a) Verifying the integrity of the Linux kernel and patches downloaded from mirrors. I can verify them easily as I have the signers public key in my keyring. If it was signed by a foreigner I would notice by the absence of the key. This works here because it is not a one-time only check but I repeatedly verify code from the same source.
b) Signing MIDlets to leverage access rights on mobile devices. I do this because I have to. It improves usability for the user because she only has to allow network access once after installing and not every time the application is started. Not that you could really tell which application caused a certain amount of cost. So code signing on mobile devices is really bollocks.
Exactly. Accountability has proven useful in other situations as well. I once was responsible for running an intranet where people of the whole company (30'000 employees) could add and modify content. There was no role system. Everybody could edit anything basically. The only thing required was authentication and the modification was tagged (i.e. "signed", even though not cryptographically) with their name. We never had a single incident of abuse.
IMHO there are too many IM protocols/networks already. It's like having 10 different phone networks where people can not call each other if they live on different networks. IM should not be closed networks but as open as email. I want to pick a client and IM to everybody I know, independent of the network their on.
it's too easy to seriously screw up the system with emerge
That's interesting. I use Gentoo daily and never managed to screw up my system although trying lots of even unstable packages. What was your key experience that made you write this sentence?
To make machines run the exact same Gentoo, IMHO all you have to keep in sync are:/etc/var/lib/portage/world and emerge world.
Just one simple example. Every medium sized webapp has a rather large configuration vector. Configuration is today often done in XML. As PHP does not have application state it is not possible to perform an application startup and read the config once and then store it for later use. With every request you have to configure your whole application again. This can be a bad performance killer.
If you really cared about OO design and good code you would not be coding in PHP but Java,.Net or C++. PHP is just not suited for real-world web applications. Rather read The Pragmatic Programmer than a book about a specific language.
Linux today is doing quite a good job when it comes to hardware support. Driver developers are trying hard to get even esoteric hardware working. A problem that Apple for instance never had to face, since their OS runs on their dedicated hardware only. If Sun wants a wide adoption of Solaris they will have to catch up on device drivers. I seriously doubt they will get more vendor support than Linux. That means they will have to do the dirty work themselves (not the vendors). Just taking Linux drivers and porting them to Solaris does not work too well, as the two ABIs are probably (no idea really) totally different. If you need special hardware to run Solaris it can not be success.
It makes Webapp development easier. You don't need web designers to make the HTML. As a developer just produce HTML and let the web designer create the CSS.
This is important, since in webapps there rarely are HTML pages that you could open in Dreamweaver and edit nicely. HTML is normally distributet in several include files and messed up with non-HTML code like JSP, JSTL, template engine code. In lolcalized applications there is not even text in a dynamic page.
Now, just generate a sample page with dummy content and give it to your designer to make a CSS for it. Of course your designer will require you to include some meta information in the HTML code: element ids, style classes, grouping certain elements in div elements etc. But this is far easier than maintaining a design in HTML!
You just listed eight (that's 8) steps necessary to download this "public beta". You have to register yourself twice and it may take a couple of days. Sorry, I don't call that public any more.
If they have something to share with the public why can't they just put a file on their public part of their website?
Maintaining a Linux distro is pretty much work. You will end up with zillions of packages that YOU don't even care, but only others would like to have. Building a distro from scratch is somehow obsolete these days that we have Gentoo - which does exactly that. But all scripted. You can customize Gentoo exactly how you want it by putting your own or modified ebuilds into the overlay portage tree.
I don't think it's a good idea to use a key issued to an organization in this case. If your organization does not have an office you will probably not be able to get a code signing cert from Thawte (or other CAs) stating your organization's name, anyway. You will fall back to GPG/PGP probably.
At Apache Software Foundation (ASF) we use personal GPG keys. Of course that makes it a little tricky for the user, because he must know that the signer belongs to the organization. You should therefore clearly state on your website and inside the downloaded package who signed it (one thing ASF still has to do right). You should also publish the fingerprints of those keys in the same easy-to-find place (keys that can not be verified are useless). On the other hand there is no problem when a developer leaves the project. There is no need to pass secrets around.
Comments are good, no question. But they must be made on the right level of detail. Commenting every single line is complete overkill and helps only those who are completely unfamiliar with the language. So this may be useful for educational purposes, but not for real world code.
When I inherit an existing code base, first thing I do is try to get the overall structure. In Java this is pretty obvious when the packages are well organized and have good names. Next I look into individual packages. There should be a package.html that quickly describes what this package does, what it should not do, and so on. This is still no comments in the classical sense.
Next I look at class names. My IDE also distinguishes interfaces from classes, so they are easily spotted. No need to use naming conventions for interfaces and the like, though. Good class names already tell you a lot how things probably work and it's easy to figure out.
The details of the classes responsibilities are in the class documentation at the top. This one I consider an essential comment. Knowing how to use this class, if it's thread-safe, immutable, it's contract etc. is the most important thing.
Next the contract of the individual methods is important. So at least all the public and protected methods must have a good comment describing the contract in detail. Note: I am not interested in HOW a method performs a job, but only what goes in and in what state does it leave the object.
Finally to comments on individual code blocks and private methods: use comments only when an algorithm is not obvious, when an arithmetic expressions needs explanation, when the reason for a thing you do is not obvious. Also document constructs that are very delicate when changed and likely to break something.
Often I see code like this://read input [some lines of code]//process bla bla [some more lines of code]//find data [some more lines of code]
Instead of placing comments in front of each code block the code should have been broken up into smaller methods that have a speaking name.
Right, ff the driver is disabled it is not even compiled! The only thing this guy could possibly worry about is the download size. But who cares with ever increasing bandwidths and storage size?
Maybe the kernel config could feature some more high-level options or some typical base configs from which to start like:
* It's going to be a generic kernel for a live CD and needs to fit all kind of hardware
* It's a Main Frame
* It's a laptop
* It's a DNS/Web server, router
* Multimedia is cool/bloat
Maybe even a completely different UI for configuring the kernel can solve much of the difficulties. Of course this would have to be maintained whereas the current kconfig system is quite self-maintaining.
Actually, I very much like tha fact that all drivers are built into the main kernel. This is what makes Linux so much advanced over Windows: I never need to look for special drivers on the web or flip in a vendor CD whenever I buy a new device. It's just there. And it's good.
If you don't like to rebuilt your kernel for every new device, just compile all the modules (or the ones you will likely use) and load them when needed.
Messing with TTL can render DNS RBLs completely useless. When an IP is blacklisted we want the shortest possible notice. I don't care about a blacklisted IP after 7 days.
This has nothing to do with Firefox or the JRE, nor IE. The JRE's security manager properly issues are warning that the user is about to run arbitrary code. It's like an email worm. The user's interaction and ignorance is need to spread the thing.
The whole issue is around stability. If you mark a particular kernel tree as "stable" and apply only security and other "trivial" patches, people will loudly complain if something breaks.
To be able to call something "stable" you must test it, and test it A LOT. Testing a Linux kernel is not a trivial thing as it can run in a myriad of kernel configurations and on zillions of hardware configurations. So only the users can test it, it's just too much for the developers. But users won't test an unstable kernel.
So whenever you release a kernel as "stable" then the real testing will only begin!
IMHO maintenance of a "stable" tree should be left to the distributions. Almost all of them already roll their own kernels. And some have certified hardware they use to thoroughly test the beast before releasing it to the public.
I turned an offer down because of ethics. They would have paid very well though. But they make money by selling addresses, cleaning address data, collecting and combining personal information, checking credit-worthiness etc.
I will probably quit my current job as it is not challenging enough and they pay crap.
In my job I want to be happy. I am happy if I like the everyday work. It must be challenging. I want to be proud of my work. The people must be nice. The office must not stink. Boss and customers must not be idiots. I want some freedom, like take a day off for going snowboarding if the weather is too nice to work. My competence must be recognized.
Conclusion: Quit what you hate. Start what you like.
The search box also does not make annoying beep sounds
Turn it off with about:config property accessibility.typeaheadfind.enablesound
config [...] should be easily accessable
Most end users don't configure anything on their applications. They don't even know they can! So having just the most important options is fair enough. Nothing is worse than an overly complicated options dialog like the one in MS Word!
There's no HTML editor anymore either. Firefox is targeted to the end user mainly. The HTML editor is not end user ready. And it is at least questionable if an end user needs a HTML editor at all.
There is always people that don't like the taste of a new interface. That's why you have the choice. You can stick with Mozilla if you whish. Or you can hack XUL and make a GUI that suits your liking.
If the 'Linux' that IBM is talking about is relying on any of their patented 'aparatus and system', they should just issue a license for Linux and other OSS to use it freely. That'd be recognized in court.
If you read the wikipedia article, the grand unified theory is one theory for all forces. What do you mean by the term 'relativistic mechanics'? Particle physics is almost always relativistic, since we mostly study particles at high energies. At the same time particle physics is always quantum physics. I don't see what's the problem, dude.
Slashdot Mirror
Looking forward for a real hardware hack then. Maybe use a laptop and USB cable to hack a Mazda? The question is not IF it happens, but WHEN.
Yeah I this too: /usr/bin/tar cjf $HOME/backup.tar.bz2 $HOME/backup/*
crontab -e
0 18 * * *
My daily use of code signing is:
a) Verifying the integrity of the Linux kernel and patches downloaded from mirrors. I can verify them easily as I have the signers public key in my keyring. If it was signed by a foreigner I would notice by the absence of the key. This works here because it is not a one-time only check but I repeatedly verify code from the same source.
b) Signing MIDlets to leverage access rights on mobile devices. I do this because I have to. It improves usability for the user because she only has to allow network access once after installing and not every time the application is started. Not that you could really tell which application caused a certain amount of cost. So code signing on mobile devices is really bollocks.
Exactly. Accountability has proven useful in other situations as well. I once was responsible for running an intranet where people of the whole company (30'000 employees) could add and modify content. There was no role system. Everybody could edit anything basically. The only thing required was authentication and the modification was tagged (i.e. "signed", even though not cryptographically) with their name. We never had a single incident of abuse.
IMHO there are too many IM protocols/networks already. It's like having 10 different phone networks where people can not call each other if they live on different networks. IM should not be closed networks but as open as email. I want to pick a client and IM to everybody I know, independent of the network their on.
it's too easy to seriously screw up the system with emerge
/etc /var/lib/portage/world
That's interesting. I use Gentoo daily and never managed to screw up my system although trying lots of even unstable packages. What was your key experience that made you write this sentence?
To make machines run the exact same Gentoo, IMHO all you have to keep in sync are:
and emerge world.
Just one simple example. Every medium sized webapp has a rather large configuration vector. Configuration is today often done in XML. As PHP does not have application state it is not possible to perform an application startup and read the config once and then store it for later use. With every request you have to configure your whole application again. This can be a bad performance killer.
If you really cared about OO design and good code you would not be coding in PHP but Java, .Net or C++. PHP is just not suited for real-world web applications. Rather read The Pragmatic Programmer than a book about a specific language.
Linux today is doing quite a good job when it comes to hardware support. Driver developers are trying hard to get even esoteric hardware working. A problem that Apple for instance never had to face, since their OS runs on their dedicated hardware only.
If Sun wants a wide adoption of Solaris they will have to catch up on device drivers. I seriously doubt they will get more vendor support than Linux. That means they will have to do the dirty work themselves (not the vendors). Just taking Linux drivers and porting them to Solaris does not work too well, as the two ABIs are probably (no idea really) totally different. If you need special hardware to run Solaris it can not be success.
It makes Webapp development easier. You don't need web designers to make the HTML. As a developer just produce HTML and let the web designer create the CSS.
This is important, since in webapps there rarely are HTML pages that you could open in Dreamweaver and edit nicely. HTML is normally distributet in several include files and messed up with non-HTML code like JSP, JSTL, template engine code. In lolcalized applications there is not even text in a dynamic page.
Now, just generate a sample page with dummy content and give it to your designer to make a CSS for it. Of course your designer will require you to include some meta information in the HTML code: element ids, style classes, grouping certain elements in div elements etc. But this is far easier than maintaining a design in HTML!
You just listed eight (that's 8) steps necessary to download this "public beta". You have to register yourself twice and it may take a couple of days. Sorry, I don't call that public any more.
If they have something to share with the public why can't they just put a file on their public part of their website?
Maintaining a Linux distro is pretty much work. You will end up with zillions of packages that YOU don't even care, but only others would like to have. Building a distro from scratch is somehow obsolete these days that we have Gentoo - which does exactly that. But all scripted. You can customize Gentoo exactly how you want it by putting your own or modified ebuilds into the overlay portage tree.
I don't think it's a good idea to use a key issued to an organization in this case. If your organization does not have an office you will probably not be able to get a code signing cert from Thawte (or other CAs) stating your organization's name, anyway. You will fall back to GPG/PGP probably.
At Apache Software Foundation (ASF) we use personal GPG keys. Of course that makes it a little tricky for the user, because he must know that the signer belongs to the organization. You should therefore clearly state on your website and inside the downloaded package who signed it (one thing ASF still has to do right). You should also publish the fingerprints of those keys in the same easy-to-find place (keys that can not be verified are useless). On the other hand there is no problem when a developer leaves the project. There is no need to pass secrets around.
Comments are good, no question. But they must be made on the right level of detail. Commenting every single line is complete overkill and helps only those who are completely unfamiliar with the language. So this may be useful for educational purposes, but not for real world code.
//read input //process bla bla //find data
When I inherit an existing code base, first thing I do is try to get the overall structure. In Java this is pretty obvious when the packages are well organized and have good names. Next I look into individual packages. There should be a package.html that quickly describes what this package does, what it should not do, and so on. This is still no comments in the classical sense.
Next I look at class names. My IDE also distinguishes interfaces from classes, so they are easily spotted. No need to use naming conventions for interfaces and the like, though. Good class names already tell you a lot how things probably work and it's easy to figure out.
The details of the classes responsibilities are in the class documentation at the top. This one I consider an essential comment. Knowing how to use this class, if it's thread-safe, immutable, it's contract etc. is the most important thing.
Next the contract of the individual methods is important. So at least all the public and protected methods must have a good comment describing the contract in detail. Note: I am not interested in HOW a method performs a job, but only what goes in and in what state does it leave the object.
Finally to comments on individual code blocks and private methods: use comments only when an algorithm is not obvious, when an arithmetic expressions needs explanation, when the reason for a thing you do is not obvious. Also document constructs that are very delicate when changed and likely to break something.
Often I see code like this:
[some lines of code]
[some more lines of code]
[some more lines of code]
Instead of placing comments in front of each code block the code should have been broken up into smaller methods that have a speaking name.
Right, ff the driver is disabled it is not even compiled! The only thing this guy could possibly worry about is the download size. But who cares with ever increasing bandwidths and storage size?
Maybe the kernel config could feature some more high-level options or some typical base configs from which to start like:
* It's going to be a generic kernel for a live CD and needs to fit all kind of hardware
* It's a Main Frame
* It's a laptop
* It's a DNS/Web server, router
* Multimedia is cool/bloat
Maybe even a completely different UI for configuring the kernel can solve much of the difficulties. Of course this would have to be maintained whereas the current kconfig system is quite self-maintaining.
Actually, I very much like tha fact that all drivers are built into the main kernel. This is what makes Linux so much advanced over Windows: I never need to look for special drivers on the web or flip in a vendor CD whenever I buy a new device. It's just there. And it's good.
If you don't like to rebuilt your kernel for every new device, just compile all the modules (or the ones you will likely use) and load them when needed.
Messing with TTL can render DNS RBLs completely useless. When an IP is blacklisted we want the shortest possible notice. I don't care about a blacklisted IP after 7 days.
This has nothing to do with Firefox or the JRE, nor IE. The JRE's security manager properly issues are warning that the user is about to run arbitrary code. It's like an email worm. The user's interaction and ignorance is need to spread the thing.
The whole issue is around stability. If you mark a particular kernel tree as "stable" and apply only security and other "trivial" patches, people will loudly complain if something breaks.
To be able to call something "stable" you must test it, and test it A LOT. Testing a Linux kernel is not a trivial thing as it can run in a myriad of kernel configurations and on zillions of hardware configurations. So only the users can test it, it's just too much for the developers. But users won't test an unstable kernel.
So whenever you release a kernel as "stable" then the real testing will only begin!
IMHO maintenance of a "stable" tree should be left to the distributions. Almost all of them already roll their own kernels. And some have certified hardware they use to thoroughly test the beast before releasing it to the public.
I turned an offer down because of ethics. They would have paid very well though. But they make money by selling addresses, cleaning address data, collecting and combining personal information, checking credit-worthiness etc.
I will probably quit my current job as it is not challenging enough and they pay crap.
In my job I want to be happy. I am happy if I like the everyday work. It must be challenging. I want to be proud of my work. The people must be nice. The office must not stink. Boss and customers must not be idiots. I want some freedom, like take a day off for going snowboarding if the weather is too nice to work. My competence must be recognized.
Conclusion: Quit what you hate. Start what you like.
Servlets usually are little. They are only an adapter between HTTP and your application logic. So they are hardly ever longer than a few screens.
The search box also does not make annoying beep sounds
Turn it off with about:config property accessibility.typeaheadfind.enablesound
config [...] should be easily accessable
Most end users don't configure anything on their applications. They don't even know they can! So having just the most important options is fair enough. Nothing is worse than an overly complicated options dialog like the one in MS Word!
There's no HTML editor anymore either.
Firefox is targeted to the end user mainly. The HTML editor is not end user ready. And it is at least questionable if an end user needs a HTML editor at all.
There is always people that don't like the taste of a new interface. That's why you have the choice. You can stick with Mozilla if you whish. Or you can hack XUL and make a GUI that suits your liking.
Then just hit okay and it will end up in the top folder as it would in IE.
A promise is worth nothing in court.
If the 'Linux' that IBM is talking about is relying on any of their patented 'aparatus and system', they should just issue a license for Linux and other OSS to use it freely. That'd be recognized in court.
Too much hassle and no fun. I am having fun at a really small company.
If you read the wikipedia article, the grand unified theory is one theory for all forces.
What do you mean by the term 'relativistic mechanics'? Particle physics is almost always relativistic, since we mostly study particles at high energies. At the same time particle physics is always quantum physics. I don't see what's the problem, dude.