Do you really want to start playing the disclosure game with me? Are you sure about that? Did you get clearance from your boss to play that game with me? I can go there if you want to, but I want to know you asked me to that dance with proper approvals from headquarters. Once you dance with the devil you _must_ pay his fee.
>With your penchant for vague, unsupported assertions and callous lack of empathy, you'd be excellent upper management - possibly even C-level - material. That, or a RIAA lawyer.
OK, that hurt.
I do care. I would prefer that we went with persuasion. Unfortunately I've tried persuasion and it doesn't work. We now have to deal in pain.
If you're wondering if I'm willing to burn up all my established good reputation to buy the reader the chance to read my parent comment, the answer is yes.
Now the question is how many mod points have you got?
>Point out a current remote root exploit in Windows. To the best of my knowledge, there are none.
You're kidding right? They're enumerated the second Tuesday of each month. We even have a word for it now: "Patch Tuesday". It's an IT anti-holiday. How do you not know about this?
How badly can the/. moderation system be abused? I'm not sure. Please read the cousin post and the parent and decide for yourself whether the moderation system has been abused by me or somebody else.
Y'know, sometimes there are posts that are poignant, interesting, on-topic, and yet are modded down as a troll for no better reason than people who have mod points are more interested in squelching challenging ideas. That's fine, and slashdot has a mechanism to deal with that, called Karma.
Because I have good/. Karma I can call your attention to the parent post even though I believe it's been badly moderated. Because I'm a Slashdot subscriber, I get an extra point to add to this post, which calls attention to the parent. I have enough good Karma that even if this post is moderated a troll I will have lost nothing.
I'm making this amplifying post because the parent post was moderated down in one second. It was born silenced. Obviously there were moderators prepared to prevent you from hearing my response to the question asked. Some of you might for this reason alone find my words above meaningful or intriguing.
I don't want them fixed. I am aware of several dozen remote root exploits for Windows and am sure there are hundreds I'm not aware of. But I don't have to prove it. I can say it, and Microsoft could sue me. Between the time they sued me and the time we got to court they would have to span two years of updates, in which they would have to admit several dozen remote root exploits and concede their case. They are there, and if you trawl the darker corners of the Internet you can find them. It's been twenty years and I see no evidence that Microsoft is even interested in pursuing this level of discovery - and that says a lot.
I want these faults to be exploited over and over. I want business and government to suffer until they see that this is crazy. I want them to find the answer by themselves because obviously they won't listen to me, though we've all tried to tell them many times. I want these IIS.NET websites to divulge the financial details of their members, and make them suffer, because that is the only way they will learn. Yes, some bad guys will turn a profit in the interim, which is a bad thing, but there's some pain involved in educating the fool.
If you want a secure desktop you don't consider Windows first, second, third or ever. You dismiss it out of the gate. Your proper choices are OS-X, Linux and BSD. OS-X is fine for general use, especially now that you can get Photoshop and AutoCad for it. Linux is cool for office staff - it includes office software. BSD is for the finance department and other paranoid people because the feature that can't be implemented securely in BSD won't be implemented in any serious distribution. If the question is utility versus security, the BSD community would rather have security.
But no, your question is "do you care to point these vulnerabilities out". No. No I don't. They're as plain as day for anyone who honestly looks. You can find them if you want to. If you don't see them I have to ask why? Why do you not see them? The only possible answer is that you don't want to.
Until 2008 the memristor was a theoretical construct - a presumed fourth element to complete the symmetry between resistor, inductor and capacitor. But then in a moment it went from theoretical to provably found, and the theory became real. It turns out that it took researchers this long to find it because the effect doesn't work at all in larger process sizes. They needed to try it at the recently evolved process sizes to definitively find the effect. Now they have found it, and it works. Since it's a new discovery limited by feature size at 50nm maximum, one would presume that we will need to explore new finer lithography technologies for some time before its minimum feature size is found.
The innate nature of the technology is that it's stackable. It can exploit dimension z. That's not even debatable - it's even given in the fine article. It doesn't rely on dopants embedded in the silicon, but on the junctions between mettalic elements laid upon it. It is fast. Cells are analog so it's possible to store multiple bits in a cell to the limit of how finely the programming current can be regulated, which is a factor that improves over time. It's low-power, and obviously so low-heat. There are some thermal implications for filesystems based on this storage that can best distribute the thermal load of writing, but that's a programming issue easy to overcome.
It's also already small. It doesn't even work on feature sizes larger than 50nm. We won't know how small a feature size it works on until we develop new methods of lithography that work at finer levels of resolution than it works at. It could be quite some time before that happens. We're stretching the limits of ultraviolet already and up from here is X-Rays and Gamma rays, which are hard to produce.
Between the three dimensional elements, the fine resolution elements, the multiple bits per cell elements, the high speed of access and programming, this does look like the technology to carry us forward from flash memory if it can be produced commercially. The partnership between HP and Hynix to implement commercial production does imply that it's coming. They've announced a plan and a schedule. One would presume their engineers are hard at work and the remaining practical questions involve layout of the memory grids to optimize performance to the interface and provide sufficient indirection to deal with inherent physical media reliability.
Yes, there's an available rights escalation vulnerability in recent Linux Kernels that's best patched by updating your system with the latest updates. The breathless nature of the fine summary betrays an eagerness to get Linux admins to click the links before they've done so. I'd rather not. Social engineering is such a powerful exploit mechanism after all.
The Windows geeks obviously will want to paint this as a native Linux vulnerability that they don't have - and it is marginally true. That's fine - but it's an escalation bug, not a remote root, and they've several dozen remote root bugs to close before they point fingers.
My first impression was "whoa - Gateway is still in business."
After that though, yeah. Dumb idea all the way around. They're going to get such a roasting over this. Viral Youtube videos, blog crusaders polluting every tech forum and newsgroup with this one issue, the full Tonight Show treatment. The hate that this spawns will be worth far less than all the money it could possibly bring in.
And then of course comes the question: if ideas this bad come to market, who's running the ship up there? And then the stock takes a hit.
Memristor technology doesn't even work with feature sizes that big, so it's the logical next step. Also it can be layered and so leverage Dimension Z. Products expected in three years from a joint HP and Hynix venture. No worries.
You do know that Android being open means you can choose the least fucked wireless provider, right? Android is common less than a year, so less than half of the people on contract who might choose it have done so, given that the standard contract is two years. Android is open. Google doesn't force the wireless providers to do the right thing and keep it open. Google trusts us to choose the wireless providers that let Android be the most open. They give, and though they don't require anything back it's permissible that they hope we will see that it is better to be free.
I like that. I like that Google isn't trying to force my choice - they're trying to be the best choice and attract me to choose them. That's not evil.
Microsoft paying Verizon to cripple all their Android phones with Bing that can't be removed and depriving their customers of choice, that's evil.
Microsoft is giving away their shiny new hypervisor with their operating systems. What would be more fair than for VMWare to give away operating systems with their hypervisor?
Intel now approaching release on an even newer, even better DRM system developed with secret AI Heuristics obtained in their recent acquisition of McAfee. A spokesman, who asked not to be identified, said "Trust us! This time we'll defeat those nasty pirates for sure!" The Intel technology is rumored to be based on quantum cryptography, 2Gbit keys, and something which is referred to as a "negative entropy hash".
In response we've asked Tim Jones of The Pirate Bay to comment. "Goodness. Whatever will we do? We'll never be able to decode that. Oh, wait. Those torrents come from unencrypted masters before they went to production. They're not cracked, they're leaked. Never mind. No worries."
Sony, BMG and Viacom are said to be in negotiations to license the technology.
You are correct about such things. Dell's Streak was just released and is still for sale with Donut (V1.6), which is a year old today. I don't know about the GP but it does bother me that the handset vendors and carriers are so lazy about updates, or just slow. It also bothers me when a network provider works a deal to have all their phones' search functions be crippled by an Android competitor (I'm looking at you Verizon).
This is the bad part about choice. It's important that you pay attention, that you weigh the risks. It opens the option of making a bad choice. That's why people should consider when they're choosing, and if they're not sure what they're choosing they're better off with a platform like the iPhone which offers less choice but delivers better consistency. The iPhone is a premium phone and the vast majority of utility is in the apps - where iOS is best in class. If your needs fit in the limits, it's a good choice and a safe choice.
Android is pretty new. A year ago it had less than 1% market share, but we're well on the way to figuring out what it is now, who is slow, and who is just plain crooked. A year ago it was on Donut, which didn't compare well to iOS, and now it's on FroYo, which does. The pace of progress of the platform is simply astounding and now it's at 17% of market share, which is amazing - though still less than iOS.
But there's a lot compelling about choice. There's never going to be an iPhone with a projector. External media and HDMI connectors are right out. Apple makes a few platforms, and they do them well, but they don't have grand variety. Your iPhone will never come in a seethrough blacklight reactive all-acrylic form factor, or one that snaps apart so the keyboard and display are separate. It won't ever have a fingerprint scanner, or USB ports to control standard peripherals. There's never going to be external MicroSD ports for media hot swaps. It comes in thin and thinner - there's no "extra thick for large battery" option. One day it may have swappable batteries for the road-warrior on the go. The interface to do wireless telemetry to your pacemaker won't be an option.
There's comfort in no choice and if comfort was my preference Apple certainly does it well with smooth integration, frequent updates, quality builds, impressive displays and a lot of things that others aren't doing. It's a quality experience. It's just not for me. I don't want to have the cool phone. I want to have the phone that serves my specific desires and needs. It's not about what the phone wants or needs. It's about me.
They don't get to vote in America, and we shouldn't let them count the votes either.
Look, I'm an IT guy. I completely get the labor savings, the fallibility of humans, the difference in cost. We ought to be willing to pay the cost for humans to count our votes - if it costs more, maybe we'll let less stupid stuff on the ballot, or vote less than every few months. I get that when people want to cheat, a way can often be found - though most vote-counting setups have multiple interested parties to limit the cheating. I get that the average American voter is mindless cattle whose vote can be bought with sufficient advertising. But still, I'd rather that people tried to get their cheating past other suspicious-minded people than that machines introduced the opportunity to rig elections wholesale in advance and without a trace.
In the mean time until the machines are granted the right to vote, they've got no business counting the vote.
As for the rest of it, well I believe it's been described as the worst system for managing society - except for all the others that have been tried. It's mostly working.
I responded to this elsewhere in the thread, so I'll just link it here. The choice thing is key.
Android is decidedly not being shunned in business. I work in business. I don't see anything but iPhones and Androids any more, and it's not Anecdotal. Comscore agrees. RIM still has a presence but it's fading fast. I'm still carrying around the CrackBerry at work, but an update to Epic 4G is in the plan. Android is sucking the air out of every other balloon, which means that they're getting a HUGE swath of the new unit sales - and so almost all the phone vendors' attention.
The speed of this change is nothing short of amazing. Android didn't really start to take off until Donut was released, which I note was exactly one year ago today. And now it's at 17%. That's astounding. And yet we have this fine article to tell us "choice is bad"?
Not supporting XP shuts out at least half of the current installed base. IE9 only runs on Vista and 7, and it doesn't come preinstalled on either one. At last report even when IE's preinstalled so thoroughly it can't be removed, it's not used half the time so at most the upside right now is 25%. Long uphill climb for this one, as IE share continues its slow decline in general. IE9 is not what it takes to drive W7 adoption amongst the XP installed base.
And before you tell me XP is old... it's still selling on new machines today, and it will remain available under downgrade rights for two full years after the release of the next full version of Windows. It's not going away quickly. XP has a long tail.
So yeah, even though "Cross Platform" does not mean "runs on all the current versions of Windows", IE9 doesn't even do that. Now let's talk about mobile...
Slashdot Mirror
You're so cute. You would make a good pet. Do you have a nice mane?
Do you really want to start playing the disclosure game with me? Are you sure about that? Did you get clearance from your boss to play that game with me? I can go there if you want to, but I want to know you asked me to that dance with proper approvals from headquarters. Once you dance with the devil you _must_ pay his fee.
Please pay attention. The more you mod it down, the more amplifying posts I'll make under it. You can't win. Give it up.
>With your penchant for vague, unsupported assertions and callous lack of empathy, you'd be excellent upper management - possibly even C-level - material. That, or a RIAA lawyer.
OK, that hurt.
I do care. I would prefer that we went with persuasion. Unfortunately I've tried persuasion and it doesn't work. We now have to deal in pain.
Sometimes I wish /. moderation was trackable.
If you're wondering if I'm willing to burn up all my established good reputation to buy the reader the chance to read my parent comment, the answer is yes.
Now the question is how many mod points have you got?
>Point out a current remote root exploit in Windows. To the best of my knowledge, there are none.
You're kidding right? They're enumerated the second Tuesday of each month. We even have a word for it now: "Patch Tuesday". It's an IT anti-holiday. How do you not know about this?
How badly can the /. moderation system be abused? I'm not sure. Please read the cousin post and the parent and decide for yourself whether the moderation system has been abused by me or somebody else.
If it's me, I can bear it.
Y'know, sometimes there are posts that are poignant, interesting, on-topic, and yet are modded down as a troll for no better reason than people who have mod points are more interested in squelching challenging ideas. That's fine, and slashdot has a mechanism to deal with that, called Karma.
Because I have good /. Karma I can call your attention to the parent post even though I believe it's been badly moderated. Because I'm a Slashdot subscriber, I get an extra point to add to this post, which calls attention to the parent. I have enough good Karma that even if this post is moderated a troll I will have lost nothing.
I'm making this amplifying post because the parent post was moderated down in one second. It was born silenced. Obviously there were moderators prepared to prevent you from hearing my response to the question asked. Some of you might for this reason alone find my words above meaningful or intriguing.
>Care to point them out?
No.
I don't want them fixed. I am aware of several dozen remote root exploits for Windows and am sure there are hundreds I'm not aware of. But I don't have to prove it. I can say it, and Microsoft could sue me. Between the time they sued me and the time we got to court they would have to span two years of updates, in which they would have to admit several dozen remote root exploits and concede their case. They are there, and if you trawl the darker corners of the Internet you can find them. It's been twenty years and I see no evidence that Microsoft is even interested in pursuing this level of discovery - and that says a lot.
I want these faults to be exploited over and over. I want business and government to suffer until they see that this is crazy. I want them to find the answer by themselves because obviously they won't listen to me, though we've all tried to tell them many times. I want these IIS .NET websites to divulge the financial details of their members, and make them suffer, because that is the only way they will learn. Yes, some bad guys will turn a profit in the interim, which is a bad thing, but there's some pain involved in educating the fool.
If you want a secure desktop you don't consider Windows first, second, third or ever. You dismiss it out of the gate. Your proper choices are OS-X, Linux and BSD. OS-X is fine for general use, especially now that you can get Photoshop and AutoCad for it. Linux is cool for office staff - it includes office software. BSD is for the finance department and other paranoid people because the feature that can't be implemented securely in BSD won't be implemented in any serious distribution. If the question is utility versus security, the BSD community would rather have security.
But no, your question is "do you care to point these vulnerabilities out". No. No I don't. They're as plain as day for anyone who honestly looks. You can find them if you want to. If you don't see them I have to ask why? Why do you not see them? The only possible answer is that you don't want to.
Until 2008 the memristor was a theoretical construct - a presumed fourth element to complete the symmetry between resistor, inductor and capacitor. But then in a moment it went from theoretical to provably found, and the theory became real. It turns out that it took researchers this long to find it because the effect doesn't work at all in larger process sizes. They needed to try it at the recently evolved process sizes to definitively find the effect. Now they have found it, and it works. Since it's a new discovery limited by feature size at 50nm maximum, one would presume that we will need to explore new finer lithography technologies for some time before its minimum feature size is found.
The innate nature of the technology is that it's stackable. It can exploit dimension z. That's not even debatable - it's even given in the fine article. It doesn't rely on dopants embedded in the silicon, but on the junctions between mettalic elements laid upon it. It is fast. Cells are analog so it's possible to store multiple bits in a cell to the limit of how finely the programming current can be regulated, which is a factor that improves over time. It's low-power, and obviously so low-heat. There are some thermal implications for filesystems based on this storage that can best distribute the thermal load of writing, but that's a programming issue easy to overcome.
It's also already small. It doesn't even work on feature sizes larger than 50nm. We won't know how small a feature size it works on until we develop new methods of lithography that work at finer levels of resolution than it works at. It could be quite some time before that happens. We're stretching the limits of ultraviolet already and up from here is X-Rays and Gamma rays, which are hard to produce.
Between the three dimensional elements, the fine resolution elements, the multiple bits per cell elements, the high speed of access and programming, this does look like the technology to carry us forward from flash memory if it can be produced commercially. The partnership between HP and Hynix to implement commercial production does imply that it's coming. They've announced a plan and a schedule. One would presume their engineers are hard at work and the remaining practical questions involve layout of the memory grids to optimize performance to the interface and provide sufficient indirection to deal with inherent physical media reliability.
Yes, there's an available rights escalation vulnerability in recent Linux Kernels that's best patched by updating your system with the latest updates. The breathless nature of the fine summary betrays an eagerness to get Linux admins to click the links before they've done so. I'd rather not. Social engineering is such a powerful exploit mechanism after all.
The Windows geeks obviously will want to paint this as a native Linux vulnerability that they don't have - and it is marginally true. That's fine - but it's an escalation bug, not a remote root, and they've several dozen remote root bugs to close before they point fingers.
My first impression was "whoa - Gateway is still in business."
After that though, yeah. Dumb idea all the way around. They're going to get such a roasting over this. Viral Youtube videos, blog crusaders polluting every tech forum and newsgroup with this one issue, the full Tonight Show treatment. The hate that this spawns will be worth far less than all the money it could possibly bring in.
And then of course comes the question: if ideas this bad come to market, who's running the ship up there? And then the stock takes a hit.
Memristor technology doesn't even work with feature sizes that big, so it's the logical next step. Also it can be layered and so leverage Dimension Z. Products expected in three years from a joint HP and Hynix venture. No worries.
How's that story working out for you now?
He means not just to pay for the effort. James Cameron intends to go down into the deep with this thing, himself personally.
You do know that Android being open means you can choose the least fucked wireless provider, right? Android is common less than a year, so less than half of the people on contract who might choose it have done so, given that the standard contract is two years. Android is open. Google doesn't force the wireless providers to do the right thing and keep it open. Google trusts us to choose the wireless providers that let Android be the most open. They give, and though they don't require anything back it's permissible that they hope we will see that it is better to be free.
I like that. I like that Google isn't trying to force my choice - they're trying to be the best choice and attract me to choose them. That's not evil.
Microsoft paying Verizon to cripple all their Android phones with Bing that can't be removed and depriving their customers of choice, that's evil.
Microsoft is giving away their shiny new hypervisor with their operating systems. What would be more fair than for VMWare to give away operating systems with their hypervisor?
If you're looking for the key hash article, it's here.
Intel now approaching release on an even newer, even better DRM system developed with secret AI Heuristics obtained in their recent acquisition of McAfee. A spokesman, who asked not to be identified, said "Trust us! This time we'll defeat those nasty pirates for sure!" The Intel technology is rumored to be based on quantum cryptography, 2Gbit keys, and something which is referred to as a "negative entropy hash".
In response we've asked Tim Jones of The Pirate Bay to comment. "Goodness. Whatever will we do? We'll never be able to decode that. Oh, wait. Those torrents come from unencrypted masters before they went to production. They're not cracked, they're leaked. Never mind. No worries."
Sony, BMG and Viacom are said to be in negotiations to license the technology.
You are correct about such things. Dell's Streak was just released and is still for sale with Donut (V1.6), which is a year old today. I don't know about the GP but it does bother me that the handset vendors and carriers are so lazy about updates, or just slow. It also bothers me when a network provider works a deal to have all their phones' search functions be crippled by an Android competitor (I'm looking at you Verizon).
This is the bad part about choice. It's important that you pay attention, that you weigh the risks. It opens the option of making a bad choice. That's why people should consider when they're choosing, and if they're not sure what they're choosing they're better off with a platform like the iPhone which offers less choice but delivers better consistency. The iPhone is a premium phone and the vast majority of utility is in the apps - where iOS is best in class. If your needs fit in the limits, it's a good choice and a safe choice.
Android is pretty new. A year ago it had less than 1% market share, but we're well on the way to figuring out what it is now, who is slow, and who is just plain crooked. A year ago it was on Donut, which didn't compare well to iOS, and now it's on FroYo, which does. The pace of progress of the platform is simply astounding and now it's at 17% of market share, which is amazing - though still less than iOS.
But there's a lot compelling about choice. There's never going to be an iPhone with a projector. External media and HDMI connectors are right out. Apple makes a few platforms, and they do them well, but they don't have grand variety. Your iPhone will never come in a seethrough blacklight reactive all-acrylic form factor, or one that snaps apart so the keyboard and display are separate. It won't ever have a fingerprint scanner, or USB ports to control standard peripherals. There's never going to be external MicroSD ports for media hot swaps. It comes in thin and thinner - there's no "extra thick for large battery" option. One day it may have swappable batteries for the road-warrior on the go. The interface to do wireless telemetry to your pacemaker won't be an option.
There's comfort in no choice and if comfort was my preference Apple certainly does it well with smooth integration, frequent updates, quality builds, impressive displays and a lot of things that others aren't doing. It's a quality experience. It's just not for me. I don't want to have the cool phone. I want to have the phone that serves my specific desires and needs. It's not about what the phone wants or needs. It's about me.
They don't get to vote in America, and we shouldn't let them count the votes either.
Look, I'm an IT guy. I completely get the labor savings, the fallibility of humans, the difference in cost. We ought to be willing to pay the cost for humans to count our votes - if it costs more, maybe we'll let less stupid stuff on the ballot, or vote less than every few months. I get that when people want to cheat, a way can often be found - though most vote-counting setups have multiple interested parties to limit the cheating. I get that the average American voter is mindless cattle whose vote can be bought with sufficient advertising. But still, I'd rather that people tried to get their cheating past other suspicious-minded people than that machines introduced the opportunity to rig elections wholesale in advance and without a trace.
In the mean time until the machines are granted the right to vote, they've got no business counting the vote.
As for the rest of it, well I believe it's been described as the worst system for managing society - except for all the others that have been tried. It's mostly working.
Will it come with a built-in tazer so when I see Bing search come up I can use it on my Verizon rep?
I responded to this elsewhere in the thread, so I'll just link it here. The choice thing is key.
Android is decidedly not being shunned in business. I work in business. I don't see anything but iPhones and Androids any more, and it's not Anecdotal. Comscore agrees. RIM still has a presence but it's fading fast. I'm still carrying around the CrackBerry at work, but an update to Epic 4G is in the plan. Android is sucking the air out of every other balloon, which means that they're getting a HUGE swath of the new unit sales - and so almost all the phone vendors' attention.
The speed of this change is nothing short of amazing. Android didn't really start to take off until Donut was released, which I note was exactly one year ago today. And now it's at 17%. That's astounding. And yet we have this fine article to tell us "choice is bad"?
Not supporting XP shuts out at least half of the current installed base. IE9 only runs on Vista and 7, and it doesn't come preinstalled on either one. At last report even when IE's preinstalled so thoroughly it can't be removed, it's not used half the time so at most the upside right now is 25%. Long uphill climb for this one, as IE share continues its slow decline in general. IE9 is not what it takes to drive W7 adoption amongst the XP installed base.
And before you tell me XP is old... it's still selling on new machines today, and it will remain available under downgrade rights for two full years after the release of the next full version of Windows. It's not going away quickly. XP has a long tail.
So yeah, even though "Cross Platform" does not mean "runs on all the current versions of Windows", IE9 doesn't even do that. Now let's talk about mobile...