a good sysadmin is not someone who understands an OS thoroughly.
I can't believe anyone would make this assertion. While I agree completely with the other half of your statement, that a good sysadmin must understand the aims of yout IT systems and know how to implement them properly, I would say that thoroughly understanding an OS is a vital prerequsite for that second clause.
Anyone who has worked with an operating system, a programming language, heck, a make and model of car, knows that there are essentially four levels of competence. First, complete incompetence. You have no knowledge, you try things and you screw things up. Second, basic competence. You have some knowledge. You successfully carry out basic tasks. You use the system without damage, but there are vast areas about which you know nothing. Third, competence. At this level you know your way around. You know how things work. You know what all the parts do. Fourth, high competence (guru). You not only know how things work, you know why. You develop a holistic sense of the system/language/automobile. You can imagine how things work. You can be presented with an unfamiliar situation and you can figure out what to do about it.
Most people with whom I have worked in IT (and I've been working professionally as either a system admin or a programmer/analyst for over 12 years now) are at what I would call level 3, and a fair number are at level 4. Thorough knowledge of a system is required to be at level 4.
The notion that one does not require deep knowledge of systems to be a systems administrator is tenable only in a system with nothing ever happens that is outside the training materials. No such system exists.
If you are arguing that deep knowledge of a system is not required to be a sysadmin, then I sure don't want to work at your company. If, OTOH, you are arguing that deep knowledge of a system is not in itself sufficient to be a good sysadmin, well, then I've been wasting your time and I apologize, because I agree with that...
Bad security is not requiring password change. Bad security is writing them down.
People have to be trained in security.
If this is a concern (you can't fire people for writing down passwords) then let them last much longer, but force a change when the failure thresholds are exceeded. That would be sufficient. The point of password changing to me is NOT to close the door again (because generally penetration once is enough), but rather to ensure that even the limited probing my proposal allows cannot be profitable, even assuming an attack lasts years. So, I'll grant you that monthly changes may be too frequent. Therefore have no forced changes until a failure threshold is reached.
If you choose to work it that way, then I'd add a third counter: failures per password. So, three successive failures is a lockout. Ten failures in a month is a lockout. Fifty failures since last password change is a forced password change.
Two part authentication is nice. But that isn't what the guy was asking. The guy was asking if username.password authentication can be sufficient. The answer is, yes it can. My post stresses that the greatest risk lies in inappropriate disclosure at the client. I think I was realistic throughout on the risks.
Password token cards and so forth are also vulnerable to deeply embedded attacks. If you have unauthorized software running on the client, then their recovery of passwords is the least of your concerns. If that situation exists, why bother recovering passwords? Just have that software read everything on the machine. If you posit a trojan program on the client, then two-part authentication won't help you. It's reading your data.
Note also that I recommend that you validate the address of the source. If a password is recovered and tried from an unauthorized locale, it fails as if the password had been changed.
So, if you are asking if a two-part authentication is superior, you bet it is. I'm just saying that a username/password system can be made reasonably secure.
You can strengthen the password system even more without a true two part system if you, instead of passing the password, calculate, say, an MD5 hash of the password, the client IP address and port and send that hash over the net. The server side uses the known password and the IP address and port it reads from the actual socket connection (this is assuming no proxy has interfered, but you can come up with something else). This way an attacker who has recovered the password must also either be on the server's network, or able to compromise every router between himself and the server.
I like this because even if the SSL is broken, nothing is learned that can be used in another attack from another location. The password cannot be recovered from the network traffic. I realize that this requires client side programming. Probably in Java (could you do this with JavaScript? I haven't used it enough to know...), which, of course, has its own risks; still.
Still better, have the server set a cookie on each connect that is used as part of the hash. The cookie is changed each time. If ever an authentication comes in that was not hashed with the last set cookie, lock the account. Somone got in there. Not only that, but it was the transaction just before the one that failed the hash. You've got the bad guy!
There are a lot of possibilities.
The person building this system has to decide if such an attack is likely and what the cost would be if such an attack were mounted. Look at what you are proposing:
Somone wants to read a doctor's e-mail so badly that he:
1) Manages to install software that can monitor keystrokes on a client.
2) Is able to pick out a password from all the keystrokes he has collected.
3) Is able to either directly connect to the client's LAN or the server's LAN such that he can impersonate a valid client IP, OR
4) Is able to compromise every router between himself and the server such that he appears to be the authorized client.
If such an attack is likely, then, by all means insist on a 2-part authentication.
You have a multi-part authentication (sort-of). There is a key exchange involved in the https. I've worked on a similar system (for a medical insurance company).
Here's my take. Username/Password is okay, so long as password strength is sufficient. I made a modified version of crack to hammer passwords on our system and I cracked about 40% in less than a week on a 200MHz Pentium. Of course, I was hammering the passwords locally.
If you:
1) Require 128-bit SSL 2) Test password strength 3) Install active attack detects 4) Enforce password change policy
I think you are probably fine. Sure, they can be broken or compromised. The most likely compromise is inappropriate password sharing at the client. You can't prevent that whatever scheme you implement except through user education (perhaps the most important and most often neglected area of security).
While multi-part authentication tokens (a la SecureID) are pretty danged strong, I don't think they are necessary here.
By active attack detect, I mean you should have daemons (or whatever) that look for someone hammering on passwords from the outside. You can do this by simple counting and account disabling, but if you do that, be sure to disable not only in the case of successive password fails, but also limit the number of password fails you allow per unit time, even with success in between.
Why? Because an attack might well assume that you limit successive failed passwords, so they might wait for a known success before they fail again.
Consider also using network origin. Keep a list of addresses from which connects may be attempted by that user. Treat any attempt to come in from elsewhere to be a password fialure (make it work alike so an attacker can't tell you do this!).
If you limit a user to three successive failures and no more than 10 failures a month, and you force a password change every month, no one should be able to crack a password where they only get 10 guesses.
These are ways you can make a password scheme secure.
BTW, I never persuaded my client to mandate 128-bit SSL, but consider the EFF's cracker machine. It can break shorter SSL in days. That means password recovery.
I guess I can distill this advice:
How would an attacker be able to break passwords? Deny them those abilities.
If you have prevented coming around your authentication mechanism to attack your password repository directly, then the steps outlined above should make your passwords plenty secure.
"Theft," in common usage is absconding with private property. Copyright is a legal construct that makes the specific embodiement of a set of ideas into private property. Copyright infringement is, therefore, whether "legally" or not, theft.
As it happens, the penalties for theft of a $25 something are far less than the potential penalties for copying a $25 something and giving it to friend. Criminal copyright infringement is a federal crime and a felony. $25 theft from your local Market-o-Mass-Media is a petty misdemeanor.
Believe it or not, there is a conception of right and wrong beyond the narrow confines of legalese. It seems to me right and proper that the creator of a work should have the right to control of the work. That's what copyright is about. The right to copy.
If you create something and wish to cast it into the wind, so be it. That's what the GPL is about: using the instrument of copyright to ensure that a work is and shall remain free.
My whole point (I had one when I started) is that this is not like the Linux DeCSS mess (where they did nothing AFAIK that would constitute a violation of US law; how sad they were in Norway if their laws make what they did illegal). This is not a free-speech issue (unless you are talking about the free-speech rights of the artists). This is not like the arguments against software patents.
There was a recent case where somebody wanted to use Dr. Martin Luther King's famous "I have a dream" speech in a television advertisement. This is something I would have held to be a grotesque debasement of one of the most important examples on rhetoric in this, or any other, century. Fortunately, Dr. King copyrighted all his speeches. The advertisers went to court arguing that it had been news, and therefore a matter of public record. The court upheld the copyright. Copyright good.
You may indeed be doing little or no harm when you copy a song and give it to a friend. If it stays at that level, it is unlikely to draw the attention of any law enforcement or corporate lackeys. But it is the same usurpation of the creator's rights as it would be if you did it on an industrial scale. It is simply a matter of scale, or degree. It is the same act. We convict someone of murder no matter if they kill one person or fifty. When you copy a song and give it to a friend you are acting as those advertisers would have acted if they had gone ahead and used "I have a dream" to sell a car, or some soap, or bottles of beer.
The placing of mp3s on public servers (and we didn't get enough detail on this story, so I am only assuming this is what they did), and then to argue fair use is like me copying your book 100,000 times and leaving the copies lying around and then trying to claim, "Oh, that's fair use -- those are all for me."
When you share you're not even breaking a law, much less stealing anything. When you copy you may be infringing on a copyright, but even that is not theft. It simply isn't, it doesn't even have the same
sentences as theft. Legally speaking they're different crimes.
This is facile. It depends on who owned what you're sharing in the first place. Feel free to share anything you own. When you share property of mine without asking me or telling me, you are stealing. And I don't care if the law views it differently, I am talking about moral conduct here.
I think there is plenty of room for a philosophical debate about the nature of a duplicable recording -- how can it be stolen if the "owner" still has the thing? You've just made more of it. Is a copy of a thing the thing? This is metaphysics.
As a matter of practice, however, the whole of copyright law is based on the notion that the author of a text (or score, and by extension the more modern texts of film, broadcasts, and recordings of the same) can choose to reserve rights to that work; can choose to grant those rights in whole or in part. Unpublished works are protected. Published works are protected by copyright.
The point of this that the copyright holder is the sole entity with the right to assign those rights. When you copy and distribute, you are usurping the right of the creator because you feel like it. Criminal copyright violation is a felony and carries considerably greater criminal and civil penalties than would theft of a CD from a record store, which would be a petty misdemeanor.
In music these days, most artists are covered by ASCAP (in the US) or BMI (in the UK) minimum basic agreement (or better as negotiated by the artist or his/her agent) which grants certain specific rights to the record label for a certain period of time and certain rights to the artist. Amongst other things, these basic agreements specify terms for radio broadcasting of songs, so that indivdual radio stations don't have to enter into individual contracts with indivdual artists to play individual songs on the radio.
Now, if I publish a song and copyright it, I do so in the expectation that I (or contractually authorized agents) will control distribution of the song. When you copy it and give it to a friend, you steal that right (and in all likelihood, cost me money). If I publish a song and do not copyright it, or I grant specific permission for everyone to use it as they please, then fine. I don't then expect that control.
The courts have established a fairly consistent pattern when it comes to home recording. When a recording is of material legally purchased by you and that recording is intended for personal use, then it constitutes "fair use" and you may do so. Play it to others for profit, give it away to others, or sell copies and you are stealing (criminal copyright infringement).
As for the RIAA, they are the trade association of the recording industry. They act in the interest of their members (the record companies).
This is not a free-speech, free-software issue. This isn't even like the Linux CSS software debacle, which was about a boneheaded encryption scheme that locked out open-source software. But why does the entertainment industry want bonedheaded encryption? Because of a bunch people out there "sharing."
Look, we either live in a civil society or we live in a "bugger the hindmost" every savage for himself, take what you can get, screw your neighbor society.
Rationalize it all you want, it is still illegal to speed. The law is just another social contract. I agree to be contrained by rules because I then know others are similarly contstrained and this protects me from harm at the hands of others. So you speed, doing 70-mph in a 55-mph zone on an urban freeway. No harm, right? Well what about someone doing 45 in a 30 zone at a grade crossing on a snowy day? That 15mph difference could be the idfference between stopping successfully when the light changes and slamming into someone, killing them.
Speeding is not without consequences, even on the freeway. Because you are willing to take the risk on yourself does not mean that I, as another driver on that road, have agreed to take on that added risk.
I, too, exceed the speed limit somewhat in my desire to get where I'm going, but if I get pulled over and get a ticket its just my own damned fault.
While I love free software and am very upset about patents and their effects on programming freedom, I totally support copyright in all of tis forms. It is up to an author whether or not to sell or give away their creation. When you copy and share, you steal. Period. It may be a small crime, but you knew you were breaking the law. You have to accept the consequences. "Everybody does it" is not an excuse.
"A patriot is someone who gets a parking ticket and rejoices that the system works." -- Somebody clever whose name I can't recall right now...
I don't think it's quite fair to criticize the "depth" of the review. The author outright says that he's a newbie to BSD and that this is the story of his experience with it.
He tells a tale of the difficulties he had as a fairly Linux savvy person using OpenBSD for the first time, and he speaks as deeply of the benefits of the running system as his experience justifies.
I wouldn't trust hime if he went into more depth. A few days of poking does not an expert make.
BTW, I've been using Linux since 1993 (I first tried the TAMU distribution, anyone else out there use TAMU?) and just this summer installed my first *BSD system, I put FreeBSD on an old 486 on my network. I had a good experience with that. It's up and stable and I use to serve copies of my "Webmaster in a Nutshell Deluxe" and "Java in a Nutshell Deluxe" CD-ROMs to the rest of my network via NFS. It works beautifully, and I haven't had to touch the box for nearly six months now. What else do you want from a server?
So, this guys's story made me keen to try out OpenBSD and see what that could do for me.
I think that's what the article was about, rather than a comprehensive review.
Oh yeah, another commenter said (disparagingly, I think) that people who read that site are all RedHat users. I read this article and I'm a Debian user.
Hey, I could be wrong, but I though that was academy ratio. Academy ratio motion pictures (pre-widescreen) were in an aspect ratio similar if not identical 4:3 and this called the academy ratio. Perhaps academy ratio is slightly different. The only reason I was willing to call it that was that I have never seen vertical or horizontal letterboxing when they show academy ratio movies on TV. So, if the academy ratio is NOT 4:3, then it is close enough that there is no signifcant cropping. They certainly dont pan-and-scan them!
Work on Mozilla if you want to (how's the license, by the way? Does it meet snuff of can Netscape/AOL take it back any time they want?), but as a developer of web based applications, I think anyone who makes a site that won't work with an HTML 3.0 compliant browser at least to the point of all content being readable is being negligent.
HTML emphasizes content over form. The web should continue to do so. I have to admit that I wasn't fond of image maps, frames, or javascript. Even so, there are a host of simple techniques for making rich sites play nice with less capable browsers.
I'm not sure I understand why they (the entertainment industry) has their shorts all in a bundle over this. Surely they new that at least some people would be knock off DVDs via a redigitalization of the analog signal? Sure, it isn't as high quality and the seconday channels are lost, but aren't they already subject to piracy galore with VCRs? And yet they make money hand over fist on VCR rentals and sales. I am fully capable of copying videos at home, and yet most of my videotapes are purchased, pre-recorded videos.
Frankly, I think piracy should be regarded as competition. If you lower your price enough, people are simply not that tempted to pirate. I think most people would buy rather than pirate depending on price.
In shrink wrap software (which I hardly ever have to buy anymore, thank you FSF and Linus et.al.!), I would buy just about any title at $20 or less. I'll even go up to about $60 for something like Quicken (where's the Linux version, Intuit? -- BTW, I've sent them letters swearing that I'll not upgrade again until they make Linux version. What could any future version do that my current one can't?)
In movies, at an average price of $20, I seem to be content enough to buy them.
I can't help but be outraged, however, at the fact that DVDs, which cost them FAR less to make than videocassettes, are consistently more expensive! I have stuck with VCRs for now because of that (well, and because I expect HDTV to be the "must" for upgrade to DVD -- why get a DVD and feed it to my 24-inch academy ratio 3-inch mono speaker TV?).
I guess I'm saying it should be a linear programming problem to compute the price at which they get the most money rating rate of sale against rate of piracy. I don't care how much technology they throw at it. If it can be viewed, it can be copied somehow, even if it's sampling the voltages at the CRT! Give it up. Keep it open and make it cheap. People will pay then.
This story should not have resulted in the incarceration of the child. It should have resulted in a parent conference. The school should have asked the parent about knowledge of or signs of drug abuse.
One of the problems out there right now, though, is parents who go ballistic whenever a school official suggests that their little darlings are leass than perfect. My mother works in a high school and they had an incident where a ring of students was selling copies of upcoming tests for profit. When the parents of the children who bought and sold the tests were brought in, several of them threatened to sue the school if they damaged these kids chances of getting into ivy league schools.
Parents do not seem to see that an unearned degree doesn't do anyone any good. Cheating doesn't improve things for anybody in the long run.
This is a halloween horror story. But the horror is the inarticulate writing, the unimagintive substitution of gore for fear, and the fact that a 13-year-old is fully literate in the drug culture.
Something should have been done for this young man a long time ago. Someone should have rewarded his diligence and been disappointed in his laziness. Someone should have been proud of him.
I don't know the particulars here, but freedom is not a right of childhood. It is not and it shouldn't be. Parents and educators should have both a right and a obligation to constrain the behaviors of the young. The young should have the right to try and get away with everything they can. That's what the passage into adulthood is, the establishment of a unique identity that knows that society is bound to him and he to society. I don't mean blind, mindless obedience, I mean enlightened self-interest.
Nihilism and self-destruction seem to have replaced optomism and cooperation. I don't know why, but I do know two things that should NOT be done about it:
1) Children should not be treated as criminals because they have the irresponsibility of youth.
2) Children should not be allowed to run wild, doing whatever they please, saying whatever they please without regard to how it affects others.
The condescending and paranoid adult attitudes towards the young dovetail neatly with the arrogant, disrespectful, "serve me now" attitude that the young seem to display towards educators.
The combination is a formula for disaster.
A 13-year old doesn't know that he will die. He WILL die. When he dies, everything stops. If he loves, everything he loves will one day be lost. Time is short, life is so precious, and we are teaching our young to waste it by being callous, unfeeling, indifferent, nonchalant, self-centered, nihilistic, and bored. The worst thing a young person can be is passionate.
The sad thing to me is that I think it is the ones who deep in their hearts know that life is a magnificient, intoxicating, awesome thing, those who have shown their caring and vulnerable hearts cautiously and tentatively to others, who have had their deep feeling and thought mocked and belittled. They are the ones most harmed. They are the ones most likely to be unable to live with this world that seems not have a heart. They are the ones most harmed by the "paranoid adult" attitude that so rankles Katz and company.
The problem is that the adults can't tell the difference between those alienated children and the others who definitely do exist. Those whom we have made sociopaths. Those who take pleasure only in cruelty. Who have known only the tenderness of the blue flickering phosphor tube, those who have been held in human arms so rarely that they are scarecely aware of the absence. Those who cannot see others as feeling beings because they no longer are.
You see, they've learned that the only love they've had, that flickering phospohor tube, only wants to sell them something. It doesn't love them either.
We need to ask ourselves (those of us here old enough to be parents) what we are doing by bring a child into this world and raising them this way.
I'm going to quote from what I think may be one of the most important films of all time, a film made in the mid-1970's called Network. Watch it. Feel it. Make it a part of you.
"...because fewer than 8% of you people read books. Because fewer than 15% of you people read newspapers. Because the only truth you know is what comes to you over this tube. Right now there is a whole, an entire generation that never knew anything that didn't come out of this tube. This tube is the Gospel. The Ultimate Revelation. This tube can make or break Presidents, Popes, Prime Ministers, this tube is the most awesome goddamned force in the whole godless world, and that's why woe is us...
"So, you listen to me! Listen to me! Television is not the truth. Television is a goddamned amusement park. A traveling troupe of acrobats, storytellers, jugglers, and football players! We're in the boredom killing business! So, if you want the truth, go to God. Go to your gurus. Go to yourselves because that's the only place you're ever gonna find any real truth. Man, you're never gonna get the truth from us. We'll tell you anything you want to hear. We'll tell you that Kojak always gets the killer, and that nobody ever gets cancer at Archie Bunker's house, and no matter how much trouble the hero is in, just look at your watch, at then end of the hour, he's going to win. We'll tell you any shit you want to hear.
"But YOU people sit there, night after night, day after day; We're all you know. You're beginning to believe the lies we're spinning here. You're beginning to believe that television is reality and that your own lives are unreal. You do whatever the tube tells you. You dress like the tube, you eat like the tube, you raise your children like the tube, you even think like the tube. This is mass madness you maniacs! In God's name, you people are the real thing, we are the illusion!
He proceeds to chant "Turn off your television sets, turn them off, turn them off and leave them off, turn them off!"
The screenwriter, Paddy Chayefsky, had something important to say, I think...
I've rambled here. I haven't been exactly on point, but I'm concerned. I think our society is deeply sick and the problems of youth seem to me to point only at it getting worse. I don't think youth is to blame. Quite the reverse. We are for overcoddling, indulging, being fearful of the rebuke of parents, courts, lawyers. We don't hold children accountable when they're young and ready for moral learning, so we abuse them when they're adolescents and either (as I think most of them are) just awkward and searching for themselves, but basically just fine, or they are that tiny minority of true sociopaths, and its already too late for them. So we abuse the sensetive because we fear them, and we continue to let media and consumer culture raise our young because we are too busy making money to buy crap ourselves.
Once again, evil RF radiation comes in to destroy our minds, give us brain cancer, and generally mess up our bodies.
This is crap science reporting. (Since I haven't read the scientific paper, I can't judge the science). It is possible that low level RF from cell phones had an effect on the rat's ability to find the platform in the middle of the milk, but I don't see how one can conclude that memory is what was affected. How about directional sense or motor coordination?
I still maintain that standing in sunlight complaining about radiation from your cell phone is like calling your neighbor during a hurricane to complain that his cat is breathing on your trees.
Until you have an etiology whereby RF causes harm to your brain, you can't say RF is the cause.
The effects of RF at thes power levels and distances from your neurons is so miniscule. Until you show me a physiological change in brain tissue exposed to RF, I just don't buy it.
Boo! Raaayyydiayyyytion! Boo!
What's hitting you when your turn on a light? Radiation! What's hitting you when you stand in the sun? Radiation (really broadband radiation, too, from DC to daylight)! Radiation is nothing but energy in motion, either in photons (RF, aka "light") or in massive particles (alpha and beta particles, protons, neutrons, or electrons moving at high speeds).
Radiation can really only affect you in a few ways. It can raise your temperature, it can break chemical bonds, or it can cause nuclear change. The first effect is the most common and happens at lower energies (like those in cell phones). The second is an electron effect and happens at higher energies. The third is a nuclear effect at happens at really high energies where neutrons are forced into atomic nuclei making, possibly, unstable isotopes out of stable ones. This last one is quite rare and I don't think any terrestrial RF source has that kind of energy (I'm not a physicist, can this happen at cosmic ray energies?). The second and third effects just don't happen at energies this low. (Actually, I would guess that the second could happen VERY RARELY through some phonon effect or somesuch -- can an educated person help me out here?)
Anyways, I still think this is way overhyped. You get more harmful radiation working in a granite building. If you're really scared, get a mag mount antenna (if you double the distance between your head and the antenna, your reduce the dose to 1/4th, triple it, 1/9th, and so on -- inverse square law, remember?) and keep your calls short.
Just a little follow-up. I think your point was my point. You just said it more succinctly. One point in my orignal post that I really wish to stress is that I consider scientific orthdoxy to be much less of a concern than over-specialization and compartmentalization. I think one of the most common occasions for scientists (and understand, I am not a practicing scientist. My reading extends only as far as Scientific American, which is hardly an academic journal) to be dismissed is when they write on subjects outside their well-known field. Science itself, however, the so-called scientific method developed out of an interdisciplinary set of skills; yes, a "liberal arts" education. Science was, when it first began to be formalized, called "nature philosophy." It was thought of as one philosophical method out of many. It still is. But the whole of the academy has become so self-contained and insular (for good reasons -- there is so much knowledge to be learned that it takes a lifetime to be an expert in these small, narrow fields), that I fear we miss out on whole avenues of thought. To trot out another cliche, I think they (scientists) sometimes cannot see the forest for the trees.
That's what excited me about Gold. That's what I think Feynman gets at in his autobiographical books -- anyone can do science, in any field. Just don't be disappointed when your brilliant discover turns out to have been made 138 years ago by someone else, and proven wrong 57 years ago by yet another someone.
So, yes, I value the men and women with wide and shallow knowledge, just as I value those with knowledge narrow and deep.
I just want us to keep in mind that even when a kook is right, he's still a kook (I use the word "kook" in its technical psychological sense, of course!)
The threads in the discussion clearly demonstrate why a conservative scientific mainstream is needed. Look at how many of these discussions turn into a sort of scientific wish fulfillment where things that people want to believe are put forth and backed up with evidence that the scientific orthodoxy was wrong in the past.
I think problems lies in distriguishing what is possible from what is true. That's the difference between hypothesis and theory. Experiment is the path from hypothesis to theory. Theory is as strong a statement as you can (or should) expect science to make, because you never know when an observation is going to blow it all out of the water.
Of course there is stodgy resistance to new ideas. That's because scientists are people. Show me an organization without orthodoxy and I'll show the absence of an organization;-)
For every example of the orthodoxy resisting an idea that later turned out to be accepted theory, I can show you tens of thousands of crackpots who, in their ignorance of much of the body of scientific knowledge and method, advance theories that were demonstrated false by sound experiment decades ago.
I'm not saying "forward the stodgy orthodoxy" here, I'm just saying, to trot out a cliche, don't throw the baby out with the bathwater. I see three dangers in the scientific orthodoxy that should be examined regularly:
1) Human desire. This is the natural reluctance we all have to abandon a belief, particularly one to which we have dedicated our lives and whose overthrow amounts to a repudiation of our lives' work. This is what made Wegener (sp?), proponent of Continental Drift, into a pariah.
2) Financial interest. This is closely related to human desire, because greed is a human desire, but here I'm talking about something even more basic. If your livelihood, which is necessity (as opposed to your future wealth, which is greed), depends on funding from organizations who would withdraw funding if their agenda were undermined by your findings, you would be sorely tempted to withhold findings; not to say falsify findings.
3) Specialization. This is part, I think, of Gold's heresy. The "scientifc community" tends to separate in disciplines and those disciplines tend to become insular. How many geologists know much, if anything, about astronomer's findings of hydrocarbons on other worlds? How could they come up with a radical new idea on the formation of oil if they are ignorant of a significant source of information. Likewise, one of the reasons Wegener (yes, him again) was dismissed was that he was a meteorologist. What did he know about geology? This last problem is perhaps the most serious.
So, yes, problems exist. Even so, most radical ideas are, I suspect, quite spectacularly wrong. There are limited time, money, and tools for scientific research. Some effort must be made to concentrate our efforts on research likely to bear fruit (not just economic, but also purely intellectual fruit).
I think most people seriously underestimate how much we know about the physical world, and how abstruse, sensetive, and detailed are experiments that move science incrementally forward. This fact is what makes "problem area 3" such a, well, problem. This kind of science is based on inference; on steady observation, and drawing reasonable conclusions and extrapolations from those observations.
But don't despair. Science's famous heroes are those who leap beyond the current framework. Those people frequently labor in the world of inference, but at the same time are accumulating a wider model; an idea, like Einstein's photons or his relativity; like Gold's geophysical oil production; like Wegener's drifting continents. At some point the idea "solidifies," and they outline a radical hypothesis. This is an act of imagination, and quite different from inference. Inference is a process (as is "science"), but imagination is a human creative act, as difficult to quantify as "insight" or "brilliance."
The trouble is, in music or poetry or painting, you have the "insight" and you are done. You have created. In science, however, your insight must be tested against the physical world. Many a beautiful theory has been destroyed by an ugly fact (I wish I could say I had invented that turn of phrase; can someone remind me who said that first? I have forgotten, but I love the phrase).
This is, I think, the source of the "Nobel whacko." Many scientists are, I think, freed by their Nobel prize; by the concrete assurance of their status that the prize represents. They are freed to articulate their personal untested pet hypothesis.
I have to wrap up this ramble. I'd just like to say that I think people are far too sanguine. People are far too ready to believe an idea that matches their "feeling" about how things should work. Even Einstien said "God does not play dice." Don't let's throw away the orthodoxy. As with so much of life, good science is the challenge of finding balance.
All I can say is I bought Civ:CTP and I love it. I'm having a blast playing it, and I got a free FreeBSD CD from (I can't remember if it was LinuxMall or LinuxCentral... sorry...).
I'm having as much fun with FreeBSD as I am with Civ:CTP. Still run Linux on all but one of my boxes, though...
"Kook" is too strong, and "idealogue" not strong enough. I think it is fair to say that this guy is more concerned and hyperbolic than most commentators, but I have read a number of stories from reputable sources (NPR, The Economist) that indicate that MS has had actual losses due to both time shuffling of earnings and the lamentable fact that no one (not just MS) has to report stock options as a debt.
In other words (and remember, not only am I not an accountant nor a lawyer, but I'm barely fluent in basic economics, so this is definitely a media created impression, not knowledgeable reportage), it may well be that MS has had multi-million dollar losses in the last few years. So have many companies that continue to have high stock prices and good long-term prospects.
I would very much like to see a change in the law requiring that stock options be included in financial reports as debts, because THEY REALLY ARE DEBT. The reason that I think the banking and SEC big-wigs are not all bent out of shape over this is NOT that MS is buying their silence, but rather that this has become a pervasive practice and changing radically and suddenly would probably have catastrophic consequences.
I would expect to see this practice regulated increasingly over time.
What I do not know is if this practice, if added up across the market, really amounts to a dangerous bubble. That would be an interesting question. The danger would depend on the ratio of vested, unredeemed stock options to the market cap of the company all weighed against earnings. If the P/E ratio is already out of whack and the percentage of options in total market cap is high, well, that would have to be risky, wouldn't it?
I guess I'd side with this gadfly to the extent that I think we should agitate for tighter regulation of the accounting practices that allow the "shadow debt" of options, and for greater disclosure.
Beyond that, I'd like to hear from several other experts and economists. This guy's story is interesting, but long on conclusions and short on data.
Yep. They can't brute force your encrypted message, but they can look in your swap partition from fragments of your passphrase, or even the decrypted key itself. If you've ever typed your passphrase in a telnet session or on an X-server where the client was elsewhere on the network, etc. etc. etc.
They can also, if you've been using crypto in a crime (or if they accuse you of using crypto in a crime) they can create powerful incentives for you to give up the key.
Truth is, you should protect that passphrase like all get-out. You should keep your private keys on a CD-R and you should carry it with you. You should throw it on a fire when you are done with it. You should use gpg and pay attention to the secure memory features. Now you have a crypto system that is so difficult to use, its very annoying. That's just as well. You'll only use it when you really need it. The less ciphertext made with a given key, the better.
The NSA is probably better at breaking things than you think because, as Bruce says, the weak links are not the crypto algorithms.
Along this line, consider: There are two free versions of (yes, I know it sounds goofy, but think about it) MS-DOS out there. Some sort of simple GUI (GEM? an OEM GUI) that provided only a browser and an e-mail app? That wouldn't be that hard to write if you just made it a context switcher instead of a multi-tasker. Kind of a beefed-up PalmOS. I'm not seriously suggesting this is the case, but I feel like Linux/*BSD would be overkill for a machine like this.
OTOH, it would be easy to hide all the complexity of Linux/*BSD by having accounts that add users, start-up and shutdown the machine, and dial-in and disconnect. Just specify the appropriate commands as shells in/etc/passwd and there you have it. The/etc/skel would give each new user an account the fires straight into Netscape. The users would never see a shell.
I don't know what it is. Its just kind of fun to know the market is changing.
Diversity is good. Whatever they're going to use, it's better than no choice at all.
I've been very sympathetic to Katz and his advocacy for alienated youth in the past. I still think that mature adults (and by this I do not atuomatically mean that adolescents are immature, merely that there is a perspective that comes with time; the one and only quality of wisdom that youth necessarily lacks) need to reach out to teens, to embrace them as they are and welcome them into the family of adulthood.
"Being different" isn't, for the most part, really different. Instead it arises from a basic desire to establish an identity, a unique personhood, especially in the face of a sort of commercial conformity that some young people embrace and others despise.
What is sad and tragic is that each attempt to create an identity is immediately co-opted by the marketing machine and sold back on MTV (and every other media outlet).
This leads to a sort of vicious cycle where youth goes to greater and greater extremes in the natural quest to be not their parents, teachers, or other adult authorities. Once targeted marketing made the great discovery that younger people are less careful with their money than older people, what would have been unthinkable now appears on prime-time TV. Look at how long it took the "hippe" youth culture to move to the mainstream. Compare that with any youth trend today from Goth to body-piercing. It's instantly a product.
I, for one, think we (meaning adults, or if you prefer, people over 30) should be a lot less uptight over teen identity, and a lot more concerned about the commercial debasement of our self-expression.
That said, I think Katz is hitting off the mark here. This "screening" is a bit unfortunate, but I see it as an effort to identify young people who might need a concerned adult in their lives. It's far from ideal, but in a world where otherwise healthy, affluent children are killing themselves and sometimes killing others, its about damned time adults and institutions started to pay attention to young people. If this tool becomes a way to make contact and start listening to the real emotional needs of young people, then it is a good tool. If it becomes a way to sort young people into the "good" ones and the "bad" ones, it's a bad tool.
Basically, I think Katz is jumping before there is something to jump on.
As for me, my approach to young people is: Respect them. Listen to them. Involve them. Love them.
Any youth who is respected, listened to, involved, and loved is unlikely to kill himself/herself or others. The rest they have to figure out for themselves.
DDE doesn't do applications embedding. That's OLE. DDE is a horse-dung IPC mechanism that sends messages in the message queue to EVERY RUNNING APPLICATION on a Windows boxen.
The expense of ORB calls can be very similar to the cost of initially calling a shared lib, but from then on shared library calls will tend to be much faster than ORB calls. This difference gets exaggerated when a lot of data is passed in the call and/or in the result, because all of it has to go through the transport representation conversion and data transmission.
Now, while I've done a fair amount of IDL/ORB/IIOP stuff in my time, I haven't looked into the KDE code at all. If they did it right, they should have a lightweight IPC API that can use a variety of transports and that will autmatically use the much faster local *nix capabilities on the local machine, and the moderately slower Xlib capabilties between X-displays, and use CORBA for anything more divergent. Point being the app writer should not have to particularly know or care.
CORBA is VERY time expensive, esp. when you're talking about things that have a dramatic influence on the perception of speed, like redrawing windows.
Often the user's feeling of performance is based more on finding the right place to stick the delay than in having the fastest end-to-end time for a process.
Case in point: I once eliminated hundreds of user's complaints about a slow system by slowing it down about 40%. We had a PowerBuilder (ugh!) front end to a client-server application. One of the forms had a pick list that was HUGE, populated by a stored procedure call. That call would often take 3-4 minutes to complete. Users went bananas because they got the good olde Win 3.1 hourglass while the pick list was populated.
I changed the code to pick up one record at a time from the result set and insert it in the pick list rather than make the single "all at once" call. It actually took 2-3 minutes longer to fully populate the pick list, but the users never got the hourglass and could start working the form right away. Zero complaints.
I guess what I'm saying is, KDE is a UI. As such, it has to focus on user issues, not technological issues. I am 100% a technology guy. I'd rather satisfy myself that things are done right than satisfy users. Even so, the KDE folks want people to use their software. That means they have to address user issues first and put architecture second. It seems to me they are doing a danged fine job of balancing these concerns.
This kind of story is why I don't like seeing "anti-/." stories out there. I'm over 30 and much of that youthful zeal is gone, so I frequently cringe at the loud and uninformed zealotry of some of my fellow/.ers, but usually, I think, their on line ranting is harmless and it is giving a place for a sort of populist rage to vent safely. Meanwhile, almost every thread has a few particles of true insight, information, and wisdom.
I happily put up with the flames to find those insights I would have missed.
One of the things I like about sites for nerds, linuxers, et. al., is the way they (we) subvert the mass media of the industry. The recent PCWeek debacle ("If I had installed the RedHat patches, I would have missed 'Baywatch.'" -- see the story on Linux Today) is a fine example of this. This story is another.
Okay, so individuals (including me) sometimes type faster than we think. So what? We think eventually. And we don't let lies go unchallenged.
Never be afraid to point out a falsehood! ZD deserves very little journalistic respect. This has nothing to do with the perceived OS bias, and everything to do with poor standards of fact checking and a complete lack of journalistic integrity.
I'm not sure you are familiar with the caucus system. You don't vote for candidates at a caucus. You vote for delegates out of the people there. You vote on platform. Yes, delegates are generally "bound" to a candidate, but the caucus system is the point of entry to part activism. If you are highly motivated on an issue, it is through the caucus that you get your issue into the party's agenda.
Caucus attendance is how the religious right got its surprising influence in the Republican party (surprising considering their political agenda is supported by a minority of Americans, a significant minority, but still a minority). They availed themselves of the tools. I'm urging "us" to do the same. By "us," I mean those here on slashdot, the majority of whom, I suspect, have similar views (not the same, but similar) on what I would call the "geek vote:"
1) UCITA and defeating it. 2) Crypto-law reform. 3) Patent law reform as applied to software. 4) Universal high-speed net access
Item 4, I suspect, will have quite a range of views within slashdot and wouldn't be a "party vote," because I see slashdot as having a wide range of political views, from people like me who think the governement ought to just get in there and "Interstate" the network, to radical libertarians who would hold that all government regulation of the communications industry should be torn down to let them build the network, but I think it is fair to say that the goal is shared and we would quibble about the means.
As for the now oft mentioned "slashdot" political site, I think people hesitate because it is likely to descend into flamewar central. I think such a thing could work if the editorial policy on articles kept them strictly confined to technology issues, and never strayed into more general policy questions.
Rob can call me -- I'd be willing to run such a site;-)
Whoops! Pasted the one definition twice (color me stupid). Here's what I meant to paste the second time:
Main Entry: democracy Pronunciation: di-'mä-kr&-sE Function: noun Inflected Form(s): plural -cies Etymology: Middle French democratie, from Late Latin democratia, from Greek dEmokratia, from dEmos + -kratia -cracy Date: 1576 1 a : government by the people; especially : rule of the majority b : a government in which the supreme power is vested in the people and exercised by them directly or indirectly through a system of representation usually involving periodically held free elections 2 : a political unit that has a democratic government 3 capitalized : the principles and policies of the Democratic party in the U.S. 4 : the common people especially when constituting the source of political authority 5 : the absence of hereditary or arbitrary class distinctions or privileges
Slashdot Mirror
I can't believe anyone would make this assertion. While I agree completely with the other half of your statement, that a good sysadmin must understand the aims of yout IT systems and know how to implement them properly, I would say that thoroughly understanding an OS is a vital prerequsite for that second clause.
Anyone who has worked with an operating system, a programming language, heck, a make and model of car, knows that there are essentially four levels of competence. First, complete incompetence. You have no knowledge, you try things and you screw things up. Second, basic competence. You have some knowledge. You successfully carry out basic tasks. You use the system without damage, but there are vast areas about which you know nothing. Third, competence. At this level you know your way around. You know how things work. You know what all the parts do. Fourth, high competence (guru). You not only know how things work, you know why. You develop a holistic sense of the system/language/automobile. You can imagine how things work. You can be presented with an unfamiliar situation and you can figure out what to do about it.
Most people with whom I have worked in IT (and I've been working professionally as either a system admin or a programmer/analyst for over 12 years now) are at what I would call level 3, and a fair number are at level 4. Thorough knowledge of a system is required to be at level 4.
The notion that one does not require deep knowledge of systems to be a systems administrator is tenable only in a system with nothing ever happens that is outside the training materials. No such system exists.
If you are arguing that deep knowledge of a system is not required to be a sysadmin, then I sure don't want to work at your company. If, OTOH, you are arguing that deep knowledge of a system is not in itself sufficient to be a good sysadmin, well, then I've been wasting your time and I apologize, because I agree with that...
Bad security is not requiring password change. Bad security is writing them down.
People have to be trained in security.
If this is a concern (you can't fire people for writing down passwords) then let them last much longer, but force a change when the failure thresholds are exceeded. That would be sufficient. The point of password changing to me is NOT to close the door again (because generally penetration once is enough), but rather to ensure that even the limited probing my proposal allows cannot be profitable, even assuming an attack lasts years. So, I'll grant you that monthly changes may be too frequent. Therefore have no forced changes until a failure threshold is reached.
If you choose to work it that way, then I'd add a third counter: failures per password. So, three successive failures is a lockout. Ten failures in a month is a lockout. Fifty failures since last password change is a forced password change.
Two part authentication is nice. But that isn't what the guy was asking. The guy was asking if username.password authentication can be sufficient. The answer is, yes it can. My post stresses that the greatest risk lies in inappropriate disclosure at the client. I think I was realistic throughout on the risks.
Password token cards and so forth are also vulnerable to deeply embedded attacks. If you have unauthorized software running on the client, then their recovery of passwords is the least of your concerns. If that situation exists, why bother recovering passwords? Just have that software read everything on the machine. If you posit a trojan program on the client, then two-part authentication won't help you. It's reading your data.
Note also that I recommend that you validate the address of the source. If a password is recovered and tried from an unauthorized locale, it fails as if the password had been changed.
So, if you are asking if a two-part authentication is superior, you bet it is. I'm just saying that a username/password system can be made reasonably secure.
You can strengthen the password system even more without a true two part system if you, instead of passing the password, calculate, say, an MD5 hash of the password, the client IP address and port and send that hash over the net. The server side uses the known password and the IP address and port it reads from the actual socket connection (this is assuming no proxy has interfered, but you can come up with something else). This way an attacker who has recovered the password must also either be on the server's network, or able to compromise every router between himself and the server.
I like this because even if the SSL is broken, nothing is learned that can be used in another attack from another location. The password cannot be recovered from the network traffic. I realize that this requires client side programming. Probably in Java (could you do this with JavaScript? I haven't used it enough to know...), which, of course, has its own risks; still.
Still better, have the server set a cookie on each connect that is used as part of the hash. The cookie is changed each time. If ever an authentication comes in that was not hashed with the last set cookie, lock the account. Somone got in there. Not only that, but it was the transaction just before the one that failed the hash. You've got the bad guy!
There are a lot of possibilities.
The person building this system has to decide if such an attack is likely and what the cost would be if such an attack were mounted. Look at what you are proposing:
Somone wants to read a doctor's e-mail so badly that he:
1) Manages to install software that can monitor keystrokes on a client.
2) Is able to pick out a password from all the keystrokes he has collected.
3) Is able to either directly connect to the client's LAN or the server's LAN such that he can impersonate a valid client IP, OR
4) Is able to compromise every router between himself and the server such that he appears to be the authorized client.
If such an attack is likely, then, by all means insist on a 2-part authentication.
You have a multi-part authentication (sort-of). There is a key exchange involved in the https. I've worked on a similar system (for a medical insurance company).
Here's my take. Username/Password is okay, so long as password strength is sufficient. I made a modified version of crack to hammer passwords on our system and I cracked about 40% in less than a week on a 200MHz Pentium. Of course, I was hammering the passwords locally.
If you:
1) Require 128-bit SSL
2) Test password strength
3) Install active attack detects
4) Enforce password change policy
I think you are probably fine. Sure, they can be broken or compromised. The most likely compromise is inappropriate password sharing at the client. You can't prevent that whatever scheme you implement except through user education (perhaps the most important and most often neglected area of security).
While multi-part authentication tokens (a la SecureID) are pretty danged strong, I don't think they are necessary here.
By active attack detect, I mean you should have daemons (or whatever) that look for someone hammering on passwords from the outside. You can do this by simple counting and account disabling, but if you do that, be sure to disable not only in the case of successive password fails, but also limit the number of password fails you allow per unit time, even with success in between.
Why? Because an attack might well assume that you limit successive failed passwords, so they might wait for a known success before they fail again.
Consider also using network origin. Keep a list of addresses from which connects may be attempted by that user. Treat any attempt to come in from elsewhere to be a password fialure (make it work alike so an attacker can't tell you do this!).
If you limit a user to three successive failures and no more than 10 failures a month, and you force a password change every month, no one should be able to crack a password where they only get 10 guesses.
These are ways you can make a password scheme secure.
BTW, I never persuaded my client to mandate 128-bit SSL, but consider the EFF's cracker machine. It can break shorter SSL in days. That means password recovery.
I guess I can distill this advice:
How would an attacker be able to break passwords? Deny them those abilities.
If you have prevented coming around your authentication mechanism to attack your password repository directly, then the steps outlined above should make your passwords plenty secure.
"Theft," in common usage is absconding with private property. Copyright is a legal construct that makes the specific embodiement of a set of ideas into private property. Copyright infringement is, therefore, whether "legally" or not, theft.
As it happens, the penalties for theft of a $25 something are far less than the potential penalties for copying a $25 something and giving it to friend. Criminal copyright infringement is a federal crime and a felony. $25 theft from your local Market-o-Mass-Media is a petty misdemeanor.
Believe it or not, there is a conception of right and wrong beyond the narrow confines of legalese. It seems to me right and proper that the creator of a work should have the right to control of the work. That's what copyright is about. The right to copy.
If you create something and wish to cast it into the wind, so be it. That's what the GPL is about: using the instrument of copyright to ensure that a work is and shall remain free.
My whole point (I had one when I started) is that this is not like the Linux DeCSS mess (where they did nothing AFAIK that would constitute a violation of US law; how sad they were in Norway if their laws make what they did illegal). This is not a free-speech issue (unless you are talking about the free-speech rights of the artists). This is not like the arguments against software patents.
There was a recent case where somebody wanted to use Dr. Martin Luther King's famous "I have a dream" speech in a television advertisement. This is something I would have held to be a grotesque debasement of one of the most important examples on rhetoric in this, or any other, century. Fortunately, Dr. King copyrighted all his speeches. The advertisers went to court arguing that it had been news, and therefore a matter of public record. The court upheld the copyright. Copyright good.
You may indeed be doing little or no harm when you copy a song and give it to a friend. If it stays at that level, it is unlikely to draw the attention of any law enforcement or corporate lackeys. But it is the same usurpation of the creator's rights as it would be if you did it on an industrial scale. It is simply a matter of scale, or degree. It is the same act. We convict someone of murder no matter if they kill one person or fifty. When you copy a song and give it to a friend you are acting as those advertisers would have acted if they had gone ahead and used "I have a dream" to sell a car, or some soap, or bottles of beer.
The placing of mp3s on public servers (and we didn't get enough detail on this story, so I am only assuming this is what they did), and then to argue fair use is like me copying your book 100,000 times and leaving the copies lying around and then trying to claim, "Oh, that's fair use -- those are all for me."
This is facile. It depends on who owned what you're sharing in the first place. Feel free to share anything you own. When you share property of mine without asking me or telling me, you are stealing. And I don't care if the law views it differently, I am talking about moral conduct here.
I think there is plenty of room for a philosophical debate about the nature of a duplicable recording -- how can it be stolen if the "owner" still has the thing? You've just made more of it. Is a copy of a thing the thing? This is metaphysics.
As a matter of practice, however, the whole of copyright law is based on the notion that the author of a text (or score, and by extension the more modern texts of film, broadcasts, and recordings of the same) can choose to reserve rights to that work; can choose to grant those rights in whole or in part. Unpublished works are protected. Published works are protected by copyright.
The point of this that the copyright holder is the sole entity with the right to assign those rights. When you copy and distribute, you are usurping the right of the creator because you feel like it. Criminal copyright violation is a felony and carries considerably greater criminal and civil penalties than would theft of a CD from a record store, which would be a petty misdemeanor.
In music these days, most artists are covered by ASCAP (in the US) or BMI (in the UK) minimum basic agreement (or better as negotiated by the artist or his/her agent) which grants certain specific rights to the record label for a certain period of time and certain rights to the artist. Amongst other things, these basic agreements specify terms for radio broadcasting of songs, so that indivdual radio stations don't have to enter into individual contracts with indivdual artists to play individual songs on the radio.
Now, if I publish a song and copyright it, I do so in the expectation that I (or contractually authorized agents) will control distribution of the song. When you copy it and give it to a friend, you steal that right (and in all likelihood, cost me money). If I publish a song and do not copyright it, or I grant specific permission for everyone to use it as they please, then fine. I don't then expect that control.
The courts have established a fairly consistent pattern when it comes to home recording. When a recording is of material legally purchased by you and that recording is intended for personal use, then it constitutes "fair use" and you may do so. Play it to others for profit, give it away to others, or sell copies and you are stealing (criminal copyright infringement).
As for the RIAA, they are the trade association of the recording industry. They act in the interest of their members (the record companies).
This is not a free-speech, free-software issue. This isn't even like the Linux CSS software debacle, which was about a boneheaded encryption scheme that locked out open-source software. But why does the entertainment industry want bonedheaded encryption? Because of a bunch people out there "sharing."
Look, we either live in a civil society or we live in a "bugger the hindmost" every savage for himself, take what you can get, screw your neighbor society.
Your choice.
Rationalize it all you want, it is still illegal to speed. The law is just another social contract. I agree to be contrained by rules because I then know others are similarly contstrained and this protects me from harm at the hands of others. So you speed, doing 70-mph in a 55-mph zone on an urban freeway. No harm, right? Well what about someone doing 45 in a 30 zone at a grade crossing on a snowy day? That 15mph difference could be the idfference between stopping successfully when the light changes and slamming into someone, killing them.
Speeding is not without consequences, even on the freeway. Because you are willing to take the risk on yourself does not mean that I, as another driver on that road, have agreed to take on that added risk.
I, too, exceed the speed limit somewhat in my desire to get where I'm going, but if I get pulled over and get a ticket its just my own damned fault.
While I love free software and am very upset about patents and their effects on programming freedom, I totally support copyright in all of tis forms. It is up to an author whether or not to sell or give away their creation. When you copy and share, you steal. Period. It may be a small crime, but you knew you were breaking the law. You have to accept the consequences. "Everybody does it" is not an excuse.
"A patriot is someone who gets a parking ticket and rejoices that the system works."
-- Somebody clever whose name I can't recall right now...
I don't think it's quite fair to criticize the "depth" of the review. The author outright says that he's a newbie to BSD and that this is the story of his experience with it.
He tells a tale of the difficulties he had as a fairly Linux savvy person using OpenBSD for the first time, and he speaks as deeply of the benefits of the running system as his experience justifies.
I wouldn't trust hime if he went into more depth. A few days of poking does not an expert make.
BTW, I've been using Linux since 1993 (I first tried the TAMU distribution, anyone else out there use TAMU?) and just this summer installed my first *BSD system, I put FreeBSD on an old 486 on my network. I had a good experience with that. It's up and stable and I use to serve copies of my "Webmaster in a Nutshell Deluxe" and "Java in a Nutshell Deluxe" CD-ROMs to the rest of my network via NFS. It works beautifully, and I haven't had to touch the box for nearly six months now. What else do you want from a server?
So, this guys's story made me keen to try out OpenBSD and see what that could do for me.
I think that's what the article was about, rather than a comprehensive review.
Oh yeah, another commenter said (disparagingly, I think) that people who read that site are all RedHat users. I read this article and I'm a Debian user.
Oh, and the 24-inch referred to my screen diagonal measurement. It wasn't meant to be part of the aspect ratio comment...
Hey, I could be wrong, but I though that was academy ratio. Academy ratio motion pictures (pre-widescreen) were in an aspect ratio similar if not identical 4:3 and this called the academy ratio. Perhaps academy ratio is slightly different. The only reason I was willing to call it that was that I have never seen vertical or horizontal letterboxing when they show academy ratio movies on TV. So, if the academy ratio is NOT 4:3, then it is close enough that there is no signifcant cropping. They certainly dont pan-and-scan them!
To this one I can only say, "Say Amen, somebody!"
Work on Mozilla if you want to (how's the license, by the way? Does it meet snuff of can Netscape/AOL take it back any time they want?), but as a developer of web based applications, I think anyone who makes a site that won't work with an HTML 3.0 compliant browser at least to the point of all content being readable is being negligent.
HTML emphasizes content over form. The web should continue to do so. I have to admit that I wasn't fond of image maps, frames, or javascript. Even so, there are a host of simple techniques for making rich sites play nice with less capable browsers.
Standards, folks, standards!
If you new what I new. Knew, dammit! K!
:-)
Sorry. I just hate it when my fingers make me look like a moron. I prefer to do it with the message content!
I'm not sure I understand why they (the entertainment industry) has their shorts all in a bundle over this. Surely they new that at least some people would be knock off DVDs via a redigitalization of the analog signal? Sure, it isn't as high quality and the seconday channels are lost, but aren't they already subject to piracy galore with VCRs? And yet they make money hand over fist on VCR rentals and sales. I am fully capable of copying videos at home, and yet most of my videotapes are purchased, pre-recorded videos.
Frankly, I think piracy should be regarded as competition. If you lower your price enough, people are simply not that tempted to pirate. I think most people would buy rather than pirate depending on price.
In shrink wrap software (which I hardly ever have to buy anymore, thank you FSF and Linus et.al.!), I would buy just about any title at $20 or less. I'll even go up to about $60 for something like Quicken (where's the Linux version, Intuit? -- BTW, I've sent them letters swearing that I'll not upgrade again until they make Linux version. What could any future version do that my current one can't?)
In movies, at an average price of $20, I seem to be content enough to buy them.
I can't help but be outraged, however, at the fact that DVDs, which cost them FAR less to make than videocassettes, are consistently more expensive! I have stuck with VCRs for now because of that (well, and because I expect HDTV to be the "must" for upgrade to DVD -- why get a DVD and feed it to my 24-inch academy ratio 3-inch mono speaker TV?).
I guess I'm saying it should be a linear programming problem to compute the price at which they get the most money rating rate of sale against rate of piracy. I don't care how much technology they throw at it. If it can be viewed, it can be copied somehow, even if it's sampling the voltages at the CRT! Give it up. Keep it open and make it cheap. People will pay then.
This story should not have resulted in the incarceration of the child. It should have resulted in a parent conference. The school should have asked the parent about knowledge of or signs of drug abuse.
One of the problems out there right now, though, is parents who go ballistic whenever a school official suggests that their little darlings are leass than perfect. My mother works in a high school and they had an incident where a ring of students was selling copies of upcoming tests for profit. When the parents of the children who bought and sold the tests were brought in, several of them threatened to sue the school if they damaged these kids chances of getting into ivy league schools.
Parents do not seem to see that an unearned degree doesn't do anyone any good. Cheating doesn't improve things for anybody in the long run.
This is a halloween horror story. But the horror is the inarticulate writing, the unimagintive substitution of gore for fear, and the fact that a 13-year-old is fully literate in the drug culture.
Something should have been done for this young man a long time ago. Someone should have rewarded his diligence and been disappointed in his laziness. Someone should have been proud of him.
I don't know the particulars here, but freedom is not a right of childhood. It is not and it shouldn't be. Parents and educators should have both a right and a obligation to constrain the behaviors of the young. The young should have the right to try and get away with everything they can. That's what the passage into adulthood is, the establishment of a unique identity that knows that society is bound to him and he to society. I don't mean blind, mindless obedience, I mean enlightened self-interest.
Nihilism and self-destruction seem to have replaced optomism and cooperation. I don't know why, but I do know two things that should NOT be done about it:
1) Children should not be treated as criminals because they have the irresponsibility of youth.
2) Children should not be allowed to run wild, doing whatever they please, saying whatever they please without regard to how it affects others.
The condescending and paranoid adult attitudes towards the young dovetail neatly with the arrogant, disrespectful, "serve me now" attitude that the young seem to display towards educators.
The combination is a formula for disaster.
A 13-year old doesn't know that he will die. He WILL die. When he dies, everything stops. If he loves, everything he loves will one day be lost. Time is short, life is so precious, and we are teaching our young to waste it by being callous, unfeeling, indifferent, nonchalant, self-centered, nihilistic, and bored. The worst thing a young person can be is passionate.
The sad thing to me is that I think it is the ones who deep in their hearts know that life is a magnificient, intoxicating, awesome thing, those who have shown their caring and vulnerable hearts cautiously and tentatively to others, who have had their deep feeling and thought mocked and belittled. They are the ones most harmed. They are the ones most likely to be unable to live with this world that seems not have a heart. They are the ones most harmed by the "paranoid adult" attitude that so rankles Katz and company.
The problem is that the adults can't tell the difference between those alienated children and the others who definitely do exist. Those whom we have made sociopaths. Those who take pleasure only in cruelty. Who have known only the tenderness of the blue flickering phosphor tube, those who have been held in human arms so rarely that they are scarecely aware of the absence. Those who cannot see others as feeling beings because they no longer are.
You see, they've learned that the only love they've had, that flickering phospohor tube, only wants to sell them something. It doesn't love them either.
We need to ask ourselves (those of us here old enough to be parents) what we are doing by bring a child into this world and raising them this way.
I'm going to quote from what I think may be one of the most important films of all time, a film made in the mid-1970's called Network. Watch it. Feel it. Make it a part of you.
"...because fewer than 8% of you people read books. Because fewer than 15% of you people read newspapers. Because the only truth you know is what comes to you over this tube. Right now there is a whole, an entire generation that never knew anything that didn't come out of this tube. This tube is the Gospel. The Ultimate Revelation. This tube can make or break Presidents, Popes, Prime Ministers, this tube is the most awesome goddamned force in the whole godless world, and that's why woe is us...
"So, you listen to me! Listen to me! Television is not the truth. Television is a goddamned amusement park. A traveling troupe of acrobats, storytellers, jugglers, and football players! We're in the boredom killing business! So, if you want the truth, go to God. Go to your gurus. Go to yourselves because that's the only place you're ever gonna find any real truth. Man, you're never gonna get the truth from us. We'll tell you anything you want to hear. We'll tell you that Kojak always gets the killer, and that nobody ever gets cancer at Archie Bunker's house, and no matter how much trouble the hero is in, just look at your watch, at then end of the hour, he's going to win. We'll tell you any shit you want to hear.
"But YOU people sit there, night after night, day after day; We're all you know. You're beginning to believe the lies we're spinning here. You're beginning to believe that television is reality and that your own lives are unreal. You do whatever the tube tells you. You dress like the tube, you eat like the tube, you raise your children like the tube, you even think like the tube. This is mass madness you maniacs! In God's name, you people are the real thing, we are the illusion!
He proceeds to chant "Turn off your television sets, turn them off, turn them off and leave them off, turn them off!"
The screenwriter, Paddy Chayefsky, had something important to say, I think...
I've rambled here. I haven't been exactly on point, but I'm concerned. I think our society is deeply sick and the problems of youth seem to me to point only at it getting worse. I don't think youth is to blame. Quite the reverse. We are for overcoddling, indulging, being fearful of the rebuke of parents, courts, lawyers. We don't hold children accountable when they're young and ready for moral learning, so we abuse them when they're adolescents and either (as I think most of them are) just awkward and searching for themselves, but basically just fine, or they are that tiny minority of true sociopaths, and its already too late for them. So we abuse the sensetive because we fear them, and we continue to let media and consumer culture raise our young because we are too busy making money to buy crap ourselves.
I don't know the way out.
I don't know what to do.
Once again, evil RF radiation comes in to destroy our minds, give us brain cancer, and generally mess up our bodies.
This is crap science reporting. (Since I haven't read the scientific paper, I can't judge the science). It is possible that low level RF from cell phones had an effect on the rat's ability to find the platform in the middle of the milk, but I don't see how one can conclude that memory is what was affected. How about directional sense or motor coordination?
I still maintain that standing in sunlight complaining about radiation from your cell phone is like calling your neighbor during a hurricane to complain that his cat is breathing on your trees.
Until you have an etiology whereby RF causes harm to your brain, you can't say RF is the cause.
The effects of RF at thes power levels and distances from your neurons is so miniscule. Until you show me a physiological change in brain tissue exposed to RF, I just don't buy it.
Boo! Raaayyydiayyyytion! Boo!
What's hitting you when your turn on a light? Radiation! What's hitting you when you stand in the sun? Radiation (really broadband radiation, too, from DC to daylight)! Radiation is nothing but energy in motion, either in photons (RF, aka "light") or in massive particles (alpha and beta particles, protons, neutrons, or electrons moving at high speeds).
Radiation can really only affect you in a few ways. It can raise your temperature, it can break chemical bonds, or it can cause nuclear change. The first effect is the most common and happens at lower energies (like those in cell phones). The second is an electron effect and happens at higher energies. The third is a nuclear effect at happens at really high energies where neutrons are forced into atomic nuclei making, possibly, unstable isotopes out of stable ones. This last one is quite rare and I don't think any terrestrial RF source has that kind of energy (I'm not a physicist, can this happen at cosmic ray energies?). The second and third effects just don't happen at energies this low. (Actually, I would guess that the second could happen VERY RARELY through some phonon effect or somesuch -- can an educated person help me out here?)
Anyways, I still think this is way overhyped. You get more harmful radiation working in a granite building. If you're really scared, get a mag mount antenna (if you double the distance between your head and the antenna, your reduce the dose to 1/4th, triple it, 1/9th, and so on -- inverse square law, remember?) and keep your calls short.
Just a little follow-up. I think your point was my point. You just said it more succinctly. One point in my orignal post that I really wish to stress is that I consider scientific orthdoxy to be much less of a concern than over-specialization and compartmentalization. I think one of the most common occasions for scientists (and understand, I am not a practicing scientist. My reading extends only as far as Scientific American, which is hardly an academic journal) to be dismissed is when they write on subjects outside their well-known field. Science itself, however, the so-called scientific method developed out of an interdisciplinary set of skills; yes, a "liberal arts" education. Science was, when it first began to be formalized, called "nature philosophy." It was thought of as one philosophical method out of many. It still is. But the whole of the academy has become so self-contained and insular (for good reasons -- there is so much knowledge to be learned that it takes a lifetime to be an expert in these small, narrow fields), that I fear we miss out on whole avenues of thought. To trot out another cliche, I think they (scientists) sometimes cannot see the forest for the trees.
That's what excited me about Gold. That's what I think Feynman gets at in his autobiographical books -- anyone can do science, in any field. Just don't be disappointed when your brilliant discover turns out to have been made 138 years ago by someone else, and proven wrong 57 years ago by yet another someone.
So, yes, I value the men and women with wide and shallow knowledge, just as I value those with knowledge narrow and deep.
I just want us to keep in mind that even when a kook is right, he's still a kook (I use the word "kook" in its technical psychological sense, of course!)
The threads in the discussion clearly demonstrate why a conservative scientific mainstream is needed. Look at how many of these discussions turn into a sort of scientific wish fulfillment where things that people want to believe are put forth and backed up with evidence that the scientific orthodoxy was wrong in the past.
;-)
I think problems lies in distriguishing what is possible from what is true. That's the difference between hypothesis and theory. Experiment is the path from hypothesis to theory. Theory is as strong a statement as you can (or should) expect science to make, because you never know when an observation is going to blow it all out of the water.
Of course there is stodgy resistance to new ideas. That's because scientists are people. Show me an organization without orthodoxy and I'll show the absence of an organization
For every example of the orthodoxy resisting an idea that later turned out to be accepted theory, I can show you tens of thousands of crackpots who, in their ignorance of much of the body of scientific knowledge and method, advance theories that were demonstrated false by sound experiment decades ago.
I'm not saying "forward the stodgy orthodoxy" here, I'm just saying, to trot out a cliche, don't throw the baby out with the bathwater. I see three dangers in the scientific orthodoxy that should be examined regularly:
1) Human desire. This is the natural reluctance we all have to abandon a belief, particularly one to which we have dedicated our lives and whose overthrow amounts to a repudiation of our lives' work. This is what made Wegener (sp?), proponent of Continental Drift, into a pariah.
2) Financial interest. This is closely related to human desire, because greed is a human desire, but here I'm talking about something even more basic. If your livelihood, which is necessity (as opposed to your future wealth, which is greed), depends on funding from organizations who would withdraw funding if their agenda were undermined by your findings, you would be sorely tempted to withhold findings; not to say falsify findings.
3) Specialization. This is part, I think, of Gold's heresy. The "scientifc community" tends to separate in disciplines and those disciplines tend to become insular. How many geologists know much, if anything, about astronomer's findings of hydrocarbons on other worlds? How could they come up with a radical new idea on the formation of oil if they are ignorant of a significant source of information. Likewise, one of the reasons Wegener (yes, him again) was dismissed was that he was a meteorologist. What did he know about geology? This last problem is perhaps the most serious.
So, yes, problems exist. Even so, most radical ideas are, I suspect, quite spectacularly wrong. There are limited time, money, and tools for scientific research. Some effort must be made to concentrate our efforts on research likely to bear fruit (not just economic, but also purely intellectual fruit).
I think most people seriously underestimate how much we know about the physical world, and how abstruse, sensetive, and detailed are experiments that move science incrementally forward. This fact is what makes "problem area 3" such a, well, problem. This kind of science is based on inference; on steady observation, and drawing reasonable conclusions and extrapolations from those observations.
But don't despair. Science's famous heroes are those who leap beyond the current framework. Those people frequently labor in the world of inference, but at the same time are accumulating a wider model; an idea, like Einstein's photons or his relativity; like Gold's geophysical oil production; like Wegener's drifting continents. At some point the idea "solidifies," and they outline a radical hypothesis. This is an act of imagination, and quite different from inference. Inference is a process (as is "science"), but imagination is a human creative act, as difficult to quantify as "insight" or "brilliance."
The trouble is, in music or poetry or painting, you have the "insight" and you are done. You have created. In science, however, your insight must be tested against the physical world. Many a beautiful theory has been destroyed by an ugly fact (I wish I could say I had invented that turn of phrase; can someone remind me who said that first? I have forgotten, but I love the phrase).
This is, I think, the source of the "Nobel whacko." Many scientists are, I think, freed by their Nobel prize; by the concrete assurance of their status that the prize represents. They are freed to articulate their personal untested pet hypothesis.
I have to wrap up this ramble. I'd just like to say that I think people are far too sanguine. People are far too ready to believe an idea that matches their "feeling" about how things should work. Even Einstien said "God does not play dice." Don't let's throw away the orthodoxy. As with so much of life, good science is the challenge of finding balance.
All I can say is I bought Civ:CTP and I love it. I'm having a blast playing it, and I got a free FreeBSD CD from (I can't remember if it was LinuxMall or LinuxCentral... sorry...).
I'm having as much fun with FreeBSD as I am with Civ:CTP. Still run Linux on all but one of my boxes, though...
"Kook" is too strong, and "idealogue" not strong enough. I think it is fair to say that this guy is more concerned and hyperbolic than most commentators, but I have read a number of stories from reputable sources (NPR, The Economist) that indicate that MS has had actual losses due to both time shuffling of earnings and the lamentable fact that no one (not just MS) has to report stock options as a debt.
In other words (and remember, not only am I not an accountant nor a lawyer, but I'm barely fluent in basic economics, so this is definitely a media created impression, not knowledgeable reportage), it may well be that MS has had multi-million dollar losses in the last few years. So have many companies that continue to have high stock prices and good long-term prospects.
I would very much like to see a change in the law requiring that stock options be included in financial reports as debts, because THEY REALLY ARE DEBT. The reason that I think the banking and SEC big-wigs are not all bent out of shape over this is NOT that MS is buying their silence, but rather that this has become a pervasive practice and changing radically and suddenly would probably have catastrophic consequences.
I would expect to see this practice regulated increasingly over time.
What I do not know is if this practice, if added up across the market, really amounts to a dangerous bubble. That would be an interesting question. The danger would depend on the ratio of vested, unredeemed stock options to the market cap of the company all weighed against earnings. If the P/E ratio is already out of whack and the percentage of options in total market cap is high, well, that would have to be risky, wouldn't it?
I guess I'd side with this gadfly to the extent that I think we should agitate for tighter regulation of the accounting practices that allow the "shadow debt" of options, and for greater disclosure.
Beyond that, I'd like to hear from several other experts and economists. This guy's story is interesting, but long on conclusions and short on data.
Yep. They can't brute force your encrypted message, but they can look in your swap partition from fragments of your passphrase, or even the decrypted key itself. If you've ever typed your passphrase in a telnet session or on an X-server where the client was elsewhere on the network, etc. etc. etc.
They can also, if you've been using crypto in a crime (or if they accuse you of using crypto in a crime) they can create powerful incentives for you to give up the key.
Truth is, you should protect that passphrase like all get-out. You should keep your private keys on a CD-R and you should carry it with you. You should throw it on a fire when you are done with it. You should use gpg and pay attention to the secure memory features. Now you have a crypto system that is so difficult to use, its very annoying. That's just as well. You'll only use it when you really need it. The less ciphertext made with a given key, the better.
The NSA is probably better at breaking things than you think because, as Bruce says, the weak links are not the crypto algorithms.
Along this line, consider: There are two free versions of (yes, I know it sounds goofy, but think about it) MS-DOS out there. Some sort of simple GUI (GEM? an OEM GUI) that provided only a browser and an e-mail app? That wouldn't be that hard to write if you just made it a context switcher instead of a multi-tasker. Kind of a beefed-up PalmOS. I'm not seriously suggesting this is the case, but I feel like Linux/*BSD would be overkill for a machine like this.
/etc/passwd and there you have it. The /etc/skel would give each new user an account the fires straight into Netscape. The users would never see a shell.
OTOH, it would be easy to hide all the complexity of Linux/*BSD by having accounts that add users, start-up and shutdown the machine, and dial-in and disconnect. Just specify the appropriate commands as shells in
I don't know what it is. Its just kind of fun to know the market is changing.
Diversity is good. Whatever they're going to use, it's better than no choice at all.
I've been very sympathetic to Katz and his advocacy for alienated youth in the past. I still think that mature adults (and by this I do not atuomatically mean that adolescents are immature, merely that there is a perspective that comes with time; the one and only quality of wisdom that youth necessarily lacks) need to reach out to teens, to embrace them as they are and welcome them into the family of adulthood.
"Being different" isn't, for the most part, really different. Instead it arises from a basic desire to establish an identity, a unique personhood, especially in the face of a sort of commercial conformity that some young people embrace and others despise.
What is sad and tragic is that each attempt to create an identity is immediately co-opted by the marketing machine and sold back on MTV (and every other media outlet).
This leads to a sort of vicious cycle where youth goes to greater and greater extremes in the natural quest to be not their parents, teachers, or other adult authorities. Once targeted marketing made the great discovery that younger people are less careful with their money than older people, what would have been unthinkable now appears on prime-time TV. Look at how long it took the "hippe" youth culture to move to the mainstream. Compare that with any youth trend today from Goth to body-piercing. It's instantly a product.
I, for one, think we (meaning adults, or if you prefer, people over 30) should be a lot less uptight over teen identity, and a lot more concerned about the commercial debasement of our self-expression.
That said, I think Katz is hitting off the mark here. This "screening" is a bit unfortunate, but I see it as an effort to identify young people who might need a concerned adult in their lives. It's far from ideal, but in a world where otherwise healthy, affluent children are killing themselves and sometimes killing others, its about damned time adults and institutions started to pay attention to young people. If this tool becomes a way to make contact and start listening to the real emotional needs of young people, then it is a good tool. If it becomes a way to sort young people into the "good" ones and the "bad" ones, it's a bad tool.
Basically, I think Katz is jumping before there is something to jump on.
As for me, my approach to young people is: Respect them. Listen to them. Involve them. Love them.
Any youth who is respected, listened to, involved, and loved is unlikely to kill himself/herself or others. The rest they have to figure out for themselves.
DDE doesn't do applications embedding. That's OLE. DDE is a horse-dung IPC mechanism that sends messages in the message queue to EVERY RUNNING APPLICATION on a Windows boxen.
The expense of ORB calls can be very similar to the cost of initially calling a shared lib, but from then on shared library calls will tend to be much faster than ORB calls. This difference gets exaggerated when a lot of data is passed in the call and/or in the result, because all of it has to go through the transport representation conversion and data transmission.
Now, while I've done a fair amount of IDL/ORB/IIOP stuff in my time, I haven't looked into the KDE code at all. If they did it right, they should have a lightweight IPC API that can use a variety of transports and that will autmatically use the much faster local *nix capabilities on the local machine, and the moderately slower Xlib capabilties between X-displays, and use CORBA for anything more divergent. Point being the app writer should not have to particularly know or care.
CORBA is VERY time expensive, esp. when you're talking about things that have a dramatic influence on the perception of speed, like redrawing windows.
Often the user's feeling of performance is based more on finding the right place to stick the delay than in having the fastest end-to-end time for a process.
Case in point: I once eliminated hundreds of user's complaints about a slow system by slowing it down about 40%. We had a PowerBuilder (ugh!) front end to a client-server application. One of the forms had a pick list that was HUGE, populated by a stored procedure call. That call would often take 3-4 minutes to complete. Users went bananas because they got the good olde Win 3.1 hourglass while the pick list was populated.
I changed the code to pick up one record at a time from the result set and insert it in the pick list rather than make the single "all at once" call. It actually took 2-3 minutes longer to fully populate the pick list, but the users never got the hourglass and could start working the form right away. Zero complaints.
I guess what I'm saying is, KDE is a UI. As such, it has to focus on user issues, not technological issues. I am 100% a technology guy. I'd rather satisfy myself that things are done right than satisfy users. Even so, the KDE folks want people to use their software. That means they have to address user issues first and put architecture second. It seems to me they are doing a danged fine job of balancing these concerns.
This kind of story is why I don't like seeing "anti-/." stories out there. I'm over 30 and much of that youthful zeal is gone, so I frequently cringe at the loud and uninformed zealotry of some of my fellow /.ers, but usually, I think, their on line ranting is harmless and it is giving a place for a sort of populist rage to vent safely. Meanwhile, almost every thread has a few particles of true insight, information, and wisdom.
I happily put up with the flames to find those insights I would have missed.
One of the things I like about sites for nerds, linuxers, et. al., is the way they (we) subvert the mass media of the industry. The recent PCWeek debacle ("If I had installed the RedHat patches, I would have missed 'Baywatch.'" -- see the story on Linux Today) is a fine example of this. This story is another.
Okay, so individuals (including me) sometimes type faster than we think. So what? We think eventually. And we don't let lies go unchallenged.
Never be afraid to point out a falsehood! ZD deserves very little journalistic respect. This has nothing to do with the perceived OS bias, and everything to do with poor standards of fact checking and a complete lack of journalistic integrity.
Keep your eyes open. Catch them in the act...
I'm not sure you are familiar with the caucus system. You don't vote for candidates at a caucus. You vote for delegates out of the people there. You vote on platform. Yes, delegates are generally "bound" to a candidate, but the caucus system is the point of entry to part activism. If you are highly motivated on an issue, it is through the caucus that you get your issue into the party's agenda.
;-)
Caucus attendance is how the religious right got its surprising influence in the Republican party (surprising considering their political agenda is supported by a minority of Americans, a significant minority, but still a minority). They availed themselves of the tools. I'm urging "us" to do the same. By "us," I mean those here on slashdot, the majority of whom, I suspect, have similar views (not the same, but similar) on what I would call the "geek vote:"
1) UCITA and defeating it.
2) Crypto-law reform.
3) Patent law reform as applied to software.
4) Universal high-speed net access
Item 4, I suspect, will have quite a range of views within slashdot and wouldn't be a "party vote," because I see slashdot as having a wide range of political views, from people like me who think the governement ought to just get in there and "Interstate" the network, to radical libertarians who would hold that all government regulation of the communications industry should be torn down to let them build the network, but I think it is fair to say that the goal is shared and we would quibble about the means.
As for the now oft mentioned "slashdot" political site, I think people hesitate because it is likely to descend into flamewar central. I think such a thing could work if the editorial policy on articles kept them strictly confined to technology issues, and never strayed into more general policy questions.
Rob can call me -- I'd be willing to run such a site
Whoops! Pasted the one definition twice (color me stupid). Here's what I meant to paste the second time:
Main Entry: democracy
Pronunciation: di-'mä-kr&-sE
Function: noun
Inflected Form(s): plural -cies
Etymology: Middle French democratie, from Late Latin democratia, from Greek dEmokratia, from dEmos + -kratia -cracy
Date: 1576
1 a : government by the people; especially : rule of the majority b : a government in which the supreme power is vested in the people and exercised by them directly or indirectly through a system of representation usually involving
periodically held free elections
2 : a political unit that has a democratic government
3 capitalized : the principles and policies of the Democratic party in the U.S.
4 : the common people especially when constituting the source of political authority
5 : the absence of hereditary or arbitrary class distinctions or privileges