I read the article to see what the numbers were on performance differences. Turns out there were none, what a surprise! So as usual, in theory, perhaps maybe there might be a performance difference and maybe it might be significant or not, or both. Until real comparisons are made, safe to ignore.
What's more important is his other problem with Java generics which is that in runtime it's not possible to tell what type a collection is compiled as, this is to retain bytecode compatibility. So reflection will have no clue on any of this generics stuff, which isn't a deal breaker, it's just a downside I hadn't heard about before.
We are achieving more, those programs they're talking about didn't exist for previous processors.
Trading CPU cycles for development time is a valid choice. I for one would rather have more programs that run 20% slower, than fewer programs that run quicker.
I'll give $10,000 to all those who refuse to port anything to the Amiga, just to let those poor souls who still care move on with their lives.
Please guys, this holiday season take some time out of your schedule and knock an Amiga user unconscious, then nurse them back to health. That won't accomplish much in the long term, I agree, but it will shut them up for a couple days.
I'm interested to read your comments GCP as I'm a longtime Java programmer as well. When I read the C# spec I found that the vast majority of the language additions over Java were the classic Microsoft shortcuts that cloud a language and reduce clarity. This is of course with the one great exception of delegates, which I am totally in favour of.
It seems there is a danger as we get more experienced with programming to want to get fancy with our syntax and so on, but I think Java neatly constrains this desire and guides us to write clearer programs. This is why projects in Java are so successful at producing reusable open source components, and using those components as building blocks.
This is all involves personal preference of course. However, when I download a library for a program I'm working on I know there'll be an lower bound on how bad or obfuscated the code will be, most of the additions to C# lower that bound significantly.
I don't know if you're still writing applets, but Java works. And there's a reason this DB RAID was written for Java and not for the other languages you mentioned, because Java works.
You should check out some of the Java technologies post 1999, they're entrusted with a lot of sensitive computing nowadays.
You neatly summed up the debate for me there. Most of the posts on here have confused user permissions with what I was getting at with the virtual machine angle.
Perhaps I wasn't clear enough by not providing an example, but as I'm a Java programmer too I didn't want this to immediately devolve into a language war. I don't need to have everything I run on my system be written in Java, but it'd be nice if they were on a common secured runtime.
Not quite. I'm not advocating user permission isolation or resitrction by the VM, just memory control. For example, in Java there are no pointers and all bounds checking is done by the VM, so buffer overflows are non-existant.
If you managed to hack the password on an app running on the VM you'd still have that user's level of access, but we can be fairly certain that hack would not occur as a result of an overflow style attack.
You can effectively make a VM buffer overflow immune by auditing just the same as you can with any other program, but the difference is that then anything that gets writte on the VM is immune to that class of problem as well - a great gain in security.
I totally agree that it's not a "solve-all" solution to the problem, I just was thinking it would be a way to greatly reduce or eliminate a whole (large) class of security problems in one step.
And yes, the programs are only as secure as the VM, but at least then you can focus on the VM for audits.
I don't doubt secure C programs can be written, but we must ensure that everyone that writes a C program does write them in a secure manner. However, if people write their programs to a virtual machine then all we need to ensure is that the VM is written in a secure manner. That will lead directly to a more secure now, and in case new applications show up that you want to run. You don't need the qmail security guarantee to prove that there aren't buffer overflows, you know that the virtual machine has that security guarantee already.
It's not so much isolating the services from the rest of the system, but making it possible to completely remove the chance of a buffer overflow type exploit. This means we don't have to waste our time auditing server applications for those types of holes (which seem to make up the majority), we can just audit the virtual machine once.
By virtual machine, I'm talking about a Java or.NET runtime, one that controls access to the memory for all programs that run on it.
That's not quite what I was getting at. I was asking why things aren't run in a virtual machine that can provide one place to audit to protect against buffer overflows. Meaning that if you are 99% certain that your virtual machine is safe, then anything that runs on top of it will also be 99% safe from those types of attacks. This is in contrast to having to be 99% sure of each and every native mode application that you run on your machine.
This is the fundamental difference between trying to protect your root accounts and priveleges against a whole pile of potentially compromised services, and instead guarding all memory access at one control point via a VM.
Could I compile existing software, like sendmail, with this and that would remove buffer overflow style explots? If so that's very interesting, how come the binary RPMs that Redhat and crew aren't already compiled with a tool like this?
That's not quite what I was getting at. User mode linux is a more safe way to run services that might suffer from overflow style exploits, but it still doesn't stop those exploits from occuring.
I'm looking for one place to prevent those exploits (in a VM), and then build secure services on top of that.
You can also get a trackball, I use the MS Trackball Explorer and work, and a regular mouse at home. Switches up the type of motion so your hand doesn't get so blown out.
Every once and a while they take a bunch of people out to the facilities they built, then blew up at the Nevada nuclear testing sites. That's what I'd check out.
Predictions regarding the person who made this post:
1. Under the age of 20, or older but still lives with parents. 2. Has not touched a human breast other than his own. 3. Doesn't read much, or while reading doesn't think much. 4. Enjoys taking hard line stands on many issues, although not sure why. 5. Has never actually performed an action in support of one of these hard line stands. 6. Considers himself a pretty amazing programmer. 7. Enjoys tasering own nads.
Does anyone know if it can do IMAP in the email client?
Also, I'm a java programmer and I've read some asides in articles that say that although it's has a JVM, you can't install programs directly on the phone, is that true?
Seriously though, can anyone tell me what the attraction to the d.net project was? It seems like a colossal waste of cycles to me. Everyone knew it was going to be successful, it was just a matter of wasting enough time to eventually find the right block.
Now that it's over, what do we have to show for it? A whole lot of nothing it seems.
Slashdot Mirror
Site seems to be toast, try the coral link Logo Winner.
I read the article to see what the numbers were on performance differences. Turns out there were none, what a surprise! So as usual, in theory, perhaps maybe there might be a performance difference and maybe it might be significant or not, or both. Until real comparisons are made, safe to ignore.
What's more important is his other problem with Java generics which is that in runtime it's not possible to tell what type a collection is compiled as, this is to retain bytecode compatibility. So reflection will have no clue on any of this generics stuff, which isn't a deal breaker, it's just a downside I hadn't heard about before.
We are achieving more, those programs they're talking about didn't exist for previous processors.
Trading CPU cycles for development time is a valid choice. I for one would rather have more programs that run 20% slower, than fewer programs that run quicker.
I'll give $10,000 to all those who refuse to port anything to the Amiga, just to let those poor souls who still care move on with their lives.
Please guys, this holiday season take some time out of your schedule and knock an Amiga user unconscious, then nurse them back to health. That won't accomplish much in the long term, I agree, but it will shut them up for a couple days.
We've used Teamspeak alot. It's stable and free.
...if sitting in front of a TV and drinking beer makes you happy, all the power to you.
It's probably a good idea to keep some of the power for people who aren't hammered and lazy.
I'm interested to read your comments GCP as I'm a longtime Java programmer as well. When I read the C# spec I found that the vast majority of the language additions over Java were the classic Microsoft shortcuts that cloud a language and reduce clarity. This is of course with the one great exception of delegates, which I am totally in favour of.
It seems there is a danger as we get more experienced with programming to want to get fancy with our syntax and so on, but I think Java neatly constrains this desire and guides us to write clearer programs. This is why projects in Java are so successful at producing reusable open source components, and using those components as building blocks.
This is all involves personal preference of course. However, when I download a library for a program I'm working on I know there'll be an lower bound on how bad or obfuscated the code will be, most of the additions to C# lower that bound significantly.
I don't know if you're still writing applets, but Java works. And there's a reason this DB RAID was written for Java and not for the other languages you mentioned, because Java works.
You should check out some of the Java technologies post 1999, they're entrusted with a lot of sensitive computing nowadays.
You neatly summed up the debate for me there. Most of the posts on here have confused user permissions with what I was getting at with the virtual machine angle.
Perhaps I wasn't clear enough by not providing an example, but as I'm a Java programmer too I didn't want this to immediately devolve into a language war. I don't need to have everything I run on my system be written in Java, but it'd be nice if they were on a common secured runtime.
Wow, that's starting to sound like
Not quite. I'm not advocating user permission isolation or resitrction by the VM, just memory control. For example, in Java there are no pointers and all bounds checking is done by the VM, so buffer overflows are non-existant.
If you managed to hack the password on an app running on the VM you'd still have that user's level of access, but we can be fairly certain that hack would not occur as a result of an overflow style attack.
You can effectively make a VM buffer overflow immune by auditing just the same as you can with any other program, but the difference is that then anything that gets writte on the VM is immune to that class of problem as well - a great gain in security.
I totally agree that it's not a "solve-all" solution to the problem, I just was thinking it would be a way to greatly reduce or eliminate a whole (large) class of security problems in one step.
And yes, the programs are only as secure as the VM, but at least then you can focus on the VM for audits.
I don't doubt secure C programs can be written, but we must ensure that everyone that writes a C program does write them in a secure manner. However, if people write their programs to a virtual machine then all we need to ensure is that the VM is written in a secure manner. That will lead directly to a more secure now, and in case new applications show up that you want to run. You don't need the qmail security guarantee to prove that there aren't buffer overflows, you know that the virtual machine has that security guarantee already.
It's not so much isolating the services from the rest of the system, but making it possible to completely remove the chance of a buffer overflow type exploit. This means we don't have to waste our time auditing server applications for those types of holes (which seem to make up the majority), we can just audit the virtual machine once.
By virtual machine, I'm talking about a Java or
That's not quite what I was getting at. I was asking why things aren't run in a virtual machine that can provide one place to audit to protect against buffer overflows. Meaning that if you are 99% certain that your virtual machine is safe, then anything that runs on top of it will also be 99% safe from those types of attacks. This is in contrast to having to be 99% sure of each and every native mode application that you run on your machine.
This is the fundamental difference between trying to protect your root accounts and priveleges against a whole pile of potentially compromised services, and instead guarding all memory access at one control point via a VM.
Could I compile existing software, like sendmail, with this and that would remove buffer overflow style explots? If so that's very interesting, how come the binary RPMs that Redhat and crew aren't already compiled with a tool like this?
That's not quite what I was getting at. User mode linux is a more safe way to run services that might suffer from overflow style exploits, but it still doesn't stop those exploits from occuring.
I'm looking for one place to prevent those exploits (in a VM), and then build secure services on top of that.
You can also get a trackball, I use the MS Trackball Explorer and work, and a regular mouse at home. Switches up the type of motion so your hand doesn't get so blown out.
Every once and a while they take a bunch of people out to the facilities they built, then blew up at the Nevada nuclear testing sites. That's what I'd check out.
Predictions regarding the person who made this post:
1. Under the age of 20, or older but still lives with parents.
2. Has not touched a human breast other than his own.
3. Doesn't read much, or while reading doesn't think much.
4. Enjoys taking hard line stands on many issues, although not sure why.
5. Has never actually performed an action in support of one of these hard line stands.
6. Considers himself a pretty amazing programmer.
7. Enjoys tasering own nads.
How'd I do? I'm guessing 5/7 at least.
Anyone ever noticed how much mundane Apple news gets posted on Slashdot? A minor speed increase on laptops doesn't seem to warrant a full story.
And, if you look in the categories for stories, there are tons of Apple specific categories for no real reason:
Apple Wireless
Apple Hardware
Apple Software
Apple Desktops
iMac
Apple Media
Apple Networking
OS 9
OS X
Apple Utilities
Look, we're in the "Apple Laptop" category for the love of god, what is the deal?
Nice sig, I wonder where you got it?
Does anyone know if it can do IMAP in the email client?
Also, I'm a java programmer and I've read some asides in articles that say that although it's has a JVM, you can't install programs directly on the phone, is that true?
Thanks.
Seriously though, can anyone tell me what the attraction to the d.net project was? It seems like a colossal waste of cycles to me. Everyone knew it was going to be successful, it was just a matter of wasting enough time to eventually find the right block.
Now that it's over, what do we have to show for it? A whole lot of nothing it seems.
No I don't agree, get a Tivo. It will solve all your problems above, and will show you how far consumer digital technology has come.
They're pretty cheap now too.