Setting up decent-looking fonts under Linux is still difficult.
It's difficult to get Monotype fonts from Microsoft (MS Office files won't look "decent" unless you have exactly the same fonts -- this is how that shit is designed) and dump them into the truetype fonts directory?
Yes, but then your domain ID and password would be sent across the network in cleartext.
Over HTTPS? Or you still believe marketdroids that told you that Basic authentication is insecure because it doesn't use some proprietary bullshit, yet Windows-specific authentication is secure even without HTTPS, EVEN THOUGH YOU ARE PASSING PASSWORD IN THE FORM?
A modem that PDA-using people heard of but didn't pay attention.
"Merlin"? I smell "Digital Nervous System" again
on
HP Jornada 560 Series
·
· Score: 2
Microsoft often abuses popular names and words that have some established meanings in some nearby area to confuse the heck out of users -- bright example of that is "Digital Nervous System" that seems to "share" an acronym with Domain Name System that happens to predate Microsoft's definition by a decade, and, while mentioned a lot, probably isn't clearly to its target audience.
Now where have I seen the word "Merlin" very close to PDAs, but not exactly a PDA-related item last time? Wasn't it a PC version of a popular Minstrel PDA CDPD modem, made by Novatel? Indeed, it is! And, just like with "DNS" and other cases, I don't think that it's a coincidence -- it may not be illegal, but it's hijacking someone else's trademark with the goal to make users think that Microsoft's product is related to something they have heard about.
Don't spend money on revmping the curriculum so Physics won't be put after Chemistry (what makes just as much sense as installing XF86 before libc). Don't spend money on getting better teachers (now you can't get an educated person to become a teacher because salaries are beyond "poor" and closer to "insulting"). Don't do anything that forces students to study (it's more important to make them think that they live in a "free country" and have no duties whatsoever). Don't keep companies' interests and religious propaganda out of school. Don't even start a program that empahsized learning of technology (heck, a bunch of high school kids making a beowulf cluster out of old p150's just to find out what those Slashdot trolls are talking about would be better than what kids are learning now). Get a bunch of laptops, pay some Dell, Gateway, Sony or even Compaq a shitload of money, pay Microsoft more money, give laptops to unprepared kids, teach them "technology" like pointing and clicking through menus, and be afraid of those kids actually using those things for something you don't understand. And expect that when kids will finish school they will have detailed knowledge of every button, menu and dialog box of the obsolete by that time version of Microsoft Word.
Not closing TD, TR, etc. tags is ok as long as the same opening tag follows or TABLE tag closes after it, thus unambiguously showing that the previous tag is closed (you can't nest tables without additional TABLE tag). However missing TABLE tag within another page produces an ambiguous piece of markup that can be interpreted in muliple ways -- this is not only prohibited by the standard but is theoretically impossible to render without guesswork. Few tags like that on the page, and it will be possible to make countless numbers of grotesque-looking combinations, formally all equally possible. MSIE (and Mozilla, imitating MSIE) guesses a lot, and makes those pages display "somehow", however formally they are invalid and ambiguous.
If cutting spending on advertisments resulted in an increase in profit, why do you think they do spend that much? Surely you don't think they enjoy giving money away just for the sake of advertising?
Of course, it will decrease the profits! It just won't affect the development of useful drugs.
As somebody said earlier in the discussion, money has to change hands somewhere. If drugs should be available to poor countries for free, vote in a government who will increase taxes in order to pay for these countries to receive medication.
Money don't have to change hands -- government can just use their collective buying power to force companies to accept slightly lower profit margins, what will be healthy for both people and the economy. Don't forget that drug companies have obscenely high profit margins, and spent most of their time, money and effort on the development of expensive but nonessential products and incrementl enhancement of existing ones.
Nothing. Companies are not people, they exist only because governments say so, and their "rights" are supposed to defined, as whatever benefits people.
If they don't receive royalties on their drugs, how are they going to support ongoing research??
They can cut spending on advertisement of their yet another 24-hours nasal decongestant by few percents. And, maybe later at least one of those Brazilian people, whose lives will be saved because of this, will do a piece of biological research that will be crucial for those pharmaceutical companies.
I have seen that. Disabling HTTP and filtering out TCP to port 80 at the router still did not fix the problem -- apparently listening at the HTTP port can't be disabled, and filters don't affect the broken piece of code.
Code Red and Cisco 675
on
Code Red Refunds?
·
· Score: 4, Interesting
My provider isn't "The Wicked Q of the West", but I ended up downloading Cisco 675 CBOS upgrade from their site. This is what happened.
1. I have received announcements about Code Red in everything security-related that I was subscribed to, and as usual, ignored it because I don't use IIS, Windows and other garbage of that kind.
2. Cisco 675 router that connects me to my providers (ISP is Megapath, line was Rhythms) started hanging in the most outrageous manner possible, being not accessible even from its serial console that I have attached to one of my Linux boxes through USB multiport serial converter. It was "outrageous" and not merely "bad" because same Linux box happened to have still-working Ricochet modem attached to another USB port, and I was able to reach it from work even when DSL was down, but couldn't reset DSL until I was physically at home.
3. Later announcements mentioned Cisco routers as vulnerability, and recommended to disable web administration on the router as a workaround, and upgrade the firmware. Cisco page mentioned an upgrade but did not offer anything to download -- required to call their phone number or email them and beg for firmware update. Knowing that everybody who ever bought Cisco 6xx, plus a bunch of people who didn't know how their company's Catalyst differs from bitty box 675, will be trying to reach Cisco, I have chosen to do a workaround.
4. I have disabled web administration, it stopped working, but router continued listening on the port 80. I assumed, it will just ignore all data that it receives, so a bug won't be triggered.
5. Router still hangs. I have set a filter to block everything that comes from outside to the port 80 on the router. It looked like router stopped responding to this, so I was confident that I am not vulnerable to that thing anymore.
6. Router still hangs. Apparently my mind was not advanced enough to comprehend the brokenness of CBOS -- broken code was receiving packets BEFORE THEY PASSED THE FILTERS.
7. I have looked at the Cisco site to check if they got the idea, how many requests for copies of CBOS patches they are supposed to process and posted the binaries. Nothing -- the page still contained a phone number and email address, and since I was at home, I could be pretty sure that people who were supposed to answer at Cisco weren't at work either.
As opposed to other Cisco products, CBOS has no optional pieces, and is useful for a single puprose of upgrading shitty 6xx boxes, so why they needed my phone call to make sure that I am indeed going to use their software to upgrade their router and not, say, print as a hex dump and smoke it, is still a mystery for me.
8. While constantly resetting Cisco, I have started IRC, and asked some of my friends if they know, where to find those damn patches. After few minutes I have received some rather unflattering description of CBOS, Cisco and Intel (who happened to be the real authors of this shit), and the URL on Qwest site with CBOS images.
9. CBOS images were distributed as Windows executables, with Windows upload program but no instructions -- probably following the logic that if a customer has his servers infected by a virus, running downloaded executables is the least of his concerns. Fortunately, Windows executable was a wrapped zip file, and upload procedure over a serial console was in the router's documentation.
10. Router worked fine ever since, but it looks like it's still impossible to filter or completely disable web administration on it.
---
Of course, this was that simple only because I had a full access ("exec" and "enable" passwords) to the router. I am afraid to think, how Qwest technicians would have to work if they had to upgrade customers' routers over the network while routers were being attacked, or to distribute passwords to the customers to make them able to run the updater program (I have never seen it running, I assume that it uploads updates either by xmodem over console or by TFTP -- in the first case only customer can enter the password, and in the second one _someone_ has to login to the router and still enter the password), so I kinda understand why Qwest couldn't do much in this situation. OTOH, Cisco could at least issue binary patches as a public-accessible download.
The problem is not that copyright allows someone to sell information, software, etc. If that was all it was good for, I don't think, many people cared about it, but the current situation is that this is THE MOST USELESS part of what copyright and restrictive licenses accomplish.
Look at any software company. It always has a bunch of proprietary information that it does not want to disclose to anyone, including its customers -- I know because I work for one. What is that information, why is it valuable? Because it can be sold? No, directly most of it has use less valuable than a paper it's printed on, and companies almost never attempt to sell it unless when company is being bought outright. However it's tightly guarded, and is considered to be what makes a company profitable.
That information is usually related to the aility to interoperate with company's products and to make alternative versions of them. Usually it's some, often braindead, protocol, APIs, data structures, etc. -- things invented arbitrarily, and usually without the application of any mental effort whatsoever. However keeping customers and competitors unaware of those allows companies to keep selling their new products to old customers and prevent others from replacing company's products with something else, even if competitors would be perfectly capable of producing superior replacements if not customers being locked in by proprietary protocols, interfaces and formats.
So, this kind of proprietary information does not behave as knowledge, or even as a good that can be sold -- it's an instrument of power, the power that IMNSHO no one deserves to exercise, and copyright is merely a tool to protect this abuse of the customer. Compared to this power, actual ability/unability to make the customer pay for software, or only for service, is so insignificant in the modern software industry, no one in his right mind would think about it. This is what I find unethical about proprietaty software licenses, and copyright law that protects them.
Are you suggesting that Cygwin is a port of some other package? Ports are made from source code - if I described WINE as a port of win32, I suspect few folk would agree with me - WINE was created from scratch.
Cygwin is a port of GNU tools to Windows -- that happened to be done by Cygnus, the same people who wrote most of those tools in the first place. The only difference from Unix version is that port to Windows was made much later, and involved more pain than versions for any other OS. Everything in Cygwin that is not in your usual GNU tools (which BTW happen to be a large piece of any Linux distribution) is done with one goal -- to make them work on Windows.
Likewise Cygwin is not a port of anything. Cygwin is a standalone.dll, custom built to provide various unix and POSIX API calls.
The number of developers means nothing -- there are more Macromedia Flash developers or Visual Basic developers than developers that any advanced language and Java combined, yet most of useful software is still written in C, C++ and sometimes perl.
Re:Looks like a very uninformd piece
on
Taming the Web
·
· Score: 2
There are some pretty general rules that technology follows. For example, in the long run for every "shield" there will be a "sword" that will be effective against it. Or that absolutely everything fails from time to time, no matter how good it is designed and produced.
The nature of the network is that any attempt to selectively block something in it will cause the performance loss that will make it unusable for its primary purpose -- while China can allow itself to block a bunch of sites because it can even isolate itself from the rest of the world without any noticeable damage (keeping their own network inside the country working unimpeded), most of people, companies and governments will see the decrease of performance and reliability as a significant threat to them, and this will become even more obvious in the future.
I just pointed out that Cygnus people, within Red Hat or not, are not working on cygwin as only a part of their development of GNU utilities -- the comment that I am answering to implied that cygwin is their main project.
Cygnus did not write gcc. I believe that was RMS. Red Hat/Cygnus does contribute a lot to the gcc and gdb projects but they did not write these programs and do not own these programs.
Most of work on gcc is now being done by Cygnus.
Cygwin was written by Cygnus employees (hence the name) but, like any successful free software endeavor, it's grown far from its humble beginnings.
A port is a port. A port to the environment as hostile as Windows may be a difficult undertaking, but it's still derived from the same gnu utilities that are still in active development.
There are no "cygwin people" -- it's Cygnus, the same people who wrote most of gcc and other tools for Unix.
At this point only a fool will consider the possibility that cooperation with Microsoft is possible. Microsoft threatens us with subverting standards -- when they change standards everyone with Windows suddently has a version of every their product that does not interoperate with what we do, and the ideas that we are forced to introduce into our software for that interoperability are stupid and disgusting. This means that no matter what someone may say out of "realpolitik", Microsoft is the most dangerous enemy of Open Source, and should be treated as such.
Re:Looks like a very uninformd piece
on
Taming the Web
·
· Score: 2
"NSA Line Eater", a recorder that keeps the history of all Internet traffic over major backbones, is a well-known semi-mythical entity that people assume, is very likely to exist. The problem is, all the data that it could (did?) collect should be almost impossible to process in any reasonable manner, and it's still not technically feasible to make it in any way respond by blocking the flow of data without bringing backbones to a crawl. So, yes, it's possible that everything is being recorded, but it has absolutely no effect one anyone's ability to block something.
Looks like a very uninformd piece
on
Taming the Web
·
· Score: 2
It describes, what corporations and governments want or doing in their attempts to control the Internet, but we know this already. The problem is, it doesn't contain any plausible reasons why those attempts can possibly be successful.
Slashdot Mirror
Well, that requires you to buy, or have bought, a Microsoft product in the first place, so it's not much of a help.
Fonts are at MS "typography" page -- I forgot, where it is, but certainly it's public-accessible.
They can ban it from doing business in Europe -- this was the reason why some mergers were called off.
Setting up decent-looking fonts under Linux is still difficult.
It's difficult to get Monotype fonts from Microsoft (MS Office files won't look "decent" unless you have exactly the same fonts -- this is how that shit is designed) and dump them into the truetype fonts directory?
Yes, but then your domain ID and password would be sent across the network in cleartext.
Over HTTPS? Or you still believe marketdroids that told you that Basic authentication is insecure because it doesn't use some proprietary bullshit, yet Windows-specific authentication is secure even without HTTPS, EVEN THOUGH YOU ARE PASSING PASSWORD IN THE FORM?
It's not. He was using HTTP 1.0, and server pretended that it supports HTTP 1.0, yet demanded an authentication method that exists only in HTTP 1.1.
A modem that PDA-using people heard of but didn't pay attention.
Microsoft often abuses popular names and words that have some established meanings in some nearby area to confuse the heck out of users -- bright example of that is "Digital Nervous System" that seems to "share" an acronym with Domain Name System that happens to predate Microsoft's definition by a decade, and, while mentioned a lot, probably isn't clearly to its target audience.
Now where have I seen the word "Merlin" very close to PDAs, but not exactly a PDA-related item last time? Wasn't it a PC version of a popular Minstrel PDA CDPD modem, made by Novatel? Indeed, it is! And, just like with "DNS" and other cases, I don't think that it's a coincidence -- it may not be illegal, but it's hijacking someone else's trademark with the goal to make users think that Microsoft's product is related to something they have heard about.
Don't spend money on revmping the curriculum so Physics won't be put after Chemistry (what makes just as much sense as installing XF86 before libc). Don't spend money on getting better teachers (now you can't get an educated person to become a teacher because salaries are beyond "poor" and closer to "insulting"). Don't do anything that forces students to study (it's more important to make them think that they live in a "free country" and have no duties whatsoever). Don't keep companies' interests and religious propaganda out of school. Don't even start a program that empahsized learning of technology (heck, a bunch of high school kids making a beowulf cluster out of old p150's just to find out what those Slashdot trolls are talking about would be better than what kids are learning now). Get a bunch of laptops, pay some Dell, Gateway, Sony or even Compaq a shitload of money, pay Microsoft more money, give laptops to unprepared kids, teach them "technology" like pointing and clicking through menus, and be afraid of those kids actually using those things for something you don't understand. And expect that when kids will finish school they will have detailed knowledge of every button, menu and dialog box of the obsolete by that time version of Microsoft Word.
Not closing TD, TR, etc. tags is ok as long as the same opening tag follows or TABLE tag closes after it, thus unambiguously showing that the previous tag is closed (you can't nest tables without additional TABLE tag). However missing TABLE tag within another page produces an ambiguous piece of markup that can be interpreted in muliple ways -- this is not only prohibited by the standard but is theoretically impossible to render without guesswork. Few tags like that on the page, and it will be possible to make countless numbers of grotesque-looking combinations, formally all equally possible. MSIE (and Mozilla, imitating MSIE) guesses a lot, and makes those pages display "somehow", however formally they are invalid and ambiguous.
If cutting spending on advertisments resulted in an increase in profit, why do you think they do spend that much? Surely you don't think they enjoy giving money away just for the sake of advertising?
Of course, it will decrease the profits! It just won't affect the development of useful drugs.
As somebody said earlier in the discussion, money has to change hands somewhere. If drugs should be available to poor countries for free, vote in a government who will increase taxes in order to pay for these countries to receive medication.
Money don't have to change hands -- government can just use their collective buying power to force companies to accept slightly lower profit margins, what will be healthy for both people and the economy. Don't forget that drug companies have obscenely high profit margins, and spent most of their time, money and effort on the development of expensive but nonessential products and incrementl enhancement of existing ones.
You can't patent ANYTHING without publishing it, and you won't get any data from universities without cooperation. Drugs are not Coca-Cola.
What happened to the drug companies' rights?
Nothing. Companies are not people, they exist only because governments say so, and their "rights" are supposed to defined, as whatever benefits people.
If they don't receive royalties on their drugs, how are they going to support ongoing research??
They can cut spending on advertisement of their yet another 24-hours nasal decongestant by few percents. And, maybe later at least one of those Brazilian people, whose lives will be saved because of this, will do a piece of biological research that will be crucial for those pharmaceutical companies.
What is Brazil doing to cure AIDS??
Keeps its people alive.
You are still vulnerable at the port 81 -- despite the restriction.
Great! ;-)
The problem is, that leaves you behind NAT, and people with "business" DSL service have bunches of servers behind their routers.
I have seen that. Disabling HTTP and filtering out TCP to port 80 at the router still did not fix the problem -- apparently listening at the HTTP port can't be disabled, and filters don't affect the broken piece of code.
My provider isn't "The Wicked Q of the West", but I ended up downloading Cisco 675 CBOS upgrade from their site. This is what happened.
1. I have received announcements about Code Red in everything security-related that I was subscribed to, and as usual, ignored it because I don't use IIS, Windows and other garbage of that kind.
2. Cisco 675 router that connects me to my providers (ISP is Megapath, line was Rhythms) started hanging in the most outrageous manner possible, being not accessible even from its serial console that I have attached to one of my Linux boxes through USB multiport serial converter. It was "outrageous" and not merely "bad" because same Linux box happened to have still-working Ricochet modem attached to another USB port, and I was able to reach it from work even when DSL was down, but couldn't reset DSL until I was physically at home.
3. Later announcements mentioned Cisco routers as vulnerability, and recommended to disable web administration on the router as a workaround, and upgrade the firmware. Cisco page mentioned an upgrade but did not offer anything to download -- required to call their phone number or email them and beg for firmware update. Knowing that everybody who ever bought Cisco 6xx, plus a bunch of people who didn't know how their company's Catalyst differs from bitty box 675, will be trying to reach Cisco, I have chosen to do a workaround.
4. I have disabled web administration, it stopped working, but router continued listening on the port 80. I assumed, it will just ignore all data that it receives, so a bug won't be triggered.
5. Router still hangs. I have set a filter to block everything that comes from outside to the port 80 on the router. It looked like router stopped responding to this, so I was confident that I am not vulnerable to that thing anymore.
6. Router still hangs. Apparently my mind was not advanced enough to comprehend the brokenness of CBOS -- broken code was receiving packets BEFORE THEY PASSED THE FILTERS.
7. I have looked at the Cisco site to check if they got the idea, how many requests for copies of CBOS patches they are supposed to process and posted the binaries. Nothing -- the page still contained a phone number and email address, and since I was at home, I could be pretty sure that people who were supposed to answer at Cisco weren't at work either.
As opposed to other Cisco products, CBOS has no optional pieces, and is useful for a single puprose of upgrading shitty 6xx boxes, so why they needed my phone call to make sure that I am indeed going to use their software to upgrade their router and not, say, print as a hex dump and smoke it, is still a mystery for me.
8. While constantly resetting Cisco, I have started IRC, and asked some of my friends if they know, where to find those damn patches. After few minutes I have received some rather unflattering description of CBOS, Cisco and Intel (who happened to be the real authors of this shit), and the URL on Qwest site with CBOS images.
9. CBOS images were distributed as Windows executables, with Windows upload program but no instructions -- probably following the logic that if a customer has his servers infected by a virus, running downloaded executables is the least of his concerns. Fortunately, Windows executable was a wrapped zip file, and upload procedure over a serial console was in the router's documentation.
10. Router worked fine ever since, but it looks like it's still impossible to filter or completely disable web administration on it.
---
Of course, this was that simple only because I had a full access ("exec" and "enable" passwords) to the router. I am afraid to think, how Qwest technicians would have to work if they had to upgrade customers' routers over the network while routers were being attacked, or to distribute passwords to the customers to make them able to run the updater program (I have never seen it running, I assume that it uploads updates either by xmodem over console or by TFTP -- in the first case only customer can enter the password, and in the second one _someone_ has to login to the router and still enter the password), so I kinda understand why Qwest couldn't do much in this situation. OTOH, Cisco could at least issue binary patches as a public-accessible download.
...for DMCA.
Freaking industry whores.
The problem is not that copyright allows someone to sell information, software, etc. If that was all it was good for, I don't think, many people cared about it, but the current situation is that this is THE MOST USELESS part of what copyright and restrictive licenses accomplish.
Look at any software company. It always has a bunch of proprietary information that it does not want to disclose to anyone, including its customers -- I know because I work for one. What is that information, why is it valuable? Because it can be sold? No, directly most of it has use less valuable than a paper it's printed on, and companies almost never attempt to sell it unless when company is being bought outright. However it's tightly guarded, and is considered to be what makes a company profitable.
That information is usually related to the aility to interoperate with company's products and to make alternative versions of them. Usually it's some, often braindead, protocol, APIs, data structures, etc. -- things invented arbitrarily, and usually without the application of any mental effort whatsoever. However keeping customers and competitors unaware of those allows companies to keep selling their new products to old customers and prevent others from replacing company's products with something else, even if competitors would be perfectly capable of producing superior replacements if not customers being locked in by proprietary protocols, interfaces and formats.
So, this kind of proprietary information does not behave as knowledge, or even as a good that can be sold -- it's an instrument of power, the power that IMNSHO no one deserves to exercise, and copyright is merely a tool to protect this abuse of the customer. Compared to this power, actual ability/unability to make the customer pay for software, or only for service, is so insignificant in the modern software industry, no one in his right mind would think about it. This is what I find unethical about proprietaty software licenses, and copyright law that protects them.
Are you suggesting that Cygwin is a port of some other package? Ports are made from source code - if I described WINE as a port of win32, I suspect few folk would agree with me - WINE was created from scratch.
Cygwin is a port of GNU tools to Windows -- that happened to be done by Cygnus, the same people who wrote most of those tools in the first place. The only difference from Unix version is that port to Windows was made much later, and involved more pain than versions for any other OS. Everything in Cygwin that is not in your usual GNU tools (which BTW happen to be a large piece of any Linux distribution) is done with one goal -- to make them work on Windows.
Likewise Cygwin is not a port of anything. Cygwin is a standalone .dll, custom built to provide various unix and POSIX API calls.
DLL is only a small part of the package -- see their own description.
The number of developers means nothing -- there are more Macromedia Flash developers or Visual Basic developers than developers that any advanced language and Java combined, yet most of useful software is still written in C, C++ and sometimes perl.
There are some pretty general rules that technology follows. For example, in the long run for every "shield" there will be a "sword" that will be effective against it. Or that absolutely everything fails from time to time, no matter how good it is designed and produced.
The nature of the network is that any attempt to selectively block something in it will cause the performance loss that will make it unusable for its primary purpose -- while China can allow itself to block a bunch of sites because it can even isolate itself from the rest of the world without any noticeable damage (keeping their own network inside the country working unimpeded), most of people, companies and governments will see the decrease of performance and reliability as a significant threat to them, and this will become even more obvious in the future.
I just pointed out that Cygnus people, within Red Hat or not, are not working on cygwin as only a part of their development of GNU utilities -- the comment that I am answering to implied that cygwin is their main project.
Cygnus did not write gcc. I believe that was RMS. Red Hat/Cygnus does contribute a lot to the gcc and gdb projects but they did not write these programs and do not own these programs.
Most of work on gcc is now being done by Cygnus.
Cygwin was written by Cygnus employees (hence the name) but, like any successful free software endeavor, it's grown far from its humble beginnings.
A port is a port. A port to the environment as hostile as Windows may be a difficult undertaking, but it's still derived from the same gnu utilities that are still in active development .
"NSA Line Eater", a recorder that keeps the history of all Internet traffic over major backbones, is a well-known semi-mythical entity that people assume, is very likely to exist. The problem is, all the data that it could (did?) collect should be almost impossible to process in any reasonable manner, and it's still not technically feasible to make it in any way respond by blocking the flow of data without bringing backbones to a crawl. So, yes, it's possible that everything is being recorded, but it has absolutely no effect one anyone's ability to block something.
It describes, what corporations and governments want or doing in their attempts to control the Internet, but we know this already. The problem is, it doesn't contain any plausible reasons why those attempts can possibly be successful.