Slashdot Mirror


User: Phroggy

Phroggy's activity in the archive.

Stories
0
Comments
6,452
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 6,452

  1. Re:Higher Standards on Apple Freezes Snow Leopard APIs · · Score: 2, Insightful

    I'm sure it won't.

    I tried upgrading to Leopard on my G4 iBook. Tried it for a couple months, then downgraded back to Tiger.

    Some of the UI decisions they made in Leopard, like folders in the Dock that display as all of their contents stacked in a pile instead of a folder icon, were completely brain-dead. There was enough public outcry (and third-party workarounds) that Apple added options to fix the behavior in newer versions, but they still go with the stupid options by default. Did they forget to do usability testing, or did they simply ignore the results? Did it not occur to them that when you've got four dozen items in your Applications folder, making the folder look almost like the Address Book is confusing? Or that a distant star shining through a transparent menubar looks like something's wrong with your screen?

    Other problems I noticed:

    • CUPS browsing is disabled by default
    • Editing multiple items in iCal is more awkward; they fixed part of it, but the details appear in a popup instead of a sidebar so they're always in a different part of the screen depending on what you're editing
    • Spotlight's "Show All" function doesn't group the results by categories
    • The selected tab in an application like X-Chat turns gray whenever another window has focus, so you can't see which tab was selected

    Also, I think getting rid of the rounded corners was a terrible choice. I found a hack that brings them back if you want.

    I also ran into driver issues - I couldn't get my Canon scanner to work, and couldn't communicate with my Nokia phone over Bluetooth. It reminded me of Vista users complaining about their driver woes.

    Then there are UI problems with Tiger that Leopard simply left unchanged:

    • FTP still doesn't work (try ftp://ftp.mozilla.org/pub/mozilla.org/ for example)
    • Windows like Spotlight's "Show All" search results window aren't associated with any application, so Cmd-Tab won't switch to them; in Leopard the "Add Printer" window has this problem too

    I don't see how Snow Leopard could be worse.

  2. Re:Been there, done that on Windows 7 RCs Shut Down To Force Updates · · Score: 1

    You exaggerate! Sometimes I could get Win95 to run for as many as six hours without crashing.

  3. Re:How many times are we going to hear this questi on Go For a Masters, Or Not? · · Score: 1

    /o Tape monkey get up, get coffee, tape monkey go to job... o/

    Tape monkey rotate last week's backups, push a button, turn a knob.

  4. Ready to go on Lenovo On the Future of the Netbook · · Score: 4, Insightful

    Linux, even if you've got a great distribution and you can argue which one is better or not, still requires a lot more hands-on than somebody who is using Windows. So, we've seen overwhelmingly people wanting to stay with Windows because it just makes more sense: you just take it out of the box and it's ready to go."

    If Linux netbooks aren't ready to go out of the box, the vendors are doing a poor job.

    If people are trying to install non-bundled apps, they might run into trouble. Otherwise, everything should just work. If it doesn't, something's wrong.

  5. Re:"State-Supported" Hackers on Law of Armed Conflict To Apply To Cyberwar · · Score: 2, Insightful

    From the the summary:

    This means that we consider state-supported 'hackers' to be subject to the Geneva Conventions and Customary International Law,...

    I really don't know what any of this means. First, what's with the "state-supported" bit? Why would that matter? Second, what does it mean to be subject to the Geneva Conventions - that we can't torture them if we catch them?

    It means a foreign government is attacking the United States, either directly or by outsourcing the task to private contractors. This decision says that just because they're doing the attack over the Internet instead of physically doesn't mean we should treat it any differently.

    On the other hand, if it's just some Chinese script kiddie in his basement, acting alone (without the support of the Chinese government), we're not going to retaliate by bombing Beijing, because that would be stupid.

  6. Re:PIF files on Windows 7 Users Warned Over Filename Security Risk · · Score: 1

    Of course that web site will be gone in a few months, and the information will be lost. Even if someone mirrors the page, links to the old location will be broken.

  7. Re:How to rename files on Windows 7 Users Warned Over Filename Security Risk · · Score: 1

    Um, no, that's a new feature on Leopard (Mac OS X 10.5). On Tiger (10.4), the entire visible part of the filename will be selected, including any extension.

  8. Re:How can this be? sufixication on Windows 7 Users Warned Over Filename Security Risk · · Score: 4, Informative

    By reading the MIME type stored in filesystem metadata! In this example, when you save a document in Microsoft Word and name it "file", instead of appending a ".doc" extension to the filename, Word would leave the filename alone and add a MIME type. The OS's file browser would use this MIME type to determine which application to open the file in when double-clicked (instead of using extensions the way it does now), and a web server would read the MIME type and send that to the browser, instead of looking up a file extension in a table the way it does now.

    For backwards compatibility, users could choose to append an extension to the filename, but this would be completely ignored by newer operating systems. If you chose to name your Word document "file.jpg", you could, and your OS wouldn't care, but since this would cause significant confusion when sending it to users of legacy systems, you wouldn't do that.

    The Macintosh filesystem (MFS/HFS/HFS+) used 32-bit "type" and "creator" codes, normally rendered as a 4-character string. This was a good idea in 1984, but not nearly as specific as MIME types (on classic Mac OS, HTML and XHTML and CSS and JavaScript files would all have their "type" field set to "TEXT"). MIME types are definitely the way to go, if you want to construct something like this today.

  9. Re:Perfect example of why wikipedia is not so bad on Phony Wikipedia Entry Used By Worldwide Press · · Score: 2, Insightful

    Everybody misses an important point in that story: the fact the student had to repeatedly introduce the phony quote in the article and barely succeeded in having it live for more than 24 hours demonstrates that wikipedia is pretty good at self-correcting itself !

    Yeah, that's great, but it's entirely possible that if this hadn't come to light so soon, somebody would later have "corrected" the Wikipedia article by citing The Guardian. It wouldn't be the first time this has happened.

  10. Re:Namespaces on An Early Look At What's Coming In PHP V6 · · Score: 1

    Glad you like my sig. Here's another:

    #!/usr/bin/perl
    for $a(1,46){for $b(0..7){$c=0;$_?hex substr(q), "ef7fa1866706ca",
    Just another Perl Hacker, ("eff02289402844"),2*$_+$a,2)&2**(7-$b):
    $_["phroggy"] and $c+=2**(7-$_)for(0..7);$d.=chr $c;}}print"$d\n";

  11. Re:Namespaces on An Early Look At What's Coming In PHP V6 · · Score: 1

    Say that $Foo=3
    It will print
    Hello 3

    Because the namespace begins with a backslash ('\foo\n') and when using it inside double quoted strings must be "\\foo\\n".

    The example in the article didn't mention leading with a backslash, or at least I don't think it did (it's been slashdotted, apparently).

    And seriously? You have to escape the backslashes? What if you want a literal backslash now?

  12. Re:Cry me a river on An Early Look At What's Coming In PHP V6 · · Score: 1

    Is there a business in supplying coal for instance? Some people still heat their houses with it, but does that mean YOU as a business man have to run a business to supply them?

    No, but it does mean if YOU choose not to supply them with coal, somebody else will.

    The parent isn't complaining because he doesn't want to stay up to date. He's complaining that they have a lot of customers who don't want to stay up to date, and there's nothing he can do about that except stop taking their money.

    Ask yourself, how much time does it cost you to keep the people happy who want PHP4 and how much that same time could have earned you in business from PHP5 customers.

    Unfortunately, turning away PHP4 customers doesn't mean more PHP5 customers will suddenly sign up. They are currently supporting both, and while of course there is a cost associated with continued support of PHP4, presumably they have already determined that the revenue from their continued business outweighs the extra cost. In fact, by offering consulting services for customers using PHP4 who have problems, they could make even more profit.

  13. Namespaces on An Early Look At What's Coming In PHP V6 · · Score: 4, Interesting

    So let's say you've got a global variable, $n

    And let's say you're using it in a module, Foo

    And because scattering global variables everywhere is a stupid idea that will lead to much pain, let's say you've decided to use namespaces in PHP6.

    Now, in your main script, let's say you happen to be using a variable $Foo, for no particular reason.

    What does this do?

    <?php
    echo "Hello $Foo\n";
    ?>

  14. Apple looking at EA? on Apple Racks Up the Gaming Patents · · Score: 4, Interesting

    I was about to dismiss it as unsubstantiated speculation, but I just saw an article claiming that Apple may want to acquire EA. That would fit in VERY nicely with designing their own game console, which I imagine would replace AppleTV.

    Wow. Apple buying Twitter would be silly, but Apple buying EA could totally change the landscape.

  15. Re:The Holy Bible is pure on Apple May Loosen Restrictions With iPhone 3.0 · · Score: 3, Informative

    That's the English Standard Version (ESV).

  16. Re:OK.... on Churches Use Twitter To Reach a Wider Audience · · Score: 1

    Now, brothers, if I come to you and speak in tongues, what good will I be to you, unless I bring you some revelation or knowledge or prophecy or word of instruction? ...Unless you speak intelligible words with your tongue, how will anyone know what you are saying? You will just be speaking into the air.

    So if the whole church comes together and everyone speaks in tongues, and some who do not understand or some unbelievers come in, will they not say that you are out of your mind? ...If there is no interpreter, the speaker should keep quiet in the church and speak to himself and God.

    1 Corinthians 14:6,9,23,28 (NIV)

  17. Re:Hmm. on McAfee Sites Vulnerable To XSS Attack · · Score: 1

    > (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address)

    Don't be so sure about that...

    Especially not when a valid email CAN have a lot of funky things in it, even comments.

    Hmm. It looks like you're right. On sites where I've written my own validation code it won't be accepted, but where I've used a CPAN module, it might be. I'll have to see if that's a problem anywhere.

    Normally characters like greater-than/less-than symbols are not permitted, but the local-part (left of the @ symbol) can be quoted, and if it's quoted, it can contain them. Spaces are also allowed. So, "<script>alert('foo');//</script>"@example.com is technically a valid address. That's disturbing.

  18. Re:Hmm. on McAfee Sites Vulnerable To XSS Attack · · Score: 1

    I find it easiest to not validate anything on input, because I don't know what my output is necessarily going to be - could be HTML, could be PDF (for example). If I am outputting to non-HTML I don't want to wade through HTML-encoded soup to get something sensible back out.

    What I mean by input validation is aborting with an error if the user has submitted invalid data, e.g. entering "foo" in an e-mail address field. Nothing is encoded or escaped at this point. If I need to store it in a database, the data is stored as-is, using the Perl DBI's automatic escaping feature to make sure SQL injection attacks aren't possible (I can think of one occasion when this wasn't adequate and I had to wring my own routine). Whatever else I need to do with the data, any necessary escaping gets done only as the data is being used, it's never stored that way. If I need to send it back to the browser, HTML escaping doesn't happen until I actually print the HTML, or immediately before.

    If I'm outputting to web, I then always validate / encode *all* content, usually using something like the Microsoft AntiXSS library. This stops user-inputted markup from being rendered, but it also stops markup that's been maliciously inserted into your database from being remembered. Remember the SQL injection attack that appended a javascript snippet to every field it could find? It was looking to do an XSS attack.

    That's a very interesting idea. Because I use Perl's DBI, I don't normally worry about SQL injection, because I so rarely include a raw variable in a query string (and I'm very careful if I do - for example, I might use a variable that's looping through a list of field names, but the list isn't user-submitted, it's hard-coded into the script).

    If you need to chuck out user-generated markup, make sure you contstruct your whitelist and ruleset very carefully.

    Yes, I think I have done that. However, this sort of thing is very easy to get wrong, and one little slip can result in disaster. Hopefully I've done everything correctly.

  19. Re:Hmm. on McAfee Sites Vulnerable To XSS Attack · · Score: 1

    User submitted implies that he's talking about server side validation of the received POSTed data. Also he specifies that he is properly escaping dangerous characters before sending the response BACK to the browser.

    Yes, this is precisely what I meant.

    I normally implement server-side input validation first, test it, then add client-side input validation in JavaScript.

    On the server side, once it's been through input validation, then anything that needs to be sent back to the browser is escaped (run through a function that converts characters like greater-than/less-than symbols to HTML entities, etc.), but I often skip this for data that is known to be safe because it would have failed input validation if it wasn't (e.g. e-mail addresses).

    No where could it be interpreted as client-side validation.

    Somehow it would appear that you're mistaken. ;-)

  20. Hmm. on McAfee Sites Vulnerable To XSS Attack · · Score: 2, Interesting

    Yikes. I wonder if any of my code has that vulnerability. I don't think so. I try to make sure I run all user-submitted text through something to escape those kinds of characters before sending it back to the browser as HTML, but it's possible I could have missed something somewhere. The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?

    The only way I could be sure is if I did a thorough audit of all my web site code, and I really don't want to go through that hassle. It's probably fine. I've never had an XSS attack used successfully against any site I've built. Certainly not one that was using SSL. So let's just assume that this trend will continue!

    Right?

  21. Re:Mac users on The Biggest Cults In Tech · · Score: 1

    on mouseUp
      if word 3 of the last line of paragraph 1 of card field "foo" is "bar" then
        answer "Foobar?" with "Cancel" or "Ok"
        if It is "Ok" then put "foo" into word 3 of the last line of paragraph 1 of card field "foo"
      else
        answer "No foobar." with "Cancel"
      end if
    end mouseUp

    Something like that look about right?

  22. Re:Mac users on The Biggest Cults In Tech · · Score: 1, Informative

    The consistency and attention to detail in the UI, and the great applications.

    Some of this consistency was due to Apple's Human Interface Guidelines, which specified minute details like how many pixels there should be between a button and the edge of a dialog box, as well as more generally what to think about when choosing labels for the buttons, and when it's appropriate to use modal or modeless dialogs.

    Some of it was because Steve Jobs oversaw much of the design of the Mac OS personally, and if he wasn't happy with it he would throw things at people until they got it right.

    When Windows 3.1 was limited to eight character filenames with only a few non-alphanumeric characters allowed, Macs allowed 31 characters, were case-preserving (but not case-sensitive) and could contain almost any character except a colon. You could have different files of the same type (e.g. a JPEG picture) that would open in different applications (e.g. one would open in GraphicConverter while another would open in Photoshop) depending on which application created the file. You could organize your files by physical layout, grouping a few files together on the left side of a window and others on the right, then use labels to make some files red and others blue.

    And then there were the applications. BBEdit and GraphicConverter come to mind as great apps that are still actively developed. Apps like Photoshop and Excel were Mac-first. I've forgotten most of the apps that we used back then, but there was a very active Mac shareware community.

  23. Mac users on The Biggest Cults In Tech · · Score: 0, Troll

    Plenty of newbs are jumping aboard the Mac bandwagon now that it's trendy to do so. Mac OS X is now a certified UNIX operating system, mostly compatible with lots of Linux or FreeBSD stuff, and it runs on what is mostly off-the-shelf PC hardware including Intel CPUs.

    However, some of us loved our Macs in the 1990s, when none of those things were true.

  24. Re:Colbert != comedian on Let's Rename Swine Flu As "Colbert Flu" · · Score: 1

    Nah, parodying the zealotry of the right wing is funny in any western culture--English included! I lived there, and they do it just as well as Colbert (remember the funny puppets from the 80s of Reagan, Thatcher, et. al.?)

    It's important to note that Colbert is parodying both the style and the message. Making fun of the right wing is great, if you happen to lean left, but making fun of shameless bias, arguing without facts, and ridiculous claims of impartiality while acting like a pompous buffoon is also important.

    Keith Olbermann, for example, is just as shamelessly biased, but he backs up his arguments with researched facts and doesn't claim to be "fair and balanced". The political message might be a good target for parody (criminal prosecutions for CIA operatives who were doing their jobs under the guidance and oversight of the US Department of Justice? Really?) and his over-the-top bias is hard to stomach even when you agree with him, but apart from that his style just doesn't warrant a parody.

  25. Re:Colbert != comedian on Let's Rename Swine Flu As "Colbert Flu" · · Score: 1

    Being from Ireland, you may not be familiar with American cable news channels. Count yourself lucky.

    Weird Al Yankovic parodies popular music, but "Taco Grande" isn't particularly funny today. At the time, it was comedic genius; a much-needed relief from radio stations that were playing "Rico Suave" several times a day. If you never heard the original, though, "Taco Grande" must stand alone, and although you might appreciate the general silliness (in the same way you might appreciate Yankovic's "Hardware Store"), it's not really funny by itself.

    When Colbert stands alone, he's somewhat amusing, but to appreciate his genius, you must immerse yourself in the source material. Watch Bill O'Reilly insist that his own warped views are unbiased and therefore inherently correct; watch him act like a pompous buffoon when someone dares introduce real facts into a discussion. Listen to John Gibson sign off with "and that's my word." Watch CNN and MSNBC. Watch the crap that American cable news networks are churning out every day, and THEN flip over to The Colbert Report. You'll understand a lot better.