POSIX is a superset of the UNIX Release 7 APIs, which (if APIs could be copyrighted) would be owned by AT&T. And POSIX is not as open as you think it is - until quite recently you had to pay for a copy of the spec, you still have to pay for certification, and you can only use the associated trademarks if you do. Imagine if AT&T had been able to block the creation of POSIX by claiming copyright on those APIs. Imagine if The Open Group had been able to enforce the rule that you couldn't ship anything that implements any of the POSIX APIs unless you implemented the full set and paid them for certification.
I'm the author of TFA. There's a big difference between a general purpose processor and a general purpose computer. A lot of current research in computer architecture is focussed on the idea that you have a sharp divide between accelerators and general purpose CPUs. The point of the article is that different CPU microarchitectures are specialised for different workloads (one of the cited results was that in a big.LITTLE arrangement, the A7 core runs one of the SPEC benchmarks faster than the A15 because of its lower cache access time, for example) and that there are a lot of assumptions about the kind of code that the general purpose core will run. Many of these are true for C code, but a lot less true for code written in other languages. The communication patterns that mainstream multicore processors are optimised for are heavily tied to C, to the extent that if you have a language with a shared-nothing abstraction and message passing then the only way of implementing it is horrendously inefficient at the hardware level.
It would be interesting, but it's also a question of encoding density. Having a fixed number of architectural registers (and a much larger number of microarchitectural registers) is a technique that works reasonably well. Adding more architectural registers makes your operand size very large. You could imagine something like Dalvik bytecode, with 2^32 SSA registers and a CPU able to interpret it by either using internal registers or spilling to RAM, but you'd likely end up needing huge instruction caches and not getting much (if any) speedup.
I don't know specifically, but for some GPUs there's a flag to disable strict IEEE floating point compliance. This can make things go a lot faster, at the expense of sometimes giving the wrong result. For graphics workloads, a few more floating point rounding errors are normally invisible to the human eye, but for scientific (GPGPU) computing they can be problematic.
I've not built a machine with anything other than the stock cooler for a long time, but I had a 1GHz Athlon with a Zalman flower cooler that ran stably at 1.33GHz for years and was almost silent (big, low RPM fan pushing air over it). It actually still worked when I booted it a couple of years ago, although it's too slow to care about now.
AC post, so you're likely to stay at 0, but this comment in TFA stuck out for me:
Moreover, our team was predominantly black. I could relate to my teammates without having to conform.
Why do you find black people easier to relate to than white / asian / whatever people? Why do you not feel that you have to conform when surrounded by them?
No, I mean that they broke the ones that OpenBSD comes with and OpenBSD hasn't added new ones for years. They're no longer interesting as a target for security research.
Our biggest problem is willingness to relocate - candidates who are already on the West Coast are so hammered by recruiters that it's hard to find anyone actually looking, but there are plenty of qualified engineers elsewhere.
Sounds like the real problem is that you are unwilling to relocate. Putting your company somewhere where the cost of living is high and there's a shortage of talent seems to be very popular, but difficult to understand. Why not find out where there's a pool of talent and open an office there? Or do what a number of tech companies have done and allow remote workers, then start building satellite offices where you find clusters of competent people.
When have you ever known a political party supporter switch affiliation because their party's policies don't work? Because the parties ideology has shifted, sure, but because they've tried their policies and they didn't work? Very rare.
Here's a suggestion: Let the people do the gerrymandering. Enlarge the electoral districts so that they overlap and allow people to select the one that they want to belong to.
The other issue with postal votes is that they make voter intimidation easier. If someone threatens or bribes you to vote with an in-person anonymous ballot, then it's easy to claim that you voted the way that they wanted, but do your own thing inside the booth. With a postal ballot, they can just ask for your ballot paper, make the marks themselves, and post it in. There were a few cases in the UK of patriarchs in immigrant families collecting all of the ballot papers and sending them all in.
You never know. If the Libertarians get in and dismantle a large part of the government, then the next guys might have a chance to rebuild it along more sensible lines...
In the UK, we have TheyWorkForYou, which is developed by mySociety, a charity that exists to provide useful tools for voters. They also run a few related sites, including WriteToThem, which provides an easy way of identifying and contacting your elected representatives.
If you want to improve the state of your government, then donating to an organisation like them is probably a much better idea than giving the money to any party.
If you claim OpenBSD malloc is inferior to other OSes, how do you explain OpenBSD as the more secure OS out there?
I said it was slower, not inferior. It does provide slightly better safety, but if you've got a targeted attacker then you can still bypass the protections.
On Snowdens NSA slides, OpenBSD were noticeably absent on all slides
So were ReactOS and Haiku. OpenBSD most likely doesn't have enough market share for the NSA to care about. Things like the OpenSSL vulnerabilities that they knew about all worked fine on OpenBSD, so there was no point in investing effort in finding OpenBSD-specific exploits.
You'll also notice that OpenBSD hasn't shown up in publications in top-tier security conferences much for five or so years - exploit mitigation targets in other systems were more interesting to try to break.
It's been a few years since I did any benchmarking, but back then it was 10-20% slower than jemalloc (the FreeBSD default malloc). Some of the slowdown was hidden in microbenchmarks (worse memory fragmentation, so more cache misses after programs have been running for a while), but anything that did a lot of memory allocation - especially short-lived allocations - was noticeably slower. Unfortunately, this is the kind of overhead that encourages people like the OpenSSL devs to ship their own buggy allocators to avoid the overhead of the system one.
You realise that, in most civilised societies, all of those things are paid for by the state for people who are unable to find work? The standard of living isn't great (you'll most likely be in a shared house with quite a small bedroom), but it's enough to survive and look for work.
Re:Does it fix the performance issues?
on
OpenBSD 5.6 Released
·
· Score: 2, Interesting
OpenBSD's malloc implementation is noticeably slower than anyone else's. It is, however, more likely to make certain categories of memory management error crash the program (rather than leaving it in a state where an attacker might be able to exploit the bug). Unfortunately, most modern exploit techniques don't rely on the invariants that OpenBSD's malloc() breaks, so you end up paying the performance cost without getting much by way of security gain (unless your attacker is a script kiddie who is using 5-year-old scripts).
They haven't 'embraced LLVM/Clang', they still ship GCC 4.2.1 or GCC 3.3.6 (depending on the architecture) and compile the base system with it. They ship LLVM/Clang as packages (ports).
You're missing the point. The vulnerability is in the client, not the server. If you connect to WiFi, then you implicitly trust the WiFi access point to route your traffic. Anything unencrypted can be compromised, but your machine should be safe. With the dhcp client vulnerability, a malicious DHCP response - which can be sent by any machine on the network, not just the WiFi access point - can get a root shell on your laptop.
I came here to post something similar. We've seen a load of switchers over in FreeBSD land as a result of systemd, including one company that's currently a moderately large RedHat customer and plans to migrate before their current support contract expires.
No, because your laptop doesn't authenticate base systems either. It will try to connect to any AP that has an SSID that it recognises and (if it expects DHCP on that network, which is usually the default) send a DHCP query. And, if that AP is malicious, then you'll get the exploit code delivered to your DHCP client.
Personally, I keep my appointment book with paper and pencil. I can access it anywhere, at any time, whether or not I remembered to bring a charger, whether I'm on a plane or in a meeting
I keep my calendar on an ownCloud server that I can access from any web browser and is automatically sync'd with my phone, tablet, and laptop in the background, so any one of those devices can beep and give me reminders of appointments, and I'll notice whichever is closer to me. It also integrates with Tracere on the phone that automatically silences the ringer when I'm in a meeting.
I'm a big fan of Skagen watches. There's been a trend in men's watches to make them bigger and bigger (presumably so the wearer can say 'we are men, for we can lift big watches!' on a regular basis). I want a watch that's light and convenient and I've not found anything better. The thinnest ones that they make aren't water resistant and are light enough that you can barely feel them. I have one with a titanium mesh strap, which is marginally thicker and lighter, but I can still forget that I'm wearing a watch. The new smartwatches are just a continuation of the 'let's make watches big' trend. If I want to carry something that bulky around, I'll put it in my pocket, with my phone...
If you have a DHCP client attaching to unknown servers, shame on you
Huh? First of all, DHCP has no authentication. If I pop up on your trusted network and answer DHCP broadcast queries faster than the router, then your DHCP client will trust me. Second, you realise that that's how most operating systems are configured to work out of the box? Plug in network cable (or join WiFi network), send DHCP broadcast packet, trust the response.
Slashdot Mirror
POSIX is a superset of the UNIX Release 7 APIs, which (if APIs could be copyrighted) would be owned by AT&T. And POSIX is not as open as you think it is - until quite recently you had to pay for a copy of the spec, you still have to pay for certification, and you can only use the associated trademarks if you do. Imagine if AT&T had been able to block the creation of POSIX by claiming copyright on those APIs. Imagine if The Open Group had been able to enforce the rule that you couldn't ship anything that implements any of the POSIX APIs unless you implemented the full set and paid them for certification.
I'm the author of TFA. There's a big difference between a general purpose processor and a general purpose computer. A lot of current research in computer architecture is focussed on the idea that you have a sharp divide between accelerators and general purpose CPUs. The point of the article is that different CPU microarchitectures are specialised for different workloads (one of the cited results was that in a big.LITTLE arrangement, the A7 core runs one of the SPEC benchmarks faster than the A15 because of its lower cache access time, for example) and that there are a lot of assumptions about the kind of code that the general purpose core will run. Many of these are true for C code, but a lot less true for code written in other languages. The communication patterns that mainstream multicore processors are optimised for are heavily tied to C, to the extent that if you have a language with a shared-nothing abstraction and message passing then the only way of implementing it is horrendously inefficient at the hardware level.
It would be interesting, but it's also a question of encoding density. Having a fixed number of architectural registers (and a much larger number of microarchitectural registers) is a technique that works reasonably well. Adding more architectural registers makes your operand size very large. You could imagine something like Dalvik bytecode, with 2^32 SSA registers and a CPU able to interpret it by either using internal registers or spilling to RAM, but you'd likely end up needing huge instruction caches and not getting much (if any) speedup.
I don't know specifically, but for some GPUs there's a flag to disable strict IEEE floating point compliance. This can make things go a lot faster, at the expense of sometimes giving the wrong result. For graphics workloads, a few more floating point rounding errors are normally invisible to the human eye, but for scientific (GPGPU) computing they can be problematic.
I've not built a machine with anything other than the stock cooler for a long time, but I had a 1GHz Athlon with a Zalman flower cooler that ran stably at 1.33GHz for years and was almost silent (big, low RPM fan pushing air over it). It actually still worked when I booted it a couple of years ago, although it's too slow to care about now.
Moreover, our team was predominantly black. I could relate to my teammates without having to conform.
Why do you find black people easier to relate to than white / asian / whatever people? Why do you not feel that you have to conform when surrounded by them?
That's fine for the first office, but there's no reason not to put the satellite office elsewhere.
No, I mean that they broke the ones that OpenBSD comes with and OpenBSD hasn't added new ones for years. They're no longer interesting as a target for security research.
Our biggest problem is willingness to relocate - candidates who are already on the West Coast are so hammered by recruiters that it's hard to find anyone actually looking, but there are plenty of qualified engineers elsewhere.
Sounds like the real problem is that you are unwilling to relocate. Putting your company somewhere where the cost of living is high and there's a shortage of talent seems to be very popular, but difficult to understand. Why not find out where there's a pool of talent and open an office there? Or do what a number of tech companies have done and allow remote workers, then start building satellite offices where you find clusters of competent people.
When have you ever known a political party supporter switch affiliation because their party's policies don't work? Because the parties ideology has shifted, sure, but because they've tried their policies and they didn't work? Very rare.
Here's a suggestion: Let the people do the gerrymandering. Enlarge the electoral districts so that they overlap and allow people to select the one that they want to belong to.
The other issue with postal votes is that they make voter intimidation easier. If someone threatens or bribes you to vote with an in-person anonymous ballot, then it's easy to claim that you voted the way that they wanted, but do your own thing inside the booth. With a postal ballot, they can just ask for your ballot paper, make the marks themselves, and post it in. There were a few cases in the UK of patriarchs in immigrant families collecting all of the ballot papers and sending them all in.
You never know. If the Libertarians get in and dismantle a large part of the government, then the next guys might have a chance to rebuild it along more sensible lines...
In the UK, we have TheyWorkForYou, which is developed by mySociety, a charity that exists to provide useful tools for voters. They also run a few related sites, including WriteToThem, which provides an easy way of identifying and contacting your elected representatives.
If you want to improve the state of your government, then donating to an organisation like them is probably a much better idea than giving the money to any party.
If you claim OpenBSD malloc is inferior to other OSes, how do you explain OpenBSD as the more secure OS out there?
I said it was slower, not inferior. It does provide slightly better safety, but if you've got a targeted attacker then you can still bypass the protections.
On Snowdens NSA slides, OpenBSD were noticeably absent on all slides
So were ReactOS and Haiku. OpenBSD most likely doesn't have enough market share for the NSA to care about. Things like the OpenSSL vulnerabilities that they knew about all worked fine on OpenBSD, so there was no point in investing effort in finding OpenBSD-specific exploits.
You'll also notice that OpenBSD hasn't shown up in publications in top-tier security conferences much for five or so years - exploit mitigation targets in other systems were more interesting to try to break.
It's been a few years since I did any benchmarking, but back then it was 10-20% slower than jemalloc (the FreeBSD default malloc). Some of the slowdown was hidden in microbenchmarks (worse memory fragmentation, so more cache misses after programs have been running for a while), but anything that did a lot of memory allocation - especially short-lived allocations - was noticeably slower. Unfortunately, this is the kind of overhead that encourages people like the OpenSSL devs to ship their own buggy allocators to avoid the overhead of the system one.
You realise that, in most civilised societies, all of those things are paid for by the state for people who are unable to find work? The standard of living isn't great (you'll most likely be in a shared house with quite a small bedroom), but it's enough to survive and look for work.
OpenBSD's malloc implementation is noticeably slower than anyone else's. It is, however, more likely to make certain categories of memory management error crash the program (rather than leaving it in a state where an attacker might be able to exploit the bug). Unfortunately, most modern exploit techniques don't rely on the invariants that OpenBSD's malloc() breaks, so you end up paying the performance cost without getting much by way of security gain (unless your attacker is a script kiddie who is using 5-year-old scripts).
They haven't 'embraced LLVM/Clang', they still ship GCC 4.2.1 or GCC 3.3.6 (depending on the architecture) and compile the base system with it. They ship LLVM/Clang as packages (ports).
You're missing the point. The vulnerability is in the client, not the server. If you connect to WiFi, then you implicitly trust the WiFi access point to route your traffic. Anything unencrypted can be compromised, but your machine should be safe. With the dhcp client vulnerability, a malicious DHCP response - which can be sent by any machine on the network, not just the WiFi access point - can get a root shell on your laptop.
I came here to post something similar. We've seen a load of switchers over in FreeBSD land as a result of systemd, including one company that's currently a moderately large RedHat customer and plans to migrate before their current support contract expires.
No, because your laptop doesn't authenticate base systems either. It will try to connect to any AP that has an SSID that it recognises and (if it expects DHCP on that network, which is usually the default) send a DHCP query. And, if that AP is malicious, then you'll get the exploit code delivered to your DHCP client.
Personally, I keep my appointment book with paper and pencil. I can access it anywhere, at any time, whether or not I remembered to bring a charger, whether I'm on a plane or in a meeting
I keep my calendar on an ownCloud server that I can access from any web browser and is automatically sync'd with my phone, tablet, and laptop in the background, so any one of those devices can beep and give me reminders of appointments, and I'll notice whichever is closer to me. It also integrates with Tracere on the phone that automatically silences the ringer when I'm in a meeting.
But your way sounds good too...
I'm a big fan of Skagen watches. There's been a trend in men's watches to make them bigger and bigger (presumably so the wearer can say 'we are men, for we can lift big watches!' on a regular basis). I want a watch that's light and convenient and I've not found anything better. The thinnest ones that they make aren't water resistant and are light enough that you can barely feel them. I have one with a titanium mesh strap, which is marginally thicker and lighter, but I can still forget that I'm wearing a watch. The new smartwatches are just a continuation of the 'let's make watches big' trend. If I want to carry something that bulky around, I'll put it in my pocket, with my phone...
If you have a DHCP client attaching to unknown servers, shame on you
Huh? First of all, DHCP has no authentication. If I pop up on your trusted network and answer DHCP broadcast queries faster than the router, then your DHCP client will trust me. Second, you realise that that's how most operating systems are configured to work out of the box? Plug in network cable (or join WiFi network), send DHCP broadcast packet, trust the response.