Slashdot Mirror


User: mbpark

mbpark's activity in the archive.

Stories
0
Comments
40
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 40

  1. Here's how to do it :) on Commodore 64 Confuses Austrian Police · · Score: 2, Informative

    Here's the best way to do it:

    1. Use Star Commander or the equivalent program (ftp://ftp.zimmers.net/pub/cbm/archiving/c64/emuti l.prg) to make your .d64 files. Additionally, if they're feeling up to the challenge, mnib (http://markus.brenner.de/mnib/index.html).
    2. Use PDS Hash Toolkit or some other approved toolkit to hash the disk images you've created.

    They can also use 64hdd (www.64hdd.com), set it as drive #10, make directories on the partition they copy the files to, and then individually hash each file using PDS Hash Toolkit. You'll have to hash the 64hdd binaries as well.

    If he's a really hardcore user of the C= series, I think the price of that SuperCPU on eBay just went up by a few hundred euro.

  2. Re:Computer Forensics = FRAUD (fbi puts files in) on Forensic Discovery · · Score: 2, Interesting

    DoctorMabuse,

    I also use EnCase when I do forensics work, and prefer the SHA-1 hash features in it :). One of my customers is large enough to have their own copy, and access to iLook if needed.

    However, the procedural work that has to be done before an evidence disk gets into my hands is just as, if not, more important than the actual evidence. Even when it comes to log files, I have to follow a very firm set of procedures, starting with the md5 checksum of the files, before I even start. I also have to only work on the copies.

    However, I like EnCase for one other reason. They'll provide their own experts for you if required in your case. Even though the file system analysis is not as complete as iLook in some regards, it's still a really good product that provides the whole package.

    And, EnCase Enterprise Edition can examine live systems now :)

  3. Re:This isn't about what you think on Google's Dark Fibre Plans? · · Score: 1

    I have one simple response to that.

    It does not appear to be about just using trunking and turning everything into one big WAN. If you can deploy a modified layer 3 protocol, you can use it, in conjunction with applications, to intelligently route from server group to server group. Take a look at the Kentucky Linux Athlon Testbed (http://aggregate.org/FNN/) to see how you could deploy custom routing tables in a scenario where you assume that machines are not redundant, and in a scenario much like the one you describe.

    If you combine this with a good Layer 3 routing protocol (modified), you can have redundant server groups that can have another server take over in case of the failure of a primary. Google runs everything redundantly. Why have a single point of failure? :)

    I'll admit not being a networking expert, but I do know that part of what Google does involves intelligent searching of data, and that putting a Layer 3 protocol, albeit modified, in place, would provide a benefit over a straight WAN in that you can use it to determine how and where to store data if you combine it with the storage, with redundancy.

    If you combine the data with how it's stored (GFS), and you optimize the path how to get to it over your own network, while tying in your own intelligent routing algorithms, then you've got yourself something that can be used for incredibly fast data retrieval.

  4. This isn't about what you think on Google's Dark Fibre Plans? · · Score: 5, Interesting

    Hello,

    Considering what Google has built internally for server management and redundancy, I would hypothesize based upon available data (i.e. GFS) that they're looking to light up fiber between their data centers, while running either TCP/IP or IPv6 (with modifications of existing IGP and routing protocols, more than likely BGP or OSPF) between them.

    This is a very smart move on their part, if this is true. This would allow them to do their own internal traffic control and shaping over a private network, and develop/modify algorithms for efficient transfer of data over said network, without having to "play" by Telco/ISP rules.

    In other words, they're more than likely building their own global network to more efficiently transfer data over the Internet by completely bypassing it for their inter-server traffic. This is a very smart move, if true.

  5. well, there's one for $650 coming in a few weeks.. on PowerPC Open Platform Motherboards Finally Here · · Score: 3, Informative

    Hello,

    There's another PPC Motherboard with PCI, UDMA100, and Firewire coming in a couple of weeks from a German company named bPlan. It's called Pegasos, and info is here.

    $650 with a G3/400 is a lot more palatable than $3000. I just hope it has OpenFirmware on it!

  6. Don't forget the 8GB of the IDE64 :) on CompactFlash / IDE Interface for Apple II · · Score: 5, Insightful

    It's about time Apples caught up to the Commodore 64 ;).

    IDE64 has given them that ability for a while, since all you need is a CF to IDE adapter, and you can have up to two 8 GB harddrives on a c64, or a few CF cards, or a couple of IBM Microdrives :).

    16GB on that machine is completely nuts. You could quite possibly store every c64 game ever made (which I estimate at over 30,000 .d64 images total) and still have room left over for the applications.

    Of course, you can go for the 8GB HD and a CD-ROM :). Some of those screenshots are pretty nuts. I can't imagine loading the Windows 95 CD-ROM using LOAD"$",8

    Meanwhile, Nate has nearly hacked together an MP3 player for the c64 based on the MAS chip. That, and a quickcam, and a few other things. Look at the C= projects page. That's some wicked stuff.

    Now that's a hacker's machine. Give them enough time and they even get a workalike UNIX with a GUI and IRC client, as well as a 20Mhz CPU, 16MB RAM, and many other cool things. From what I hear, XGA video and PCI are next.

    I always did like these hackers of older systems. I would enjoy seeing those optimization techniques applied to modern code and compilers, especially gcc :).

  7. Hauppage on To HDTV or Not to HDTV? · · Score: 2

    You can get a Hauppage WinTV-D and get ATSC HDTV formats on your PC for about $500 :).

    The link to the Datasheet is Here.

    It's a nice device, and it does TiVO functionality too. I'm not sure if this card has any Linux support.

    However, it also does Digital to SVHS conversion, and all the other good things like recording of Digital TV. The only downside is that it renders everything in 480i.

    For $500, I know what I am buying :). I can buy one of these and a decent projector off eBay for $2000 and have HDTV cheaper and with a better picture than actually buying the set and spending over that amount. If a better HDTV card comes out, I'll just upgrade.

  8. I will say this much...it's an Admin issue on Gartner Group Suggests Dumping IIS For Now · · Score: 2

    Here's how I look at it (and with one IIS box on the Internet at a colo location, the rest being UNIX or Linux).

    1. Most of IIS you don't need. My script mappings in IIS are .shtml, .asp, and .pl. Period. I have one DLL allowed, and that's SDIIS.DLL, for RSA AceServer authentication, and that's done in a virtual directory with its own mapping for just that dll. The rest of it that I deleted is a gaping large maw of security hell and buffer overflows like Index Server, .htr files, and .idc files.

    2. My web root is not in the \inetpub directory.

    3. ALL extraneous services are turned off.

    4. ALL web directories except the site's are turned off.

    IIS is an insecure piece of crap in its default install, but Apache and Netscape/iPlanet can be as well.

    It's a matter of actually auditing your systems, whether they run Linux, NT, or some other OS, and making sure that you audit them properly and only allow what you need. Make sure the system serves its purpose. And make sure IUSR_ only has read access to \winnt, and only gets create/read/write access to \winnt\system32\logfiles. Period. You also want to make sure it has read access to its webroot directory, and no ability to write anything except to that one logging directory.

    This was not an issue of the virus. This was an issue of poor adminstration.

    I just went through 3 days of logfiles from that NT server (4.0, SP6A, with over 50 hotfixes ARGH!), and because we followed some basic configuration guidelines that come naturally with Apache admins apparently, we had 17,000 attempted break-ins, and 404's for all.

    You can't point and click your way to good security. It's a matter of making sure that you only allow in what you want, and making sure the patches are THERE.

    Apparently this isn't a problem with some Linux distributions, especially Debian and Slackware, because they actually care enough to not install many things you do not need. Red Hat is another issue :). If people install Red Hat with a default install instead of IIS and think switching to Linux solves their problems, someone will make another Ramen worm.

    It's not just an IIS problem. It's an administration problem. People have to be educated to not turn on world+dog with their web server, and keep up with patches, or else this happens. I hope at the least it causes some admins to realize that ANY OS+Web Server must be configured properly before putting it out on the Internet for public view, because not even a PIX is going to protect you from bad configuration.

  9. Hmmm....perl....haven't we learned from Oracle? on MySQL Gets Perl Stored Procedures · · Score: 4, Interesting

    What I find extremely funny about this all is that Microsoft is doing the same thing in SQL Server 9.0, by putting the CLR in the SQL Server database. This way you can write your procedures for SQL Server in many languages, including Perl. OUCH. It causes more overhead than you realize to have an interpreter for more than SQL in the database.

    I'm a DBA. I have seen the last few versions of Oracle with their Java Stored Procedure and SQLJ support, which is pretty bad. Oracle can't even get their PL/SQL running right between queries and views and stored procedures (the engine has not changed for PL/SQL since 7.3 in 8i, and 9i does not change it that much. Yes, they run 2 engines, one for SQL and one for PL/SQL. It makes Oracle perf tuning a complete nightmare). Yet they find it necessary to shoehorn a complete JVM in. No, no one really uses it, because it doesn't provide advantages.

    It only makes the code completely unmaintainable since it's nothing more than code that calls the internal JDBC driver rather than an external one.

    PL/SQL, T-SQL, and the other stored procedure languages at least are written in a superset of the main DML/DDL language. This allows you to use the same language optimizer, which reduces code size, and allows for code consistency across the entire project. In other words, all the queries, including parts of stored procedures, get the same optimization treatment.

    Having ONE optimizer means that you can make it run really well, and share query plans and cached information. Pretty cool :).

    The other important reason you have stored procedures is because if they are written in the main language, you can leverage the optimizer for query plans and caching of frequently-used or prototyped statements. That's part of the other reason for stored procedures. You can share queries and query prototypes with views and user queries, and have optmization that is better than what writing a procedure in X language can do.

    Now we've got Microsoft coming in with their CLR, and mySQL using Perl. This is going to lead to even more unmaintainable code, because you're going to have people coding business logic that can be optimized in the DDL/DML language used in a higher-level language that cannot be.

    Talk about a performance problem :).

    From a language and optimization perspective, you always try and use a derivative of the main DML/DDL language of the database, so that you can use the same optimizer for making the statements run faster and perform well.

    Anyone can write internal hooks to have a code interpretation engine in a SQL database. Oracle's been doing it for years, and so has Sybase. No one I know uses it because it doesn't provide the real advantages of stored subprograms in a database, which is to store frequently-used and prototyped query statements and aggregations in such a way so that they can be optimally retrieved versus just executed. When you add additional languages, you lose that. Oracle's Java Stored Procedures are nothing more than Java code that calls a different JDBC driver. I don't even want to think of what ADO.NET is going to do in SQL Server 9.

    While this seems like a good idea, remember that it's been out for a few years in two other products, and is coming out for another. It's not as big a deal as real SQL stored procedures, because it's not as optimal as they are due to their loose coupling (which describes it perfectly IMHO), and can't share in the same optimization techniques as user SQL queries.

    In other words, this isn't something to be too happy about, since it's something that people already have and don't use.

  10. Wow. $140K for a stereo system. on Insanely Audiophile · · Score: 5

    Hello,

    I can easily see how a stereo system can cost that much money. One of the more interesting people I have heard was of an EE who built his system out of extremely high-end components (a LOT of Mark Levinson), and who actually built the rest of it himself from parts, especially the interconnects. When you've got the knowledge this guy has (and he lives up near Montreal in upstate NY), and the drive to search for not only stereo components, but super-high-grade electronics components to finish off the system, you're going to have yourself a system that will sound better, period.

    If you know where to look, you can find the parts you need. The dials and switches in one of the components he built were incredibly sensitive, and easily cost several hundred dollars on their own. Same goes for the capacitors as well. If you want to build your own amplifier or pre-amp, the instructions are readily available on the net.

    The funny part was the guy actually paid Lucasfilm, the trademark holders of THX, to certify his system for it. It passed. Yes, that alone will cost you as much as a Lexus if you're not a movie theater chain.

    By building the major parts himself, and finding other components and speakers that were just as good, he saved himself over $25K.

    There's a site called Madisound that will sell you the components you need to build very high-quality speakers. I will be buying my next speakers and having them assembled from 1" DuPont Corian from these people, when I can actually afford it. If you go for Skanning woofers, they can run as much as $680.00 each. Speakers from them (with parts they will not list on their website because they would have to order them from the manufacturer) can cost over $10K, but the kits run anywhere from $300 to $2000 on average.

    However, I built a system that does what I want on a very tight budget (under $1000), most of which was spent on my turntable needle (Ortofon), BA speakers (which are surprisingly good), a Tandberg tape deck, and a Sony CD player (yeah, yeah, I know, but it sounds damn fine and is getting upgraded soon anyways to at least an H/K).

    I bought most of it at pawn shops. Sometimes audiophiles have to sell as well. Now I'm just planning a major upgrade to a NAD preamp/amp combination, custom speakers, and I haven't decided on the CD player yet :).

    However, I can understand spending $140K on a stereo if you have it. Larry Ellison spent over $1 million on his (which has a subwoofer that sits in a former indoor swimming pool with special acoustical filling, and yes he had it designed in, it is one of the biggest sub assemblies ever made), and Bill Gates is a serious audiophile as well. We know where Slash's royalty checks from GNR go as well :).

  11. Re:Microsoft Authentication On Web Properties on What Are Microsoft And Napster Talking About? · · Score: 2

    Hello,

    I did my homework on the Digital Certificates within Internet Explorer 5.x for Digital Rights Management.

    What I found were CA's for every major credit reporting agency (including Equifax), electronic billing providers, and a few Microsoft ones, besides the usual Thawte and Verisign Ones. Deustche Telekom even has two CA's in IE 5.x.

    Microsoft has been testing time-limited WMA files for about two years now. Windows XP and WMP8 include full DRM, among other 1984-eqsue identification tools.

    .NET, from what I have seen and played with, does have the APIs possible to generate a unique ID for a computer. That's the issue with Windows XP now, because it uses the hardware to generate a GUID-type string identifying the computer (and it changes with a hardware install). Windows XP adds significant identification abilities to .NET, allowing for identification of registered users, in combination with Hailstorm and Passport.

    Combine the two (and there are a LOT of things that Internet Explorer does to a system, the most significant being the DRM and installation of GTE CyberTrust and Equifax certificates), with the digital certificate generated for each user of a Windows 2000 or XP system (which is why IE 5.00 broke Windows 2000, because it overwrote RSABASE.DLL and RSAENH.DLL, the two DLL's Microsoft uses in IE for SSL and Digital Certificates for 56-bit and 128-bit encryption, respectively. When these are broken, Windows 2000 or XP cannot authenticate a user.).

    Microsoft has a complete DRM system in place capable of authenticating users, computers, installed software, and the capability to bill for it through MSN premium services. In addition, the acquisition of Great Plains software may provide Microsoft the ability for companies to integrate billing for these services (aka micropayments) through MSN bCentral (which is also going .NET).

    Napster may be interested in using this system of theirs to provide a way of keeping the file-sharing while charging to actually listen to the song through Windows Media Player 8 and Windows XP. It's all about money. This solution makes the RIAA happy, Microsoft happy, and Lars happy. It makes a lot of people who use Napster for MP3 files really pissed off. Most of all, it will make OpenNap, Gnutella, Freenet, and whatever cDc comes up with very popular.

    Just doing my homework on IE (and also worked on a PKI project here that involved certificates).

  12. Microsoft Authentication On Web Properties on What Are Microsoft And Napster Talking About? · · Score: 5

    I am beginning to see a pattern here.

    First, eBay signed up to use .NET and Hailstorm for their authentication processes.

    Secondly, Microsoft integrated a complete Digital Rights Management system into IE 5.0 and above, with respective authentication in Windows 2000/XP, and a patch for Windows 98/Me.

    If you don't believe me and have IE, go to Tools, Internet Options, Content Tab, Certificates, and click on the Advanced Button on that tab. When you look at Intended Purpose, you will see Digital Rights as a certificate option (among many other things).

    Third, Microsoft is and has been in with the RIAA and assorted other agencies to promote Digital Rights, and has their own WMA format to do so. They can use certificates to provide strong authentication on media files.

    Fourth, the Passport infrastructure that Microsoft is building (which encompasses .NET, Hotmail, their other web services, and Windows Media Player) will allow for full Internet-based Digital Rights Management, with Microsoft acting as the central authenticating authority.

    Fifth, they can also use their commerce infrastructure for micropayments, or leverage the common billing authority they are working on with .NET to give all users of Microsoft Products a common Microsoft Services Bill. They will be able to handle micropayments because they will have themselves set up as a centralized billing authority for all premium web content. This will may include Office, Windows Update, Windows Media Services (which in Windows XP will expand this to high-quality video), MSN, and Hotmail premium services.

    Fifth, bringing Napster aboard means that Microsoft can track all files, and therefore all users, by giving them a centralized Passport ID (which you already have). They will have the ability, in Windows 2000 and XP, to link that to a root certificate that identifies your computer, users on it, and files you have downloaded.

    Napster will be still able to download large amounts of audio files if this strategy is going where I've taken it. However, they will not be file you can play. You will have to use the Passport infrastructure to pay for these files to listen to them. Integrating Hailstorm and .NET will allow Napster to still have file sharing, but adds complete authentication services that the RIAA likes (note that I did not say couldn't be broken. I'd be stupid to think anything is uncrackable), and adds micropayments through Microsoft Billing Services.

    eBay is switching to the model too, which scares me in that many popular sites seem to be more than willing to cede control of user authentication to a central authority that I would never trust with my personal information. Yahoo does the same thing, but they don't associate a user with a machine, hardware, registered software products, or personal information to the level that Microsoft does.

    Napster joining with Microsoft is a BAD thing. It's one more step for Passport/.NET/HailStorm before they end up controlling a large portion of the sites on the net through their services. That, and it would make Napster pay, which would only make Lars happy :).

  13. If you want good support, you have to pay for it. on Tech Support: Sucking Even More · · Score: 3

    Tech Support is mostly hell. I've done it.

    However, it's a double-edged sword.

    1. Most Companies do not want to pay for technical support of their products. Therefore, the least competent people are put into it.

    2. The companies that do put competent people in tech support charge you a lot of money for it.

    Speaking as an Oracle customer, who spends $2,500+ per server per year on silver-level support, it's nasty. I have to spend that to get an operator on the phone with a decent wait time who knows what they are doing. However, I don't consider Oracle as inherently complex as Windows 98, simply because there's less stuff to break. Oracle also doesn't bundle Internet Explorer, the bane of support operators everywhere because it can and will break anything in a system.

    This ties in with the fact that there aren't even dependency lists for what things a program installer screws up. Most software manufacturers just don't let support communicate to the developers.

    Did I mention how much developers and engineers usually despise the end-user support people? There is a definate hatred there, and I've seen it way too many times.

    Technical Support, in most cases, is isolated from the rest of the company. Microsoft is especially guilty of this, unless you pay $250 per incident for support. Oracle is better, when you pay them a lot of money for Silver or Gold support.

    However, most users don't have that money. They also are stuck using extremely buggy products, like Internet Explorer, and software that can and will change every DLL and system library to the version it was built against (ICQ, Visual Studio, Internet Explorer, and Office 2000 are especially guilty) and not run if it doesn't find the right version. It's an unfortunate situation here, and not even the best tech support operators can handle these issues over a phone.

    What needs to happen is for software to be built right, documented, and then supported right. Unfortunately, the consumer technical support is not there because the margins must be the same as computer hardware as they are for software, razor-thin. Ideally, stable build environments for the software made these days too would help, since 90% of the problems I have run into are because of version dependencies.

    Then, maybe, I won't have to pay out the nose to get support like I do now on non-enterprise products. I'm more than willing to pay for support if I get extremely competent people on the phone.

  14. Re:CBM disk format - CBM 8050 Drives on Spying and Technology: Robert Philip Hanssen · · Score: 1

    I remember having two CBM 8050 drives.

    They were FAST (IEEE-488 interface does that. It was the SCSI of its day), and kept most of the CBM directory structure.

    They were supposed to use DS/QD disks. However, those 360K disks from the local store were able to format out to 1 MB.

    However, to clarify. The 1541, 4040, and 1571 drives can write out to track 44 if you play some tricks with CBM DOS. I had code that would do that from one of my old cracker books.

    The other interesting trick that was played was actually thought of by SubLogic. On Flight Simulator for the c64, the main loader program and a large amount of code was written to Track 18 (directory), and was only available via direct access.

    However, the tracks 35-44 trick was quite good, and could be used to hide a lot more data than track 40 :). From what I remember, the 8050 had the same trick too.

  15. The theory actually CAN be applied. on CS vs CIS · · Score: 1

    I have a degree in Computer Science, and I took a lot of the CIS classes so that I could learn more about UNIX and Java (where I went was very OS-agnostic in the Computer Science department).

    What I have discovered through real-life experience as a developer and DBA is that the theory that you learn in classes such as Data Structures, Operating Systems, and Compiler Theory, as well as calculus, statistics, and discrete math is applied in the real world more than you think.

    For example, learning SQL and learning how databases operate was simple after the two times I took discrete math (the only class I failed in college). I also used the relational theory a lot in Java, C/C++, and SQL code.

    When I had to learn WAP and WML, I was presented with EBNF (Extended Backus-Naur Form) grammars. Knowing EBNF from my CS classes helped there. Knowing what a context-free grammar is and how to work with them using flex and bison (and EBNF by deduction) to write a better solution was a big help with XML.

    When I had to write mathematically correct code, I used knowledge from Statistics and Numerical Analysis classes to do it.

    Meanwhile, when I took my CIS classes, they didn't care about software engineering practices or writing the best code. CIS presents their students with a lot more management and application-level classes. From what I have seen, they care more about the impact of applications and high-level application design. CS is NOT application-specific, and cares more about the right way to develop on all levels and why.

    However, when I took that one CIS Operating Systems class back at school, I remember the student presentations being essentially product slicks talking about vaporware. Apparently they must have a class on reading InfoWorld and eWeek. Not one mention of low-level filesystem fundamentals, process management, or IPC, and not ONE presentation on a UNIX variant (we did AmigaOS and covered all those topics and more). However, I learned a lot about NT ACL's and Novell. ;)

    My opinion is that a CS degree will help you more than you ever will realize in the real world. It will teach you how to think the right way about code and how to do it right. CIS people, from what I have seen, don't make it as higher-end developers unless they are really darn good. They just don't have that background. Those math and cs classes will help you think analytically and efficiently. You will learn how to program right, not just program in Java or COBOL :).

    I have half of my college CS textbooks as references because they are that relevant to actual work, especially the Data Structures and Algorithms Analysis book by Weiss (probably the most popular CS book along with the Dragon Book).

    Stick with CS. You'll be better off in the end, know more, and be better prepared to solve problems.

  16. I AM a PA resident..and am VERY happy with this. on PC "Lemon Law" Bill Introduced In Pennsylvania · · Score: 2

    Unfortunately, most users get sucked in by stores like "Cameras, Sound, Video, and Computers" who give deals that are too good to be true, and stick consumers with crap parts.

    I see this at the computer shows out here in PA all the time. You have people selling computers with parts that I wouldn't even use in a compost heap. When the parts break, the so-called "customer service" departments will do nothing to help and blame the consumer for even complaining. The consumer spends a lot of money out of pocket to get someone else to fix the system, and in the end they spend more for a crap computer with no warranty than they would have for something more stable and servicable WITH a warranty, such as a Dell.

    Because of this, the BBB out here in PA HATES computer stores, and especially the ones that are cut-rate and outright rude to customers, which is most of them outside CompUSA and MicroCenter, when it comes to warranty service of broken equipment. CompUSA and MicroCenter are much better than average here than anyone else (most of whom are outright thieves, which is why I buy mail-order than buy in PA), which does not speak too well about PA at all.

    Compaq (with their Presario line) is absolutely crap also, and Packard Bell/NEC are just as bad. A lot of smaller vendors also like to stick it to consumers by using the cheapest parts imaginable, especially in the systems sold in Computer Shopper.

    These systems DO break a lot. Consumers do get upset. PA is finally putting some teeth into their laws to prevent manufacturers from selling utter crap. I hope it bankrupts those computer stores that have been selling junk that breaks to consumers, and teaches them lessons about how not to screw over PA.

    Then again, most of these junk resellers will move to Delaware or New Jersey to try and avoid this law anyway.

  17. It's not just an MS issue. on Default Behavior: Piranha vs. Microsoft SQL Server · · Score: 1

    What's next. Are you going to publish that Oracle has a security hole because the default password for system is 'manager' and sys is 'change_on_install'? Sybase ASE sets a default blank password also, at least on 11.x.x, which is installed on a large amount of websites, and is used in the finance industry extensively.

    This is entirely a moot topic because EVERY major RDBMS I know ships with a default password. The only reason this seems to be an issue here is because most NT/SQL Server admins do not know better to change the password, and because the vast majority of NT/IIS/ASP applications apparently use the sa account.

    If you're a DBA and you leave a default password on a database, and you leave that port open on your firewall, you've got issues.

    If you even use the SA, SYS, or SYSTEM accounts in ANY applications for ANYTHING, you've got even bigger issues.

    If you even integrate the signons with anything other than Kerberos DCE or a properly secured Linux system, you're asking for it. SQL 7.0 does this by default, and YOU CANNOT TURN IT OFF IN 7.0 or 2000. You however could in 6.5.

    If you give ANY non-SA DB account on a public site access to the system tables or master database, you've shouldn't even be a DBA.

    If I wanted to, I could mount the same attack in Oracle using the UTL_FILE package in PL/SQL to read any file on an accessible system, especially on an Oracle NT installation where the Oracle account installs as a default of the LSA (Local System Authority), meaning I could literally use SQL*PLUS, the DBMS_JOB package, and some creative PL/SQL stored procedure to own an NT (or unsecured Linux/UNIX) box running Oracle with just access to port 1521 and SQL/PLUS on my box (downloadable from OTN) and some knowledge of PL/SQL.

    Sybase and Microsoft just make it much easier to do because of their default installs, and because MS makes it easy to run arbitrary OS commands. Sybase at least doesn't enable xp_cmdshell by default, from what I remember.

    Heck, Sybase does the same thing, and on Sybase on UNIX one can even send UDP packets from the DBMS itself in a stored procedure. Think of what one could do with a default Sybase install, port 5000 open, and 64-processor support.

    For what it's worth, Microsoft SQL Server 7.0 ships with a large amount of security holes that are much worse than a blank SA password, including the fact that unlike Oracle, you can't use encryption for client/server connections over TCP/IP without some serious hacking that disables your ability to patch or upgrade the server. Oracle can use SSL for client/server connections. It also uses NT default accounts, and the SQL Server Agent installs as LSA by default. Getting SQL Server 7.0 to run as anything non-priviliged is a pipe dream.

    The bottom line is however that MS, Sybase, Oracle, and many other RDBMS vendors ship their databases with default passwords. If you're going to rip Microsoft for it (which Slashdot WOULD do first, it's a Linux site!), you should also rip Oracle and Sybase for it also. Security starts with a good DBA/Sysadmin team and making sure that this does not happen.

  18. The issue isn't the browser, rather what it does. on Justice Department Decides To Break Up Microsoft · · Score: 2

    I've done extensive work with extranets, SSL, and web applications here. Here is why the judge has separated the two:

    IE does things to the underlying OS that Netscape and any other browser does not. When you install it, it replaces the SSL libraries already on the system. It also replaces a large amount of system files.

    As a matter of fact, IE 5.01 will install half the SSL files and security permissions needed to access the supposed secure features of W2K, such as driver signing, encrypted file system, and the Certificate Authorities that w2k uses to authenticate.

    Netscape does not do this on any version. As a matter of fact, you can mix and match Netscape versions on your machine, which you CANNOT do under IE. Merrill Lynch, when they first released Merrill Lynch Online for Windows, shipped NS 3.04 because it did the least damage under 128-bit SSL to the system, and it worked.

    It is this level of integration that caused this issue in the first place. This is why they want to separate the two between two companies. This level of integration is a NIGHTMARE to all of us who have to deal with SSL. I would prefer to have it so the following happens:

    1. I can install multiple versions of IE on a machine, which this will guarantee if this goes through. I now have to have multiple machines to do this, because VMware is slow, especially when emulating IE 5.5 or W2K.

    2. The underlying OS will not dictate certain brower functionality and vice versa. IE is notorious for changing the functionality of a system depending on the version.

    3. SSL will not screw up a system anymore, and will not install things you do not need or will not use (hopefully!).

    AOL & Netscape are APPLICATIONS, no matter how you say it. IE does things to the OS. Netscape does not. AOL does what it has to to the dial-up networking stack because MS's is incredibly flaky and will not work on all computers. AOL is the only application I know of that will work on all computers installed with Windows without the usual major issues of the MS TCP/IP stack. They did an awesome job with it.

    I am glad some people see the light and know what MS has done here, which causes all sorts of issues that developers and integrators have to work around because they call it "innovation". This work with IE smacks of typical strong-arm tactics that turned developers away from them.

  19. I've been doing my part to keep them alive on New Front In The Copyright-War: Abandon-Ware · · Score: 2

    Next to my CuMine 667 in this office sits a full Commodore 128 system with 2 joysticks. I still love to play old videogames, and enjoy being able to download a bunch of them from the 'net and copy them onto 1541/71 disks to play.

    However, I also do think that the media that they are stored on is getting old and rather unreliable. I am fortunate that most of my 15 year old C= disks still work, as does my 1571 drive.

    C= people have done a great job so far of cataloguing everything and were among the first to put it on CD-ROM. I cannot say the same for other formats. If I want to archive my old Commodore floppies on CD-R, my hard drive, or even 3.5" disks, I can. However, for many of these old videogame formats, and especially some of the games for older machines like the Spectrum, Apples, TRS-80, and MSX, it is not as widespread. It's there, but I can't just do it like I can with a C=.

    This is not just an issue for games, it's an issue for many other packages too. Quite frankly, a lot of the programmers back then had a lot less to work with and made the best of it. There are many applications, file formats, and extremely COOL code floating around on these unreliable formats.

    Don't laugh. Some of those people that programmed the TRS-80 built functionality into 16K of code for a word processor that I didn't see until Word 95. The people who wrote a lot of C= code did so with a machine that was not even the best machine of its time, however it was the most hackable of all of them for cool A/V effects.
    Its programmers turned its bugs into features, unlike most MS programmers today.

    However, I am doing my part to save these old games by keeping my archive of C= games (which is at over 500 disks from the 80's in my office here) safe, and gradually making .d64 images of them all (which get backed up on CD-R) I also do the same for other forms of media, and have built up a small lab so that I can copy from Apple, C=, old IBM (360K and up), and soon Amiga here.

    Some of what these programmers did just amazes me in how ingenious it is. The least we can all do is preserve it, study the code, and try to apply it so that we can write tight code in the future.

  20. I've been to Netcraft on Linux And Hip Hop · · Score: 1

    Netcraft is a very good source.

    However, it does not provide metrics for counting the very large amount of servers not accessible from the Internet. For example, it counts our main web server, running Apache/Linux. However, it does not count the numerous development servers that we run on and off-site that run Linux, NT, and FreeBSD. It also does not count the intranet servers people run, or mail servers.

    Netcraft is a good source for seeing what is directly connected to the Internet. However, it does not provide the statistics that show servers in use at companies that either:

    a. Are connected to the Internet and run web servers at ports other than 80 and not on 80.

    b. Are not connected to the Internet directly.

    c. Are used as directly-connected Internet servers that function in another capacity, such as a firewall, proxy server, mail server, or other method that does not provide statistics about what the underlying OS is.

    When there is a metric for that, I'll like it more than Netcraft.

  21. I agree with this on one principle on Linux And Hip Hop · · Score: 5

    Before 1990, rap music was not thought of as being as profitable as other forms of music.

    Why is that? Before 1990, the Billboard lists were not compiled based on actual data, rather they were based on hearsay on what albums were selling the most from the record stores.

    When soundscan was implemented in the summer of 1990, I believe it was, the first week's top 10 from Billboard based on actual album sales featured a VERY big surprise.

    NWA was in the top 10, and at #2 that week with the album 'Efil4zaggin'. They were #1 the next week. Darn good album too, even though Ice Cube left NWA before it.

    Much is the same with Linux and Microsoft. The old metrics of OS sales do not apply anymore, since Linux uses a different distribution method than Microsoft, as well as the traditional distribution channels. Now that the actual population of linux servers is being measured against the actual population of MS servers, the metrics have changed. In other words, the old methods of measuring OS penetration (physical sales) are like the pre-Soundscan methods (hearsay).

    I am looking forward to seeing actual counts of Linux servers in corporations. Boeing has been cited as having over 50,000. I would especially like to see what percentage of the corporate mail server market Linux has over MS and Lotus.

    In this way, Linux is like rap music, in that it was ignored because of methods of measuring sales and distribution that did not truly reflect actual figures.

  22. Even Better :) on WordPerfect Office 2000 - Now Shipping · · Score: 1

    $159 for both? Now I definately like that number. That's less than a Win2k Pro license (which I got today for testing under VMWare 2.0)!

    I checked out pricing for MS products today. That's even less than MS Select Pricing for Win2K/O2K if you're a business with under 400 people. Plus, unlike the combination of O2K and Win2K, these WILL work together. We ran the two together here, and although they DID work, it just wasn't well. Why wait for a service pack real soon now, when you can get the real thing now? :)

    By the way, I did run Excel and Word 2000 documents in StarOffice 5.1 and WP Beta. Worked flawlessly. Didn't run through Presentations though.

  23. This is definately a good thing :) on WordPerfect Office 2000 - Now Shipping · · Score: 2

    This release is not only a good product, but it has features integrated that give it a lower price point than the features MS Office2K + Adobe Acrobat for Windows + Crystal Reports provide.

    Right now, they are shipping a word processor and tools that allow export to PDF, a database with reporting capabilities that allow export to word processing documents, web pages, and PDF through an intermediate step, as well as pretty complete Office 2000 compatibility.

    The cost of this when you add up Office 2000 Professional, Crystal Reports, and Adobe Acrobat for Windows will run you $1000 per user if you don't have discounts. Throw in a Windows 98 license, and it goes up to $1100, or a Win2K Pro license, which makes it roughly $1300.

    Buying this and Corel Linux Deluxe costs about $450. A machine to run this on decently (Pentium II/300 or better) that is a major corporate brand can be found for $600 through the large mailorder resellers. For about the same cost as just the software for a MS system, you can buy a decent business system that won't crash as easily.

    This is a good deal. It can read those nasty Office document formats, and it has a more complete spreadsheet (I have hit the 256 column limit in Excel before with a client). I'm going to recommend these fully loaded Corel Linux boxes to people who don't have $1000 to spend on just software. Most people use their computers for applications such as this, so that's not a bad idea.

  24. This isn't the first chip, Athlon too :) on Adaptec Supporting Ultra160 On IA-64 Linux · · Score: 0

    They just haven't announced the fact that they also apparently have Athlon-specific drivers for the Ultra160 SCSI chipset yet.

    I have heard through one of the AMD beta testers about the raw speed that the onboard Adaptec Ultra160 on the new AMD motherboards designed for the Athlon/Athlon Ultra (this one was a test one running RAMBUS) provides. Yes, it may have custom Athlon-optimized drivers. No, you won't see them until the actual hardware ships.

    Windows NT 4.0 SP5 booting to the login screen in 4 seconds off this HD. Compared to the 30 seconds my CuMine 667 with Intel DMA/66 chipset running NT at work takes, this is a good thing.

    This is a test machine that had a 1.2GHz copper-based Athlon that was running a chip from a test run at Dresden. It was definately running a test Adaptec chipset. This was in January.

    I'm just waiting for the announcement. I want one of these for home. Anything running optimized drivers like that with on-board integration is going to smoke whatever Intel has that will be available this year, since they have been rushing their chips out without testing them like they should.

    Remember the AMD 5x86, NexGen nx586, Cyrix 5x86 and MediaGX, as well as the AMD 486/120 and 133? Intel rushed their chips out the door to beat those releases. I remember the PII/300 getting announced and showing up in decent quantities 6 months later, and don't even bring up the early Pentiums. Itanium is essentially a test chip, and I'll expect major changes between now and McKinley.

    Meanwhile, Adaptec chooses to not announce a product that will be available for a reasonable price in June. Itanium is going to cost as much as the 450 Xeons with 2MB cache did, and a lot more for the higher end models. For the price of the chip alone, I'll be able to buy that Athlon running the same SCSI and actually run applications wel.

  25. my only question is WHY? on Microsoft Unveils The X Box · · Score: 1

    The specs on the X-box don't look too good for a 2001 release. By the time this machine hits the stores, there will be 1.5 to 2Ghz processors out there, specifically the Intel Pentium IV (Willamette) and Athlon Ultra, as well as a few processors down in that price range.

    By the time this machine comes out, you will be able to purchase a more powerful machine on Pricewatch for less money, with more RAM, a bigger HD, and also a faster DVD drive.

    They made several bad decisions here:

    1. 64MB Integrated RAM. Most of the super high-performance video cards don't share memory with the system RAM. This is a bad move, seeing as how video cards with their own RAM perform much better than integrated video, which is fine to use with your Compaq Presario on AOL, but not for any good 3d-gaming.

    2. 600 Mhz processor? Considering the amount of processors that will be around in 2001 to whoop ass on the 600Mhz machines for a cheaper price, why?

    3. Operating System? I'm thinking one thing here: Custom Windows 2000 Embedded. What better way to get developers to write code for the new operating system based on Win2K that is going to be replacing the crap Win 9x kernel? Why put bloatware on this box? Isn't that why most Dreamcast games don't use CE?

    4. Ethernet only? Doesn't MS realize that most of America and the world don't have DSL, cable modems, or such? Just putting in a PCMCIA slot or even offer cartridge-based I/O expansion would be better! I think it would be very good to have options other than Fast Ethernet, such as wireless LAN, modem, integrated cable modem (so you have less wires), or even a GSM or CDMA connection. They need to think about other than North America here!

    On the other hand, I look forward to Linux running on this box. If they can get it to run on the N64, obviously this isn't too far behind :)