Slashdot Mirror


User: cquark

cquark's activity in the archive.

Stories
0
Comments
81
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 81

  1. Try perl's IO::Socket and IO::Select on PHP 5 Released; PHP Compiler, Too · · Score: 1

    I love perl's IO::Socket and IO::Select classes for writing socket-based applications. Python's socket and select classes are quite nice too.

  2. Security Theorems and Proofs on Is Finding Security Holes a Good Idea? · · Score: 1

    In the most general abstract case, the security of computer systems is undecidable. This result can be proved by showing that deciding the security in the most general case is equivalent to solving the Halting Problem.

    However, there are specific systems which can be shown to be secure. A well-known example of a security system that can be proved secure is the Bell-LaPadula multilevel security model.

  3. False Positives on Biometric ID Cards Trialled in Glasgow · · Score: 3, Insightful
    A 4% failure rate? What happens if it fails? Are you detained, denied whatever you were being identified for? This seems unacceptable as a form of identification.

    If the purpose is discovering terrorists, a 4% false positive rate means the system is completely ineffective. Assuming than one person in a million is a terrorist (ridiculously high, I know), then you'd have 40,000 false positives in addition to your one likely correct guess. That's not only a tremendous cost to civil liberties, but it's also likely that the security personnel are going to ignore the terrorist because they've dealt with 40,000 mistakes in the process, and are justifiably unlikely to believe the system any longer.

  4. Less Secure on Biometric ID Cards Trialled in Glasgow · · Score: 5, Insightful

    The likely result of universal biometric identification schemes will be to make us less secure. All of them suffer from the problem of creating the initial cards for the whole population. How do you determine people's identities to give them their initial cards? By using their current identification materials, so the system won't start in a state that's any more secure than our current identification system. In order to be secure, you not only have to avoid transitioning from a secure state to an insecure one, you also have to start in a secure one, and all of these systems fail that requirement.

    Two of the 9/11 terrorists had valid driver's licenses in false names. Biometrics won't prevent existing false IDs from being used to generate new false biometric IDs. Biometrics also won't prevent the personnel who issue biometric IDs from being bribed or coerced into issuing IDs in false names. Remember that the initialization problem isn't a one time issue either--people lose IDs frequently, so the procedure for issuing new biometric IDs to people who don't have one has to exist throughout the lifetime of the system.

    Identification is not an effective solution to preventing terrorism. What good would it have done to have known Timothy McVeigh's name before the Oklahoma City? In order to prevent terrorism, you need to know someone's intentions, not their identity, or you need preventative mechanisms in place to stop terrorism that are idependent of who a person is, such as secure doors to the cockpits of airplanes.

  5. USB Mouse Problem Solution on Dan Gillmor Reconsiders Linux on the Desktop · · Score: 2, Interesting
    I've also experienced the problem with USB mice locking up. The problem is caused by X attempting direct hardware access to the mouse, leading to a race condition with the kernel. Recent kernels trigger the race condition with much greater frequency than older kernels, but the problem has been fixed in recent versions of X. Upgrade your X package to the latest release, and you shouldn't experience this problem any longer.

    Fedora Core 2 test 2 works fine will my USB mice, and I've found it overall the easiest to install of the RPM-based systems. (I'm using Fedora Core 2 before its release because I need kernel 2.6.) I had many more problems with Mandrake 10, but I haven't tried the current release of Suse yet.

  6. Stow: uninstall from source on Build From Source vs. Packages? · · Score: 3, Informative

    Stow lets you install each package in its own directory (i.e., /opt/pkg-x.y.z), then symlinks them into a unified /usr/local tree. Stow -D pkg-a.b.c removes the symlinks for just that package, letting you do a single package uninstall. You can manage the files on a per-package basis, while users can ignore all the details, as it looks like everything is installed in /usr/local/bin to them. Stow provides a simple solution for building packages from source on any UNIX.

  7. Other Database Languages: QBE, Datalog, PL/SQL on Prothon - A New Prototype-based Language · · Score: 1

    While SQL is hugely dominant, other database languages exist. SQL is primarily based on relational algebra, while QBE (Query-by-example) is a graphical language, where queries actually look like tables, and Datalog is a Prolog-like language which is partially based in relational calculus. MS Access supports GQBE, a version of QBE, but I'm not sure if anyone uses Datalog any longer. There are also procedural database languages, like Oracle's PL/SQL and Postgres' similar PL/pgSQL.

  8. Solutions: Cyclone and Stackguard on Analysis of the Witty Worm · · Score: 1

    Excellent post. Moving away from C/C++ is a good idea for many projects, but since there's far too much C/C++ code out there for that to be a universal solution, we need to see wider deployment of stackguarding compilers like the propolice and stackguard patches to gcc 3.x. We also need to look at easy migration paths from C/C++ to a type-safe language, like Cyclone, a type-safe dialect of C.

  9. Prevents some exploits; raises bar on others on AMD Could Profit from Buffer-Overflow Protection · · Score: 1
    Some exploits will be prevented, and the bar will be raised for most exploits. Worms that rely on classic stack smashing attacks will fail on the new processors even if they succeed in their attacks on older machines.

    It's not always possible to execute a return-into-libc attack. What if the function you want to jump to has a NULL byte in its address? In that case, you can't pass that address as part of a C-string. Patches exist to ensure that all functions in libc end in 00 to protect against return-into-libc attacks. For those interested in more details, Horizon's paper on bypassing no-exec stacks on Solaris explains the return-into-libc attack.

    There are also cases where you don't need to insert code into an application. Instead, you can change the return value of a function or the outcome of a conditional security test to exploit the overflow. In such situations, you can achieve your goal by overwriting a variable without injecting code.

    If the stack is protected and the heap is not, you can use a heap overflow to inject code into the heap, then use a stack overflow to corrupt the return address to point to the exploit code located in the heap. However, if the heap is non-executable too, this class of attack won't work.

  10. Source Code Auditing Tools on Exploit Based On Leaked Windows Code Released · · Score: 1

    There are a variety of static source code analyzers that will find potential buffer overflows and other types of security flaws. I like Flawfinder, but ITS4 is also good though it's licensing terms aren't as clear or free as I'd like. There's also Secure Software's RATS, which can analyze several languages in addition to C and C++. Each of these tools generates a large amount of output and you have to have some understanding of security to use them, but they can find potential security flaws that you would otherwise overlook.

  11. pkgsrc may be what you're searching for on Solaris 10 to be Released Late in 2004 · · Score: 3, Informative
    Only a few years ago, SPARC/Solaris was the most standard platform for open source software and IA32/Linux was the nonstandard, difficult one to build on. It's amazing how fast times have changed.

    As for libraries compiled with a different C compiler than you're using to link with, that's a common problem between gcc and vendor UNIX C compilers. However, the vendor C compiler suites shouldn't be disregarded as they offer many advantages over gcc (take a look at some of the Solaris bugs in gcc and gdb.)

    However, if you want something like /usr/ports on Solaris, check out pkgsrc. It's NetBSD's ports collection, and it has been ported to Solaris 8 and 9.

  12. Re:UPN on WB Cancels Angel · · Score: 3, Insightful

    UPN lost millions of dollars on Buffy. While the Nielsen ratings for the first couple of Buffy season 6 episodes were well over 4, the show hovered around the low 3's for over a year before dropping into the low 2's for second half of season 7. (Each Nielsen rating point in that time period represented a little less than a million viewers.) After that disappointment, I don't think UPN is likely to buy a spinoff whose ratings on the WB have generally been lower than those of its parent show.

  13. Unlikely on Scientists Claim They Cloned Humans · · Score: 1
    One negative effect could be that (rich?) people get to perfect their kids by cloning or genetic modifications. Creating kids that are geneticly better adapted, and in doing so creates a class society where normal people will not get good jobs and so on.
    Given the implausibility of such a scenario, I'm not sure why people keep bringing it up. Genetic modification technology will become more affordable over time, but even if didn't, history has shown that the people of the upper classes willingly and frequently interbreed with people of lower social class. You only have to look at the case of Thomas Jefferson's children with his slaves, Strom Thurmond's with his servant, or think about the number of sexual partners a star professional athlete has to realize that the chance of creating a genetically different class is extremely unlikely.

    Look at all the difficulties scientists have in preventing genetically modified crops from interbreeding with neighboring crops. That's with plants; preventing humans from interbreeding will be much more difficult. Plants don't move, aren't sexually active all the time, and don't actively resist you when you tell them with whom they can reproduce. Humans do all of those things. The only way to create a genetically modified class would be to make it impossible to pass on those genes with something like Monsanto's heavily protested Terminator gene technology. Specific issues like the Terminator gene are ideas to worry about instead of having needless fears about all types of genetic modification.

  14. The Lessons of History on Outsourcing As A Source Of U.S. Jobs · · Score: 1

    Trade imbalances between the West and East have happened before. Commerce between the West and East has ebbed and grown throughout the centuries, depending on the current state of civilization and barriers to commerce such as agressive Steppe nomads or the rise of Islam. The last times the West sent vast quantities of its currency to buy goods from India and China, that investment has not come back to Europe. India and China simply wouldn't buy European goods to the same degree that Europe would buy goods from India and China.

    One of those times resulted in the Roman economic crisis, where they attempted to solve the problem by devaluing their currency (sound familiar?), leading into the crisis of the 3rd century, which Rome barely survived and which eventually led to the fall of the Western Empire. The other of those times was at the beginning of the modern era, when Europe saved itself by discovering the New World and using its resources to supply its need for currency. While the current economic crisis may be different, I see no evidence that Japan, whose populace does have money to spend, is buying Western goods at the rate that the West buys Asian goods. Should we expect China and India to act differently when they haven't in the past?

  15. Re:Its getting too much on Outsourcing As A Source Of U.S. Jobs · · Score: 1
    C'mon guys, you cant have it both ways. Either go the complete close economy, as the anti-globalization fanatics preach. No hollywood movies, no pepsi, co coke no McDonalds blah blah, or you have to have it completely open.

    Why do you think such extremism is necessary or even a good idea? No economy today is completely closed or completely open. While we can debate where on the scale we should stand, it's clear that both extreme positions are too harmful for any nation to adopt for long.

    Countries would be foolish to allow industries like defence where security matters or essential ones like agriculture to be completely exported. While the modern U.S. provides too many protections for its farmers, I would suggest that people remember the history of the U.K. and Germany struggling to feed their populations during two world wars and that rationing continued in the U.K well into the 1950's before they decide to let everything be completely open.

  16. Threats to Australia on Australia To Adopt U.S.-Style Copyright Laws · · Score: 2, Informative
    While Indonesia is the closest potential threat to Australia, the Javanese who dominate the empire are a minority and having a difficult time holding together the different provinces which were united only by Dutch colonial rule. While Indonesia has a large population, it's an extremely underdeveloped country--they have about 5 million telephones for that population, for example--which combined with their lack of unity makes it unlikely that they'd invade a first world country like Australia.

    Your numbers are off by a fair bit, as there are approximately 20,000,000 Australians in an area less than half the size of South America, a continent noticeably smaller than North America. The number of Indonesians is closer to 200 million than 300 million (234,000,000 according to CIA World Factbook estimate).

  17. Re:The question to ask is. on India Becoming a Major Hub for Western Job Seekers · · Score: 1
    "Markets" don't exist. People exist. People have wants. They engage in free trade.


    While there is an abstract idea of market, which you can claim doesn't exist in the same way that a mathematical concept like a circle doesn't exist, that's not what people are talking about when they mention markets. When people talk about markets, they're referring to the complex, organized trading systems that function according to government and international regulations. True, these markets are no more physical than the concept of a loan or a corporation, but to say they don't exist is being disingenous.

    Markets don't exist to maximize freedom. Markets exist because people want to trade. Markets were not "invented," markets have existed forever whenever people were not forced not to participate in them. Markets are part of our innate psychology.


    Markets were invented. While that act of invention was some thousands of years ago, it doesn't mean it didn't happen. There are different, older means of exchanging goods that don't resemble our modern concept of a market. For the vast majority of our history, we existed in small tribes of a few dozen people where opportunities for trade and storage of goods were extremely limited.

    The idealistic concepts of capitalist man and communist man both reflect part of human nature, but both are deeply flawed because they don't attempt to reflect our entire nature. Both sharing and exchange were essential to our tribal life in their appropriate contexts. Economics won't become a science until it establishes consilience with psychology and biology and thereby bases itself on a scientific understanding of human nature instead of absurd idealistic assumptions based on tiny splinters of our psychology. If capitalist societies are foolish enough to follow their idealistic model of man as far as communism did, the results will be the same: a wealthy, powerful ruling class and a vast majority of oppressed people who will eventually bring the system down.
  18. How to Pay Less for your Textbooks on Ripoff 101: Gouging Students for Textbooks · · Score: 1
    Textbooks are often 50% cheaper if you order them from Amazon in the UK, and you can get cheap paperback editions from India for around 5% of what you pay for an American hardcover. There was an earlier Slashdot story about this: For Americans, Imported Textbooks Can Be Cheaper. Links to various international alternatives can be found in the comments as well as in the article.

    If you don't know what your textbooks are early enough to order overseas, buy your books from an online store like BookPool or ecampus.com, both of which are generally cheaper than Amazon for Computer Science texts.

  19. Social Security, Investment, and the Future on Scam Combines Patriot Act FUD With IE Bug · · Score: 1
    Social Security is not an investment scheme. It's a PAYG (pay as you go) pension plan, where your taxes pay for the benefits of current retirees. There's not a dime invested now, nor will there ever be one unless social security is privatized.

    What about the social security surplus you've heard about? It's spent year by year as part of the general fund. The government supports the general fund debt by selling bonds to the social security fund, but issuing bonds to yourself is not an investment scheme. That means that the government will pay for social security from the general fund in the future. It also means that deficit spending of current proportions will be impossible in the future since the social security fund will no longer exist to be a "buyer" of government bonds.

    The social security tax does accomplish some goals which our government views as important:

    • Creates the illusion of an investment.
    • Makes us think we're paying less in income tax, by separating it into two taxes.
    • Reduces income taxes for the rich, as the federal income tax structure peaks at the 43.3% (28% income + 15.3% FICA rate), then goes down to the 28% rate (no FICA) then up a couple of steps to the rate for maximum earners of 35% rate.
    Will there be a social security when you retire? I suspect it will be, but there will need to be a combination of lower benefits and higher taxes to pay for it.
  20. Learning and Applying: the test of time on Student Fights University Over Plagiarism-Detector · · Score: 1
    A few years later, I'm looking at job sites on the web, and they all want C++. Guess what. I learned Java in college, because they were, and are, convinced that "*C++ is dying!!!111", a common meme from the early Java days that refuses to go away.

    I'm going to guess that you're young by your mention of learning Linux and Java in university. Neither technology existed when I went to university. Neither did C++, ANSI C, or Windows for that matter. Computer technology changes and you can't expect to learn most of the technologies you'll use in your career in college.

    That's what the theory courses are for--to teach you the aspects of computer science that aren't as likely to change. Wait until you've had a few different jobs, or just think about other students who aren't doing precisely what you're doing. The university can't tailor its curriculum to every student going through, even if your professors were magically prescient and knew just the technologies you'd use in each of your jobs.

    Oh, and all those boring theory classes I wasted my time on? Irrelevant. Never have I needed to know anything about calculus, algebra, automata theory, artificial intelligence, declarative programming, or even statistics. Heck, I hardly ever use floats or do anything more complex than i++ in a for loop.

    If you're using variables, you're using algebra, so I expect you use it every day. I found automata quite useful when I spent a few years reading RFCs on network protocols, and writing or debugging finite state machines that modelled the protocols in clients or servers. Techniques like functional, declarative, and object-oriented programming all have their place, and I've found them all useful in one job or another. Most programmers don't use a lot of Prolog, but XML DTD's and context-free grammars like yacc are both declarative techniques and I've used both more than once.

    Assembly and an understanding of computer architecture was useful when I was doing hardware-centric programming too. I've also spent a fair amount of time doing scientific programming, which covers the rest of the classes you listed except AI, though I've never seen AI as a requirement so I suspect you chose it as an elective. However, I have a friend who writes AI-teaching software, so for her, it was a class that directly applied to her job.

  21. End Times or Transitions on Interview with Bruce Sterling · · Score: 1
    You could argue that the loss of morals ended the Roman empire
    Except, of course, that the decadence of Tiberius and Caligula that people point to as marking the decline of Roman morals, was over four centuries before the fall of the Western Roman Empire and over a millenia before the fall of the Eastern Roman Empire.
    but that wasn't the end of the world, just another change in it.
    However, this is a good point. The Fall of Rome was a disaster at the time, but the history of China reveals the problems with a monolithic empire. Zheng Ho had far better ships than Columbus in the early 15th century, but the succeeding emperor declared an end to his explorations and after a generation passed, China lost its knowledge of maritime technology, allowing Europe to dominate the oceans for the next few centuries.
  22. Compensation without Control is the answer on Head Of ATF To Direct RIAA Anti-Piracy · · Score: 2, Insightful
    If you're going to turn around and tell me that it's your right to download all the music you want and that the copyrights placed on the music is null and void, then I'd have to respectfully disagree with you.
    Copyright is a human creation: it's supposed to be a compromise between the writers and the readers of copyrighted works. There's no reason to let a law written by the RIAA and other old industry interests suppress new technologies like Napster. Copyright law has always changed with technology and the rise and immediate reaction to Napster and its sucessors is no different than what happened with cable TV and many other prior technologies. When producers of television shows complained that the newfangled cable television providers were "stealing" their shows, the cable TV providers said it was their right to record and rebroadcast the same shows that TV stations had paid for and were broadcasting.

    The solution was not to allow the old industry of broadcast television to sue the cable TV companies out of existence under an old copyright law which was written without the participation of cable TV interests. Complete control over all uses of works is not a right that has ever or should ever be granted to owners of copyrights. Such a right would end the development of new technologies and tremendously reduce innovation in any country foolish enough to grant it. However, compensation can be given without control, and that's what's been done in the past as in the case of cable TV. The cable TV had to pay a license fee, but the old broadcasters could not restrict the cable TV companies from licensing any TV program they wanted. That's the solution that should've been applied to Napster. It grants both parties a reasonable settlement and allows people to continue to innovate.

  23. Re:OK, but the fact is copyrights are still wrong on Linus Corrects Darl on Copyright Law · · Score: 1
    Oh please, you're arguing semantics. Fine, you are granted rights to control how the work is distributed, for a limited period of time.
    Semantics are important to rational debate. If we're not careful, people like you will define themselves as correct in these matters by sliding implicit assumptions into an argument using clever semantics, like calling copyrights "property" or copyright infringement "theft," when there are substantial conceptual, legal, and ethical differences between property and a limited monopoly over ideas.
    Really. Well, I wrote my book/poem/etc with my own computer in my own home using electricity I paid for. Oh, wait, because all those things were built by society?
    And you also invented the English language, the concepts of the novel and the poem, the history of English letters upon which all such works are based. Shakespeare produced most of the plots of English literature centuries before our modern novels and even he was rarely original. No work of literature is created ex nihilo. Every literary work owes a great debt to society.
  24. Citing URLs has been appropriate since 1991 on Web Pages Are Weak Links in the Chain of Knowledge · · Score: 2, Informative
    The idea is that you generally have to cite peer-reviewed, published and presented articles; criteria which the majority of web published material simply does not satisfy.

    While it's obvious that not every URL is appropriate for a research paper, papers in high energy physics have used URL-references to preprints at arxiv since 1991. It's not surprising to see some less technical fields like anthropology further behind in understanding and using the technology, and high energy physics has a particular advantage in that the web was originally created for disseminating information in that field.

    People interested in the evolution of an electronic knowledge architecture that's gradually replacing the print one in some scientific fields will likely find the articles Creating a global knowledge network and Can Peer Review be better Focused? interesting. Both are by Paul Ginsparg, who started the preprint archive 12 years ago at LANL.

    It's also worth noting that free, public access to preprints has democratized physics research, as all researchers have access to timely information instead of only a few who had the right connections to get early copies of preprints before 1991. It also provides affordable access to physics articles to researchers at institutions whose libraries can't afford the 5-figure subscription fees of many modern scientific journals.

  25. Excellent Point regarding Books on Companies Move Away From Cubicle Culture · · Score: 2, Informative
    I need my technical books too. While electronic books do exist, physical books have substantial advantages over them which more than make up for the lack of keyword searchability.
    1. You often need to read the book and your full screen at the same time. You can buy another monitor, but what if you want to refer to two books? You always have more affordable desk space than screen space.
    2. All the books you need aren't available in electronic form. I recently gained access to Safari and some other electronic books, but they cover less than 10% of what's on my bookshelf so they certainly can't replace it.
    3. Resolution. Books are printed at around 1500dpi, while screens are generally around 100dpi. Books are easier to read.
    4. Paper is an absorptive technology, while screens are projective. Once again, books are easier on your eyes.
    5. Books are more portable. They're fairly light and they don't require power. I can confidently carry my book on the plane across the Atlantic without worrying about power adaptors or battery lifetime for my trip.
    6. Books don't support DRM software.

    As you can see, electronic books are a long way from being an adequate replacement for paper books, though I'm looking forward to digital paper which will alleviate some of the problems with electronic texts, being an absorptive display technology and so not requiring a constant power flow.