Actually, it's not as insidious as you might think. Notice that the Dell with XP also has a bunch of other software, like AOL, Wordperfect, etc..
AOL actually pays Dell a fee to include their software, as do the other companies that Dell provides "trial" software for (JASC and others, for instance). This allows them to sell the PC at a lower cost.
Also note that the regular price for the PC is $349, and the $299 price is a special.
It doesn't tell me anything, nor should it tell YOU anything.
My point was that you can't take a statement (supposedly) made about why they won't implement CSS2 and claim that it proves they won't implement CSS2.1 either.
By the way, you might be even more interested in this:
It didn't say it was going to support CSS 2.1, but it hasn't said it wouldn't either. CSS2 is a flawed standard, and MS is right for saying they won't support it. 2.1 is a different story, and MS has not commented on whether they will or won't support it.
Actually, anyone still using Windows 2000 are morons. MS will not be issuing any more patches for it, which means when new flaws are discovered in XP, chances are they will apply to 2k as well, making the OS even that much more insecure.
While it might apply less to users behind firewalls, it's still a stupid move. Upgrade to XP, or Switch to Linux or something, just don't continue to use an unsupported OS.
Actually, I've never read a non-compete that didn't offer to pay the salary of the individual if they are unable to find work in their field because of the non-compete.
That's not to say they don't exist, but I think anyone would be able to win a judgement against a former employer if that were the case, even if it wasn't spelled out specifically in the contract.
But Borland didn't have non-compete clauses in their contracts. They're not legal in california.
That being said, however, Borland's products were never that great. They were good values (mostly), which is what drove sales. They also rode the wave of mid-80's University "Pascal" requirements.
Borland had many problems that had nothing to do with Microsoft. They abandoned products like crazy. Their Pascal and C++ class libraries broke everything every time you upgraded (That's why VCL components have to be compiled for each version), and their products were never that great performers. The optimizer in Borland and Turbo C++ was pitifull, for example.
They had a great IDE in the mid-80's, but they botched it later. More importantly, Microsoft got a LOT better, and their "mediocre but good value" business model wouldn't stand up.
I don't know. This is slightly different because the borland people didn't have non-compete clauses in their contracts (because they're not legal in California where Borland is based). Microsoft did have such a non-compete clause with this VP.
Microsoft is within their rights to complain. If Borland wanted to protect it's IP they should have run their offices in a different state.
Borland chose to do business in a state that wouldn't protect them. You know damn well Borland would have had non-compete's if the law had allowed them to.
This, mind you is after the bug details were embargoed until July 20th. They keep moving the date back and will likely do it again when August 1st rolls around.
I'm not talking about updates that happen without your knowledge. I'm talking about notification of updated packages that YOU choose to install.
The issue here is that you lose that automatic notification, and unless you watch the security lists closely, and keep a ready inventory of all the installed programs (including those installed by dependancy) you're a security nightmare waiting to happen.
I don't know about you, but i've got better things to do with my time than spend it constantly checking for seucrity issues. I'd rather be notified when one that applies to me occurs.
While the morris worm was a big wakeup to the unix community, it was largely a one shot wonder until many years later.
Internet security didn't really become an issue until e-commerce started becoming common. Until there were more than just universities on the internet.
Nobody took internet security seriously, not even after the morris worm (which, while a wake up call, really was more of a nuisance than anything). Most people, and more importantly, most internet developers, didn't even know how the morris worm worked if they had even heard of it at all.
Buffer overflow exploits dropped of the face of the map after the morris worm. They fixed the flaws and everyone promptly forgot about it.
It's been common knowledge that gets() was bad because it could crash your program. What it wasn't easy to do was exploit buffer overflows. Buffer overflow exploit knowledge has only really happened in the last 10 years or so, and kits have been developed to make this very easy to do.
And then you turned around and said "Linux offers me some very fine grained control over what those users can do including the root account. I am unsure if windows has anything like it, but my experience says no."
I was commenting on your "fine grained" issue. I assume you're talking about Capabilities, something that NT based Windows has always had.
The user the IIS server runs under is completely configurable, as are the applications that run under it (Windows has the concept of impersionation, which is like Sudo, but applications can change their security context themslves rather than spawning a new process as a specific user). This is simply something you can't do with Apache or any other Unix web server that I'm aware of.
There's a HUGE problem with tarballs. You lose the "automatic update" features of your distro. You aren't automatically informed about security flaws and other critical updates.
That's fine if you're only managing one or two programs. But when you have dozens of tarballed apps, you're not going to keep up.
I'm not sure what OS you use, but the ones I do have the same problems. When I uninstall programs, there are still/etc config files left behind, there are still libraries with no dependancies left behind, there are stray . files in home directories, etc...
Hint: try reading some documentation, taking your time. Also, typing the following three magic lines seems to work for me:./configure make make install
Oh, give me a break. You can't seriously expect anyone to believe this bullshit, do you?
Even if the above works (and often, depending on the distro, it won't because of dependancy, file locaiton, or other issues) this isn't the end. You often have to edit config files, set up profiles, or any number of other activities.
Your argument about Debian is even worse. In order to use anything recent, you have to depend on experimental packages, which are a crapshoot at best. Debian only "just works" if you're willing to put up with 2 year old versions.
You know, i've noticed this tendancy of Unix supporters to assume that what is known now has always been that way.
For example, you talk to the typical Unix supporter and they'll tell you that Unix was designed from the beginning with TCP/IP, Security, memory protection and multitasking, and a bunch of other stuff, when in reality all those things were added on afterwards.
The same is true with this point. 10 years ago, while Buffer overflows were known, they weren't common knowledge, and the average developer certainly didn't have the knowledge or tools to combat them.
By the way, do you realize how much of an ass you sound like when you say "Maybe they should have thought of that BEFORE..."?
Logically speaking, if they didn't know about something, how could they have thought about it? Not that I'm saying that a company like MS wouldn't have had people that did know about such things, just that your argument is rather stupid.
And for the record, I think Microsoft deliberately ignored security, even though they had people that understood the implications of it. I think it was a deliberate choice for them.
Are you nuts? Of course you can run IIS on any user you want. It goes a step further in IIS though. If you want to talk fine grained. You can specify different users for different web applications. or different web sites. You can specify different users for the "anonymyous" user or for interactive logins.
As for your argument about running IIS in a seperate VM... that's just plain stupid. Whenever the argument falls back to "But yeah, you have to buy something extra" you've lost the "The OS can't do this" argument.
You must not do much with your server. I have a SuSE 9.1 server that I run without X with pretty much the same services and am constly hitting swap, and I have 196MB of Ram.
I also have a 256MB server running IIS and SQL Server which performs quite well. So go figure.
Slashdot Mirror
Actually, it's not as insidious as you might think. Notice that the Dell with XP also has a bunch of other software, like AOL, Wordperfect, etc..
AOL actually pays Dell a fee to include their software, as do the other companies that Dell provides "trial" software for (JASC and others, for instance). This allows them to sell the PC at a lower cost.
Also note that the regular price for the PC is $349, and the $299 price is a special.
As I said to another poster. When CSS 2.1 is ratified it will be CSS2. For now, it's not.
Right now, CSS 2.1 doesn't exist. Therefore, CSS 2.0 is the only ratified CSS2, and therefore CSS2 *IS* a flawed standard.
It should be noted that when Hixie wrote that, CSS 2.1 was in the CR stage. Since then it's gone back to working draft.
It doesn't tell me anything, nor should it tell YOU anything.
h tml#a000533
h tml#a000539
My point was that you can't take a statement (supposedly) made about why they won't implement CSS2 and claim that it proves they won't implement CSS2.1 either.
By the way, you might be even more interested in this:
http://www.webstandards.org/buzz/archive/2005_07.
And this:
http://www.webstandards.org/buzz/archive/2005_07.
It didn't say it was going to support CSS 2.1, but it hasn't said it wouldn't either. CSS2 is a flawed standard, and MS is right for saying they won't support it. 2.1 is a different story, and MS has not commented on whether they will or won't support it.
CSS2 *IS* a flawed standard. That's why CSS 2.1 will totally replace it once it's finalized.
Until then, 2k does everything I need.
Except, perhaps, be supported by it's manufacturer?
What are you going to do when the next worm comes along that exploits a flaw that MS fixed in XP but not 2000?
Actually, anyone still using Windows 2000 are morons. MS will not be issuing any more patches for it, which means when new flaws are discovered in XP, chances are they will apply to 2k as well, making the OS even that much more insecure.
While it might apply less to users behind firewalls, it's still a stupid move. Upgrade to XP, or Switch to Linux or something, just don't continue to use an unsupported OS.
Actually, 6 year old. Windows 2000 was released in 1999.
Actually, I've never read a non-compete that didn't offer to pay the salary of the individual if they are unable to find work in their field because of the non-compete.
That's not to say they don't exist, but I think anyone would be able to win a judgement against a former employer if that were the case, even if it wasn't spelled out specifically in the contract.
But Borland didn't have non-compete clauses in their contracts. They're not legal in california.
That being said, however, Borland's products were never that great. They were good values (mostly), which is what drove sales. They also rode the wave of mid-80's University "Pascal" requirements.
Borland had many problems that had nothing to do with Microsoft. They abandoned products like crazy. Their Pascal and C++ class libraries broke everything every time you upgraded (That's why VCL components have to be compiled for each version), and their products were never that great performers. The optimizer in Borland and Turbo C++ was pitifull, for example.
They had a great IDE in the mid-80's, but they botched it later. More importantly, Microsoft got a LOT better, and their "mediocre but good value" business model wouldn't stand up.
I don't know. This is slightly different because the borland people didn't have non-compete clauses in their contracts (because they're not legal in California where Borland is based). Microsoft did have such a non-compete clause with this VP.
Microsoft is within their rights to complain. If Borland wanted to protect it's IP they should have run their offices in a different state.
Borland chose to do business in a state that wouldn't protect them. You know damn well Borland would have had non-compete's if the law had allowed them to.
Well, Mozilla is in fact one of those that aren't releaseing details of the patch even after the patch is released.
- 56.html
http://www.mozilla.org/security/announce/mfsa2005
Bug details embargoed until August 1, 2005
This, mind you is after the bug details were embargoed until July 20th. They keep moving the date back and will likely do it again when August 1st rolls around.
I'm not talking about updates that happen without your knowledge. I'm talking about notification of updated packages that YOU choose to install.
The issue here is that you lose that automatic notification, and unless you watch the security lists closely, and keep a ready inventory of all the installed programs (including those installed by dependancy) you're a security nightmare waiting to happen.
I don't know about you, but i've got better things to do with my time than spend it constantly checking for seucrity issues. I'd rather be notified when one that applies to me occurs.
While the morris worm was a big wakeup to the unix community, it was largely a one shot wonder until many years later.
Internet security didn't really become an issue until e-commerce started becoming common. Until there were more than just universities on the internet.
Nobody took internet security seriously, not even after the morris worm (which, while a wake up call, really was more of a nuisance than anything). Most people, and more importantly, most internet developers, didn't even know how the morris worm worked if they had even heard of it at all.
Buffer overflow exploits dropped of the face of the map after the morris worm. They fixed the flaws and everyone promptly forgot about it.
It's been common knowledge that gets() was bad because it could crash your program. What it wasn't easy to do was exploit buffer overflows. Buffer overflow exploit knowledge has only really happened in the last 10 years or so, and kits have been developed to make this very easy to do.
And then you turned around and said "Linux offers me some very fine grained control over what those users can do including the root account. I am unsure if windows has anything like it, but my experience says no."
I was commenting on your "fine grained" issue. I assume you're talking about Capabilities, something that NT based Windows has always had.
As it would appear. You're not using your server for much of anything.
Excuse me? I don't understand security? How so?
The user the IIS server runs under is completely configurable, as are the applications that run under it (Windows has the concept of impersionation, which is like Sudo, but applications can change their security context themslves rather than spawning a new process as a specific user). This is simply something you can't do with Apache or any other Unix web server that I'm aware of.
There's a HUGE problem with tarballs. You lose the "automatic update" features of your distro. You aren't automatically informed about security flaws and other critical updates.
That's fine if you're only managing one or two programs. But when you have dozens of tarballed apps, you're not going to keep up.
I'm not sure what OS you use, but the ones I do have the same problems. When I uninstall programs, there are still /etc config files left behind, there are still libraries with no dependancies left behind, there are stray . files in home directories, etc...
Oh, give me a break. You can't seriously expect anyone to believe this bullshit, do you?
Even if the above works (and often, depending on the distro, it won't because of dependancy, file locaiton, or other issues) this isn't the end. You often have to edit config files, set up profiles, or any number of other activities.
Your argument about Debian is even worse. In order to use anything recent, you have to depend on experimental packages, which are a crapshoot at best. Debian only "just works" if you're willing to put up with 2 year old versions.
You know, i've noticed this tendancy of Unix supporters to assume that what is known now has always been that way.
For example, you talk to the typical Unix supporter and they'll tell you that Unix was designed from the beginning with TCP/IP, Security, memory protection and multitasking, and a bunch of other stuff, when in reality all those things were added on afterwards.
The same is true with this point. 10 years ago, while Buffer overflows were known, they weren't common knowledge, and the average developer certainly didn't have the knowledge or tools to combat them.
By the way, do you realize how much of an ass you sound like when you say "Maybe they should have thought of that BEFORE..."?
Logically speaking, if they didn't know about something, how could they have thought about it? Not that I'm saying that a company like MS wouldn't have had people that did know about such things, just that your argument is rather stupid.
And for the record, I think Microsoft deliberately ignored security, even though they had people that understood the implications of it. I think it was a deliberate choice for them.
Are you nuts? Of course you can run IIS on any user you want. It goes a step further in IIS though. If you want to talk fine grained. You can specify different users for different web applications. or different web sites. You can specify different users for the "anonymyous" user or for interactive logins.
As for your argument about running IIS in a seperate VM... that's just plain stupid. Whenever the argument falls back to "But yeah, you have to buy something extra" you've lost the "The OS can't do this" argument.
You must not do much with your server. I have a SuSE 9.1 server that I run without X with pretty much the same services and am constly hitting swap, and I have 196MB of Ram.
I also have a 256MB server running IIS and SQL Server which performs quite well. So go figure.