Slashdot Mirror


User: Allador

Allador's activity in the archive.

Stories
0
Comments
1,614
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,614

  1. Re:These Articles... on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1

    Has their patch cycle fixed an OS that supplies trojan horses and viruses with a security level higher than the fucking user who setup the damn box in the first place? Can you elaborate on this? What exactly have you seen wrt this?

    By default, the SYSTEM process has some user rights that arent (by default) granted to the admin user. But you can grant them to yourself if you want, you just normally dont need them. The 'run as service right' for example. The OS also ships by default with some NTFS ACLs set such that SYSTEM is the only account that has change perms, and Admins have only read. It's trivially changeable if you want to, however.

    An OS that allows hidden processes and invisible files to alter settings without actually reflecting those setting changes in the apps that are supposed to monitor said changes? You mean a rootkit? All operating systems suffer from this.

    It sounds to me like your experiences here are just based out of some fundamental lack of understanding about how windows works. There's nothing wrong with that under normal circumstances, but I hate to see rants like this that arent based on fact.

    The only numbers that matter is these: 150 thousand viruses and trojans for MS Windows and counting. None for Mac OS X. The attacks on OSX may not have gained enough visibility to make news yet, but that doesnt buy you much security. Just perceived security.

    For example, I would argue that most unix & linux servers are more secure by default than OSX. Yet those things get pwnd and turned into botnets all the damn time. Yet somehow those hardly even make news.

    There was a targeted (ie, not an automated attack) attack a few years back that ended up gaining control of a large number of unix research systems at Universities and research labs. When it was finally found, it turned out that the attackers had been in there for years in some cases. It was quite impressive.
  2. Re:Thats because M$ just has more 'features' on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1

    Take a look at the "shatter attack" privilege elevation exploit that just got fixed in Vista, it started with Win NT 4.0, and when was that out? The shatter attack was not a generally useful technique, it required a very specific set of things to be setup for it to work. You basically had to have a privileged window running on the same desktop session as the unpriv'd attack. Then that priv'd window had to be programmed to do some fairly silly things in response to window messages.

    The common attack vector in the early days was to attack the anti-virus status window. Most av vendors have long since moved away from this. Their status icons in the system tray run as the unpriv'd user and communicate via rpc or other with the actual av services.

    This is an attack that was actually useful back in the NT4 days. However, it hasnt been practically useful in a long time, as it relied on 3rd party software makers to make a series of bad choices AND having their software running as a priv'd user on the same session as the attacked user.

    All that being said, this WAS a serious design flaw for a long time. But it was fairly well mitigated in the past 5 years or so.

    This entire category of attacks is now non-viable with vista and windows 2008 server, due to the way the windowing system works. Lower priv'd processes cannot message higher priv'd processes.

    And now with have the wonderful Fire-Wire exploit, which they were aware of in 2004, reminded again in 2006, and the exploit finally published in 2007 because they refused to do anything! Do you mean the firewire attack as described here?

    You do realize that this is generally applicable to linux & macosx as well, right? It's one of the side-effects of the firewire spec including DMA for performance reasons.

    Here is a reasonable write-up on it.

    Here is a 2005 cansecwest preso on this topic. At the time, they actually did the demo attack against osx during the preso.
  3. Re:When will it stop? on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1

    When a problem exists on Windows, it can often cause serious damage, simply because of the inherently flawed design of the OS. Can you elaborate on this?

    I ask because I see comments like this all the time, but when I ask, no one can ever seem to really back it up. Or if they do, its by horribly inaccurate knowledge of how windows actually works.

    So what design issues are we talking about here that are inherently flawed?
  4. Re:yes, and if grandma had wheels..... on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 2, Insightful

    Are you kidding me?

    On the front page of /. right now is an article about how, for the second year in a row, the Mac is the only OS in the cansecwest contest to get owned.

    The person took complete control of the mac box by having the user click on a link in safari.

    The rules of this contest state that only non-published attacks can be used. This guy just happened to have this one sitting around to use.

  5. Re:Look at it my way on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1

    Dude, you really need to read the articles you post before you post them.

    The first one is a slashdot posting of an australian news article referencing a handful (ie, less than 20) people who posted to the MSDN blog of the vista pm. Did you go read these comments? They exhibited an amazingly low intelligence level, even compared to here. Most of them were incomprehensible rants. This was not news, it was ad-impression generation by a magazine website. In fact, you'll notice that whole set of articles were all based on that same set of blog comments. This was not exactly well supported, documented cases of real problems. They were a very small number of people anonymously posting on a blog comment page that they had some problems.

    The second one is inaccurate on almost every stage of it. SP1 was never pulled. A patch that preceded sp1 was temporarily pulled. You would have known that had you read the links you included.

    And wow, the third one. The third of your links is someone complaining that a RELEASE CANDIDATE of sp1 that they installed caused problems of their machines. So it wasnt even a final release. Of course, you would have seen that if you would have read your own links.

  6. Re:Look at it my way on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1
    I'm not sure if you realize this, but most of what you say here as your argument is just flat made up and has little relation to reality.

    If that is analysed, I'm sure that Apple prioritises it's bugs better, and fixes the more important bugs earlier and more efficiently than Microsoft. What do you base that on? I'm fairly sure you just made that up out of thin air.

    Moreover, the bugs at Microsoft would be more severe, and a lot of patches are released in a hurry without testing properly. Again, where do you get your information from?

    You did read the other post here today about OSX being the only operating system that has been owned yet at the contest going on at cansecwest, right? That it was completely owned with someone clicking on a link in safari?

    A perfect example is the recent release of the Vista SP1, which was withdrawn later on. Can you cite this? Because that never actually happened.

    It caused complete devastation, leaving many systems unrepairable, and led to heavy loss of data, for a lot of people I know. Based on nearly every other sentence in your post being completely factually inaccurate, I very seriously doubt if this is true, even in your limited sphere of acquaintances. Especially considering that to get sp1 right now, people have to go manually seeking it out, which usually means techy types or fast adopter types.

    With Apple, such mistakes are very, very few. Yes, because major operating system upgrades from apple have never happened. And definitely never included total failure of the machine to boot, or loss of data.

    The bugs are mostly small, with less than 2% of them being fatal. That is an incredibly specific statement. Care to support it with a reference, or a link, or other citing?

  7. Re:Well, duh... on Microsoft or Apple - Who Is the Faster Patcher? · · Score: 1

    Without actually RTFA (I can't be bothered with that) You of course realize that as soon as you say that, everyone just immediately moves on to the next article and ignores anything you might have to say, right?

  8. Re:you are thinking in the box on Meet the Laptop of 2015 · · Score: 1

    You're absolutely right.

    But you'll notice that none of the concept laptops in TFA talked about any of that.

    They pretty much all had touch-screen keyboards, except for that goo-ball no-screen one.

    My specific complaint which this whole thread has been about, is that touch-screen keyboards are not a pragmatic alternative to mechanical keyboards, despite how they are ALWAYS shown as the future of human interaction. Touch-screen keyboards are to us now what the flying cars were for folks earlier in the century. Every 'futurist' thought they would be ubiquitous. But once you spend 5 minutes thinking about the practical challenges and limitations of such a thing, you realize how silly an idea it is. Touch-screen keyboards fall into this same category.

    This says nothing about alternative techniques, however.

    Personally, I've always wanted to try one of the two-handed items that are like small dumbbells and only have one button per finger, and you type in chords which correspond to letters. Never made the time to get up to speed on one though.

  9. Re:That's nothing new on Meet the Laptop of 2015 · · Score: 1

    So that works great for the home row. But what about when you make a mistake, or are slightly off? The only way you'll be able to detect it is by watching the screen, then stopping, and looking at the keyboard.

    Then you have the cursor keys and the home/end/insert/delete/pgup/pgdwn keys. Both of those sets I do completely by touch.

    On keyboards where they're rearranged or not in a touch friendly location, my typing slows way down, especially when in an IDE.

  10. Re:In the future nobody touches anything on Meet the Laptop of 2015 · · Score: 1

    I'm confused, are we talking about the voiceless neckband type of technology that went by a few days ago? Or just general purpose telepathy?

    How would the keyboard know what you meant to hit when you put your finger randomly 'there'.

    Even if it assumed that where you put your fingers first is the 'home row', what about when you type imperfectly? There are plenty of times when touch typing that one finger will be a little off, and hit the wrong key, or two keys at once. When that happens, I can detect the mistake and correct it, without ever having to look at the keyboard.

    In that situation, how would the screen know what I meant to do? Should it assume the right key, or the 'actually hit' key. What about when you hit the presence of two at the same time?

  11. Re:You completely miss the point on Windows 7 Likely Going Modular, Subscription-based · · Score: 1
    The examples you include are servicing plans, not tiered pricing. But I'll skip that ...

    SQL Server workgroup edition is cripple-ware. SQL server editions all have a common code base, and it it would've cost MSFT exactly zero to allow 64-bit functionality and use of all installed RAM on the Express and Workgroup editions. Conversely, customers pay significantly more to go from Workgroup to Standard editions, and almost ALL of that extra cost is pure increase in margin. Go look at the feature comparison here.

    There are a ton of features present in Standard that arent included in Workgroup. Even even more so between enterprise and standard.

    Your perspective seems to be that because the advance features exist, they shouldnt be stripped out of low versions, since there's no marginal cost to include them. But this is an inaccurate way of looking at it.

    MS made a choice to invest more in those extra features. They didnt have to do so. They could have just made workgroup version and thats it, and offered it at a lower price. But they made the investment to create other features, dont they have a right to make money off of that investment?

    Would it have been better to not offer the workgroup version at all? Or should all businesses be forced by law to only offer all features they own in all products, or none?

    And the same for Express. Dont they have a right to make money off their products? It may be a teaser to put that version out there, but its also a big boon to the community. There are a HUGE number of situations, people, and products who use SQL Express and will never need anything more. Plus then you get the benefit of MS keeping your system updated and patched.

    And even if there wasnt real value going between the versions ... it is absolutely the right of a company to do tiered pricing. It's an accepted practice in business. In fact, its often 'a good thing' for society. As it allows a product to get in the hands of people who wouldnt otherwise be able to afford it, but lets a company charge full price for something to those who can afford it. Even if its all exactly the same version of the product, there's nothing inherently wrong with that.

    And specifically, before the 2005 versions, there was no product placement in the 'sql server 2005 workgroup' level. So if you were a consumer, and you wanted the product, but couldnt pay for standard, you were screwed.

    Then in 2005 versions they offered workgroup. Now there is more choice. And for people who want it, but cant afford standard, they have a product they can use. This is an improvement over not having a product in that category at all.

    And heck, database servers are a highly competitive market. There are literally dozens of them, from free to insanely expensive. MS falls about in the middle. If you dont like the versions they offer, vote with your dollars, and use something else. And if you like simpler pricing, look at EnterpriseDB, its a commercial port of Postgres, and is quite nice from what I've seen.

  12. Re:Still no keyboard-less tablets on Meet the Laptop of 2015 · · Score: 1

    There are plenty of these out there.

    HP just released a nice 11 or 12 inch with a really slick base a lithium polymer battery.

    They get alot of use in medicine.

  13. Re:In the future nobody touches anything on Meet the Laptop of 2015 · · Score: 1

    When you sit down you easily see the position of the keyboard Thats exactly it. With a physical keyboard that you can feel the keys on, and have home-row bumps, then you dont ever need to look at the keyboard at all.
  14. Re:In the future nobody touches anything on Meet the Laptop of 2015 · · Score: 1

    Try it some time. Use one of those laser-projector keyboards that will shine a keyboard on anything.

    After the first 60 seconds when the novelty wears off, you realize its just absolutely terrible for anything but emergency use.

    Not to mention: How would a glass LCD screen provide bumps?

    Also, with a physical keyboard, I can tell when I mistype by the feel .... I never have to look at the keyboard, so I can make mistakes, correct them, and keep going without ever having to look at the keyboard. With no tacile feedback, this wouldnt work.

  15. Re:That's nothing new on Meet the Laptop of 2015 · · Score: 4, Insightful

    Using a touch-screen as a keyboard is a terrible idea, and only good for very casual users.

    For the typical road-warrior that totes a laptop around, you need a keyboard that you can type on without having to look at it.

    Touch screens work adequately for systems like the iPhone where you need to be looking at the display anyway, but are useless on a laptop where you need to be able to type quickly and move on and off the keyboard without having to look at it all the time.

  16. Re:Promises, promises ... nothing. Microsoft is ov on Windows 7 Likely Going Modular, Subscription-based · · Score: 1

    Vista sales have been quite good, and MS doesnt have any problems with 'imploding cash reserves'.

    If you really think they're running out of cash, go read the last couple year's SEC filings to catch you up to speed.

  17. Re:Well... on Windows 7 Likely Going Modular, Subscription-based · · Score: 1

    Businesses will though.

    It actually makes sense from a business perspective, if the pricing stays the same as they're paying now.

    Then its more predictable costing, therefore easier to budget. And it alleviates the upgrade/downgrade problem. They own the current version, but can install whatever version they want.

    Assuming the prices are roughly the same, there's a lot of bennies for the business.

    I dont think it would ever work for home users though, that'll probably stay the same as now, bundled with the hardware.

  18. Re:You completely miss the point on Windows 7 Likely Going Modular, Subscription-based · · Score: 1

    These are artificial limitations that are ADDED to these versions to cripple functionality; there are no cost savings whatsoever (development, code, packaging, etc) to MSFT by placing these limitations on the lower-cost editions. They are cripple-ware solely to enhance revenue streams of higher-margin editions. THAT is the point he is making.

    Modularity in and of itself is hardly a new innovation (MSFT is a very late arrival at that party). Given MSFT's established practice of selling cripple-ware I think you're confusing running a business with technology.

    Calling tiered pricing 'cripple-ware' is really being quite silly. Is Oracle cripple-ware because there are different versions with different abilities? Is an IBM mainframe cripple-ware because you didnt pay for all the processors, even if they're in the box sitting in your data center? Is RedHat management service crippleware just because you have to pay to use it for more than one machine?

    This is normal business tactics, and not even shady or strange.
  19. Re:Recognize the error and wait for Win7 on The Death of Windows XP · · Score: 1

    I definitely dont find that to be a valid analogy, others might.

    Vista includes more features, more handholding, at the cost of more complexity and bloat.

    As I understand it, you can install nearly the entire vista desktop stuff on server 2008 if you want.

    The difference most people are probably finding is that if they're running server 2008 they're probably running it on high quality server class hardware, with (the important part) quality drivers.

    So many of the drivers for vista are very very bad. Particularly on the 32-bit side.

  20. Re:for those of us old enough to remmeber... on The Death of Windows XP · · Score: 1

    These might be major changes to how the OS runs and is programmed, but if there are invisible to the user, then what is the point? UAC isnt invisible to the user, and neither are the improved stability.

    If your drivers are up to snuff, hibernate and suspend is noticeably better as well. Ever since moving to this new laptop with Vista Business x64 (as my company's guinea pig for Vista), I've been consistently hitting the next month's patch day without reboots (2-10 suspends and change locations per day every day). The most stable XP box I had would usually only last a couple weeks before it would start getting flaky under that behavior.

    The stability of the shell (ie, the graphical desktop) under spotty network and hard drive activity situations is vastly, vastly improved as well. The shell never locks up under load or a bad network connection any more.

    You're right in that there's no big flashy new features, but then again, XP worked really well for alot of people, feature-wise. So evolutionary improvements are what you would reasonably expect.

    The improvements made to Vista are the sort of solid, under-the-hood engineering improvements that this crowd should be applauding. A new process scheduler in the linux kernel makes the front page with much applause, but this set of improvements, which is much much bigger (and also includes an improved process and io scheduler) gets beaten down?

    And I don't feel that "get less viruses" should be a major selling point of an OS, it is a disgrace that this was needed. Well you may not like it, but that is one of the top complaints of XP, how much it degrades over time. This is due to malware and shoddy third party software.

    Both of these stem from XP being hard for non-techy users to run as non-admin.

    Vista makes it simple for a non-techy user to run as non-admin, which will dramatically help these problems.

    I dont see it as much of a disgrace to help solve some of the most complained about problems in a product. That sounds very reasonable to me.

    And disgrace or not, that WAS what was most needed. Are you saying they should have just told their customers to go screw themselves, because it would have been too disgraceful to solve one of the primary complaints of their products?

  21. Re:Vista, sucks.... on The Death of Windows XP · · Score: 1

    By that time you are nearing the price of getting a MAC right? Yeah, pretty close. But if running windows is what you want to do, or what you need to do, its easy enough to get quality equipment.

    When I thought about all the hassle's Spam, viruses, training that I had to do for my PC sales. To avoid viruses/malware, we just have the machines auto-patch, and have our clients run as non-admin for their day-to-day accounts and dont use IE. At that point, anti-virus is a pretty marginal help, but its cheap enough in most situations.

    I'm not sure how a Mac makes you get less spam, though.
  22. Re:Nature of an OS on The Death of Windows XP · · Score: 1

    The days of an OS revolutionizing or vastly enhancing the way someone, especially a consumer, computes are long behind us. The OS has suffered from feature bloat for forever, and for the most part, a successful new OS is one that just doesn't hinder the work to be done. Oh please. We're probably a decade or more away from having the OS being mature and boring and plateaued, feature-wise.

    As long as you still need an IT shop, and dedicated system admins to keep your systems running, patched, configured correctly, and apps installed, that means the OS isnt done.

    There isnt an OS in existence that 'just works' and works correctly without any expert interaction. OSX comes the closest, but they still need their brain-bar or whatever they call the Mac service centers.
  23. Re:Vista, sucks.... on The Death of Windows XP · · Score: 1

    You get server quality hardware on the inside. And, since no server level hardware manufacture is going to be caught dead with crappy drivers. You'll get better driver support to. With the end result getting you a high stability, smoother running machine. You can do this with windows too, just buy quality business class machines. This means never going to Best Buy for your computer purchases. It means buying from HP, Lenovo, Dell, and buy their 'corporate' class equipment. The drivers are usuallyl very high quality and stable over a couple years in those lines.
  24. Re:for those of us old enough to remmeber... on The Death of Windows XP · · Score: 1

    Vista does not have significant improvements over XP. Go read the wikipedia page on Vista. There are massive, significant, under the hood improvements to Vista compared to XP.

    It was a pretty massive overhaul of the kernel.

    Hell, just moving most drivers to userspace, and UAC are huge.

    Responding to a UAC prompt is massively more simple and intuitive to use than constantly having to use runas. Especially for non-techy types. I didnt mind running as non-admin and using runas on xp and 2000, but it wasnt practical for most folks. With UAC, running as non-admin (ie, using your computer correctly) is now easy for even a newb.

  25. Re:Recognize the error and wait for Win7 on The Death of Windows XP · · Score: 1

    Since there have been a number of reports of people using Windows Server 2008 as a workstation and getting better performance than Vista, it's clear that Vista's days are numbered. You do realize that with SP1, Vista and Server 2008 are the same OS, right?

    The differences are tuning and user-space and consumer targeted stuff tacked on the top of the core for Vista.