So it's no longer "data" vs "audio," but "home" vs "work?"
I admit it, this really pisses me off because it's clearly an effort to manipulate perception and partition the market in ways more favorable to the RIAA. They'll leave offices alone, for now, if they can get the legal presumption that all home users are pirates.
But in fact many people work from home - for many service-based small businesses there is no "office" - and for most people the CDR is the only backup medium they have. Even those of us with real tape drives (I have both TR-4 and DDS tapes) often use CDR backups because of the fast recovery rates. (With a indexed compressed tar system I'm working on, I can do wildcard recoveries from a full 800MB CDR in a matter of seconds.)
But according to the RIAA, I use those 50-disc spindles to rip insufferable pop music, not to backup up my own business files.
Unless they've totally redone their code, openca won't take you very far.
The problem is that a production CA almost certainly follows nesting 90-10 rules. 90% (or more) of the time is spent on lookups, with 10% for everything else. 90% of *that* is spent authenticating the identity of people requesting some action, 10% is spent actually doing the work. Yet most of the OSS CA code focuses on that sexy 1%, not the boring (but critical) 99%.
As for openca in particular, I seem to recall that it used a storage mechanism similar to that used by the openssl ca approach. That's separate files, with symlinks from the 32-bit hash of the entire key. That's good enough for a proof-of-concept toy, but a CA needs to be able to support *fast* searches on 6-8 separate search keys (e.g., subject DN, issuer DN, issuer + SN, hashses of same, subject keyid, whole-cert hash, and ideally components of the DNs.) And those hases are should be the full 160-bit SHA1 hash, base64 encoded.
The CA also needs to support these lookups through LDAP and HTTP, and should be able to present the information in a variety of formats for the various users.
That's why I wrote my PKIX extensions to PostgreSQL, and the cert repository code in JSP/servlets. Not because I expect to have million-record repositories, but because it's easy to integrate the repository with other systems. It's why the author of EJBCA is using EJB in his CA - again it provides an easy way to integrate with other systems via J2EE.
Since I could create such a public CA easily enough, why don't I? Simple - I feel my time is better spent figuring out how to work with crypto java cards under Linux, not creating what amounts to a toy. Or using the same certs to provide strong encryption in PostgreSQL. (In fact, I originally implemented an OpenPGP style encryption, then switched to PKCS7 cert style encryption. Basic crypto support is already available, but full support requires extensions to the grammar and a lot more DB-specific knowledge than I have at the moment.) Or continuing to develop my CD-R backup program that so that the compressed tar files are encrypted. Again, for technical reasons I started with OpenPGP formatting and switched to PKCS7.
X.509 isn't just winning because of Microsoft, it's because PGP has some serious problems right now.
Where are the PGP key servers? "Trust" is a nice concept, but you still need to be able to communicate with strangers with no common mutual friends. You still need to be able to check whether a key has been compromised/revoked.
In some ways more importantly, where's the continuity? I can revoke a cert, issue a new one, and it shouldn't cause any problem for most users. But if you revoke your cert (e.g., because I know it's been compromised) how can I transparently transition to your next cert.
I think what many people have forgotten is that PGP was never intended to replace centralized authorities, just to provide an alternative at a time when it looked very possible that a government monopoly on certs (with mandatory key escrow) could be put into place. PKIX makes a lot more sense for most situations, as long as there's not a single government-mandated provider.
You're correct that it's not difficult to sign certs. But a CA needs to do a lot more than that. You need to be able to handle revocations and renewals, while avoiding the fradulent revocations and renewals by third parties. You need to be able to publish the certs and CRLs to any interested party. You need to provide the standard search methods.
And once you've done all of that, you're still left with the question of exactly what the cert means. A free cert that shows nothing but the fact that you have an email address isn't particularly useful. It gives you encrypted email, but no real authentication.
That's better than nothing, but the suspect the other people working on CA projects feel that we'll get more benefit from our efforts elsewhere.
Of course DNA is a creative work. But the author has a tendency to take things a bit personally when you step on his turf - plagues of locusts, seas of blood, 40 years wandering the dessert.
"False gods" are a particular sore spot. It also involved money and the creation of synthetic animals -- wasn't there something about cattle made of gold?
So sure, claim His work. But don't expect much sympathy when a Legion of Angelic Lawyers arrive to contest it.
Let's get something straight before I go any further. Spam (email and fax) is theft. It's theft of my resources - my bandwidth, my disk space, and my paper and toner supplies.
Unsolicited physical mail does me relatively little harm. It does take a bit of time to sort through it, but the USPS won't toss out my VISA bill because the annoying weekly flyer has taken up the last of my mailbox space.
In contrast, I've lost email because spam filled a partition. (Some broken mailer hit me with 20+ copies of a multimegabyte file in less than an hour.) My fax machine, being the cheapest I could find since I was mostly interested in outgoing faxes, uses a plastic strip that can only handle a relative handful of pages. Every junk fax that I receive significantly increases the risk that an important fax will be cut off.
If the courts rule that it's legal to steal from me, the results are obvious and inevitable. No more fax, no more junk mail, no answering machine (same legal logic applies), no telephone. You want to talk to me, you'll do it just like the Founding Fathers expected - you'll send a letter or you'll visit me in person because the cost of me offering any alternative is too high.
Search the literature - what was used before the mechanical systems of WW-II?
These were the strongest ciphers that could be used in an era before mechanical assistance (and you could even simulate the Engima machine with pen and paper!), so they satisfy two of your requirements. But you won't find asymmetrical ciphers from that era.
However, you can find some ciphers far stronger than the simple rotor engines others are suggesting.
The "giant penguin attacking Redmond" ad was humorous and ironic. (We all know who the 800-pound gorilla is around here.) Nobody looked at that banner ad and decided to eliminate MS products from consideration for a project out of fear that a giant rampaging penguin would lay waste to their town.
In contract, a lot of people still give a lot of weight to Microsoft's advertising. I guess they think it's one thing to damn near lie in a Federal criminal case, but MS would never lie to customers and potential customers.
So these comments have a real chance of causing people to back away from Unix.
Worse, and perhaps the real purpose of this campaign, the fact that their claims apply even more directly to MS products than Unix/Linux will provide an "innoculation" effect when the Unix/Linux people offer reasons for getting away from MS products. The poor victims of the Dark Jedi mind tricks will recognize the phrases and believe that everyone is equally guilty. Just like how "everyone" now knows that all software is buggy, that "configuration" only refers to trivialities like selecting the background image on your desktop, etc. That's a well-known technique for eliminating the ability of your critics to attack your own weaknesses.
If you're going to repeat that old crap, make sure you get it right. Linux(tm) is not Unix(tm), because nobody has felt any need to pay for Unix(tm) certification for any Linux(tm) system.
The "Unix(tm)" name is now nothing more than marketing Jedi mind tricks. Do you insist your mouthwash contain T<sub>2</sub>5(tm) (otherwise known as water)? Of course not - for the stuff that really matters, all are pretty much the same. Ditto, what's important isn't the Unix(tm) label, it's compliance with POSIX standards.
If you get deep into the implementation details, it's true that Linux didn't fork from the original Unix source tree and like any "clean-room" implementation there are some significant differences. BFD. As long as the system stays close enough to the POSIX standards it's a moot point to everyone but kernel developers and marketing droids.
Outlook, and outlook alone
on
Can GnuPG Deliver?
·
· Score: 5, Informative
The problem isn't S/MIME per se. Anyone who can use OpenPGP libraries can easily use S/MIME, and vice versa. The problem is Outlook, pure and simple.
I don't remember the details, but it's been discussed on the OpenSSL lists recently. Outlook has totally dropped the ball on multi-part S/MIME messages. Because they're the 800-pound special-ed gorilla their incompetence means that few people are interested in using correctly working multi-part S/MIME tools that can't interoperate with the majority of people, while the coders understand how much damage is being done by the broken Outlook implementation and refuse to be involved in any effort that gives it credence.
I'm rarely see black hats hiding in shadows, but this is one of those exceptions. It's too easy to imagine some spook taking advantage of the fact that MS can kill the market for secure communications, while ensuring that the tools are still available for their users.
The fastest sort to write is the call to the library sort. qsort().
The lowest chance of writing a bug into a sort is the library sort. qsort().
The best known sort is the library sort. qsort().
Obviously other languages may have different library sorts, but IMHO any C/C++ developer who claims ignorance of qsort() is immediately and ruthlessly demoted to "2 years experience with little likelihood of succeeding in the field" category. This is a hard line, but I have yet to hear any reasonable excuse for being ignorant of the basic tools of your profession and being proud of it.
There are rare circumstances where I'll write my own sorts... but only after looking HARD for a way to call the library sort, and only because I've had a full year of graduate-level algorithms. Writing a good sort routine is *hard*, and it should only be done by people who know sorts cold. E.g., can you provide the running time and worst case performance of quick sort, Shell sort and heap sorts, and when those sorts might be worth the the effort instead of using the standard library sort?
I'm getting real tired of repeating this every few weeks.
When I recompile a standard package with different options (e.g., to match my environment, to be more secure by disabling some standard servers, etc.), intending to redistribute the packages to others, where the fsck am I supposed to put the results?
Hint: put it in the standard places and expect to be burned at the stake. I'll bring the burning torch. Non-standard builds that aren't clearly identified as non-standard tend to waste a *huge* amount of time because people reasonably, but erroneously, think that the package is official one.
To be blunt, the decision of where to put files is simple and well-established:
1) The standard packages (from Red Hat, Debian, whoever) loads into the standard locations.
2) Any modified packages distributed to others load into/opt. It's worth noting that it's/etc/opt,/lib/opt..., not/opt/etc,/opt/lib.... A lot of people (including me) tend to get this wrong, but it's in the FHS.
3) Any modified packages that are not distributed to others load into/usr/local. In this case it's/usr/local/etc,/usr/local/lib....
4) Any original package not distributed by the OS has historically gone into/opt, but with PM/CM it could load into the standard locations. It should never load into/usr/local.
5) Finally, "depot" style builds use their own trees, probably following the/opt practices.
As an aside, I've even been experimenting with a tool that rewrites Debian packages so the load into/opt instead the standard locations. Relocating the files is trivial - it's a rewrite of the data.tar.gz headers and some standard control.tar.gz files, but automatically fixing installation scripts is still problematic.
The thing about the article that really pisses me off is that *all* of his advice can be applied equally well in all four scenarios. The fact that I can mechanically change a package to use a different installation target really drives this home. Yet out of nowhere he makes an uninformed comment that makes life difficult for those of us distributing modified standard files. (Comment deleted for profanity)
I know most left-handed individuals feel that many standard tools are awkward to use because of some subtle biases towards the right-handed majority. E.g., think about the standard manual can opener.
Will the "thumb users" find standard objects equally awkward to use? What about after some thumb-based tools have become widely available (e.g., I could imagine swapping out a standard keyboard for a thumbboard), since that will provide less exposure to finger-based devices?
Much more complex than it first seems
on
Beginning SQL?
·
· Score: 5, Interesting
This issue is a *lot* more complex than it first seems. There's a lot of really bad SQL code out there, and many of the authors don't even realize how little they know.
The problem is that it takes time and experience to really develop a sense for how to use the data. If you're a programmer, you should have at least some familiarity with performance issues even if you don't always pick the best algorithm for the problem. Likewise with a SQL database you really need to understand why 3NF is important, why referential integrity is a really good idea, etc. It's not uncommon for databases to span many gigabytes and a bad design can literally cost millions of dollars as you throw more hardware and expensive database licenses at the problem.
This isn't just theoretical - ghosting can be a problem with 3NF data, and you need to know how to recognize it and fix it. (More precisely, how to fix it without using 1NF or 2NF, which both have serious problems that 3NF fixes.)
Then there's the issues of views. It's easy to understand read-only views, but updateable views make life incrediby interesting. But this is critical - a bad updateable view will create a lot of subtle errors in your database.
Other issues - how do you access the data? This is everything from JDBC or Pro*C to JSP tag libraries. How do you handle bad data, or bad assumptions? (Nothing teaches you how hard it is to get a unique identifier like trying to actually find unique identifiers for real data.)
Finally, many of these sites aren't just looking for SQL knowledge, they're looking for specific packages like Oracle Financials.
I think the best way to illustrate just how much there is to learn is that a friend recently decided to get Oracle certification to help land jobs. She's been focusing on databases for almost a decade, yet she still had to study hard for the exams. I've been doing intermittent database work for even longer and have pulled several rabbits out of my hat - yet I know I would struggle to pass just one part (of four) of the exams.
But on the question at hand, my advice is to get an introductory text and start solving some problems. Create a database listing your CDs, then extend it to handle DVDs and VHS tapes, then extend it again to handle books and magazines. Create an index to keep track of your softball or bowling league stats - the teams, the players, the individual and team stats. You'll learn more from one or two reasonably large problems than you'll learn from a dozen books.
That's not a "kickstart" program. It sounds like a great program once you've been working out for 6-12 months, but it's not something for couch potatoes.
If it was filed in 19_98_, then the Unix "crypt(1)" program predates it by a generation. A human generation, not a "software generation." crypt(1) only offered trivial protection, but it *was* an application-independent system resource that could be used to encrypt and decrypt messages with a classic algorithm.
It sounds like the attorneys who filed that patent application need to be face penalties for filing a fradulent legal document. Don't just invalidate the patent, disbar the assholes who try to patent stuff that's been common practice for decades.
All of the office equipment will be 2-phase. Three-phase wiring is mostly used in industrial settings, although it might also be used with consumer oven and electric clothes dryers.
Call me stupid, but what's the problem here? They're talking about the Java(tm) language and libaries developed and promoted by Sun, so the latter is well within its rights AND OBLIGATIONS in asking them to remember to add the "(tm)."
Changing the URL may be overkill, but it's still very reasonable for "javaranch.com" to be the short name and the preferred name (title, first use in all documents, etc.) to be the more verbose form.
As for comparisons to Microsoft Windows, this situation is totally different. "Window" has several specific meanings within the technical literature (Windowing GUI system, "window" and "viewport" in computer graphics, "window" into paged memory (a hack to get more memory than a processor's address space can handle into a system), etc.) In contrast, I'm not aware of any "java" use within the technical literature except as the beverage of choice for many developers.
There have been some (joking) "pro-abortion" groups, they stalk public areas and force unwanted abortions on protesting women. Few pro-choicers like abortions, they just feel that there are circumstances where abortions are the lessor of evils.
Am I the only one who wants to see a summons sent to the Battle Creek, Michigan city servers... using a technically correct but problematic header? (I would like to the earlier/. article on ORBZ here, but it seems to have disappeared.)
I would love to see them try to threaten a Federal Court with a felony trespass charge because they're exercising their own sovereign rights to summon parties before the court. My money is on the federal courts in this case.
The ironic thing is that he has the most to fear if he never uses illegal drugs.
About a decade ago the US Government decided to drug test about 8000 senior civil service employees applying for promotions. These are all highly skilled professionals with a lot to lose, so there's very little chance that any will be using drugs at this time.
About 8 people tested positive. Aha!, said the feds, this proves the validity of these tests! We would have never suspected these highly respected individuals were drug fiends without this testing! They actually used the relative handful of positives as "proof" of the validity of the tests.
Not so fast, countered the lawyers. No drug test is positive, and even if have three independent tests with a 10% false positive rate then 0.1% percent will be falsely labeled as drug users. Or about 8 out of 8,000. (In reality, of course, systemic errors such as a forgotten poppy-seed bagel will tend to skew all three tests.) The relative handful of positives, and the context of the test, suggests that these are innocent people wrongly accused.
The case actually made it to the Supreme Court, and as I recall the Supreme Court essentially said that it couldn't be bothered with questions about the scientific validity of tests when *drugs* are involved. The individuals were denied promotions on the basis of these tests alone.
Adding further insult, many mandatory "drug treatment programs" that can be triggered by these false positives *require* you to admit to your "problem" as part of your "treatment." If you do occasionally smoke a joint on weekends, you can cop to it and keep your job. But if you're drug free you're labeled uncooperative and can be terminated for resisting "treatment."
If the pyramid scheme wants you to use the mail in any way (e.g., sending that $5), it falls under the jurisdiction of the USPS Postal Inspector.
Send it to your postal inspector. I believe you can just put it in an envelope with "US Postal Inspector - Pyramid Scheme Enclosed" written on it - no postage - and the carrier will accept it and pass it along.
Even if it's a private mailbox the Post Office could decide to stop all deliveries to that address pending an investigation, turn it over to the FTC or local AG, etc.
The moon's orbit is used for a couple reasons, most noticably the "lensing" effect both the earth and moon have on close misses. Something that passes this closely is going to have its orbit affected by the gravitational attraction.
As for the impact of the rock, we no longer have the luxury of only caring about the area immediately adjacent to the impact point. During the first Gulf War there was a brilliant flash seen by military satellites from an impact that exploded over the Pacific Ocean. Had circumstances been slightly different the flash would have been seen over the Persian Gulf or Middle East, and it's virtually certain that the flash would have been initially interpreted as a nuclear detonation. (Watching for such flashes is exactly why these satellites were launched.)
If the error was not quickly determined -- and it could be very difficult with another Tunguska-level event where the *only* way to distinguish it from a nuke is the lack of radiation -- then the deaths from the subsequent "retaliation" could easily dwarf the deaths from the initial impact.
Ever use SMS to talk about hot babes without them knowing it?
Now try it again, only talking about a coordinated attack on a crowd. Voice "you take the out the guard by the east door, I'll take out the one on the south side" would warn anyone within earshot, but SMS wouldn't.
Other areas where SMS could be a problem is getting through airport security - if one of your co-hijackers was caught, the others could SMS each other warning them to avoid certain checkpoints, or by somebody outside of a bank robbery in case things go bad and the people inside need to know what the police are up to outside.
Then came commercial puns such as HP/UX and AIX. And non-commercial educational puns like Minix. All careful to avoid the letters U-N-I-X to avoid AT&T lawyers. But it's important to remember that U-N-I-X is a meaningless word - the only thing remotely close to it is eunichs, itself a bad pun on the social life of most programmers but not a generic term in any way.
In this environment, it's natural that some punsters started referring to Linus's pet project as Linux. He didn't name it that, others did.
Slashdot Mirror
So it's no longer "data" vs "audio," but "home" vs "work?"
I admit it, this really pisses me off because it's clearly an effort to manipulate perception and partition the market in ways more favorable to the RIAA. They'll leave offices alone, for now, if they can get the legal presumption that all home users are pirates.
But in fact many people work from home - for many service-based small businesses there is no "office" - and for most people the CDR is the only backup medium they have. Even those of us with real tape drives (I have both TR-4 and DDS tapes) often use CDR backups because of the fast recovery rates. (With a indexed compressed tar system I'm working on, I can do wildcard recoveries from a full 800MB CDR in a matter of seconds.)
But according to the RIAA, I use those 50-disc spindles to rip insufferable pop music, not to backup up my own business files.
Unless they've totally redone their code, openca won't take you very far.
The problem is that a production CA almost certainly follows nesting 90-10 rules. 90% (or more) of the time is spent on lookups, with 10% for everything else. 90% of *that* is spent authenticating the identity of people requesting some action, 10% is spent actually doing the work. Yet most of the OSS CA code focuses on that sexy 1%, not the boring (but critical) 99%.
As for openca in particular, I seem to recall that it used a storage mechanism similar to that used by the openssl ca approach. That's separate files, with symlinks from the 32-bit hash of the entire key. That's good enough for a proof-of-concept toy, but a CA needs to be able to support *fast* searches on 6-8 separate search keys (e.g., subject DN, issuer DN, issuer + SN, hashses of same, subject keyid, whole-cert hash, and ideally components of the DNs.) And those hases are should be the full 160-bit SHA1 hash, base64 encoded.
The CA also needs to support these lookups through LDAP and HTTP, and should be able to present the information in a variety of formats for the various users.
That's why I wrote my PKIX extensions to PostgreSQL, and the cert repository code in JSP/servlets. Not because I expect to have million-record repositories, but because it's easy to integrate the repository with other systems. It's why the author of EJBCA is using EJB in his CA - again it provides an easy way to integrate with other systems via J2EE.
Since I could create such a public CA easily enough, why don't I? Simple - I feel my time is better spent figuring out how to work with crypto java cards under Linux, not creating what amounts to a toy. Or using the same certs to provide strong encryption in PostgreSQL. (In fact, I originally implemented an OpenPGP style encryption, then switched to PKCS7 cert style encryption. Basic crypto support is already available, but full support requires extensions to the grammar and a lot more DB-specific knowledge than I have at the moment.) Or continuing to develop my CD-R backup program that so that the compressed tar files are encrypted. Again, for technical reasons I started with OpenPGP formatting and switched to PKCS7.
X.509 isn't just winning because of Microsoft, it's because PGP has some serious problems right now.
Where are the PGP key servers? "Trust" is a nice concept, but you still need to be able to communicate with strangers with no common mutual friends. You still need to be able to check whether a key has been compromised/revoked.
In some ways more importantly, where's the continuity? I can revoke a cert, issue a new one, and it shouldn't cause any problem for most users. But if you revoke your cert (e.g., because I know it's been compromised) how can I transparently transition to your next cert.
I think what many people have forgotten is that PGP was never intended to replace centralized authorities, just to provide an alternative at a time when it looked very possible that a government monopoly on certs (with mandatory key escrow) could be put into place. PKIX makes a lot more sense for most situations, as long as there's not a single government-mandated provider.
If it's so easy, why haven't you done it?
You're correct that it's not difficult to sign certs. But a CA needs to do a lot more than that. You need to be able to handle revocations and renewals, while avoiding the fradulent revocations and renewals by third parties. You need to be able to publish the certs and CRLs to any interested party. You need to provide the standard search methods.
And once you've done all of that, you're still left with the question of exactly what the cert means. A free cert that shows nothing but the fact that you have an email address isn't particularly useful. It gives you encrypted email, but no real authentication.
That's better than nothing, but the suspect the other people working on CA projects feel that we'll get more benefit from our efforts elsewhere.
Of course DNA is a creative work. But the author has a tendency to take things a bit personally when you step on his turf - plagues of locusts, seas of blood, 40 years wandering the dessert.
"False gods" are a particular sore spot. It also involved money and the creation of synthetic animals -- wasn't there something about cattle made of gold?
So sure, claim His work. But don't expect much sympathy when a Legion of Angelic Lawyers arrive to contest it.
</passover humor>
Let's get something straight before I go any further. Spam (email and fax) is theft. It's theft of my resources - my bandwidth, my disk space, and my paper and toner supplies.
Unsolicited physical mail does me relatively little harm. It does take a bit of time to sort through it, but the USPS won't toss out my VISA bill because the annoying weekly flyer has taken up the last of my mailbox space.
In contrast, I've lost email because spam filled a partition. (Some broken mailer hit me with 20+ copies of a multimegabyte file in less than an hour.) My fax machine, being the cheapest I could find since I was mostly interested in outgoing faxes, uses a plastic strip that can only handle a relative handful of pages. Every junk fax that I receive significantly increases the risk that an important fax will be cut off.
If the courts rule that it's legal to steal from me, the results are obvious and inevitable. No more fax, no more junk mail, no answering machine (same legal logic applies), no telephone. You want to talk to me, you'll do it just like the Founding Fathers expected - you'll send a letter or you'll visit me in person because the cost of me offering any alternative is too high.
Search the literature - what was used before the mechanical systems of WW-II?
These were the strongest ciphers that could be used in an era before mechanical assistance (and you could even simulate the Engima machine with pen and paper!), so they satisfy two of your requirements. But you won't find asymmetrical ciphers from that era.
However, you can find some ciphers far stronger than the simple rotor engines others are suggesting.
I can't believe it's necessary to point this out.
The "giant penguin attacking Redmond" ad was humorous and ironic. (We all know who the 800-pound gorilla is around here.) Nobody looked at that banner ad and decided to eliminate MS products from consideration for a project out of fear that a giant rampaging penguin would lay waste to their town.
In contract, a lot of people still give a lot of weight to Microsoft's advertising. I guess they think it's one thing to damn near lie in a Federal criminal case, but MS would never lie to customers and potential customers.
So these comments have a real chance of causing people to back away from Unix.
Worse, and perhaps the real purpose of this campaign, the fact that their claims apply even more directly to MS products than Unix/Linux will provide an "innoculation" effect when the Unix/Linux people offer reasons for getting away from MS products. The poor victims of the Dark Jedi mind tricks will recognize the phrases and believe that everyone is equally guilty. Just like how "everyone" now knows that all software is buggy, that "configuration" only refers to trivialities like selecting the background image on your desktop, etc. That's a well-known technique for eliminating the ability of your critics to attack your own weaknesses.
If you're going to repeat that old crap, make sure you get it right. Linux(tm) is not Unix(tm), because nobody has felt any need to pay for Unix(tm) certification for any Linux(tm) system.
The "Unix(tm)" name is now nothing more than marketing Jedi mind tricks. Do you insist your mouthwash contain T<sub>2</sub>5(tm) (otherwise known as water)? Of course not - for the stuff that really matters, all are pretty much the same. Ditto, what's important isn't the Unix(tm) label, it's compliance with POSIX standards.
If you get deep into the implementation details, it's true that Linux didn't fork from the original Unix source tree and like any "clean-room" implementation there are some significant differences. BFD. As long as the system stays close enough to the POSIX standards it's a moot point to everyone but kernel developers and marketing droids.
The problem isn't S/MIME per se. Anyone who can use OpenPGP libraries can easily use S/MIME, and vice versa. The problem is Outlook, pure and simple.
I don't remember the details, but it's been discussed on the OpenSSL lists recently. Outlook has totally dropped the ball on multi-part S/MIME messages. Because they're the 800-pound special-ed gorilla their incompetence means that few people are interested in using correctly working multi-part S/MIME tools that can't interoperate with the majority of people, while the coders understand how much damage is being done by the broken Outlook implementation and refuse to be involved in any effort that gives it credence.
I'm rarely see black hats hiding in shadows, but this is one of those exceptions. It's too easy to imagine some spook taking advantage of the fact that MS can kill the market for secure communications, while ensuring that the tools are still available for their users.
Why are you writing sorting routines anyway?
The fastest sort to write is the call to the library sort. qsort().
The lowest chance of writing a bug into a sort is the library sort. qsort().
The best known sort is the library sort. qsort().
Obviously other languages may have different library sorts, but IMHO any C/C++ developer who claims ignorance of qsort() is immediately and ruthlessly demoted to "2 years experience with little likelihood of succeeding in the field" category. This is a hard line, but I have yet to hear any reasonable excuse for being ignorant of the basic tools of your profession and being proud of it.
There are rare circumstances where I'll write my own sorts... but only after looking HARD for a way to call the library sort, and only because I've had a full year of graduate-level algorithms. Writing a good sort routine is *hard*, and it should only be done by people who know sorts cold. E.g., can you provide the running time and worst case performance of quick sort, Shell sort and heap sorts, and when those sorts might be worth the the effort instead of using the standard library sort?
I'm getting real tired of repeating this every few weeks.
/opt. It's worth noting that it's /etc/opt, /lib/opt..., not /opt/etc, /opt/lib.... A lot of people (including me) tend to get this wrong, but it's in the FHS.
/usr/local. In this case it's /usr/local/etc, /usr/local/lib....
/opt, but with PM/CM it could load into the standard locations. It should never load into /usr/local.
/opt practices.
/opt instead the standard locations. Relocating the files is trivial - it's a rewrite of the data.tar.gz headers and some standard control.tar.gz files, but automatically fixing installation scripts is still problematic.
When I recompile a standard package with different options (e.g., to match my environment, to be more secure by disabling some standard servers, etc.), intending to redistribute the packages to others, where the fsck am I supposed to put the results?
Hint: put it in the standard places and expect to be burned at the stake. I'll bring the burning torch. Non-standard builds that aren't clearly identified as non-standard tend to waste a *huge* amount of time because people reasonably, but erroneously, think that the package is official one.
To be blunt, the decision of where to put files is simple and well-established:
1) The standard packages (from Red Hat, Debian, whoever) loads into the standard locations.
2) Any modified packages distributed to others load into
3) Any modified packages that are not distributed to others load into
4) Any original package not distributed by the OS has historically gone into
5) Finally, "depot" style builds use their own trees, probably following the
As an aside, I've even been experimenting with a tool that rewrites Debian packages so the load into
The thing about the article that really pisses me off is that *all* of his advice can be applied equally well in all four scenarios. The fact that I can mechanically change a package to use a different installation target really drives this home. Yet out of nowhere he makes an uninformed comment that makes life difficult for those of us distributing modified standard files. (Comment deleted for profanity)
I know most left-handed individuals feel that many standard tools are awkward to use because of some subtle biases towards the right-handed majority. E.g., think about the standard manual can opener.
Will the "thumb users" find standard objects equally awkward to use? What about after some thumb-based tools have become widely available (e.g., I could imagine swapping out a standard keyboard for a thumbboard), since that will provide less exposure to finger-based devices?
This issue is a *lot* more complex than it first seems. There's a lot of really bad SQL code out there, and many of the authors don't even realize how little they know.
The problem is that it takes time and experience to really develop a sense for how to use the data. If you're a programmer, you should have at least some familiarity with performance issues even if you don't always pick the best algorithm for the problem. Likewise with a SQL database you really need to understand why 3NF is important, why referential integrity is a really good idea, etc. It's not uncommon for databases to span many gigabytes and a bad design can literally cost millions of dollars as you throw more hardware and expensive database licenses at the problem.
This isn't just theoretical - ghosting can be a problem with 3NF data, and you need to know how to recognize it and fix it. (More precisely, how to fix it without using 1NF or 2NF, which both have serious problems that 3NF fixes.)
Then there's the issues of views. It's easy to understand read-only views, but updateable views make life incrediby interesting. But this is critical - a bad updateable view will create a lot of subtle errors in your database.
Other issues - how do you access the data? This is everything from JDBC or Pro*C to JSP tag libraries. How do you handle bad data, or bad assumptions? (Nothing teaches you how hard it is to get a unique identifier like trying to actually find unique identifiers for real data.)
Finally, many of these sites aren't just looking for SQL knowledge, they're looking for specific packages like Oracle Financials.
I think the best way to illustrate just how much there is to learn is that a friend recently decided to get Oracle certification to help land jobs. She's been focusing on databases for almost a decade, yet she still had to study hard for the exams. I've been doing intermittent database work for even longer and have pulled several rabbits out of my hat - yet I know I would struggle to pass just one part (of four) of the exams.
But on the question at hand, my advice is to get an introductory text and start solving some problems. Create a database listing your CDs, then extend it to handle DVDs and VHS tapes, then extend it again to handle books and magazines. Create an index to keep track of your softball or bowling league stats - the teams, the players, the individual and team stats. You'll learn more from one or two reasonably large problems than you'll learn from a dozen books.
That's not a "kickstart" program. It sounds like a great program once you've been working out for 6-12 months, but it's not something for couch potatoes.
Forget SFS.
If it was filed in 19_98_, then the Unix "crypt(1)" program predates it by a generation. A human generation, not a "software generation." crypt(1) only offered trivial protection, but it *was* an application-independent system resource that could be used to encrypt and decrypt messages with a classic algorithm.
It sounds like the attorneys who filed that patent application need to be face penalties for filing a fradulent legal document. Don't just invalidate the patent, disbar the assholes who try to patent stuff that's been common practice for decades.
All of the office equipment will be 2-phase. Three-phase wiring is mostly used in industrial settings, although it might also be used with consumer oven and electric clothes dryers.
Call me stupid, but what's the problem here? They're talking about the Java(tm) language and libaries developed and promoted by Sun, so the latter is well within its rights AND OBLIGATIONS in asking them to remember to add the "(tm)."
Changing the URL may be overkill, but it's still very reasonable for "javaranch.com" to be the short name and the preferred name (title, first use in all documents, etc.) to be the more verbose form.
As for comparisons to Microsoft Windows, this situation is totally different. "Window" has several specific meanings within the technical literature (Windowing GUI system, "window" and "viewport" in computer graphics, "window" into paged memory (a hack to get more memory than a processor's address space can handle into a system), etc.) In contrast, I'm not aware of any "java" use within the technical literature except as the beverage of choice for many developers.
There have been some (joking) "pro-abortion" groups, they stalk public areas and force unwanted abortions on protesting women. Few pro-choicers like abortions, they just feel that there are circumstances where abortions are the lessor of evils.
Am I the only one who wants to see a summons sent to the Battle Creek, Michigan city servers... using a technically correct but problematic header? (I would like to the earlier /. article on ORBZ here, but it seems to have disappeared.)
I would love to see them try to threaten a Federal Court with a felony trespass charge because they're exercising their own sovereign rights to summon parties before the court. My money is on the federal courts in this case.
The ironic thing is that he has the most to fear if he never uses illegal drugs.
About a decade ago the US Government decided to drug test about 8000 senior civil service employees applying for promotions. These are all highly skilled professionals with a lot to lose, so there's very little chance that any will be using drugs at this time.
About 8 people tested positive. Aha!, said the feds, this proves the validity of these tests! We would have never suspected these highly respected individuals were drug fiends without this testing! They actually used the relative handful of positives as "proof" of the validity of the tests.
Not so fast, countered the lawyers. No drug test is positive, and even if have three independent tests with a 10% false positive rate then 0.1% percent will be falsely labeled as drug users. Or about 8 out of 8,000. (In reality, of course, systemic errors such as a forgotten poppy-seed bagel will tend to skew all three tests.) The relative handful of positives, and the context of the test, suggests that these are innocent people wrongly accused.
The case actually made it to the Supreme Court, and as I recall the Supreme Court essentially said that it couldn't be bothered with questions about the scientific validity of tests when *drugs* are involved. The individuals were denied promotions on the basis of these tests alone.
Adding further insult, many mandatory "drug treatment programs" that can be triggered by these false positives *require* you to admit to your "problem" as part of your "treatment." If you do occasionally smoke a joint on weekends, you can cop to it and keep your job. But if you're drug free you're labeled uncooperative and can be terminated for resisting "treatment."
If the pyramid scheme wants you to use the mail in any way (e.g., sending that $5), it falls under the jurisdiction of the USPS Postal Inspector.
Send it to your postal inspector. I believe you can just put it in an envelope with "US Postal Inspector - Pyramid Scheme Enclosed" written on it - no postage - and the carrier will accept it and pass it along.
Even if it's a private mailbox the Post Office could decide to stop all deliveries to that address pending an investigation, turn it over to the FTC or local AG, etc.
The moon's orbit is used for a couple reasons, most noticably the "lensing" effect both the earth and moon have on close misses. Something that passes this closely is going to have its orbit affected by the gravitational attraction.
As for the impact of the rock, we no longer have the luxury of only caring about the area immediately adjacent to the impact point. During the first Gulf War there was a brilliant flash seen by military satellites from an impact that exploded over the Pacific Ocean. Had circumstances been slightly different the flash would have been seen over the Persian Gulf or Middle East, and it's virtually certain that the flash would have been initially interpreted as a nuclear detonation. (Watching for such flashes is exactly why these satellites were launched.)
If the error was not quickly determined -- and it could be very difficult with another Tunguska-level event where the *only* way to distinguish it from a nuke is the lack of radiation -- then the deaths from the subsequent "retaliation" could easily dwarf the deaths from the initial impact.
Ever use SMS to talk about hot babes without them knowing it?
Now try it again, only talking about a coordinated attack on a crowd. Voice "you take the out the guard by the east door, I'll take out the one on the south side" would warn anyone within earshot, but SMS wouldn't.
Other areas where SMS could be a problem is getting through airport security - if one of your co-hijackers was caught, the others could SMS each other warning them to avoid certain checkpoints, or by somebody outside of a bank robbery in case things go bad and the people inside need to know what the police are up to outside.
Linux follows a long tradition of similar names.
In the begining was Multics.
Then came Unix, a pun on Multics.
Then came commercial puns such as HP/UX and AIX. And non-commercial educational puns like Minix. All careful to avoid the letters U-N-I-X to avoid AT&T lawyers. But it's important to remember that U-N-I-X is a meaningless word - the only thing remotely close to it is eunichs, itself a bad pun on the social life of most programmers but not a generic term in any way.
In this environment, it's natural that some punsters started referring to Linus's pet project as Linux. He didn't name it that, others did.