To be honest, I wouldn't expect to survive passing through the center of a black hole, even if it held a charge equivalent to half the electrons in the universe, and was spinning so quickly that its mass only just held it together, but maybe that's just me...
And they want to protect their trademark. They don't want something that doesn't play in all CD players to be called a CD, because otherwise the public might get confused and think that this is a problem with CDs themselves, not copy protected non-standard laser disks. Or whatever you call them if they aren't CDs.
I mean, it's OK for you and me, we read techie web sites like slashdot, and I'm subscribed to bugtraq. But 99.9% of the public out there aren't.
So, somewhere informative should be yelling and screaming about a problem like this that affects pretty much everyone with WinME or XP.
So, I check MS's website.
Top article with the biggest link? No. That goes to 'Give the gift of Internet for Christmas', an advert for MSN.
Ah, there's a Windows section just beneath - surely it'll be there? Nope. "Music, movies and more".
Maybe it counts as 'News'? "Test Results In - Windows XP more reliable" (at least if its getting your computer rooted you're after).
Downloads perhaps? An item at least for a security fix - the Internet Explorer one discussed last week, but no mention of any XP patches. Not even if I click "More downloads".
Maybe if you click on the 'Windows' section? No mention. But that's for the Windows XP Home edition. Maybe the Pros think it's more useful? No. "Turn your computer into an entertainment center" - very professional.
Aha - finally found it; chose a link from the Windows XP Home page to the Windows XP home page (note capitalisation difference) and theres a small link there "Important! Security patch for Windows XP and Windows ME users" on a page that apparently has the main intention of allowing people to choose whether they want the home edition or the professional edition sites, neither of which has the link.
Oh, and as an aside, is it just me, but I'm using Internet Explorer 5 with default font size settings, on Win NT 4 with default font size settings, and some of the text on the security bulletin is only about 6 pixels tall and is utterly unreadable because of this?
Erm; I'm fairly sure my copy of KDE 2.1 has a 'most recently used programs' section at the top of the programs menu...? I don't have it available to me right now (I'm at work) to check, but I think its there.
This seems to be one area where MS have got their OS technically superior. Windows DLLs are by default 'pre-linked' in the fashion you talk about, as they have compiled into them a standard base address. As long as you don't use two DLLs that have conflicting base addresses (and with a centrally organized desktop environment, you can get that right every time) you're fine!
I think you'll find that you also need a good 3D input device. The mouse is an adequate way of selecting items in 2D, but cannot easily be extended to 3D. The 'data glove' extends the concept of pointing to an object to 3D but is cumbersome to use and looks silly. Only when your computer can track what you're doing with your hand (in precise relation to whatever projection method its using to show the 3D space) will 3D interfaces become usable. And just try to stop people from walking around in them!
Because I guess a lot of script kiddies read/. and everyone else has been vague on details, I'll hold off on them as well, but the real bug involves messing around with HTTP headers. Basically, one part of IE uses one method to get the filename of an object, and another uses a different method. IE shows the '.txt' or whatever filename in its dialog boxes, but the file it saves to your hard disk and executes is a '.exe' file.
Several people on the list attempted to reproduce the exloit as detailed by the original poster and failed. Whether that was their mistake or not is anyone's guess
Well, I for one did try. The original discussion sounded intriguing, and the unusual lack of detail for a bugtraq post made me take note. I'm not a security researcher, and don't claim to know much about internet security - just the basics that you need to know in order to write web applications, which is my job. Exploiting your average bug is way beyond me (I wouldn't know where to start with a buffer overflow, and I don't even understand how format string bugs work), but I got this one down in 5 minutes. It's a simple combination of factors.
What I'm saying, basically, is that if I can do it, so can a lot of other people. It's also in an area of IE that many people have known for a long time is very flaky, so I guess that some people have known about this hole for a very long time, because a lot of people go looking for IE holes, and if you know how to do it they can be easy to find.
Do you really think that a piece of MS software would say 'SecureIIS offers websites running Microsoft Internet Information Server a broad range of protection from [known vulnerabities]'?
Err... I thought the point of a fuel cell is that it is a rechargable power source with a particularly small amount of energy loss in the conversion process...?
Basically, you don't buy the bottles as 'fuel' in the traditional sense of the word. The three that come with it should be enough for most applications - forever.
From the BBC article:
A spokesman for Home Secretary David Blunkett said after the defeats: "We feel that the unelected Tory peers are disembowelling vital parts of the bill and completely undermining our fight against terrorism."
He said the distinction peers tried to make between terrorism and crime was "false".
The DPA is sprinkled with caveats about it not being applicable where information is required to be kept/processed/disclosed in order to conform with any other law, so the two seem at least to my untrained eyes to be compatible, at least semantically speaking, if not in terms of their obviously opposing goals.
It should be noted however, that the current incarnation of the DPA was mandated into existence by European Parliament resolutions on data privacy, which may have force to overrule any new laws requiring such information to be kept & disclosed. Sometimes, those folks over the channel there do some things sensible. Even if they do make silly rules about straight bananas.
Can anyone out there name one thing that I can do in XP that I could not do under Win3.1 or DOS? [...] Today, their dinky single user non multitasking softare acts much the same, but it's a little faster thanks to hardware improvements
In actual fact you've hit the nail right on the head. XP isn't a single user OS; it's a multi-user OS that only allows one user console access at a time, similar I guess to if the only way linux could support multiple logins was through virtual console switching...
This is a promising approach, and something I have to admit never considering before. But, with a little work, it could make a useful, workable system.
Firstly, to address a slight issue of fairness from the point of view of software vendors, a reasonable time frame must be required before they start to become liable for security breaches. This would have to be varied according to how much the type of product involved depends on the security, and how complex verifying and determining details of the apparent vulnerability is, but as a guideline anything from two working days for an obvious failing in an Internet server software up to four weeks for an obscure, hard to reproduce problem in a non-network related application (e.g. a word processor that isn't network integrated in any fashion - nb, MS Word's integration through VBAs into Outlook means that this wouldn't count in this category).
I'm also given to wonder whether or not the current state of law in the UK would hold this to be the case anyway. Acting like this is generally considered 'best practice', and UK law has held companies liable for problems caused by them not acting properly and immediately on knowledge they have before (admittedly I don't believe it has ever been applied like this, but cases such as the discovery of the adverse affects of asbestos and companies using it not warning their employees about potential hazards have been upheld before). Maybe some kind of action needs to be brought. Of course, you'd have to prove that the vendor knew about the problem for a considerable period of time before you were affected by it, and would have to be affected by it before any advisories were published, but I'm sure this can be done sometimes.
I think you've done a wonderful job in showing, in a simple way, that the difference is completely moot. It's impossible to seperate the particles from the background, because that would mean exiting the universe. So you have essentially just done a full circle and shown in a totally different way that the conflict *IS* purely a philosophical one.
That's not necessarily entirely true. Consider that the nature of vacuum fluctuations and their interactions with what we consider to be "our" physical universe are not even remotely understood. In fact, the existence of such fluctuations has only been accepted by most physicists for a comparitively short period of time. Only very recently have experiments been devised that actually interact with them in any way. In the future, experiments may be performed that are capable of altering them. Then, we can start to see what affect these alterations may have on our fundamental reality, and one or the other (or both) of these theories may be disproved.
First of all, I don't suspect most people would consider removing a package from an operating system 'modifying the software' or any of the other list of things stated.
Secondly, giving people instructions on how to break the copyright of an item is not against any copyright laws that I know of. I can quite easily walk up to a person holding a copy of a book in a bookshop and suggest they could take a copy of it by using a photocopier if they so desired. The only laws that I may possibly be breaking concern enticement into breaking laws and dubiously applicable here (I expect they may apply following DMCA, but probably wouldn't have done before).
I can tell you this for sure, because I have worked with web advertising people in various contexts for quite some time, and I can tell you right now that X10 do not use popups.
No.
They use pop-unders. Because popups annoy people, and they wouldn't want to do that.
Err... I don't know much about the US version (OK, I know a little and know that what I'm about to say doesn't apply directly to it, so wait for a second), but:
Weakest Link was a low-cost show set up to be run on a tight budget in an unpopular time slot (17:30) on a relatively unpopular channel (BBC2). Everything about the show was intended to be cheap, from the prizes to the presenter ("can't afford a megastar? Oh, ok we'll get a vaguely well known presenter of consumer rights programs, at least she'll be able to be scornful of idiots"). Nobody anticipated that it would take off like it has. And they're scared to touch the format in case they destroy that 'special something' that makes it so popular. And they're probably right. The chances are, with even the modest changes you suggest it wouldn't have taken off so much in the UK, and you'd probably have never seen it in the US by now.
Now, it sounds to me like the people that these groups that were actually selling copies of this software should have been a little more careful about giving credit where credit was due if for no other reason than ticking off the primary developer is a bad deal.
Having just read through the details of what happened here, I don't even see this point. The person selling the CDs wasn't actually aware that any credit was being missed out, and upon being informed of this problem, offered and in fact did rectify it. I think all of the problems here come down to a clash of personalities and the fink maintainer expecting his name up in lights or something, while the CD distributor (IMHO rightly) focussed the credit upon those who wrote the original program (ie GIMP) and only mentioned the porting efforts embodied in fink as a side reference.
Probably because so few people actually use it that it's hardly worthwhile...
Re:I've been seeing .biz for a long, long time!
on
.biz Open For Biz
·
· Score: 1
Don't you think that this is going to cause you problems? I mean, all sorts of people are now going to be registering domains that you can't see. Links are going to spring up all over the web (there's already been one from slashdot!) that you can't follow because of your choice of a non-standard root server; won't you find this inconvenient?
Actually, in the UK at least, it's rare to have to pay to have a non-geographic telephone number these days (unless you get it from BT!). Many companies will even pay you to use one...
Slashdot Mirror
To be honest, I wouldn't expect to survive passing through the center of a black hole, even if it held a charge equivalent to half the electrons in the universe, and was spinning so quickly that its mass only just held it together, but maybe that's just me...
And they want to protect their trademark. They don't want something that doesn't play in all CD players to be called a CD, because otherwise the public might get confused and think that this is a problem with CDs themselves, not copy protected non-standard laser disks. Or whatever you call them if they aren't CDs.
How are *users* supposed to know about this?
I mean, it's OK for you and me, we read techie web sites like slashdot, and I'm subscribed to bugtraq. But 99.9% of the public out there aren't.
So, somewhere informative should be yelling and screaming about a problem like this that affects pretty much everyone with WinME or XP.
So, I check MS's website.
Top article with the biggest link? No. That goes to 'Give the gift of Internet for Christmas', an advert for MSN.
Ah, there's a Windows section just beneath - surely it'll be there? Nope. "Music, movies and more".
Maybe it counts as 'News'? "Test Results In - Windows XP more reliable" (at least if its getting your computer rooted you're after).
Downloads perhaps? An item at least for a security fix - the Internet Explorer one discussed last week, but no mention of any XP patches. Not even if I click "More downloads".
Maybe if you click on the 'Windows' section? No mention. But that's for the Windows XP Home edition. Maybe the Pros think it's more useful? No. "Turn your computer into an entertainment center" - very professional.
Aha - finally found it; chose a link from the Windows XP Home page to the Windows XP home page (note capitalisation difference) and theres a small link there "Important! Security patch for Windows XP and Windows ME users" on a page that apparently has the main intention of allowing people to choose whether they want the home edition or the professional edition sites, neither of which has the link.
Oh, and as an aside, is it just me, but I'm using Internet Explorer 5 with default font size settings, on Win NT 4 with default font size settings, and some of the text on the security bulletin is only about 6 pixels tall and is utterly unreadable because of this?
Erm; I'm fairly sure my copy of KDE 2.1 has a 'most recently used programs' section at the top of the programs menu...? I don't have it available to me right now (I'm at work) to check, but I think its there.
Probably you only read it when it's been slashdotted. It's normally fine...
This seems to be one area where MS have got their OS technically superior. Windows DLLs are by default 'pre-linked' in the fashion you talk about, as they have compiled into them a standard base address. As long as you don't use two DLLs that have conflicting base addresses (and with a centrally organized desktop environment, you can get that right every time) you're fine!
I think you'll find that you also need a good 3D input device. The mouse is an adequate way of selecting items in 2D, but cannot easily be extended to 3D. The 'data glove' extends the concept of pointing to an object to 3D but is cumbersome to use and looks silly. Only when your computer can track what you're doing with your hand (in precise relation to whatever projection method its using to show the 3D space) will 3D interfaces become usable. And just try to stop people from walking around in them!
Because I guess a lot of script kiddies read
Several people on the list attempted to reproduce the exloit as detailed by the original poster and failed. Whether that was their mistake or not is anyone's guess
Well, I for one did try. The original discussion sounded intriguing, and the unusual lack of detail for a bugtraq post made me take note. I'm not a security researcher, and don't claim to know much about internet security - just the basics that you need to know in order to write web applications, which is my job. Exploiting your average bug is way beyond me (I wouldn't know where to start with a buffer overflow, and I don't even understand how format string bugs work), but I got this one down in 5 minutes. It's a simple combination of factors.
What I'm saying, basically, is that if I can do it, so can a lot of other people. It's also in an area of IE that many people have known for a long time is very flaky, so I guess that some people have known about this hole for a very long time, because a lot of people go looking for IE holes, and if you know how to do it they can be easy to find.
"This is Microsoft software after all ... "
Do you really think that a piece of MS software would say 'SecureIIS offers websites running Microsoft Internet Information Server a broad range of protection from [known vulnerabities]'?
That's tantamount to admitting responsibility!
Basically, you don't buy the bottles as 'fuel' in the traditional sense of the word. The three that come with it should be enough for most applications - forever.
IANAPP, but how can something which is the explanation of why particles have mass have a mass itself?
He said the distinction peers tried to make between terrorism and crime was "false".
Doesn't that sound so typical?!
It should be noted however, that the current incarnation of the DPA was mandated into existence by European Parliament resolutions on data privacy, which may have force to overrule any new laws requiring such information to be kept & disclosed. Sometimes, those folks over the channel there do some things sensible. Even if they do make silly rules about straight bananas.
In actual fact you've hit the nail right on the head. XP isn't a single user OS; it's a multi-user OS that only allows one user console access at a time, similar I guess to if the only way linux could support multiple logins was through virtual console switching...
No. You misunderstand. That's how long it'll take to boot...
This is a promising approach, and something I have to admit never considering before. But, with a little work, it could make a useful, workable system.
Firstly, to address a slight issue of fairness from the point of view of software vendors, a reasonable time frame must be required before they start to become liable for security breaches. This would have to be varied according to how much the type of product involved depends on the security, and how complex verifying and determining details of the apparent vulnerability is, but as a guideline anything from two working days for an obvious failing in an Internet server software up to four weeks for an obscure, hard to reproduce problem in a non-network related application (e.g. a word processor that isn't network integrated in any fashion - nb, MS Word's integration through VBAs into Outlook means that this wouldn't count in this category).
I'm also given to wonder whether or not the current state of law in the UK would hold this to be the case anyway. Acting like this is generally considered 'best practice', and UK law has held companies liable for problems caused by them not acting properly and immediately on knowledge they have before (admittedly I don't believe it has ever been applied like this, but cases such as the discovery of the adverse affects of asbestos and companies using it not warning their employees about potential hazards have been upheld before). Maybe some kind of action needs to be brought. Of course, you'd have to prove that the vendor knew about the problem for a considerable period of time before you were affected by it, and would have to be affected by it before any advisories were published, but I'm sure this can be done sometimes.
That's not necessarily entirely true. Consider that the nature of vacuum fluctuations and their interactions with what we consider to be "our" physical universe are not even remotely understood. In fact, the existence of such fluctuations has only been accepted by most physicists for a comparitively short period of time. Only very recently have experiments been devised that actually interact with them in any way. In the future, experiments may be performed that are capable of altering them. Then, we can start to see what affect these alterations may have on our fundamental reality, and one or the other (or both) of these theories may be disproved.
(Note: IANAP).
This sounds rather peculiar to me.
First of all, I don't suspect most people would consider removing a package from an operating system 'modifying the software' or any of the other list of things stated.
Secondly, giving people instructions on how to break the copyright of an item is not against any copyright laws that I know of. I can quite easily walk up to a person holding a copy of a book in a bookshop and suggest they could take a copy of it by using a photocopier if they so desired. The only laws that I may possibly be breaking concern enticement into breaking laws and dubiously applicable here (I expect they may apply following DMCA, but probably wouldn't have done before).
This sounds like a load of hot air to me.
(IANAL, of course...)
Ah, you are, I'm afraid, mistaken.
I can tell you this for sure, because I have worked with web advertising people in various contexts for quite some time, and I can tell you right now that X10 do not use popups.
No.
They use pop-unders. Because popups annoy people, and they wouldn't want to do that.
[sic]
Err... I don't know much about the US version (OK, I know a little and know that what I'm about to say doesn't apply directly to it, so wait for a second), but:
Weakest Link was a low-cost show set up to be run on a tight budget in an unpopular time slot (17:30) on a relatively unpopular channel (BBC2). Everything about the show was intended to be cheap, from the prizes to the presenter ("can't afford a megastar? Oh, ok we'll get a vaguely well known presenter of consumer rights programs, at least she'll be able to be scornful of idiots"). Nobody anticipated that it would take off like it has. And they're scared to touch the format in case they destroy that 'special something' that makes it so popular. And they're probably right. The chances are, with even the modest changes you suggest it wouldn't have taken off so much in the UK, and you'd probably have never seen it in the US by now.
Having just read through the details of what happened here, I don't even see this point. The person selling the CDs wasn't actually aware that any credit was being missed out, and upon being informed of this problem, offered and in fact did rectify it. I think all of the problems here come down to a clash of personalities and the fink maintainer expecting his name up in lights or something, while the CD distributor (IMHO rightly) focussed the credit upon those who wrote the original program (ie GIMP) and only mentioned the porting efforts embodied in fink as a side reference.
Probably because so few people actually use it that it's hardly worthwhile...
Don't you think that this is going to cause you problems? I mean, all sorts of people are now going to be registering domains that you can't see. Links are going to spring up all over the web (there's already been one from slashdot!) that you can't follow because of your choice of a non-standard root server; won't you find this inconvenient?
Obvious exceptions apply for 0800 numbers, etc.!