Hey, look everyone, a Microsoft astroturfer, posting his carefully choosen sequences of meaningless words, trying to create an impression that his corporate masters are winning something.
"Stable ABI" is the new "GIMP doesn't support CMYK!!!".
Hey, shit-for-brains Microsoft astroturfer, did you know that userspace ABI is compatible in Linux across everything released for more than a decade? "ABI changes" are only a problems for proprietary kernel drivers, but get this -- there are no, and never ever were, proprietary kernel printer drivers for Linux.
At this point Linux uses CUPS, the same printer spooler as OSX, so all drivers are in userspace. No printer manufacturer will dare to exclude OSX support, therefore Linux gets automatically supported as well.
Completely unrelated to this, your whole post is complete nonsense -- you can run an old Linux system, but upgrades are so useful and easy, there is no point doing so, this is why people would rather run an upgrade procedure than look for a package from an old release.
There is "less corruption" in US because most forms of corruption are perfectly legal there. You have to do something truly monstrous to be accused of corruption in US -- and having political parties literally on your payroll does not count.
Actually stealing and disseminating foreign governments' or private entities' secret documents is not a crime anywhere in the world. Each government has one or a bunch of agencies dedicated to the stealing part, and ofter does the disseminating whenever convenient.
More often than not, and even when illegal, the combination (stealing AND disseminating) it's also not morally wrong, either.
Stealing and secretly giving to the hostile governments is usually wrong, but this is not what Wikileaks does.
Oh Yesss!!!! Lives of traitors working for CIA are worth more than lives of thousands of innocent civilians killed in a war of aggression (a war crime all in itself, though Americans don't realize that) perpetrated by US.
You might ask the good people who were once subjects of the Soviet Union how they would feel about your comment.
I was, and I see nothing wrong with that comment -- no sane person outside US likes US, and everyone in ex-USSR hates you. You may consider watching less Fox News and/or less fapping at the picture of Reagan.
Millennia? Try looking at the last 100 years. You might have missed two World Wars,
What was the total duration of both, and number of people killed? Compare that to people dying of hunger and poverty thanks to US policies after WWII ended.
followed by a cold war with the USSR over communism that spanned the globe.
Not only I remember it, I was on the opposite side of it. Contrary to what your friendly propaganda workers told you, the only country that messed with things all over the globe, was US. American politicians seen ghosts of USSR every time any even remotely leftist group of politicians came to power anywhere, and attacked them as if nukes were raining on Washington, DC. USSR, at most, occasionally jumped across its border reacting to what it perceived as a direct threat to its territory -- granted, often in a mildly assholish (Hungary, Czechoslovakia) or unsuccessful (Afghanistan) way. Not that US did not outdo USSR meddling in both Eastern Europe and Middle East by multiple orders of magnitude (Balkan wars/Kosovo, Afghanistan, Iraq) after that.
The United States emerged as the sole superpower, and as such in the last couple of decades had the biggest footprint in foreign meddling, but Russia is on the rise again and re-asserting its influence.
Then your tenure as self-proclaimed "sole superpower" can be described by one letter, and that letter is F.
Many times there are reconnaissance efforts before an actual exploit.
And the only valid response to them is to never react in any manner unless you are specifically researching attackers and potential attackers' behavior. Security of a system should never be assumed to be dependent on anything but secure design of that system.
That is computer security 101.
Reaction to threats is an idiotic practice that makes absolutely no sense. There are billions of hosts on the Internet, large percentage of them is compromised by botnets, and at any moment any of them can happen to be attacking your system. If you are vulnerable to a remote exploit, you will never have time, leave alone chance, to react -- your only defense is to eliminate vulnerabilities before they are attacked. Fortunately remote exploits (what the article describes is not a remote exploit) are taken very seriously by software/distributions maintainers other than Microsoft and Adobe.
This is why security research and bug fixing is so important, however there is absolutely nothing end user can do about it unless he is in the position to investigate a new, previously unknown vulnerability. This happens what statistically can be described as "approximately never".
Local exploits don't require "vigilance" either -- if you really have large amounts of untrusted things running on potentially vulnerable systems, you have to have reasonable policies, access/authentication system and backup procedures. None of them involve red-eyed peering at the monitor looking for the signs of enemies coming.
Must be nice to live in a world where the only possibilities are the ones you believe.
Extraordinary claims are supposed to be supported by something other than "you are not open-minded enough".
No my most prominent statement was "in my experience" and then I went on to convey that experience.
Your "experience" how you described it, contradicts your own claims. The rest is irrelevant.
You want to ignore all that and pretend that I said "Windows is more secure than Linux" or "Windows is easier to maintain than Linux"
No, you claimed that all operating systems are equally insecure. This is false.
PS: "...to merely implementing well-known sane policies and apply updates when they are released..." is being vigilant about security. A home user that ignores updates is not being "vigilant" about security.
"Vigilant" means actively and constantly applying some nontrivial effort. Not calling root shell with input from CGI, or running an auto-update procedure every day is not "vigilant". Backing up all data from VMWare hosts, sifting for exploits, reimaging compromised VMWare instances of Windows and restoring sanitized data back to them is "vigilant".
Are you for real? A non-customer would not have a local account.
Have you ever seen a shell server compromised by a non-customer? You are talkling about your shitty little ISP experience, not some theoretical possibility, right?
Why are you still arguing Linux vs. Windows? My post has never had anything specific to Windows vs. Linux and you'd know that if you bothered to read before responding.
Don't even try that shit. Your most prominent statement was the claim that you have observed that Linux servers were compromised more often than Windows server. You backed it with fallacies, spin and your experience that -- if it was true or relevant in the first place -- is in no way applicable for any comparison.
If you want to discuss your most idiotic (though less prominent) claim that one has to be "vigilant" to run Linux servers in a secure manner (as opposed to merely implementing well-known sane policies and apply updates when they are released), you are welcome to do it after renouncing your claims of having demonstrated it with your shitty experience running shell servers.
Static analysis produces massive amounts of false positives that are easier to "fix" than to verify.
I believe, it would be a safe bet that there are still no actual vulnerabilities found and successfully exploited by this method -- and the actual exploitable vulnerability the article is about, was not and could not be found by such analysis.
So no, changelog is not a "gold mine" for anything, most of the time if will give you massive load of starting pointers that if/when you will find one that is a genuine security bug and produce an exploit based on it, not even the oldest network-accessible installation of Slackware will have them.
This is a rare exception, though it hardly stands out in the changelog, and only coincidence with Xorg [otherwise completely valid and reasonable] behavior makes exploit possible.
"Extensive history" of other governments only looks impressive if summed over millennia of their existence, and, more importantly, everyone else wisened up and stopped this shit decades or centuries ago.
US causes death, destruction and misery all over the world right now, at a scale and rate never seen before from any of the "evil empires" of the past.
1. All compromises of a Linux shell servers ARE privilege elevation -- because every intruder starts from having a valid local an account on it.
2. A privilege elevation on a Windows server would not even be an exploit because Windows server does not run untrusted content -- if you have an account on hosted Windows server that can install things, you are its administrator already, so there is nothing to exploit.
3. Windows desktops suffer from privilege escalation exploits all the time. So would any system that would provide remotely accessible shell accounts on Windows server.
4. You are still pretending that anything you have observed has something to do with remote exploits, quality of maintenance, and other irrelevant and stupid statements that you made and I have ignored.
I am VERY familiar with how Communists governed -- they were still better than your politicians. I can grant you one thing, they had one ruling party, US has two. They have two ruling parties now -- both are worse than one they had before, and both are better than two you have in power (I mean, United Russia is better than Democrats and Russian Communist Party is better than Republicans, other comparisons are up to debate), so this is hardly relevant.
Of course, if you compare yourself to anything other than Communists or Theocrats, the true extent of your political system's backwardness becomes apparent, so don't even try.
It does nothing. No one used startx for many years by now.
However yes, startx started as user would run X server as root, thank to setuid bit. And that was one of the reasons why it is deprecated in favor of display managers (xdm/kdm/gdm/...) that are started from system startup scripts and do not have setuid components.
So how do you compare exploits seen by a Linux shell provider with exploits you have seen being a Windows shell provider?
Oh, there are no Windows shell providers, as that would be an insane thing to do -- between 1999 and 2003 or now. And you conveniently did not mention that you counted exploits on a poorly run shell server vs. Windows "server" that never runs anything you didn't put on it (and they apparently still were copromised, just less often than your shell servers).
I wonder why did you make such an omission. Perhaps to create an appearance of support for your completely invalid claims?
Iran is a dictatorship not because their elections "don't pick the right person", it is a dictatorship because the election process is rigged so that only certain people can be elected, and these need approval from a non-elected body anyways.
Look, an American describing problems with US elections. I wonder, why he calls his country "Iran" and "dictatorship".
Slashdot Mirror
See http://linux.slashdot.org/comments.pl?sid=1761840&cid=33330428
Hey, look everyone, a Microsoft astroturfer, posting his carefully choosen sequences of meaningless words, trying to create an impression that his corporate masters are winning something.
"Stable ABI" is the new "GIMP doesn't support CMYK!!!".
Hey, shit-for-brains Microsoft astroturfer, did you know that userspace ABI is compatible in Linux across everything released for more than a decade? "ABI changes" are only a problems for proprietary kernel drivers, but get this -- there are no, and never ever were, proprietary kernel printer drivers for Linux.
At this point Linux uses CUPS, the same printer spooler as OSX, so all drivers are in userspace. No printer manufacturer will dare to exclude OSX support, therefore Linux gets automatically supported as well.
Completely unrelated to this, your whole post is complete nonsense -- you can run an old Linux system, but upgrades are so useful and easy, there is no point doing so, this is why people would rather run an upgrade procedure than look for a package from an old release.
There is "less corruption" in US because most forms of corruption are perfectly legal there. You have to do something truly monstrous to be accused of corruption in US -- and having political parties literally on your payroll does not count.
Actually stealing and disseminating foreign governments' or private entities' secret documents is not a crime anywhere in the world. Each government has one or a bunch of agencies dedicated to the stealing part, and ofter does the disseminating whenever convenient.
More often than not, and even when illegal, the combination (stealing AND disseminating) it's also not morally wrong, either.
Stealing and secretly giving to the hostile governments is usually wrong, but this is not what Wikileaks does.
Oh Yesss!!!! Lives of traitors working for CIA are worth more than lives of thousands of innocent civilians killed in a war of aggression (a war crime all in itself, though Americans don't realize that) perpetrated by US.
You might ask the good people who were once subjects of the Soviet Union how they would feel about your comment.
I was, and I see nothing wrong with that comment -- no sane person outside US likes US, and everyone in ex-USSR hates you. You may consider watching less Fox News and/or less fapping at the picture of Reagan.
Intellectual property from other companies generally has to be stripped from the code base and those algorithms reimplemented in a different way.
And they should better not implement it in a driver. Ex: winmodems.
Millennia? Try looking at the last 100 years. You might have missed two World Wars,
What was the total duration of both, and number of people killed? Compare that to people dying of hunger and poverty thanks to US policies after WWII ended.
followed by a cold war with the USSR over communism that spanned the globe.
Not only I remember it, I was on the opposite side of it. Contrary to what your friendly propaganda workers told you, the only country that messed with things all over the globe, was US. American politicians seen ghosts of USSR every time any even remotely leftist group of politicians came to power anywhere, and attacked them as if nukes were raining on Washington, DC. USSR, at most, occasionally jumped across its border reacting to what it perceived as a direct threat to its territory -- granted, often in a mildly assholish (Hungary, Czechoslovakia) or unsuccessful (Afghanistan) way. Not that US did not outdo USSR meddling in both Eastern Europe and Middle East by multiple orders of magnitude (Balkan wars/Kosovo, Afghanistan, Iraq) after that.
The United States emerged as the sole superpower, and as such in the last couple of decades had the biggest footprint in foreign meddling, but Russia is on the rise again and re-asserting its influence.
Then your tenure as self-proclaimed "sole superpower" can be described by one letter, and that letter is F.
Many times there are reconnaissance efforts before an actual exploit.
And the only valid response to them is to never react in any manner unless you are specifically researching attackers and potential attackers' behavior. Security of a system should never be assumed to be dependent on anything but secure design of that system.
That is computer security 101.
Reaction to threats is an idiotic practice that makes absolutely no sense. There are billions of hosts on the Internet, large percentage of them is compromised by botnets, and at any moment any of them can happen to be attacking your system. If you are vulnerable to a remote exploit, you will never have time, leave alone chance, to react -- your only defense is to eliminate vulnerabilities before they are attacked. Fortunately remote exploits (what the article describes is not a remote exploit) are taken very seriously by software/distributions maintainers other than Microsoft and Adobe.
This is why security research and bug fixing is so important, however there is absolutely nothing end user can do about it unless he is in the position to investigate a new, previously unknown vulnerability. This happens what statistically can be described as "approximately never".
Local exploits don't require "vigilance" either -- if you really have large amounts of untrusted things running on potentially vulnerable systems, you have to have reasonable policies, access/authentication system and backup procedures. None of them involve red-eyed peering at the monitor looking for the signs of enemies coming.
While un-captioned cats might be of limited interest to the /. community
lol gb2/b/
Yes I have.
Describe one.
Must be nice to live in a world where the only possibilities are the ones you believe.
Extraordinary claims are supposed to be supported by something other than "you are not open-minded enough".
No my most prominent statement was "in my experience" and then I went on to convey that experience.
Your "experience" how you described it, contradicts your own claims. The rest is irrelevant.
You want to ignore all that and pretend that I said "Windows is more secure than Linux" or "Windows is easier to maintain than Linux"
No, you claimed that all operating systems are equally insecure. This is false.
PS: "...to merely implementing well-known sane policies and apply updates when they are released..." is being vigilant about security. A home user that ignores updates is not being "vigilant" about security.
"Vigilant" means actively and constantly applying some nontrivial effort. Not calling root shell with input from CGI, or running an auto-update procedure every day is not "vigilant". Backing up all data from VMWare hosts, sifting for exploits, reimaging compromised VMWare instances of Windows and restoring sanitized data back to them is "vigilant".
Are you for real? A non-customer would not have a local account.
Have you ever seen a shell server compromised by a non-customer? You are talkling about your shitty little ISP experience, not some theoretical possibility, right?
Why are you still arguing Linux vs. Windows? My post has never had anything specific to Windows vs. Linux and you'd know that if you bothered to read before responding.
Don't even try that shit. Your most prominent statement was the claim that you have observed that Linux servers were compromised more often than Windows server. You backed it with fallacies, spin and your experience that -- if it was true or relevant in the first place -- is in no way applicable for any comparison.
If you want to discuss your most idiotic (though less prominent) claim that one has to be "vigilant" to run Linux servers in a secure manner (as opposed to merely implementing well-known sane policies and apply updates when they are released), you are welcome to do it after renouncing your claims of having demonstrated it with your shitty experience running shell servers.
Static analysis produces massive amounts of false positives that are easier to "fix" than to verify.
I believe, it would be a safe bet that there are still no actual vulnerabilities found and successfully exploited by this method -- and the actual exploitable vulnerability the article is about, was not and could not be found by such analysis.
So no, changelog is not a "gold mine" for anything, most of the time if will give you massive load of starting pointers that if/when you will find one that is a genuine security bug and produce an exploit based on it, not even the oldest network-accessible installation of Slackware will have them.
This is a rare exception, though it hardly stands out in the changelog, and only coincidence with Xorg [otherwise completely valid and reasonable] behavior makes exploit possible.
"Extensive history" of other governments only looks impressive if summed over millennia of their existence, and, more importantly, everyone else wisened up and stopped this shit decades or centuries ago.
US causes death, destruction and misery all over the world right now, at a scale and rate never seen before from any of the "evil empires" of the past.
1. All compromises of a Linux shell servers ARE privilege elevation -- because every intruder starts from having a valid local an account on it.
2. A privilege elevation on a Windows server would not even be an exploit because Windows server does not run untrusted content -- if you have an account on hosted Windows server that can install things, you are its administrator already, so there is nothing to exploit.
3. Windows desktops suffer from privilege escalation exploits all the time. So would any system that would provide remotely accessible shell accounts on Windows server.
4. You are still pretending that anything you have observed has something to do with remote exploits, quality of maintenance, and other irrelevant and stupid statements that you made and I have ignored.
I am VERY familiar with how Communists governed -- they were still better than your politicians. I can grant you one thing, they had one ruling party, US has two. They have two ruling parties now -- both are worse than one they had before, and both are better than two you have in power (I mean, United Russia is better than Democrats and Russian Communist Party is better than Republicans, other comparisons are up to debate), so this is hardly relevant.
Of course, if you compare yourself to anything other than Communists or Theocrats, the true extent of your political system's backwardness becomes apparent, so don't even try.
It does nothing. No one used startx for many years by now.
However yes, startx started as user would run X server as root, thank to setuid bit. And that was one of the reasons why it is deprecated in favor of display managers (xdm/kdm/gdm/...) that are started from system startup scripts and do not have setuid components.
So how do you compare exploits seen by a Linux shell provider with exploits you have seen being a Windows shell provider?
Oh, there are no Windows shell providers, as that would be an insane thing to do -- between 1999 and 2003 or now. And you conveniently did not mention that you counted exploits on a poorly run shell server vs. Windows "server" that never runs anything you didn't put on it (and they apparently still were copromised, just less often than your shell servers).
I wonder why did you make such an omission. Perhaps to create an appearance of support for your completely invalid claims?
Iran is a dictatorship not because their elections "don't pick the right person", it is a dictatorship because the election process is rigged so that only certain people can be elected, and these need approval from a non-elected body anyways.
Look, an American describing problems with US elections. I wonder, why he calls his country "Iran" and "dictatorship".
Everyone else.
Seriously, Americans, your country is unique in the amount of evil it produces. Deal with it.
So only rich parents deserve justice, right?
could get monitory compensation
I have no words.
To be fair, Acrobat^WAdobe Reader was the only application with which Adobe surprised me with something good --
1. They wrote a proper GTK application.
2. They implemented a nice brochure-printing functionality.
Unfortunately that's all I have seen from Adobe outside of the range between "half-assed" and "infuriating".
Fuck Adobe, fuck its tools and fuck developers who won't switch to anything better at first opportunity.