Slashdot Mirror


User: lkaos

lkaos's activity in the archive.

Stories
0
Comments
697
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 697

  1. Re:Get LCC now!! on Cheap Software Languages for NT? · · Score: 2

    Problems with LCC:

    1) It has it's own bastardized version of C
    2) It's not ANSI C compliant at all
    3) The licensing scheme is all screwed up since it was Open Source and then went closed source.
    4) It doesn't produce executable code that's anywhere near comparable with GCC.
    5) It was originally written when GCC didn't exist for Windows, well, know it does :)

    If you need a C compiler, get GCC. Develop with Cygwin and compile with Mingw32 :)

  2. Re:No buffer overflow! on Bug in zlib Affects Many Linux Programs · · Score: 2
  3. No buffer overflow! on Bug in zlib Affects Many Linux Programs · · Score: 3, Informative
    From the zlib.org page:

    The vulnerability results from a programming error that causes segments of dynamically allocated memory to be released more than once (aka. "double-freed"). Specifically, when inftrees.c:huft_build() encounters the crafted data, it returns an unexpected Z_MEM_ERROR to inftrees.c:inflate_trees_dynamic(). When a subsequent call is made to infblock.c:inflate_blocks(), the inflate_blocks function tries to free an internal data structure a second time.

    Because this vulnerability interferes with the proper allocation and de-allocation of dynamic memory, it may be possible for an attacker to influence the operation of programs that include zlib. In most circumstances, this influence will be limited to denial of service or information leakage, but it is theoretically possible for an attacker to insert arbitrary code into a running program. This code would be executed with the permissions of the vulnerable program.


    Duplicate deletions are not the same as buffer overflows and are no where near as easy to exploit. In fact, I have _never_ seen a duplicate deletion exploitation other than a simple DoS. Not to mention the fact that it requires a special series of calls from the calling program.

    In summary, the world hasn't come to an end and Free Software is all-the-sudden as vunerable as closed source software. Put the pills down and relax :)
  4. Re:AOL switching to Mozilla... on AOL To Finally Switch To Mozilla? · · Score: 2

    I guess I am one of the 5-6% percent :)

    I've used NS4.x since it came out and I've also followed Mozilla since NS first released the code oh so long ago. Currently, I have the lastest version of Mozilla installed 0.9.x something or other but I still choose to use NS4.x to browse for one reason.

    Most sites who use the 'newer' features of HTML look horrible. In fact, I didn't even release I had CSS shut off on NS4.x until recently and aftering turning them on, I quickly realized why I had them off. Website designers really need to design pages better. The biggest problem with CSS is that people assume that everyone is going to be on a 800x600 screen it seems and I can't friggin read anything anywhere.

    It's painful. Give me a text-only site _any_ day to the new breed of flash/shockwave/CSS sites. They just plain suck.

  5. Re:AOL for Linux??? on AOL To Finally Switch To Mozilla? · · Score: 2

    This brings up a good point. For AOL to support Linux, they would have to add another authentication mechanism to the kernel. This likely means a kernel module. Unfortunately, since they are a proprietary protocol, the module would have to be binary-only.

    Supporting binary modules alone between the various kernel modules is enough of a hassle to make them not want to support Linux.

    If AOL opened up their protocol then I, for one, would support a project to add support for the protocol to Linux. Whether it sucks or not, it's good for Linux.

  6. *sigh* on Star Wars Episode II Trailer Tonight · · Score: 2

    Oh well, can't win them all.

    Lot's of catch-phrases and cartoonish special effects. 'Begun has the clone war'

    Even Yoda is lame.

  7. Re:Professionalism == Bad on Criticisms of KDE 3 Release Process · · Score: 1

    You don't like KDE? Maybe if you used WindowMaker you would!

    Bah! WindowMaker was too much a resource hog when I first installed so many years back... I could only open one window and then if I tried to open another, I would run out of memory. Those were the good ole days :)

    I'm not much a GUI person. I use gnome-terminal, Emacs (not XEmacs, but GNU Emacs), and mozilla and that's about it. The Gnome stuff seems more light weight to me and I like the fact that it works well with Sawfish (since I was able to do some lisp hacks to sawfish to add macros and some other neat stuff).

    Give me a few terminal windows, and a display to bring up emacs on, and I'm happy as hell.

  8. Re:Professionalism == Good on Criticisms of KDE 3 Release Process · · Score: 2

    Well, if you want to talk about professionalism, it also is very unprofessional to bad mouth a project right before it's release.

    A lot of the time, developers like to blow things a bit out of proportion and that's all well and good when your just around developers, but it is very bad to make such public comments.

    We always had a general rule of thumb that we follow. Within a month of a release of our project, we never use the word 'core dump' around the management. Dumps are no big deal most of the time but it doesn't give management a warm and fuzzy feeling to hear the words 'core dump' so close to deadline.

  9. Professionalism == Bad on Criticisms of KDE 3 Release Process · · Score: 5, Insightful

    The best part of developing free software is that it is low stress. People tend to get all bent out of shape about it. I think this is a pretty good example of what happens when people get stressed out about something that people are for the most part doing because they enjoy it.

    So the KDE guys got together and were inspired to perform lots of last minute hacking. More power to them! So what if the 3.0 release is delayed or has a few issues. I think these three guys who signed the letter were just jealous because they weren't involved in the process.

    I don't use KDE, and never liked it, but I have to stand up for the developers here. Just enjoy developing the software and stop bitching because there aren't 'hard freezes' before a release.

  10. If you code FS, don't _ever_ look at the source on Rotor: Shared Source CLI · · Score: 3, Interesting

    I am absolutely positive that the licensing terms for the 'shared source' are going to involve some sort of extreme IP protection mechanism that will give MS unimaginable amount of power to prosecute anyone who they believe is violating their IP.

    From now on, FS developers will have to make sure that anyone on their project has _not_ agreed to the MS shared source license. Kaffe has a similiar policy because of Sun's nasty license.

  11. Not really an issue on Netscape 6 is Spyware? · · Score: 3, Informative

    The netscape search bar is meant to perform a search first of the netscape homepage IIRC, and then if relavant results aren't found, another search engine is chained.

    How often the second link of the searching chain is invoked is pretty critical in netscape figuring out how effective their search engine is.

    For those that remember the old Yahoo days when it used Altavista as a backup, it would appear to be a similiar situation. It would have been to Yahoo's advantage (and the end-users advantage) for Yahoo to track how well it's search engine performed and how often it had to default to alta vista.

    Now, AOL has come out saying they don't collect the information (and most folks on the net are behind a firewall or using a dynamic IP anyway) so it's not as big of a deal as it's being made out to be. This article mentions the 'potential' to be Spyware but it doesn't make clear the fact that in practice, AOL is not tracking anything.

    Besides, you can disable this feature if you are really nervous about it (as some folks mentioned previously). The fact of the matter is though, that by allowing AOL to collect this data, you are simpling improving your search results.

    BTW: This article also doesn't make it clear that if you goto www.google.com, nothing is tracked. The only time it is actually tracked is if you only enter a word (instead of a URL) in the location bar. I don't think many people use this feature that frequently anyway though. It's been there for a while though.

  12. Re:sexy? on To The Pain · · Score: 2

    Moderators drive me crazy.

    I swear, that post only lasted about 30 seconds...

    Perhaps I'll try to explain slightly more (as it appears moderators have no sense of humor).

    There is a difference betweening being a programmer and programming. One is a state of being and the other is a function.

    I do not believe that women are less capable of programming (performing the function) than men. What I do believe though, is that women do not choose programming as a state of being.

    Men and women are fundamentally different. Many people are entirely too liberal in assuming that they are the same. Being different does not necessarly make one superior to the other.

    If you observe the posters journal, she states, "I'm not a hardcore geek. I'm a thinker, and the computer and technology field has a huge are for new thoughts". There is a fundamental drive for people who are hardcore geeks. There's a passion and a beauty in it that I swear is genetic.

    There's a difference between posting flame bait and an idea that is different than what most people think. I don't mind being mod'd down, but atleast give people a chance to read it for god sakes.

  13. Re:sexy? on To The Pain · · Score: 0, Flamebait

    The female computer programmer is a myth.

    It simply doesn't exist. Not that women cannot program, but I do not believe women exist that would choose to program on their own.

    Women just don't program for fun. Most men don't either for that matter...

    Now watch my karma go down in flames...

  14. Re:Performance of network software on OpenSSH Local Root Hole · · Score: 1

    Why isn't it a modern language? It's got object orientation, templates, all the features you'd expect out of a modern language.

    Just because a language is object oriented, doesn't mean it's a 'modern language'. The object oriented paradigm isn't the only paradigm out there.

    As you mentioned yourself, Ada does not have a garbage collector and it also doesn't have any real mechanism for security (to provide os-independent security mechanisms as java does). You may say it's object oriented, but it doesn't support MI, partial specialization, or operator overloading. Not to mention the fact that Ada is a little old to be considered modern :)

    So you can measure the goodness of a programming language by counting features? Then PL/I is much better than C. Why did so many people use C then?

    PL/I is just an ugly language. C is a very natural language.

    Not necessarly quanity of features but richness of features. As far as OO is concerned, C++ supports a huge amount of OO features (specifically regarding templates) that most other OO simply don't support.

    While C++ doesn't support all OO concepts (double-dispatching is the most obvious feature feature that's lacking), it supports a lot more than other languages.

    There are no perfect programmers. If many good programmers make a particular style of error that results in a root hole because of a language, perhaps some other language should be used. The other solution, hire only perfect programmers, doesn't work because they don't exist.

    People villianize C/C++ because some bad things can be done in it. The fact is that there is an aweful lot of code written in C/C++ and the percentage of exploits to number of SLOCS of C/C++ is not as high as many would like you to believe.

    This article is not an example of a root hole. I have worked on very large C++ programs with relatively inexperienced programmers and we never have serious problems with there code. Of course, we don't have problems because we have rules about not using the dangerous features of C++ (such as direct array indexing or unchecked dynamic memory allocation). Likewise though, having access to those features allow for extremely efficent code to be written by more experienced programmers.

    A language's goodness is not gauged by how idiot-proof it is, but in how scalable it is to both the beginner programmer and the more expert programmer.

    BTW: Ada doesn't

  15. Re:Performance of network software on OpenSSH Local Root Hole · · Score: 1

    Modern language does not mean interpreted, and especially doesn't mean Java. There are plenty of open source modern languages - Ada (GNAT), ML (SML, O'Caml), Eiffel (SmallEiffel).

    When in the world did Ada become a modern language???

    I beg to differ about C being less efficent than assembly. Anything that can be done in assembly can be done just as effectently in C. The only time assembly is required is for odd-ball processor specific optimization.

    Garbage collection is really overrated. Well, full blown GC atleast. One can write a C++ program and never use a malloc/new almost in every circumstance. It also encourages use of the stack as opposed to allocating everything in the heap which is much more memory efficent.

    C is a great language. C++ is a better language because it has many more features. C++ has any (and probably more) features than SML, ADA, & Eiffel. The reason people don't like C/C++ is simply because one can do bad things in it. A language shouldn't be gauged on how idiot-proof it is though.

  16. Re:Performance of network software on OpenSSH Local Root Hole · · Score: 0, Flamebait

    This entire thread has absolutely made me sick. It reminds of the folks who cry that an OS should be written in a BASIC dialect or in Java (or even C++ for that matter).

    High Level languages (it's silly to refer to them as "modern languages") all suffer from one fundamental problem. They do not allow sufficent control over program behavior to make the kind of assurances that high-performance applications need to make. OpenSSH rocks and it could not be rewritten in Java or some other silly language.

    These languages are good for simple programs or assembly line programs where performance is not really an issue. Java and other interpretted languages require huge memory overheads and are only as stable as the underlying VM.

    Do not kid yourself that Java isn't exploitable. Especially with the J2EE package that encourages network transparency. Anytime you communicate over a network you undertake considerable risk.

    BTW: This who is very unlikely to be a rootable exploit. Off-by-one errors will likely cause only a SEGV or perhaps undefined behaviors. It is not like buffer overflows as it is not easy to insert arbitary code.

    Remember too that OpenSSH is open source whereas the Java Runtime library isn't. Give me a week with the source to Java and I guarentee I can find you a bunch of remote exploits. Open Source software often gets held to much higher standards than traditional software simply because there is no way to cover up all the little holes.

    And you may think your an expert since you wrote an FTPD but is it as capable as wu-ftpd? Just because you can serve a file as quickly doesn't mean that it comes anywhere close to handling all the features that wu-ftpd. Sit down and try to write tens of thousands of lines in a so-called "modern language" and you'll be back to C.

  17. Re:Smart Story Poster on The Customer is Always Wrong · · Score: 1

    Karma Whore Alert. You're lucky I didn't program the lameness filter here. But as usual, the moderator ratpack is falling for it.

    I'm actually suprised I didn't get hit on this one. It was just too funny though. I had to post it.

    How 'bout getting a clue and actually reading what's written on the screen after you klick a link, assuming of course that you followed the link in the first place instead of dumping random neural firings at the keyboard? Hackers (the movie) != Hackers (the book).

    Irony is that you seemed to jump the gun and forego reading my immediate reply to my own thread correcting myself.

    BTW: Posting AC is lame enough as it is, but posting AC to complain about karma whoring, well, that's just too ironic.

  18. Re:Smart Story Poster on The Customer is Always Wrong · · Score: 1

    1. What do you care?

    It's funny as hell! I'm not complaining about it.

    I respect the guy, it's definitely a smart move. Karma whoring is pointless, but whoring for money is great.

  19. Re:Smart Story Poster on The Customer is Always Wrong · · Score: 1

    The latter is a steaming pile of ignorant trendoidism from 1995 featuring Angelina Jolie and her 28.8 BPS pentium.

    But my god, she is so damn hot in those leather outfits.

  20. Re:Smart Story Poster on The Customer is Always Wrong · · Score: 1

    Ok, it's a book, same idea though.

  21. Smart Story Poster on The Customer is Always Wrong · · Score: 5, Interesting

    I know I'll get mod'd down for this but I just had to point it out.

    The guy who submitted this story included a link to purchase the movie 'Hackers' from Amazon.com (as opposed to the movie's website which would seem more logical) as part of the stories description.

    I was curious about this for a minute until I released that he included a referer ID in the URL so as the URL gets /.'d and people purchase the movie (which is bound to happen), he will get a percentage from the sale! Talk about using the /. effect to one's advantage.

    Capitalism is wonderful, isn't it? I'm amazed that the editors let that slip by. I think this is a whole new category of karma whoring...

  22. Re:Not pratical on Scientific American Article: Internet-Spanning OS · · Score: 2

    For this all to work as specified in the article, high bandwidth connections must be available.

    With sufficent bandwidth, why should anyone _ever_ pay for cycles that they do not use. All you really need is a high bandwidth connection with the computational equivalent of a TV with a small reverse feed for input devices.

    With the advent of set-top boxes, the age of the PC is coming to an end. It just isn't useful for the typical consumer. The only inhibiting factor today is bandwidth. The internet OS _assumes_ bandwidth availability though. That is its flaw. With proper bandwidth, there is no need for anything other than a glorified TV.

  23. Not pratical on Scientific American Article: Internet-Spanning OS · · Score: 3, Interesting

    This article makes one fatal assumption: Consumers will always purchase more powerful equipment than they need.

    The time of super fast home-PCs is likely to not last very long. The incoming .NET and dotGNU waves are likely to make thin clients much more realistic.

    There is absolutely no reason for 'Mary' to have so much computing power since she doesn't need it. The only real limiting factor today is bandwidth which this article assumes anyway.

    What is probably likely in the future though is a more distributed OS. One that is truely network transparent in every facet of operation. I believe there are some rumors floating around about MIT working on something to this effect...

  24. Re:Problems with homebrew PVR on TiVo Service Cost Rising · · Score: 1

    I'm gonna hit both posts at once :)

    First, doesn't the raw recording take an enormous amount of disk space? Something like 7GB/hour? Doesn't that reduce the recording capacity of the drive and/or the amount of consecutive tv that can be recorded?

    As far as the second post, I searched around for the Allwell boxes and they seem nice. Only problem is that they are not available anywhere. I do not know if your model has this, but they have models that have built in TV-OUT capability.

    What I always intended on doing was to get a Mini-ATX case once I got everything working right. The problem is that I was never able to find a satisifactory configuration.

    Looks like I may start again though. If I can get X to display on my TV with accelerated graphics, with a DivX codec, xine, and cdrecord, I might be able to throw something very nice together...

  25. Re:Problems with homebrew PVR on TiVo Service Cost Rising · · Score: 1

    I'm using a Matrox G400 DH to display video-out from Linux on a regular NTSC TV. It works just fine.

    It appears I spoke too soon. The gatos project has also begun initial support for TV-OUT with the AIW cards.

    Video acceleration? What do you need it for?
    Hardware YUV translation. The only thing that makes video playback bareable in Linux on my box.

    My P-III 500 MHz does realtime DivX (MPEG-4)
    I have not used the DivX codecs in my testing. I always wanted to maintain compatibility with VCDs in order to be able to burn CD-Rs. Granted, the DivX items could be converted to MPEG-1.

    I use one machine (P-III 500MHz).
    Can you also watch the item being recorded or does this box act as a standalone video server?