Slashdot Mirror


User: Zenin

Zenin's activity in the archive.

Stories
0
Comments
368
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 368

  1. Re:Preempting dumb discussion on Flurry of Scans Hint That Bash Vulnerability Could Already Be In the Wild · · Score: 1

    Trying to brush off blame with the tired old nonsense that "Linux is just the kernel, man!", just doesn't fly anymore. Hell, it never really has.

    The term "Linux" is well understood to mean a family of full, complete operating systems (libs, userland, and all). When anyone is actually speaking of just the kernel, it's qualified as exactly that, "The Linux kernel...blagh, blagh".

  2. Re:"could be worse than Heartbleed" on Flurry of Scans Hint That Bash Vulnerability Could Already Be In the Wild · · Score: 1

    Sure, a double fork() && exec() pattern is ideal, but it's also significantly more code and complexity (read: fat thumb bugs) than calling system("/some/command &");

    And before you say it, yes actually there are tons of use cases where forking a background process is a far superior method than any alternatives. It's one of the oldest and most common Unix programming patterns in existence. Programming doesn't really change much simply because you add "on the web" to the end of your use case.

  3. Re:"could be worse than Heartbleed" on Flurry of Scans Hint That Bash Vulnerability Could Already Be In the Wild · · Score: 1

    The vast, vast majority of tools do not need significant "scaling". Often just throwing a heavy weight job in the background (eg, transcoding a video file) is, and always will be, significant. Especially if you've got an auto-scaling web farm that'll just expand under load anyway. system("/big/job &") all day long.

    Sure, it'll never scale to YouTube levels, but it'll scale large enough for 99% of common use cases.

    The "proper" alternative architecture using message queues, etc is massively more code, complexity, and resource cost. Great if you actually need it, nothing but overhead when you don't, and you typically don't.

  4. Re:This exposes systemic insecurities on Flurry of Scans Hint That Bash Vulnerability Could Already Be In the Wild · · Score: 1

    You don't need to run a "full-bore shell program" to be vulnerable.

    You simply need to use the system() function of any popular language (Perl, PHP, Python, Ruby, C, etc). The system() function executes /bin/sh -c to parse the string before executing it. You don't even need to pass any arguments. On every Linux distro /bin/sh IS bash. Game over.

    The alternative to using a one line system() call is a few dozen lines of complex, easily screwed up systems programming as you navigate through fork(), exec(), dupe(), wait(), etc.

    The real issue are Linux distributions deciding that bash was a suitable substitute for a minimal POSIX /bin/sh.

  5. Re:Rather cumbersome on Amazon Instant Video Now Available On Android · · Score: 2

    You failed to note the "Google TV" text all over that app's page.

    That version is only usable on Google TV, not Android.

  6. Re:I think this is a good idea. on Is It Time To Split Linux Distros In Two? · · Score: 1

    You try and throw it back and me and yet...Linux is one of the only "modern" production kernels that hasn't figured out auto-tuning.

    Why is that do you think?

    And why should I chose Linux, knowing I'll have to spend considerable time and expense to "tune" it, even for very common use cases, when other systems can tune themselves better than 95% of sysadmins and do so for free?

  7. Re:I think this is a good idea. on Is It Time To Split Linux Distros In Two? · · Score: 1

    Better question: It's 2014, why the hell are you still manually tuning kernels?

    I'm not saying you don't need to for Linux...I'm asking why you or anyone else feels this is an acceptable requirement? Is it just to keep Linux sysadmins employed?

    Sure, for some incredibly unusual workloads we might not be able to expect the kernel to self-tune, but for the other 95% of typical uses they kernel really should be able to tune itself and do so far better than any human.

    Seriously, why do people put up with schedulers that are so bad they not only can't self-tune...they need to be wholly replaced...and such "tuning" requirements are considered normal?!

  8. Re:It would be less of an issue on IT Job Hiring Slumps · · Score: 1

    "You can't pay less than $80k to an H1B"

    BS. You have to pay the "minimum or prevailing wage in that geographic location for your particular position", which more often than not actually translates to well below the actual prevailing wage for the area and pretty much always well below $80k. It's also trivial to fudge by playing games with job titles:

    Online Wage Library - FLC Wage Search Wizard

    Does a "Application Software Developer" cost to much? Save a bit by calling them an "Analyst", or call them a "Web Developer" and save yourself $30k! :-/

    Even in most all of the highest wage markets in the US, it's trivial to get a "prevailing wage" well south of $80k with an H1B. AND they are effectively indentured servants (a small step up from slave): They can't complain, they have no real freedom to get fed up with your BS and quit.

  9. Re:What the heck? on DMCA Claim Over GPL Non-Compliance Shuts Off Minecraft Plug-Ins · · Score: 2

    Yes and no...

      Mojang didn't originally violate any license or infringe on copyright. Bukkit were always the ones in violation (of Mojang's license and copyright infringement). ...But now, Mojang "bought" Bukkit (the name and infrastructure, but not the code assets). This is where things get weird.

    Mojang/Bukkit is no longer in violation of Mojang's copyright, but neither is the Bukkit package in compliance with the GPL. Although that actually isn't clear either:

    A) Mojang/Bukkit are distributing the complete "source" to Bukkit (via the decompiled Minecraft server code). Although...that decompiled code isn't under GPL...

    B) Bukkit is the derivative (much like writing a GPL driver for Windows, or in general the issues of linking GPL code to non-GPL code: http://www.gnu.org/licenses/gp...

    Does Bukkit's license have the exception called for in the GPL FAQ linked above? Maybe, but it may not matter. Legally the exception may be considered implied because it was/is required and the distributor (the original Bukkit coders) knew/know that.

    But reguardless...Mojang could easily side step the whole issue by stripping the Mojang/Bukkit distributable of all non-GPL code (ie, the decompiled Minecraft server code). So long as Mojang/Bukkit doesn't distribute GPL/non-GPL mixed binaries (ie, only distributes Bukkit source sans Minecraft source), they aren't in violation. The GPL only requires you distribute source for the binaries you distribute and it is not a violation to simply distribute source that can't be compiled or can only be compiled once "brewed" locally with non-GPL code by the end user. While that end-user can't legally distribute their non-compliant binaries, they can legally use them themselves.

    And Mojang can count on the InterWebz to make available "unofficial" distributions of the needed decompiled Minecraft code and/or distributing (in violation) compiled binaries. Mojang isn't responsible for other people violating licenses (even as they benifit from the activity) and is under no obligation to expend effort or coin to pursue them. The butthurt Bukkit devs would need to do that legwork on their own dime if they cared.

  10. Re:I know you're trying to be funny, but... on Linus Torvalds: "GCC 4.9.0 Seems To Be Terminally Broken" · · Score: 1

    How did this load of crap get +5 Insightful? Oh that's right, it's Slashdot.

  11. Re:I know you're trying to be funny, but... on Linus Torvalds: "GCC 4.9.0 Seems To Be Terminally Broken" · · Score: -1, Troll

    Smoothly? Maybe, if you never upgrade. Linus/Linux has badly botched nearly every major transition they've done.

    a.out to ELF
    libc to glibc
    VM flavor of the month
    filesystem of the month
    32bit to 64bit
    sound, oh god..
    MAKEDEV / devfs / udev

    And that's the short list...and just the kernel. If we actually talk about the full OS (aka distributions), my god...it's a configuration manager's worst nightmare.

    What the hell, I've got some /. karma to burn:

    The reality is, Linus is the quintessential asshat. Not a fraction as smart as he thinks or boasts that he is, happily takes credit for everyone else's work (while simultaneously chastising them), dismissing his own failures as the peons not able to understand his greatness. And for all this the "community" regards him as a living god.

    If you look at it all honestly, it's difficult to find any "contributions" that Linux has done that weren't/aren't already done first and better by others. I'd even go so far as to say the computing world would have been better off never having been exposed to the plague that is Linux, which didn't win the market through technical merit.

  12. Re:Server 2012 already looks like Windows 8. on Microsoft's CEO Says He Wants to Unify Windows · · Score: 4, Informative

    I'm sorry, PowerShell is a trainwreck of a language. Extremely unintuitive, inconsistent, cryptic.

    Using a function? Call it as function($arg1, $arg2). Oh, did you write the function? Sorry, you'll have to call it as function $arg1 $arg2.

    Want to pass a path to something? It's easy: -Path $path. Oh wait, $path is actually a real path and not a glob? You'll have to use -literalPath...if it's supported. Yep, we kept the same failed idea of CMD and decided argument expansion should be done by each command/function/program/cmdlet independently so that we can make damn sure nothing at all is ever consistent. There's a reason why every Unix shell, bash much included, handles argument expansion in the shell.

    Sane variable scoping? Not from PS.

    Want to use something from .Net? It's built in, a major selling point! Oh...sorry if the syntax is so incredibly buggered that it makes real world PowerShell/.Net code look like a bid for the Obfuscated Perl Contest. And once you get it "right", PowerShell can't grok anything beyond trivial. God help me, I had to craft and populate an IEnumerable of Tuple of String, String in PowerShell to pass to a .Net method (from DacServices). Finally crafted (looked like a spell incantation), it couldn't get through PowerShell to the method call in one piece. Flat out broken. Finally had to give up and just code a real C# console app to handle the 10 lines of code.

    Want output/trace to display in the order you actually write it? When it actually happens? Better | Out-Default all of it or strange things happen.

    Most sane languages, especially so-called "OOP" languages, actually stop when an exception is thrown by default. Typically with a default global catch that offers you a nice stack trace, or something. PowerShell? By default it keeps on trucking, not even a peep (bad old habits of CMD are hard to break I guess).

    Misspell a variable somewhere? Or a method name? Not even a warning until runtime when it fails (but then keeps on trucking right along, happy to double down on the fail). Even Perl isn't that bad (at least with "use strict;").

    PowerShell is better than CMD/Batch. But then, so is a swift kick to the head. It's a horrid language and a bad shell. Bash via Cygwin is a hell of a saner and more powerful way to use a shell on Windows. And if you ever need .Net something, do yourself a huge favor and do it from C# as a console app and call that...1,000,000,000 times better than trying to use the fugly hack of a .Net interface that PowerShell provides.

  13. Re:won't work on Amazon Seeks US Exemption To Test Delivery Drones · · Score: 1

    Why would you assume that?

    Especially when it's the main highlight of Amazon's Prime Air concept video?

  14. Re:Shrug. on Amazon Seeks US Exemption To Test Delivery Drones · · Score: 1

    Sure, but it's a much, much easier problem to solve.

    For starters, flying is analogous to driving only if every road had 1,000 lanes and there were such 1,000 road lanes leading directly in any direction from any point.

    Or in other words, it's not at all analogous to "traffic" as folks typically think of it. A GPS module, a few cheap sonic sensors and/or slightly more expensive transponders, with basic collision avoidance software would easily solve the problem entirely. All of which I must add, are already on board any and all drones for the simple fact you can't navigate autonomously (more or less the definition of a "drone") without it. Anything less and you have a traditional R/C model aircraft, not a drone.

  15. Re:Why in America? on Amazon Seeks US Exemption To Test Delivery Drones · · Score: 1

    And you would be completely correct....except for SEC. 336. SPECIAL RULE FOR MODEL AIRCRAFT, which effectively exempts the FAA from almost any authority over anything that could legitimately be called a model aircraft used in a legitimate way. Effectively it puts the AMA in charge of regulating model aircraft, just as the organization has done with astounding success and safety for the better part of a century.

  16. Re:Murphy says no. on Ask Slashdot: Unattended Maintenance Windows? · · Score: 3, Insightful

    In general, don't do anything that isn't your core business. Or another way of saying it, Do What Only You Can Do.

    If you are an insurance company, is building and maintaining hardware your business? No, not in the slightest. You have no more business maintaining computer hardware as you have maintaining printing presses to print your own claims forms.

    Maintaining hardware and the rest of the infrastructure stack however, is the business of Amazon AWS, Windows Azure, etc. The "fantasy" you're referring to is the crazy idea that you, as some kind of God SysAdmin, can out-perform the world's top infrastructure providers at maintaining infrastructure. Even if you were the best SysAdmin alive on the planet, you can't scale very far.

    Sure, any of those providers can (and do, frequently) fail. Still, they are better than you can ever hope to be, especially once you scale past a handful of servers. If you are concerned that they still fail, that's good, yet it's still a problem worst addressed by taking the hardware in house. A much better solution is to build your deployments to be cloud vendor agnostic: Be able to run on AWS or Azure (or both, and maybe a few other friends too) either all the time by default or at the flip of a (frequently tested) switch.

    Even building in multi-cloud redundancy is far easier, cheaper, and more reliable than you could ever hope to build from scratch on your own. That's just the reality of modern computing.

    There are reasons to build on premises still, but they are few and far between. Especially now that cloud providers are becoming PCI, SOX, and even HIPAA capable and certified.

  17. Re:Murphy says no. on Ask Slashdot: Unattended Maintenance Windows? · · Score: 1

    Or it's not at all dependent on those factors.

    It's much more a matter of how much someone cares to put redundancy in place. Doing it right affects the entire stack: Code architecture, deployment tooling, infrastructure architecture and costing.

    It's a large reason why PaaS is gaining momentum: This is all assumed and it ends up being easier to do it the right way (that includes all this) from the start than doing it any other way, given that most all of the boiler plate aspects are already built.

    If you're building services that still require "regular maintenance windows" in 2014, you're doing it wrong.

  18. Re:What with all the other debris? on The View From Inside A Fireworks Show · · Score: 1

    Extremely unlikely bordering on impossible.

    Nearly every possible failure condition would result in the quad-copter falling more or less straight down and into the water.

    These things do not glide. Even a partial motor failure would send it tumbling end over end...more or less straight down. When they fail they fall out of the sky like a rock.

  19. Re:Illegal and Dangerous? on The View From Inside A Fireworks Show · · Score: 1

    Hit who?

    No one hangs around under a fireworks display and in this instance it was all over water.

    The worst think it's going to hurt is a fish swimming too close to the surface.

  20. And we'll name the first one we find Black Sabbath on New Class of Stars Are Totally Metal, Says Astrophysicist · · Score: 3

    Unless it's made of a light metal...then we'll name it Warrant.

  21. Re:Not surprised, mixed feelings on That Toy Is Now a Drone · · Score: 1

    We may need to see something similar.

    We already have it, SEC. 336. SPECIAL RULE FOR MODEL AIRCRAFT of the FAA MODERNIZATION AND REFORM ACT OF
    2012: http://www.gpo.gov/fdsys/pkg/C...

    The current issue is that the FAA has decided to "interpret" that section by more or less pretending it does not exist or apply to them:

    http://www.faa.gov/about/initi...

    The FAA isn't interested in the law. They consider themselves to be a country unto themselves, consisting of all a space greater then 12" above the land.

  22. Re:detroit vs SV? on Google, Detroit Split On Autonomous Cars · · Score: 2

    There are plenty of cars now with thermostats. And they suck big, fat donkey balls.

    Give me old fashioned fan speed and air temp knobs any day.

    The issue is that the environment instead a car just isn't stable enough for a simple thermostat to be effective. The small size and large number of strong temperature influencing features (windows, hot seats, your body, external air every time a door or window opens) mean that maintaining a single temperature throughout is incredibly impractical. To do so would require a massive amount of over-engineering (far more insulation than a car typically receives and a massively larger heating/cooling system to counter the still large external temperature influences).

    And then why is 76 degrees or whatever "comfortable"? If I'm getting into a car after being under a bright sun and 100 degree heat, nothing short of 50 degree air blowing powerfully on me is going to be comfortable. Yet, that won't be the case three minutes later where I'll want it to ease up. That is...unless I'm doing a bunch of errands and so I'm frequently going back out into that 100 degree heat.

    Car environment systems have completely different problems to deal with and needs to satisfy than building environment systems.

  23. Re:Figures... on LAPD Gets Some Hand-Me-Down Drones From Seattle, Promises Discretion · · Score: 2

    Yes, and precisely because it's so large.

    The larger the organization the more and larger nooks and crannies to hide in and the greater the resources to "defend" (cover up) incidents. Far more ability/resources to do harm, far more opportunities to do harm, far more reward from doing harm, far more ability to get lost in the woodwork and get away with it. The PD isn't unique; the rest of Los Angeles's governmental departments are much the same. From the school district, to the building codes, to street maintenance, to parks and rec.

    The economics of scale are never more apparent than when it comes to corruption.

  24. Re:Wow! on The Big Biz of Spying On Little Kids · · Score: 2

    Thank you for bringing up issues like healthcare: Today's "socialist" ObamaCare plan was yesterday's fringe extremist right-wing health plan when it was proposed as an alternative to (center-left) HillaryCare. It's a fantastic example of just how far the "center line" of politics in the US has been pushed far, FAR to the right.

    On the whole your essay either oversimplifies the (lack of) distinctions to the point of being invalid, or just gets the points wrong on all counts.

    With a few notable social issue exceptions (that honestly don't really matter, but have been great for riling up "the base" on both sides), the debate has marched fast and steadily to the right for decades. Largely not by arguing for right-wing ideas and winning, but rather by cunningly moving the center line allowing them to argue what had been solidly "center" for the better part of a century was now "left wing extremism". The reframe was clever, undeniable, and incredibly effective. It's even snowed you.

  25. Re:Wow! on The Big Biz of Spying On Little Kids · · Score: 1

    It's...not easy to follow.

    "Liberal" is a pejorative in the US, typically thrown at folks who are anywhere slightly left of the far right-wing that drives much of US politics. In reality what is "left" or "liberal" in the US would be center-right or even hard-right anywhere else on the globe. In the US the "center line" between left and right isn't anywhere near where you'd expect it to logically be.

    That said... "Libertarian" in the US is the polar opposite of "Liberal" and generally means the far right fringe of the batshit crazy extremist right wing. All the policies of pure anarchy, yet refuse to accept the title.

    ALL debate in the US spans a range that the rest of the world would consider center-right (Democrats) through far right (Republicans) and extremist right-wing separatists (Tea Party, Libertarians). There are left-wing groups in the US (the Green Party, Socialists, etc), but they get absolutely zero air time and are effectively a non-entity in our politics (although they get a nod in San Francisco every once in a while).