Slashdot Mirror


User: g4dget

g4dget's activity in the archive.

Stories
0
Comments
2,551
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,551

  1. Re:the problem is monoculture again on MS SQL Server Worm Wreaking Havoc · · Score: 1
    I think it's important to note that in the real world, besides having great diversity in species, we still have diseases.

    Diversity isn't about eliminating diseases, it's about limiting their impact on entire ecosystems.

    I agree that having a small amount of immunity can slow down an emerging worm.

    It's not just about slowing down the spread. If we had had 1/10th the number of vulnerable sites, we would have had (roughly) 1/10th the amount of traffic, and much less impact on overall Internet performance.

    It's really difficult to configure routers, especially core routers, to block unusual traffic patterns. The lack of aggressive filtering, IMO, is why we have these problems.

    Filtering is perhaps too drastic. Good volume based pricing, with premium prices for peak usage, would help. If every MS SQL site that got infected was facing a $50k bill--probably the cost their sloppiness imposed on the rest of us--they'd be more careful next time. And if that fails, you can throttle, rather than filter.

  2. I don't believe, but... on SOHO Strikes Back · · Score: 1
    I don't believe that extraterrestrials are visiting the solar system. And it also looks to me that the images shown by the UFO enthusiasts have been doctored.

    However, none of the explanations given by the SOHO folks so far seem to account for the image in this article. That streak isn't perfectly straight. Possible explanations that I can come up with are: the whole image is just a fake, a cosmic ray that "bounced" off a nucleus, something close to the camera lens that bounced off the glass, or the image of a star or planet taken while the satellite was maneuvering. Someone who knows space imaging and these kinds of cameras should present a credible argument on what the real reason is.

    Again, I don't believe in extraterrestrial visitors. But, on the other hand, I think asking for a specific, plausible explanation for each individual imaging artifact is valid: these are scientific instruments, and if they show such effects, one should be able to account for them 100%.

  3. Re:USAF UFO detector network on SOHO Strikes Back · · Score: 1
    If it's out there, one of these systems will pick it up within a few days.

    Well, if you go to the Lincoln Lab site and look around, you see lots of detection events that are labeled "Lost or Not Real". So, these systems might already be picking it up. But how do you follow up on a "Lost or Not Real" detection?

  4. not supported by the data on UFO Evidence From SOHO Satellite · · Score: 1
    The data consists of 47 samples. It's not surprising to find some rational function of 10 variables that gives you 75% correlation.

    In different words, they are using bad science to argue against bad science. And while UFOs are at least a theoretical possibility, this use of statistics is just plain wrong.

  5. Re:the problem is monoculture again on MS SQL Server Worm Wreaking Havoc · · Score: 1
    I think it's unrealistic and counter to the overall goal to interoperability of the internet to have so many implementations,

    The Internet is based on interoperability by standards compliance. More implementations foster more standards compliance and interoperability. You are effectively suggesting interoperability having N implementors hack up their systems not to comply with the standard but to work with the N-1 other systems "that matter". That's bad: nobody then knows what the standard really is.

    It really doesn't take a whole lot of penetrated systems to perpetuate a targeted DDoS. The ratio of size between common small pipes (1.5mbit/sec) and large pipes (1gbit/sec) isn't that great;

    Of course, you don't need a lot of compromised hosts to bring down a single target, but so what? That wasn't the problem in this attack. If something cures the common cold, it doesn't also have to cure cancer in order to be useful.

    Furthermore, the effects are not linear: if you increase the density of vulnerable sites, you get a more than linear increase in terms of overall risk and effect: the lower the density, the longer it takes for one compromised host to find the next one, and below a certain density it becomes effectively impossible (in particular, if routers are configured to throttle or block unusual traffic patterns like that). And if compromising the system involves manual interaction at some pointo (as a lot of vulnerabilities do), you get even bigger benefits from reducing the density of vulnerable systems even slightly.

    I'd rather have 5-6 well-supported software packages out there than hundreds of fairly-supported ones-- both from an interoperability standpoint and a resiliency point of view.

    See, and that kind of naive thinking is exactly why we get the huge security problems and poor standards compliance that we have.

  6. stating the obvious on Interview with Jaron Lanier on "Phenotropic" Development · · Score: 1
    Yes, of course, we want our software to become adaptive, to be based on pattern recognition, to be able to make intelligent inferences and decisions by itself. And that's what a large number of people in computer science and related disciplines are working on: pattern recognition, rule based systems, logic programming, Bayesian networks, etc. And when people figure out how to apply the techniques we already have in order to simplify software, they do apply them.

    I somehow fail to see what Lanier is contributing to any of this, other than picking up some buzzwords and trying to make a name for himself.

  7. Re:the problem is monoculture again on MS SQL Server Worm Wreaking Havoc · · Score: 1
    I don't think it's fair to say this is due to a software monoculture. MS SQL Server only has a 18-19% RDBMS marketshare (38% or so of the Windows database market).

    In biology, a "monoculture" also doesn't mean that the whole world has a single kind of crop, it means that there are very large patches of the same crop. Even 18% market share for any one company or product is way too large (yes, that holds for Apache as well). And an 18% marketshare fo MS SQL server translates into a much larger share of vulnerable installations, because of the generally lower skills required to install and administer it, because of its lower cost, and because of the kinds of installations that are using it; you're probably much less likely to find an Oracle or DB2 server on the open net.

    The argument could be made that with more different types of software, there is a greater risk of DDoS that could cripple the net (although cleanup will be easier in that case, too).

    One can also make the argument that the earth is flat. Neither of those two arguments, however, stands up to reality.

  8. the problem is monoculture again on MS SQL Server Worm Wreaking Havoc · · Score: 2, Insightful

    While part of the problem is that Microsoft software sucks particularly badly when it comes to security, something like this can happen with other software as well. The real problem is that we have a software monoculture: we need many more, different, independently implemented software systems. They will all have bugs, but as long as they all have different bugs, we are mostly OK. And that's the real reason why Microsoft's market dominance, in particular on large numbers of small machines run by non-experts, is a problem.

  9. Re:Swing isn't particularly good cross platform on Cross-Platform GUI Toolkits (Again)? · · Score: 1
    Every PC bought in the last two years should be sufficient to run SWING applications.

    You missed my point. I can live with Swing being a resource hog. What I can't live with in Swing is the bugs, the poor desktop integration, and the platform-dependent behavior. And the "kinks" I was referring to weren't just Swing problems, they were lots and lots of Java language, library, and runtime problems. Take a look at Sun's own bug tracker.

    As the typical business app just shovels data between the GUI and some database that needs to presented in a nice way, SWING is now probably just OK thanks to Moore's law.

    wxPython, Tcl/Tk, or a web application are OK for that, too, and they are even less effort to program (and considerably better cross-platform) than Swing.

  10. Re:Swing isn't particularly good cross platform on Cross-Platform GUI Toolkits (Again)? · · Score: 1
    I made a technical point there: wxWindows or Qt let you write cross-platform code that works well, Swing doesn't. I would even have listed a fully commercial cross-platform toolkit if Troll Tech hadn't driven them all out of the market with their "QPL" gimmick.

    Now, since you do bring up licenses... Of course, Qt isn't free for commercial apps. I frankly think the Qt dual licensing scheme is a lousy idea for users. However, even Qt is at the very least available under the GPL so that if you use it for non-commercial apps, you won't get stuck when Troll Tech goes out of business or changes their business model. With Sun, Swing is entirely proprietary and you are at their mercy.

  11. Re:Swing isn't particularly good cross platform on Cross-Platform GUI Toolkits (Again)? · · Score: 1
    Ive used Swing in both X11 and on a Mac. I have seen none of the issues you are speaking of. Maybe when it first came out there were bugs but these must have been fixed.

    No. I still develop in Java, and I assure you they haven't been fixed. They are still in 1.3 and 1.4.

    Basically, Sun doesn't seem to give a damn about any platform other than Windows when it comes to the client side. With a supposed 95% market share, that may sound reasonable, but the problem is that Java is advertised as a good cross-platform solution for client apps, and that it just isn't.

  12. Re:outlook for java not so good on The Future of Java? · · Score: 1
    GNU gcj, the open source Java compiler, actually works quite well for that: it generates executables that behave like normal C/C++ programs and are quite small. Runtime performance is like Sun's best JIT.

    The trouble, of course, is that gcj cannot implement the Java2 platform because large chunks of that are proprietary. So, you get a decent Java language compiler, but your code will be Linux specific, which is kind of defeating the purpose. In that case, you might as well look beyond Java for other, perhaps more elegant, languages.

    Personally, I like O'CAML (search for "ocaml" on Google). It has none of the warts of Java or C#, it compiles into good code, and there are lots of libraries available for it.

  13. Linux is bad, Mac/Windows are worse on JWZ Reviews Video on Linux · · Score: 1
    But it's a total pain in the ass to use due to rampant "themeing." Why do people do this?

    Easy: Apple does it and Microsoft does it, and it sucks worse on those platforms. An even worse problem with the Mac and Windows players are that they are (in my experience) much less reliable than the Linux players.

    So, yes, the UI on the Linux players sucks, but it does as well on most of the others. And in terms of functionality, Linux players are generally better.

  14. outlook for java not so good on The Future of Java? · · Score: 1
    Sun promised to deliver a small cross-platform platform for delivering applications over the web. They promised to have the system standardized through a standards body. They promised to improve numerical performance and compile-time type safety.

    What Sun has given us instead is a huge server-side environment. Sun dropped out of standardization efforts twice (you may argue whether their reasons were good, but the fact is they broke their promises). The GUI toolkit and graphics systems (Swing and Java2D) are proprietary to Sun and have no third party or open source equivalents. Sun has implemented almost none of the recommendations of the JavaGrande forum. And Sun's implementation of genericity is not type-safe. And on top of all that, Sun holds patents on some core Java technologies (like the byte-code type checking).

    The biggest promise of Java, easy cross-platform GUI development, has been the biggest disappointment as far as I'm concerned. Swing is a pretty neat GUI toolkit on Windows, but on Mac and Linux, it's flaky and unpredictable in my experience. And Sun's lowest-common denominator cross-platform philosophy is seriously flawed in my opinion, putting everybody into a straightjacket. wxWindows's cross-platform approach is much better: wxWindows gives you the lowest common denominator, and then it gives you convenient access to platform-specific features when you want it--that's essential for writing high-quality apps.

    As far as I'm concerned, Java has stagnated and become bloated over the last few years. And I don't think Java is a good platform for open source development (since important parts of the platform are not available in open source form).

    I think Mono is the best option for open source systems. Microsoft has learned from Sun's mistakes and done a (slightly) better job with language design. And Microsoft isn't afraid to fix the runtime to make things like genericity work right.

    And, sad as it is, I think the legal and patent situation is better for C#/CLR than for Java/JVM: yes, like Sun, Microsoft has patents, and unlike Sun, they are even threatening to assert them, but unlike Sun's, those patents seem peripheral and easily worked around.

    What's probably going to happen is that IBM takes away the rudder from Sun and pushes a Java platform built entirely around open, non-Sun standards. And projects like Mono will probably offer full Java support pretty soon. So, in some sense, Java is going to survive, but Sun and the Java2 platform will disappear. And, as far as I'm concerned, it won't be missed either.

  15. beware of contamination on SCO Group Hires Boies After All · · Score: 1
    One particular area of concern is with companies that signed agreements to see proprietary SCO source code and whose programmers now are working on different projects that could use that proprietary code, McBride said. He declined to comment on who could be contributing that code.

    In fact, a number of companies believe that if you have seen their proprietary source code and then work on another implementation, the presumption is that you are violating their copyright. Of particular concern to me in that regard is Sun Java: Sun has, in the past asserted such contamination clauses against other companies. There is a strong possibility that any open source Java project is contaminated if the people as much as looked at any of the source code that Sun makes available. And similar concerns exist for other projects.

  16. Re:More attention to IO needed on Improving Linux Kernel Performance · · Score: 1
    There are a bunch of commercial products that make building distributed data bases fairly easy. IBM promises that with one of their DB2-based products, you basically just plug in a new machine and point it at the master database server.

    Some open source equivalent would sure be nice. But even something homegrown for particular applications isn't too hard; usually, you can find an obvious field pretty easily to distribute and balance database content to different servers by.

  17. Re:and your answer, also "typical". on Rolling Out Mozilla in an Organization? · · Score: 1
    because the real world is full of nasty crap you have to deal with, and the last thing I want to do is spend my evenings and weekends fucking around with my custom perl scripts on 4000 windows boxes.

    Of course, managing 4000 Windows boxes with custom Perl scripts is a big pain. That's because managing 4000 Windows boxes with anything is a big pain. Buying lots of toy software add-ons just means you are going to waste a lot of extra money and time playing around with that software.

    I'm a huge open source zealot, but come on- some of us like to actually get home in time for dinner. there's other things besides computers, you know.

    It's another misconception that increasing your efficiency let's you get home earlier: if you double your efficiency, your company will just double your workload. So, even if all that Windows software did make you more efficient (which it doesn't), it wouldn't help you "get home" earlier anyway.

  18. Swing isn't particularly good cross platform on Cross-Platform GUI Toolkits (Again)? · · Score: 2, Insightful
    Yes, I know, Sun wants Swing to be cross-platform. I was really hopeful when it came out. The first few years, it looked like Sun was going to make it work and work out the kinks. But after several years, it's clear that they won't be able to do that any time soon.

    Swing still really falls short compared to other cross-platform offerings. In particular, performance and correctness of Swing on X11 and Macintosh are iffy: for example, window management is broken on X11, antialiasing makes lines disappear on Macintosh, and graphics can crawl to a halt in the presence of transparency on both X11 and Macintosh.

    Another problem is that Swing is, as you point out, only "free as in beer": it's not open source and there is no open source implementation. Sun could, at least in principle, pull the rug out from under you at any time, for example, by starting to charge for commercial applications. And I recommend that you read the JRE license very carefully--it already comes with many strings attached (e.g., Sun reserves the right to install software on your machine).

    If you need to write cross-platform prototyping code, Swing is OK. However, something like wxPython is probably both a bit easier to use for prototyping still and works somewhat better across platforms.

    If you want to write professional-looking, robust, and efficient cross-platform applications, Swing is not the answer, at least for now. Programming in something like wxWindows or Qt may be a lot more work, but at least you can get the job done.

  19. there is no "best" on Cross-Platform GUI Toolkits (Again)? · · Score: 1
    For example, if you need to put together an application very quickly, Tcl/Tk is great, but it has its limits. wxWindows is probably the most complete of the cross-platform toolkits, but it's harder to use. Qt has a clean design but uses some non-standard constructs and costs lots of money if you want to use it commercially. FLTK is very easy to program and generates very small executables (even statically linked), but its widget set is limited and the released version have very limited layout support.

    If you want a simple answer and you are asking for a C++ toolkit, your best bet is C++. But you have to realize that there are intrinsic tradeoffs in choosing any toolkit.

  20. Which planet? on UFO Evidence From SOHO Satellite · · Score: 1
    "The image seen in various newspapers is of an over-exposed planet - it is not a UFO."

    For an object that big, it should be easy to figure out which planet or asteroid it was.

    What makes the planet explanation a bit odd is the way the trail is structured--it has a kink in it, and it isn't uniformly blurred. If this is a planet, then the picture must have been taken while the observatory itself was actively moving around.

  21. A flying saucer... on UFO Evidence From SOHO Satellite · · Score: 1

    is not exactly "unidentified": if you know that a piece of kitchen china is whizzing through the air, it seems to me you have done a pretty careful job at identifying what it is already.

  22. typical on Rolling Out Mozilla in an Organization? · · Score: 3, Insightful
    What you want to do is use something like Microsoft Systems Management Server, [microsoft.com] Veritas WinInstall, [ondemandsoftware.com] or Novell ZenWorks SnAPPShot [novell.com]

    This is pretty typical: in order to get even the simplest task done on Windows, the usual answer is: get another software package.

    the money you spend will save you $$$ in man-hours trying

    First, you are going to spend many man hours getting your manager to approve the purchase and order the applications. Then you are going to spend many more man hours installing them. Then you are going to spend many man hours trying to figure them out. Then you are going to spend even more man hours fiddling around with them trying to package up Mozilla. Then, you still need to figure out how to get the packages themselves or the client packages for those packages onto the clients. Then, if everything goes really well, you may be ready to install the software.

    And when some major software upgrade comes from Microsoft or these vendors, you can start pretty much from square one.

    That's of course assuming that those packages are completely bug free. More than likely, they will interact in some unknown way with some other software package and mess up something or other.

    hackneyed, crappy homebrew solution in the long run

    Professional chefs use a couple of knives to get the job done: they are reliable, predictable, simple, and efficient. Amateurs run out and buy every kitchen appliance under the sun, hoping to compensate with appliances for skills that they lack. It's no different with system management: if you don't know what you are doing, your answer is going to be: "oh, just buy another piece of software".

    Windows, unfortunately, doesn't ship with any knives, but with Cygwin and Perl, you can get by. System management on Windows still like preparing a banquet in a kitchenette, but you don't need to make the effort even harder by stuffing the kitchenette full with useless junk.

  23. Re:More attention to IO needed on Improving Linux Kernel Performance · · Score: 4, Informative
    In particular I'm interested in how the Linux kernel is designed to handle multiple independent I/O buses.

    By running multiple kernels. Seriously: the way to get great performance out of PC hardware is to buy lots of it and cluster it. You still end up paying less for more performance than with the high end systems.

  24. Re:Different kinds of databases on Scaling Server Performance · · Score: 1

    I think from context and common usage, you can figure out that by "database", I was referring to "relational database like MySQL, PostgreSQL, Oracle, or DB2". If you couldn't, welcome to the real world, Data.

  25. Re:How else? on Scaling Server Performance · · Score: 1

    Store them in the file system, in a DBM file, in memory, or in an object database. Relational databases are overkill for most web applications and were never designed for that kind of use.