Plus with an open documented format, you can weed out a lot of things by parsing the document...
Embedded binaries, recogniseable shellcode, macros, and many other nasties embedded in an open document can be detected, and the xml data itself can be validated against the schema to further cut out a percentage of nasties... MS on the other hand uses a binary blob, which is much harder to sort through.
Can't speak for the spreadsheet component, but i've had the opposite experience with the word processing components... Open up a large textfile (how large depends on your available ram, i used about 12000 pages) in word and openoffice writer. This is plain text, no formatting or anything, the results:
Word appears to load it and lets you read the first few pages, meanwhile the application is chugging away in the background... it informs you it won't be able to spell check as you type, and then hangs for a few minutes before completely crashing.
Writer takes ages to load it, but once loaded lets you work with it with no slowdown, and even spell checks it properly.
Your forced to use the built in IDE with msoffice and VBA... On the other hand Openoffice lets you write macros in java, javascript, python or it's own built in starbasic language, for all but the latter many IDE's exist for you to use, and plenty of people can already program in these languages, no need to learn a new language with such a limited scope for use.
If you need support, you can buy it from sun (either in the form of staroffice, or seperately buy support), what support do you get from ms after you've paid $400 for the software? How do you know it's not been audited? the source is out there, many people could have...
Since when has the msoffice gui matched the rest of the system either? If you want a consistent interface then koffice is for you.
Openoffice has a rich macro API too, and supports writing of macros in multiple languages.
In terms of home users, you can have home users using different versions of msoffice to you, which also causes incompatibilities, or you can give them a copy of openoffice for free and ensure consistency. I doubt many companies would foot the bill to buy the same version of msoffice for all their employees to use at home, even if it did save them a lot of version mismatch problems.
As for people outside your organisation, with openoffice you *can* open msoffice documents, in some cases better than different versions of ms can open them. However with ms, you can't open documents in the opendocument format, which is seeing increasing use especially in government.
Usually not. Large consumer oriented ISPs (ie: the biggest ones) have far too many customers, and far too few staff monitoring abuse@ (if any), and far too much red tape to cut through to get anything done anyway.
Well, your VM server is a far more complex beast than a simple serial console server, and is therefore far more likely to go down... Anyone running a significant number of servers with serial consoles should have a console server anyway.
But the point is, you have a single point of failure in either scenario, just with serial consoles that point is less complex and less likely to fail.
On the other hand, you can take advantage of the fact that most systems have 2 serial ports, and pair all your systems up with the console connecting out of one and into another, so a machine only becomes inaccessible if it's pair goes down too.
Then why are these companies being allowed to get away with copy protection schemes? They may be easily crackable, but not by joe public, who is the most likely to need a backup copy.
As with most such security measures, copy protection schemes just hurt the legitimate users. Those who can crack the schemes themselves, or know people who can, probably already use downloaded versions anyway.
And to continue the trend of a car analogy (even tho the first one made no sense whatsoever) look at codes on car radios. I have a radio in my car, which has a 4 digit code that needs to be entered if the battery is disconnected, recently the battery was replaced and i spent a couple of weeks without a radio because that's how long it took me to find the business-card sized card with the code on it. On the other hand, someone who steals car radios (or deals in radios stolen by others) will know methods of easily and quickly resetting the code... I've seen (and user) legit garages that do it in seconds, and car radios still get stolen even tho most have codes nowadays, so it's pretty clear the thieves know how to break these codes in a pretty trivial manner.
And then you have my grandfather, who managed to get his radio locked out (3 failed attempts) because the code supplied with his car, was not the code currently set on the radio (clearly the previous owner had mislaid the code and had it reset, because the serial numbers on the radio matched the car according to the dealer) was not the code written down in the car's handbook (which was the original code according to the dealer)... Anyway he took it to a main dealer, they looked up the code that was supposed to be on that car (seems most manufacturers keep a database of radio cars linked to chassis numbers) and that didnt work, so they reprogrammed the code, reprogramming it took all of 5 minutes but he still had to pay for the service.
A radio without a code would have saved him a considerable amount of time, hunting around for the code, calling the guy he bought the car from, taking time off work to go down to the car dealer... It would have saved a thief 5 minutes of his time.
I find it highly amusing that the "server" versions of windows all ship with a complete copy of directx (including direct3d, and support for various gaming-related networking protocols and joysticks etc)... And you can't remove it... WHY? Maybe they're admitting what a mickey mouse excuse for a server their OS is, and that i should be playing games on it instead.
The guest OS can use it's own drivers for USB devices (which most likely includes your webcam) For PCMCIA you'd have no joy, since the host OS would need to support it, on the other hand you could use ndiswrapper to get linux to support it using the windows drivers. (out of interest, what type of wireless card is it? most chipsets are supported nowadays, just not always in the default kernels) Your mic will work fine if it's connected to your soundcard in the standard way... If it's a USB device then it should work too, same as your webcam.
I always used host-only networking in vmware, and let linux handle the natting and port forwarding... I didn't even know vmware could do port forwarding! Vmware's implementation of nat is quite easy to crash, if your doing a heavy portscan over a vmware nat interface it can sometimes go tits up... The same thing happens if a guest windows machine gets infected with some kind of ddos drone which begins an attack. As to the linux client being neglected, the linux client is the original one, vmware was originally designed for linux and the windows version was always an afterthought... the linux version always seems to be a fair bit quicker too (especially with networking)
As someone said earlier, the "1 server per task" mentality is a result of flawed OS's and apps... Similarly, the "physical reboot / physical console access" idea is a result of flawed hardware/firmware design (well, more a result of people using systems designed for desktop use as servers). and flawed gui-only os's (again, designed for desktop use) Any proper server system will have at the very least a serial console, with the ability to reboot/manage/reinstall etc from it... I have a vax from the late 80s with such a feature, and i've never seen a sun sparc system without serial console support.
I totally agree... I run a number of unix systems in the same way, i currently run 2 mailservers (1 for sending/receiving mail, 1 for spam filtering) spam filters, http/https, dns, database, ircserver, asterisk and jabber server on a single quad processor box with redundant power, raid5 disks, daily tape backup and ecc memory. The OS does a good job of keeping everything apart from each other, and implements ulimits to prevent one service going nuts and consuming all the ram/cpu. If i had to split all these services to seperate machines i'd be running on massively inferior hardware, with far less redundancy features... And i'd lose the burst ability - admittedly seperate boxes would be faster *IF* every service was heavily loaded, but it's usually the case that only one or two services see heavy load at any one time, during which time these services have access to a single far more powerfull system than if they ran on a smaller dedicated box.
He'l lose performance, running in 32bit mode you have to use nasty paging hacks to access 16GB of ram, and i believe theres a 2GB or 4GB limit per process (which might not matter). Also you lose access to the extra registers available in 64bit mode... Finally if he's using AMD cpus, then no 32bit version of windows supports NUMA properly (not sure if the 64bit versions do)
Was there any additional latency on a couple of the ping responses?
Your solution also works around a common problem - resource utilisation and general user fuckups, each user can only crash one of the smaller virtual boxes instead of the whole system.
In terms of security, A/D is actually a lot more of a headache than Novell's offering... But your right, the biggest issue with citrix is the applications behind it, many windows programs are simply not designed with security or multiuser usage in mind, there are often ways to execute arbitrary code and very little protection against excessive resource utilisation, create a corrupt word document, load it up on a shared citrix server and watch the calls to support go through the roof.
Actually MacOSX is case sensitive too, but the default filesystem (HFS+) is not... Tiger introduced a case sensitive version of HFS+ which breaks poorly written apps like photoshop, but makes it easier to compile some unix apps.
Actually joliet was microsoft's attempt to create their own extension to ISO9660 (which only allows 8.3 filenames) instead of using the existing extension, rock ridge, which is not only more flexible but was already supported by virtually every other os out there (including your old sunos boxes)
Filenames aren't really the place for such information tho... One neat feature of amigaos, was that every file could have a comment attached, a majority of networking apps used this feature to store the URL of any file in it's comment, so i could see exactly where things were downloaded from at a glance.
I demand the right to make backup copies of any media i purchase...
I have CD's which i like to listen to in the car, they often end up getting damaged by extremes of temperature in the car.
I have younger brothers/sisters, and i could have kids, who are highly likely to want to play games and watch movies... Can you really trust kids to take care of media? I have made countless copies of various CDs, Games and DVDs for my younger brother, who has managed to scratch or otherwise destroy hundreds of them through mishandling (he likes to carry CDs/DVDs around in his pocket, which also contains coins) and when he's finished using a piece of media, he likes to just leave it laying around, on the floor to be trodden on or picked up/chewed by the dog, in direct sunlight, on/near sources of heat like radiators, or he handles them with dirty hands...
I don't mind losing a pile of $0.05 cheapo blank CDs to kids, it just goes with the territory, but to lose a $50 game is another matter.
Hmm, you don't need root to install openoffice on mac, tho you do to install X11 if you don't already have it... I`m sure you can still install neooffice without root tho.
Slashdot Mirror
Plus with an open documented format, you can weed out a lot of things by parsing the document...
Embedded binaries, recogniseable shellcode, macros, and many other nasties embedded in an open document can be detected, and the xml data itself can be validated against the schema to further cut out a percentage of nasties...
MS on the other hand uses a binary blob, which is much harder to sort through.
Incase you haven't noticed, msoffice is multi platform too, infact it started out on the mac.
Besides, cross platform is a good thing, it reduces platform lock-in and increases competition, which drives prices down and quality up.
Can't speak for the spreadsheet component, but i've had the opposite experience with the word processing components...
Open up a large textfile (how large depends on your available ram, i used about 12000 pages) in word and openoffice writer.
This is plain text, no formatting or anything, the results:
Word appears to load it and lets you read the first few pages, meanwhile the application is chugging away in the background... it informs you it won't be able to spell check as you type, and then hangs for a few minutes before completely crashing.
Writer takes ages to load it, but once loaded lets you work with it with no slowdown, and even spell checks it properly.
Your forced to use the built in IDE with msoffice and VBA...
On the other hand Openoffice lets you write macros in java, javascript, python or it's own built in starbasic language, for all but the latter many IDE's exist for you to use, and plenty of people can already program in these languages, no need to learn a new language with such a limited scope for use.
If you need support, you can buy it from sun (either in the form of staroffice, or seperately buy support), what support do you get from ms after you've paid $400 for the software?
How do you know it's not been audited? the source is out there, many people could have...
Since when has the msoffice gui matched the rest of the system either? If you want a consistent interface then koffice is for you.
Openoffice has a rich macro API too, and supports writing of macros in multiple languages.
In terms of home users, you can have home users using different versions of msoffice to you, which also causes incompatibilities, or you can give them a copy of openoffice for free and ensure consistency. I doubt many companies would foot the bill to buy the same version of msoffice for all their employees to use at home, even if it did save them a lot of version mismatch problems.
As for people outside your organisation, with openoffice you *can* open msoffice documents, in some cases better than different versions of ms can open them. However with ms, you can't open documents in the opendocument format, which is seeing increasing use especially in government.
Wow! now i can protect my site from "prying ices" too!
Usually not.
Large consumer oriented ISPs (ie: the biggest ones) have far too many customers, and far too few staff monitoring abuse@ (if any), and far too much red tape to cut through to get anything done anyway.
Well, your VM server is a far more complex beast than a simple serial console server, and is therefore far more likely to go down...
Anyone running a significant number of servers with serial consoles should have a console server anyway.
But the point is, you have a single point of failure in either scenario, just with serial consoles that point is less complex and less likely to fail.
On the other hand, you can take advantage of the fact that most systems have 2 serial ports, and pair all your systems up with the console connecting out of one and into another, so a machine only becomes inaccessible if it's pair goes down too.
Then why are these companies being allowed to get away with copy protection schemes?
They may be easily crackable, but not by joe public, who is the most likely to need a backup copy.
As with most such security measures, copy protection schemes just hurt the legitimate users.
Those who can crack the schemes themselves, or know people who can, probably already use downloaded versions anyway.
And to continue the trend of a car analogy (even tho the first one made no sense whatsoever) look at codes on car radios.
I have a radio in my car, which has a 4 digit code that needs to be entered if the battery is disconnected, recently the battery was replaced and i spent a couple of weeks without a radio because that's how long it took me to find the business-card sized card with the code on it.
On the other hand, someone who steals car radios (or deals in radios stolen by others) will know methods of easily and quickly resetting the code... I've seen (and user) legit garages that do it in seconds, and car radios still get stolen even tho most have codes nowadays, so it's pretty clear the thieves know how to break these codes in a pretty trivial manner.
And then you have my grandfather, who managed to get his radio locked out (3 failed attempts) because the code supplied with his car, was not the code currently set on the radio (clearly the previous owner had mislaid the code and had it reset, because the serial numbers on the radio matched the car according to the dealer) was not the code written down in the car's handbook (which was the original code according to the dealer)...
Anyway he took it to a main dealer, they looked up the code that was supposed to be on that car (seems most manufacturers keep a database of radio cars linked to chassis numbers) and that didnt work, so they reprogrammed the code, reprogramming it took all of 5 minutes but he still had to pay for the service.
A radio without a code would have saved him a considerable amount of time, hunting around for the code, calling the guy he bought the car from, taking time off work to go down to the car dealer...
It would have saved a thief 5 minutes of his time.
I find it highly amusing that the "server" versions of windows all ship with a complete copy of directx (including direct3d, and support for various gaming-related networking protocols and joysticks etc)... And you can't remove it... WHY?
Maybe they're admitting what a mickey mouse excuse for a server their OS is, and that i should be playing games on it instead.
The guest OS can use it's own drivers for USB devices (which most likely includes your webcam)
For PCMCIA you'd have no joy, since the host OS would need to support it, on the other hand you could use ndiswrapper to get linux to support it using the windows drivers. (out of interest, what type of wireless card is it? most chipsets are supported nowadays, just not always in the default kernels)
Your mic will work fine if it's connected to your soundcard in the standard way... If it's a USB device then it should work too, same as your webcam.
I always used host-only networking in vmware, and let linux handle the natting and port forwarding... I didn't even know vmware could do port forwarding!
Vmware's implementation of nat is quite easy to crash, if your doing a heavy portscan over a vmware nat interface it can sometimes go tits up... The same thing happens if a guest windows machine gets infected with some kind of ddos drone which begins an attack.
As to the linux client being neglected, the linux client is the original one, vmware was originally designed for linux and the windows version was always an afterthought... the linux version always seems to be a fair bit quicker too (especially with networking)
As someone said earlier, the "1 server per task" mentality is a result of flawed OS's and apps...
Similarly, the "physical reboot / physical console access" idea is a result of flawed hardware/firmware design (well, more a result of people using systems designed for desktop use as servers). and flawed gui-only os's (again, designed for desktop use)
Any proper server system will have at the very least a serial console, with the ability to reboot/manage/reinstall etc from it... I have a vax from the late 80s with such a feature, and i've never seen a sun sparc system without serial console support.
I totally agree...
I run a number of unix systems in the same way, i currently run 2 mailservers (1 for sending/receiving mail, 1 for spam filtering) spam filters, http/https, dns, database, ircserver, asterisk and jabber server on a single quad processor box with redundant power, raid5 disks, daily tape backup and ecc memory.
The OS does a good job of keeping everything apart from each other, and implements ulimits to prevent one service going nuts and consuming all the ram/cpu.
If i had to split all these services to seperate machines i'd be running on massively inferior hardware, with far less redundancy features... And i'd lose the burst ability - admittedly seperate boxes would be faster *IF* every service was heavily loaded, but it's usually the case that only one or two services see heavy load at any one time, during which time these services have access to a single far more powerfull system than if they ran on a smaller dedicated box.
He'l lose performance, running in 32bit mode you have to use nasty paging hacks to access 16GB of ram, and i believe theres a 2GB or 4GB limit per process (which might not matter).
Also you lose access to the extra registers available in 64bit mode...
Finally if he's using AMD cpus, then no 32bit version of windows supports NUMA properly (not sure if the 64bit versions do)
Was there any additional latency on a couple of the ping responses?
Your solution also works around a common problem - resource utilisation and general user fuckups, each user can only crash one of the smaller virtual boxes instead of the whole system.
In terms of security, A/D is actually a lot more of a headache than Novell's offering...
But your right, the biggest issue with citrix is the applications behind it, many windows programs are simply not designed with security or multiuser usage in mind, there are often ways to execute arbitrary code and very little protection against excessive resource utilisation, create a corrupt word document, load it up on a shared citrix server and watch the calls to support go through the roof.
Actually MacOSX is case sensitive too, but the default filesystem (HFS+) is not... Tiger introduced a case sensitive version of HFS+ which breaks poorly written apps like photoshop, but makes it easier to compile some unix apps.
The date is already stored as metadata on virtually any filesystem, and basic commands like "find" are capable of searching based on it.
Actually joliet was microsoft's attempt to create their own extension to ISO9660 (which only allows 8.3 filenames) instead of using the existing extension, rock ridge, which is not only more flexible but was already supported by virtually every other os out there (including your old sunos boxes)
Would the filesystem even allow that? or would it just create a directory and put the file in there...
On the other hand, creating files with backslashes on samba shares is quite amusing when windows users start browsing them.
Filenames aren't really the place for such information tho...
One neat feature of amigaos, was that every file could have a comment attached, a majority of networking apps used this feature to store the URL of any file in it's comment, so i could see exactly where things were downloaded from at a glance.
In which case you could still use a virtualization tool to virtualize the video-playback OS, and then grab the screenshots from that.
I demand the right to make backup copies of any media i purchase...
I have CD's which i like to listen to in the car, they often end up getting damaged by extremes of temperature in the car.
I have younger brothers/sisters, and i could have kids, who are highly likely to want to play games and watch movies... Can you really trust kids to take care of media? I have made countless copies of various CDs, Games and DVDs for my younger brother, who has managed to scratch or otherwise destroy hundreds of them through mishandling (he likes to carry CDs/DVDs around in his pocket, which also contains coins) and when he's finished using a piece of media, he likes to just leave it laying around, on the floor to be trodden on or picked up/chewed by the dog, in direct sunlight, on/near sources of heat like radiators, or he handles them with dirty hands...
I don't mind losing a pile of $0.05 cheapo blank CDs to kids, it just goes with the territory, but to lose a $50 game is another matter.
Hmm, you don't need root to install openoffice on mac, tho you do to install X11 if you don't already have it...
I`m sure you can still install neooffice without root tho.