Slashdot Mirror


User: fizbin

fizbin's activity in the archive.

Stories
0
Comments
488
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 488

  1. Old Hat on Trinity DDoS Discovered · · Score: 1

    Check out sometime the capabilities of the SubSeven windows trojan. It can phone home on IRC, ICQ, or AOL IM. Since I installed my cable modem 2 weeks ago, SubSeven connection attempts have been coming in at the rate of about 2-3/day, (with floods as high as 5/hour) easily making it the most frequent suspicious probe. (not counting the hundreds of UDP port 137 UDP port 137 traffic that goes by - I don't have time to sort all of that stuff into suspicious vs. "normal".

    (off topic)

    I've tried to set up a little mini-honeypot to see what these SubSeven probers would try after finding a machine with that port open, but only one has actually tried anything; maybe I need to work out more of the protocol to fake it better. (And I would appreciate any pointers on that, especially on what the "UFU" command means - for some reason, SubSeven's source code isn't available)

  2. Re:Word format for resumes on Microsoft Word Documents That "Phone Home" · · Score: 1

    I recently completed a job search (which although it ended well, did not begin well) and I didn't get any responses to the headhunting agencies I emailed my resume to until I started sending it out in word format. (Silly me; I thought HTML would be the preferred format for an internet applications programmer.)

    Maybe that comment about text-only resumes applies to large companies, but in the world of small headhunting firms, Word 97 is the way you should send it to them. (My PDF-format resumes didn't get any response either, despite the fact that the most common reason I heard for wanting Word format was that they wanted to see my resume exactly as I intended)

    This is one reason I actually wish everyone in the Microsoft world would go out and upgrade to Office 2000 - if I could guarantee that those people who wanted Word format all had O2K installed, then I could just have one version of my resume, and symlink resume.doc to resume.html.

    (If you have office 2000, you can look at http://math.jhu.edu/~martind/resume.html and then at http://math.jhu.edu/~martind/resume2k.doc, which is just a symlink to the same file. See how easy it is to have a valid HTML file that formats nicely as a Word document the way you want it to?)

    Face it - resumes are used to get you through the part of the job process that is governed not by technical people, but by people who know offices and paperwork; as far as most of those people are concerned, anything outside of Word isn't a real document.

  3. Re: W3C standards on Microsoft's IE 5.5 Flouts Industry Standards · · Score: 1

    In defense of w3c standards:

    If we stuck to them, we'd be living with a less flashy web, possibly. Thing is, we'll never know - it's the old story of "It's not been tried and found wanting, it's been found difficult and not tried." The full W3C DOM can do everything Microsoft's DOM can do, and more; check out the descriptions of the Mozilla samples. As for coding for both browsers, it should be a simple matter to build a bunch of wrapper script to make stuff work on both IE 4/5 and Netscape 6. (So long as you don't get _too_ fancy with complicated InnerText and InnerHTML manipulations - I still think it'd be possible to convert that code, but it would be more of a pain)

    My guess is that if the browser implementors had cared about the standards process, we would have a workable MathML by now; SVG (or some similar related standard) would have been out last year or earlier; sets of related documents would be easy to navigate through (remember ?); we'd have browsers using a sensible authoring model instead of IE/MSOffice's frontpage server extension trickery; etc.

    The fact is though that you're right - Microsoft doesn't give a rat's ass about standards compliance unless the people they consider their customers (that is, people selling fancy flashy business websites - not those people trying to find information on the web) insist on them.

  4. Re:More Fun with MS's support site on She Blinded Me With Quickies · · Score: 1

    Is their Barney FAQ: http://support.microsoft.com/support/actimates/bar ney/faq/default.asp

    Looking through all that almost (_almost_) makes me want to get ahold of one of those things and figure out what the protocol is for the PC transmitter.

  5. Re: who doesn't use ssh? on Colleges Urged To Ban Telnet And FTP · · Score: 1

    I don't; I _can't_.

    My summer job (here at unisys, whose stock makes interesting watching these days) has me sitting behind a firewall. This I can live with and in fact find quite reasonable.

    The firewall is set to only allow outgoing connections to specific machines/ports. This I find highly annoying, but if it let out the right ports I wouldn't mind.

    The ports I know of that I'm allowed to connect to are 21, 23, 80, 81, 443, 8000, 8080, and any port on AOL's IM servers. Nothing else. You'll notice that 22 isn't in that list. That's right - the corporate firewall is so secure that you can't use ssh. Telnet access, however, apparently meets some business need.

    I'd actually like it if every school started dropping telnet access and only allowing ssh. Maybe the cry of "let me read my school email" from all the interns would get the corporate firewall policy changed.

  6. Re:GPL and "stealing" on Abit Violating The GPL? · · Score: 1

    > It is the nature of the GPL to coercively steal others' work. It is not immoral to resist immorality.


    Ok, I'll bite. (I know, I shouldn't, but I'm not doing anything other than waiting for the latest n-MB download of debian packages to complete)


    It is the nature of the GPL to offer people strong incentives to free their work in the sense of the GPL, by allowing them to then combine it with other existing GPLed software.


    If you wish to have nothing to do with GPLed code, then the GPL will have nothing to do with you.


    I won't even touch the implicit rejection you make of the stance the GNU project takes that open code is more moral than closed code. That way lies unending recursive holy wars.

  7. Ob Fact-Check-Nit on Napster, Gnutella, Bans, Lawsuits And More · · Score: 1

    The quote from Lars comparing these people to looters was quite appropriate.


    Lars didn't make that quote - it was taken from the text of the lawsuit. The quote Lars gave was the either incredibly stupid or brilliantly subversive line about treating art as a commodity.


  8. There have been some changes on GCC For Windows NT? · · Score: 1

    Last time I prowled around that site (approx. two weeks ago) I did notice that quite a few of their internal links were now broken - specifically, links to pages at www.cygnus.com would often go nowhere (since www.cygnus.com points to www.redhat.com).

    I also noticed that it was very difficult to find the same documentation on the cygnus tools as one could before (e.g. html or winhelp versions of the gnu texinfo docs)

  9. It'd be easy to avoid on Cursor Software Tracks You On Web · · Score: 2

    Thing is, it would be easy to achieve their stated goals (count of unique visitors to a site) without raising the same privacy concerns.

    Certainly each customer (that is, website with the cursor-changing support) has a serial number as well. Call this number "C", and call the serial number of the user whose cursor is changed "U". Instead of reporting the pair (C,U) to headquarters, simply report the pair (C,f(C,U)), where f is some one-way hash function. (e.g. MD5)

    The information they (say they) want to collect is still collected, and yet it is impossible to do the correlation activity that privacy people are concerned about.

    I agree, though, that it seems like someone just didn't think it through. Much as programmers need to be re-educated to think intelligently about security, it appears that privacy concerns need to be addressed similarly.

  10. Marklar! on How To Write Unmaintainable Code · · Score: 1

    void markle(MARKLAR marklar) {
    MARKLAR* Marklar;

    Marklar =
    Markle(Marklar);
    }

    /* This takes the marklar, creates a marklar to it and then just uses Markle on the marklar that points to the marklar.*/

  11. Re:Who's Who of Free Software on Candidates for 1999 GNU Free Software Award · · Score: 1

    > Viewing source is viewing art and can inspire.
    > Search engines such as google are also good at
    > bringing up the home pages of those in question.

    And indeed, I have been using search engines to fill out my list at http://www.math.jhu.edu/~martind/fsfl ist.html. It just seems it would be nice to have that information collected somewhere so that not everyone had to hunt these names down.

  12. Is there a "who are these peole" list? on Candidates for 1999 GNU Free Software Award · · Score: 1

    I mean, I recognize the big names on there, but most of the people I just don't recognize at all.

    If no one knows of a better idea, I've started the process of making a bare-bones list at http://math.jhu.edu/~martind/fsflist.html - I suspect that someone else will have a better reference, but it's a start. (at the moment the list doesn't even contain all the descriptions of the people I know about)

  13. Genesis 10 on I Want Names for my Servers! · · Score: 1

    Go look at Genesis 10 from the KJV.

    I started using this scheme when I acquired an old VT terminal named "nimrod" (it had a label that said so) and needed something to name my new linux box that I was hooking this terminal up to. So my box became "cush". When I re-habilitated an old 386 to be my scratch, testing box it became "seba".

    If for some reason Genesis 10 doesn't have enough names for you, start in on 1 Chronicles.

    Another advantage of this scheme is that there are some who feel that logging into a server named "zeus" or "athena" is somehow doing homage to a pagan god. These names are straight out of the bible, and they're minor enough characters that no one is going to be offended that you're insulting some great leader by naming the server that. (I can just imagine the uproar over naming a server "jesus")

    And while I admit that Hazarmaveth is a bit hard to pronounce or, more importantly, type, there are plenty of easily useable names in there.

  14. A little straight-forward probability on Software to Predict "Troubled Youths" · · Score: 1

    I think this example comes from the book Innumeracy, but I'm not entirely sure:

    Imagine a deadly disease that has infected, on average, one out of every 500 people. Now imagine a test for this disease that is 98% accurate. What proportion of people testing positive will actually have the disease?

    The answer, of course, is around 9%. Now let us consider "potential to blow up the school" as a disease. How accurate is this test? Given my general skepticism of psychological tests, I'd wager less than 90%, but let's give it the benefit of the doubt and say 98% as above. I'm almost certain that 1 in 500 figure above is way too large for this "disease". My estimates may be off, but we certainly have more than 4 million high-school aged children in the US. Even if we assume that only 1% of kids with the potential to go shoot up the school actually do it, that leaves us with under 2000 "potentially dangerous" kids in the us. That's 1 in two thousand, and remember how generous my estimates are. So one in 40 of the kids diagnosed by this test have a one percent chance of shooting up the school, if even that much.

    I'm all for arming school administrators with psychological knowledge about their students, but I strongly suspect that this is just snake oil.

    And let's knock off the BS about the shooters at Columbine having been repressed gay geeks who lashed out at athletes - that was and always has been a press fabrication that everyone bought into.

  15. Anyone have an official licensing statement? on Borland Releases Old Turbo C, Turbo Pascal for Free · · Score: 1

    As far as I can tell, their website contains only zip files containg the original contents of the disks.

    It would be nice to have an official, blessed by Borland's (Inprise's?) lawyers, statement telling us what we can and can't do with these images.

    I assume that we can freely download the zipfiles from Borland's site, and install Turbo Pascal on machines with said zipfiles. But can we, say, put those zipfiles up on the web ourself? What about installing Turbo Pascal on a thousand machines from a single download? (The licenses of some downloadable software prohibit this) What about reverse engineering; is that allowed?

    Or, since the old "you agree by breaking this seal" license agreement isn't reproduced in the .zip files, are we perhaps bound by no agreement at all? (This might in fact be legally the worst of all possible situations, since then even downloading it is murky territory)

  16. Re:Taping phone conversations on Wal-Mart Sells Home Spy Gear · · Score: 1

    Depends on the state. Federal law says that at least one party must be aware - some states add the restriction that both people must be aware.

    This became an issue recently as Linda Tripp was taping those phone conversations with a certain white house intern while she (Tripp) was in Maryland, which is one of those states that requires both parties to be aware of the recording. Maryland prosecuters went after her for that, but in Maryland it is a valid defense (for this law) to claim ignorance of the fact that both people have to know. Of course, they had the Radio Shack salesperson who had sold Tripp the recording device testify that he had read her the standard "these are the laws in Maryland..." disclaimer that they're required to read to each customer who buys one of these, and I don't know what happened after that.

  17. Linux-based domain squatters on Domain Resale for Fun and Profit(?) · · Score: 3

    Try, sometime, doing up a whois on "The Linux Group" - I just wish I knew how to get WHOIS to not abort the search after a certain number of entries get found. I also wonder where they get the cash to hold onto all these names, since I don't see them marketing these domains to sell them.

    Anyone in the NYC area want to go pay them a house call and find out who they really are?

    Among the things they're sitting on:
    ENTERPRISELINUX.COM
    LINUXDNS.ORG
    DEBIANLINUX.COM
    LINUXADMIN.COM
    FREELINUX.COM

    and, apparently just for fun:
    ANTISTATICCARPET.ORG (and .NET)

  18. But "joe moron" CAN do encryption on Listen to Cel phones live on the Internet? · · Score: 1

    They do it all the time whenever they access an https site. Sometimes, they even know it's secure because the browser pops up an information box telling them.

    I do wonder if it isn't possible to have digital phones at least automatically encrypt when connected to a (compatible) digital phone.

    Of course, then one has to consider encryption technologies that can survive the phone-D/A-slight analog noise-A/D-phone sequence that many cell phone calls go through. Not a trivial matter.

  19. Re:Uninformed Linux attack dogs on Another Windows Macro Virus Wreaks Havoc · · Score: 1

    > I work on security in Microsoft Outlook.

    So what are you people coming up with to deal with these things?

    Personally, I would like to see a sandbox (compare with java's security model) if possible built into some future windows release - that way, untrusted programs could be run in a secure environment (where they would be prevented from messing with any files/registry keys outside a certain hierarchy, and also prevented from other things at the users' discretion) - I know that this goes against the (Microsoft) corporate policy of only doing signing-based security, but there are problems with the current signing security that I won't go into here. (Basically, signed .exe files aren't routine - even if they were, how long do you think it's going to take for a worm that resigns itself each time it sends itself on?)

  20. Ext2 article on Pov-Ray on IV Quickie Drip · · Score: 1

    I suppose it's an adequate introduction for those who didn't know that Pov-Ray existed. Unfortunately, it makes the blatantly false claim that Pov-Ray is open source.

    Just because you get to look at the source doesn't mean it's open.

  21. But it needs a new euphamism on Review:Garbage Collection · · Score: 1

    Data euthanasia?
    Memory cleaning?
    Data cleansing?
    Memory downsizing? (or "rightsizing")
    RIM? ("Reduction in (allocated) memory" - analogous to corporate-speak RIF)

  22. "Single most important trait of a programmer" on Students Sue over Difficult Class · · Score: 1

    I would contend that a good memory, although no doubt useful, is nowhere near the most important trait for a programmer to have. Nor is it necessarily the ability to pick up a new language overnight.

    The single most important trait for any employee is an ability to provide demonstrable value for an employer. In the case of a programmer, this means the ability to program - not to code, but to program. I draw the subtle distinction because I've seen too many people who think that they can program just because they can slap together code that they think will work, even if they themselves can't understand what they've written three months later.

    The ability to plan out the development of a program is not synonymous with being able to code. I suppose we could now debate whether freshly minted college graduates are more or less able to do this than your average self-taught programmer without a degree, but regardless of how those two groups compare this skill is something that is in fact acquired by (sometimes painful) experience.

    Finally, if there is any age bias in the computer industry, it is in the exact opposite direction - the industry discriminates against anyone over 40.

  23. Stupid people have too _many_ rights on Students Sue over Difficult Class · · Score: 1

    Thank you; you responded much more politely than I would have.

  24. So I'm _not_ a mod... on Slashdot Moderation Phase 1.1 · · Score: 2

    Ok, so I'm not a moderator; is there any way to find out how far I missed the cutoff by? No doubt you don't have records of the old totals, Rob, but is there any way I can know what my lifetime comment sum is? Also, in the list which shows the comments posted in the past few weeks by a given user, could we see the score each comment currently has?

    I'm actually a bit confused, as I think I've posted only one comment that was rated anything other than a 1, (if you don't say anything exciting, you also end up saying very little that's objectionable) and I'm frankly a bit confused at the rating on that comment too. Of course, I don't have time lately to read much slashdot so even had I made the cutoff I might out myself so that I'd lose moderator power and not have to deal with it.

  25. Did Troll-Tech eventually change their license? on RMS on APSL · · Score: 1

    I suppose Bruce thinks they did (see previous reply), but when I went to their website it was the same old non-free "Qt free edition" license that I got. (No redistribution of modified versions, etc.) Am I missing something?