Thanks for the answer. That's the only vulnerability I could think of; just wanted to make sure that there wasn't a technical issue that I was overlooking or didn't know about.
A couple points of note. First, we're talking civil cases, so everything I say will be in that venue.
Second, parents are often responsible for their children's actions; if you're the kid of the RIAA gun owner, then yes, the family of the person you killed could sue your parents. This is not an absolute; parents are not always held liable for their kids' actions, but they often are.
Third, even with no relation, it's quite possible and reasonable that if the person you took the gun from didn't secure it properly (for instance, say you found it outside on their lawn), they could be held partially liable.
The RIAA is mostly full of crap on this issue, but your analogy is at least equally flawed.
Alas, the transparent proxy has thwarted many attempts at pure stupidity (using my WAP to do your banking is asking for it), thus https is blocked by default
Is it? At least if you pay attention to the source of a certificate and use SSL 2.0, SSL isn't vulnerable to man-in-the-middle or snooping attacks, is it? I don't see what the issue is, unless it's that few actually check the ssl certificate to see if it's signed by someone trusted...
Thanks for the support. I'm the author of the original post... (occasionally I'll post something I think will be moderated troll or flamebait or something as AC, but each time I think afterwards that I shouldn't bother... I can burn karma and should probably take responsibility for what I say anyway.)
But there's almost third such summary from today, though I guess going back and looking this one is closer to the beginning of the summary than the end. But it still takes the obligatory/. anti-MS swipe in an article that has almost nothing to do with MS or Vista, and also mentions shortcomings of Linux/Unix security. Why not say "Could children with a $100 laptop end up with a better security infrastructure than executives using $5000 laptops powered by Vista?"?
Oh, and admittedly rather less egregious, there is even a forth article ending with something similar to the question formula.
I agree with the sentiment most of the time, but it really gets old after a while. And they're usually pretty dumb "can you predict the future" questions too. Do you think this thread will make a difference?
Jobs is an arrogant control-freak, and he often exaggerates when talking about the coolness of Apple products or their potential - but he doesn't strike me as a liar. In fact, he is quite earnest in his own way. Do you have any evidence of him lying?
No, but I read and watch almost nothing he says either. I bet I could find something if I tried.
I don't see what refusing to license Fairplay has to do with wanting to be DRM-free.
You said in your previous post "When [Gates] says he opposes DRM, he probably means he opposes DRM that Microsoft doesn't control." Again, how's that different from Jobs wanting to control FairPlay?
Licensing Fairplay would make the DRM even worse.
How? By not locking iTunes customers into iPods?
So, Jobs has to include DRM, as the deals with the RIAA and labels demanded it.
And the MPAA would have demanded some degree of DRM for next-gen DVDs to play on Windows.
It's strange that you say he "fought tooth and nail" to keep other people from licensing iTunes. Who was he fighting?
Hmm, Norway (which ruled FairPlay illegal in that country), France (including saying that a law that would require them to license FairPlay was "state-sponsored piracy"), The Netherlands, Germany, and increasingly others. (The first two are the best examples.)
From what I can see, Apple simply said "No, we aren't going to license iTunes. End of story." No fighting involved. After all, it's Apple's property, they have no obligation to license it to anybody. So, why would there be a tooth and nail fight?
Interesting that you don't have a problem with Apple trying to retain control of their DRM but you seem to have a problem with the words you put into Gates's mouth about not liking DRM MS doesn't control.
That may be, but I would expect the same for Linux. I could be wrong.
I would be a little surprised if there were that big a difference too (the more I've learned about Windows architecture the more they look the same), but remember that there is a big difference between how Linux and Windows treat system calls. On Unix, I don't think it's terribly uncommon to make system calls directly even though the C library is available. If you call open() or read() from a C program on Unix, that's pretty much just a marshaling function. However, if you make a call to functions in the Windows API, they aren't going directly to the kernel; they go through the Windows subsystem first, and it's not uncommon that this does non-trivial work. The actual system calls in ntdll are largely undocumented, and it's very rare to call to them. Because of this, I could see the behavior that hides the fact that read() may not return enough being in the Windows subsystem in Windows and the kernel in Linux.
One thing your comment made me remember is there are some Windows calls where you get back an array of items, you have to call the function once with a null pointer and some other param changes, and you get back the count of items, then you allocate the memory for the items, then you call again. I would not expect that to make *that* much difference, but it is there.
Blah. Yeah, that sort of sucks. Though again, there's a (small) chance this is not reflect in the system call interface.
Oops, sorry, I did indeed draw the wrong conclusion from the Slashdot headline, which seemed to imply a universal requirement.
Don't ever draw conclusions from/. headlines. More often than not they are at least sensationalist, and often flat out wrong. Heck, it's not uncommon for the summaries to be wrong...
However, even with the restricted correct version, it's not all peachy either. Indeed, contrarily to popular belief, sex offender lists are not only composed of dangerous rapists.
Agreed, though in some sense that's a separate issue. Because of this, I am against these registry things and the punitive aspects of them. However, if this issue could be fixed, this law would be a good idea I think, despite the almost unenforcability of it.
The point is not perfectly on the mark, but it is not wholey off the mark either.
That's right. It's close enough to the mark that it looks like it's making a good point while masking the point that drawing any conclusions besides "this might be why Windows is less secure" is complete BS.
As to apache and iis as the choices, they have bearing in that apache will likely be the choice on linux, and iis will likely be the choice on windows.
Ahhhh, now might be a reasonable conclusion.
However, that's not what the article says. The article says "these graphs are why Windows is less secure", not "these graphs are why IIS/Windows is less secure than Apache/Linux" or even "this is why web servers on Windows are less secure than web servers on Linux."
And if iis has that much to do with the chart, then why is the graph *that* much more involved? Is it doing it's task inefficiently? Are the hooks for ASP or other things that numerous?
I don't know. It's not ASP, because they're serving the same page from both. At the same time, I can't imagine what all the additional system calls that Windows would need are either. Some investigation seems to indicate that the APIs are about the same, so why would you need more calls on one than the other?
The only other thing I can think of besides "IIS sucks" is that the Windows subsystem is making multiple syscalls for each library call. For instance, on a read or write the library hides the fact that sometimes not all the data is transfered by making multiple syscalls, while on Linux the kernel hides that fact. But this doesn't necessarily indicate a problem with Windows at all -- quite the contrary, it means that in that respect the Windows kernel is actually simpler because that logic moves to user space.
They have been active in promoting the use of DRM and even saying it will be to the benefit of consumers.
Bill Gates has gone on the record opposing DRM, at least as it's present form.
There is no way that they were forced by the industry to implement that much DRM at the heart of their latest product.
I've posted this before. I don't think that MS is being forced into implementing DRM.
However, I don't think that if they were interested in good business decisions, they'd have much choice. Take the quality degradation on movie quality. If the studios want this, I don't think MS is in a position to refuse. If they do, I think the studios would just refuse to allow anyone to legally watch their next-gen DVDs on Windows. I think their market for people who watch on their computer vs. people who watch on a home theater is small enough that they would prefer to have the control. At the same time, who's the consumer going to blame? Probably the computer vendor. Most people aren't rational enough to listen to "it's the studios being unreasonable, not us". So if MS refuses, they take the brunt of the complaints. And to that the fact that MS is *already* hurting from recent pressures of Apple and, to a rather lesser extent, Linux, and I don't think they'd be thrilled about this. Add to *that* the business opportunity if Apple then says "hey, we'll implement your DRM" and then says "hey, look, you can watch your next-gen DVDs on Apples but not Windows systems" and actually gives people a compelling reason to switch. Appeasement to the MPAA looks really good to MS about now.
So I don't think MS is trying to be good here. But I don't think they could be good either.
Name one remote security exploit in any DOS implementation? Regardless of whether it's a fair comparison or not, DOS is more secure than Linux by just about any reasonably sane metric you can come up with it.
Not all of security is remote. Let's see you take out an entire filesystem as non-root under Linux.
Your point mostly stands, but being more susceptible to trojans IS a perfectly sane metric that DOS fails.
It is a map of OS calls required to accomplish a task.
And the task is being deliberately misrepresented to indicate that it's a good test of Linux vs. Windows as opposed to Apache/Linux and IIS/Windows. In fact, if I had to make a guess, I'd say that the choice of Apache and IIS would have more to do with the difference.
Because, you say that everyone would lose their online freedom. This isn't true with the present proposal unless everyone is a registered sex offender. I have hard time believing that this is the case, so combined with the comment about this is to get people to switch off their brains, I concluded that you're saying that you expect it to become generally required.
If this isn't what you meant, then I'm sorry I misinterpreted; but in that case you'll have to explain why a sex offender having to register his screen name makes ME lose MY online freedom.
Nope, under this proposal, everybody would forfeit their online freedom. The spectre of rapists is only dangled in front of the voting populace to conveniently switch off their brains. Fortunately, sometimes sanity prevails in the end.
Total Annihilation was a great game too, though I did tend to prefer StarCraft, probably out of familiarity.
StarCraft: high terrain serves only to create choke points and barriers to units. It is completely ignored for anything but restricting movement.
This isn't true. Units on low terrain next to high terrain had (I know) restricted sightlines and units on high terrain next to low terrain (I think) had extended sightlines as compared to the unit on flat terrain. I think it also affected the probability of hitting another unit when firing too (or maybe did less damage), but I'm less sure on that.
StarCraft: Units either move or they fight. Not both.
Personally, I think so. A friend of mine sent me that link, and we were like 'we should make a higher quality version' so I could post it on my door and stuff, so we did. Also made a few changes and additions to the boxes, including moving Java up to next to C#. (And added an arrow back from C++ to C, added Smalltalk, ML, and a couple others.) This is the revised version.
Patentability here is dubious at best; it uses completely well-known phenomena (presumably just temperature changes due to pressure change and/or conversion of mechanical energy).
EVERYTHING (well, almost everything) uses completely well-known phenomena to work. That doesn't mean it's not an invention.
Considering the sheer number of possible physical explanations that have popped up here on Slashdot in a short period of time, whatever this is should fail the "obvious to one skilled in the art" test.
Obvious is measured in terms of creating it, not in understanding how it works. If it uses one of the mentioned principles, they've been understood for decades or centuries. The mere fact that it hasn't been invented before this (giving the guy the benefit of the doubt for now) in the face of this is testament to it's non-obviousness.
Graphics can be disabled too. Are they only useful for toys?
Heck, I can telnet into a host and issue the HTTP request myself. HTML rendering can be disabled too. Is HTML only useful for toys?
If there's an application that needs Javascript, then the user will turn on Javascript or go somewhere else. If you don't care about the latter response, or if there's no alternative, then Javascript is a fine solution. The problem with "Javascript can be turned off" is if you don't take this into account for problems like security and validation. If not having it enabled can affect OTHER people, your program's designed wrong; if it only affects the person who doesn't have it enabled, that's fine.
This would actually fix about 90% of the trouble we have with drive letters although I suspect it does not work on w2k which we are still using...
I can't vouch 100%, but from what I read I think it should support it. (W2K was the first version to come with the proper NTFS support for this.)
You do have to be mounting onto a version 3 NTFS partition, though I don't think the mount*ed* volume needs to be.
Does the mounted-to directory have to exist, like in Unix, or does it have to *not* be there. Personally having it not be there makes more sense, I never liked how Unix mount works and all I can think is that it is that way for a technical reason and nobody wants to admit that.
It has to exist and be an empty directory. I don't quite understand it either; I think the other way *would* make more sense. The best thing I can come up with is that it's needed to give the root directory of the mounted file system (and maybe the whole thing if it's FAT) permissions...
Slashdot Mirror
Thanks for the answer. That's the only vulnerability I could think of; just wanted to make sure that there wasn't a technical issue that I was overlooking or didn't know about.
A couple points of note. First, we're talking civil cases, so everything I say will be in that venue.
Second, parents are often responsible for their children's actions; if you're the kid of the RIAA gun owner, then yes, the family of the person you killed could sue your parents. This is not an absolute; parents are not always held liable for their kids' actions, but they often are.
Third, even with no relation, it's quite possible and reasonable that if the person you took the gun from didn't secure it properly (for instance, say you found it outside on their lawn), they could be held partially liable.
The RIAA is mostly full of crap on this issue, but your analogy is at least equally flawed.
Alas, the transparent proxy has thwarted many attempts at pure stupidity (using my WAP to do your banking is asking for it), thus https is blocked by default
Is it? At least if you pay attention to the source of a certificate and use SSL 2.0, SSL isn't vulnerable to man-in-the-middle or snooping attacks, is it? I don't see what the issue is, unless it's that few actually check the ssl certificate to see if it's signed by someone trusted...
I know. Isn't not having strict liability crimes inconvenient?
Thanks for the support. I'm the author of the original post... (occasionally I'll post something I think will be moderated troll or flamebait or something as AC, but each time I think afterwards that I shouldn't bother... I can burn karma and should probably take responsibility for what I say anyway.)
/. anti-MS swipe in an article that has almost nothing to do with MS or Vista, and also mentions shortcomings of Linux/Unix security. Why not say "Could children with a $100 laptop end up with a better security infrastructure than executives using $5000 laptops powered by Vista?"?
But there's almost third such summary from today, though I guess going back and looking this one is closer to the beginning of the summary than the end. But it still takes the obligatory
Oh, and admittedly rather less egregious, there is even a forth article ending with something similar to the question formula.
I agree with the sentiment most of the time, but it really gets old after a while. And they're usually pretty dumb "can you predict the future" questions too. Do you think this thread will make a difference?
Should we be suspicious of every large business that started out small?
Yes. (Then again, I tend to be very cynical about companies in general.)
At what point does a small, presumably non-corporate business become "big" and full of the "temptations of corporate culture"?
Hard to say, but if you can influence back door sessions of state legislatures I think that's a good indication you've crossed the boundary.
Jobs is an arrogant control-freak, and he often exaggerates when talking about the coolness of Apple products or their potential - but he doesn't strike me as a liar. In fact, he is quite earnest in his own way. Do you have any evidence of him lying?
No, but I read and watch almost nothing he says either. I bet I could find something if I tried.
I don't see what refusing to license Fairplay has to do with wanting to be DRM-free.
You said in your previous post "When [Gates] says he opposes DRM, he probably means he opposes DRM that Microsoft doesn't control." Again, how's that different from Jobs wanting to control FairPlay?
Licensing Fairplay would make the DRM even worse.
How? By not locking iTunes customers into iPods?
So, Jobs has to include DRM, as the deals with the RIAA and labels demanded it.
And the MPAA would have demanded some degree of DRM for next-gen DVDs to play on Windows.
It's strange that you say he "fought tooth and nail" to keep other people from licensing iTunes. Who was he fighting?
Hmm, Norway (which ruled FairPlay illegal in that country), France (including saying that a law that would require them to license FairPlay was "state-sponsored piracy"), The Netherlands, Germany, and increasingly others. (The first two are the best examples.)
From what I can see, Apple simply said "No, we aren't going to license iTunes. End of story." No fighting involved. After all, it's Apple's property, they have no obligation to license it to anybody. So, why would there be a tooth and nail fight?
Interesting that you don't have a problem with Apple trying to retain control of their DRM but you seem to have a problem with the words you put into Gates's mouth about not liking DRM MS doesn't control.
That may be, but I would expect the same for Linux. I could be wrong.
I would be a little surprised if there were that big a difference too (the more I've learned about Windows architecture the more they look the same), but remember that there is a big difference between how Linux and Windows treat system calls. On Unix, I don't think it's terribly uncommon to make system calls directly even though the C library is available. If you call open() or read() from a C program on Unix, that's pretty much just a marshaling function. However, if you make a call to functions in the Windows API, they aren't going directly to the kernel; they go through the Windows subsystem first, and it's not uncommon that this does non-trivial work. The actual system calls in ntdll are largely undocumented, and it's very rare to call to them. Because of this, I could see the behavior that hides the fact that read() may not return enough being in the Windows subsystem in Windows and the kernel in Linux.
One thing your comment made me remember is there are some Windows calls where you get back an array of items, you have to call the function once with a null pointer and some other param changes, and you get back the count of items, then you allocate the memory for the items, then you call again. I would not expect that to make *that* much difference, but it is there.
Blah. Yeah, that sort of sucks. Though again, there's a (small) chance this is not reflect in the system call interface.
Oops, sorry, I did indeed draw the wrong conclusion from the Slashdot headline, which seemed to imply a universal requirement.
/. headlines. More often than not they are at least sensationalist, and often flat out wrong. Heck, it's not uncommon for the summaries to be wrong...
Don't ever draw conclusions from
However, even with the restricted correct version, it's not all peachy either. Indeed, contrarily to popular belief, sex offender lists are not only composed of dangerous rapists.
Agreed, though in some sense that's a separate issue. Because of this, I am against these registry things and the punitive aspects of them. However, if this issue could be fixed, this law would be a good idea I think, despite the almost unenforcability of it.
But Gates is a big fat liar and bullshit artist. When he says he opposes DRM, he probably means he opposes DRM that Microsoft doesn't control.
And I should believe Jobs, the guy who's fighting tooth and nail to keep other people from licensing the iTunes/iPod DRM?
The point is not perfectly on the mark, but it is not wholey off the mark either.
That's right. It's close enough to the mark that it looks like it's making a good point while masking the point that drawing any conclusions besides "this might be why Windows is less secure" is complete BS.
As to apache and iis as the choices, they have bearing in that apache will likely be the choice on linux, and iis will likely be the choice on windows.
Ahhhh, now might be a reasonable conclusion.
However, that's not what the article says. The article says "these graphs are why Windows is less secure", not "these graphs are why IIS/Windows is less secure than Apache/Linux" or even "this is why web servers on Windows are less secure than web servers on Linux."
And if iis has that much to do with the chart, then why is the graph *that* much more involved? Is it doing it's task inefficiently? Are the hooks for ASP or other things that numerous?
I don't know. It's not ASP, because they're serving the same page from both. At the same time, I can't imagine what all the additional system calls that Windows would need are either. Some investigation seems to indicate that the APIs are about the same, so why would you need more calls on one than the other?
The only other thing I can think of besides "IIS sucks" is that the Windows subsystem is making multiple syscalls for each library call. For instance, on a read or write the library hides the fact that sometimes not all the data is transfered by making multiple syscalls, while on Linux the kernel hides that fact. But this doesn't necessarily indicate a problem with Windows at all -- quite the contrary, it means that in that respect the Windows kernel is actually simpler because that logic moves to user space.
They have been active in promoting the use of DRM and even saying it will be to the benefit of consumers.
Bill Gates has gone on the record opposing DRM, at least as it's present form.
There is no way that they were forced by the industry to implement that much DRM at the heart of their latest product.
I've posted this before. I don't think that MS is being forced into implementing DRM.
However, I don't think that if they were interested in good business decisions, they'd have much choice. Take the quality degradation on movie quality. If the studios want this, I don't think MS is in a position to refuse. If they do, I think the studios would just refuse to allow anyone to legally watch their next-gen DVDs on Windows. I think their market for people who watch on their computer vs. people who watch on a home theater is small enough that they would prefer to have the control. At the same time, who's the consumer going to blame? Probably the computer vendor. Most people aren't rational enough to listen to "it's the studios being unreasonable, not us". So if MS refuses, they take the brunt of the complaints. And to that the fact that MS is *already* hurting from recent pressures of Apple and, to a rather lesser extent, Linux, and I don't think they'd be thrilled about this. Add to *that* the business opportunity if Apple then says "hey, we'll implement your DRM" and then says "hey, look, you can watch your next-gen DVDs on Apples but not Windows systems" and actually gives people a compelling reason to switch. Appeasement to the MPAA looks really good to MS about now.
So I don't think MS is trying to be good here. But I don't think they could be good either.
Name one remote security exploit in any DOS implementation?
Regardless of whether it's a fair comparison or not, DOS is more secure than Linux by just about any reasonably sane metric you can come up with it.
Not all of security is remote. Let's see you take out an entire filesystem as non-root under Linux.
Your point mostly stands, but being more susceptible to trojans IS a perfectly sane metric that DOS fails.
It is a map of OS calls required to accomplish a task.
And the task is being deliberately misrepresented to indicate that it's a good test of Linux vs. Windows as opposed to Apache/Linux and IIS/Windows. In fact, if I had to make a guess, I'd say that the choice of Apache and IIS would have more to do with the difference.
Because, you say that everyone would lose their online freedom. This isn't true with the present proposal unless everyone is a registered sex offender. I have hard time believing that this is the case, so combined with the comment about this is to get people to switch off their brains, I concluded that you're saying that you expect it to become generally required.
If this isn't what you meant, then I'm sorry I misinterpreted; but in that case you'll have to explain why a sex offender having to register his screen name makes ME lose MY online freedom.
Nope, under this proposal, everybody would forfeit their online freedom. The spectre of rapists is only dangled in front of the voting populace to conveniently switch off their brains. Fortunately, sometimes sanity prevails in the end.
Or maybe you're committing the slippery slope fallacy.
Yeah, only us leftist freaks care about the murder of 2/3 of a million human beings. Whereas you normal folks don't see anything wrong with it.
Let me introduce you to my friend, Mr. Strawman.
Who said anything about the war? We're talking about making up laws about data retention.
Total Annihilation was a great game too, though I did tend to prefer StarCraft, probably out of familiarity.
StarCraft: high terrain serves only to create choke points and barriers to units. It is completely ignored for anything but restricting movement.
This isn't true. Units on low terrain next to high terrain had (I know) restricted sightlines and units on high terrain next to low terrain (I think) had extended sightlines as compared to the unit on flat terrain. I think it also affected the probability of hitting another unit when firing too (or maybe did less damage), but I'm less sure on that.
StarCraft: Units either move or they fight. Not both.
The Terran Siege Tank can fire while in motion.
Personally, I think so. A friend of mine sent me that link, and we were like 'we should make a higher quality version' so I could post it on my door and stuff, so we did. Also made a few changes and additions to the boxes, including moving Java up to next to C#. (And added an arrow back from C++ to C, added Smalltalk, ML, and a couple others.) This is the revised version.
That's okay! He'll just fire back! He'll place it perpendicular to the others if he has to!
Patentability here is dubious at best; it uses completely well-known phenomena (presumably just temperature changes due to pressure change and/or conversion of mechanical energy).
EVERYTHING (well, almost everything) uses completely well-known phenomena to work. That doesn't mean it's not an invention.
Considering the sheer number of possible physical explanations that have popped up here on Slashdot in a short period of time, whatever this is should fail the "obvious to one skilled in the art" test.
Obvious is measured in terms of creating it, not in understanding how it works. If it uses one of the mentioned principles, they've been understood for decades or centuries. The mere fact that it hasn't been invented before this (giving the guy the benefit of the doubt for now) in the face of this is testament to it's non-obviousness.
Huh?
Graphics can be disabled too. Are they only useful for toys?
Heck, I can telnet into a host and issue the HTTP request myself. HTML rendering can be disabled too. Is HTML only useful for toys?
If there's an application that needs Javascript, then the user will turn on Javascript or go somewhere else. If you don't care about the latter response, or if there's no alternative, then Javascript is a fine solution. The problem with "Javascript can be turned off" is if you don't take this into account for problems like security and validation. If not having it enabled can affect OTHER people, your program's designed wrong; if it only affects the person who doesn't have it enabled, that's fine.
See this diagram, and in particular the arrow from "people who refuse to use the word AJAX to "AJAX programmers"
Before that, companies actually made good floppies that would last on the order of years
I've got MS Office on floppies somewhere. I bet I could still install from them if I wanted. (v.6)
This would actually fix about 90% of the trouble we have with drive letters although I suspect it does not work on w2k which we are still using...
I can't vouch 100%, but from what I read I think it should support it. (W2K was the first version to come with the proper NTFS support for this.)
You do have to be mounting onto a version 3 NTFS partition, though I don't think the mount*ed* volume needs to be.
Does the mounted-to directory have to exist, like in Unix, or does it have to *not* be there. Personally having it not be there makes more sense, I never liked how Unix mount works and all I can think is that it is that way for a technical reason and nobody wants to admit that.
It has to exist and be an empty directory. I don't quite understand it either; I think the other way *would* make more sense. The best thing I can come up with is that it's needed to give the root directory of the mounted file system (and maybe the whole thing if it's FAT) permissions...