Buffer overflows are a result of sloppy code missing length checks. Timing attacks are completely unrelated -- they are a result of code running predictably enough that the timing of a response leaks information. They are not a general security breach -- this is an isolated case where a large number of requests to a modSSL server could leak the server's private key -- but nothing else.
So, the timing is so perfect because the code produces such predictable results, it leaks information? Maybe if they put some sloppy code in the length checks, it wouldn't be so predictable...;)
Grrrr... My first impulse was to mod the parent down, but I figured I'd reply.
Wow. The exact reason you should not moderate a comment.
But look, READ my post before commenting. I said doing it was chicken shit. I just told you how to. I HAVE done it on newly installed systems, to quickly get them up to speed. But jeez, I AM paying them. They get my money every year. Is this an abuse of the system? Yes. Have they insured it is very easy to do? Yes. Do I do this all the time or even frequently? No. Does it matter? Not really. They STILL are getting my money. There is NO FAQ saying you can't do that, although its not really how the system is supposed to work.
I just told the guy about a 'bug' in the way their system works. Thats all. Qualified it as chickenshit up front and at the close. Oh yea, and I PAY for every version of RedHat. I bought 8.0 the other day. I could have downloaded it, but I don't mind paying for a nice shiney copy. I bought 6.1 and 6.2, 7.1 and 7.2. I never 'register' each copy (which entitles me to updates). I even bought their server edition. They are coming out just fine with my business.
Don't shoot me for being the messenger. I don't claim its too expensive. As a matter of fact, I said it was CHEAP. The fact is, 3 of 4 boxes I install are for test purposes, and get wiped after a week or two anyway. Part of the reason i have the account is to get these test servers 'up to speed' to keep from getting hacked while i am testing. So dicking with entitlements is actually easier, and faster for me. and for a regular joe who dicks with Linux on a couple of home computers, for him too.
I respect your opinion, but I think you have missed the entire conversation and the full meaning. I'm the guy who talks good about Redhat and gives them lots of money, this one little exploit aside.
thanks for the info, I went and checked, and you are 100% correct.
wasn't very clear in my original statement. Get a testing box, install 7.2. Now download, patch, configure, build, and install a new kernel. Now put a 7.3 CD in the drive, reboot, select "Upgrade" from the installer and see how far you get.
I have never actually upgraded linux, partially due to the old days, when they recommended you simply replace instead of upgrade, so I haven't tried this, although I believe you.
If you roll your own kernels, (assuming newer version) can't you just backup the system map, and then delete the new kernel and tree before you upgrade? so it 'doesn't know' you rolled your own? I never delete old kernels or trees anyway.
Oh, and I wouldn't try to upgrade from remote anyway, no way. I am HOPING we will move into our new building by july, with a shiny new T1. I have two dual p3/1g, and three dual ppro200's that I will setup to replace everything. lots of redunancy (the ppros actually still scream, IBMs, all scsi). We will only get about 30k to 100k users a month on this system (seasonal) and we outsource the ecommerce. Now I just need an OS to put on them.....
Best of luck to you. Don't upgrade your kernel by hand, and remember to always install software from RPM, and backup and custom configuration stuff. You don't want to have to completely re-image a machine just because you have to upgrade the OS in order to get support you've paid for, do you?
Actually, up2date defaults to NOT upgrading the kernel. You CAN force update the kernel. I have done this twice (on a test box, while sitting in front of it) and it worked great. rebooted and it actually worked. but generally it tells you it is skipping the kernel because it is marked to skip.
As to them not supporting after a year, I need to check into this. I use, and PREFER 7.2. I have installed 8.0 on a couple machines, and don't like it quite as well, perhaps because I am just used to 7.2.
I worry about upgrading my RENTED RACKSHACK boxes. Its not advisable to update a box that is located 1300 miles away via ssh.
Now if they follow thru with their EOL products 12 months after new release, then my opinion of RH would change, and I would be looking at other distros. Outside of building new kernels, which i can do by hand, i see no reason to switch from 7.2, period. there are no new 'features', even with the kernel, that I give a damn about on my web server. The only thing 8.0 offers is Squirrelmail as a stock item, but i already have it installed on 7.2
As to installing by RPM only, I pretty much do anyway, except stuff I build, which is updated less frequently. For security, my concerns are the command RPM packages anyway, proftp, apache, sendmail, openssl, ssh, etc. I never manually upgrade a package unless its for security or the bug directly affects me.
To be honest, I would end up keeping 7.2 (until i NEEDED higher) and just manually updating the major packages anyway, rather than upgrade to a version that I don't want or need. Then again, Im the guy who wants to run an updated 95 instead of XP on my personal computer.
I personally think the $60/yr/machine is a bit pricey... I'd like to have both my machines on one account (instead of having to create a new e-mail address for the second) but $120/yr seems a little steep. If it was $60/yr for 1-5 machines I'd jump in a heartbeat. I'd still only need to download the ISO once so the bandwidth there wouldn't be any more... and I really wouldn't be using any more bandwidth it'd just be on a different machine.
Maybe i didnt make myself clear. You pay 60 for one machine to use up2date, but you can register ALL your machines, and you get email updates, etc for ALL of them. you just can update with up2date. when machine #2 needs a SENDMAIL update, you dont use up2date, you go download the correct packages manually and rpm -Fvh them on the box.
They USED to have $240 a year for 'enterprise' updating, where all patches were uploaded to your one server, and all your machines could access them, but it was too good a value, so they quit it.
To be honest, when you use up2date, it does download the packages to/var/spool/up2date/??? and you can probably make a hack to let your other boxes use it. but as long as you get the email for the unsupported boxes, its not hard to manually install the fixes anyway.
Also, if you have ONE machine 'entitled' as they call it, you can log onto rhn.redhat.com and see ALL your machines. You just need to run "up2date -p" on the unentitled machines periodically to keep the profiles updated. Its really not very hard to do.
Another trick (shh! don't tell anyone!) if you are a really really cheap bastard:
1. Register both your machines using up2date on the boxes. This will create a profile for each box. Make sure you use the same login name and password for each box so they are listed on the same account (go to rhn.redhat.com FIRST if you don't already have a free account)
2. Go to rhn.redhat.com and pay for ONE entitlement. Pick one of your registered boxes to entitle.
3. Go to that entitled box, and run up2date -u
4. Go to rhn.redhat.com and CHANGE your entitlement from box 1, to box 2.
5. Go to box 2 (now entitled) and run up2date -u.
6. Once a week, goto 1 and start over.
This is a chicken shit way to actually get full entitlement on ALL your boxes for $60. This is NOT practical for an enterprise, but it DOES work for someone like you (or me;).
I have all of my servers running up2date on a schedule. I just setup a quickie cron job for up2date to run once per day and that seems to take care of things very nicely, and I'm not paying anything for the service. I do get emails telling me when updates come out and I check periodically to make sure that my systems are staying updated but I haven't had any problems so far. Only been running it on auto-pilot for about 3 months though so YMMV.
I assume you are using registered product, which comes with free up2date service for 90 days. However, if you don't pay for it after that, it wont update your system. you should go to rhn.redhat.com to check your profile. you can even schedule updates from there, but like you, i use cron. Run up2date -p once a week and up2date -u once per day.
in a nutshell, you are not getting the updates this way;) do a 'up2date -u' from a shell and you will see. It will tell you that you are not entitled. (unless you registered that package, on that box, from a purchased copy). It will run in cron just fine, and not produce an error, it just wont do anything.
it is the support, but they also bundle the type of programs that are relevent for the type of package you are buying. from my experience with their offerings, part of what you are getting (besides service) is a different build of kernel, some stuff preconfigured, etc. if it knocks 10 hours off configuring and testing (easy to do) and it costs you $50 an hour for a tech (dirt cheap tech, i might add) then it saved you $500. For most companies, the price, $800 is the cheapest part of installing a server anyway.
Time DOES equal money. If you want an ecommerce server, to generate $1mil in sales (small time) then paying 0.08ths of 1% of your sales for the operating system AND support is a bargain.
Thank you. I was just saying this to someone else. I have been on this plan for two years now. worth every damn penny and then some. it works, everytime, very fast. AND (as i stated elsewhere) they let you register your UNPAID systems and get info/emails about them, free. You don't get to use up2date with them, but you at least KNOW when they are out of date.
But one of the big advantages of Windows is support.
Adding to your comment, another factor is that Linux can GENERALLY run a bit faster on the same hardware, assuming you run a server at init 3 (who wouldnt?) This gives you a little more horsepower per server.
Also, a company MAY pay the $800 for a few boxes, but install a free version of Linux for other boxes. Maybe their dedicated DNS boxes don't need the support, or their POP boxes. As you stated, they don't have this option with windows. They can PAY for support on the ones they need, get the other free, and run the same basic OS on all of them.
Personally, I have a few servers, all running Linux, and I pay $60 from Redhat for up2date priority access (a freaking bargain). It also keeps with with ALL my servers, telling me what servers need what patches, i just have to download and install the other servers manually, which is no biggie. I gladly have the $60 annual on autorenew, because I have the choice to run one for pay, the others for free. From my experience, RedHat offers good value.
Um, please note the;) wink and references to "red neck math" and "conspiracy" freaks. I mean jesus, you have to be TRYING to argue or karma whore to not get wtf i was saying.
you think 95 is better than XP and XP prevents you from getting your "job done" then you are just a fucking tard.
I run one file server on 95a for 15 clients, and my average uptime is measured in months.
There is nothing in XP that makes my programs run faster. Everything that does not work to make my applications run faster, can only act to make them run slower. Compare application start up times (i have) Compare boot time. (I have) 95 is one of the truly great OS's (not without some bugs, granted). XP is stable, and on average, more stable, granted. But from MY EXPERIENCES, and this would cover DOZENS of computers, on small and medium network and stand alone, from P1/100 to p4/2.5s, plus the fact that I install OS on used systems (recycles) several times a week: 95 is faster. Period. Its because its simpler, which is what _I_ need. If you don't understand this, well never mind AC, you obviously DON'T understand this.
It uses Mobile Mark 2002, with the p3/1.2 getting a 134, the p4/2.4 getting a 164, and the centrino 1.6 getting 189. Now just using Redneck Math(r) that would have a theorical p3/1.6 getting about 179. (compared to 189 for Cent1.6) It shows only a 18% increase in speed of the p4/2.4 over the p3/1.2. This is one reason I have been so disappointed that my dual p3/1.0 beats my p4/2.5 hands down.
My theory is that there really is no Centrino, and its really just a P3 with a bigger cache. I mean, whose gonna look inside the chips and compare them anyway? Its not like you can SEE them circuits;)
Ok, conspiracy freaks, you take it from here, please...
The goal of the OS maker is to put in more and more features that require better and better CPUs, thus making their product better (not because of bloat, I mean come on, Windows XP is DEFINITELY much better than Windows 95, and a lot of it is in the features).
Actually, the goal of any company is to make money, whatever it takes. If people think a 'hotter' cpu is better for whatever reason, lets make that baby cook.
As to XP being better....no, I would disagree. For what I do, its slower. dialog boxes take forever, it wants to figure out everything I am doing before i do it. saving files on 95, the dialog pops up instantly on 500mhz. on my 2.5ghz, it takes several seconds to check all the drives. XP is constantly hitting my firewall trying to call home, trying to seconds guess me. Not everyone WANTS everything integrated. I would prefer to use products other than MS without it breaking some damn feature. I can give lots of examples, but I dont need to.
I don't need a 'smarter' OS. I need an OS to get the fuck out of my way and let me get my job done. Just be a thin layer between Photoshop/Sound Forge/Flash/Mozilla and the hardware. When I want to listen to music, I will start a player. XP insists on starting a dialog menu asking me what to do every time I put in a music cd, even tho I always select 'do nothing' and 'remember my preferences'.
XP is suck ass slow. It just looks pretty doing it. I would gladly pay the same $ for 95 if they would simply keep it SIMPLE and updated. And fix the 256mbram bug. Gladly. I might even pay more. 98, SE, ME, dont get me started.....
half a year ago and prior to that id give AMD the advantage over Intel for their chips (except for the deceptivity of 2100+ chips being 1.73 Ghz).... even accepting their tendancy to overheat.
Overheat? with all due respect, I dont understand the modding here. AMD chips run HOT. Very hot. But if you DONT crack the damn ceramic and run a properly rated fan, they do NOT overheat. They run within the tolorances that the specifications call for.
Just because the spec for AMD is a higher temperature than Intel does NOT imply 'overheating'. I get tired of this FUD. I don't talk AMD down even tho I prefer Intel. Doesn't change the fact that this is FUD.
Someone else already pointed out that HP/Compaq sell Athlon based notebooks. I have a Sony VAIO PCG-NVR23 that has a Mobile Athlon XP 1800+ or something like that. I know Sony has at least one other model with a Mobile Athlon chip.
Just adding to your comment, they even use Transmeta CPUs in some models, risking the wrath of Intel.
I dont see it that way. If SCO loses, then everything is pretty much the way it was. If SCO wins (even if IBM settles), linux kernel hackers are instantly a bunch of hacks who stole someone elses code.
There is one other option: IBM buys SCO for current value, around 35 million, and GPLs it. They already are developing a great reputation in the Linux community for contributions (I have run Linux on IBM dual cpu servers for years, love them). This would generate a TON of good will, would publicly release some decent code to the community, and increase their business.
IF they did that, they would be smart to KEEP the name UNIX proprietary itself, just releasing the source. Then they could use the Unix brand for marketing purposes, to make their offerings 'look' better, or they COULD even sell SCO for $9.99 just to drive down the perceived value of it (what they are accused of). Either way, Sun ain't gonna like it, HP either.
I think SCO wants ibm to buy them out and be done with it. (From Novell paying 750mil in "92 to 35mil market cap. now) If you read the full complaint, it may LOOK weak to us, but to the average juror, it would be confusing. And since its civil (win on preponderance, not 'beyond a reasonable doubt') its a gamble that could cost more than the 35 mil anyway. Even if not, it has enough to complain about to cost several million in legal fees, not counting customers worried about IBM.
1. Buy it, GPL it, bathe in the glory. 2. Be the #1 source for Linux/SCO/Unix in sales and development. They already make kick ass hardware to go with it. 3. Profit. No ??????? step necessary.
Capacity, supply, they're different, but not that much in practice. If you have a lot of excess capacity, you can fill any demand PDQ, so you still don't get an investment/employment increase.
Positively untrue. We face this every day. In order for us to manufacture equipment, I have order electronics from Mexico, timers and other electronics from France (looking for a new source now, assume why), lamps from Germany and/or the US, plastics from one plant, raw steel from another, cut steel from another, sheet aluminum from another, order powder coating from yet another plant, hydraulic cylinders from tiawan, nuts, bolts, wiring harnesses, fasteners, etc, etc.. This is just the tip of the iceberg. Most people underestimate what is all involved in manufacturing. Most parts have a lead time of 4 to 8 weeks. Parts from Europe also take about 2 weeks on the water, from the Pacific rim 3 weeks.
If ONE part is missing, we can't build. Even if its just the cardboard boxes.
We have the capacity to double production, but we don't have the inventory of all items. If the companies we buy parts from cut back, and then we need to double our orders, then our lead times may increase a couple of months (this does happen at least once every two years). We also have to train people for the assembly line. And we are just a small manufacturer.
In the real world, for us to jump up production, we have to anticipate our needs 3 to 6 months from now. This is while hoping NONE of our vendors have trouble keeping up with demand (if WE need more parts, there is a good chance our competition does, adding to the posibility of shortage)
In a nutshell, we have the CAPACITY (building space, most of the employees, machinery, knowlege, dock space, etc) to double our "supply", but we dont have the parts to do it without up to several months lead time. If demand jumped up (dealers were begging for units) that we didn't have, we would raise the price (reduce/elliminate incentives) to choke back demand (inflation, passed on to customer). This gives us more $ to invest in parts to build up. This is common practice. Supply/Demand.
I don't mean to rag, I just wanted to let you know that manufacturing is WAY different than most people think. The best comparison is to steering a large boat. You can't start or stop on a dime. You have to anticipate and prepare the whole supply chain, or your ass runs into the dock. Except with manufacturing, you never get it right. You just get it close enough. And because many good ARE time sensitive, you DO hire more to fill orders. Ours is an example. Only purchased 6 months of the year.
Thus an "employee credit" for a larger tax writeoff for the more employees a company hires.
I can't argue the merits of this, I would have to look at it much closer, but the idea is worth looking at, very interesting. One thing: I personally dont see it as a hidden tax nearly as much as the govt. saying "we will put 1 billion in wage credits, because we think they will generate that 1 billion in taxes, and taxes from what they buy over the next few years." (7x theory) This is an investment.
of course! don't forget that "democracy is a gift of God to americans" according to G.W.Bush;)
if you're going to be rude, at least be correct. He never said that. what he did say is that freedom is not granted by governments, but the god given right to all persons. Even the Declaration of Independance says all persons, not just Americans. This is why NON citizens have the same rights as citizens within our court system.
While I am not a christian, I do agree with the concept that freedom is NOT given, it is inhearant to every individual, and govt. can only act in ways to limit it, never to grant it.
During the Reagan years there was a shortage in supply, so cutting taxes was a reasonable idea. Now however, there is a massive glut of supply, so the idea of cutting taxes for investors is crazy, because this money won't be reinvested. What's needed is something like a double tax credit for the first $20K for each employee hired. This would create a lot of low paying jobs that would help people get by a lot better than no jobs at all.
Another option that was actually done about 15 years ago is a direct tax CREDIT for up to $x in investment. Friends purchased delivery vehicles during this time. it was like US buying it for him. I think it was a 10k credit. THAT will cause investment as well.
As to the "to a degree" yea, you have diminishing returns on any plan. The idea is not punish success. You refer to a glut of supply, from my perspective, this is not entirely true. there may be a glut of CAPACITY, but most companies are running record low inventories. The danger of this is if demand jumps, then inflation can jump up too (supply/demand short term based). We have seen sharper increases in productivity than in growth of jobs, thus unemployement.
This means factories have less raw materials on hand, which if demand JUMPS rather than gradually rises, it creates a bottleneck throughout the chain. Right now, a company i do work for is enjoying the fact that we can snag up some extra parts inventory for our production at reduced rates and stockpile a bit (prices+storage+interest normal price+availability). We are the exception, however. Lots of manufacturers of basic parts are getting aggressive to keep cash flowing. Once again, too much capacity vs. demand. Its not that they are necessarily STOCKING the parts, they just gotta keep producing SOMETHING or start laying off.
Part of our problem is we are learning how to produce more and more stuff, with less and less people. In that respect you get into a bind when you can produce more stuff with fewer people thus less jobs, and they dont have the money to buy the new cheaper stuff because they dont have jobs. This is NOT a permanant problem, just part of the cyclical nature of production and productivity. Still hurts in the shortrun.
Still, when all is said and done, capitalism has lots of shortcomings, and the only thing worse is everything else.
em>Well, assuming you'd see it at the exact time it was moderated, I'd agree with you. But you don't. It could be at -1 by the time you look at it. See what I'm saying? A post is funny, or it's not, at any particular time, but a mod of 'underrated' only applies to a specific score of a post, which you don't see when you click on "see in context."
No, actually you see all moderation done to it, the parent, the author, the full context. If you see it Funny +3 and one Underrated, then fine. BUT I HAVE NEVER SEEN UNDERRATED OR OVERRATED ON M2. Thats the point. In the years and years I have been on slashdot, never seen it. Unless you can finally show me where I am wrong, I have to assume YOU are, and just being acedemic.
REPEAT: Since I have never seen under or overrated on M2, everything else you are saying is irrelevent. Period. If you can point to where it says that they ARE, or 3 reasonable references from individuals, then I will stand corrected. Until then, I say UNDER and OVER are not subject to M2, which was THE POINT I had made.
that is why you click to see it in context. and while under/over SHOULD be used to mod down 'interesting' when its not, or is incorrect, it can easily ABUSED is the problem. there is not CHECKS AND BALANCES. I can mod everything that sounds "liberal" for instance, as OVERRATED to push a conservative agenda, and go unchecked. I wouldn't, but some will, and do. It can be used to silence others without being subjected to M2. Yes, most wont', the ones who DO have an agenda, WILL. thats the point. I see people mod using OVER on +1 posts. Even on +2 posts, it shouldn't be used, imho. if its not offtopic, redundant or flamebait, then maybe your being too subjective in calling a karma bonus OVERRATED.
In order to M2 an 'overrated' post, you'd have to know what the score was at the time of the moderation,
Yes, its called "see it in context". its already a feature. I use it about once every other time I M2 anyway. Sometimes it hard to see if something is "offtopic" without looking at it in context. but then again, silly me, I may just be trying to M2 correctly and objectively. Offtopic, for instance, i end up saying nothing or 'unfair' about half the time, as long as the message is remotely concerning the topic, or its relative to the conversation that has flowed from the original topic.
Any system that allows abuse, will be abused. Just like any hole in an OS will be exploited, by some "just because i can". IMHO, this is a bug of slashdot.
Personally, I only mod up, almost never mod down. Its a choice. I view 0+ and find stuff that is worthy, instead of taking my bad day out on someone's opinion simply because i disagree.
Why would a corporation hire more people when it can now afford to give even better benefits to the CEO and the other corporate elite?
With all due respect, I don't think you understand corporate philosophy very well. Any decent CEO understands investment. Its not that he needs $ now, so he will invest in anything that will return MORE than the cost of the investment. If you can borrow money for 10% to add more inventory you can easily sell for 20% net profit, then its a good investment.
People are an investment, too. They are not as likely to invest it in people who already make $1 million, since ITS NOT DEDUCTABLE. (Yes, you can't deduct pay to anyone over one million. Ask your CPA) You CAN make it so attractive to invest that many will.
And yes, you can rag capitalism, but the fact is: when you cut taxes (to a degree) you increase the amount of taxes collected. Once again, its NOT a zero sum game. When the US cut capital gains from 28% to 20%, they generated about $7000 in extra taxes from ME for example. I would not have made the investments otherwise, the risk wasn't worth the reward because of the taxes. Then it was, and I did, and I hired, and I made, and I paid. So from ME (a very average small business owner) that created a job for someone that now pays several thousand a year in taxes, plus thousands per year from me, all initited from a tax cut.
If you don't understand that, then you just aren't trying and do not care. Being anti-capitalist is easy when you don't have anything to offer the public that its willing to pay for.
Slashdot Mirror
Buffer overflows are a result of sloppy code missing length checks.
;)
Timing attacks are completely unrelated -- they are a result of code running predictably enough that the timing of a response leaks information. They are not a general security breach -- this is an isolated case where a large number of requests to a modSSL server could leak the server's private key -- but nothing else.
So, the timing is so perfect because the code produces such predictable results, it leaks information? Maybe if they put some sloppy code in the length checks, it wouldn't be so predictable...
Grrrr... My first impulse was to mod the parent down, but I figured I'd reply.
Wow. The exact reason you should not moderate a comment.
But look, READ my post before commenting. I said doing it was chicken shit. I just told you how to. I HAVE done it on newly installed systems, to quickly get them up to speed. But jeez, I AM paying them. They get my money every year. Is this an abuse of the system? Yes. Have they insured it is very easy to do? Yes. Do I do this all the time or even frequently? No. Does it matter? Not really. They STILL are getting my money. There is NO FAQ saying you can't do that, although its not really how the system is supposed to work.
I just told the guy about a 'bug' in the way their system works. Thats all. Qualified it as chickenshit up front and at the close. Oh yea, and I PAY for every version of RedHat. I bought 8.0 the other day. I could have downloaded it, but I don't mind paying for a nice shiney copy. I bought 6.1 and 6.2, 7.1 and 7.2. I never 'register' each copy (which entitles me to updates). I even bought their server edition. They are coming out just fine with my business.
Don't shoot me for being the messenger. I don't claim its too expensive. As a matter of fact, I said it was CHEAP. The fact is, 3 of 4 boxes I install are for test purposes, and get wiped after a week or two anyway. Part of the reason i have the account is to get these test servers 'up to speed' to keep from getting hacked while i am testing. So dicking with entitlements is actually easier, and faster for me. and for a regular joe who dicks with Linux on a couple of home computers, for him too.
I respect your opinion, but I think you have missed the entire conversation and the full meaning. I'm the guy who talks good about Redhat and gives them lots of money, this one little exploit aside.
thanks for the info, I went and checked, and you are 100% correct.
wasn't very clear in my original statement. Get a testing box, install 7.2. Now download, patch, configure, build, and install a new kernel. Now put a 7.3 CD in the drive, reboot, select "Upgrade" from the installer and see how far you get.
I have never actually upgraded linux, partially due to the old days, when they recommended you simply replace instead of upgrade, so I haven't tried this, although I believe you.
If you roll your own kernels, (assuming newer version) can't you just backup the system map, and then delete the new kernel and tree before you upgrade? so it 'doesn't know' you rolled your own? I never delete old kernels or trees anyway.
Oh, and I wouldn't try to upgrade from remote anyway, no way. I am HOPING we will move into our new building by july, with a shiny new T1. I have two dual p3/1g, and three dual ppro200's that I will setup to replace everything. lots of redunancy (the ppros actually still scream, IBMs, all scsi). We will only get about 30k to 100k users a month on this system (seasonal) and we outsource the ecommerce. Now I just need an OS to put on them.....
Best of luck to you. Don't upgrade your kernel by hand, and remember to always install software from RPM, and backup and custom configuration stuff. You don't want to have to completely re-image a machine just because you have to upgrade the OS in order to get support you've paid for, do you?
Actually, up2date defaults to NOT upgrading the kernel. You CAN force update the kernel. I have done this twice (on a test box, while sitting in front of it) and it worked great. rebooted and it actually worked. but generally it tells you it is skipping the kernel because it is marked to skip.
As to them not supporting after a year, I need to check into this. I use, and PREFER 7.2. I have installed 8.0 on a couple machines, and don't like it quite as well, perhaps because I am just used to 7.2.
I worry about upgrading my RENTED RACKSHACK boxes. Its not advisable to update a box that is located 1300 miles away via ssh.
Now if they follow thru with their EOL products 12 months after new release, then my opinion of RH would change, and I would be looking at other distros. Outside of building new kernels, which i can do by hand, i see no reason to switch from 7.2, period. there are no new 'features', even with the kernel, that I give a damn about on my web server. The only thing 8.0 offers is Squirrelmail as a stock item, but i already have it installed on 7.2
As to installing by RPM only, I pretty much do anyway, except stuff I build, which is updated less frequently. For security, my concerns are the command RPM packages anyway, proftp, apache, sendmail, openssl, ssh, etc. I never manually upgrade a package unless its for security or the bug directly affects me.
To be honest, I would end up keeping 7.2 (until i NEEDED higher) and just manually updating the major packages anyway, rather than upgrade to a version that I don't want or need. Then again, Im the guy who wants to run an updated 95 instead of XP on my personal computer.
I personally think the $60/yr/machine is a bit pricey... I'd like to have both my machines on one account (instead of having to create a new e-mail address for the second) but $120/yr seems a little steep. If it was $60/yr for 1-5 machines I'd jump in a heartbeat. I'd still only need to download the ISO once so the bandwidth there wouldn't be any more... and I really wouldn't be using any more bandwidth it'd just be on a different machine.
/var/spool/up2date/??? and you can probably make a hack to let your other boxes use it. but as long as you get the email for the unsupported boxes, its not hard to manually install the fixes anyway.
Maybe i didnt make myself clear. You pay 60 for one machine to use up2date, but you can register ALL your machines, and you get email updates, etc for ALL of them. you just can update with up2date. when machine #2 needs a SENDMAIL update, you dont use up2date, you go download the correct packages manually and rpm -Fvh them on the box.
They USED to have $240 a year for 'enterprise' updating, where all patches were uploaded to your one server, and all your machines could access them, but it was too good a value, so they quit it.
To be honest, when you use up2date, it does download the packages to
Also, if you have ONE machine 'entitled' as they call it, you can log onto rhn.redhat.com and see ALL your machines. You just need to run "up2date -p" on the unentitled machines periodically to keep the profiles updated. Its really not very hard to do.
Another trick (shh! don't tell anyone!) if you are a really really cheap bastard:
1. Register both your machines using up2date on the boxes. This will create a profile for each box. Make sure you use the same login name and password for each box so they are listed on the same account (go to rhn.redhat.com FIRST if you don't already have a free account)
2. Go to rhn.redhat.com and pay for ONE entitlement. Pick one of your registered boxes
to entitle.
3. Go to that entitled box, and run up2date -u
4. Go to rhn.redhat.com and CHANGE your entitlement from box 1, to box 2.
5. Go to box 2 (now entitled) and run up2date -u.
6. Once a week, goto 1 and start over.
This is a chicken shit way to actually get full entitlement on ALL your boxes for $60. This is NOT practical for an enterprise, but it DOES work for someone like you (or me;).
I have all of my servers running up2date on a schedule. I just setup a quickie cron job for up2date to run once per day and that seems to take care of things very nicely, and I'm not paying anything for the service. I do get emails telling me when updates come out and I check periodically to make sure that my systems are staying updated but I haven't had any problems so far. Only been running it on auto-pilot for about 3 months though so YMMV.
;) do a 'up2date -u' from a shell and you will see. It will tell you that you are not entitled. (unless you registered that package, on that box, from a purchased copy). It will run in cron just fine, and not produce an error, it just wont do anything.
I assume you are using registered product, which comes with free up2date service for 90 days. However, if you don't pay for it after that, it wont update your system. you should go to rhn.redhat.com to check your profile. you can even schedule updates from there, but like you, i use cron. Run up2date -p once a week and up2date -u once per day.
in a nutshell, you are not getting the updates this way
it is the support, but they also bundle the type of programs that are relevent for the type of package you are buying. from my experience with their offerings, part of what you are getting (besides service) is a different build of kernel, some stuff preconfigured, etc. if it knocks 10 hours off configuring and testing (easy to do) and it costs you $50 an hour for a tech (dirt cheap tech, i might add) then it saved you $500. For most companies, the price, $800 is the cheapest part of installing a server anyway.
Time DOES equal money. If you want an ecommerce server, to generate $1mil in sales (small time) then paying 0.08ths of 1% of your sales for the operating system AND support is a bargain.
work for a company (that will go nameless) that offers 24/7, 1 hour callback tech support on the product.
No, its not redhat.
We charge over $20,000 for A SINGLE USER.
Holy crap, you work for SCO then?
How about $60?
Thank you. I was just saying this to someone else. I have been on this plan for two years now. worth every damn penny and then some. it works, everytime, very fast. AND (as i stated elsewhere) they let you register your UNPAID systems and get info/emails about them, free. You don't get to use up2date with them, but you at least KNOW when they are out of date.
IMHO, Redhat has a great thing with this program.
But one of the big advantages of Windows is support.
Adding to your comment, another factor is that Linux can GENERALLY run a bit faster on the same hardware, assuming you run a server at init 3 (who wouldnt?) This gives you a little more horsepower per server.
Also, a company MAY pay the $800 for a few boxes, but install a free version of Linux for other boxes. Maybe their dedicated DNS boxes don't need the support, or their POP boxes. As you stated, they don't have this option with windows. They can PAY for support on the ones they need, get the other free, and run the same basic OS on all of them.
Personally, I have a few servers, all running Linux, and I pay $60 from Redhat for up2date priority access (a freaking bargain). It also keeps with with ALL my servers, telling me what servers need what patches, i just have to download and install the other servers manually, which is no biggie. I gladly have the $60 annual on autorenew, because I have the choice to run one for pay, the others for free. From my experience, RedHat offers good value.
Sure you can, it's done all the time.
;) wink and references to "red neck math" and "conspiracy" freaks. I mean jesus, you have to be TRYING to argue or karma whore to not get wtf i was saying.
Um, please note the
you think 95 is better than XP and XP prevents you from getting your "job done" then you are just a fucking tard.
I run one file server on 95a for 15 clients, and my average uptime is measured in months.
There is nothing in XP that makes my programs run faster. Everything that does not work to make my applications run faster, can only act to make them run slower. Compare application start up times (i have) Compare boot time. (I have) 95 is one of the truly great OS's (not without some bugs, granted). XP is stable, and on average, more stable, granted. But from MY EXPERIENCES, and this would cover DOZENS of computers, on small and medium network and stand alone, from P1/100 to p4/2.5s, plus the fact that I install OS on used systems (recycles) several times a week: 95 is faster. Period. Its because its simpler, which is what _I_ need. If you don't understand this, well never mind AC, you obviously DON'T understand this.
What about the Centrino processors released last night? 1.6GHz performing equal to that of a 2.6GHz P4?
;)
Actually, the Centrino 1.6 was faster than the p4 1.6. This links to the comparisons, choose Compare Performance.
It uses Mobile Mark 2002, with the p3/1.2 getting a 134, the p4/2.4 getting a 164, and the centrino 1.6 getting 189. Now just using Redneck Math(r) that would have a theorical p3/1.6 getting about 179. (compared to 189 for Cent1.6) It shows only a 18% increase in speed of the p4/2.4 over the p3/1.2. This is one reason I have been so disappointed that my dual p3/1.0 beats my p4/2.5 hands down.
My theory is that there really is no Centrino, and its really just a P3 with a bigger cache. I mean, whose gonna look inside the chips and compare them anyway? Its not like you can SEE them circuits
Ok, conspiracy freaks, you take it from here, please...
The goal of the OS maker is to put in more and more features that require better and better CPUs, thus making their product better (not because of bloat, I mean come on, Windows XP is DEFINITELY much better than Windows 95, and a lot of it is in the features).
Actually, the goal of any company is to make money, whatever it takes. If people think a 'hotter' cpu is better for whatever reason, lets make that baby cook.
As to XP being better....no, I would disagree. For what I do, its slower. dialog boxes take forever, it wants to figure out everything I am doing before i do it. saving files on 95, the dialog pops up instantly on 500mhz. on my 2.5ghz, it takes several seconds to check all the drives. XP is constantly hitting my firewall trying to call home, trying to seconds guess me. Not everyone WANTS everything integrated. I would prefer to use products other than MS without it breaking some damn feature. I can give lots of examples, but I dont need to.
I don't need a 'smarter' OS. I need an OS to get the fuck out of my way and let me get my job done. Just be a thin layer between Photoshop/Sound Forge/Flash/Mozilla and the hardware. When I want to listen to music, I will start a player. XP insists on starting a dialog menu asking me what to do every time I put in a music cd, even tho I always select 'do nothing' and 'remember my preferences'.
XP is suck ass slow. It just looks pretty doing it. I would gladly pay the same $ for 95 if they would simply keep it SIMPLE and updated. And fix the 256mbram bug. Gladly. I might even pay more. 98, SE, ME, dont get me started.....
half a year ago and prior to that id give AMD the advantage over Intel for their chips (except for the deceptivity of 2100+ chips being 1.73 Ghz).... even accepting their tendancy to overheat.
Overheat? with all due respect, I dont understand the modding here. AMD chips run HOT. Very hot. But if you DONT crack the damn ceramic and run a properly rated fan, they do NOT overheat. They run within the tolorances that the specifications call for.
Just because the spec for AMD is a higher temperature than Intel does NOT imply 'overheating'. I get tired of this FUD. I don't talk AMD down even tho I prefer Intel. Doesn't change the fact that this is FUD.
Hotter != Overheating
Ok, I'm done.
Someone else already pointed out that HP/Compaq sell Athlon based notebooks. I have a Sony VAIO PCG-NVR23 that has a Mobile Athlon XP 1800+ or something like that. I know Sony has at least one other model with a Mobile Athlon chip.
Just adding to your comment, they even use Transmeta CPUs in some models, risking the wrath of Intel.
I dont see it that way. If SCO loses, then everything is pretty much the way it was. If SCO wins (even if IBM settles), linux kernel hackers are instantly a bunch of hacks who stole someone elses code.
There is one other option: IBM buys SCO for current value, around 35 million, and GPLs it. They already are developing a great reputation in the Linux community for contributions (I have run Linux on IBM dual cpu servers for years, love them). This would generate a TON of good will, would publicly release some decent code to the community, and increase their business.
IF they did that, they would be smart to KEEP the name UNIX proprietary itself, just releasing the source. Then they could use the Unix brand for marketing purposes, to make their offerings 'look' better, or they COULD even sell SCO for $9.99 just to drive down the perceived value of it (what they are accused of). Either way, Sun ain't gonna like it, HP either.
I think SCO wants ibm to buy them out and be done with it. (From Novell paying 750mil in "92 to 35mil market cap. now) If you read the full complaint, it may LOOK weak to us, but to the average juror, it would be confusing. And since its civil (win on preponderance, not 'beyond a reasonable doubt') its a gamble that could cost more than the 35 mil anyway. Even if not, it has enough to complain about to cost several million in legal fees, not counting customers worried about IBM.
1. Buy it, GPL it, bathe in the glory.
2. Be the #1 source for Linux/SCO/Unix in sales and development. They already make kick ass hardware to go with it.
3. Profit. No ??????? step necessary.
how can you forget Tux, the mascot?!??
Capacity, supply, they're different, but not that much in practice. If you have a lot of excess capacity, you can fill any demand PDQ, so you still don't get an investment/employment increase.
Positively untrue. We face this every day. In order for us to manufacture equipment, I have order electronics from Mexico, timers and other electronics from France (looking for a new source now, assume why), lamps from Germany and/or the US, plastics from one plant, raw steel from another, cut steel from another, sheet aluminum from another, order powder coating from yet another plant, hydraulic cylinders from tiawan, nuts, bolts, wiring harnesses, fasteners, etc, etc.. This is just the tip of the iceberg. Most people underestimate what is all involved in manufacturing. Most parts have a lead time of 4 to 8 weeks. Parts from Europe also take about 2 weeks on the water, from the Pacific rim 3 weeks.
If ONE part is missing, we can't build. Even if its just the cardboard boxes.
We have the capacity to double production, but we don't have the inventory of all items. If the companies we buy parts from cut back, and then we need to double our orders, then our lead times may increase a couple of months (this does happen at least once every two years). We also have to train people for the assembly line. And we are just a small manufacturer.
In the real world, for us to jump up production, we have to anticipate our needs 3 to 6 months from now. This is while hoping NONE of our vendors have trouble keeping up with demand (if WE need more parts, there is a good chance our competition does, adding to the posibility of shortage)
In a nutshell, we have the CAPACITY (building space, most of the employees, machinery, knowlege, dock space, etc) to double our "supply", but we dont have the parts to do it without up to several months lead time. If demand jumped up (dealers were begging for units) that we didn't have, we would raise the price (reduce/elliminate incentives) to choke back demand (inflation, passed on to customer). This gives us more $ to invest in parts to build up. This is common practice. Supply/Demand.
I don't mean to rag, I just wanted to let you know that manufacturing is WAY different than most people think. The best comparison is to steering a large boat. You can't start or stop on a dime. You have to anticipate and prepare the whole supply chain, or your ass runs into the dock. Except with manufacturing, you never get it right. You just get it close enough. And because many good ARE time sensitive, you DO hire more to fill orders. Ours is an example. Only purchased 6 months of the year.
Thus an "employee credit" for a larger tax writeoff for the more employees a company hires.
I can't argue the merits of this, I would have to look at it much closer, but the idea is worth looking at, very interesting. One thing: I personally dont see it as a hidden tax nearly as much as the govt. saying "we will put 1 billion in wage credits, because we think they will generate that 1 billion in taxes, and taxes from what they buy over the next few years." (7x theory) This is an investment.
of course! ;)
don't forget that "democracy is a gift of God to americans" according to G.W.Bush
if you're going to be rude, at least be correct. He never said that. what he did say is that freedom is not granted by governments, but the god given right to all persons. Even the Declaration of Independance says all persons, not just Americans. This is why NON citizens have the same rights as citizens within our court system.
While I am not a christian, I do agree with the concept that freedom is NOT given, it is inhearant to every individual, and govt. can only act in ways to limit it, never to grant it.
During the Reagan years there was a shortage in supply, so cutting taxes was a reasonable idea. Now however, there is a massive glut of supply, so the idea of cutting taxes for investors is crazy, because this money won't be reinvested. What's needed is something like a double tax credit for the first $20K for each employee hired. This would create a lot of low paying jobs that would help people get by a lot better than no jobs at all.
Another option that was actually done about 15 years ago is a direct tax CREDIT for up to $x in investment. Friends purchased delivery vehicles during this time. it was like US buying it for him. I think it was a 10k credit. THAT will cause investment as well.
As to the "to a degree" yea, you have diminishing returns on any plan. The idea is not punish success. You refer to a glut of supply, from my perspective, this is not entirely true. there may be a glut of CAPACITY, but most companies are running record low inventories. The danger of this is if demand jumps, then inflation can jump up too (supply/demand short term based). We have seen sharper increases in productivity than in growth of jobs, thus unemployement.
This means factories have less raw materials on hand, which if demand JUMPS rather than gradually rises, it creates a bottleneck throughout the chain. Right now, a company i do work for is enjoying the fact that we can snag up some extra parts inventory for our production at reduced rates and stockpile a bit (prices+storage+interest normal price+availability). We are the exception, however. Lots of manufacturers of basic parts are getting aggressive to keep cash flowing. Once again, too much capacity vs. demand. Its not that they are necessarily STOCKING the parts, they just gotta keep producing SOMETHING or start laying off.
Part of our problem is we are learning how to produce more and more stuff, with less and less people. In that respect you get into a bind when you can produce more stuff with fewer people thus less jobs, and they dont have the money to buy the new cheaper stuff because they dont have jobs. This is NOT a permanant problem, just part of the cyclical nature of production and productivity. Still hurts in the shortrun.
Still, when all is said and done, capitalism has lots of shortcomings, and the only thing worse is everything else.
em>Well, assuming you'd see it at the exact time it was moderated, I'd agree with you. But you don't. It could be at -1 by the time you look at it. See what I'm saying? A post is funny, or it's not, at any particular time, but a mod of 'underrated' only applies to a specific score of a post, which you don't see when you click on "see in context."
No, actually you see all moderation done to it, the parent, the author, the full context. If you see it Funny +3 and one Underrated, then fine. BUT I HAVE NEVER SEEN UNDERRATED OR OVERRATED ON M2. Thats the point. In the years and years I have been on slashdot, never seen it. Unless you can finally show me where I am wrong, I have to assume YOU are, and just being acedemic.
REPEAT: Since I have never seen under or overrated on M2, everything else you are saying is irrelevent. Period. If you can point to where it says that they ARE, or 3 reasonable references from individuals, then I will stand corrected. Until then, I say UNDER and OVER are not subject to M2, which was THE POINT I had made.
This isn't going to do much to remove the stereotypical "Comic Book Guy" from the Simpsons image. Fat, loney, and sweats in 60 degree weather.
Worse Happy Meal Ever.
that is why you click to see it in context. and while under/over SHOULD be used to mod down 'interesting' when its not, or is incorrect, it can easily ABUSED is the problem. there is not CHECKS AND BALANCES. I can mod everything that sounds "liberal" for instance, as OVERRATED to push a conservative agenda, and go unchecked. I wouldn't, but some will, and do. It can be used to silence others without being subjected to M2. Yes, most wont', the ones who DO have an agenda, WILL. thats the point. I see people mod using OVER on +1 posts. Even on +2 posts, it shouldn't be used, imho. if its not offtopic, redundant or flamebait, then maybe your being too subjective in calling a karma bonus OVERRATED.
In order to M2 an 'overrated' post, you'd have to know what the score was at the time of the moderation,
Yes, its called "see it in context". its already a feature. I use it about once every other time I M2 anyway. Sometimes it hard to see if something is "offtopic" without looking at it in context. but then again, silly me, I may just be trying to M2 correctly and objectively. Offtopic, for instance, i end up saying nothing or 'unfair' about half the time, as long as the message is remotely concerning the topic, or its relative to the conversation that has flowed from the original topic.
Any system that allows abuse, will be abused. Just like any hole in an OS will be exploited, by some "just because i can". IMHO, this is a bug of slashdot.
Personally, I only mod up, almost never mod down. Its a choice. I view 0+ and find stuff that is worthy, instead of taking my bad day out on someone's opinion simply because i disagree.
Why would a corporation hire more people when it can now afford to give even better benefits to the CEO and the other corporate elite?
With all due respect, I don't think you understand corporate philosophy very well. Any decent CEO understands investment. Its not that he needs $ now, so he will invest in anything that will return MORE than the cost of the investment. If you can borrow money for 10% to add more inventory you can easily sell for 20% net profit, then its a good investment.
People are an investment, too. They are not as likely to invest it in people who already make $1 million, since ITS NOT DEDUCTABLE. (Yes, you can't deduct pay to anyone over one million. Ask your CPA) You CAN make it so attractive to invest that many will.
And yes, you can rag capitalism, but the fact is: when you cut taxes (to a degree) you increase the amount of taxes collected. Once again, its NOT a zero sum game. When the US cut capital gains from 28% to 20%, they generated about $7000 in extra taxes from ME for example. I would not have made the investments otherwise, the risk wasn't worth the reward because of the taxes. Then it was, and I did, and I hired, and I made, and I paid. So from ME (a very average small business owner) that created a job for someone that now pays several thousand a year in taxes, plus thousands per year from me, all initited from a tax cut.
If you don't understand that, then you just aren't trying and do not care. Being anti-capitalist is easy when you don't have anything to offer the public that its willing to pay for.