Slashdot Mirror


User: hackstraw

hackstraw's activity in the archive.

Stories
0
Comments
4,286
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,286

  1. Re:Okay, let's give an example on Cross-Platform Java Sandbox Exploit · · Score: 1
    There are quite a few people out there who refuse Java "on principle". My website is for a radio program. Audio is an intrinsic part of the overall equation. So what are the alternatives?

    Ah, so this is why we have been going at it all afternoon :)

    Hey, trust me, I have no intrinsic dislike for Java. I wasn't born that way. Just like I have been saying, it simply hasn't worked in my experience. Be it correlation or not. I'm only human or just like any other living organism, I try to avoid pain and go towards pleasure. Java has been painful for me. I believe Sun has hyped that they even rebrand someone elses Linux distro and throw Java at it.

    Also, if I were to go to your site, and wanted to listen to your Speex files, I would turn on the Java plugin. And honestly, if it worked, I would probably tell anyone interested about something written in Java that actually worked.

    It's not that I think Java is perfect. It's that for many tasks, it's the best tool for the job.

    If it works, I have no beef with it. The high number of failures beit from the developer or from the JVM or somewhere else from so many different developers and companies, to include Sun, has simply left me with the feeling that Java is not the right tool for the job. If it doesn't work, what am I to think? Yeah! On clicking the "Next" button on this installer it crashes! W00t! Oh, I just have to reboot in a color pallete with fewer colors because there is a bug in the JVM. OK. Obviously Java wasn't the right tool for the job.

    As far as ActiveX goes, my hatred of it is a different animal than your hatred of Java. I cannot and will never trust ActiveX precisely because it's native code. You cannot build a code sandbox around a technology that allows direct pointer manipulation. Period. The use of ActiveX in all but the most rare intranets is absolutely unforgivable in my opinion from a network security perspective.

    You obviously know more about this than me. I'm not too Windows literate, but I have not heard anything positive about ActiveX. But I don't care. I will not come across it in any of the immediate foreseeable future.

    Regarding NullPointerExceptions -- any unchecked exception for that matter -- and the end-user/developer divide, I couldn't disagree more. Developers get their bug reports from end-users. Stacktraces, being text, fall into log files easily. These log files get emailed to developers in "incident reports". Core files don't fall into log files quite so easily. Printable stacktraces with line number references was one of the best things to happen to the client-debug-patch loop in the software arena. Released binaries with debug symbols stripped out (as is common in shipped software) can be an absolute nightmare when trying to replicate in-house.

    Excellent point. I havn't programmed in Java in years, but if there is a catchall exception handler and I were programming in the language, I would do something like this pseudo code:

    catchException *

    dumpStackTrace(Logfile);

    print "There was a fatal error. If you feel this is a bug in this program please mail
    me@here.com with the contents of ", Logfile, "\n";
    .
    exit(1);

    I don't know if there is a default exception handler in Java. But something as simple as that would be much, much better than leaving a stacktrace on my screen. That would save face for both Java and the application itself.

    You hate Java for how it's been used. I hate ActiveX for what it is, its underlying design. There's a fundamental difference there.

    I disagree. I've established I cannot comment on ActiveX, but Java is supposed to be cross platform, yadda yadda. You know as well as I do. To me, if it were the right tool for the job, I would not have these opinions. In fact, I would probably develop in Java. I'm very interested in crossplatform portable stuff. The concept really inte

  2. Re:AMD Better Get Its Act Together on Intel Quietly Adopts AMD's x86-64 · · Score: 2, Informative

    This is in addition to Intel performance-enhancing compilers.

    You mean those compilers that AMD uses for their benchmarks?

    When performance matters, you need an end to end solution. Intel delivers. However, AMD might be able to benchmark well with 64bit apps as soon as they use Intel's updated compiler.

    For those that don't know. Most all of the AMD64/Opteron bencharks were done with the Intel compiler in 32bit mode.

  3. Re:Win2K is just as bad. on How Much Harm Can One Web Site Do? · · Score: 2, Insightful

    I reciently installed a new win2K system and installed the latest service pack 4.

    I also killed all the services. and it never ran a web browser. Just mysql. I didn't have any antivirus software on it.

    So after placing it on an unfirewalled connection in a locked room, withing 2 hours there were over dozens of virus, worm and spyware installed on the system till it crashed and couldn't even boot. Coming up with 100's of DLL errors!

    Again we never open a single web page.

    Specificaly some of what was installed was:

    [ snip 40 executables & libraries & whatever else was here ]


    W2K is still a supported product. If you have any kind of maintence or service contract with the vendor I would strongly suggest you ask them to fix the product. You may want to seek legal advice.

    It kills me that people actually _pay_ for this kind of crap.

    Can you envision any other single supported product that you can bring home and plug it in and have it basically self desctruct?

    Sometimes I secretly wish I were greedy and ambitious enough to be a snake oil salesman and have much of the world's population give me money and respect me for it.

    Unfortunately, I have too much personal pride and respect for my fellow man.

    So long as people put up with this, it is only going to get worse. Every day I'm more convinced that people's IQ halves in front of a computer screen.

  4. Re:Regarding the Video... on How Much Harm Can One Web Site Do? · · Score: 1

    It would have been different if the Windows Media Player for OS X actually played half of the WMVs out there. It does not play this one. When can I be completely M$ free?????

  5. Re:You're missing both points on How Much Harm Can One Web Site Do? · · Score: 1

    if you then walk in and steal my TV while I'm gone and sell it at the local pawnshop you're still just as much a criminal as if you smashed a steel door in with an APC

    B&E (Breaking and Entering) is a separate offense than theft or larceny, and depending on the value of the TV, odds are its a worse offense (in the US).

    The same principle applies here: the sites and software authors are not the legitimate businesspeople they try to convince everyone they are.

    As I posted yesterday:

    raud (n.) -- A deception deliberately practiced in order to secure unfair or unlawful gain.

    Fraud in the US is illegal.

  6. Re:Disable Java on Cross-Platform Java Sandbox Exploit · · Score: 1

    I couldn't do without Java on my mobile phones these days.

    What??? I've had a mobile phone for years. Never once considered having a JVM on the thing.

    Just out of sick and morbid curiosity, what does Java give you on your phone that you cannot live without?

  7. Re:Disable Java on Cross-Platform Java Sandbox Exploit · · Score: 1

    Ever notice how when people say stuff like that, it almost always means, "More people should be like me."?

    In this case it does mean that.

    Its foolish for a web developer to depend on a 3rd party plugin to view their site. If you want some platform specific application, then just write a platform specific application. For me, I currently use 3 OSes -- Solaris, Linux, and OS X on 5 different architectures. Its annoying to have to abandon looking at a website because there is no plugin for my specific architecture and OS. The web is supposed to be portable. KISS. Text and images can do a whole lot. Hell, text by itself can do a whole lot.

  8. Re:Regarding Java on Cross-Platform Java Sandbox Exploit · · Score: 1

    You would guess wrong. I have coded for appservers, applets (where I started with Java), and standalone applications. AWT since the 1.02/1.1 transition and Swing since the 0.5 beta.

    OK. But it was a good guess. And I am glad to have this discussion with someone that is knowedgeable about the subject.

    I have also had FAR more problems getting GTK+ to work on X and Windows.

    Hmm. Mentioned the W word. That is another thing I don't touch because of too many bad experiences. No other comment.

    It's like nitpicking that HTML isn't crossplatform because h1 tags use a different default font and sizing depending on the browser/platform.

    Not really. HTML's H1 tag looks good enough. Its big, bold, and there is some padding under it. Thats good enough. No bugs added. Maybe the Swing stuff has gotten better, and it should be better than AWT ever was, but the whole point of Java initially was to be a crossplatform GUI language, that was not HTML's goal.

    As for the statements "Perl works" et al., you haven't left the traditional UNIX world lately have you?

    Nope :)
    Go to Windows and you'll find out how many vaunted CPAN modules were written for UNIX only.

    Ditched Windows years ago.

    Go to OS X and tell me how easy it is to install the Python Imaging Library, a very common dependency for many apps.

    I said it mostly works.

    Done much debugging of C++ where templates (including the STL) are used extensively?

    Shutter. Again, I said C++ mostly works. Templates, good idea in theory, but good luck in doing any kind of portable project that requires templates. For that matter, C++ is very difficult if porability is desired. No 2 compilers can agree on what the laguage is. C++ is fine in a specific environment. I believe that C++ and MFC is OK for Windows apps, but that is a pretty specific case, and another discussion.

    Yes, this is largely because the JDK/JRE aren't allowed to be redistributed with the operating system in most cases. Yes, this is the biggest reason why Java should get a more liberal license. But there is nothing inherent to the VM setup or libraries that makes it inferior to the others.

    See, Java was pushed down my throat. Not too many years ago you could not apply for a job without at least 15 years of Java programming experience. (Yes, an exaggeration, but people now want things like 5 years of C# experience, you know what I mean.) Sun has pumped this puppy hard. I don't know why. I'm unsure if they make any money off of it, but then again they have trouble across the board in recent years.

  9. Re:Don't Disable Java on Cross-Platform Java Sandbox Exploit · · Score: 1

    So you have plugins including Java applets turned off but then say you haven't seen any useful applets. So let me get this straight: you hide them and then complain that you can't see any good ones.

    If I come to a website and see a mostly blank page my 1st guess is that is a flash site. I turn on the plugin and reload the page to see if there is any content there. Again, I can't remember the last time I had to go enable the Java plugin to view a website. From what I remember, 99% of all Java junk on websites are goofy eyecandy that make's my laptop hot. On that note, that is why I don't enable plugins (basically flash) because they are pretty much exclusively used for advertisements, and they are very annoying and I cannot stop them from animating like I can with a GIF image. The same goes for flash that goes for java. Its simply unnecessary for most all of its uses. There are some pretty cool flash animations, but I would personally be happier if I could just download them and view them in a flash viewer. I do not need nor want this crap inlined with standard text and images on a website. Its annoying to be listening to music or watching TV and have some silly flash thing overpower that or annoy a friend or coworker. Again, if I'm interested I would prefer to download the toy and play with it at will. I do not want or need it to load automatically. Sorry for the flash rant, but my opinions are similar for Java, and Java and the "plugin craze" that was going on in the late 90s just got me so turned off to them that I have dismissed them. My prediction is that the next version of spyware will be browser plugin based. That way you can get some kind of consent by installing the plugin, and get away with doing things that the user probably does not want you to do. HTML, CSS, JavaScript can't and don't do these thins. Again, sorry for the rant.

    Have you used Java since the old Netscape days?

    Not really. Only when absolutely necessary for something like the Oracle installer or Solaris web installers.

    Well... except for that one applet that was a site logo rippling like it was underwater. Pure eye candy that sucked up 60% CPU time sustained on a 3GHz processor. Once again, good technology, bad applet writer.

    Small comment. But this is the junk I just don't want. I know that ripple applet (or lake or something), and its horrible and simply unnecessary. The problem here is not with the technology, it with people. Invariably, some people have this "give me an inch and I'll take a mile" thing going on. I'm sure you have seen a browser popup ad before, right? Fortunately javascript has become useful again and stabalized since decent browsers took away the ability to do dumb stuff like popup windows, resize windows, raise/lower windows, and change the text on the status at the bottom of the browser window.

    And I sure as hell am not going to use ActiveX for that even if it was supported on non-IE and non-Windows environments.

    Hmm, do you have some kind of beef with ActiveX like I do with Java?

    By the way, your mention of NullPointerException is funny to me. Take a C app and access a null pointer. Boom! Hope you have core files enabled so you load the image in a handy debugger. Take a Java app and access a null reference (pointer). Not only can the exception be caught so that it doesn't completely take down the app, but you get an easy to read (relative to C and C++) stacktrace telling you exactly where it occurred so that you can fix it.

    Not my job. I've already paid for said software its supposed to work. We are talking about two different things here. I'm talking as an end user and your talking as a developer. Yeah, I know that accessing a NULL pointer in C will dump core. I guess I can agree that I maybe misdirecting some of my past frustrations on Java vs. poor Java developers. But oftentimes there is a Java part of a bigger software package like the installer, and the package works once

  10. Re:Regarding Java on Cross-Platform Java Sandbox Exploit · · Score: 1

    One is that I've been coding in Java for years and yet I find no more bugs than I come across in common C or Perl libraries.

    I'm guessing that you coded in Java for appservers or something similar? This is where Java has landed. It was not intentional, but also not by accident. Initially, Java was supposed to be the end all be all write once run anywhere GUI language. People experienced the same problems that I did with the Oracle installer and with Java applets looking like ass on different platforms and/or browsers. Java quickly became known as "write once and run nowhere" or "write once and crash everywhere".

    My point, is that I realize that some people do use Java effectively, and it has come to be in the appserver or whatever you want to call it between a web server and a database. Also, this is kinda of a niche environment that is under fairly tight control. This is simply not my experience with Java as an end user application. (Aside from the Websphere junk).

    Problems with CLASSPATH? Right. Like people don't have many of the same problems with PATH and LD_LIBRARY_PATH.

    Its pretty common knowledge that using LD_LIBRARY_PATH is a hack and has obvious security issues, and should not be used unless it is absolutely necessary. LD_LIBRARY_PATH can be fixed with /etc/ld.so.conf or using the -R linking flag for those linkers that support that, or some other sane fix.

    The same arguments can be made for CLASSPATH.

    Your problems are inherent in splitting programs into modular pieces, not with Java specifically.

    I'm sorry, but no. My problems are with Java. Just about every program is split up into modular pieces. Perl works. C works. C++ mostly works. Python mostly works. sh works. awk works. Java, although it very well may be near 80 to 90% working, its that 10 to 20% of the time that has wasted my time, my coworkers time, and my users time.

    Again, I have no inherent beef against Java. Its just that my experiences have been so negative for so many years, that I have been conditioned to dislike the whole thing.

  11. Re:Regarding Java on Cross-Platform Java Sandbox Exploit · · Score: 2, Insightful

    You sir are reacting like an idiot.

    Thanks!

    You list applications that do not work and then blame the language. Blame the application writers, not the language.

    I don't have an issue with the language. Its the buggy runtime environment (jre) that I have an issue with. The language has many good features. From what I understand, its one of the best languages to program in. But since the jre is so finicky and broken, its not worth it to use the language, no matter how good it is.

    Another issue that I have with Java is the CLASSPATH stuff. Its simply too difficult on a multiuser system to maintain a clean environment for all users. Again, this is from years of experience and pain.

    Yet another 3 bugs I just remembered with the jre is a web installer toy that would not run by typing /path/to/application, but would run by cd'ing to /path/to and then do ./application. This was due to a CLASSPATH problem. This was for a mature commercial product. Another interesting bug with Java was I have had issues with Matlab randomly not dislpaying to a remote X server. I've had this too crash yet another web installer that could not correctly display to a remote X server.

    Again, I have no beef with the Java language, its the Java implementation that simply has never worked that has pissed me off too many times since Java 1st came out. Its been, what, almost 10 years now, and I still cringe every time an application that I have to use is written in Java. I'm firm with this, and again is just from years of painful experiences.

  12. Re:No root privilege escalation on Cross-Platform Java Sandbox Exploit · · Score: 2, Insightful

    I run as root and as Administrator because i'm too lazy to set up actual, proper permissions and accounts. That doesn't mean that I couldn't, just that I don't.

    This will change when you get a job. I recommend breaking this habit soon.

  13. Re:Disable Java on Cross-Platform Java Sandbox Exploit · · Score: 2, Interesting

    Disable Java in your browser unless you absolutely need it (rare). Period.

    Why is this flamebate?

    My browser has _no_ plugins running by default. Also, my browser (Safari) has a separate Java and plugin preference checkbox, and I rarely load Java. The last time I did was to look at some buggy applet that someone wrote at work.

    Over the years I have come to dispise Java. It would be different if it worked, but for me, Java has caused many problems, and I have seen 0 benefits from it.

    So, I won't get modded as flamebate as well, I'll elaborate.

    Oracle's "Universal Installer" is written in Java so that it could be crossplatform, etc, etc. to make it easier and universal for people to install Oracle. How convenient that it took me _hours_ to install it on a NT machine because of a bug in Java made the installer fail if the display was using more than some arbitrary number of colors (256, 16k, dunno, don't care). Thanks.

    There are many "web installers" or whatever written in Java for Solaris machines. I've had these fail about 40% of the time.

    I've had Netscape crash at least on the order of hundreds of times because of Java.

    Java in a browser applet is very slow loading.

    My brand new Apple Xserve RAID came with a GUI admin program written in Java. It worked for about a week, now it doesn't, and I have to call Apple and bitch when I get the time.

    Java applets _never_ looked near the same on different OSes or even on the same OS with different browsers. Besides the silly thing a coworker wrote, I don't rememember the last time I had to load the Java plugin for a website.

    I have installed Websphere once, I won't go into details from here.

    One of Java's cool "features" is that it does not have pointers. I can't tell you how many times I've run a Java program and gotten a traceback which mentions a "null pointer exception".

    I'm familier with Java for years. This is not some blind "this sucks" thing. I've coded in Java to write applications and applets that run native on a normal OS, and in browsers, and on embeded devices like smartcards and iButtons.

    I don't particularly care for Python either, but at least most of the python applications that I have used work, so I have no real objections to it besides I just don't like the language or the quirky way python and python programmers do things. For example, the damn #!/usr/bin/env python thing kills me. Try explaining to (l)users over and over again that there are 2 versions of python on the system. One in /usr/bin one in /usr/local/bin. If the (l)user has sufficiently screwed up their PATH statement, or uses a broken shell (like bash which cannot decide which dotfiles to load under which invocation, don't get me started with (t)csh)) then the wrong instance of python gets loaded, and I have to go through my speach again about how #!/usr/bin/env python is wrong. But since it works most of the time, I don't rant about it like Java.

    I'm just talking from my experiences here, and I have not had a pleasant experience with Java.

  14. Re:No root privilege escalation on Cross-Platform Java Sandbox Exploit · · Score: 1, Informative

    A unix-like OS like Linux is somewhat safer than Windows, as one user account compromised doesn't trash the stuff that user doesn't have read/write permissions on (such as root or other users). So it's possible to contain on Linux, but on Windows... people usually run as Administrator.

    BFD. Most machines that are used for surfing the web are single user machines and having that users stuff trashed is the same as trashing the whole machine.

  15. Re:Java != Java Sandbox on Cross-Platform Java Sandbox Exploit · · Score: 1

    Its the browser-based sandbox that's the culprit here, not Java. Saying its a problem with Java, is like saying an IE exploit is a problem with HTML.

    I believe this is completely wrong. First, if the problem were in the browser and not Java, how did Sun fix it on 2 different operating systems and there was not mention of a specific browser.

    Also, AFAIK, the Java plugin does have a sandbox which prevents Java toys from doing things like accessing local files, etc. It takes a trusted and signed applet and user intervention to go outside of the sandbox.

  16. Re:Another good reason to allow third party review on Cross-Platform Java Sandbox Exploit · · Score: 1

    Actually, its another good reason that I don't load any plugins.

    I only enable them when I'm staring at a blank page and for some morbid curiosity I want to see what is on the site.

  17. Re:What about the bookstores? on Amazon Japan Offers Barcode Purchases via Camera Phone · · Score: 1

    Japan does other weird things like splitting books into two halves

    In the US we have wierd stores like Cosco that put two boxes of cereal and put them in a 3rd box.

  18. Re:Betamax gets the last laugh on The VHS is Dead · · Score: 1

    What do you do? Watch the movie, then complain when you return it and ask for a refund?

    Yup!

    I'm pretty sure I could parley that into a free rental, if I pressed the issue, but when I'm bringing DVD's back, I want to get it over with, drop it in the slot and leave.

    Fine. Pay to watch commercials. I'm not.

  19. Re:Betamax gets the last laugh on The VHS is Dead · · Score: 1

    I don't pay for scratched rented disks. Nor do I pay for the ones that disable me to skip commercials.

    Do you?

    If so, why?

  20. Re:Everyone already HAS a VCR!!! on The VHS is Dead · · Score: 1

    I'm 34 and never owned a VCR.

    I hate all tapes. Cassettes, VCR tapes, and unfortunately I still have to use computer tapes for work.

    I'm patiently waiting the end of sequential media.

  21. Re:For now, I'm letting it go to hell on How To Manage Your Home Directory? · · Score: 3, Insightful

    Me too. I just thow crap in my home directories until 'ls' simply outputs too much stuff, and then I clean up.

    My personal machine is a mac as well, and my safari download location is my home directory. I actually like my home directory messy :) It makes a quick 'scp' easier because I don't have to type or remember the path either on the 'to' or 'from' machine. I always know where my current files are. Simply typing 'ls' is pretty much always useless. 'ls -lotr' is usually better. WIldcards really help.

    I consider stuff in my home directory as kinda temporary and/or immediate files. Meaning that I could be using them for the next couple of months or so. I find it too easy to use wildcards and to sort by time to waste my time cleaning up stuff. If someone mentions a PDF that they sent me last week I do ls -lotr *.pdf Odds are its near the bottom somewhere with a filename that makes sense.

    Now if something is important enough that I want to keep it semi-indefinitely, I put it somewhere where I can find it later, most likely on 2 different computers, and often one of them gets backed up.

    I thought of writing a cronjob to go and touch all of the file in my home directory that do not begin with '.' and are not directories and have a timestamp of older than 24 hours, and automatically moving junk to some directory after 14 days or so, but I havn't done that yet.

    I guess my point is that 1) besides my '.' files, I consier all files in $HOME to be basically temporary. Most of them are downloads which are located in safari's download manager for some time, and are also easily reobtainable. I don't mind the mess because filtering, grepping, sorting makes finding something trivial. Once things get "out of hand", I clean up. Sometimes I just move bunches of junk to a new dirctory called 'stuff' or something, and after its been in stuff long enough and I havn't needed any files from there, I just toss stuff. 2) I put important files in logical places where I know important files go. And, I always have at least one form of redundancy.

  22. Re:Of course we can't compete! on Report: Broadband In US Homes Nearly 20 Percent · · Score: 1

    Once the prices drop to a reasonable level a larger percentage of people will likely switch.

    Most everyone I know from about 16 and older is willing to pay at least $50 a month for a telephone and most adults pay at least $40 a month for television service.

    In other words, its priorities. Most Americans are content with talking on the phone with people while driving, walking in public, "working", and shopping, and vegging to TV at home after work until they pass out.

  23. Re:It's interesting on Failing Grades For Most Anti-Spyware Tools · · Score: 1

    Give some proof. I've never heard of this.

    http://slashcode.com/

    Get the code and search for:

    "Due to excessive bad posting from this IP or Subnet"

    Also, google for that phrase.

    This also happened to me and I am a subscriber, and have a pretty clean posting record and my karma has been labeled as "excellent" for years. I don't remember it ever not being "excellent".

    It could have been someone else on my subnet, but I don't know. I almost ditched slashdot for good after that. It pissed me off pretty bad.

  24. Re:It's interesting on Failing Grades For Most Anti-Spyware Tools · · Score: 2, Interesting

    spyware almost always hides its true intentions deeply into some EULA nobody reads

    spyware usually is very hard to uninstall

    In other words, spyware like most spam depends on a business model based upon deception. Using deception in a business model is also known as fraud.

    fraud (n.) -- A deception deliberately practiced in order to secure unfair or unlawful gain.

    Fraud in the US is illegal.

    Therefore, most spyware and spam are alread illegal in the US.

    Look lawmakers you can give yourself another raise and take the rest of the day off. Your work is already done!

  25. Re:It's interesting on Failing Grades For Most Anti-Spyware Tools · · Score: 1

    (and what made you think you'd get karma for admitting to writing spyware?)

    Not to mention that posting anonymously while logged in can get your entire subnet banned from posting to slashdot. This can and does happen if your karma is "too low". And "excellent" is not high enough to be "too low".

    Moral of the story. Log out before posting anonymously.