We can't tell from Blackduck's data either since it isn't known what criteria are used by them.
We could pick other projects and see what the trend is in them, but ultimately all we would know is what the trend is in them. Google Code looks like a fairly easy place to gather some figures from and they host a lot of code these days.
Any such study is limited by the set of data it looks at. I presume the FSF chose Debian because it is (a) large (b) licenses are reasonably easily checkable (c) well documented historical versions, so they could quickly check if the there is a trend away from the GNU GPL in the kind of systems the FSF was created to create.
The changes in Blackduck's data are simply too large to reflect changes to say GNU/Linux distros, since software tends not to change license that often, so it seems likely they are just including more sources of free software from other places which simply have less GNU GPL software in them, in which case what you are seeing is their data becomes more representative of the totality of free software code rather than a trend away from the GNU GPL.
Thus it is possible both studies are correct and that GNU GPL usage is increasing in Debian (and probably other general purpose GNU/Linux desktops - not least a lot of them are based on Debian, and perhaps in general), and GNU GPL now forms a smaller part of the code base that Blackduck are keeping in their knowledge base.
Whilst I'm sure the FSF like people to use the GNU GPL, they are pro-free software, so if that the amount of free software Blackduck find is growing faster than the growth in GNU GPL software, it is unlikely to be keeping my friends in Boston up at night.
But what really matters is what software people use, not the proportion of software in repositories. I'm using Debian to write this, and I don't much care what free software license most of the software I use is, as long as Debian can inspect, package, fix and distribute it.
I care more when I write code, but mostly that the codebase I'm contributing to aims to remain free, a copyleft license is a guarantee of that, but it isn't the only such guarantee that makes me feel good. I'd happily contribute freely to the Apache project knowing me and my friends can expect to benefit from any such contribution in future even without a copyleft license.
Fair enough. I believe Powershell also now has programmable tab completion, so I dare say "Powertab" is catching up fast. I sometimes suspect a lot of this sort of development depends on someone mistyping something important, and spending the necessary hours making damn sure they never make that typo again.
You've never enabled the extra features in Bash auto-completion have you.
In Bash the tab auto-completion is programmable, with the typical configuration used on Debian it completes command names, file names (to nearest unambiguous match and then shows you the list of matching names), it will display the command line options to commands limited to those which match what you've typed so far, for various commands that take commons lists (like list of available software packages) it will auto-complete those arguments from those lists.
I believe Zsh does similar but also shows short extract from documentation on command line options in addition.
The problem is as a GNU/Linux user you can end up like me and just hit tab whenever the grey matter glitches and you forgot what you were going to type next.
Say you want to install a web server with PHP5....
$ apt-g[tab] completes "apt-get " $apt-get i[tab] completes the "install" option $apt-get install libapa[tab] saves typing the "che" (goodness you can get lazy) $apt-get install libapache2-m[tab] saves typing "od" for mod $apt-get install libapache2-mod-ph[tab] saves typing the "p5" $apt-get install libapache2-mod-php5
So I've saved typing 15 characters (if I can count), got everything spelt right first time, and this one command will (I think) get you a webserver and PHP5 installed and ready for development work, of course usually you want to specify which thread model you want for the Apache webserver and probably want some other dev tools but it makes the points that you only need 16 key presses to install a webserver with PHP (no browsing to websites, downloading installers, or finding your original installation CD image to drag IIS off, or patching to get it up to date after running the command (since it'll install the latest versions). Only the command name "apt-get" is a file name.
It has been this way for a long time in Debian (although PHP5 wasn't around all that time), and you have to uncomment a line in one of the config files to enable the enhanced completion otherwise I think it is just filenames (including commands).
I was kind of worried about the opposite. It suggests someone at Microsoft has been doing some serious work making Windows easier to administrate, which might make it more popular amongst the IT literate crowd, and thus more popular generally.
This remote admin will make automaton of admin easier, and also discourage what we (and many others) are guilty of, which is logging in with VNC or remote desktop, and messing about as Administrator because we only have a few boxes. Until we realize actually we have far too many to be doing it all this way.
"That said... a reasonable expectation may not translate into something actionable in a court of law."
IANAL - but UK law explicitly implemented rules to govern consumer agreements where you can't negotiate contract terms. (Unfair terms in consumer contracts regulations) which were based on an EU directive from 1993, which effectively boils down to a reasonableness test (although there are restrictions on fields of reasonableness).
Whilst I don't have a problem boycotting Sony, perhaps such contracts probably needs some sort of proper legal redress in the style of the European directive, as otherwise it would be pretty much impossible to buy/lease any modern software or hardware without agreeing to similarly outrages terms and conditions as were used in this class action.
Apple get called draconian because of the things they do.
Being a good citizen in free software doesn't just mean doing those things in your own self interest to do, of which we agree Apple do a lot, but also not doing things that might be perceived as in your own short term self interest that are unethical (of which Apple also do plenty).
I don't think registering a URL to an XML file does the trick.
The Linux distro's typically sign the packages, saying they were presented to the distro by someone they trust.
You need some sort of security in place, otherwise the system is effectively trusting all the web servers in all the URLs, and we know how safe web servers are.
But yes if Microsoft update updated everything, then people would have motivation for running it. Where as if it just updates a few system and Office - things that no one cares about till there PC is spamming - where is the motivation?
But it boils down to the same thing, trusting a single central authority, and since Windows users implicitly trust Microsoft, it might as well be them.
Let's face facts, there is tons of software that is not on Linux that people want. You see the thing is most of the GNU/Linux installs I've done are because the software I (or my clients) wanted to run didn't run on MS Windows at all, and much of it still doesn't (or runs poorly - we fork() fork() fork() fork() fork() fork() fork() it is what we like to do).
So what you are saying is we should write non-portable must-have applications for GNU/Linux desktop, and we'll win the desktop share battle. Unfortunately for the adoption of GNU/Linux being wholly dependent on software that only runs on one platform is just the kind of situation many of the users are trying to avoid.
It is a common trait to want to reduce everything down to a single number, or something easily compared, especially when most folks have only a very vague definition of the area being compared.
Everyone wants to validate their own prejudices (and some are paid to support other folks interests).
Security is a process, the goal of which is to protect something (usually your data - maybe your hardware - maybe availability or even user sanity!) and (usually at least) to minimize the resources it takes to do it. You can only meaningfully produce numbers when you are more specific than "security" or even "vulnerability".
So it might be possible to say discover the number of bugs that allow arbitrary remote code execution through web surfing (although in some cases the answer might be "may be" for some bugs), using the bog standard install of the OS, installing all the latest patches as soon as they are available, using the vendor preferred web browser. But even then this is only listing discovered vulnerability, so all you have is a number that is almost meaningless to real security, although it is comparable, if that you can use it to compared how safe browsing was. The IE/Firefox days vulnerable is a good example of such a metric, but again it depends on known vulnerabilities.
If someone produced a range of such tests, not just covering vulnerability counts, but covering other things (for example - some one mentioned that users don't always patch - thus the proportion of users who are patched up to date could make a useful metric about how usable the softwares update mechanism is, which I'd suggest is a key security metric).
One might be able to make a case for a rigorous methodology for using a selection of such tests, but that requires serious research and effort, and we already know the result will be; -- most Desktop OSes are less secure than most end users would like if they only understood what all the techie blurb meant --
As someone who used/sold Watchguards firewall products, since they were called Seattle Labs, the days you built your own GNU/Linux server to install it on, I was gutted when they went to Windows only for the admin and reporting software.
True you could still get it to log to a syslog host (and for several sites we did), but they just assumed end users would have a Windows server around (and reliably so, which was even less certain in those days) to log stuff to.
Okay the GUI on the firewall box itself was probably not the greatest security idea, but I was disappointed when they didn't have some sort of cross platform management interface, as they clearly had the skills to do it (had previously done much of it).
On the other hand I don't think anyone can criticize their support of kernel development work to get the features they wanted in the firewall, but these kind of retrograde steps really tie folks to Microsoft, and it didn't do anything for the security of the companies concerned either.
I think AJAX is the free software worlds revenge, most of the big Ajax projects seem to eventually give up on IE6, which means Firefox if they don't have XP.
This mentality of speed at the cost of correctness is prevalent...
I use to sell firewalls. People always wanted to know how fast it would work (most were good up to around 100Mbps, when most people had at most 2Mbps pipes at most), very few people asked detailed questions about what security policies it could enforce, or the correctness and security of the firewall device itself.
Everyone knew they needed something, very few had a clue about selecting a good product, speed they understood, network security in comparison is pretty tough. Other forms of correctness are I think also more difficult to comprehend.
How many people know the safety rating of their automobile? Okay probably the wrong people to ask.
The point of the GPL is it allows GPL code to be mixed in.
Once that happens the code can't be distributed under the BSD license anymore.
Hypocrisy doesn't enter into it, it is likely that dual licensed code will end up under the GPL only when used in the Linux kernel. This doesn't necessarily prevent authors contributing their changes back to BSD, but it may require them to remove any GPL only code that is in the mix.
Since the code clearly can't be used under the BSD license if GPL code is subsequently included, and the original licensing made clear the authors intended this use of the code.
Theo seems to be objecting to the authors choice of a dual license, he is welcome to his opinion, but it is down to the authors to select the license or licenses they are happy with.
There may be a technical legal issue concerning changing the attached license text, but if that isn't allowed, then the law is an ass in this situation, since the original BSD license text would be meaningless.
Efficiency isn't an issue here as far as I can see.
Whilst our transmitters have shrunk, nearly everyone carries one in their pocket now, so our total power output is huge compared to only 50 years ago.
The assumption is that advanced alien civilizations will similarly leak energy, perhaps a smaller percentage, but of a much bigger pot.
The number of assumptions to discover a human-like civilization is staggering.
Imagine a planet with ocean all over it, and advanced squid like creatures. Now imagine what they would have to overcome to produce space travel compared to us? Would they invent radio? If so would they do it earlier or later, given how well sound travels in fluids? One could imagine them developing advanced technologies, fishing technologies, but electronics is going to be a challenge I suspect. They could well end up expert in hydraulics, before discovering say electricity.
Our science, and technology, is very much "ape science", addressing the issues ape like creatures have, on a world like ours. Some aliens might be like us.
There is also an implicit assumption they would want to find us, want to reveal themselves to us, etc etc. Again, whilst a lot of earth bound creatures are curious, it isn't even a universal trait amongst our own planets species, on a planet where poking your head down a hole gets it bitten off most of the time, space travel might be seen as too risky, let alone making first contact with a militaristic species like ours.
On a technical point do mouse pointers ever lag these days?
Certainly most mouse pointing is done so close to the silicon I've seen boxes stiffed, and the user would have known it if only the arrow hadn't followed the mouse around. That isn't even with fancy graphics cards.
Funny about the multimedia stuff, as I was chatting to a load of multimedia people at LUGRadio live, and all of them pretty much run realtime kernels all the time. If it is good enough for profession audio and video work, it is more configuration than features that is lacking.
And yes, applications taking more than an instant (5 seconds is eternity in modern computing) is silly these days, but on the other hand people will accept 5 seconds for most application if they get the software cheaper, now, better featured. Bloat happens because it isn't the most important issue for most users.
I was sorting a problem on XP once on a bog standard DELL desktop.
Booted the Ubuntu LiveCD, opening up 20 or so video players, and watched it do a pretty good job of doing video in each of them. Windows XP couldn't do this, even when I reset the IDE driver to stop it using PIO mode (whose stupid idea to downgrade the bus performance due to errors on reading CDs and DVDs?).
If you see issues dragging Windows it is almost certainly that your graphics card is not properly supported under X and all (or at least too much) of the work is being done on the CPU, and then pushed through extra buses before it is displayed.
My desktop with a poorly featured ATI card which has sucky graphics performance, but I see few issues because of the stomping great CPUs you can get cheaply these days. But my VIA box, with a CPU so pathetic it doesn't need a fan (Yippee), does better interactive responsiveness, because all that graphical messing is done on a properly supported graphics card.
I suspect if, like MacOS, you stuck to a small range of very well supported graphics card, you'd be running around going "look at my Linux desktop windows wobble, fade, and spin", instead of moaning about it on/..
I'm not excusing GNOME or KDE bloat, but the fact is modern hardware can easily handle the bloat, I just think it a shame that you need all this modern hardware, when the main thing wrong with the old hardware was it doesn't run the bloat. Programmers seem to bloat in an OS agnostic fashion;)
What I do not like is Novell tilting the playing field, turning it more into a political competition and deep pockets competition than an honest features, performance and usability competition.
Not just Novell, seems SUN, IBM, Nokia, Canonical, Intel, Redhat, are all trying to tilt the field by giving money, or staff, or other resources to the GNOME project. Or possibly it is these companies actually like the GNOME project, and see it as adding value to their businesses.
I'd accept the commercial interest in GNOME seems somewhat one sided, given how good KDE is. I'm especially intrigued by some of the PIM stuff in KDE (not that I use it other than Kmail). I think that it is companies seeing which way others jumped, and feeling safer to go that way as well (Isn't that what got us a Microsoft monopoly?). So it would be good to see more commercial backers for KDE, but I don't think we can blame Novell for tilting anyones playing field.
Actually they are still implementing much of Carly's plan.
On the upside Hans wrote down his vision for file systems, and reiserFS4 is just about there.
The problem is Hans also managed to make a business out of writing file system handling code. Indeed I seem to remember when I discussed a file system semantics issue with him, he offered to do me a module that "does it right" for cold hard cash. I guess is isn't a huge market area, so you take chances where they come. But without him doing that part of the business it is likely to fall behind.
COW is available in Linux for all file systems that support the appropriate quiescing system call (i.e. as of April - ext3, ext4, gfs2, jfs, reiserfs, xfs).
So if you just want block level copy on write you get this via Linux LVM already, with the snapshot facility.
It looks to me that the difference here is the metadata storage, and interface. i.e. Some understanding of the filesystems structure is introduced into the process, which will improve performance, and reduce overheads, and no doubt provide other potential benefits to in the future.
Although on the other hand it is increased complexity and mixing of layers, file systems were hard enough without these complexities.
Since the example filename given is a valid filename, the interface may be a tad suspect as well. You pays your money (or not), and still choose ext3 or reiserFSv3 on Linux, if you still want your data tomorrow without excesses fsck times or memory usage.
How much of this is down to the industry practice?
They ask if he is in a professional body, but all he has is a doctorate in computing, and training in forensics, which puts him head and shoulders above others in the field in terms of qualifications.
He's an engineer, he did what they ask of him.
I'm surprised there wasn't a more structured procedure for the examination of the disk, I know if I was billing the RIAA for my time I'd be sure to send them long documented lists of things checked for, even if the check turned out negative, and bill them for each printout of relevant settings.
But I'm not sure what beyond that could reasonably be expected. I don't think the field has quite reached the level of forensic pathology, not least IT is a rapidly moving target, and thus not only the tools and techniques, but also the things being looked for move rapidly. Where as in forensic pathology there are a few more constants, and more established and formal procedures.
Urm, surely editing the config file automatically is kind of doing it the Apache way.
Once you accept it is required for a task, then it is easier to do it the "config file" way, since my distro of choice already includes a load of tools for automatically editing the Apache config files, and has nicely broken the config into a set of files that include each other as needed, allowing fine grained modification of the config without having to version control one huge config file. This allows the installers to automatically add modules to the config, or add and remove virtual hosts with one short command.
Alas our IIS is still 5, but at least the Metabase file seems to have stopped corrupting itself routinely. But with several hundreds of virtual servers IIS is slow to start, and it is only that the config of all these servers is identical that it is is reasonable to manage at all. And a load of scripts that automatically add virtual hosts and remove them.
Basically boils down to as you scale it in either size or complexity, you want scripting and/or automation, and scripting and GUI's don't generally mix well (although I'm sure they can).
If I get the choice, Apache on Debian is my choice. But of course rarely do they ask the system administrator what will be easiest to configure, most reliable to maintain, more often you hear "we bought X, make it work".
2. It is possible, but the costs of making software ultra-secure is so high that it's not worth it. Customers would rather pay a lower price for a slightly less secure system than a much larger price for a 100% secure system.
I think it is somewhat more complex.
It is relatively easy to avoid the kind of problem reported. Almost trivially so. But it isn't the way the software industry generally writes kernels or device drivers, so we'd have to start again. Kind of like deciding petrol was a mistake, and we should have used some oxide of Nitrogen to power the cars, it would take a lot of effort to get the new engines up to the level of the petrol one's we have now, even if theoretically something else would be a better choice long term.
But worth looking at how bad the security issues with mobile phones, Cisco routers, and some other devices are for comparison, and looking at what these devices do differently (or the same in some cases).
As regards the market, there seems to be virtually no market for secure general purpose desktop computers. Compare MacOSX and GNU/Linux security histories with Windows. Even if we accept that Windows is targeted more because it is popular, people aren't making significant moves to less targeted systems (not being shot at, is almost as good as being bullet proof), and it isn't because they are worried about obscure holes in the Linux WiFi driver. I'm sure if there was a real market in desktop operating systems, security is one of the things people might use as a criteria, after "does it run game X", "can I view all my favourite porn sites", and "will it run MS Office", and "how much does it cost".
Sounds plausible. Our Linux TCO is greater per server than our Windows servers, but it is because the Linux boxes do much more (HTTP, SMTP, FTP, firewall, traffic shapers), the Windows servers mostly run single use IIS boxes.
The total return on money spent is vastly better with Windows, but that is because of the revenue from the application run, and nothing to do with the functionality of the OS. We are replacing all that with stuff that runs on Linux, because it works so much better.
Conversely my Linux desktop requires a lot less attention than the Windows desktops, despite doing a lot more (doubles as a test server). Mostly because software installation is quicker and easier, there are no significant malware issues, and the OS is generally more robust and stable.
What is scary is the number of fundamental issues we keep hitting with Windows, and the "don't start from there" answers from the Microsoft knowledge base, and the arcane incantation to make it do basic stuff, and the difficulty fathoming what ought to be simple issues. If my Linux box did stuff like Windows XP, or as slowly as Windows XP, I'd have taken to kernel hacking to fix it a long time ago.
Slashdot Mirror
We can't tell from Blackduck's data either since it isn't known what criteria are used by them.
We could pick other projects and see what the trend is in them, but ultimately all we would know is what the trend is in them. Google Code looks like a fairly easy place to gather some figures from and they host a lot of code these days.
Any such study is limited by the set of data it looks at. I presume the FSF chose Debian because it is (a) large (b) licenses are reasonably easily checkable (c) well documented historical versions, so they could quickly check if the there is a trend away from the GNU GPL in the kind of systems the FSF was created to create.
The changes in Blackduck's data are simply too large to reflect changes to say GNU/Linux distros, since software tends not to change license that often, so it seems likely they are just including more sources of free software from other places which simply have less GNU GPL software in them, in which case what you are seeing is their data becomes more representative of the totality of free software code rather than a trend away from the GNU GPL.
Thus it is possible both studies are correct and that GNU GPL usage is increasing in Debian (and probably other general purpose GNU/Linux desktops - not least a lot of them are based on Debian, and perhaps in general), and GNU GPL now forms a smaller part of the code base that Blackduck are keeping in their knowledge base.
Whilst I'm sure the FSF like people to use the GNU GPL, they are pro-free software, so if that the amount of free software Blackduck find is growing faster than the growth in GNU GPL software, it is unlikely to be keeping my friends in Boston up at night.
But what really matters is what software people use, not the proportion of software in repositories. I'm using Debian to write this, and I don't much care what free software license most of the software I use is, as long as Debian can inspect, package, fix and distribute it.
I care more when I write code, but mostly that the codebase I'm contributing to aims to remain free, a copyleft license is a guarantee of that, but it isn't the only such guarantee that makes me feel good. I'd happily contribute freely to the Apache project knowing me and my friends can expect to benefit from any such contribution in future even without a copyleft license.
Fair enough. I believe Powershell also now has programmable tab completion, so I dare say "Powertab" is catching up fast. I sometimes suspect a lot of this sort of development depends on someone mistyping something important, and spending the necessary hours making damn sure they never make that typo again.
You've never enabled the extra features in Bash auto-completion have you.
In Bash the tab auto-completion is programmable, with the typical configuration used on Debian it completes command names, file names (to nearest unambiguous match and then shows you the list of matching names), it will display the command line options to commands limited to those which match what you've typed so far, for various commands that take commons lists (like list of available software packages) it will auto-complete those arguments from those lists.
I believe Zsh does similar but also shows short extract from documentation on command line options in addition.
The problem is as a GNU/Linux user you can end up like me and just hit tab whenever the grey matter glitches and you forgot what you were going to type next.
Say you want to install a web server with PHP5....
$ apt-g[tab] completes "apt-get "
$apt-get i[tab] completes the "install" option
$apt-get install libapa[tab] saves typing the "che" (goodness you can get lazy)
$apt-get install libapache2-m[tab] saves typing "od" for mod
$apt-get install libapache2-mod-ph[tab] saves typing the "p5"
$apt-get install libapache2-mod-php5
So I've saved typing 15 characters (if I can count), got everything spelt right first time, and this one command will (I think) get you a webserver and PHP5 installed and ready for development work, of course usually you want to specify which thread model you want for the Apache webserver and probably want some other dev tools but it makes the points that you only need 16 key presses to install a webserver with PHP (no browsing to websites, downloading installers, or finding your original installation CD image to drag IIS off, or patching to get it up to date after running the command (since it'll install the latest versions). Only the command name "apt-get" is a file name.
It has been this way for a long time in Debian (although PHP5 wasn't around all that time), and you have to uncomment a line in one of the config files to enable the enhanced completion otherwise I think it is just filenames (including commands).
I was kind of worried about the opposite. It suggests someone at Microsoft has been doing some serious work making Windows easier to administrate, which might make it more popular amongst the IT literate crowd, and thus more popular generally.
This remote admin will make automaton of admin easier, and also discourage what we (and many others) are guilty of, which is logging in with VNC or remote desktop, and messing about as Administrator because we only have a few boxes. Until we realize actually we have far too many to be doing it all this way.
"That said... a reasonable expectation may not translate into something actionable in a court of law."
IANAL - but UK law explicitly implemented rules to govern consumer agreements where you can't negotiate contract terms. (Unfair terms in consumer contracts regulations) which were based on an EU directive from 1993, which effectively boils down to a reasonableness test (although there are restrictions on fields of reasonableness).
Whilst I don't have a problem boycotting Sony, perhaps such contracts probably needs some sort of proper legal redress in the style of the European directive, as otherwise it would be pretty much impossible to buy/lease any modern software or hardware without agreeing to similarly outrages terms and conditions as were used in this class action.
Apple get called draconian because of the things they do.
Being a good citizen in free software doesn't just mean doing those things in your own self interest to do, of which we agree Apple do a lot, but also not doing things that might be perceived as in your own short term self interest that are unethical (of which Apple also do plenty).
I don't think registering a URL to an XML file does the trick.
The Linux distro's typically sign the packages, saying they were presented to the distro by someone they trust.
You need some sort of security in place, otherwise the system is effectively trusting all the web servers in all the URLs, and we know how safe web servers are.
But yes if Microsoft update updated everything, then people would have motivation for running it. Where as if it just updates a few system and Office - things that no one cares about till there PC is spamming - where is the motivation?
But it boils down to the same thing, trusting a single central authority, and since Windows users implicitly trust Microsoft, it might as well be them.
So what you are saying is we should write non-portable must-have applications for GNU/Linux desktop, and we'll win the desktop share battle. Unfortunately for the adoption of GNU/Linux being wholly dependent on software that only runs on one platform is just the kind of situation many of the users are trying to avoid.
It is a common trait to want to reduce everything down to a single number, or something easily compared, especially when most folks have only a very vague definition of the area being compared.
Everyone wants to validate their own prejudices (and some are paid to support other folks interests).
Security is a process, the goal of which is to protect something (usually your data - maybe your hardware - maybe availability or even user sanity!) and (usually at least) to minimize the resources it takes to do it. You can only meaningfully produce numbers when you are more specific than "security" or even "vulnerability".
So it might be possible to say discover the number of bugs that allow arbitrary remote code execution through web surfing (although in some cases the answer might be "may be" for some bugs), using the bog standard install of the OS, installing all the latest patches as soon as they are available, using the vendor preferred web browser. But even then this is only listing discovered vulnerability, so all you have is a number that is almost meaningless to real security, although it is comparable, if that you can use it to compared how safe browsing was. The IE/Firefox days vulnerable is a good example of such a metric, but again it depends on known vulnerabilities.
If someone produced a range of such tests, not just covering vulnerability counts, but covering other things (for example - some one mentioned that users don't always patch - thus the proportion of users who are patched up to date could make a useful metric about how usable the softwares update mechanism is, which I'd suggest is a key security metric).
One might be able to make a case for a rigorous methodology for using a selection of such tests, but that requires serious research and effort, and we already know the result will be; -- most Desktop OSes are less secure than most end users would like if they only understood what all the techie blurb meant --
As someone who used/sold Watchguards firewall products, since they were called Seattle Labs, the days you built your own GNU/Linux server to install it on, I was gutted when they went to Windows only for the admin and reporting software.
True you could still get it to log to a syslog host (and for several sites we did), but they just assumed end users would have a Windows server around (and reliably so, which was even less certain in those days) to log stuff to.
Okay the GUI on the firewall box itself was probably not the greatest security idea, but I was disappointed when they didn't have some sort of cross platform management interface, as they clearly had the skills to do it (had previously done much of it).
On the other hand I don't think anyone can criticize their support of kernel development work to get the features they wanted in the firewall, but these kind of retrograde steps really tie folks to Microsoft, and it didn't do anything for the security of the companies concerned either.
I think AJAX is the free software worlds revenge, most of the big Ajax projects seem to eventually give up on IE6, which means Firefox if they don't have XP.
I use to sell firewalls. People always wanted to know how fast it would work (most were good up to around 100Mbps, when most people had at most 2Mbps pipes at most), very few people asked detailed questions about what security policies it could enforce, or the correctness and security of the firewall device itself.
Everyone knew they needed something, very few had a clue about selecting a good product, speed they understood, network security in comparison is pretty tough. Other forms of correctness are I think also more difficult to comprehend.
How many people know the safety rating of their automobile? Okay probably the wrong people to ask.
Oh the irony, someone claims law is common sense, and clearly knows less than I do about how it works.
Why are you never a moderator when you need to be.
In other news a Professor of Law finds a bug in BSD, and castigates the developers for not understand C.
The point of the GPL is it allows GPL code to be mixed in.
Once that happens the code can't be distributed under the BSD license anymore.
Hypocrisy doesn't enter into it, it is likely that dual licensed code will end up under the GPL only when used in the Linux kernel. This doesn't necessarily prevent authors contributing their changes back to BSD, but it may require them to remove any GPL only code that is in the mix.
Since the code clearly can't be used under the BSD license if GPL code is subsequently included, and the original licensing made clear the authors intended this use of the code.
Theo seems to be objecting to the authors choice of a dual license, he is welcome to his opinion, but it is down to the authors to select the license or licenses they are happy with.
There may be a technical legal issue concerning changing the attached license text, but if that isn't allowed, then the law is an ass in this situation, since the original BSD license text would be meaningless.
Efficiency isn't an issue here as far as I can see.
Whilst our transmitters have shrunk, nearly everyone carries one in their pocket now, so our total power output is huge compared to only 50 years ago.
The assumption is that advanced alien civilizations will similarly leak energy, perhaps a smaller percentage, but of a much bigger pot.
The number of assumptions to discover a human-like civilization is staggering.
Imagine a planet with ocean all over it, and advanced squid like creatures. Now imagine what they would have to overcome to produce space travel compared to us? Would they invent radio? If so would they do it earlier or later, given how well sound travels in fluids? One could imagine them developing advanced technologies, fishing technologies, but electronics is going to be a challenge I suspect. They could well end up expert in hydraulics, before discovering say electricity.
Our science, and technology, is very much "ape science", addressing the issues ape like creatures have, on a world like ours. Some aliens might be like us.
There is also an implicit assumption they would want to find us, want to reveal themselves to us, etc etc. Again, whilst a lot of earth bound creatures are curious, it isn't even a universal trait amongst our own planets species, on a planet where poking your head down a hole gets it bitten off most of the time, space travel might be seen as too risky, let alone making first contact with a militaristic species like ours.
On a technical point do mouse pointers ever lag these days?
Certainly most mouse pointing is done so close to the silicon I've seen boxes stiffed, and the user would have known it if only the arrow hadn't followed the mouse around. That isn't even with fancy graphics cards.
Funny about the multimedia stuff, as I was chatting to a load of multimedia people at LUGRadio live, and all of them pretty much run realtime kernels all the time. If it is good enough for profession audio and video work, it is more configuration than features that is lacking.
And yes, applications taking more than an instant (5 seconds is eternity in modern computing) is silly these days, but on the other hand people will accept 5 seconds for most application if they get the software cheaper, now, better featured. Bloat happens because it isn't the most important issue for most users.
That is probably down to hardware support.
/..
;)
I was sorting a problem on XP once on a bog standard DELL desktop.
Booted the Ubuntu LiveCD, opening up 20 or so video players, and watched it do a pretty good job of doing video in each of them. Windows XP couldn't do this, even when I reset the IDE driver to stop it using PIO mode (whose stupid idea to downgrade the bus performance due to errors on reading CDs and DVDs?).
If you see issues dragging Windows it is almost certainly that your graphics card is not properly supported under X and all (or at least too much) of the work is being done on the CPU, and then pushed through extra buses before it is displayed.
My desktop with a poorly featured ATI card which has sucky graphics performance, but I see few issues because of the stomping great CPUs you can get cheaply these days. But my VIA box, with a CPU so pathetic it doesn't need a fan (Yippee), does better interactive responsiveness, because all that graphical messing is done on a properly supported graphics card.
I suspect if, like MacOS, you stuck to a small range of very well supported graphics card, you'd be running around going "look at my Linux desktop windows wobble, fade, and spin", instead of moaning about it on
I'm not excusing GNOME or KDE bloat, but the fact is modern hardware can easily handle the bloat, I just think it a shame that you need all this modern hardware, when the main thing wrong with the old hardware was it doesn't run the bloat. Programmers seem to bloat in an OS agnostic fashion
Not just Novell, seems SUN, IBM, Nokia, Canonical, Intel, Redhat, are all trying to tilt the field by giving money, or staff, or other resources to the GNOME project. Or possibly it is these companies actually like the GNOME project, and see it as adding value to their businesses.
I'd accept the commercial interest in GNOME seems somewhat one sided, given how good KDE is. I'm especially intrigued by some of the PIM stuff in KDE (not that I use it other than Kmail). I think that it is companies seeing which way others jumped, and feeling safer to go that way as well (Isn't that what got us a Microsoft monopoly?). So it would be good to see more commercial backers for KDE, but I don't think we can blame Novell for tilting anyones playing field.
On the upside Hans wrote down his vision for file systems, and reiserFS4 is just about there.
The problem is Hans also managed to make a business out of writing file system handling code. Indeed I seem to remember when I discussed a file system semantics issue with him, he offered to do me a module that "does it right" for cold hard cash. I guess is isn't a huge market area, so you take chances where they come. But without him doing that part of the business it is likely to fall behind.
Still I won't stop using reiserfs3 just yet.
How do you think the discussions carry on for so long, and get so tedious people click on the adverts in preference?
"Accidental feature" - LW
You missed the bit about where Reiser commented adversely about Sturgeons character immediately his wife disappeared.
I just hope, whatever outcome, Hans gets back to file systems.
Whatever happened to his "damaged" claim against Sturgeon BTW?
COW is available in Linux for all file systems that support the appropriate quiescing system call (i.e. as of April - ext3, ext4, gfs2, jfs, reiserfs, xfs).
So if you just want block level copy on write you get this via Linux LVM already, with the snapshot facility.
It looks to me that the difference here is the metadata storage, and interface. i.e. Some understanding of the filesystems structure is introduced into the process, which will improve performance, and reduce overheads, and no doubt provide other potential benefits to in the future.
Although on the other hand it is increased complexity and mixing of layers, file systems were hard enough without these complexities.
Since the example filename given is a valid filename, the interface may be a tad suspect as well. You pays your money (or not), and still choose ext3 or reiserFSv3 on Linux, if you still want your data tomorrow without excesses fsck times or memory usage.
How much of this is down to the industry practice?
They ask if he is in a professional body, but all he has is a doctorate in computing, and training in forensics, which puts him head and shoulders above others in the field in terms of qualifications.
He's an engineer, he did what they ask of him.
I'm surprised there wasn't a more structured procedure for the examination of the disk, I know if I was billing the RIAA for my time I'd be sure to send them long documented lists of things checked for, even if the check turned out negative, and bill them for each printout of relevant settings.
But I'm not sure what beyond that could reasonably be expected. I don't think the field has quite reached the level of forensic pathology, not least IT is a rapidly moving target, and thus not only the tools and techniques, but also the things being looked for move rapidly. Where as in forensic pathology there are a few more constants, and more established and formal procedures.
Urm, surely editing the config file automatically is kind of doing it the Apache way.
Once you accept it is required for a task, then it is easier to do it the "config file" way, since my distro of choice already includes a load of tools for automatically editing the Apache config files, and has nicely broken the config into a set of files that include each other as needed, allowing fine grained modification of the config without having to version control one huge config file. This allows the installers to automatically add modules to the config, or add and remove virtual hosts with one short command.
Alas our IIS is still 5, but at least the Metabase file seems to have stopped corrupting itself routinely. But with several hundreds of virtual servers IIS is slow to start, and it is only that the config of all these servers is identical that it is is reasonable to manage at all. And a load of scripts that automatically add virtual hosts and remove them.
Basically boils down to as you scale it in either size or complexity, you want scripting and/or automation, and scripting and GUI's don't generally mix well (although I'm sure they can).
If I get the choice, Apache on Debian is my choice. But of course rarely do they ask the system administrator what will be easiest to configure, most reliable to maintain, more often you hear "we bought X, make it work".
I think it is somewhat more complex.
It is relatively easy to avoid the kind of problem reported. Almost trivially so. But it isn't the way the software industry generally writes kernels or device drivers, so we'd have to start again. Kind of like deciding petrol was a mistake, and we should have used some oxide of Nitrogen to power the cars, it would take a lot of effort to get the new engines up to the level of the petrol one's we have now, even if theoretically something else would be a better choice long term.
But worth looking at how bad the security issues with mobile phones, Cisco routers, and some other devices are for comparison, and looking at what these devices do differently (or the same in some cases).
As regards the market, there seems to be virtually no market for secure general purpose desktop computers. Compare MacOSX and GNU/Linux security histories with Windows. Even if we accept that Windows is targeted more because it is popular, people aren't making significant moves to less targeted systems (not being shot at, is almost as good as being bullet proof), and it isn't because they are worried about obscure holes in the Linux WiFi driver. I'm sure if there was a real market in desktop operating systems, security is one of the things people might use as a criteria, after "does it run game X", "can I view all my favourite porn sites", and "will it run MS Office", and "how much does it cost".
Sounds plausible. Our Linux TCO is greater per server than our Windows servers, but it is because the Linux boxes do much more (HTTP, SMTP, FTP, firewall, traffic shapers), the Windows servers mostly run single use IIS boxes.
The total return on money spent is vastly better with Windows, but that is because of the revenue from the application run, and nothing to do with the functionality of the OS. We are replacing all that with stuff that runs on Linux, because it works so much better.
Conversely my Linux desktop requires a lot less attention than the Windows desktops, despite doing a lot more (doubles as a test server). Mostly because software installation is quicker and easier, there are no significant malware issues, and the OS is generally more robust and stable.
What is scary is the number of fundamental issues we keep hitting with Windows, and the "don't start from there" answers from the Microsoft knowledge base, and the arcane incantation to make it do basic stuff, and the difficulty fathoming what ought to be simple issues. If my Linux box did stuff like Windows XP, or as slowly as Windows XP, I'd have taken to kernel hacking to fix it a long time ago.