Slashdot Mirror


User: tricorn

tricorn's activity in the archive.

Stories
0
Comments
1,399
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,399

  1. Re:Gypped on Halo 3 Review · · Score: 1

    I've always been amusedat people who use "butt naked", not realizingthat it is a corruption of a racial slur on Native Americans, "buck naked".

  2. Re:Uneven Shows on The Fall Geek TV Lineup · · Score: 1

    Being British I fail to understand why anyone in the US likes UK comedies ... I do hope it was better -- the US versions usually are.

    I thought Coupling (original UK version) was absolutely hilarious, but the US version of it was horrible. The first episode was, as near as I could tell, word for word the same script, and it just fell totally flat. I don't know if it was the timing, the chemistry between the actors, the laugh track or just poor delivery, but it didn't last long.

  3. Re:That's nice and everything but.... on New Hack Exploits Common Programming Error · · Score: 1

    Um, that Wikipedia description is correct. It is also saying the same thing I am. You have one pointer pointing to memory. That memory then gets assigned to another object. Modifying that second object can then modify the object that is supposedly no longer there (pointed to by the dangling pointer) OR modifying the object pointed to by the dangling pointer will change the object that has been allocated on top of it. If you DON'T have two different pointers pointing to the same memory, then the fact that it is a dangling pointer does no harm (note that something may have pointed to it, modified it, then have been deallocated, and the "different pointer" may also be an internal pointer used by the memory allocation routines, but that is not as likely; debugging techniques such as heap scrambling to specifically find such errors can also modify the dangling object).

    I didn't say you have to "combine it with a buffer overflow"; I said that changing an object pointer in one or the other object to be on the stack with a relevant field now mapped onto a return address would allow you to change the return address using techniques similar to buffer overflow attacks - e.g. using a carefully designed string to contain executable code and point the return pointer to jump to that location on the stack. Modifying a pointer to an object that contains a large string so that the object is on top of the stack is one way to do this, then (using the original object that contains the pointer) loading that string with some content you can supply, is one way to do this.

    Changing one object by modifying another object is the very essence of what happens when you have a dangling pointer. Usually it just screws everything up, leading to "impossible" results ("but all references to X are checked to make sure it could never have that value!"), but if you know which two objects are overlapping, you can usually do interesting things with it. And you don't need magic.

  4. Re:That's nice and everything but.... on New Hack Exploits Common Programming Error · · Score: 3, Informative

    Well, no - a dangling pointer implies two different pointers referencing the same memory area. Since many objects have pointers to other objects, if you can change one object by modifying fields through the other pointer (either the dangling pointer or the memory area doubly referenced), you can change one of those object pointers to point to a location on the stack; then using common buffer overflow techniques, you can put code on the stack and modify a return address to point to that code.

    I wouldn't say such an approach can ALWAYS be used to compromise a machine, but it is much more generic than the (also quite possible) C++ (and similar language) specific method using pointers to vtables and such.

    I've always assumed that if you can get a program to crash, you can probably get it to execute arbitrary code. One way of avoiding such techniques (other than writing correct code) is to use hardware support. The No-Execute page flag is one good start; having separate control-flow and data stacks would be another (where the control-flow stack would only be accessible through special instructions). Randomizing the location of the stack and the heap, and possibly make the memory allocation routine be less optimal and more random would also help a lot. Having a tagged memory architecture would be helpful as well (pointers to code could ONLY be manipulated through special instructions, and trying to load the wrong type of memory would cause a hardware exception).

  5. Re:Good grief on Slot Machine with Bad Software Sends Players To Jail · · Score: 1

    If you play 100 quarters, you'll end up with 95-98 quarters at the end of it, on average. That means that, although you may occasionally stick a quarter in and get back 20, you'll also stick a quarter in and get back nothing 21 times as often. Again, on average. Obviously, some people will get more back than they put in, and some people will get back less than 95% of what they put in.

  6. Re:As if computer science wasn't stunted enough on Forget Math to Become a Great Computer Scientist? · · Score: 1

    You don't think algorithm analysis isn't math? Boolean algebra? What about formal logic? People seem to be hearing "math" and thinking "calculus" and "differential equations" and "trigonometry" and "geometry", and saying "I'll never need that". Well, maybe you will, maybe you won't. But the "computer science" part of computer programming IS math; there's lots of computer programming you can do with computer science, but then you're not doing computer science. Computer Science itself IS math, but there's LOTS of different fields of math, and being interested in one such field does not mean you're interested in all of them. There are even lots of different areas in CS itself, and interest and ability in one area of CS does not imply interest and ability in all areas even of just CS.

    Math is about formalism and proof and logic. A lot of computer programming is not (but a lot of computer programming can benefit from an understanding of the results that the Computer Science formalism and proofs result in, even if you don't need to understand HOW it was proven).

    Many areas of non-CS math can be useful in programming as well. Calculus and differential equations are useful in some circumstances. Statistics is often useful (queuing theory is statistically based). Even topology can be useful (I can imagine that the 4-color map theorem might be used in the design of a data structure, for instance). Trigonometry has obvious utility in some circumstances. NOT knowing these things limits you in what you can do. That doesn't mean that to be a useful and accomplished computer programmer you need to know every field of math and computer science, of course.

  7. Re:Look on the bright side... on No iPhone For 64-Bit Windows · · Score: 1

    That's sort of how I feel about all the products or services that require you use a Microsoft operating system and a Microsoft Web browser in order to use them, or use all of the features, in things like firmware or database updates for GPS units, controlling your DVR from home, or development environments for microcontrollers. Sort of funny to see people bit by the same thing in the other direction for a change.

  8. Re:It will be supported on No iPhone For 64-Bit Windows · · Score: 1

    Use of "word" can be ambiguous. It's most natural meaning is the size of the data registers in a particular computer architecture. C has slowly moved away from having word size (which is "int" is normally assumed to be) be dependent on the underlying hardware, instead having "int" and "long" both be 32-bit, requiring "long long" for 64-bit. This obviously makes portability a lot easier.

    The height of the insanity was with the early x86 chips, with compilers having "int" be 16 or 32 bits (thus, either matching "short" or "long"), and a whole family of pointers of varying sizes to deal with the weird segmented memory and varying execution models. Compared to that, having a variety of "char" sizes that might be either signed or unsigned was a piece of cake (some char sizes being 6 bits, 7 bits, 8 bits, 12 bits and 60 bits). Be thankful that the DEC convention of Radix-50 characters went away, there wasn't even a true bit size for those, just a word (36-bit word at that) containing characters that had to be unpacked.

  9. Re:The list on Top Irritating Words Spawned by Internet · · Score: 1

    Webinar.

  10. Re:Math Wrong? on The Fallacy of Hard Tests · · Score: 1

    A "really hard test" will have no questions that "everybody can answer", will have some questions that almost nobody can answer, and will have a high enough pass level that it tends to filter out people who are marginal rather than being generous. There will be enough questions on the test that the probability of someone passing simply through lucky guessing is going to be very low. The more questions there are, the lower the margin of uncertainty. "very hard tests" aren't necessarily good tests, though.

    Look at it this way: if you score it so that someone randomly answering gets an expected score of 0, or a score of 50, or whatever score, it's the variation FROM that expected score that makes the difference. Whatever the penalty for guessing is, if everyone answers ALL questions regardless of how sure they are of the answer, you'll get the same distribution of scores (the actual values won't be the same, but the distribution will be). How well the test discriminates will be based on the number and quality of the questions, not the scoring method.

    If there's no penalty for guessing, or a penalty that's less than the expected return, then a rational test taker should ALWAYS guess, so you get the above scenario. If, however, the penalty for guessing is more than the expected return for a random answer, then the rational test taker must evaluate the certainty of their answer, and only answer if that is above the expected return rate. In that case, the ONLY additional thing you are measuring is the accuracy of the test taker's self-evaluation of their knowledge level on each question. If that's important, then do it (or do it for a portion of the test), but know that means it is being less discriminatory of the actual knowledge level.

    A penalty that is less than the expected return rate (e.g. no penalty) penalizes someone who runs out of time to randomly fill in the blanks, which is probably not what you want to test, so a scoring method that gives exactly the expected return for an unanswered question is appropriate. Thus, score 0 for an incorrect answer, 1 for a correct answer, 0.5 for an unanswered T/F, 0.2 for an unanswered 1-of-5 multiple choice, etc. However, giving a score of 0 for an unanswered question should return close to the exact same result for everyone who does the expected behavior of answering every question; there will be some random noise inserted, but over several hundred questions that should be fairly low.

    Any test is going to have problems with people right at the margin. A "hard test" will make sure that ONLY those people who are qualified pass (thus eliminating some candidates who were qualified but unlucky), an "easy test" will make sure that all qualified candidates pass (thus allowing in some people who weren't qualified but were lucky). For a pass-fail test, ALL the questions should be able to be answered by a qualified candidate, and NONE of the questions should be able to be answered by all of the unqualified candidates (i.e. if you take a sufficiently large number of unqualified candidates, NONE of the questions should be able to be answered by all of them, and ideally all of the questions would have about the same level of incorrect responses).

    If the purpose of the test is diagnostic, then you'll have a wide range of very easy to practically impossible questions, designed to identify a particular area of deficiency. However, NO question should be able to be answered by everyone, that would be a useless test question that only measures ability to accurately fill in a circle on the test sheet (although even that might be useful to identify people who have problems taking tests). With such a test, you might give a higher score for a more difficult question (e.g. instead of 0, 0.2 and 1 for wrong, no answer and correct on a 1-of-5 multiple choice, you'd give 0, 1 and 5).

  11. Re:Math Wrong? on The Fallacy of Hard Tests · · Score: 1

    Alternatively, score a wrong answer 0, a correct answer 1, and an unanswered question 0.5 (for T/F; score 0.2 for a 5-choice, etc). Expected score for 100 questions for no knowledge is then 50 if they're all T/F. The real problem with the analysis is expecting the score to be linear with the "amount of knowledge". It also is relying on a totally unrealistic test where the top scorers only know the answers to 2 questions. I'll bet that the top scorers on any "really hard test" knew a whole lot more than 2% of the questions.

    There's nothing wrong with simply scoring correct answers 1, all others 0, unless you're specifically trying to test for the ability to know when you have no idea what the answer is. How you score it will change the raw scores, but those don't matter. Validating the test is still important, and from that process you'll find out what a passing score should be. Hint, there's no reason why 70% or any other fixed number should be passing.

    One advantage of scoring only correct answers is that it removes a psychological pressure to not guess, and scoring guessing is actually a fairly good way of determining knowledge level. If you know nothing about the answer, you'll get it right 50% of the time. If you know just a little bit about a question, you may raise that to 60%, if you're familiar with it, you might get it right 80% of the time, and if you know it solid you'll get it right 95-100% of the time. If someone only answers when they feel very sure of the answer, you lose some of that ability to discriminate between knowledge levels.

  12. Re:ZFS and Sun boxes on Does ZFS Obsolete Expensive NAS/SANs? · · Score: 2, Informative

    You can pick up those 750GB Seagate SATA drives for about $200 each now...

  13. Re:Does this mean..... on Supreme Court Sides With Microsoft Over AT&T · · Score: 1

    Umm, no. The AT&T patent isn't valid in the other country, so no, they couldn't go after you there for patent infringement. Try R-ing TFA next time.

    The issue was whether producing the software in this country was violating the patent in this country even though it was only used in a country where it wasn't patented; the court ruled that since what was shipped from this country was never combined into a product that violated the patent, only copies made from what was shipped from this country, that it did not violate the patent in this country. If there was a patent in the other country that applied, it would still be infringing that (though, presumably, it would be whoever did the final "combining" of the software and hardware into a single product that was doing the infringing).

  14. Re:Does this mean..... on Supreme Court Sides With Microsoft Over AT&T · · Score: 1

    Umm, no. Copyright law and patent law are completely different. This is about patent law, and has nothing to do with making unauthorized copies of software.

  15. Re:IANAL on Supreme Court Weakens Patents · · Score: 1

    No, the law hasn't changed, only the interpretation of it. Plenty of now-obvious patents could now be challenged again.

    In addition, even if it was a change in the law, there's nothing that says that can't happen. See, for example, the extension of copyright terms to works already in existence.

  16. Re:Xbox 360 is on shelves. Wii is not. on How Wii Is Creaming the Competition · · Score: 1

    Yesterday, at Best Buy, I took a look in their locked cage where they keep the game consoles.

    I saw about 6 Wii, 5 PS3, 6 PS2 and quite a few XBox360. I would say anyone making proclamations that a specific console is or isn't selling well based on whether there are or are not units in stock hasn't a clue. For example, a unit that is never in stock is either selling really well, or possibly is selling really poorly (can't buy 'em if they're never in stock). A unit that is always in stock is either selling really well (which is why the retailer keeps ordering more, thus keeping it in stock), or is selling really poorly. Unless you're tracking actual shipments received, and then looking at inventory, you really have no idea if they are selling well at a particular store, much less around the country.

  17. Re:pfft on Vista Taking a Nibble Out of Apple in OS Wars? · · Score: 1

    Umm, what low-level control am I giving up? How is it not developer-friendly? Or office-friendly?

    Sure, there are going to be programs that run only under Windows; most micro-controller development/debugging environments, for instance, only run under Windows. Fortunately, it's pretty easy to run those few Windows programs you might need with only a Mac; you could even do it before the Intel-based Macs came out, but now you can run them at essentially full speed, in quite a few different ways.

  18. Re:Copyright? on MPAA Fires Back at AACS Decryption Utility · · Score: 1

    I didn't mean that there were separate versions, but that the "license" referred to in the standard blurbage is referring to how it was licensed to the distributor. Sure, it's meant to be read by the end user, but there IS an actual license. Read it as "we've only been licensed to distribute this DVD to people who are going to use it for purposes that don't require a sub-license, which we can't and won't give you". Of course, their way sounds scarier.

  19. Re:Isn't AACS encryption just AES? on MPAA Fires Back at AACS Decryption Utility · · Score: 1

    The phrase "effectively controls access" does NOT mean it necessarily does a good job. Read it as "has the effect of controlling access". Makes me wonder if I published a book with colored dots all over the pages, that required that you use a red filter to read it, if that would make owning red filter gel illegal.

  20. Re:Copyright? on MPAA Fires Back at AACS Decryption Utility · · Score: 3, Informative

    Actually, I own the disc, AND I own a copy of the contents, which I can use in any way not restricted by copyright. I don't own the copyright on the contents, but it is certainly an "authorized copy", and I've purchased it, I own it, and I have rights to use it in certain ways. When copyright law talks about "owner of an authorized copy", it isn't talking about the copyright owner, it's talking about ME.

  21. Re:Copyright? on MPAA Fires Back at AACS Decryption Utility · · Score: 1

    Perhaps a better interpretation might be that the distributor has been licensed to reproduce it only for "private home use" or whatever (which means they can distribute it without the recipient needing to sub-license it, since as you note no license is needed by the end user for non-public "performances" of the work.

    What I don't understand is why, if I've encoded something using AACS, that I own the copyright to, why I'm not entitled to give permission to any and all to use an AACS decryption program to decrypt my copyrighted work. Wouldn't that basically make possession and distribution of such a decryption program be unaffected by the provisions of the DMCA (since it would be "with the authorization of the copyright owner")? From the other direction, what if I distribute a copyrighted work (of my own), encrypted with, say, 3DES or simply AES? Doing so doesn't automatically make any 3DES or AES decryption program a DMCA violation, that would be silly!

    Now, if AACS is patented, then they do indeed have a way of preventing such distribution and use. However, I don't see that a simple decryption program, without any key-breaking included, is controlled by the DMCA.

  22. Re:WaitForMultipleObjects on Pthreads vs Win32 threads · · Score: 1

    Yes, but the problem with that is a thread that only wants to wait on "a || b" will get notified when c or d get kicked - sure, it goes right back to sleep, but that's needless overhead.

    Having the flexibility to use multiple condition variables with the same mutex is nice, but is also an easy way to shoot yourself if not used carefully. In Java, you have condition variables, but they are strictly one-to-one with a mutex. Doing a reader-writer lock is much easier with the pthreads style of condition variables, for example.

  23. Re:Surprised on Blu-ray/HD DVD Disc Sales Numbers Revealed · · Score: 1

    I guess we just wait a month. If another million ship, it ought to be apparent that the previous million sold. My local Best Buy has two PS3 (60GB), one PS2, and about 20 Xbox360 boxes inside the locked cage. The first time I saw them with PS3 in stock, they had about 5 of them, and as I stood there, one of them sold and two others were being seriously considered. This was about 2 weeks into January. I'm sure it's different elsewhere, but I just don't see the "piles of PS3 boxes sitting on shelves gathering dust for weeks at a time". What is quite clear to me is that any store that does have piles of PS3 boxes sitting on shelves gathering dust aren't going to have any more shipped to them, so any units that ship in February quite clearly will represent units sold in January. So just wait a month. There will be new Blu-Ray vs. HD-DVD sales figures out by then too, so the argument can continue without threat of any real resolution.

  24. Re:being denied information on Blu-ray/HD DVD Disc Sales Numbers Revealed · · Score: 1

    Broadcast analog NTSC television is limited to a bandwidth of 4.2MHz for the video signal, but if it has color it has to be below 3.5MHz (the color subcarrier is at (approximately) 3.58MHz). With 525 scan lines 30 times a second, the MAXIMUM number of lines of resolution across the screen would be 444, but some of that is taken up by the horizontal retrace. Given overscan (part of the picture isn't normally visible), you can normally only get about 300 "lines of resolution" out of a composite color signal.

    Consider: one scan line is 63.5 microseconds, 5 of which are horizontal retrace, and really only about 42 of which are useable. In 42 microseconds, a 3.5MHz signal will cycle 147 times, which is 294 "lines" (half black, half white). Actually, I think the bandwidth limit on the luminance signal is more like 3MHz, which drops it even lower. When people talk about an NTSC signal having 440 lines of resolution or whatever, that's referencing a monochrome signal only, with no colorburst to signal that there's a color subcarrier, hence the resolution can be somewhat higher, plus they're ignoring overscan. Taking overscan into account, and allowing a full 4.2MHz bandwidth, you get about 350 "vertical lines of resolution".

    Of course, with a monochrome signal, and directly connected instead of being broadcast, there's no real bandwidth limitation, so you'd only be limited by the equipment and quality of the cable. Once you add color to the picture, so to speak, you are quite definitely limited, broadcast or not. The only way to get higher resolution is to separate the luminance from the chroma signal, which is what S-Video does, or completely eliminate using a phase-modulated chroma signal and use a component video connection instead.

    The graph you linked to, regarding "SDTV", is not NTSC; SDTV is a digital standard, not an analog standard. When referring to "broadcast NTSC", you are talking about analog broadcasts.

  25. Re:being denied information on Blu-ray/HD DVD Disc Sales Numbers Revealed · · Score: 1

    NTSC is what is sent over a composite cable or over the air. "Broadcast quality" is what you get out of a composite cable. You can't get S-Video resolution out of a composite connection, since it gets filtered out so as not to interfere with the color sub-carrier. S-Video or component is not NTSC, they are both higher resolution. DVD is significantly higher horizontal resolution than "broadcast quality" NTSC (or PAL, for that matter, which uses a similar color encoding scheme, a higher number of scan lines, but lower refresh rate which normally ends up making 24-fps movies play at the wrong speed, which drives people with perfect pitch absolutely crazy).