Its a growing problem in Europe. Legally, _shops_ are not obliged to accept returns of anything that is not defective (although many do; Argos is a UK retail chain that offers this, and I know a number of people who have taken advantage of it to get a piece of equipment for a week or so that they wanted it for and then claim their money back afterwards). But a few years ago a European law was passed that required mail order/Internet retailers to do so, as long as the goods are not customised for the purchaser or perishable.
More and more people are realising what they can get away with in these terms.
Companies who are only now implementing the concept of a root account
I'm not quite sure what you're getting at here. Windows NT has had an Administrator account, being similar in principle to the unix idea of 'root', since it was first released over 10 years ago.
I've seen a lot of people here commenting on Jeff D's opinions in this piece, assuming that he's arguing from the perspective of an MS fanboy who thinks very-high-level languages are the greatest thing since sliced bread.
As someone who knows a little bit about the man, I think I need to put the record straight a little:
- He is an open source advocate -- his company, Coriolis Press, specialises in producing books about technical aspects of open source software - He clearly doesn't believe that high level languages are the only way to write software -- his book, Assembly Language Step-by-Step 2nd ed. (Wiley) is one of the best introductions I've ever seen to assembly language programming on Linux.
So, he was mistaken about how popular Apache is. In his defense, it is popular for mass hosting services and higher volume sites, but in the mid-range band I believe IIS is more popular. That mid-range band is also the most profitable to target with worms and other attacks, because it is the band that is least likely to be managed by a competent admin who has kept up-to-date with patches.
If you sign something just to be "safe", how do you really know you're safe? What rights are you giving up in order to "comply"?
True enough. But a lawyer to read the agreement and tell you if there's a problem is still cheaper than a patent search.
Anyway, last time I checked Microsoft was a latecomer to the Internet. Most of the Internet's supporting infrastructure doesn't even run Windows. They simply cannot have ownership of TCP/IP.
True enough, although there have been a lot of extensions to TCP/IP in recent years, and they may have IP rights over features like Explicit Congestion Notification, or maybe even the Evil Bit (has MS patented Evil? They certainly have a _lot_ of experience implementing it...)
Case A: You're adding a known broken authentication method to a system that already has good authentication. What are you gaining?
Most present-day locks on doors are a known-broken authentication system. Anyone who knows how to can take simple tools and in a matter of minutes unlock them. With some commonly-used lock designs and the right equipment, a locksmith can open a locked door in a matter of a seconds -- I've seen that done, and it cost me 15 pounds. Do you suggest, therefore, that we don't bother locking our doors?
No. The point is that the existance of a lock acts as a deterrent. It cuts down to a very small number the percentage of people with the ability and tools to break in, and most of those wouldn't want to anyway.
The same is true with fingerprint recognition on "smart guns". The idea behind the system is to stop someone from (e.g.) sneaking up behind you, pulling your gun and shooting you. In this scenario, it is an effective security measure.
It isn't effective if someone can take the gun away and modify it, it isn't effective if somebody plans in advance and is able to get hold of your fingerprints from somewhere. These are very unlikely scenarios -- most people doing something like that would just bring their own gun instead. The "smart gun" is designed to deter opportunists.
Case B: You're adding a known broken authentication method to a system that depends upon a different known broken authentication system. What do you get from having two broken systems instead of one? Why not focus on fixing one or the other?
Because neither of them _can_ be fixed. The first (and only) authentication system currently used by guns is possession -- that is, they can't be fired by someone who isn't holding them. It will always be possible to steal a gun from someone who isn't paying attention, and this cannot be prevented without inconveniences that are too high to be accepted (e.g. keeping the gun in a locked case strapped to your waist). It is critically important that any second authentication step used not delay the owner's ability to use the gun *at all*. Therefore, it must be something entirely automatic that is activated in the normal course of firing it. With present technology, only fingerprint sensing is feasible.
Unless, of course, you either think no security is better, or that there is something else that is a better option.
When mercury was seen to rotate at a different rate to what was previously expected, that proved that something about the way we understood gravitation and mechanics to work was wrong.
When stars appeared closer to the sun during a solar eclipse than their normal positions indicated, that proved that a number of theories about how electromagnetic radiation behaved in the presence of gravity wrong (leaving Einstein's General Relativity as the only commonly-accepted working theory).
Science frequently proves things wrong. It never proves anything right. You can interpret the claims of this report as "the way we understand the universe is wrong", so it is possible that some of it might be proven. Unlikely, perhaps.
Admittedly, in the unlikely event that they are right (yeah, right!), what would result would qualify, IMO, as a paradigm shift... it would mean that almost all of our physical theories about the way the universe works were fundamentally _wrong_. We'd have to abandon relativity and quantum theory as they would, for the first time since their development, be unable to explain observable and repeatable phenomena. This, I think qualifies as a "paradigm shift", just as the introduction of these two theories were the last two such shifts we have experienced.
I also don't find this to be FUD. If these licenses were so meaningless then why is anyone signing them? Getting a license is an admission that you feel the licensing body has the authority to license what it is attempting to.
Who knows what the licensing body has authority for? Patent searches can be difficult and expensive to do right, particularly when you're looking for patents owned by a company like MS -- they have a _lot_ of them, and it can be difficult at times to understand exactly what they're talking about.
So, do you spend maybe $5000, describe to your patent lawyer what your product does and ask him for his opinion on whether MS actually owns a patent that you're infringing, or do you sign a gratis license agreement that's a little inconvenient, but a lot cheaper, but which you think you don't need... but can't be sure?
I'm quoting the Samba team's warning against contributing to Samba while having signed an agreement about the other protocols.
Huh? The only protocol mentioned in what you quoted was CIFS, which is MS's new name for the revised specification of SMB that supports the funky new features of Win2K et al, and which is implemented in samba. That wasn't about 'other' protocols, it's about SMB/CIFS and Microsoft's NDAs, purely and simply.
They also have very bad customer service, in my limited experience of them (which was, admittedly, trying to port a domain away from them that one of my clients had registered and then promptly forgotten his username and password).
We already have something much more useful tool for that: cygwin. THE way to compile and run native linux apps on windows without wasting an excessive amount of systeml resources.
Err.. right. Cygwin does not run "native linux apps". It is a POSIX compatible C library combined with a VFS layer that presents a Unix-like filesystem when run on Windows. It has nothing to do with Linux, the only thing about that is native is that it is a piece of Windows software that runs on Windows. And given the slow implementation of fork() that they use, I'd say an excessive amount of system resources are wasted, particularly if you run a lot of complicated shell scripts. 'configure' for many packages takes 10-20 minutes to run on my system, compared to about 2 for similar complexity under Linux.
VMware developers must have bought a license, so what's the problem here?
VMware runs an unmodified version of Windows by presenting a virtual machine that is practically indistinguishable from a real PC. Therefore they don't need a license.
How about if hardware manufactures started putting this into the bios and calling it a new platform that just so happens to be nearly identical to and backwards compatible with x86. Would Microsoft have to start supporting it then?
If a major hardware manufacturer were to release and sell significant numbers of a PC that windows wouldn't run on, MS would do what they used to do back in the Windows 2/3 days -- release a special OEM version that will work (see e.g. RM Nimbus 186s).
Of course no hardware manufacturer is likely to be able to sell significant numbers of a PC that won't run windows. Catch-22.
Windows still has active desktop. It hasn't been abandoned, its just not quite so obvious these days, but you can right click on your desktop and choose "Show web content on my desktop" and go ahead and stick whatever scripted weird things you want into an HTML document for it.
That's what I thought until it stopped downloading patches for me without notification or error message (turns out I had failed to download an update that was labelled as non-critical which included a patch for BITS, which automatic update relies on, and it therefore stopped working... apply that patch and suddenly I had about two months' worth of critical updates coming down all at at once).
Slashdot Mirror
Its a growing problem in Europe. Legally, _shops_ are not obliged to accept returns of anything that is not defective (although many do; Argos is a UK retail chain that offers this, and I know a number of people who have taken advantage of it to get a piece of equipment for a week or so that they wanted it for and then claim their money back afterwards). But a few years ago a European law was passed that required mail order/Internet retailers to do so, as long as the goods are not customised for the purchaser or perishable.
More and more people are realising what they can get away with in these terms.
Companies who are only now implementing the concept of a root account
I'm not quite sure what you're getting at here. Windows NT has had an Administrator account, being similar in principle to the unix idea of 'root', since it was first released over 10 years ago.
I've seen a lot of people here commenting on Jeff D's opinions in this piece, assuming that he's arguing from the perspective of an MS fanboy who thinks very-high-level languages are the greatest thing since sliced bread.
As someone who knows a little bit about the man, I think I need to put the record straight a little:
- He is an open source advocate -- his company, Coriolis Press, specialises in producing books about technical aspects of open source software
- He clearly doesn't believe that high level languages are the only way to write software -- his book, Assembly Language Step-by-Step 2nd ed. (Wiley) is one of the best introductions I've ever seen to assembly language programming on Linux.
So, he was mistaken about how popular Apache is. In his defense, it is popular for mass hosting services and higher volume sites, but in the mid-range band I believe IIS is more popular. That mid-range band is also the most profitable to target with worms and other attacks, because it is the band that is least likely to be managed by a competent admin who has kept up-to-date with patches.
If you sign something just to be "safe", how do you really know you're safe? What rights are you giving up in order to "comply"?
True enough. But a lawyer to read the agreement and tell you if there's a problem is still cheaper than a patent search.
Anyway, last time I checked Microsoft was a latecomer to the Internet. Most of the Internet's supporting infrastructure doesn't even run Windows. They simply cannot have ownership of TCP/IP.
True enough, although there have been a lot of extensions to TCP/IP in recent years, and they may have IP rights over features like Explicit Congestion Notification, or maybe even the Evil Bit (has MS patented Evil? They certainly have a _lot_ of experience implementing it...)
You know, freedom goes both ways - you have the right to see these images, but Google has the right to censor their own content.
And I have the right to bitch and moan and stop using Google.
Ah, it would have been about 6 months ago. Perhaps they've improved then. :)
Case A: You're adding a known broken authentication method to a system that already has good authentication. What are you gaining?
Most present-day locks on doors are a known-broken authentication system. Anyone who knows how to can take simple tools and in a matter of minutes unlock them. With some commonly-used lock designs and the right equipment, a locksmith can open a locked door in a matter of a seconds -- I've seen that done, and it cost me 15 pounds. Do you suggest, therefore, that we don't bother locking our doors?
No. The point is that the existance of a lock acts as a deterrent. It cuts down to a very small number the percentage of people with the ability and tools to break in, and most of those wouldn't want to anyway.
The same is true with fingerprint recognition on "smart guns". The idea behind the system is to stop someone from (e.g.) sneaking up behind you, pulling your gun and shooting you. In this scenario, it is an effective security measure.
It isn't effective if someone can take the gun away and modify it, it isn't effective if somebody plans in advance and is able to get hold of your fingerprints from somewhere. These are very unlikely scenarios -- most people doing something like that would just bring their own gun instead. The "smart gun" is designed to deter opportunists.
Case B: You're adding a known broken authentication method to a system that depends upon a different known broken authentication system. What do you get from having two broken systems instead of one? Why not focus on fixing one or the other?
Because neither of them _can_ be fixed. The first (and only) authentication system currently used by guns is possession -- that is, they can't be fired by someone who isn't holding them. It will always be possible to steal a gun from someone who isn't paying attention, and this cannot be prevented without inconveniences that are too high to be accepted (e.g. keeping the gun in a locked case strapped to your waist). It is critically important that any second authentication step used not delay the owner's ability to use the gun *at all*. Therefore, it must be something entirely automatic that is activated in the normal course of firing it. With present technology, only fingerprint sensing is feasible.
Unless, of course, you either think no security is better, or that there is something else that is a better option.
When exactly does science "prove" something?
When mercury was seen to rotate at a different rate to what was previously expected, that proved that something about the way we understood gravitation and mechanics to work was wrong.
When stars appeared closer to the sun during a solar eclipse than their normal positions indicated, that proved that a number of theories about how electromagnetic radiation behaved in the presence of gravity wrong (leaving Einstein's General Relativity as the only commonly-accepted working theory).
Science frequently proves things wrong. It never proves anything right. You can interpret the claims of this report as "the way we understand the universe is wrong", so it is possible that some of it might be proven. Unlikely, perhaps.
Admittedly, in the unlikely event that they are right (yeah, right!), what would result would qualify, IMO, as a paradigm shift... it would mean that almost all of our physical theories about the way the universe works were fundamentally _wrong_. We'd have to abandon relativity and quantum theory as they would, for the first time since their development, be unable to explain observable and repeatable phenomena. This, I think qualifies as a "paradigm shift", just as the introduction of these two theories were the last two such shifts we have experienced.
I also don't find this to be FUD. If these licenses were so meaningless then why is anyone signing them? Getting a license is an admission that you feel the licensing body has the authority to license what it is attempting to.
Who knows what the licensing body has authority for? Patent searches can be difficult and expensive to do right, particularly when you're looking for patents owned by a company like MS -- they have a _lot_ of them, and it can be difficult at times to understand exactly what they're talking about.
So, do you spend maybe $5000, describe to your patent lawyer what your product does and ask him for his opinion on whether MS actually owns a patent that you're infringing, or do you sign a gratis license agreement that's a little inconvenient, but a lot cheaper, but which you think you don't need... but can't be sure?
I'm quoting the Samba team's warning against contributing to Samba while having signed an agreement about the other protocols.
Huh? The only protocol mentioned in what you quoted was CIFS, which is MS's new name for the revised specification of SMB that supports the funky new features of Win2K et al, and which is implemented in samba. That wasn't about 'other' protocols, it's about SMB/CIFS and Microsoft's NDAs, purely and simply.
They also have very bad customer service, in my limited experience of them (which was, admittedly, trying to port a domain away from them that one of my clients had registered and then promptly forgotten his username and password).
Many people already own a copy of Windows 98. Most of the PCs that currently exist were sold with a copy of it, I believe.
This isn't redundant. It's the only post in the entire thread that asks a very important question.
We already have something much more useful tool for that: cygwin. THE way to compile and run native linux apps on windows without wasting an excessive amount of systeml resources.
Err.. right. Cygwin does not run "native linux apps". It is a POSIX compatible C library combined with a VFS layer that presents a Unix-like filesystem when run on Windows. It has nothing to do with Linux, the only thing about that is native is that it is a piece of Windows software that runs on Windows. And given the slow implementation of fork() that they use, I'd say an excessive amount of system resources are wasted, particularly if you run a lot of complicated shell scripts. 'configure' for many packages takes 10-20 minutes to run on my system, compared to about 2 for similar complexity under Linux.
VMware developers must have bought a license, so what's the problem here?
VMware runs an unmodified version of Windows by presenting a virtual machine that is practically indistinguishable from a real PC. Therefore they don't need a license.
How about if hardware manufactures started putting this into the bios and calling it a new platform that just so happens to be nearly identical to and backwards compatible with x86. Would Microsoft have to start supporting it then?
If a major hardware manufacturer were to release and sell significant numbers of a PC that windows wouldn't run on, MS would do what they used to do back in the Windows 2/3 days -- release a special OEM version that will work (see e.g. RM Nimbus 186s).
Of course no hardware manufacturer is likely to be able to sell significant numbers of a PC that won't run windows. Catch-22.
As the only security model they don't make sense.
As an additional one that doesn't replace any other, and which everyone is made aware they shouldn't depend on, I don't see a problem.
Other than that "emergency situation" thing, which we're supposed to be ignoring, but which is actually kind of serious.
From the manual:
A port specifically for x86/64 is in progress, although Xen already runs on such systems in 32-bit legacy mode
back when Windows had "active desktop" features
Windows still has active desktop. It hasn't been abandoned, its just not quite so obvious these days, but you can right click on your desktop and choose "Show web content on my desktop" and go ahead and stick whatever scripted weird things you want into an HTML document for it.
The quote at the bottom of the page goes, "Cheer Up! Things are getting worse at a slower rate."
Well, something's going at a slower rate. Could be the web site that describes whatever the hell Konfabulator actually is.
Someone want to enlighten us non-Apple users?
You still own your computer. Until of course you connect it to the Internet, at which point a script kiddie will 0wn it.
I'm fine with the automatic Windows update!
That's what I thought until it stopped downloading patches for me without notification or error message (turns out I had failed to download an update that was labelled as non-critical which included a patch for BITS, which automatic update relies on, and it therefore stopped working... apply that patch and suddenly I had about two months' worth of critical updates coming down all at at once).
I can't find the actual response on that site... but there is a copy of it on zdnet.
Some of us prefer brunettes.
Of course, some of us prefer gadgets too, but they're weird.