User: phasm42

Re:Just for the record.

On: Wired Dissects Sony as PS3 Effort Falters

Look closer. It says Sony made Japan's first transistor radio. Regency made the first commercial model, and Intermetall probabaly produced the first one, although not commercialized.

Re:What is going on

On: HP Baited With Cutouts of Founders

I say they take it to the next level and fight it out on MySpace.

Re:Steal?

On: Heroic IT Dept Less Likely to Steal... Lunches?

The neighborhood may play a role in that as well. It wouldn't be hard to find an area where the whole stand would disappear the same day.

And I do think that Walmart would be more likely to be looted because it's a corporation, not an individual.

Re:Question

On: Microsoft Flubs Patch, Putting Users At Risk

Windows 2K SP4 is affected -- the SP1 bit is in regards to XP.

Re:Speaking as one who has been burned...

On: Consumer Reports Creates Viruses to Test Software

If you've written a virus, then you know all the attack vectors and hooks. On a set of isolated machines, it's very easy to prevent it from spreading. It's not like a biological virus where it could randomly mutate and escape, and you should know this if you've written a virus. Releasing a virus onto an open network was just bad judgement if you want to contain it.

Re:Why Slashdot.. why?

On: Dvorak Adores YouTube

Yes

Re:Oh noes!

On: Windows' Patchguard Hinders Security Vendors

To add to your point, customers won't care when their viruses/malware break, but they will care when the security software they paid for breaks. It could also discourage people from applying updates, out of fear it will break their security software.

Re:10 year old POS?

On: Image Recognition on Mobile Phones

The trick is to read the barcode from an image, not from a scanning laser or other barcode reading hardware. That's what makes it interesting.

Re:He's so wrong.

On: Technology And The Decline of Gonzo Journalism

When you walk away NOTHING is changed. It's why I stopped playing RPG's. If I spent all the time I wasted pretending to blacksmith online ACTUALLY BLACKSMITING I would know HOW TO BE A BLACKSMITH BY NOW.

Fucking excellent point. I hope other readers give this some serious thought.

Re:Microsoft Innovation

On: Vista Speech Recognition Goes Awry

Destroyed the competition? You do realize that there are other speech recognition programs out there, like Dragon Naturally Speaking that work quite well? I'm sure they're glad that MS hasn't paid attention to this until now.

Re:Awesome

On: Using Electricity to Heal

That's in vivo :-]

Screenshots

On: Hacktivismo launches ScatterChat

I like the use of "Lord Spankatron" in the screen shots.

Re:and selling us the half assed solution again

On: Intel Stepping Up to Combat AMD's 4x4

Intel's chip is two dual-cores in one package, one socket. This is much more of a quad-core than AMD's 4x4 "hack": Two dual-cores in two sockets.

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

That's too bad, I love 1.5. We switched to it as soon as it came out. The new enums are great -- your enums can be full classes with methods and multiple bits of data associated with each constant, and you can even give each constant distinct implementations of methods. It does wonders for organizing code. I also love the ability to get the stack trace of other threads -- before 1.5, you could only get the stack trace of the current thread or of a Throwable. Now I can enumerate all threads, get their stack traces, and easily see what's going on. Generics are okay, but it's not that big of a deal. I'm starting to get into annotations. Under the right circumstances (an ORM), they're very useful. If you deal with a lot of concurrency, the java.util.concurrent package and subpackages are very nice implementations of locking, queueing, and atomic operations that you've probably had to implement at some time.

I don't know what's holding your work back from 1.5, but if possible you should push for it. It was a really big improvement. The one thing that caused us trouble was some jakarta code that declared variables named "enum" -- this is now a keyword in 1.5.

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

...because StringBuffer.toString() will share arrays until another modification is made to the StringBuffer...

Wow, I had no idea. However, this is no longer true in Java 5 -- see this bug report. The complaint was slow performance due to removal of the sharing. The gist of it seemed to be that sharing was dependant on synchronization, and StringBuilder was introduced in 1.5, which is an unsynchronized class. Furthermore, the compiler now uses StringBuilder for concatenations instead of StringBuffer as before. And lastly, they claim to see a slight slowdown using array sharing in their benchmarks, and believe the submitter is having a performance problem under an odd set of circumstances.

Anyway, very interesting to know. I typically re-use StringBuffers (now StringBuilders for my new stuff), so the array sharing didn't do much good for me, and may have actually wasted space if the String sizes varied greatly. Here's the 1.5 code if you're interested:

StringBuffer:

public synchronized String toString() {
return new String(value, 0, count);
}

StringBuilder:

public String toString() {
// Create a copy, don't share the array
return new String(value, 0, count);
}

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

A better example:

String s = "foo";
String s2 = "foo";
System.out.println(s == s2);

Will generally print "true" since the compiler can intern the "foo" literal.

String s = "foo";
String s2 = new String("foo");
System.out.println(s == s2);

Will print false since s2 is a new String.

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

This should not be optimized, because it is functionally different. These code snippets will work differently:

String s = "foo";
String s2 = new String(s);
System.out.println(s == s2);

Prints "false"

String s = "foo";
String s2 = s;
System.out.println(s == s2);

Prints "true"
Furthermore, if you do the "new String(x)" inside a loop, you are creating an object with every pass through the loop. Although you may want a separate object for some purposes, this is generally not the case because strings are immutable.

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

It is not functionally identical. String literals are turned into instances of String yes, but saying "new String("X")" creates two Strings, the original literal embedded in the class, and a new one generated at runtime. The code does this:

String s = "foo";
String s2 = new String(s);

as opposed to this:

String s = "foo";
String s2 = s;

Re:I'm not very experienced with SQL Security...

On: SQL Injection Attacks Increasing

If you think parameters means escaping, you're dead wrong. If you interact with a database, you really need to know this.

Re:Use PreparedStatements with Java

On: SQL Injection Attacks Increasing

String SQL = new String("select * from user where username = ?");

This is wasteful -- it generates a new String object every time when it's just a literal. Just use

String SQL = "select * from user where username = ?";

Re:Hard for Devs?

On: SQL Injection Attacks Increasing

There is no "automatic checks" -- other languages simply support prepared statements, which sidesteps the entire problem. No escaping necessary, just use a parameterized SQL statement. They also support the standard string concatenation method, but prepared statements are there from the start, and many examples make use of this. Although there is a package for PHP to support parameterized SQL, all the PHP I've seen simply uses string concatenation.

Here's an example of parameterized queries in Java:

PreparedStatement ps = connection.prepareStatement("insert into USERS_LIST (USER_ID, USER_NAME) values (USER_ID_SEQ.nextval, ?)";
ps.setString (1, userName);
boolean status = (ps.executeUpdate() == 1);

Need to insert more? Reuse the prepared statement

for (String userName : users)
{
ps.setString(1, userName);
numBad += (ps.executeUpdate() == 1)?0:1;
}

Re:Bah

On: High-level Languages and Speed

Mod parent up -- that was a very concise explanation of the problem of optimization.

Re:SETI's a waste... until we find them

On: Is SETI@home Where Your Cycles Belong?

By the time such a radio signal arrives, it would probably be many hundreds or thousands of years after the original transmission.

Re:how many aren't listed?

On: New Top500 List Released at Supercomputing '06

United Airline's intranet is called SkyNet.

Blocking the blocker

On: Prototype System Blocks Digital Cameras

Then someone will come along with a similar device that targets the blocker. Or a proper mirror setup...