprise their membership - all being part of the group collective and not individuals - are to be interred at Guantanamo Bay indefinitely where all necessary means will be used to extract useful information."
That is not what I meant at all. Corporations have a legal status as a person. This allows the people behind the corporation to get away with just about anything and not be responsible for the actions. A corporation is made up of people and every person in that corporation has rights. However a corporation is a legal creation for a group of people to work together and it is not a person just like a computer or a pen is not a person. They should not have the rights of people. A corporation only has a right to exist so long as it benefits the community that granted it the charter in the first place. If it is not serving the community then the charter should be revoked. There is no inherent right to make money, there is no right for these things to exist they are a freedom given up by the society in exchange for some useful service. In the beginning corporations all had built into them self destruct clauses so they had for example a 5 year contract to do x for the public in exchange for y. I am not saying we need to go back to limited times on them just that they need to be responsible to the public for their actions. I would even put an asbolute size on how large corps could get and that limit would be below the bottom item on the forbes 1000 list.
As you allow power to be concentrated in a smaller group of people it gets abused and corporations are an example of the abuse of power. I am sure we can find thousands of examples of abuse by gm, ford, monsanto, hp, ibm, microsoft, walmart etc. Large corporations are not more efficient for the society but they are more efficient in keeping themselves around and making themselves immune to market forces to a large degree. In case you are wondering our government is WAY too large also and needs to be scaled way back. More of the power needs to be back to the states, within the states more power needs to go back to the local levels.
The News, The general media etc take your pick. Video games are a reflection of life they are not a creation of that reality. I have known long before I played any video games from other sources about head shots and other sure kill shots. I have only fired a gun once and that was a shotgun with the help of my uncle at some cans.
I think most of the problems we are having is one of acceptence. Schools and other sources are pushing people to conform more and more to some extrovert idea of what someone should be. As you turn up the pressure and also remove options for having stuff changed people turn to violence. That has been true for all of human history that I know of. I know when I was in school I was considered a nerd because I liked math, science, reading etc and was picked on for it and the teachers certainly permitted it since they never tried to stop it. At some point you turn to violence to solve your problems. I learned from the society that when you are forced into a fight by a group of people that you fight to win and you better go for shots that count because if you don't you are going to end up much more badly hurt. So you go read up on nerve strikes and how to hurt someone as quickly and efficiently as possible.
If the society did not permit the first kind of behavior people would not be forced to learn the other stuff to protect themselves. I did have times where 10 or more kids would find some need to prove themselves to others by trying to beat up on me. You learn fast in situations like that and the schools allow it to happen. It is the same way in the rest of our society. Just look around you. This society is endorsing violene as the primary way to solve problems (bush), that you can do anything you want to get money (corporate america), that laws are made to be broken and are just the cost of doing business (corporate america) etc. What do you expect from kids that are raised in that world? The world is violent and the usa is growing ore violent and a pretty rapid rate and it is getting a lot meaner and the kids are a reflection of that.
You can't shelter people from reality but you can work to change it. In the end violence only creates more violence unless you go for the complete extermination of all other viewpoints which in the end leaves everyone dead. We need to defund our military by a huge ammount and fix it at no more then 5% of our budget which would still have us spending more then any other country does both as an absolute ammount and as a percentage. Then we need to get rid of the entire debt and fix the education system. Have people that really are trained educators and pay them well to do so. The schools needs to be made a safe learning environment. The other thing we need to do is clean up the rest of the crap in the society. Fox News, CNN etc need to be held to standards on reporting the truth and when they lie they need to be very heavily fined. We also need to take away corporate rights. Corporations are not people and should not have the rights that people do and they need to have a lot more responsibilities. Cleaning up the source of the problems which is a society issue not some set of pixels on a screen is the only way to really solve the problem.
Actually with konqueror if you change the popup blocking policy to smart which I think is the default it is not affected. Only if the popup policy is set to allow does the problem exist.
I think firefox and mozilla have a similar workaround also. It should also be pointed out that this workaround is the most advised configuration to run konqueror in since the smart policy means that popups can only open as a response to use clicks and never just on their own. This makes it more useful then just a regular popup blocker or a general allow policy.
I did try their exploit on my machines and it seems that all of the konqueror browers where configured correctly to begin with and the exploit did not work.
Opera is an interesting browser and I have no real issues with it but the other browsers where not as affected as they where made out to be. I would like to see a mix of khtml, gecko and opera based browsers out there so that none of them has a truly dominant share of the market and since all of them are standards compliant it is easy to make code work in all of them.
I think to get software that doesn't need to be patched will take many changes and many programmers will refuse to change. Some of the issues need to be fixed in the languages and just make certain kinds of bugs not possible to have to begin with. We also need better methods to split up programs into easily manageable and testable pieces and that would also need to be enforced by the language. I suspect such a system would not only lead to more secure programs but long term it would also lead to faster programs.
One thing I have always found strange when comparing c++ to python for example is that in a microbenchmark c++ always ends up faster then python. However my experience with larger projects is that python always end up faster then then c++ and is far less buggy. I am not entirely sure why but it has been true in my experience. That is one reason why I don't buy these benchmarks I keep seeing.
More code reuse would also help. Given that most software obeys that 90/10 rule. (90% of the performance is in 10% of the code). There will be a lot of programms that have the speed issues in the same place and that gives an opportunity to have video decode, image decode, fft, etc libraries that are very small in scope and very heavily tested to try and make it as small of a chance as possible to have security issues in those pieces. So not only does the high level language pass off the most processor intensive stuff to a lower level library you pass it to an extensively tested library and your programs are developer faster, run faster, are less buggy, easier to maintain and most importantly more secure.
That is why we need standards so you can use any program for a given purpose. If we had true webstandards then firefox, mozilla, konqueror, opera, msie etc would all be able to render the same data the same way pretty much. This would give you the freedom to change to any of the others at any time with no lockin. This does give an inherent security advantage.
So if program A has a bug you can immediately stop using it until it is fixed and go use program B and not lose anything. You will even end up more meta program things like konqueror. Konqueror is not really web browser it is a component browser and it uses khtml by default to render but it could also use gecko to render. Lets say you added the ability for it to use the opera renderer also. If there is a bug with gecko you could just switch to a different renderer and lose nothing.
There are lots of advantages you get from having well defined standards that are followed and many implementations and one is a much higher resistance to bugs. It also doesn't take much of a mix of stuff to give a much better resistance to the crap out there. Think of what would happen if 1/4 of people use outlook, 1/4 used kmail, 1/4 use thunderbird and 1/4 use evolution. Any given exploit will be able to target one of those pretty much but everything that exploit hits a machine that is not vulnerable it stops there. So the time to get a complete infection of any given group is far far longer. During that time you can patch the program, switch to a different one etc. Either way the damage is going to be a lot lower with the mixed environment.
Part of the difference is components. OSS software in general follows the unix method of smaller components with well defined interfaces and the components are also replacable with others that follow the same interface. This is inherently safer to debug then a large monolithic system.
It is far less likely that fixing a bug in OSS software will cause anywhere near the level of breakage I have seen in proprietary stuff. Actually I have only seen a few things break running debian sid in the past 3-4 years and all the problems have been trivial to roll back. Since you have lots of tiny components you can roll a component back easier. When you install a service pack in windows and a program breaks do you have any idea or even any way to find out what caused it to break? Can you roll back just that one fix?
I disagree with this since there is also more variety of things in the linux world. So long as it is not a homogenous environment then it is safer from these kinds of attacks just because a mixed environment won't spread the stuff as fast.
Also while closed source can write a patch before disclosure it does not really matter. How long do people wait before installing a patch? How easy is it to get all the patches installed? If quicken came out with a patch tomorrow how long before people would install it? How about exchange, mssql server etc is there an EASY way to update all software installed on a windows system and how often does it break things?
On my linux systems it is trivial to update every installed program to the latest versions so they also tend to be very up to date. Ease of patching all software it at least as important as how long it takes to get a patch out. Given what I have seen of many windows users many programs have not been patched in years and that seems pretty rare of the linux stuff I have run into.
One thing I hope does happen is that stuff like selinux becomes default for all linux dists in the next 2 years and that more stuff is written with safer higher level languages. Between those two things it should cut stuff down even further.
Control Center -> Desktop -> Window Behavior -> Advanced
On the page there is a setting called Focus stealing prevention level. I have mine set to high and just don't run into those issues not that it happened very often before given kde policy. You can click on the question mark button and then click on the setting to see a full description of what each option does.
The behavior is correct under KDE and it has been for a long time. So long as the button is held down you can move the mouse anywhere to scroll the page. More importantly when you let the button go it just stops scrolling there and does not snap back.
Most modern systems can mount webdav to share just fine, you can server it from all kinds of systems and can work with it from just about any kind of system. With ssl you can make it secure enough. So you end up with something nice and fast and where you are free to change implementations at any time on client or server without breaking stuff.
Another option is sftp. I am not sure how easy that is to do under windows and osx but I expect someone has a vfs layer for it under those. Under kde and gnome sftp is transparent to work with and it should be very secure, that is the way I usually share files is with sftp.
The advantage of both of these is that they are entirely user space. Worrying about speed with these file sharing seems seems pretty silly in most cases. You have such vastly more cpu power available then the system needs for file sharing that trading security for speed which is what many of these systems is doing is ridiculous. We should be designing stuff for security first and speed second since who cares how fast a machine can be compromised is. As long as it is fast enough that is fine.
Another thing really needed is more use of safer libraries. Code is not an asset it is a LIABILITY the more of it you have the worse off you are. You need to offload as much stuff to common libraries, using higher level languages which have more safety features built in etc. In the end you will end up with safer and more reliable programs and strangely enough most of them will tend to be faster for many reasons.
Not unti l XUL is beyond just mozilla
on
Firefox - The Platform
·
· Score: 4, Interesting
Overall I can't see how doing stuff with XUL is a good idea until other systems support XUL also. The point of web based apps isa freedom to change at any time. If you write to XUL you have locked yourself in to one rendering engine essentially. If xul worked with khtml and opera then I would not have this problem.
I want to have the freedom that web based apps give me and my customers not remove that freedom. Tieing myself to one browser engine does remove that freedom. Right now if I do regular html, css etcthe stuff works pretty much everywhere under almost any kind of device. With XUL I would lose that freedom and it is important.
From what I have seen all access to resources goes through the ioslaves. file:/ is just another ioslave. They are also used by all kde applications. I am not sure if that answers your question but I am not entirely sure what you asked. You could probably ask on a kde irc channel though and get a much better answer.
Konqueror is not integrated the way you might think. In kde konqueror is a kpart launcher that uses io slaves to grab information. So when you type a url into konqueror which can be any recognized url it then uses an io slave to grab that information and when it gets that information back it hands it to the appropriate kpart for that kind of information.
If you want add an html file on a server and use sftp://server:/path/to/file and it will still run khtml (the html rendering kpart). That is also why you can embed khtml in stuff like kmail and knode without much in the way of security issues since you can just have khtml render the html but not hook up any io slaves to it. That way it can't retrieve any outside resources.
KDE overall is fairly well layered. I would like to see more security work done on it but it is pretty decent at least. For example I would like khtml to run with no privelages at all. It doesn't really need any to begin with so why have it run with them. The services it accesses need to be secured but at least that would make it far harder for things to go wrong.
Most of the security work should probably happen in things like the io slaves, kjs (javascript) etc services since those can be used by any application (you can use http, sftp, webdav, imap etc from any kde file dialog box if you want) and get those more secured.
Okay so since you say that IE is a standard you can point me to the IE standard testing page somewhere on microsoft.com or some other site from them. Personally I have NEVER seen a published standard on how IE renders pages and I see it change from version to version and even within bugfix releases.
When people claim to be coding for IE they are really idiots that don't understand what they are doing which is understandable since most of the people doing this stuff are idiots. They are really writing for the quirks in the versions they are using which is not the same as coding for IE. I have seen far too many pages "designed for IE" that break in various versions of IE. Either a new service pack come out for 6 that breaks things, or it breaks in IE 5 because of something stupid etc.
The BEST way to get stuff to work across the various versions of IE is to code to the standards and use the subset of CSS that IE supports. That method is most likely to work across the various patches that change the quirks of IE oh how it handles a tag being improperly nested, not closed, not quoted right, etc or any number of other strange things people do with IE only websites.
This method also has the advantage that is can be TESTED trivially, it works across a wider range of browsers etc. It saves a lot of dev time if when something is not working right you can run tests on the html and css and see if any errors are flagged since it is amazing at some of the things that all of a sudden just work when you fix those errors even if they don't seem like they could possible be a problem.
The kernel has a VFS layer however the kde ioslave system and the gnome things are also VFS layers they just exist in userspace. The gnome one is even called gnome vfs.
VFS is just virtual file system. http, ftp, imap, sftp etc are not really filesystems but can appear that way under both kde and gnome to make management easier.
Overall I just find I can't be productive in mac osx or windows. Without a good vfs layer I find them a pain in the neck to use. I the kde io slave system the most because more things are supported but the gnome one is good also and at some point they are likely to merege.
I save many hours a week from being able to use sftp, ftp, webdav, webdavs, http, https, imaps etc from EVERY gui app that I use (I use kde and gnome apps exclusively pretty much). Until you get used to being able to work transparently with any resource via url it is hard to see how much you really gain from this but once you use it and get it there are a lot of gains you can make. I often end up having to edit files on remote servers and with the wallet in kde I can have it remember the password and use sftp and then bookmark the files I need to work with so I can just open up a local editor and work with files anywhere.
The other thing is the kpart system is kde is used extensively to share components. Spell check is configured once for all applications to share it, my text editing component is configured once and it does not matter if it is embedded in konqueror, kmail, kdevelop, kwrite etc it is the same editor settings. So when I view source code from any url it displays with the same highlights that I have configured just once. The same is true of the proxy settings, the address book etc etc.
KDE just has so many things integrated together well with the system. It is not just network aware like windows and macs are but darn near network transparent in many cases. I don't have to worry about ftping a file locally, editing it, saving it back etc I just open the resource edit it and it saves normally.
Many of these things are true for gnome also and are continuing to become more true overall especially and kde and gnome share more technology.
Windows and macs may be easier for new users, for people that don't have to deal with network stuff very often etc. However I do python devel with zope and end up dealing with a lot of network resources.
Maybe one day windows and macs will get a good vfs layer. However by the time they get that kde and gnome will have yet another feature that makes my life easier as a programmer also.
THERE IS NO IE STANDARD! There never has been and I am getting sick of people thinking that. Microsoft has not documented jack on the correct way for IE to understand various pieces of html. IE 6 on windows 98, windows 2000 and windows XP do NOT render html the same way and they choke on different quirks. Different patches can drastically change the way pages render. If you code to IE you are coding to the IE on your desk and not to some IE browser standard. The best way to make stuff work across many versions of IE is to code to the actual w3c standard for html and css and stick to the subset that IE supports.
Until MS publishes their own standard and has a tool to check code for compliance it is not a standard and never can be.
Also the w3c is not just some arbitrary body that does these standards. MS even participates on many of the standards they just don't implement them.
The parent was confused. Tkinter comes with python and it is the default gui toolkit. There are many other choices for different needs though. pyKDE is very good if you want to integrate with kde and use stuff like KDE vfs layer which is very useful.
Python has improved a lot since those benchmarks where done and there are better structure for doing many of those things now and 2.4 makes a number of those things even faster.
Between psyco and python 2.3 and soon python 2.4 you could pretty easily get some massive improvements on those tests. In almost every case where I have seen python slower then java the algorithm chosen was the problem. Algorithms that work well in java,c,c++ don't work as well in python and vice versa. String appends are a simple one (http://www.skymind.com/~ocrow/python_string/ )
I have helped far too many people speed up their programs 10-1000x with just changing a few simple things.
Actually yes you could. With a cluster of ZEOs using ZRS (ZEO Replication Service) and a bunch of Zope instances in front of ZEO and squid proxies in front of them with load balancing it should work fine. Zope scales very well and very easily. It is smaller sites that zope is overkill for not larger ones.
My problem is that there is not IE stanard. There is no such thing as making a site MSIE compatible. You can make it work with the exact version on your desktop and test on others but if you are outside the w3c specs and a FEW very limited things that ms says it supports then you are dealing with quirks and the quirks tend to be very specific in too many circumstances.
So far I have found the best way to actually get a page to render acoss a large various of MSIE 5.x and 6.x systems is to write the pages to xhtml 1.0 strict and css 1 and just use the subset of css that IE actually supports. The reason for the xhtml 1.0 strict is that then you can run a simple checker on the document and make sure every tag is properly closed. I know with html soup that IE renders a document as that it should not matter but it does in practice. Well formed html just renders more consistently across the range of IE browsers.
It is stuff like this that web designers want everyone to follow the standards. It is a pain in the neck to program for each browser quirk especially when it changes so much between even minor bug fix versions. At least for opera, konqueror, mozilla, safarri, firefox etc I can write xhtml 1.0 strict and CSS2 and have it render nearly identically in all of them with only a few things that can't be used due to bugs. MS not adhering to standards makes sites cost more to write, more to maintain, more to test etc.
Yes I made a mistake with that sentence however I am not very worried about that. Also I do not write the text on any of the websites my company does. I build the backend tools that are used to build the websites.
If you pay attention to the patents you are liable for triple damages on infringement. If you don't know about the patents that you violated then that is not true. Since patents cover so much in software the best method is not to look since at least that way you are liable for a lot less. Also ignorance of the patent can be used as evidence to throw patent out. It helps show that an idea is obvious and obviousness is a test that can throw a patent out.
So I stand by what I said that ignoring the is the best course of action.
Copywriting software is fine. Patenting an idea is not fine.
I don't think it is possible to come up with a patent on software that is non obvious. All things become obvious with enough people working on the problem and since so much information in this field is shared all the steps leading up to the idea and the idea itself are created all over the world at the same time. You don't come up with a unique idea for a software patent you just built a little bit on what the rest of the industry is doing and gain a monopoly on one of the bricks the system is based on.
Copyright a particular implementation all you want. However patenting an idea should NEVER be allowed in any field.
The point is that EVERY product is risky. With all the patents out there if people start using them no company will be able to deal with all of it. Even microsoft can be killed with tens of thousands of pattent infringement lawsuits. Same with any other large company. At some point it becomes cheaper to buy some new laws and eliminate those patents then it does to pay off all those claims. Heck ibm has a patent on tree based menus. Do you have any idea how many software packages infringe on that? The whole point is that ideas can not be patented and the system will change to reflect that when the current system causes too much hardship.
Would you ever write any software of any size if patents where being enforced? That would basically kill custom software devel which is about 95% of the industry. Even making websites would be dead except if you paid ibm to make your website since even a simple website probaby violates hundreds of patents.
The industry can not survive with software patents and modern society depends on customized software to get real work done. Software patents will go away since the rest of the businesses will demand it.
Slashdot Mirror
I don't see how this is different then the laws we have about slander, libel etc except that that don't seem to apply when it is not about a particular person or when they are not explicitely challenged. In order to make good decisions they have to be made on good information and so if you are going to present something as NEWS you have to do due diligence in checking facts and report what happened as best as you are able. If you can be shown not to have done your research before reporting stuff then you can be fined. The more you do it the more you get fined. Don't we have truth in advertising stuff already? I don't see how this is socialist or really anything else. I just want the information presented to be as accurate as possible. If Fox, CNN etc want to represent themselves as comedy shows then they would not be held to that standard. It just seems if you are going to represent yourself as X to the world then you need to actually be doing X. Just like you should not be able to mark food as organic that is not and candy bars can't be sold as healthy for you. Misinformation makes it too hard for people to make accurate decisions and there is too much out there for people to find that information on their own through other sources.
That is not what I meant at all. Corporations have a legal status as a person. This allows the people behind the corporation to get away with just about anything and not be responsible for the actions. A corporation is made up of people and every person in that corporation has rights. However a corporation is a legal creation for a group of people to work together and it is not a person just like a computer or a pen is not a person. They should not have the rights of people. A corporation only has a right to exist so long as it benefits the community that granted it the charter in the first place. If it is not serving the community then the charter should be revoked. There is no inherent right to make money, there is no right for these things to exist they are a freedom given up by the society in exchange for some useful service. In the beginning corporations all had built into them self destruct clauses so they had for example a 5 year contract to do x for the public in exchange for y. I am not saying we need to go back to limited times on them just that they need to be responsible to the public for their actions. I would even put an asbolute size on how large corps could get and that limit would be below the bottom item on the forbes 1000 list.
As you allow power to be concentrated in a smaller group of people it gets abused and corporations are an example of the abuse of power. I am sure we can find thousands of examples of abuse by gm, ford, monsanto, hp, ibm, microsoft, walmart etc. Large corporations are not more efficient for the society but they are more efficient in keeping themselves around and making themselves immune to market forces to a large degree. In case you are wondering our government is WAY too large also and needs to be scaled way back. More of the power needs to be back to the states, within the states more power needs to go back to the local levels.
The News, The general media etc take your pick. Video games are a reflection of life they are not a creation of that reality. I have known long before I played any video games from other sources about head shots and other sure kill shots. I have only fired a gun once and that was a shotgun with the help of my uncle at some cans.
I think most of the problems we are having is one of acceptence. Schools and other sources are pushing people to conform more and more to some extrovert idea of what someone should be. As you turn up the pressure and also remove options for having stuff changed people turn to violence. That has been true for all of human history that I know of. I know when I was in school I was considered a nerd because I liked math, science, reading etc and was picked on for it and the teachers certainly permitted it since they never tried to stop it. At some point you turn to violence to solve your problems. I learned from the society that when you are forced into a fight by a group of people that you fight to win and you better go for shots that count because if you don't you are going to end up much more badly hurt. So you go read up on nerve strikes and how to hurt someone as quickly and efficiently as possible.
If the society did not permit the first kind of behavior people would not be forced to learn the other stuff to protect themselves. I did have times where 10 or more kids would find some need to prove themselves to others by trying to beat up on me. You learn fast in situations like that and the schools allow it to happen. It is the same way in the rest of our society. Just look around you. This society is endorsing violene as the primary way to solve problems (bush), that you can do anything you want to get money (corporate america), that laws are made to be broken and are just the cost of doing business (corporate america) etc. What do you expect from kids that are raised in that world? The world is violent and the usa is growing ore violent and a pretty rapid rate and it is getting a lot meaner and the kids are a reflection of that.
You can't shelter people from reality but you can work to change it. In the end violence only creates more violence unless you go for the complete extermination of all other viewpoints which in the end leaves everyone dead. We need to defund our military by a huge ammount and fix it at no more then 5% of our budget which would still have us spending more then any other country does both as an absolute ammount and as a percentage. Then we need to get rid of the entire debt and fix the education system. Have people that really are trained educators and pay them well to do so. The schools needs to be made a safe learning environment. The other thing we need to do is clean up the rest of the crap in the society. Fox News, CNN etc need to be held to standards on reporting the truth and when they lie they need to be very heavily fined. We also need to take away corporate rights. Corporations are not people and should not have the rights that people do and they need to have a lot more responsibilities. Cleaning up the source of the problems which is a society issue not some set of pixels on a screen is the only way to really solve the problem.
Actually with konqueror if you change the popup blocking policy to smart which I think is the default it is not affected. Only if the popup policy is set to allow does the problem exist.
I think firefox and mozilla have a similar workaround also. It should also be pointed out that this workaround is the most advised configuration to run konqueror in since the smart policy means that popups can only open as a response to use clicks and never just on their own. This makes it more useful then just a regular popup blocker or a general allow policy.
I did try their exploit on my machines and it seems that all of the konqueror browers where configured correctly to begin with and the exploit did not work.
Opera is an interesting browser and I have no real issues with it but the other browsers where not as affected as they where made out to be. I would like to see a mix of khtml, gecko and opera based browsers out there so that none of them has a truly dominant share of the market and since all of them are standards compliant it is easy to make code work in all of them.
I think to get software that doesn't need to be patched will take many changes and many programmers will refuse to change. Some of the issues need to be fixed in the languages and just make certain kinds of bugs not possible to have to begin with. We also need better methods to split up programs into easily manageable and testable pieces and that would also need to be enforced by the language. I suspect such a system would not only lead to more secure programs but long term it would also lead to faster programs.
One thing I have always found strange when comparing c++ to python for example is that in a microbenchmark c++ always ends up faster then python. However my experience with larger projects is that python always end up faster then then c++ and is far less buggy. I am not entirely sure why but it has been true in my experience. That is one reason why I don't buy these benchmarks I keep seeing.
More code reuse would also help. Given that most software obeys that 90/10 rule. (90% of the performance is in 10% of the code). There will be a lot of programms that have the speed issues in the same place and that gives an opportunity to have video decode, image decode, fft, etc libraries that are very small in scope and very heavily tested to try and make it as small of a chance as possible to have security issues in those pieces. So not only does the high level language pass off the most processor intensive stuff to a lower level library you pass it to an extensively tested library and your programs are developer faster, run faster, are less buggy, easier to maintain and most importantly more secure.
EXACTLY!
That is why we need standards so you can use any program for a given purpose. If we had true webstandards then firefox, mozilla, konqueror, opera, msie etc would all be able to render the same data the same way pretty much. This would give you the freedom to change to any of the others at any time with no lockin. This does give an inherent security advantage.
So if program A has a bug you can immediately stop using it until it is fixed and go use program B and not lose anything. You will even end up more meta program things like konqueror. Konqueror is not really web browser it is a component browser and it uses khtml by default to render but it could also use gecko to render. Lets say you added the ability for it to use the opera renderer also. If there is a bug with gecko you could just switch to a different renderer and lose nothing.
There are lots of advantages you get from having well defined standards that are followed and many implementations and one is a much higher resistance to bugs. It also doesn't take much of a mix of stuff to give a much better resistance to the crap out there. Think of what would happen if 1/4 of people use outlook, 1/4 used kmail, 1/4 use thunderbird and 1/4 use evolution. Any given exploit will be able to target one of those pretty much but everything that exploit hits a machine that is not vulnerable it stops there. So the time to get a complete infection of any given group is far far longer. During that time you can patch the program, switch to a different one etc. Either way the damage is going to be a lot lower with the mixed environment.
Part of the difference is components. OSS software in general follows the unix method of smaller components with well defined interfaces and the components are also replacable with others that follow the same interface. This is inherently safer to debug then a large monolithic system.
It is far less likely that fixing a bug in OSS software will cause anywhere near the level of breakage I have seen in proprietary stuff. Actually I have only seen a few things break running debian sid in the past 3-4 years and all the problems have been trivial to roll back. Since you have lots of tiny components you can roll a component back easier. When you install a service pack in windows and a program breaks do you have any idea or even any way to find out what caused it to break? Can you roll back just that one fix?
I disagree with this since there is also more variety of things in the linux world. So long as it is not a homogenous environment then it is safer from these kinds of attacks just because a mixed environment won't spread the stuff as fast.
Also while closed source can write a patch before disclosure it does not really matter. How long do people wait before installing a patch? How easy is it to get all the patches installed? If quicken came out with a patch tomorrow how long before people would install it? How about exchange, mssql server etc is there an EASY way to update all software installed on a windows system and how often does it break things?
On my linux systems it is trivial to update every installed program to the latest versions so they also tend to be very up to date. Ease of patching all software it at least as important as how long it takes to get a patch out. Given what I have seen of many windows users many programs have not been patched in years and that seems pretty rare of the linux stuff I have run into.
One thing I hope does happen is that stuff like selinux becomes default for all linux dists in the next 2 years and that more stuff is written with safer higher level languages. Between those two things it should cut stuff down even further.
Under KDE this has been fixed at least.
Control Center -> Desktop -> Window Behavior -> Advanced
On the page there is a setting called Focus stealing prevention level. I have mine set to high and just don't run into those issues not that it happened very often before given kde policy. You can click on the question mark button and then click on the setting to see a full description of what each option does.
The behavior is correct under KDE and it has been for a long time. So long as the button is held down you can move the mouse anywhere to scroll the page. More importantly when you let the button go it just stops scrolling there and does not snap back.
Most modern systems can mount webdav to share just fine, you can server it from all kinds of systems and can work with it from just about any kind of system. With ssl you can make it secure enough. So you end up with something nice and fast and where you are free to change implementations at any time on client or server without breaking stuff.
Another option is sftp. I am not sure how easy that is to do under windows and osx but I expect someone has a vfs layer for it under those. Under kde and gnome sftp is transparent to work with and it should be very secure, that is the way I usually share files is with sftp.
The advantage of both of these is that they are entirely user space. Worrying about speed with these file sharing seems seems pretty silly in most cases. You have such vastly more cpu power available then the system needs for file sharing that trading security for speed which is what many of these systems is doing is ridiculous. We should be designing stuff for security first and speed second since who cares how fast a machine can be compromised is. As long as it is fast enough that is fine.
Another thing really needed is more use of safer libraries. Code is not an asset it is a LIABILITY the more of it you have the worse off you are. You need to offload as much stuff to common libraries, using higher level languages which have more safety features built in etc. In the end you will end up with safer and more reliable programs and strangely enough most of them will tend to be faster for many reasons.
Overall I can't see how doing stuff with XUL is a good idea until other systems support XUL also. The point of web based apps isa freedom to change at any time. If you write to XUL you have locked yourself in to one rendering engine essentially. If xul worked with khtml and opera then I would not have this problem.
I want to have the freedom that web based apps give me and my customers not remove that freedom. Tieing myself to one browser engine does remove that freedom. Right now if I do regular html, css etcthe stuff works pretty much everywhere under almost any kind of device. With XUL I would lose that freedom and it is important.
From what I have seen all access to resources goes through the ioslaves. file:/ is just another ioslave. They are also used by all kde applications. I am not sure if that answers your question but I am not entirely sure what you asked. You could probably ask on a kde irc channel though and get a much better answer.
Konqueror is not integrated the way you might think. In kde konqueror is a kpart launcher that uses io slaves to grab information. So when you type a url into konqueror which can be any recognized url it then uses an io slave to grab that information and when it gets that information back it hands it to the appropriate kpart for that kind of information.
If you want add an html file on a server and use sftp://server:/path/to/file and it will still run khtml (the html rendering kpart). That is also why you can embed khtml in stuff like kmail and knode without much in the way of security issues since you can just have khtml render the html but not hook up any io slaves to it. That way it can't retrieve any outside resources.
KDE overall is fairly well layered. I would like to see more security work done on it but it is pretty decent at least. For example I would like khtml to run with no privelages at all. It doesn't really need any to begin with so why have it run with them. The services it accesses need to be secured but at least that would make it far harder for things to go wrong.
Most of the security work should probably happen in things like the io slaves, kjs (javascript) etc services since those can be used by any application (you can use http, sftp, webdav, imap etc from any kde file dialog box if you want) and get those more secured.
Okay so since you say that IE is a standard you can point me to the IE standard testing page somewhere on microsoft.com or some other site from them. Personally I have NEVER seen a published standard on how IE renders pages and I see it change from version to version and even within bugfix releases.
When people claim to be coding for IE they are really idiots that don't understand what they are doing which is understandable since most of the people doing this stuff are idiots. They are really writing for the quirks in the versions they are using which is not the same as coding for IE. I have seen far too many pages "designed for IE" that break in various versions of IE. Either a new service pack come out for 6 that breaks things, or it breaks in IE 5 because of something stupid etc.
The BEST way to get stuff to work across the various versions of IE is to code to the standards and use the subset of CSS that IE supports. That method is most likely to work across the various patches that change the quirks of IE oh how it handles a tag being improperly nested, not closed, not quoted right, etc or any number of other strange things people do with IE only websites.
This method also has the advantage that is can be TESTED trivially, it works across a wider range of browsers etc. It saves a lot of dev time if when something is not working right you can run tests on the html and css and see if any errors are flagged since it is amazing at some of the things that all of a sudden just work when you fix those errors even if they don't seem like they could possible be a problem.
The kernel has a VFS layer however the kde ioslave system and the gnome things are also VFS layers they just exist in userspace. The gnome one is even called gnome vfs.
VFS is just virtual file system. http, ftp, imap, sftp etc are not really filesystems but can appear that way under both kde and gnome to make management easier.
Overall I just find I can't be productive in mac osx or windows. Without a good vfs layer I find them a pain in the neck to use. I the kde io slave system the most because more things are supported but the gnome one is good also and at some point they are likely to merege.
I save many hours a week from being able to use sftp, ftp, webdav, webdavs, http, https, imaps etc from EVERY gui app that I use (I use kde and gnome apps exclusively pretty much). Until you get used to being able to work transparently with any resource via url it is hard to see how much you really gain from this but once you use it and get it there are a lot of gains you can make. I often end up having to edit files on remote servers and with the wallet in kde I can have it remember the password and use sftp and then bookmark the files I need to work with so I can just open up a local editor and work with files anywhere.
The other thing is the kpart system is kde is used extensively to share components. Spell check is configured once for all applications to share it, my text editing component is configured once and it does not matter if it is embedded in konqueror, kmail, kdevelop, kwrite etc it is the same editor settings. So when I view source code from any url it displays with the same highlights that I have configured just once. The same is true of the proxy settings, the address book etc etc.
KDE just has so many things integrated together well with the system. It is not just network aware like windows and macs are but darn near network transparent in many cases. I don't have to worry about ftping a file locally, editing it, saving it back etc I just open the resource edit it and it saves normally.
Many of these things are true for gnome also and are continuing to become more true overall especially and kde and gnome share more technology.
Windows and macs may be easier for new users, for people that don't have to deal with network stuff very often etc. However I do python devel with zope and end up dealing with a lot of network resources.
Maybe one day windows and macs will get a good vfs layer. However by the time they get that kde and gnome will have yet another feature that makes my life easier as a programmer also.
THERE IS NO IE STANDARD! There never has been and I am getting sick of people thinking that. Microsoft has not documented jack on the correct way for IE to understand various pieces of html. IE 6 on windows 98, windows 2000 and windows XP do NOT render html the same way and they choke on different quirks. Different patches can drastically change the way pages render. If you code to IE you are coding to the IE on your desk and not to some IE browser standard. The best way to make stuff work across many versions of IE is to code to the actual w3c standard for html and css and stick to the subset that IE supports.
Until MS publishes their own standard and has a tool to check code for compliance it is not a standard and never can be.
Also the w3c is not just some arbitrary body that does these standards. MS even participates on many of the standards they just don't implement them.
The parent was confused. Tkinter comes with python and it is the default gui toolkit. There are many other choices for different needs though. pyKDE is very good if you want to integrate with kde and use stuff like KDE vfs layer which is very useful.
Python has improved a lot since those benchmarks where done and there are better structure for doing many of those things now and 2.4 makes a number of those things even faster.
Between psyco and python 2.3 and soon python 2.4 you could pretty easily get some massive improvements on those tests. In almost every case where I have seen python slower then java the algorithm chosen was the problem. Algorithms that work well in java,c,c++ don't work as well in python and vice versa. String appends are a simple one (http://www.skymind.com/~ocrow/python_string/ )
I have helped far too many people speed up their programs 10-1000x with just changing a few simple things.
Actually yes you could. With a cluster of ZEOs using ZRS (ZEO Replication Service) and a bunch of Zope instances in front of ZEO and squid proxies in front of them with load balancing it should work fine. Zope scales very well and very easily. It is smaller sites that zope is overkill for not larger ones.
My problem is that there is not IE stanard. There is no such thing as making a site MSIE compatible. You can make it work with the exact version on your desktop and test on others but if you are outside the w3c specs and a FEW very limited things that ms says it supports then you are dealing with quirks and the quirks tend to be very specific in too many circumstances.
So far I have found the best way to actually get a page to render acoss a large various of MSIE 5.x and 6.x systems is to write the pages to xhtml 1.0 strict and css 1 and just use the subset of css that IE actually supports. The reason for the xhtml 1.0 strict is that then you can run a simple checker on the document and make sure every tag is properly closed. I know with html soup that IE renders a document as that it should not matter but it does in practice. Well formed html just renders more consistently across the range of IE browsers.
It is stuff like this that web designers want everyone to follow the standards. It is a pain in the neck to program for each browser quirk especially when it changes so much between even minor bug fix versions. At least for opera, konqueror, mozilla, safarri, firefox etc I can write xhtml 1.0 strict and CSS2 and have it render nearly identically in all of them with only a few things that can't be used due to bugs. MS not adhering to standards makes sites cost more to write, more to maintain, more to test etc.
Yes I made a mistake with that sentence however I am not very worried about that. Also I do not write the text on any of the websites my company does. I build the backend tools that are used to build the websites.
If you pay attention to the patents you are liable for triple damages on infringement. If you don't know about the patents that you violated then that is not true. Since patents cover so much in software the best method is not to look since at least that way you are liable for a lot less. Also ignorance of the patent can be used as evidence to throw patent out. It helps show that an idea is obvious and obviousness is a test that can throw a patent out.
So I stand by what I said that ignoring the is the best course of action.
Copywriting software is fine. Patenting an idea is not fine.
I don't think it is possible to come up with a patent on software that is non obvious. All things become obvious with enough people working on the problem and since so much information in this field is shared all the steps leading up to the idea and the idea itself are created all over the world at the same time. You don't come up with a unique idea for a software patent you just built a little bit on what the rest of the industry is doing and gain a monopoly on one of the bricks the system is based on.
Copyright a particular implementation all you want. However patenting an idea should NEVER be allowed in any field.
The point is that EVERY product is risky. With all the patents out there if people start using them no company will be able to deal with all of it. Even microsoft can be killed with tens of thousands of pattent infringement lawsuits. Same with any other large company. At some point it becomes cheaper to buy some new laws and eliminate those patents then it does to pay off all those claims. Heck ibm has a patent on tree based menus. Do you have any idea how many software packages infringe on that? The whole point is that ideas can not be patented and the system will change to reflect that when the current system causes too much hardship.
Would you ever write any software of any size if patents where being enforced? That would basically kill custom software devel which is about 95% of the industry. Even making websites would be dead except if you paid ibm to make your website since even a simple website probaby violates hundreds of patents.
The industry can not survive with software patents and modern society depends on customized software to get real work done. Software patents will go away since the rest of the businesses will demand it.