You raise a point that for some reason everybody here is ignoring.
I don't care how fancy the mechanism is to catch this kind of thing. All fine and well.
How did the trojan get into the code in the first place? Are we to assume there's no oversight in code submissions for a package as critical as OpenSSH?
In any commercial entity where a problem like this was uncovered, there would be a thorough audit of the submission path in process. Perhaps there is in this case as well. But why is nobody even discussing it??
I want a cell phone that I have to keep in a Faraday cage, too. If I build a big enough Faraday cage I am sure I'll figure out something I can use it for in there.
You are imposing one of the problems with the total mess we current suffer with: a wide-open 'consensus' based email system, to something that would be administered very differently. The spammer wouldn't be able to 'sneak' into the system. It would be the equivalent of breaking into a post office at night to shuffle fake junk mail into the bags without paying for it.
The Postal Service is Unionized. We would be prohibited from using 'Scab' email servers. There would be email clients approved for use (the way mailboxes have to be approved).
The rate for email messages would go up every few years and it would be impossible to get to the USPS website to buy the extra 3 cent 'e-stamps' each time.
There are two formal disciplines of engineering that are accredited:
Electrical Engineering Mechanical Engineering.
All others 'engineerings' are handwaving and shortcuts implemented by various schools and organizations to get a bunch of people out there in industry plugging stuff in, etc.
I am not an EE or a ME. I'm at least honest about the fact that I'm not an engineer.
I filled out the form in the back of the Windows 98 booklet and sent it in to Microsoft so that they sent me the 3-1/2" floppy version of Windows 98. It cost about $10 to do so, and they screwed up at their end and sent two copies by mistake.
But, then, I also sent in the form when I got Windows 95 and ordered the 5-1/4" floppy version. It's an interesting version of Windows 95 in that it does not prompt for a CD key, or 'fingerprint' the diskettes like the 3-1/2" version. It's also extremely primative, the first version of Windows 95, that didn't include Internet Explorer. The floppies can all be copied over to a directory on a CD to make the 'free' version of Windows 95 that has no 'tracable numbering', CD key, or fingerprinting.
Re:Reasons for lack of GUI innovation
on
GUIs for Everyone
·
· Score: 1
I would say that Linux has been developed and maintained by hackers. Engineers generally design things, and Linux wasn't designed, it was just modeled after something else that was designed.
Further, engineers use the tool to get the job done. They typically use multiple computer operating systems, because the best tools don't exist on any one single OS. There isn't squat for Electrical Engineers on Linux, for example, and barely enough to do the job on Windows. Their Linux box might make a fine xterminal to access the apps they need, or eXceed will do, but when the real apps cost $50,000 a year per seat to license, it's trivial to lease a Sun box running Solaris to run it on.
So I take exception to the idea that Linux is designed by engineers. It's one of the tools on the shelf for certain uses.
It was wonderful, the day when all the trendy people threw out all their albums. Because then those of us who listen to the content, instead of obsessing over the form it was stored on, got all those great albums for a buck apiece.
That's Donald Knuth's project. Knuth is pretty much an exception to any rule or group characterization anybody could try to make. Genius just works that way.
Also, TeX is the product of a small group (one) of 'well-led motivated people.'
There is no Win 9x BSOD. There are error screens in Win 9x that have a blue background, but the BSOD is an unrecoverable dump screen. For the educated, BSOD screens on NT and it's derivatives actually contain information usable to fix the problem. I remember once, back on NT 4 that I was able to figure out that the BSOD had occured because I dared boot the system without a Zip Disk in the parallel port Zip drive.
Generally, it's a sign of a less-than experienced Microsoft user when one is seen referring to a BSOD on a 9x-class machine. They crash silently, they reboot silently, but they never crash to a BSOD. They aren't well engineered enough to do so.
There's a famous anectote about someone who did NOT make a good case for Linux with his boss. He got bosses' desktop machine all set up. Boss just turned machine off at end of day. Filesystem corrupted beyond repair.
Boss said he did it that way all the time on Windows. Boss is 'stupid' we will all agree. But the vulnerability of Linux to filesystem corruption from crashes was until very recently quite severe. As the desktop gobbledee goop of the newer incarnations of Linux systems grow in complexity and automation, Linux will certainly continue to be vulnerable to corruption, likely more so. The days of clean.dotfile configs seem to be going away.
If there's a 'security threat' in the source not being disclosed to one, there's a 'security threat' in the source not being disclosed to the other.
Sometimes the Open Source community seems like a bunch of boys who have stolen a car. They're FREE now, no matter that all they have is a car, and there are police on the road. Free at last!
Now, go be a good passive resistive device and leave the real work to us higher order components.
There are thousands, even millions of people who recognize that the situation in the Middle East excaberates the problem, but that at the heart of the matter, the terrorists involved in the 9/11 attack are engaged in a 'Holy War' against the West.
Ding ding ding. You win the award for stringing together the most buzzwords. Try to work in 'jack booted thug' in your next attempt. Also try to learn how to detect sarcasm in the future.
My place of work is filled with old devices that stoped working due to "software upgrades". The vendors recomend, shocker, that we replace the devices.
I have a nice brand-name STB PCI graphics card. It has an S3 Trio64 chipset. It's deprecated in XFree86. I used to use it, back in the Linux 1.2 days as my main graphic card. About a year ago I got hollered at in a forum for complaining about it. People told me 'get a new card!'
The terrorists who attacked the US on 9/11 wanted to kill Americans because they are opposed to Western Civilization, and they view the United States as the leading edge of that civilization.
It would have made no difference how 'nice' the United States behaved.
Perhaps the US government should help Peru to thwart interests that want to sell closed source there. It's a security risk, after all.
US Battleships could set up a blockade and keep out shipments of motherboards, hard drives, keyboards, and any other products that include closed source firmware in their embedded controllers.
I'm sure if Richard Stallman wants to sell GNU Emacs manuals in Peru (he gets $45 a pop for them) the government will assist him in doing so in whatever capacity they can.
You make a good point. Lots of classic-computer enthusiasts get quite upset about people coring out old hardware, destroying it's integrity in the process. It's not as big of an issue with common commodity hardware like NES enclosures, but people who core out VAX boxes that others would love to restore are seen by some as nothing better than vandals. It's like chopping a Dusenberg and slotting in a Big Block V8.
Re:People are afraid of being proven wrong
on
WarTalking Arrest
·
· Score: 1
I don't need to lock the door to my car for it to be a crime for you to rifle through the glove compartment and steal a flashlight.
If you can't understand that, perhaps a few years studying in the prison's law library will do you some good.
Slashdot Mirror
Binary? Everybody here is talking about source code.
With the batteries removed, it makes a pretty spiffy looking paperweight....
You raise a point that for some reason everybody here is ignoring.
I don't care how fancy the mechanism is to catch this kind of thing. All fine and well.
How did the trojan get into the code in the first place? Are we to assume there's no oversight in code submissions for a package as critical as OpenSSH?
In any commercial entity where a problem like this was uncovered, there would be a thorough audit of the submission path in process. Perhaps there is in this case as well. But why is nobody even discussing it??
It's pretty much like all the new topic headings here at Slashdot that have to do with Apple.
(it's common knowledge that OSDN may be purchased by Apple Computer near in the future)
I want a cell phone that I have to keep in a Faraday cage, too. If I build a big enough Faraday cage I am sure I'll figure out something I can use it for in there.
You are imposing one of the problems with the total mess we current suffer with: a wide-open 'consensus' based email system, to something that would be administered very differently. The spammer wouldn't be able to 'sneak' into the system. It would be the equivalent of breaking into a post office at night to shuffle fake junk mail into the bags without paying for it.
Yes. It's good. Unless you've got issues of resentment with the fact that you can't herd everybody into highrises and tell them how to live.
Then it probably irks you to no end.
The Postal Service is Unionized. We would be prohibited from using 'Scab' email servers. There would be email clients approved for use (the way mailboxes have to be approved).
The rate for email messages would go up every few years and it would be impossible to get to the USPS website to buy the extra 3 cent 'e-stamps' each time.
What the hell is 'Computer Engineering.'
There are two formal disciplines of engineering that are accredited:
Electrical Engineering
Mechanical Engineering.
All others 'engineerings' are handwaving and shortcuts implemented by various schools and organizations to get a bunch of people out there in industry plugging stuff in, etc.
I am not an EE or a ME. I'm at least honest about the fact that I'm not an engineer.
I filled out the form in the back of the Windows 98 booklet and sent it in to Microsoft so that they sent me the 3-1/2" floppy version of Windows 98. It cost about $10 to do so, and they screwed up at their end and sent two copies by mistake.
But, then, I also sent in the form when I got Windows 95 and ordered the 5-1/4" floppy version. It's an interesting version of Windows 95 in that it does not prompt for a CD key, or 'fingerprint' the diskettes like the 3-1/2" version. It's also extremely primative, the first version of Windows 95, that didn't include Internet Explorer. The floppies can all be copied over to a directory on a CD to make the 'free' version of Windows 95 that has no 'tracable numbering', CD key, or fingerprinting.
I would say that Linux has been developed and maintained by hackers. Engineers generally design things, and Linux wasn't designed, it was just modeled after something else that was designed.
Further, engineers use the tool to get the job done. They typically use multiple computer operating systems, because the best tools don't exist on any one single OS. There isn't squat for Electrical Engineers on Linux, for example, and barely enough to do the job on Windows. Their Linux box might make a fine xterminal to access the apps they need, or eXceed will do, but when the real apps cost $50,000 a year per seat to license, it's trivial to lease a Sun box running Solaris to run it on.
So I take exception to the idea that Linux is designed by engineers. It's one of the tools on the shelf for certain uses.
It was wonderful, the day when all the trendy people threw out all their albums. Because then those of us who listen to the content, instead of obsessing over the form it was stored on, got all those great albums for a buck apiece.
That's Donald Knuth's project. Knuth is pretty much an exception to any rule or group characterization anybody could try to make. Genius just works that way.
Also, TeX is the product of a small group (one) of 'well-led motivated people.'
There is no Win 9x BSOD. There are error screens in Win 9x that have a blue background, but the BSOD is an unrecoverable dump screen. For the educated, BSOD screens on NT and it's derivatives actually contain information usable to fix the problem. I remember once, back on NT 4 that I was able to figure out that the BSOD had occured because I dared boot the system without a Zip Disk in the parallel port Zip drive.
Generally, it's a sign of a less-than experienced Microsoft user when one is seen referring to a BSOD on a 9x-class machine. They crash silently, they reboot silently, but they never crash to a BSOD. They aren't well engineered enough to do so.
There's a famous anectote about someone who did NOT make a good case for Linux with his boss. He got bosses' desktop machine all set up. Boss just turned machine off at end of day. Filesystem corrupted beyond repair.
.dotfile configs seem to be going away.
Boss said he did it that way all the time on Windows. Boss is 'stupid' we will all agree. But the vulnerability of Linux to filesystem corruption from crashes was until very recently quite severe. As the desktop gobbledee goop of the newer incarnations of Linux systems grow in complexity and automation, Linux will certainly continue to be vulnerable to corruption, likely more so. The days of clean
Software is firmware is firmware is software.
If there's a 'security threat' in the source not being disclosed to one, there's a 'security threat' in the source not being disclosed to the other.
Sometimes the Open Source community seems like a bunch of boys who have stolen a car. They're FREE now, no matter that all they have is a car, and there are police on the road. Free at last!
Now, go be a good passive resistive device and leave the real work to us higher order components.
There are thousands, even millions of people who recognize that the situation in the Middle East excaberates the problem, but that at the heart of the matter, the terrorists involved in the 9/11 attack are engaged in a 'Holy War' against the West.
How about get a new card if you want XFree86 4.x support.
In my previous comment I was only using XFree86 as an example. My point is made.
Your argument is vacuous jingoistic bullshit
Ding ding ding. You win the award for stringing together the most buzzwords. Try to work in 'jack booted thug' in your next attempt. Also try to learn how to detect sarcasm in the future.
My place of work is filled with old devices that stoped working due to "software upgrades". The vendors recomend, shocker, that we replace the devices.
I have a nice brand-name STB PCI graphics card. It has an S3 Trio64 chipset. It's deprecated in XFree86. I used to use it, back in the Linux 1.2 days as my main graphic card. About a year ago I got hollered at in a forum for complaining about it. People told me 'get a new card!'
The terrorists who attacked the US on 9/11 wanted to kill Americans because they are opposed to Western Civilization, and they view the United States as the leading edge of that civilization.
It would have made no difference how 'nice' the United States behaved.
Perhaps the US government should help Peru to thwart interests that want to sell closed source there. It's a security risk, after all.
US Battleships could set up a blockade and keep out shipments of motherboards, hard drives, keyboards, and any other products that include closed source firmware in their embedded controllers.
Just an idea that should be pondered.
I'm sure if Richard Stallman wants to sell GNU Emacs manuals in Peru (he gets $45 a pop for them) the government will assist him in doing so in whatever capacity they can.
You make a good point. Lots of classic-computer enthusiasts get quite upset about people coring out old hardware, destroying it's integrity in the process. It's not as big of an issue with common commodity hardware like NES enclosures, but people who core out VAX boxes that others would love to restore are seen by some as nothing better than vandals. It's like chopping a Dusenberg and slotting in a Big Block V8.
I don't need to lock the door to my car for it to be a crime for you to rifle through the glove compartment and steal a flashlight.
If you can't understand that, perhaps a few years studying in the prison's law library will do you some good.