Turning off services is much better than hosts.allow/deny.
the problem is that most of the distributions started out making an OS for Sysadmins, and they can't get it out of their system. Ever heard of a network exploit for Corel Linux? Why not? It's for users, and doesn't have _any_ services running. When someone clicks on "desktop install", that's what they should get. Then you don't have to mess with files like hosts.allow/deny, ftpusers, and stuff like that. If you want to run an FTP site, then you should know how that stuff works, but most desktop users don't even know that they are running an FTP site, and that is the distributions fault.
I think the problem is that most people confuse the "potential" for better code, with "automatic" better code. Just because I release the source code doesn't make it secure. However, you _can_ find programs that have been secured. Open-source does not remove the need for security-conscious people, it just gives them better tools. With source code, if you get 0wn3d, its your fault. With proprietary code, it's the other guys fault:)
Actually, you don't need to re-install to get rid of it, as it doesn't actually touch any of your binaries. Just boot in "emergency" mode,
rm -R/usr/src/.poop
comment out the "asp" stuff in/etc/inetd.conf
rm/sbin/asp
change your passwords (an email was sent - not sure what the contents were)
remove the "asp" line in/etc/rc.d/rc.sysinit
The ftpd hole was fixed for you, and you also need to make sure rpc.statd is turned off.
I'd also suggest you go through your logs so you can see who gave you the worm, so you can tell them that they've been 0wn3d.
Also, _all_ of your index.html files have been replaced by a ramen advertisement.
However, these are the same things that have vulnerabilities in MS-land, and usually patches have been out. How many times have bugs been found in the NT kernel? Isn't it usually IIS? That is an add-on service.
Yes, I know I'm an idiot for not patching/firewalling my system. However, I got hacked (note, though, the servers I maintain did not get hacked, even though I'm relatively certain it was tried). I love getting 0wn3d. Oh well.
As far as displaying poorly with poorly-written code, well, that's your fault. As for the quirks, I guess that depends on how you use it. For me, netscape has had the fewer quirks. IE will tend to do some pretty random stuff in fixed-width tables.
Actually VA makes _wonderful_ equiptment. It is all completely tested. I remember once VA found an obscure memory problem that occured with certain memory chip/mobo combinations. You have to be really watching to find stuff like that. And, they found this before shipping, so they went back and designed and tested a unit that did work. VA customers never have to worry about poorly-made or poorly-tested products. The only have about 8 base server models to choose from, so you can be sure its very well tested. Also, the construction is very good, too. I've never seen anyone use Teflon cabling for internal SCSI buses. Those cables cost over a hundred dollars, and VA uses it for internal cabling. You are talking to a _very_ satisfied VA customer.
It was checked - that's how the hole was found. You can't security audit code in a short period of time - it takes a while. Anyway, it was because of the source release that this was found. Otherwise, this _never_ would have been fixed.
Its strange that you say that the OSS field is too fractured to do anything close, and then mention several incompatible competitors. It doesn't seem that OSS is any more fractured than anyone else. If there is to be a standard, it will be CORBA, and - oh look - GNOME already does that. However, the one thing you are missing about these object protocols is their complexity. The nice thing about http/ftp/ssh/whatever is their simplicity. Using CORBA, situations can get real messy, real fast. The lightweight services tend to give much better, more reliable results! They are missing several features, but are those features worth the pain? I don't know. If they are, well, we'll probably end up using CORBA, and probably Linux running CORBA.
I think you are also missing how quickly Linux has gained in the server arena. It now has support for Logical Volume Management (like, add this drive, and make it a part of this virtual partition), RAID hot adding/removing, and the like. Consider the following configuration:
Linux
Postgresql 7.1 (database)
RAID/LVM drives on SCSI/SCA hotswap
OpenLDAP
Postfix (mail)
Apache
and you start seeing "heavy-duty server" written all over it.
I understand where you're coming from. They couldn't have used the Gtk object model and had it be XP. Also, if they used Gtk widgets, it would not have been able to conform to W3C standards. Now, if all you want is for the control buttons to be Gtk, use galeon instead - it uses Mozilla for the page, and GTK for the outside.
I'm on a LinuxPPC box with a mouse with one button. I actually like it better. I've got Middle-Click mapped to F1, and right-click to F2. It works out very well.
I don't think its a fad. Structured programming is still the model we use, even when using it within object-oriented programming.
The guy who wrote the article missed one of the most important aspects of OO, and that's _interface_ inheritance. Interface inheritance is _NOT_ subtyping, and is vastly more flexible and usable than subtyping, which seemed to be one of his big gripes. If you want to know more about interface inheritance, look at my page at
http://members.wri.com/johnnyb/comppapers/factor in ginheritance.html
I called them "feature factors" here.
Re:the problem with UNIX is the languages
on
GTK+ without X!
·
· Score: 2
1) You can't say that Gtk was written to build market share quickly. Gtk was written as a toolkit for GIMP.
2) The reason that it is interfaceable with a number of languages, is because of how close it is to assembly language. Since all languages have to be "interfaceable" with assembly anyway, making them interfaceable with C is fairly trivial
3) I have seen other systems. My experience isn't overwhelming, but I've used Java, Delphi, and Gtk/GNOME. I liked Gtk/GNOME the best.
Please don't use terms like 'intellectual property' as if they were really property. Its absurd. The whole notion is absurd. The framers of the constitution didn't think of copyright as any sort of property. In fact, the founding fathers (if your from America, that is) said that property is an innate right, but copyright is something that the public _can_ give to someone if it deems it in the public interest. Most of the things in the constitution are deemed moral imperatives. Copyright, however, is said to be something that can be granted or taken away as the people see fit.
If you don't think its right, that's fine. But PLEASE don't confuse property rights with "intellectual property". Don't call it "pirating" or "stealing", because those words bring out extra connotations than what is actually being done. Call it "unauthorized copying", because that is what is going on. Noone's property is being stolen by any stretch of the imagination.
The kernel being delayed does not hinder taking over Microsoft. It doesn't. There's nothing about the kernel that's a problem. All of the cool stuff like USB in 2.4 has been ported back to 2.2 long ago.
They way they _should_ do development, is they should have started the 2.5 tree months ago, and left Alan Cox to finish up 2.4 and make it stable, and let Linus code all of the nifty things he wants for 2.6. Waiting until after the release to start working on a new one, although it sounds like a good idea, usually makes the current release schedule longer (because developers always have new ideas), and buggier (because when developers add new things, it breaks)
The GNOME team is working on exactly that - just check out Nautilus and Helix GNOME and Evolution.
The community shouldn't have a sense of direction. We are all individuals here. Direction should only be maintained (1) with the project maintainers (not the individual developers) and (2) with the dists. They are responsible for cohesion and direction on what they work on. Why should you tell me what I should work on?
Of course things in Linux look like copies of other things. Most innovation is incremental, not revolutionary. Revolutionary innovation is only practically realizable in incremental changes from the current place. The free software movement has only been really active for a short time, so we are coding to catch up, and then do incremental innovation from there. In the places where we didn't have 20 years worth to catch up, we are far in the lead (webserving, internet services, etc).
If you want current innovation on the UI front, look at Eazel.
The GNOME team has done a great job, I use GNOME/DIA/AbiWord as part of my job, and they work wonderfully. And, I'm running them all on a leftover PMac 7300. And I have the free software movement to thank for that.
You're still missing the point. Distros are what the users use. And no, distros should not be giving people that much choice. However, as the previous poster said, there is no such thing as too much choice. The user should never have to pick a window manager, that should be done by the distro. The should never decide that they want to use GTK on the framebuffer, the distro should not give them that option. However, saying that there is too much choice is like saying there are too many engines for cars these days. Well, you don't buy an engine, you buy a whole car, all put together. When you get in to engine shopping, you go to a mechanic, who _does_ know the details. Drivers should never pretend to be mechanics, either in driving or in software. However, the mechanics and manufacturers should have as much choice as possible.
Re:the problem with UNIX is the languages
on
GTK+ without X!
·
· Score: 2
1) Everything is a pragmatic compromise. Really. The whole point of computers is pragmatism. Would you rather them be not pragmatic?
2) The great thing about C is that it is interfaceable with a number of languages. I think that other languages are _great_ for application programming, but library programming is best done in C. Maybe the panel should be written in another language. The windowmanager already is (scheme-like if you use SawFish). With C, the application programmer gets to pick his choice of languages. With others, it is much harder.
3) It would be cool for someone to make a language that used the glib object model implicitly. That would be uber-cool.
glib/gtk is about the best-designed piece of software I've ever seen. It's wonderful, easy-to-use, and fun to program with.
Re:Why would anyone bother with PhotoShop now ???
on
Gimp 1.2.0 Released
·
· Score: 2
Gimp 1.2 lets you later change type after its been typed in. However, it does not let you change type after it has been put through effects.
That's good for installation, but what about removal? What about dependency checking during removal?./configure won't help you there. The only way./configure works in a sensible way is if it is used in conjunction with encap or stow.
Slashdot Mirror
Turning off services is much better than hosts.allow/deny.
the problem is that most of the distributions started out making an OS for Sysadmins, and they can't get it out of their system. Ever heard of a network exploit for Corel Linux? Why not? It's for users, and doesn't have _any_ services running. When someone clicks on "desktop install", that's what they should get. Then you don't have to mess with files like hosts.allow/deny, ftpusers, and stuff like that. If you want to run an FTP site, then you should know how that stuff works, but most desktop users don't even know that they are running an FTP site, and that is the distributions fault.
I think the problem is that most people confuse the "potential" for better code, with "automatic" better code. Just because I release the source code doesn't make it secure. However, you _can_ find programs that have been secured. Open-source does not remove the need for security-conscious people, it just gives them better tools. With source code, if you get 0wn3d, its your fault. With proprietary code, it's the other guys fault :)
Actually, it is destructive - it replaces _every_ index.html on your system with an advertisement for Ramen.
Actually, you don't need to re-install to get rid of it, as it doesn't actually touch any of your binaries. Just boot in "emergency" mode,
/usr/src/.poop
/etc/inetd.conf
/sbin/asp
/etc/rc.d/rc.sysinit
rm -R
comment out the "asp" stuff in
rm
change your passwords (an email was sent - not sure what the contents were)
remove the "asp" line in
The ftpd hole was fixed for you, and you also need to make sure rpc.statd is turned off.
I'd also suggest you go through your logs so you can see who gave you the worm, so you can tell them that they've been 0wn3d.
Also, _all_ of your index.html files have been replaced by a ramen advertisement.
However, these are the same things that have vulnerabilities in MS-land, and usually patches have been out. How many times have bugs been found in the NT kernel? Isn't it usually IIS? That is an add-on service.
However, that's a lot for 100 Megs of stuff. A CD would STILL be very useful.
Yes, I know I'm an idiot for not patching/firewalling my system. However, I got hacked (note, though, the servers I maintain did not get hacked, even though I'm relatively certain it was tried). I love getting 0wn3d. Oh well.
As far as displaying poorly with poorly-written code, well, that's your fault. As for the quirks, I guess that depends on how you use it. For me, netscape has had the fewer quirks. IE will tend to do some pretty random stuff in fixed-width tables.
No, there is PostgreSQL at the high end, MySQL at the medium-low end, and sleepycat at the really-low-end.
Actually VA makes _wonderful_ equiptment. It is all completely tested. I remember once VA found an obscure memory problem that occured with certain memory chip /mobo combinations. You have to be really watching to find stuff like that. And, they found this before shipping, so they went back and designed and tested a unit that did work. VA customers never have to worry about poorly-made or poorly-tested products. The only have about 8 base server models to choose from, so you can be sure its very well tested. Also, the construction is very good, too. I've never seen anyone use Teflon cabling for internal SCSI buses. Those cables cost over a hundred dollars, and VA uses it for internal cabling. You are talking to a _very_ satisfied VA customer.
It was checked - that's how the hole was found. You can't security audit code in a short period of time - it takes a while. Anyway, it was because of the source release that this was found. Otherwise, this _never_ would have been fixed.
Its strange that you say that the OSS field is too fractured to do anything close, and then mention several incompatible competitors. It doesn't seem that OSS is any more fractured than anyone else. If there is to be a standard, it will be CORBA, and - oh look - GNOME already does that. However, the one thing you are missing about these object protocols is their complexity. The nice thing about http/ftp/ssh/whatever is their simplicity. Using CORBA, situations can get real messy, real fast. The lightweight services tend to give much better, more reliable results! They are missing several features, but are those features worth the pain? I don't know. If they are, well, we'll probably end up using CORBA, and probably Linux running CORBA.
I think you are also missing how quickly Linux has gained in the server arena. It now has support for Logical Volume Management (like, add this drive, and make it a part of this virtual partition), RAID hot adding/removing, and the like. Consider the following configuration:
Linux
Postgresql 7.1 (database)
RAID/LVM drives on SCSI/SCA hotswap
OpenLDAP
Postfix (mail)
Apache
and you start seeing "heavy-duty server" written all over it.
You have to do it in X itself. I don't remember offhand how I did it, if I remember I'll look at it when I get to work.
I understand where you're coming from. They couldn't have used the Gtk object model and had it be XP. Also, if they used Gtk widgets, it would not have been able to conform to W3C standards. Now, if all you want is for the control buttons to be Gtk, use galeon instead - it uses Mozilla for the page, and GTK for the outside.
I'm on a LinuxPPC box with a mouse with one button. I actually like it better. I've got Middle-Click mapped to F1, and right-click to F2. It works out very well.
I don't think its a fad. Structured programming is still the model we use, even when using it within object-oriented programming.
r in ginheritance.html
The guy who wrote the article missed one of the most important aspects of OO, and that's _interface_ inheritance. Interface inheritance is _NOT_ subtyping, and is vastly more flexible and usable than subtyping, which seemed to be one of his big gripes. If you want to know more about interface inheritance, look at my page at
http://members.wri.com/johnnyb/comppapers/facto
I called them "feature factors" here.
1) You can't say that Gtk was written to build market share quickly. Gtk was written as a toolkit for GIMP.
2) The reason that it is interfaceable with a number of languages, is because of how close it is to assembly language. Since all languages have to be "interfaceable" with assembly anyway, making them interfaceable with C is fairly trivial
3) I have seen other systems. My experience isn't overwhelming, but I've used Java, Delphi, and Gtk/GNOME. I liked Gtk/GNOME the best.
Please don't use terms like 'intellectual property' as if they were really property. Its absurd. The whole notion is absurd. The framers of the constitution didn't think of copyright as any sort of property. In fact, the founding fathers (if your from America, that is) said that property is an innate right, but copyright is something that the public _can_ give to someone if it deems it in the public interest. Most of the things in the constitution are deemed moral imperatives. Copyright, however, is said to be something that can be granted or taken away as the people see fit.
If you don't think its right, that's fine. But PLEASE don't confuse property rights with "intellectual property". Don't call it "pirating" or "stealing", because those words bring out extra connotations than what is actually being done. Call it "unauthorized copying", because that is what is going on. Noone's property is being stolen by any stretch of the imagination.
The kernel being delayed does not hinder taking over Microsoft. It doesn't. There's nothing about the kernel that's a problem. All of the cool stuff like USB in 2.4 has been ported back to 2.2 long ago.
They way they _should_ do development, is they should have started the 2.5 tree months ago, and left Alan Cox to finish up 2.4 and make it stable, and let Linus code all of the nifty things he wants for 2.6. Waiting until after the release to start working on a new one, although it sounds like a good idea, usually makes the current release schedule longer (because developers always have new ideas), and buggier (because when developers add new things, it breaks)
The GNOME team is working on exactly that - just check out Nautilus and Helix GNOME and Evolution.
The community shouldn't have a sense of direction. We are all individuals here. Direction should only be maintained (1) with the project maintainers (not the individual developers) and (2) with the dists. They are responsible for cohesion and direction on what they work on. Why should you tell me what I should work on?
Of course things in Linux look like copies of other things. Most innovation is incremental, not revolutionary. Revolutionary innovation is only practically realizable in incremental changes from the current place. The free software movement has only been really active for a short time, so we are coding to catch up, and then do incremental innovation from there. In the places where we didn't have 20 years worth to catch up, we are far in the lead (webserving, internet services, etc).
If you want current innovation on the UI front, look at Eazel.
The GNOME team has done a great job, I use GNOME/DIA/AbiWord as part of my job, and they work wonderfully. And, I'm running them all on a leftover PMac 7300. And I have the free software movement to thank for that.
You're still missing the point. Distros are what the users use. And no, distros should not be giving people that much choice. However, as the previous poster said, there is no such thing as too much choice. The user should never have to pick a window manager, that should be done by the distro. The should never decide that they want to use GTK on the framebuffer, the distro should not give them that option. However, saying that there is too much choice is like saying there are too many engines for cars these days. Well, you don't buy an engine, you buy a whole car, all put together. When you get in to engine shopping, you go to a mechanic, who _does_ know the details. Drivers should never pretend to be mechanics, either in driving or in software. However, the mechanics and manufacturers should have as much choice as possible.
1) Everything is a pragmatic compromise. Really. The whole point of computers is pragmatism. Would you rather them be not pragmatic?
2) The great thing about C is that it is interfaceable with a number of languages. I think that other languages are _great_ for application programming, but library programming is best done in C. Maybe the panel should be written in another language. The windowmanager already is (scheme-like if you use SawFish). With C, the application programmer gets to pick his choice of languages. With others, it is much harder.
3) It would be cool for someone to make a language that used the glib object model implicitly. That would be uber-cool.
glib/gtk is about the best-designed piece of software I've ever seen. It's wonderful, easy-to-use, and fun to program with.
Gimp 1.2 lets you later change type after its been typed in. However, it does not let you change type after it has been put through effects.
That's good for installation, but what about removal? What about dependency checking during removal? ./configure won't help you there. The only way ./configure works in a sensible way is if it is used in conjunction with encap or stow.