Re:Static analysis is the sh-t
on
PMD Applied
·
· Score: 1
Static analysis of C and C++ is much more difficult, and prone to miss things and flag things inappropriately, than static analysis of a language like Java.
Re:Misses the point
on
PMD Applied
·
· Score: 2, Insightful
Its generally worth catching as many errors as you can as early as you can. I used to run an on-the-fly spell checker, which caught a lot of typos as soon as I'd made them, saving me a compile and fix cycle. In the last few years though, CodingStandardsThatActivelyPreventSpellChecking have become popular, with the justification that underscores (which my spellchecker could treat as whitespace) are not allowed in variable names in some obscure language that someone used 30 years ago, so they shouldn't be used anywhere despite leading to more readable code. Even more recently, development environments have found ways to use 2Gb of RAM and 100% of a 2GHz CPU to provide the same end effect. Progress.
It also helps if your "room full of geeks" is a small room - the person who wrote the code, the person running the meeting, and two or even just one reviewer works best in my experience. Also helps if the reviewers have reviewed the code prior to the meeting, so the rest of the team are not spending the whole meeting watching them skim the code.
In general, consumer law favours the consumer. So yes, you can have it both ways. If amazon.co.uk pulled this, they would be breaking the law. At the point where they shipped the DVDs, they have no recourse to anything over and above what was agreed with the customer before the purchase. It is OK for retailers to say "sorry, we slipped up, the price was wrong" before completing the sale, but it is illegal under the Distance Selling Regulations for anyone to demand payment for items after they have already shipped them if that payment was not already negotiated before shipping.
Symmetric encryption algorithms are not very computing intensive, cell phones today have plenty of CPU power compared to the PCs of 15 years ago that used to run the same algorithms acceptably.
Moreover some algorythms have been proven to be breakable.
Anyone who uses SHA-1 or MD5 for encryption is going to be waiting a looooong time to decrypt their data, even on the fastest processors. Best steer clear of them for encryption, regardless of how "breakable" they are.
Some phones are starting to encrypt their storage, so breaking into them through the servicing routes is not going to get you much information. Windows Mobile 6 will encrypt any external storage card if configured to, for example.
When biometric technology was new, it was expensive, and the only customers were military and other high security installations who are always looking for ways to increase the perception of security, if not the actual security. So technology to measure pulse, body temperature etc was built into the scanners from an early stage, to counter the sci-fi movie ideas of cutting off fingers, ripping out eyeballs etc to get around the biometric security.
More recently though, there has been a drive to cut costs and minaturize the scanners so they can be included in laptops and phones. I wouldn't be surprised if these scanners were susceptible to some of these basic attacks, perhaps even allowing access to 2D reproductions of a fingerprint, which is the most likely exploit to be tried.
The last thing I need when my phone is ringing in a meeting, while driving, or at the dinner table is the horrific realization that I have forgotten to unlock the phone
On every phone I have seen, you can answer incoming calls when the phone is locked. What you can't do is make outgoing calls, or browse through the phonebook, calendar and other personal information on the phone. I don't see any reason why this would change just because the authentication technology changed from a PIN to a fingerprint.
The newspapers also would like to restrict access to their "archives" (which they regard as a pay-to-see resource).
They can restrict access to their archives all they like now. I think what they're really scared of is that Google provides an easy way to find other news sources with the same story, that do not charge for access to their archive. What they are trying to do here is make Google less useful for searching for news stories, in an attempt to get back their captive audience.
OK, obviously English isn't your first language, so a lesson is in order. In English we have a number of phrases whose meaning is not exactly the same as the words making up the phrase taken literally. "Out of the box" is one such phrase, meaning "included by default". There doesn't have to be a box involved.
I'm not sure how the vorbis example is any different than the network stack or giflib. In any case, the BSD licence explicitly allows inclusion in proprietary software that is its advantage in the eyes of its supporters. The disadvantage is that it has no protection against secret embrace-and-extend modifications.
The LGPL covers situations like file formats or codecs that you want become standard even in proprietary software. Using BSD for such a case allows unscrupulous companies to create their own incompatible Vorbis+ codec to lock users into using their own software. LGPL at least ensures that if they use your code to do this, they have to provide the source so that other implementations can provide compatibility.
Domestic purposes.
36. Personal data processed by an individual only for the purposes of that individual's personal, family or household affairs (including recreational purposes) are exempt from the data protection principles and the provisions of Parts II and III.
There are also exemptions to cover "detection and prevention of crime", "protecting the public from dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity,", "protecting members of the public against conduct which may adversely affect their interests by persons carrying on a business" and pretty much every other reason an individual might want to record their conversation with customer support, in case you think domestic purposes doesn't cover it.
doesn't mean that was what was said in latin or hebrew!!!
Whatever was said, it was more likely said in Aramaic, though when recorded later it was written in Greek or Hebrew. So the true original has been long lost.
I haven't seen the video that was banned, but even assuming it was fairly tame one can easily see how YouTube might remove it in a knee-jerk manner.
The video consists of out of context quotes from the Qu'ran flashing up almost faster than you can read them. Not really the sort of thing I'd expect to be banned for as a one off incident, but the quote from Google "due to your repeated attempts to upload inappropriate videos" suggests that he has been warned before, and it is not just this one video he is being banned for. For all we know, it may have been the RIAA that had him taken down, due to the unauthorized use of Rob Dougan's Clubbed to Death as background music.
I have recordings (yes, you're not supposed to do that)
Most customer service calls I make give permission for recording at the start of the call - something like "this call may be recorded for training and monitoring purposes". Does Dell not do that?
You can use software to encrypt your conversations sent over packet data networks (in any of the various ways that this is achieved), but you cannot encrypt in hardware any conversations communicated according to the GSM/WCDMA standard.
Why not? Its uses the same speech codecs as commonly used in VoIP (EFR, AMR, AMR-WB), all you need to do is encrypt the data between speech encoding and sending the encoded data over the network. The only real difference between packet networks and cellular is that the transport layer is a fixed bandwidth dedicated channel with no congestion issues.
OpenID seems good in theory, allowing users to mange their own identity and choose where they host it, but with the big boys joining (Yahoo has already announced partial support), I can see that the trust issue will cause OpenID to become less open. Most sites will start accepting OpenIDs only if they are hosted by the big players. Not that a throwaway hotmail account is any more trustworthy than billspage.hax0rs.org, but it will be perceived to be by the suited classes, who don't understand the issues properly.
Its not a case of being backward, more a tradeoff between the cost of installing and maintaining a complex system vs property prices for the land required for a simpler conventional carpark. With skyrocketing property prices around the world in the last few years, its not surprising that we're starting to see solutions that Japan adopted at the peak of its property bubble in the 1980's.
Slashdot Mirror
Static analysis of C and C++ is much more difficult, and prone to miss things and flag things inappropriately, than static analysis of a language like Java.
Its generally worth catching as many errors as you can as early as you can. I used to run an on-the-fly spell checker, which caught a lot of typos as soon as I'd made them, saving me a compile and fix cycle. In the last few years though, CodingStandardsThatActivelyPreventSpellChecking have become popular, with the justification that underscores (which my spellchecker could treat as whitespace) are not allowed in variable names in some obscure language that someone used 30 years ago, so they shouldn't be used anywhere despite leading to more readable code. Even more recently, development environments have found ways to use 2Gb of RAM and 100% of a 2GHz CPU to provide the same end effect. Progress.
It also helps if your "room full of geeks" is a small room - the person who wrote the code, the person running the meeting, and two or even just one reviewer works best in my experience. Also helps if the reviewers have reviewed the code prior to the meeting, so the rest of the team are not spending the whole meeting watching them skim the code.
In general, consumer law favours the consumer. So yes, you can have it both ways. If amazon.co.uk pulled this, they would be breaking the law. At the point where they shipped the DVDs, they have no recourse to anything over and above what was agreed with the customer before the purchase. It is OK for retailers to say "sorry, we slipped up, the price was wrong" before completing the sale, but it is illegal under the Distance Selling Regulations for anyone to demand payment for items after they have already shipped them if that payment was not already negotiated before shipping.
Symmetric encryption algorithms are not very computing intensive, cell phones today have plenty of CPU power compared to the PCs of 15 years ago that used to run the same algorithms acceptably.
Moreover some algorythms have been proven to be breakable.
Anyone who uses SHA-1 or MD5 for encryption is going to be waiting a looooong time to decrypt their data, even on the fastest processors. Best steer clear of them for encryption, regardless of how "breakable" they are.
Some phones are starting to encrypt their storage, so breaking into them through the servicing routes is not going to get you much information. Windows Mobile 6 will encrypt any external storage card if configured to, for example.
When biometric technology was new, it was expensive, and the only customers were military and other high security installations who are always looking for ways to increase the perception of security, if not the actual security. So technology to measure pulse, body temperature etc was built into the scanners from an early stage, to counter the sci-fi movie ideas of cutting off fingers, ripping out eyeballs etc to get around the biometric security.
More recently though, there has been a drive to cut costs and minaturize the scanners so they can be included in laptops and phones. I wouldn't be surprised if these scanners were susceptible to some of these basic attacks, perhaps even allowing access to 2D reproductions of a fingerprint, which is the most likely exploit to be tried.
The last thing I need when my phone is ringing in a meeting, while driving, or at the dinner table is the horrific realization that I have forgotten to unlock the phone
On every phone I have seen, you can answer incoming calls when the phone is locked. What you can't do is make outgoing calls, or browse through the phonebook, calendar and other personal information on the phone. I don't see any reason why this would change just because the authentication technology changed from a PIN to a fingerprint.
The newspapers also would like to restrict access to their "archives" (which they regard as a pay-to-see resource).
They can restrict access to their archives all they like now. I think what they're really scared of is that Google provides an easy way to find other news sources with the same story, that do not charge for access to their archive. What they are trying to do here is make Google less useful for searching for news stories, in an attempt to get back their captive audience.
OK, obviously English isn't your first language, so a lesson is in order. In English we have a number of phrases whose meaning is not exactly the same as the words making up the phrase taken literally. "Out of the box" is one such phrase, meaning "included by default". There doesn't have to be a box involved.
OFT thinks otherwise
with Microsoft Windows, and I install
Bzzzzt. Thanks for playing. OS: Windows. GNU coreutils, not in box.
Got it?
My definition of a GNU system would be one that used GNU coreutils out of the box. gcc, emacs, wget, nano etc are add-ons above the basic system.
I'm not sure how the vorbis example is any different than the network stack or giflib. In any case, the BSD licence explicitly allows inclusion in proprietary software that is its advantage in the eyes of its supporters. The disadvantage is that it has no protection against secret embrace-and-extend modifications.
The LGPL covers situations like file formats or codecs that you want become standard even in proprietary software. Using BSD for such a case allows unscrupulous companies to create their own incompatible Vorbis+ codec to lock users into using their own software. LGPL at least ensures that if they use your code to do this, they have to provide the source so that other implementations can provide compatibility.
There are also exemptions to cover "detection and prevention of crime", "protecting the public from dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity,", "protecting members of the public against conduct which may adversely affect their interests by persons carrying on a business" and pretty much every other reason an individual might want to record their conversation with customer support, in case you think domestic purposes doesn't cover it.
doesn't mean that was what was said in latin or hebrew!!!
Whatever was said, it was more likely said in Aramaic, though when recorded later it was written in Greek or Hebrew. So the true original has been long lost.
Jews don't consider translations of the Koran as authoritative (or even "holy", in any sense) for exactly this reason.
Jews don't consider translations of the Koran as authoritative or holy for the same reason they don't consider the original as authoritative or holy.
I haven't seen the video that was banned, but even assuming it was fairly tame one can easily see how YouTube might remove it in a knee-jerk manner.
The video consists of out of context quotes from the Qu'ran flashing up almost faster than you can read them. Not really the sort of thing I'd expect to be banned for as a one off incident, but the quote from Google "due to your repeated attempts to upload inappropriate videos" suggests that he has been warned before, and it is not just this one video he is being banned for. For all we know, it may have been the RIAA that had him taken down, due to the unauthorized use of Rob Dougan's Clubbed to Death as background music.
I have recordings (yes, you're not supposed to do that)
Most customer service calls I make give permission for recording at the start of the call - something like "this call may be recorded for training and monitoring purposes". Does Dell not do that?
You can use software to encrypt your conversations sent over packet data networks (in any of the various ways that this is achieved), but you cannot encrypt in hardware any conversations communicated according to the GSM/WCDMA standard.
Why not? Its uses the same speech codecs as commonly used in VoIP (EFR, AMR, AMR-WB), all you need to do is encrypt the data between speech encoding and sending the encoded data over the network. The only real difference between packet networks and cellular is that the transport layer is a fixed bandwidth dedicated channel with no congestion issues.
OpenID seems good in theory, allowing users to mange their own identity and choose where they host it, but with the big boys joining (Yahoo has already announced partial support), I can see that the trust issue will cause OpenID to become less open. Most sites will start accepting OpenIDs only if they are hosted by the big players. Not that a throwaway hotmail account is any more trustworthy than billspage.hax0rs.org, but it will be perceived to be by the suited classes, who don't understand the issues properly.
Was it like the one in Birmingham from the same era, mothballed after a week because it didn't work?
Its not a case of being backward, more a tradeoff between the cost of installing and maintaining a complex system vs property prices for the land required for a simpler conventional carpark. With skyrocketing property prices around the world in the last few years, its not surprising that we're starting to see solutions that Japan adopted at the peak of its property bubble in the 1980's.
I remember using one in Nagoya in 1989. They are not new technology at all.