Netscape JVMs Can't Divide...
on
Pet Bugs?
·
· Score: 2
I was implementing a public key encryption algorithm for Java in Java 1.0 so applets could use it in the bad old days. I had to write a big-number package from scratch using algorithms out of Knuth vol. 2 since BigInteger wasn't in JDK1.0. I finally had it debugged on Windows, but I was getting garbage when I tested the apps on Macintoshes. Eventually, after many hours of debugging, I found that Netscape's JVM couldn't divide long integers properly, but only on the Mac, and only for certain values. You can imagine how frustrating it was that I was generating random numbers for every key, so the error would only occur once in a while.
The Netscape engineers finally acknowledged the bug, but it took them about 8 minor version upgrades of the browser before it got fixed. I ended up just hacking it to use a smaller internal radix on the Mac, which seemed to get rid of the problem.
The thing that makes me nervous is the secret key being stored on the machine that houses the database. The reason for this is so that our billing staff can handle the recurring billing. (They have a web interface where they must enter the passphrase to gain access to the credit card information.)
I'm not sure I understand the question. Why is the secret key stored on the machine? Is it stored in cleartext? If it is, that's a problem. The trick here would be to encrypt the secret key on the machine using the billing staff's password (or a hash thereof), and only decrypt the key when the password is entered. If you change the billing folks' password, you can re-encrypt the secret key with the new password. That way, you'd at least have to run a brute-force on the password (which may not be that hard, depending on how you pick passwords).
An alternative is to use a more secure mechanism than passwords for authentication--something like a keyring dongle or somesuch, but that makes things more complicated.
Don't forget having to run your own assembly and tech support shop as well. I can usually coerce somebody to come out from Dell and replace my broken (video card, motherboard, CD-ROM drive) with little effort here at work if the need arises and it's covered under warranty. At your shop, YOU are the warranty guy.
Also, factor in the labor costs (which will be substantial), count the amount of time it will take for you to assemble a machine, the cost of ESD straps and mats (you will be using ESD mats, right?), the time it will take to set up an assembly area, and the space that will take up, etc.
I used to build machines for other people (family members, etc.) Now I just tell them all to buy a Dell because the hassle on me to maintain them is WAAAAAY less. The only machine I build myself anymore is my personal box, because I spec out stuff that is too high-end for a manufacturer like Dell anyway.
For the end goal (that is, no bundling) to be achieved, Microsoft can simply remove the Internet Explorer icon (and maybe iexplore.exe) from the desktop, right? I mean, sure, there are a few small other places it's integrated (explorer.exe will start internet explorer if I navigate to a URL rather than a folder), but they wouldn't actually have to remove anything but the code that starts the browser and the justice department would be pretty happy (i.e. not be able to tell the difference). I suppose this would make the IE download awfully small, too...
The problem here isn't that we should explore how to make software expire to force system administrators to do something, but to create *better deployment technologies* for our software. Microsoft has a pretty good edge on deployment, informing users when there's an upgrade available and allowing them to upgrade.
Even if you don't like how Microsoft does its deployment, certainly some sort of standard, well-managed deployment system for OSS could be developed.
How long do you think before Cringely gets a big'ol LED and tries to establish a high-speed connection from his house out in the sticks over the hill into Santa Rosa?
It seems that one of the repeated claims about open-source software is that the best developers are sort of self-selected in a meritocratic system. However, throwing college undergrads at the problem certainly isn't going to garner a whole herd of the "best developers" out there. In fact, most of them will be downright awful.
So, would this be useful, or would it end up throwing a lot of buggy, fragile patches at software and overwhelming the lead developers?
The real problem here is a lack of natural selection. Stupid people just don't get eaten by predators, because we invent means to defend them (and for them to defend themselves).
As such, I advocate a campaign of thinning the herd every once in a while.
As I recall, Indiana Jones and the Sons of Darkness was never a real working title, but instead the title of a ficticious screenplay that circulated the Net some years ago.
Also, I think the last official rumored title was Indiana Jones and the Lost Continent or somesuch (before they tried to get M. Night Shyamalan onboard to do yet another script), chronicling Indy's search for Atlantis--not to be confused with the LucasArts game, of course.
"However, after about a month into deployment I started noticing strange problems with the machine. Intermittent lockups were the most common. The lockups appeared physical, and the machine was unrecoverable without a reboot.
While performing research on the problem, I learned there was a serious sync() bug in the 2.4 kernel. This bug exists in all kernel 2.4 versions until 2.4.6."
Intermittent lockups? Serious bugs in the kernel? For five straight minor releases, no less! This is beginning to sound like Windows! Where are the trolls who post about the Open-source movement completely preventing and/or eliminating this sort of thing?
I don't think ANYBODY should be held liable for Usenet postings they made when they were 14 years old...it's like having naked baby pictures of yourself stapled to your forehead when you walk around...
On the other hand, you can now go back and see who REALLY won all those flame wars you were involved in:)
I'll buy it and read it, but only for what it's worth. I got the feeling at the end of Mostly Harmless that he had pulled a Charlton Heston at the end of Beneath the Planet of the Apes--that he wanted to end the series so finally that no sequel was possible. A little like he was angrily trying to give the HH fans, always clamoring for more, the hint that he didn't have any more to give in the series.
On a side-note, Adams was a devout atheist. It doesn't seem fitting that we should be worried that he's looking down on all of us screaming, "No, you idiots! Don't publish that!"
Actually, you're allowed to carry a small amount of methanol on an airplane, as it's classed the same way as alcohol.
Hydrogen fuel cells were under consideration for this same purpose, but were largely abandoned precisely because you're not allowed to carry hydrogen on an airplane.
I would play, you see, but I was walking along when I put on this strange ring I found, and suddenly I found myself transformed into an acid-slime, so I ate the ring (since it's metal, you know), and then I turned back into a person, but occasionally changed into a golem. While I was a golem, I killed off a monster that would normally turn me to stone, but you know I was stone already, so I picked him up to use as a weapon...
I don't remember much after that; although I slightly recall using my dog to go steal stuff from the supermarket for me...
If the story is true, isn't it interesting that they can't afford to pay this guy for his work but they can afford the legal costs to sue him? Or maybe they got a lawyer to take it on contingency. If they won the lawsuit, would they have to pay him out of their winnings?
Yes, yes, Moore was right again, and we can build an even bigger and faster network of supercomputers and throw them at the seven types of problems they're really good at solving. Of course, we've diddled this configuration a bit--massively distributed on the WAN level (instead of just sticking them all in Kansas an putting fat pipes to them directly).
It works fine, because eventually all the users who care (read: developers) will sneak in laptops of their own and do all their work on the laptop. I've seen it before, and it'll be seen again.
I don't understand the complaints about Google's "lack" of an exact string search. Google does pay attention to quotation marks, although it ignores small common words like 'a' and 'the' making it a little annoying. "Get the fish" also returns "Get a fish" and "Get for fish" and probably others. Also, it doesn't see punctuation as a hard separator and it takes some license with posessive ("Larry Wall" will get you a lot of "Larry Wall's") but overall, these minor issues are tolerable compared to the multitudinous advantages of Google.
Offers phone (local), digital cable, and cable modem. For the digital cable and cable modem (which gets at least 8Mbps on a good day) I pay $114/mo. Their phone service is comparable to the phone company's or cheaper, ~25/mo?
Slashdot Mirror
I was implementing a public key encryption algorithm for Java in Java 1.0 so applets could use it in the bad old days. I had to write a big-number package from scratch using algorithms out of Knuth vol. 2 since BigInteger wasn't in JDK1.0. I finally had it debugged on Windows, but I was getting garbage when I tested the apps on Macintoshes. Eventually, after many hours of debugging, I found that Netscape's JVM couldn't divide long integers properly, but only on the Mac, and only for certain values. You can imagine how frustrating it was that I was generating random numbers for every key, so the error would only occur once in a while.
The Netscape engineers finally acknowledged the bug, but it took them about 8 minor version upgrades of the browser before it got fixed. I ended up just hacking it to use a smaller internal radix on the Mac, which seemed to get rid of the problem.
The thing that makes me nervous is the secret key being stored on the machine that houses the database. The reason for this is so that our billing staff can handle the recurring billing. (They have a web interface where they must enter the passphrase to gain access to the credit card information.)
I'm not sure I understand the question. Why is the secret key stored on the machine? Is it stored in cleartext? If it is, that's a problem. The trick here would be to encrypt the secret key on the machine using the billing staff's password (or a hash thereof), and only decrypt the key when the password is entered. If you change the billing folks' password, you can re-encrypt the secret key with the new password. That way, you'd at least have to run a brute-force on the password (which may not be that hard, depending on how you pick passwords). An alternative is to use a more secure mechanism than passwords for authentication--something like a keyring dongle or somesuch, but that makes things more complicated.
Don't forget having to run your own assembly and tech support shop as well. I can usually coerce somebody to come out from Dell and replace my broken (video card, motherboard, CD-ROM drive) with little effort here at work if the need arises and it's covered under warranty. At your shop, YOU are the warranty guy.
Also, factor in the labor costs (which will be substantial), count the amount of time it will take for you to assemble a machine, the cost of ESD straps and mats (you will be using ESD mats, right?), the time it will take to set up an assembly area, and the space that will take up, etc.
I used to build machines for other people (family members, etc.) Now I just tell them all to buy a Dell because the hassle on me to maintain them is WAAAAAY less. The only machine I build myself anymore is my personal box, because I spec out stuff that is too high-end for a manufacturer like Dell anyway.
For the end goal (that is, no bundling) to be achieved, Microsoft can simply remove the Internet Explorer icon (and maybe iexplore.exe) from the desktop, right? I mean, sure, there are a few small other places it's integrated (explorer.exe will start internet explorer if I navigate to a URL rather than a folder), but they wouldn't actually have to remove anything but the code that starts the browser and the justice department would be pretty happy (i.e. not be able to tell the difference). I suppose this would make the IE download awfully small, too...
The problem here isn't that we should explore how to make software expire to force system administrators to do something, but to create *better deployment technologies* for our software. Microsoft has a pretty good edge on deployment, informing users when there's an upgrade available and allowing them to upgrade.
Even if you don't like how Microsoft does its deployment, certainly some sort of standard, well-managed deployment system for OSS could be developed.
How long do you think before Cringely gets a big'ol LED and tries to establish a high-speed connection from his house out in the sticks over the hill into Santa Rosa?
It seems that one of the repeated claims about open-source software is that the best developers are sort of self-selected in a meritocratic system. However, throwing college undergrads at the problem certainly isn't going to garner a whole herd of the "best developers" out there. In fact, most of them will be downright awful.
So, would this be useful, or would it end up throwing a lot of buggy, fragile patches at software and overwhelming the lead developers?
Duh, just search for them :)
Something akin to a JMS implementation, or something that can use event routers to increase scalability as you need it like Siena
The real problem here is a lack of natural selection. Stupid people just don't get eaten by predators, because we invent means to defend them (and for them to defend themselves).
As such, I advocate a campaign of thinning the herd every once in a while.
As I recall, Indiana Jones and the Sons of Darkness was never a real working title, but instead the title of a ficticious screenplay that circulated the Net some years ago.
Also, I think the last official rumored title was Indiana Jones and the Lost Continent or somesuch (before they tried to get M. Night Shyamalan onboard to do yet another script), chronicling Indy's search for Atlantis--not to be confused with the LucasArts game, of course.
"However, after about a month into deployment I started noticing strange problems with the machine. Intermittent lockups were the most common. The lockups appeared physical, and the machine was unrecoverable without a reboot.
While performing research on the problem, I learned there was a serious sync() bug in the 2.4 kernel. This bug exists in all kernel 2.4 versions until 2.4.6."
Intermittent lockups? Serious bugs in the kernel? For five straight minor releases, no less! This is beginning to sound like Windows! Where are the trolls who post about the Open-source movement completely preventing and/or eliminating this sort of thing?
I don't think ANYBODY should be held liable for Usenet postings they made when they were 14 years old...it's like having naked baby pictures of yourself stapled to your forehead when you walk around...
:)
On the other hand, you can now go back and see who REALLY won all those flame wars you were involved in
Readers of movie fan sites have known about this for a year and a half. See this link from Cinescape.
I'll buy it and read it, but only for what it's worth. I got the feeling at the end of Mostly Harmless that he had pulled a Charlton Heston at the end of Beneath the Planet of the Apes--that he wanted to end the series so finally that no sequel was possible. A little like he was angrily trying to give the HH fans, always clamoring for more, the hint that he didn't have any more to give in the series.
On a side-note, Adams was a devout atheist. It doesn't seem fitting that we should be worried that he's looking down on all of us screaming, "No, you idiots! Don't publish that!"
Actually, you're allowed to carry a small amount of methanol on an airplane, as it's classed the same way as alcohol.
Hydrogen fuel cells were under consideration for this same purpose, but were largely abandoned precisely because you're not allowed to carry hydrogen on an airplane.
I would play, you see, but I was walking along when I put on this strange ring I found, and suddenly I found myself transformed into an acid-slime, so I ate the ring (since it's metal, you know), and then I turned back into a person, but occasionally changed into a golem. While I was a golem, I killed off a monster that would normally turn me to stone, but you know I was stone already, so I picked him up to use as a weapon...
I don't remember much after that; although I slightly recall using my dog to go steal stuff from the supermarket for me...
Microsoft is dropping 'Micro' from their name...
If the story is true, isn't it interesting that they can't afford to pay this guy for his work but they can afford the legal costs to sue him? Or maybe they got a lawyer to take it on contingency. If they won the lawsuit, would they have to pay him out of their winnings?
Imagine a Beowulf clu...
aww, nevermind.
Yes, yes, Moore was right again, and we can build an even bigger and faster network of supercomputers and throw them at the seven types of problems they're really good at solving. Of course, we've diddled this configuration a bit--massively distributed on the WAN level (instead of just sticking them all in Kansas an putting fat pipes to them directly).
So?
It works fine, because eventually all the users who care (read: developers) will sneak in laptops of their own and do all their work on the laptop. I've seen it before, and it'll be seen again.
I don't understand the complaints about Google's "lack" of an exact string search. Google does pay attention to quotation marks, although it ignores small common words like 'a' and 'the' making it a little annoying. "Get the fish" also returns "Get a fish" and "Get for fish" and probably others. Also, it doesn't see punctuation as a hard separator and it takes some license with posessive ("Larry Wall" will get you a lot of "Larry Wall's") but overall, these minor issues are tolerable compared to the multitudinous advantages of Google.
Offers phone (local), digital cable, and cable modem. For the digital cable and cable modem (which gets at least 8Mbps on a good day) I pay $114/mo. Their phone service is comparable to the phone company's or cheaper, ~25/mo?
Just to be safe, in case the robot gets out of hand, I think we should ship Sigourney Weaver up there with it.