> Gnome's gone downhill since 1.4 in the area of user customizations. The ability to customize behavior is almost non existant compared to what we had in 1.4. I could tweak and adjust 1.4 to create a very cool environment for myself. With the 2.x series, almost all of the capability is gone. It's now just a mindless environment for dummies. Gnome's stated that they're aiming low and catering for the dumber computer users. There was soo much potential for it to develop into a really powerful environment and then those silly studies were conducted and the rest is history..... Oh well.
My feelings exactly. After a lot of work I finally got a GARNOME-based GNOME 2.something working mostly to my liking, but I had to use not-latest-releases for some components because they're still taking features out.
I've been a GNOMER since 0.4, but I expect to have to drop them if they don't start putting some features back in. Sure wish I had the time to fork off a power-users' desktop. (Hmmm, "PUD". I guess priority #1 would be to find a better acronym.)
Another option might be to start a movement to vote certain doctrinaire individuals off the board next time they have elections.
> > Given the size and interests of/.'s readership, I understand why studios and production companies want to start phoney "grassroots" buzz about their films here, but do the editors really have to accept the story submissions?
> Although I agree that this is sort of tenuous as far as/. news goes, my guess is that if the story really was submitted by an undercover marketer, they would have at least waited for the website to be online. At least, I'd wait until then.
Maybe they figured that the less we knew the better PR it would be.
> Uh huh, when a joke is made against open source, then its not a joke. Its flamebait. Is that right?
Gosh, like no one ever cracks a joke about RMS, ESR, Linus, the OSS development model, Slashdot and its editors, or any of that kind of stuff, and gets modded up to 5 for it.
> And apparently it worked. Which means we can expect that as long as Canopy can find ways of cashing in on SCO's threats against Linux users, those threats will keep coming -- no matter how little sense they make.
But the pump appears to be wearing out. Previous FUDnouncements drove the stock up to nearly 14, but today's only has it back up to about 10 (from 9.x yesterday).
> Some TV show or something did a poll catering to women. They asked them, "If there were a pill that made your ass bigger, but made you way smarter, would you take it?
If you took it as a suppository, would it make you a big-headded smartass?
> In nature , when we have a monoculture, they are easily wiped out by new diseases [...] (ofcourse natural virii are, well , natural, computer viruses are artificial and are probably comparable to genetic engineering).
And that's precisely why I don't find the monoculture argument convincing. All computer viruses/worms are the result of "engineering", so all that's needed for a polymorphic virus is a bit of additional engineering to support the polymorphism. See my armchair example design posted elsewhere in this thread.
> Another thing about OSes are that vulnerablities are discovered on different OSes at different times. there is a short timespan when there are unpatched machines across OSes (or before a relatively simpler single OS virii wipes them out), so it is a lot more difficult.
Good point, but not necessarily a show-stopper. I suspect the average Linux system is more patched than the average Windows system, but I also suspect that that's just a relative improvement. Considering how often we get warnings to upgrade (say) SSL, surely there are thousands if not millions of not-professionally-managed Linux systems out there still harboring a theoretical vulnerability that's many months old?
However, I would agree that a worm that attempted (say) 5 independent exploits against Windows would disrupt the net more than a similar worm that attempted exploits of 5 different OSes. That looks like a monoculture issue until you realize that breaking up the monoculture just changes the relative disruptiveness of those two options.
> > Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?
> It would be harder than writing one that wasn't, and that's all that counts.
Surely not all that hard? And even if it would be harder than I imagine, as soon as some guru writes one someone else will turn it into a kiddie-friendly kit that lets relatively incompetent parties insert the exploits of their choice. I would be very surprised if such a thing isn't already lurking out there.
IIRC the famous Morris Worm had infrastructure for about 10 different UNIX exploits, though only one or two were actually implemented. A polymorphic worm would use the same idea, except probe for and exploit holes in multiple operating systems instead of multiple holes in a single operating system.
Clearly the code or script that runs under OS A will not run under OSes B and C, but when the worm runs under A it just treats the code for B and C as data to be uploaded when an exploit is found. So you probe a machine to see what kind of OS it is running, use a lookup table to see what exploit(s) to try for that OS, try to get in, and if you do you upload all the "data" and then tell the remote system which part of the "data" to execute, depending on which kind of OS it is. It is then running on the remote system, and very scarily has all the "data" that it needs to propagate to any of the other "supported" OSes, in addition to OSes like itself.
IANAWormWriter, but it seems to me that the challenge of implementing a polymorphic worm would be more a matter of patience than of brain power. You would have to write/compile the control logic described above for each of the target OSes, but the logic is pretty simple and the exploits you want to build in to it are presumably already available where ever kiddies get this stuff.
Red Hat has a nasty habit of installing sendmail, bind, and a bunch of other crap you don't want even if you do a custom install and explicitly mark them 'no'. My personal system-installation checklist has a step that explicitly mentions uninstalling those two after a fresh installation.
>... has already been referring to it as the Windows worm (or virus).
I think that has been a growing trend over the past year or so. But it does seem to have hit saturation this time around; I don't recall hearing any newscaster fail to describe it as a Windows problem.
> > When they find the Linux users who did this I hope they lock them up and throw away the key.
> So all someone has to do is dislike Gates and Microsoft, write an Windows virus, and they are automatically considered a Linux user? Cool.
So that's why the media is reporting Linux usage is up! I thought there were actually more people using it.
When we hear about all those cities and countries considering a switch to Linux, are they actually just considering switching all their jobs over to "Windows virus writer"?
> My wife's entire 1500 plus employee company was instructed today to not turn on their computers until IT came around to look at them.
Where I work they just kicked everyone with an exposed system off the network as soon as the DoHS warning came out 2-3 weeks ago, and let them back on the network when they could demonstrate that their system was fixed.
> One of the downsides to having just one type of OS is that it makes you very vulnerable to this sort of thing.
Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?
> As far as blaming people who haven't patched their computer, I can't see it. This thing is hitting home dialup users fer crying out loud - my friend had to drive over to his dad's house to disinfect a machine. You can't expect everybody's grandmother to behave as a professional sysadmin.
So true. That's why it's important to design OSes and user software for safety rather than for a faux ease-of-use. I hope the GNOME and KDE hackers and other FOSS writers are seeing the right message in this.
> I know there'll be dozens of "they shouldda been using un*x" posts, but in defense of Windows, there has been a patch for this on Windows Update since July 16.
IOW, "they shouldda been using... sysadmins".
I wish I had a long-term plot of how many minutes/year the prime time news spends telling people to apply security patches and update their anti-virus database. I wonder if this will eventually become a regular segment, like the weather, sports, traffic, etc.
> And who was it who brought it into the office? The CEO. He thought he had a virus but connected to the network anyway. Mod that funny if you will but try being part of our network support team.
You sound annoyed... did you draw the short stick for who gets to tell him?
> Many years ago, I saw one of the old IBM ones with a 'C:\>' prompt. I spent a couple of seconds wondering how I could hack it to get free money, then realised it was somewhat tricky without a keyboard to type on. Oh well.
Slashdot Mirror
> Gnome's gone downhill since 1.4 in the area of user customizations. The ability to customize behavior is almost non existant compared to what we had in 1.4. I could tweak and adjust 1.4 to create a very cool environment for myself. With the 2.x series, almost all of the capability is gone. It's now just a mindless environment for dummies. Gnome's stated that they're aiming low and catering for the dumber computer users. There was soo much potential for it to develop into a really powerful environment and then those silly studies were conducted and the rest is history..... Oh well.
My feelings exactly. After a lot of work I finally got a GARNOME-based GNOME 2.something working mostly to my liking, but I had to use not-latest-releases for some components because they're still taking features out.
I've been a GNOMER since 0.4, but I expect to have to drop them if they don't start putting some features back in. Sure wish I had the time to fork off a power-users' desktop. (Hmmm, "PUD". I guess priority #1 would be to find a better acronym.)
Another option might be to start a movement to vote certain doctrinaire individuals off the board next time they have elections.
> I for one welcome our new human-rabbit hybrid masters.
Yeah, them's good eatin'.
> > Given the size and interests of
> Although I agree that this is sort of tenuous as far as
Maybe they figured that the less we knew the better PR it would be.
Surely Gigli is more notable, with it's record-breaking 1.5 IMDB rating, up a full 7% from the 1.4 it had when I first heard about it last week.
> Uh huh, when a joke is made against open source, then its not a joke. Its flamebait. Is that right?
Gosh, like no one ever cracks a joke about RMS, ESR, Linus, the OSS development model, Slashdot and its editors, or any of that kind of stuff, and gets modded up to 5 for it.
Take a chill pill and enjoy the humor.
> And apparently it worked. Which means we can expect that as long as Canopy can find ways of cashing in on SCO's threats against Linux users, those threats will keep coming -- no matter how little sense they make.
But the pump appears to be wearing out. Previous FUDnouncements drove the stock up to nearly 14, but today's only has it back up to about 10 (from 9.x yesterday).
Maybe this won't last much longer.
> Some TV show or something did a poll catering to women. They asked them, "If there were a pill that made your ass bigger, but made you way smarter, would you take it?
If you took it as a suppository, would it make you a big-headded smartass?
> So I can intelligent and smell or stupid and smell nice. Ho hum life is full of hard decisions.
To paraphrase an old saw, "strong, intelligent, sweet-smelling: choose two".
> In nature , when we have a monoculture, they are easily wiped out by new diseases [...] (ofcourse natural virii are, well , natural, computer viruses are artificial and are probably comparable to genetic engineering).
And that's precisely why I don't find the monoculture argument convincing. All computer viruses/worms are the result of "engineering", so all that's needed for a polymorphic virus is a bit of additional engineering to support the polymorphism. See my armchair example design posted elsewhere in this thread.
> Another thing about OSes are that vulnerablities are discovered on different OSes at different times. there is a short timespan when there are unpatched machines across OSes (or before a relatively simpler single OS virii wipes them out), so it is a lot more difficult.
Good point, but not necessarily a show-stopper. I suspect the average Linux system is more patched than the average Windows system, but I also suspect that that's just a relative improvement. Considering how often we get warnings to upgrade (say) SSL, surely there are thousands if not millions of not-professionally-managed Linux systems out there still harboring a theoretical vulnerability that's many months old?
However, I would agree that a worm that attempted (say) 5 independent exploits against Windows would disrupt the net more than a similar worm that attempted exploits of 5 different OSes. That looks like a monoculture issue until you realize that breaking up the monoculture just changes the relative disruptiveness of those two options.
> > Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?
> It would be harder than writing one that wasn't, and that's all that counts.
Surely not all that hard? And even if it would be harder than I imagine, as soon as some guru writes one someone else will turn it into a kiddie-friendly kit that lets relatively incompetent parties insert the exploits of their choice. I would be very surprised if such a thing isn't already lurking out there.
IIRC the famous Morris Worm had infrastructure for about 10 different UNIX exploits, though only one or two were actually implemented. A polymorphic worm would use the same idea, except probe for and exploit holes in multiple operating systems instead of multiple holes in a single operating system.
Clearly the code or script that runs under OS A will not run under OSes B and C, but when the worm runs under A it just treats the code for B and C as data to be uploaded when an exploit is found. So you probe a machine to see what kind of OS it is running, use a lookup table to see what exploit(s) to try for that OS, try to get in, and if you do you upload all the "data" and then tell the remote system which part of the "data" to execute, depending on which kind of OS it is. It is then running on the remote system, and very scarily has all the "data" that it needs to propagate to any of the other "supported" OSes, in addition to OSes like itself.
IANAWormWriter, but it seems to me that the challenge of implementing a polymorphic worm would be more a matter of patience than of brain power. You would have to write/compile the control logic described above for each of the target OSes, but the logic is pretty simple and the exploits you want to build in to it are presumably already available where ever kiddies get this stuff.
> One would hope desktops don't run any of those.
Red Hat has a nasty habit of installing sendmail, bind, and a bunch of other crap you don't want even if you do a custom install and explicitly mark them 'no'. My personal system-installation checklist has a step that explicitly mentions uninstalling those two after a fresh installation.
>
I think that has been a growing trend over the past year or so. But it does seem to have hit saturation this time around; I don't recall hearing any newscaster fail to describe it as a Windows problem.
> > When they find the Linux users who did this I hope they lock them up and throw away the key.
> So all someone has to do is dislike Gates and Microsoft, write an Windows virus, and they are automatically considered a Linux user? Cool.
So that's why the media is reporting Linux usage is up! I thought there were actually more people using it.
When we hear about all those cities and countries considering a switch to Linux, are they actually just considering switching all their jobs over to "Windows virus writer"?
> My wife's entire 1500 plus employee company was instructed today to not turn on their computers until IT came around to look at them.
Where I work they just kicked everyone with an exposed system off the network as soon as the DoHS warning came out 2-3 weeks ago, and let them back on the network when they could demonstrate that their system was fixed.
Call it "opt-in security", if you will.
> One of the downsides to having just one type of OS is that it makes you very vulnerable to this sort of thing.
Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?
> As far as blaming people who haven't patched their computer, I can't see it. This thing is hitting home dialup users fer crying out loud - my friend had to drive over to his dad's house to disinfect a machine. You can't expect everybody's grandmother to behave as a professional sysadmin.
So true. That's why it's important to design OSes and user software for safety rather than for a faux ease-of-use. I hope the GNOME and KDE hackers and other FOSS writers are seeing the right message in this.
> I'm all for Microsoft making the DEFAULT behaviour to be to download and install the patches without updating.
In principle, yes, but...
a) Would Microsoft (or any other company) be willing to accept the legal liability?
b) How long until someone highjacks that very mechanism as a way of spreading grief?
> I know there'll be dozens of "they shouldda been using un*x" posts, but in defense of Windows, there has been a patch for this on Windows Update since July 16.
IOW, "they shouldda been using... sysadmins".
I wish I had a long-term plot of how many minutes/year the prime time news spends telling people to apply security patches and update their anti-virus database. I wonder if this will eventually become a regular segment, like the weather, sports, traffic, etc.
> microsoft rules linux sucks get over it gay linux faggots
Yeah, Linuxers are just jealous because this software won't run on their systems.
> Bringing down the DMV may be the best use anyone's ever found for a virus.
Yeah, everyone's always complaining that the lines aren't slow enough already.
> And who was it who brought it into the office? The CEO. He thought he had a virus but connected to the network anyway. Mod that funny if you will but try being part of our network support team.
You sound annoyed... did you draw the short stick for who gets to tell him?
> Well, this should go down as one of the most obivous scams that has happened on wall street since enron and martha..
Yeah, but at least Martha did it with style.
> Many years ago, I saw one of the old IBM ones with a 'C:\>' prompt. I spent a couple of seconds wondering how I could hack it to get free money, then realised it was somewhat tricky without a keyboard to type on. Oh well.
Use the keypad:
> Some 15 years ago, I went to an ATM, and the only thing it displayed was "640K OK" in the upper-left corner of it's screen...
> Perhaps instead of "boxers or briefs," our next presidential candidate will have to answer "POP3 or IMAP?"
No, the difference will show up when some sexual indiscretion is discovered, and the usual "Who?" will be replaced by a geeky "How?"