User: dananderson

Burn All Gifs Mini-HOWTO

On: Interview with Don Marti

For background information on BurnAllGIFs.ORG, see http://burnallgifs.org The software section is especially valuable.

I use ESR's gif2png to convert my legacy GIF files to PNG for web use. I provide Solaris SPARC and x86 packages (Linux packages are available elsewhere).

PHP installed != PHP being used

On: Programming PHP

NetCraft reports are a poor measure, not because NetCraft is inaccurate, but many have out-of-the box installations (say from RedHat) that have PHP installed, use it or not. Many or most do not use PHP.

That said, I do have a gut feeling PHP is overcoming or overcame ASP.

Re:Some good, some bad...

On: Internet Vigilante Justice, SPAM, and Copyrights

Finally, black holes/black lists/spam filters/etc. aren't solving the problem. The bandwidth is still being chewed up

Blacklists ARE solving the problem. I subscribe to SpamCop.net and I get about 50 spams filtered out daily. Bandwidth is NOT chewed up because the message is never sent--just a small rejection notice.

Re:But mod_perl and libphp4 already work on 2.0

On: Sites Rejecting Apache 2?

The "fuss" is they are still labeled as "experimental."

Java is a separate product from Mozilla or JavaScr

On: Mozilla 1.1 Hits The Street

Java is a separate product downloadable from Sun. Mozilla can't "fix" Java because Mozilla doesn't implement Java. Java functionality is available from a separate Sun plugin.

Now if you're talking about "JavaScript," a scripting language embedded in HTML, that's something completely different. JavaScript and Java are completely unrelated and (unfortunately) only share part of a name. JavaScript is a poorly defined language, so various browsers implement it differently (and have different bugs).

University of Calif. Professor defends Microsoft

On: More MS EULA Fun

Speaking of Microsoft, in my alumni magazine, I found an article by a University of California, Irvine Graduate School of Management professor, Dr. McKenzie, defending Microsoft.

Favorite quote: "Microsoft . . . . restricting market share . . . . will probably mean an increase in software prices, as well as a decline in quality and level of service."

False argument that ISPs need spam revenue

On: Spamming Gets Expensive in Utah and Ohio

It's a false argument that ISPs need spam revenue. It's a big headache except for a few ISPs that may specialize in spammers. It causes their legitimate customers to be blocked in spam lists, overloads the ISPs pipes, and gets a lot of abuse complaints for the spam customer.

If the Spam-needed-for-competition argument is true, then China and Korea would have the best hosting companies around.

Additional legislation *IS* the solution

On: Spamming Gets Expensive in Utah and Ohio

This is a good example of capitalism, with all it's faults, helping solve the problem. No need to depend on government prosecutors or police to stop spam (they have enough to do!).

Yes, give the lawyers (like them or not), CASH INCENTIVES to stop spam now and GET RICH QUICK!!!!! HURRY--DON'T DELAY. SPAMMERS ARE STANDING BY!

Re:And now Y2038

On: 1985 Usenet About Y2k

Interesting essay on the Y2038 problem, and probably human nature, at Roger Wilcox's Y2038 page, http://pw1.netcom.com/~rogermw/Y2038.html

POSIX xtime to the rescue!!!!

On: 1985 Usenet About Y2k

Fortunately, some people have thought it through. There's a proposed POSIX standard, xtime, to create a new time type, and new functions, to handle a 64 bit time type (in a 32 bit world!).

The xtime struct contains:
int_fast64_t sec;
int_fast32_t nsec;

In the 64-bit world, it's no problem--time_t is defined as a long long (64 bits).

That's 896,567,000 spammers

On: India's ISPs Want Payola from Big Portals

Ahem. . . . population 896,567,000. Enough said.

Ahem

Unfortunately, until they become a little more mature in Internet usage, that's 896,567,000 spammers. Not as bad as China or Korea (both countries are blocked completely by me), but bad enough that I have to block parts of India out.

non-commercial speech

On: Control of the .ORG TLD

Non-commercial speech generally refers to speech legally proteted by the U.S. Bill of Rights. Commercial speech (advertisements) have less protection.

MPAA and RIAA are not selling anything, just advocating viewpoints of their members (who are commercial).

.ORG use to be just for non-profit organizations, but goold ole Network Solutions stopped enforcing that a long time ago. The cat's out of the bag and it's too late to undo it. At least the new .ORG manager can prevent further abuses (perhaps by restricting it to true non-profit organizations).

MPAA and RIAA *ARE* non-commercial

On: Control of the .ORG TLD

MPAA and RIAA are non-profit organizations. They are industry trade organizations. They don't make a profit.

You (and I) may not agree with them, and a lot of other non-profit organizations, but that's the nature of organizations--they usually reflect the views of the members.

Urban Myth: banning CN spam hurts China dissidents

On: Collateral Damage in the Spam War

It's a myth that banning .cn spam is hurting dissidents. They can still surf the web and use 3rd-party web-based email. I ban all email from all Chinese, Hong Kong, Japan, and South Korean IP address blocks. I still get email from Chinese asking for technical help (Solaris on Intel and what not), which I answer.

As for dissident email, I never received any and don't expect to. I'm sure the few Chinese dissidents are beaten down quickly and probably communicate with others who can help.

Hopefully, the Chinese will wake up and realize that to be responsible Netizens, they shouldn't be spam generators for the rest of the world.

Linux uptime stats wraparound at 497 days

On: Uptime Realities in the Internet World

You can't say BSD systems have the best uptime based on Netcraft surveys. Linux systems have a limit of 497 days for reported uptime. After that, the uptime wraps around. There are several Linux systems with such uptimes. That being said, BSD systems are highly reliable and efficient and may have a higher uptime than Linux.

See the Netcraft FAQ at http://uptime.netcraft.com/up/accuracy.html#cycle

Designing Web Usability Book

On: Built For Use

My favorite usability book is Jakob Neilsen's Designing Web Usability: The Practice of Simplicity. His basic point is the web should be FAST and easy to navigate. Most people have modems and many have poor monitors. See also his website useit.com.

Re:Fix available: 1.3.26

On: Apache Vulnerability Announced

At http://www.modssl.org/ is the new mod_ssl patch for Apache 1.3.26:
19-Jun-2002: Released 2.8.9-1.3.26: Apache 1.3.26 and bugfixes.

mod_ssl and Apache 1.3.26

On: Apache Vulnerability Announced

Try ./configure --force --with-apache=/your/path/to/apache/src

Rolf is pretty good with quick patches. I would just wait a day or two. The bug is only a DOS, for most platforms it seems.

Fix available: 1.3.26

On: Apache Vulnerability Announced

Apache 1.3.26 is available which is supposed to fix the buffer overflow problem.

For mirrors: http://www.apache.org/dyn/closer.cgi/httpd/
For direct download: http://www.apache.org/dist/httpd/
For the announcement: http://httpd.apache.org/

Official CERT Advisory CA-2002-17

On: Apache Vulnerability Announced

CERT Advisory CA-2002-17 Apache Web Server Chunk Handling Vulnerability is at http://www.cert.org/advisories/CA-2002-17.html

Personally, I think, for UNIX (maybe not Windoz), it's only a DOS vulnerability, but it wouldn't hurt to upgrade once a STABLE, TESTED fix is out.

Official Apache Project Security Advisory

On: Apache Vulnerability Announced

The official Apache Project security advisory is at http://httpd.apache.org/

Versions of the Apache web server up to and including 1.3.24 and 2.0 up to and including 2.0.36 contain a bug in the routines which deal with invalid requests which are encoded using chunked encoding. This bug can be triggered remotely by sending a carefully crafted invalid request. This functionality is enabled by default.

In most cases the outcome of the invalid request is that the child process dealing with the request will terminate. At the least, this could help a remote attacker launch a denial of service attack as the parent process will eventually have to replace the terminated child process and starting new children uses non-trivial amounts of resources.

We were also notified today by ISS that they had published the same issue which has forced the early release of this advisory. Please note that the patch provided by ISS does not correct this vulnerability.

The Apache Software Foundation are currently working on new releases that fix this issue; please stay tuned here at http://httpd.apache.org/ for updated versions as they become available.

[Link to full advisory follows at http://httpd.apache.org/info/security_bulletin_200 20617.txt ]

Are the Lego Lawyers after you yet?

On: Augmented Reality Billiards

They have shutdown many amature websites that dare to expose the public to a Lego Brick. Before Lego even had a website, around 1994 and 1995, others put volunteer websites about Legos (not selling anything or competiting with Legos). Lego Lawyers put them out of business. Maybe they will try with Slashdot also. I quote from Lego Fairplay:

The LEGO Logo may not be used on an Unofficial Web Site The bright red LEGO logo has become one of the most recognized trademarks in the world. We have worked hard to make this logo a symbol of high quality creative products for children. The logo stands for the LEGO Group and we cannot risk allowing the distinctiveness of this symbol to be diluted. We must, therefore, insist that the LEGO logo NEVER be used on an unofficial web site.

See also my previous warning about Lego Lawyers. http://slashdot.org/comments.pl?sid=32953&cid=3574 059 Disclaimer: I don't agree with these heavy-handed guys.

Has Lego sued Slashdot yet?

On: LEGO Mindstorms: The Master's Technique

I'm surprised to see the Lego building block on Slashdot. Has Lego sued you yet?

Don't get me wrong. I love Lego building blocks and enjoyed them as a kid. I think they are still useful and fun for kids in today's overly-structured environment.

Anywho, one of the early websites erected in 1994 or so was by a voluntter Lego fan. He put up all sorts of Lego trivia and had cute lego graphics. Wasn't making any money and wasn't dissin' Lego.

In 1995, the site went blank. All it had was a copy of this letter from a lawyer in Denmark (I think), where Legos are made. In a rather unfriendly tone it said to ceise and desist (sp) immediately or be sued. The Lego volunteer shut the website down.

In summary, Post a Lego on the Web--Go to Jail (a good bumper sticker :-).

Re:Is This a Stable Release?

On: Red Hat Linux 7.3 Released

Yes it (RH 7.3) is a stable release intended for production systems. RH 7.3 has been through beta.

That said, I always wait at least a month (sometimes several if there's nothing in it I really need) for the "users" to find the more obscure bugs.

Also it gives time for the early adopters to post any problems and workarounds on the various mailing lists for me to search in http://google.com/ and http://groups.google.com/ (USENET news)

Don't stop spambots, feed them with Sugarplum

On: Stopping Spambots: A Spambot Trap

I don't stop spambots, I feed them. I feed them phony email addresses and addresses of spammers (gathered from places such as my fake /cgi-bin/formmail.pl). I use http://www.devin.com/sugarplum/, mentioned before on /. to dish it out!