> it still boggles my mind (a little) that we need security updates for a SPREADSHEET APPLICATION. An OS? Server software? Sure. But Excel? It's a sad commentary on Microsoft's software that such a thing is necessary.
That has nothing to do with Microsoft, anything that touches data that someone else generated can have a security vulnerability, which is almost everything you would ever want to run in this crazy internet enabled world of ours.
Ironically enough there was a very nice client for the indexing service for working with source code that microsoft's windows engineers use. It would find where functions were declared, implemented, used, etc... (You don't want to just grep all of windows source) The only thing that gave it a run for it's money was Source Insight which has an integrated search experience and could index all of windows source code on your local box. So even the old ones were quite powerfull for at least indexing source code.
With Windows XP the default for the index service was off, but a user got asked about turning it on after doing a search from a shell.
There are few levers that Microsoft has on encouraging 64 bit computing. The first is having good tools and support for creating 64 bit drivers with a shipping OS. The second is requiring the existance of 64 bit drivers to get a Designed For Windows Vista Logo (and co-marketing dollars?) and making the 64 bit OS version easily available in the consumer market. The last lever is finally going 64 bit only in certain products and eventually Windows itself. We are long past the first lever, we just saw the second completed with Vista and there are signs that the third is coming with announcements like Exchange going 64bit only.
However there is no reason why such big shifts can't happen cocurrently in the pipeline of these steps or even in parallel. For example, last year the win2k3 networking stack got an optional update to do Receive Side Scaling allowing a network server to scale better with multi-core/cpu. This technology is already a builtin part of the OS in Vista. One of the features on win2k8 is to fix the serialization of terminal server login session creation. As long as the hardware appears and there is bang for the buck, it will show up in the OS.
Re:Will anyone gain anything from this? Not Linux
on
The End is Nigh for XP
·
· Score: 1
I know that badvista.org has a campaign to mark products with DRM and defectivebydesign, but nothing in this story has anything to do with DRM; having these tags on the article is less then useful. Maybe the tags need the same type of moderation system that the comments get.
Downward compatability is a tough one. You would be suprised in the amount of underlying (public and private) API changes that showed up in XP (and more in SP2, which might as well as been an full OS release). It takes a lot of hacks and lot of testing to support older releases.
The leaked w2k source reveals that wininet takes an unhealthy interest in Internet Explorer. If wininet is simply a library of internet related functions why does it have to do IE specific stuff?
I don't know the real history, but it has played roles for both; functionality meant for IE, and then exposed for public usage. Winhttp was a first attempt to trim wininet into a library with no IE dependancies (but then you lose p3p, cache, etc...)
>The windows world isn't even close to handling >a whole class of vulnerabilities - services >running with inappropriate priviledge. Ouch! No >chrooting, priviledge separation, etc.
Actually win2k3 has done a bunch of work on running with least privlege. The first was the creation of the Local Service and Network Service accounts that remove a number of privledges that most services didn't need when running as Local System. There are a number of services that got changed from Local System to the new accounts.
Also chrooting is more of a way to work around the limited owner/group/other style of premissions. A number of the defaults (better in win2k3) ACLs are pretty decent in that regard. The closest you get to chroot in windows is to use the Restricted Token. You can play with the restricted token (in XP and up) is by opening a command shell with runas and use the Current user -> "Protect my computer and data from unauthorized program activity" option.
Windows XP uses a DDR Fairness technique to solve the same problem, I wonder how the two techniques compare? See "QoS for Modems and Remote Access" at this KB article.
If they punt your bug and it's important, you fight back (the next day). However every day closer to the ship date, the bar for what bugs will get taken (roughly: regression risk X bug impact) goes up. By not showing up, you lower the chance that your bug will get taken. Also, if a bug is critical enough (as dictated by a paying customer) the fix will get issued as a hotfix, and rolled out to everyone else in the next service pack. Lastly, there are multiple forks to the code tree, the dev has fixed the bug (by the time it get to war) and it'll checked in to the longhorn branch; it just won't get released till the next "ship vehicle".
The war team is all about the needs of a feature team against the needs to ship a stable product. Anytime such needs clash tensions run high.
Actually they build for 2x3=6 architectures. (x86, ia64 and amd64) x (free build and checked build), then each of thoose gets sorted, filtered and processed to create the 5 different finished server products (add two more when they build client). So 6x5=30 end product builds a night. Then there are different Virtual Build Labs that are responsible for most of the changes for a major section of the code branch (I think about 7 plus the main). So 30x8= 240 max builds a night.
So for extra credit, what's the legal obligations of Bluelight.com to United Online if Bluelight.com uses GPL code and modifications to thoose GPL apps, since this is a sale?
I went cell phone shopping this weekend and saw that the sprint plans generally included 2 megabytes, and $.02/KB after that. At this speed you would finish the standard alotment in under a second, and then be paying $2,850 per minute after that.
Acording to the register article, the clause is: "You acknowledge and agree that Microsoft may automatically check the version of the OS Product and/or its components that you are utilizing and may provide upgrades or fixes to the OS Product that will be automatically downloaded to your computer" I'm really unclear what this has to do with accessing private data that has nothing to do with the OS. I think you have let the/. hype about "ms gets to own your computer anytime it wants" get to you.
Actually it's probably what microsoft had in mind. The whole (probably stupid) idea is make there to be no economic advantage to buy a machine without an os, and then pirate a windows one. Also note that even if you have corperate licensing, you still can't put windows on a naked pc, see this FAQ.
The point is hundreds of people were trained and very productive in WordPerfect. They didn't WANT to switch to Office/Word, but were forced to. Productivity DROPPED like a rock. All the DOS-based tools (keymap-expanders - "alt-shift-gg" expands to "gyrointestinal gerontology", for example) don't exist for Word, and still haven't appeared on the market.
Here's $20, go get your self a vb for applications programmer for an hour.
Psched is primarily about three things, marking, shaping and priority. Marking happens both at the layer 2 (802.1p) and layer 3 (DSCP). 802.1p is okay, but nowhere near a requirement for things to work. Most people who get value out of psched right now are just using the shaping aspects of it, or the nifty features done even when unconfigured. See http://support.microsoft.com/search/preview.aspx?s cid=kb;en-us;Q316666 . To use the shaping part see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/qos/tcfunc_01et.asp.
Again: the existing stuff in windows doesn't need/care about 802.1p, does some nice things for people on a modem and people who use ICS without any extra code/configuration, and with code is mostly usefull for shaping outbound traffic.
P.S. If you think that psched is doing anything with 20% of your bandwidth, pls just don't even bother posting.
This is somewhat true, however it's been found that devs tend to under estimate the impact of their changes in terms of building other code, or two developers checking in changes to the same build each alone build fine, but together break. The result is that you build with a script that removes all the stuff not checked in and forces a full sync of all changes in the depot so far, then rebuild the entire depot. It doesn't take too long to build a depot, and it's an extremely automated process, so it doesn't take much actual dev time, plus alot of the postbuild steps are not done.
Another way to look at it is the cost of each developer having to kick off a personal build is tiny compared to the daily build not comming out and not getting bug fixes verified, new bugs found, etc.
Slashdot Mirror
I see the effect on 1Gbit.
I tried it on a 100Mbit Network and I get high network usage with no effect of playing music or not. I'm going to see if I can get 1 Gbit going...
> it still boggles my mind (a little) that we need security updates for a SPREADSHEET APPLICATION. An OS? Server software? Sure. But Excel? It's a sad commentary on Microsoft's software that such a thing is necessary.
That has nothing to do with Microsoft, anything that touches data that someone else generated can have a security vulnerability, which is almost everything you would ever want to run in this crazy internet enabled world of ours.
Ironically enough there was a very nice client for the indexing service for working with source code that microsoft's windows engineers use. It would find where functions were declared, implemented, used, etc... (You don't want to just grep all of windows source) The only thing that gave it a run for it's money was Source Insight which has an integrated search experience and could index all of windows source code on your local box. So even the old ones were quite powerfull for at least indexing source code.
With Windows XP the default for the index service was off, but a user got asked about turning it on after doing a search from a shell.
There are few levers that Microsoft has on encouraging 64 bit computing. The first is having good tools and support for creating 64 bit drivers with a shipping OS. The second is requiring the existance of 64 bit drivers to get a Designed For Windows Vista Logo (and co-marketing dollars?) and making the 64 bit OS version easily available in the consumer market. The last lever is finally going 64 bit only in certain products and eventually Windows itself. We are long past the first lever, we just saw the second completed with Vista and there are signs that the third is coming with announcements like Exchange going 64bit only.
However there is no reason why such big shifts can't happen cocurrently in the pipeline of these steps or even in parallel. For example, last year the win2k3 networking stack got an optional update to do Receive Side Scaling allowing a network server to scale better with multi-core/cpu. This technology is already a builtin part of the OS in Vista. One of the features on win2k8 is to fix the serialization of terminal server login session creation. As long as the hardware appears and there is bang for the buck, it will show up in the OS.
Try ClickOnce.
I know that badvista.org has a campaign to mark products with DRM and defectivebydesign, but nothing in this story has anything to do with DRM; having these tags on the article is less then useful. Maybe the tags need the same type of moderation system that the comments get.
Downward compatability is a tough one. You would be suprised in the amount of underlying (public and private) API changes that showed up in XP (and more in SP2, which might as well as been an full OS release). It takes a lot of hacks and lot of testing to support older releases.
I don't know the real history, but it has played roles for both; functionality meant for IE, and then exposed for public usage. Winhttp was a first attempt to trim wininet into a library with no IE dependancies (but then you lose p3p, cache, etc...)
The hello world word generated xml document I have have both the standard xml version header and namespace declarations.
>The windows world isn't even close to handling
>a whole class of vulnerabilities - services >running with inappropriate priviledge. Ouch! No
>chrooting, priviledge separation, etc.
Actually win2k3 has done a bunch of work on running with least privlege. The first was the creation of the Local Service and Network Service accounts that remove a number of privledges that most services didn't need when running as Local System. There are a number of services that got changed from Local System to the new accounts.
Also chrooting is more of a way to work around the limited owner/group/other style of premissions. A number of the defaults (better in win2k3) ACLs are pretty decent in that regard. The closest you get to chroot in windows is to use the Restricted Token. You can play with the restricted token (in XP and up) is by opening a command shell with runas and use the Current user -> "Protect my computer and data from unauthorized program activity" option.
DRR - Distributed Round Robin..
There are too many acroynms in this industry.
Windows XP uses a DDR Fairness technique to solve the same problem, I wonder how the two techniques compare?
See "QoS for Modems and Remote Access" at this KB article.
If they punt your bug and it's important, you fight back (the next day). However every day closer to the ship date, the bar for what bugs will get taken (roughly: regression risk X bug impact) goes up. By not showing up, you lower the chance that your bug will get taken. Also, if a bug is critical enough (as dictated by a paying customer) the fix will get issued as a hotfix, and rolled out to everyone else in the next service pack. Lastly, there are multiple forks to the code tree, the dev has fixed the bug (by the time it get to war) and it'll checked in to the longhorn branch; it just won't get released till the next "ship vehicle".
The war team is all about the needs of a feature team against the needs to ship a stable product. Anytime such needs clash tensions run high.
Actually they build for 2x3=6 architectures. (x86, ia64 and amd64) x (free build and checked build), then each of thoose gets sorted, filtered and processed to create the 5 different finished server products (add two more when they build client). So 6x5=30 end product builds a night. Then there are different Virtual Build Labs that are responsible for most of the changes for a major section of the code branch (I think about 7 plus the main). So 30x8= 240 max builds a night.
>How can a government/organization/individual be sure that Microsoft didn't put in backdoors into their software?
Shared Source
So for extra credit, what's the legal obligations of Bluelight.com to United Online if Bluelight.com uses GPL code and modifications to thoose GPL apps, since this is a sale?
I went cell phone shopping this weekend and saw that the sprint plans generally included 2 megabytes, and $.02 /KB after that. At this speed you would finish the standard alotment in under a second, and then be paying $2,850 per minute after that.
So Oracle is more optimised for Linux then Windows. Why am I not suprised?
Acording to the register article, the clause is: "You acknowledge and agree that Microsoft may automatically check the version of the OS Product and/or its components that you are utilizing and may provide upgrades or fixes to the OS Product that will be automatically downloaded to your computer" I'm really unclear what this has to do with accessing private data that has nothing to do with the OS. I think you have let the /. hype about "ms gets to own your computer anytime it wants" get to you.
Actually it's probably what microsoft had in mind. The whole (probably stupid) idea is make there to be no economic advantage to buy a machine without an os, and then pirate a windows one. Also note that even if you have corperate licensing, you still can't put windows on a naked pc, see this FAQ.
The point is hundreds of people were trained and very productive in WordPerfect. They didn't WANT to switch to Office/Word, but were forced to. Productivity DROPPED like a rock. All the DOS-based tools (keymap-expanders - "alt-shift-gg" expands to "gyrointestinal gerontology", for example) don't exist for Word, and still haven't appeared on the market.
Here's $20, go get your self a vb for applications programmer for an hour.
ugh.
s cid=kb;en-us;Q316666 . To use the shaping part see http://msdn.microsoft.com/library/default.asp?url= /library/en-us/qos/tcfunc_01et.asp .
Psched is primarily about three things, marking, shaping and priority. Marking happens both at the layer 2 (802.1p) and layer 3 (DSCP). 802.1p is okay, but nowhere near a requirement for things to work. Most people who get value out of psched right now are just using the shaping aspects of it, or the nifty features done even when unconfigured. See http://support.microsoft.com/search/preview.aspx?
Again: the existing stuff in windows doesn't need/care about 802.1p, does some nice things for people on a modem and people who use ICS without any extra code/configuration, and with code is mostly usefull for shaping outbound traffic.
P.S. If you think that psched is doing anything with 20% of your bandwidth, pls just don't even bother posting.
I see it more likly that microsoft would pay for licenced technologies or if it's too expensive, remove support for them.
Welcome to the real world.
This is somewhat true, however it's been found that devs tend to under estimate the impact of their changes in terms of building other code, or two developers checking in changes to the same build each alone build fine, but together break. The result is that you build with a script that removes all the stuff not checked in and forces a full sync of all changes in the depot so far, then rebuild the entire depot. It doesn't take too long to build a depot, and it's an extremely automated process, so it doesn't take much actual dev time, plus alot of the postbuild steps are not done.
Another way to look at it is the cost of each developer having to kick off a personal build is tiny compared to the daily build not comming out and not getting bug fixes verified, new bugs found, etc.