You're app really isn't that good. Piracy really isn't as big as you'd like to think it is.
I too am a developer.
I've worked on one particular app now for 7 years, there are probably 50-60k legitimate sales of the app over its lifespan. Not a huge number by any means, but if there have been 1k pirated copies installed over its entire life I would be shocked. Our app doesnt' call home, but if you use it, you're going to connect to one of a handful of sites at some point that we can identify a unique copy. We've worked with those sites to get real numbers about piracy, it happens, but its so incredibly rare that it would be a complete waste of time to even bother trying to figure out who does it, let alone do anything about the fact that they pirate it.
I call bullshit on anyone who claims 90% of the running copies were pirated, that is unless maybe you've 'cracked' your own software and given it to 9 friends, and count yourself as the 10th user and the only legitimate one. Or was it something like 'if you continue using this software, send $10 to this paypal account'? If you put any effort at all into stopping free loaders you won't see 90% from anyone, thats just not realistic and is unbelievable to say the least. Enough people are honest enough that even with no protection at all, you'll not hit that rate of piracy. Are you selling GPL'd software or something and count every instance that you didn't sell as a pirated copy? Hell, Redhat probably couldn't hit a 90% rate if they counted every freely downloaded copy of Fedora as a pirated copy. Okay, thats not true either, but really, 90%, no way.
I don't have to know anything about your app to know you're numbers are either complete made up bullshit or made up.
Really? You think the Win95 security model was a good one?
There is no such thing as a 'trusted repository', at least not in my world. The closest thing I can think of would be if Theo de raadt personally verified and signed packages. Even then, thats still a maybe, I've seen him miss plenty of bugs over the user that lead to exploits.
When you start lowering your security to less than that of Windows, and your developers working on it don't have the slightest idea of the concepts involved (they don't, I took the time to read the entire discussion), and to make it worse they have this 'I know more than you can possibly understand and I'm right' attitude, even when its pointed out how this is going to make many systems insecure due to dependancies and no one is going to know because the mailing list discussion is the only note about it... something is clearly wrong.
The entire thing makes it extremely clear that you can't trust them to make intelligent security decisions. Hell, they STILL haven't even accepted that it was a mistake, the response is more of a wishy-washy 'We are still right, but were going to change it to shut you guys up, we will just do it again later and see if you notice it then'.
Might as well just sing out: Fedora - The distributions botnets and malware prefer for Linux.
It's more like if you payed for a room at the Waldorf Astoria [*], they took your money, and then they told you that you couldn't stay there because they didn't like the way you looked (your haircut, or whatever) and didn't give you a refund for the nights you had already paid for.
No its more like you payed for a room at the Waldorf Astoria, then they threw the girl you brought with you out on the street cause it looked, convincingly like she's a whore.
About 2 people were having sex with their slutty looking wives, the other 600k people were having sex with prostitutes.
What you are describing doesn't leave you out money you paid for a service. What is going on here is people paid for access to a service, and are being refused access to it without being given a refund.
No, you certainly can continue to use XBox Live with the account just not the modded xbox. To continue your analogy, you're welcome to use your room to fuck someones brains out, you just have to bring someone else, the prostitute isn't allowed back in.
All things considered, since you broke the rules, they are being entirely fair. If it were myself I'd ban your account completely regardless of xbox, probably any known credit card or bank accounts used with the account as well since you are clearly breaking the rules you agreed to, entirely acceptable rules by any sane definition.
Adobe can go suck a nut until they fix their software to allow installation on a case sensitive filesystem. As soon as I find an acceptable replacement for Illustrator for creating standards compliant SVGs, I'm done with Adobe.
And before anyone says it, no Inkscape is not acceptable unless you like SVGs that are about as standard as Word HTML.
And how well do you think this will go over with corporations which require specific extensions to be used by employees?
I know of several that have required extensions for Thunderbird, users aren't allowed to disable them. The user is not always authorized to make changes like this to the system.
You have a very limited view of the computing world.
I do, but far too many times has the addon been compatible but disabled because it says its only valid for older versions. So they have to upgrade, go through a hassle and delay as I have to package up a new version, which is part of a larger package, so that has to be rebuilt, uploaded blah blah blah.
Nothing particularly hard, but I've yet to have the plugin broken by a Firefox upgrade. I did have one case where functionality was reduced but the plugin detected it and fall back to another method anyway, which was a check to deal with a situation caused by another plugin changing some core functions (javascript) of the UI.
I know why its there, I don't think its a bad idea, but trusting the plugin to be honest is a mistake on their part, and forcing the plugin to be disabled with no easy way to reenable it is just freaking annoying to users when you release new versions as often as Mozilla does.
Geeks may be fine with tweaking and hax0ring all the time, the random people our software sells to on the other hand just want things to work so my way works better for them.
Not one bit, my add ons are part of a commercial service and would be of no use to anyone on addons.mozilla.org. Of course, pretty much none of the ones on addons.mozilla.org are effected by this change anyway since they've already been given the once over and told to fix those sort of issues anyway.
I've got a box sitting right here, I'd love to see you boot from a LiveCD. Not real sure how you're going to do it considering the CD isn't part of the boot sequence and the BIOS is locked with a password.
You could try to move the drive to a new machine if you'd like, but since thats going to require you digging it out from behind a table, with several large items sitting on top of it, I'm probably going to notice you doing it. Did I mention the case also has a lock on it?
I let plenty of random people use it, its a shared workstation in a hotel for guests to use.
Now, with that in mind, how safe does it sound now?
This is a retarded policy choice no matter how you look at it by a couple of douce bag milkshakes who shouldn't be allowed to commit to any repository on the planet, even their on personal one.
While its unlikely you'll see malware signed in the Fedora repositories, you'll find fairly quickly that 'the bad guys' are the FIRST to comply with things designed to stop them.
Spammers were the FIRST in line to support domain keys AND SPF.
Malware authors were the FIRST to have their ActiveX controls and malware installers signed.
So yes, there is a lot of signed malware out there.
A good developer will develop as a normal user, no development environment I'm aware of actually requires elevated privs for standard development, including Visual Studio using IIS for web apps if you invest the 30 seconds it takes to google for the solution in older versions, newer versions run their own webserver as needed to avoid that problem as well.
A good developer will test on clean machines/fresh installs regularly.
A good developer will test on locked down machines regularly.
A good developer will write an application that doesn't require any specific additional privileges unless they are truly needed, and they'll document what those privileges are and why they are needed.
A good developer has no problem dealing with Nazi admins, the developer will know how to explain EXACTLY why elevated privileges are needed to the admin and what safety precautions are in place or should be observed to limit potential breeches due to those privs.
This problem is a result of cluelessness on the part of the devs who created it, I classify it as a dangerous/critical bug.
Even MS doesn't allow this sort of thing by default. You can trust a particular publisher, which is commonly used in large corps to trust internally developed and signed software, but out of the box, being signed doesn't help you.
Admins act like they do because users with too many privs have a tendency to make their lives hell, so they lock things down to prevent some ignorant user from breaking their system and requiring the admin to do more work, there is nothing wrong with this, especially for company PCs. The biggest problem here is that too many people have this sense of entitlement and seem to think they should be allowed to do whatever they want on their work PC which is simply wrong.
A good developer creates software that a good admin will be happy to run. The only time there is conflict is when one or both of the parties are unskilled and/or ignorant.
I've done both jobs, and currently function as a developer. I started out as a developer, got thrown in the sys admin position working with some very talented people who I learned a great deal from. Now, being back in the developer seat again I can write software that makes admins happy. Which I do, and its used by a few very large and very locked down companies, without any major issues.
Admins that no nothing about software development are a problem.
Developers that no nothing about administration are a problem.
If you've got either one of the above you have a bad situation, but these is no struggle between the two groups, only struggles with ignorant/incompetent versions of either or both.
If, out of the box, this setup allows a user to install a package 'signed' by 'anyone' then the admins have every right to be upset, its unlikely thats the way its supposed to function. Very few admins would take issue with having the ability to allow certain signers to install without elevated privileges, those that do take issue with it are probably more concerned with the fact that these developers have already screwed it up more than the actual feature.
I doubt any dev would want it so ANY package with a valid signature could be installed, theres no real reason for it. I can believe that would like some ability to have installation of certain signers as well though, so again, this is probably a bug.
If by some chance that the intended functionality is that out of the box any package with a valid signature (or for that matter if there is a preset list of accepted valid signers out of the box) then everyone that has written the code, reviewed the code or approved of the idea should not be allowed to write code.
I accept bugs, shit happens, if this is intended as I understand it, everyone involved in this 'feature' that approved of it needs not be allowed to participate in any software development again. Ignor
Most cameras do, they just don't use a RTC value to do so.
You don't want it continually focusing, you want it to focus then wait a bit otherwise it'll bounce all over the place. You check the distance, wait a moment, and check again, is it close to the same? If so use that as your focal length, other wise you'll probably end up never in focus cause you'll be using all the various raw values given to you by the sensor. This is likely input averaging to get a smooth value and throw out bad samples.
Take a look at the raw input values provided by most game controllers, try to hold an analog stick in one spot and not get jitter in the raw values, unless the device itself is averaging you won't got a solid result. Plug a xbox controller into your PC and use the Windows control panel (if you're using windows, never plugged a joystick into a unix box myself) to see how jumpy it is.
A sensor measuring the environment outside, in someones hand is going to bounce around like a mad man, so it has to be smoothed out somehow.
Seems like having a system timer trigger the auto focus update event would be a far better method of dealing with it rather than polling to check if its time to update again in some sort of loop.
Android DOES have timers usable by drivers doesn't it? Requiring drivers to poll would be very shitty indeed, especially on devices with lower CPU power..
You do get notified when at least some of those methods are used the next time you start Firefox. Pretty sure it's been that way since shortly after the MS plugin fiasco.
We see evolution taking away limbs but never adding new ones.
Really? Then how did we evolve from single celled organisms into creatures with 2 arms and 2 legs? How did the octopus get 8?
It all happens in the same way, just in reverse. A tiny bump gets used more and more and extends and each mutation that is actually beneficial continues down the linage. When a creature no longer has use of a limb it may go away over time, in which case they tend to atrophy over the linage and shrink and eventually go away.
It works both ways, even if you aren't aware of any specific examples.
The MS plugin is not effected by this. It did things in the proper way, the documented method for adding system wide extensions rather than user level extensions. That is why Mozilla could easily disable the insecure version of the plugin, because it actually followed the rules.
MS just added a registry key that pointed at the files for the extension, which is well documented and used by many other pieces of software to allow plugins to be installed even before Firefox, and allowing any version of Firefox (or Thunderbird or whatever) to find them, even after installation into some random directory.
If you bother to read the article, it says the same. Google Desktop Search on the other hand, doesn't follow the rules and will be blocked unless Mozilla makes a work around for them or Google updates GDS to follow the rules.
This is essentially like not allowing code from anyone other than MS to be dropped into the Windows directory, and requiring it to be put somewhere else and properly registered with the system rather than throwing it in the system32 directory and loading it as if it were trusted code from MS.
Doesn't effect that at all. Microsoft used a specific method available to Firefox plugins to add a reference to the Microsoft plugin. MS did not drop their extension in the firefox directory, they just added a registry key (in the documented way) to point to where their extension was.
Works great, till you have someone like myself, who just specifies that my components are compatible with Firefox 2.* to 10.* so I don't have to worry about a new version claiming my plugin isn't compatible even though it is, which has happened enough in the past that I just don't care anymore.
Am I wrong? Yes. Is Mozilla wrong? Yes, you never trust the external code to tell you the truth, basic programming 101.
I have found that though I can tell the difference between a FLAC and 128Kbps MP3, most of my friends can't. Most of them, if I play the same song back to back, one FLAC and one MP3, they will almost always pick the MP3.
Sounds to me like they are capable of determining they are different. If they couldn't tell the difference you'd have a nearly perfect distribution of who picked which type.
By playing them back to back you aren't checking for things that sound the same you are checking for which one they prefer, which is the mp3, because thats what they are used to.
Thus the "ammo" for the laser is no longer limited by custom nasty liquid fuels, but by the available jet fuel in the plane, which already has an extensive refueling infrastructure readily available, aka a tanker refuel.
You realize that tanker is actually carrying... liquid fuel right? And that the aircraft is powered by... liquid fuel, which you are then suggesting to use to power the weapons package.
Regardless of how you look at it the energy has to come from somewhere. If electricity from the turbine was more efficient, that would probably be the energy source used. However conversion and the related losses make it so that right now its more efficient to carry a separate weapons specific fuel payload. Just like is done with every other form of weapon on the aircraft. Missiles use their own solid propellents, as do cannons. Use the right power supply for the job.
Its not like it would be overly difficult to add a refueling system to deal with this secondary weapons system if it were that useful.
In reality, air to air refueling isn't done to keep an aircraft in combat longer, its to keep it on station (without being in combat) longer or to allow it an extended range. After a pilot has had an encounter he/she generally needs some cool down and recovery time from the stress alone, not to mention that the aircraft generally needs some maintenance work. It doesn't happen like you see in the movies. Pilots don't shoot down 8 aircraft with missiles then 5 or 6 with the cannon and hang out for a while covering their wingman while Iceman slides in for the shot on Viper. Even if the weapon provided an endless supply of shots, all you would be doing is ending up with a pilot who stayed in combat until fatigued to the point of being killed. Then you've lost a good man and an aircraft.
Slashdot Mirror
You're app really isn't that good. Piracy really isn't as big as you'd like to think it is.
I too am a developer.
I've worked on one particular app now for 7 years, there are probably 50-60k legitimate sales of the app over its lifespan. Not a huge number by any means, but if there have been 1k pirated copies installed over its entire life I would be shocked. Our app doesnt' call home, but if you use it, you're going to connect to one of a handful of sites at some point that we can identify a unique copy. We've worked with those sites to get real numbers about piracy, it happens, but its so incredibly rare that it would be a complete waste of time to even bother trying to figure out who does it, let alone do anything about the fact that they pirate it.
I call bullshit on anyone who claims 90% of the running copies were pirated, that is unless maybe you've 'cracked' your own software and given it to 9 friends, and count yourself as the 10th user and the only legitimate one. Or was it something like 'if you continue using this software, send $10 to this paypal account'? If you put any effort at all into stopping free loaders you won't see 90% from anyone, thats just not realistic and is unbelievable to say the least. Enough people are honest enough that even with no protection at all, you'll not hit that rate of piracy. Are you selling GPL'd software or something and count every instance that you didn't sell as a pirated copy? Hell, Redhat probably couldn't hit a 90% rate if they counted every freely downloaded copy of Fedora as a pirated copy. Okay, thats not true either, but really, 90%, no way.
I don't have to know anything about your app to know you're numbers are either complete made up bullshit or made up.
Do you work for the BSA or something?
Really? You think the Win95 security model was a good one?
There is no such thing as a 'trusted repository', at least not in my world. The closest thing I can think of would be if Theo de raadt personally verified and signed packages. Even then, thats still a maybe, I've seen him miss plenty of bugs over the user that lead to exploits.
When you start lowering your security to less than that of Windows, and your developers working on it don't have the slightest idea of the concepts involved (they don't, I took the time to read the entire discussion), and to make it worse they have this 'I know more than you can possibly understand and I'm right' attitude, even when its pointed out how this is going to make many systems insecure due to dependancies and no one is going to know because the mailing list discussion is the only note about it ... something is clearly wrong.
The entire thing makes it extremely clear that you can't trust them to make intelligent security decisions. Hell, they STILL haven't even accepted that it was a mistake, the response is more of a wishy-washy 'We are still right, but were going to change it to shut you guys up, we will just do it again later and see if you notice it then'.
Might as well just sing out:
Fedora - The distributions botnets and malware prefer for Linux.
Seriously?
No its more like you payed for a room at the Waldorf Astoria, then they threw the girl you brought with you out on the street cause it looked, convincingly like she's a whore.
About 2 people were having sex with their slutty looking wives, the other 600k people were having sex with prostitutes.
No, you certainly can continue to use XBox Live with the account just not the modded xbox. To continue your analogy, you're welcome to use your room to fuck someones brains out, you just have to bring someone else, the prostitute isn't allowed back in.
All things considered, since you broke the rules, they are being entirely fair. If it were myself I'd ban your account completely regardless of xbox, probably any known credit card or bank accounts used with the account as well since you are clearly breaking the rules you agreed to, entirely acceptable rules by any sane definition.
So Windows it is then.
Yes, we've established time and time again that the slashdot crowd is atypical.
Adobe can go suck a nut until they fix their software to allow installation on a case sensitive filesystem. As soon as I find an acceptable replacement for Illustrator for creating standards compliant SVGs, I'm done with Adobe.
And before anyone says it, no Inkscape is not acceptable unless you like SVGs that are about as standard as Word HTML.
And how well do you think this will go over with corporations which require specific extensions to be used by employees?
I know of several that have required extensions for Thunderbird, users aren't allowed to disable them. The user is not always authorized to make changes like this to the system.
You have a very limited view of the computing world.
I do, but far too many times has the addon been compatible but disabled because it says its only valid for older versions. So they have to upgrade, go through a hassle and delay as I have to package up a new version, which is part of a larger package, so that has to be rebuilt, uploaded blah blah blah.
Nothing particularly hard, but I've yet to have the plugin broken by a Firefox upgrade. I did have one case where functionality was reduced but the plugin detected it and fall back to another method anyway, which was a check to deal with a situation caused by another plugin changing some core functions (javascript) of the UI.
I know why its there, I don't think its a bad idea, but trusting the plugin to be honest is a mistake on their part, and forcing the plugin to be disabled with no easy way to reenable it is just freaking annoying to users when you release new versions as often as Mozilla does.
Geeks may be fine with tweaking and hax0ring all the time, the random people our software sells to on the other hand just want things to work so my way works better for them.
Not one bit, my add ons are part of a commercial service and would be of no use to anyone on addons.mozilla.org. Of course, pretty much none of the ones on addons.mozilla.org are effected by this change anyway since they've already been given the once over and told to fix those sort of issues anyway.
Silly is one way to describe it. I think sad is more appropriate.
I've got a box sitting right here, I'd love to see you boot from a LiveCD. Not real sure how you're going to do it considering the CD isn't part of the boot sequence and the BIOS is locked with a password.
You could try to move the drive to a new machine if you'd like, but since thats going to require you digging it out from behind a table, with several large items sitting on top of it, I'm probably going to notice you doing it. Did I mention the case also has a lock on it?
I let plenty of random people use it, its a shared workstation in a hotel for guests to use.
Now, with that in mind, how safe does it sound now?
This is a retarded policy choice no matter how you look at it by a couple of douce bag milkshakes who shouldn't be allowed to commit to any repository on the planet, even their on personal one.
While its unlikely you'll see malware signed in the Fedora repositories, you'll find fairly quickly that 'the bad guys' are the FIRST to comply with things designed to stop them.
Spammers were the FIRST in line to support domain keys AND SPF.
Malware authors were the FIRST to have their ActiveX controls and malware installers signed.
So yes, there is a lot of signed malware out there.
A good sys admin acting as a developer is fine.
What you describe is a shitty developer.
A good developer will develop as a normal user, no development environment I'm aware of actually requires elevated privs for standard development, including Visual Studio using IIS for web apps if you invest the 30 seconds it takes to google for the solution in older versions, newer versions run their own webserver as needed to avoid that problem as well.
A good developer will test on clean machines/fresh installs regularly.
A good developer will test on locked down machines regularly.
A good developer will write an application that doesn't require any specific additional privileges unless they are truly needed, and they'll document what those privileges are and why they are needed.
A good developer has no problem dealing with Nazi admins, the developer will know how to explain EXACTLY why elevated privileges are needed to the admin and what safety precautions are in place or should be observed to limit potential breeches due to those privs.
This problem is a result of cluelessness on the part of the devs who created it, I classify it as a dangerous/critical bug.
Even MS doesn't allow this sort of thing by default. You can trust a particular publisher, which is commonly used in large corps to trust internally developed and signed software, but out of the box, being signed doesn't help you.
Admins act like they do because users with too many privs have a tendency to make their lives hell, so they lock things down to prevent some ignorant user from breaking their system and requiring the admin to do more work, there is nothing wrong with this, especially for company PCs. The biggest problem here is that too many people have this sense of entitlement and seem to think they should be allowed to do whatever they want on their work PC which is simply wrong.
A good developer creates software that a good admin will be happy to run. The only time there is conflict is when one or both of the parties are unskilled and/or ignorant.
I've done both jobs, and currently function as a developer. I started out as a developer, got thrown in the sys admin position working with some very talented people who I learned a great deal from. Now, being back in the developer seat again I can write software that makes admins happy. Which I do, and its used by a few very large and very locked down companies, without any major issues.
Admins that no nothing about software development are a problem.
Developers that no nothing about administration are a problem.
If you've got either one of the above you have a bad situation, but these is no struggle between the two groups, only struggles with ignorant/incompetent versions of either or both.
If, out of the box, this setup allows a user to install a package 'signed' by 'anyone' then the admins have every right to be upset, its unlikely thats the way its supposed to function. Very few admins would take issue with having the ability to allow certain signers to install without elevated privileges, those that do take issue with it are probably more concerned with the fact that these developers have already screwed it up more than the actual feature.
I doubt any dev would want it so ANY package with a valid signature could be installed, theres no real reason for it. I can believe that would like some ability to have installation of certain signers as well though, so again, this is probably a bug.
If by some chance that the intended functionality is that out of the box any package with a valid signature (or for that matter if there is a preset list of accepted valid signers out of the box) then everyone that has written the code, reviewed the code or approved of the idea should not be allowed to write code.
I accept bugs, shit happens, if this is intended as I understand it, everyone involved in this 'feature' that approved of it needs not be allowed to participate in any software development again. Ignor
The patch is already available, see your doctor.
Most cameras do, they just don't use a RTC value to do so.
You don't want it continually focusing, you want it to focus then wait a bit otherwise it'll bounce all over the place. You check the distance, wait a moment, and check again, is it close to the same? If so use that as your focal length, other wise you'll probably end up never in focus cause you'll be using all the various raw values given to you by the sensor. This is likely input averaging to get a smooth value and throw out bad samples.
Take a look at the raw input values provided by most game controllers, try to hold an analog stick in one spot and not get jitter in the raw values, unless the device itself is averaging you won't got a solid result. Plug a xbox controller into your PC and use the Windows control panel (if you're using windows, never plugged a joystick into a unix box myself) to see how jumpy it is.
A sensor measuring the environment outside, in someones hand is going to bounce around like a mad man, so it has to be smoothed out somehow.
Seems like having a system timer trigger the auto focus update event would be a far better method of dealing with it rather than polling to check if its time to update again in some sort of loop.
Android DOES have timers usable by drivers doesn't it? Requiring drivers to poll would be very shitty indeed, especially on devices with lower CPU power..
You do get notified when at least some of those methods are used the next time you start Firefox. Pretty sure it's been that way since shortly after the MS plugin fiasco.
Really? Then how did we evolve from single celled organisms into creatures with 2 arms and 2 legs? How did the octopus get 8?
It all happens in the same way, just in reverse. A tiny bump gets used more and more and extends and each mutation that is actually beneficial continues down the linage. When a creature no longer has use of a limb it may go away over time, in which case they tend to atrophy over the linage and shrink and eventually go away.
It works both ways, even if you aren't aware of any specific examples.
The MS plugin is not effected by this. It did things in the proper way, the documented method for adding system wide extensions rather than user level extensions. That is why Mozilla could easily disable the insecure version of the plugin, because it actually followed the rules.
MS just added a registry key that pointed at the files for the extension, which is well documented and used by many other pieces of software to allow plugins to be installed even before Firefox, and allowing any version of Firefox (or Thunderbird or whatever) to find them, even after installation into some random directory.
If you bother to read the article, it says the same. Google Desktop Search on the other hand, doesn't follow the rules and will be blocked unless Mozilla makes a work around for them or Google updates GDS to follow the rules.
This is essentially like not allowing code from anyone other than MS to be dropped into the Windows directory, and requiring it to be put somewhere else and properly registered with the system rather than throwing it in the system32 directory and loading it as if it were trusted code from MS.
Doesn't effect that at all. Microsoft used a specific method available to Firefox plugins to add a reference to the Microsoft plugin. MS did not drop their extension in the firefox directory, they just added a registry key (in the documented way) to point to where their extension was.
You can still do that.
Works great, till you have someone like myself, who just specifies that my components are compatible with Firefox 2.* to 10.* so I don't have to worry about a new version claiming my plugin isn't compatible even though it is, which has happened enough in the past that I just don't care anymore.
Am I wrong? Yes. Is Mozilla wrong? Yes, you never trust the external code to tell you the truth, basic programming 101.
Sounds to me like they are capable of determining they are different. If they couldn't tell the difference you'd have a nearly perfect distribution of who picked which type.
By playing them back to back you aren't checking for things that sound the same you are checking for which one they prefer, which is the mp3, because thats what they are used to.
You realize that tanker is actually carrying ... liquid fuel right? And that the aircraft is powered by ... liquid fuel, which you are then suggesting to use to power the weapons package.
Regardless of how you look at it the energy has to come from somewhere. If electricity from the turbine was more efficient, that would probably be the energy source used. However conversion and the related losses make it so that right now its more efficient to carry a separate weapons specific fuel payload. Just like is done with every other form of weapon on the aircraft. Missiles use their own solid propellents, as do cannons. Use the right power supply for the job.
Its not like it would be overly difficult to add a refueling system to deal with this secondary weapons system if it were that useful.
In reality, air to air refueling isn't done to keep an aircraft in combat longer, its to keep it on station (without being in combat) longer or to allow it an extended range. After a pilot has had an encounter he/she generally needs some cool down and recovery time from the stress alone, not to mention that the aircraft generally needs some maintenance work. It doesn't happen like you see in the movies. Pilots don't shoot down 8 aircraft with missiles then 5 or 6 with the cannon and hang out for a while covering their wingman while Iceman slides in for the shot on Viper. Even if the weapon provided an endless supply of shots, all you would be doing is ending up with a pilot who stayed in combat until fatigued to the point of being killed. Then you've lost a good man and an aircraft.
Reflective to what part of the spectrum?
Clouds don't block all wavelengths equally, nor does a mirror reflect all wavelengths equally.