A case in point is Auto-IP, which does the ad-hoc network configuration. It's based on an IETF draft (draft-ietf-ipv4-autoconfig-05)....too bad that Apple didn't get involved earlier, we'd only have one uniform way to do this, instead of two.
I think you should read the referenced document more carefully, and follow the links in the post above yours you'd find that the IP auto-configuration method used by Apple Rendezvous and Microsoft UPnP is identical. It's all based on what the zeroconf guys did.
Yes both Apple's and Microsoft's solutions go further, but at the low level this stuff does interoperate.
If you were also in it for the money, and created a very good system, would you want others hacking into it, and possibly loosing business becasue of it. Okay, you are still making money from selling your product, but you want more.
Good post, but you missed something here.
Microsoft (and most of the other console vendors) actually sell their consoles ataloss. They make up the profit by getting a cut of every game sold. By hacking the box and running Linux on it, you are completely removing their profit potential for that unit. Effectively, they just paid you to have a new Linux box in your living room.
I guess I shouldn't be surprised that the author of the article (and the teachers involved) overlooked a very simple solution to this that takes advantage of the very software most of these kids are using to type these papers -- their word processor. This feature is present in most word processors. It is called "AutoText" in Word, "QuickCorrect" in WordPerfect, and probably ten other names in other word processors.
In word the feature is called AutoText. This is the feature that turns "thier" into "their" as you type. I know some people rant about this being annoying in some cases, but the important aspect of it here is that it is configurable.
All these people need to do is to add the l33t words to their AutoCorrect setup. Have it convert "u" to "you", and "wuz" to "was" and so on. To take it one step further, the teachers could just create a prefab template that contains the most common ones and hand it out. Then you can choose Tools | Templates and Add-Ins... and click Organizer... to bring up a dialog that lets you (among other things) copy AutoText between files. Just copy them to your normal.dot (default template) and you are done.
I am sure other word processors have similar features, someone chime in with the procedures for those if you wish.
Not only does this fix the problem, but the student gets to see the substitutions as they type so they get the reinforcement of what the correct English form is.
Actually the real solution to this problem in the scenario you describe is to outsource your security management. Don't buy the shiny boxes in the first place, let someone else do it and pay them a monthly fee to watch them for you.
The key is people who understand networks and security, and products that actually do the job.
In an ideal world, yes. And in such an ideal world, your brilliantly trained security experts could tweak and tweak and end up with something that probably works as good or better as the much more expensive commercial solution.
There's a slight problem.
In case you haven't noticed, we don't live in an ideal world. The facts are that: (a) there are simply not enough security-savvy people to go around, (b) those that are available can command a high price, perhaps just as high or higher than what you would spend on a commercial system and (c) frankly most companies don't want to be bothered to hassle with hiring people with such esoteric knowledge.
In this, the real world, the commercial products that you deride play a vital role for such companies.
Yes, if I was running a company I would prefer to have security expertise in house doing this. But the world is full of compromises, and frankly one very valid compromise people make is to buy commercial systems instead of hiring bodies to tweak something up with Snort.
P.S. You might want to actually try out the commercial systems you deride. I think you would find that yes, the current version of RealSecure is very expensive but in the long run it saves you money because (a) it is so heavily optimized over something like snort that you end up buying less hardware to monitor the same network and (b) you don't need as many expensive propeller-heads around to set it up and run it.
Disclaimer: Yes, I own stock in ISS, and I used to work for them. They are a good company with good products.
No offense to our open-source IDS friends, but the commercial IDS world realized this exact thing at least 5 years ago. I used to work on the network based IDS products at ISS, and we started recommending this back in 1997 (when I started working there). Here is a link (PDF) to a document that describes (among other things) running RealSecure in "stealth mode" and it dates from 1998.
> I love when e-mails pop up explorer > windows with advertisements...
Even if you are forced to use Outlook and IE at work or something, there is NO NEED to tolerate this. Despite all the anti-Outlook sentiment in these pages, it is easy to configure it to avoid problems.
Simply go into the security settings in Outlook and tell it to treat all incoming HTML mail as if it were in the "Restricted Sites" zone. And make sure that EVERYTHING (especially all scripting and java) is turned off in Restricted Sites. Boom, no more email popups (or cookies tracking when you read it, etc, etc).
It is also recommended that you install the latest security patches of course. You can go to the Windows Update site and it will automatically tell you what you need.
You don't even need to be running the latest Outlook or IE to do this, and you don't need to install the "Outlook Security Update" that cripples your ability to use certain attachments. It works back to Outlook 98 and IE 4.x.
P.S. While you are tweaking Outlook, take a look at SpamNet by CloudMark. It was written up here at Slashdot a few weeks back. I've been using it since then and it does a great job of culling annoying emails for you.
Well, Ad-Aware gives the box a clean bill of health post install, but given the fact that this is a beta, I wonder if they plan on adding other components later?
I don't run my own mail server, and the idea of contributing to the signature base appeals to me, so I just downloaded this thing to try it out.
Check out this excerpt from the EULA:
Certain third-party modules may be bundled with the Software and may be provided to You subject to separate license terms, in which case they would not be covered under this Agreement. Any such separate license terms are provided in a text file accompanying each individual third-party module.
Sure sounds like a Spyware clause to me! I'll let you know when I finish installing...
I've heard various versions of this story over the years, but the best link I can find attributes it to a General Electric engineer named Charles Steinmetz (1865-1923):
One day a whole roomful of General Electric's most expensive machinery went out of order. By this time Steinmetz had retired, but the company's baffled engineers called him back as a consultant. Steinmetz ambled from machine to machine, taking a measurement here, scribbling something in his noteboook there. After about an hour, he took out a large piece of chalk and marked a large 'X' on the casing of one machine. Workers pried off the casing and found the problem at once.
When the company executives got Steinmetz's bill for $10,000, they were reluctant to pay it. "This seems a bit excessive for one chalk mark," Steinmetz was told. "Perhaps you'd better itemize your charges."
Within a few days, they received the following itemized bill:
First of all, the fact that you had to get that page from the Google cache and not from Sonicblue's own web site is a major clue that it is out of date information.
Second of all, I've owned a Replay for going on 3 years and I can report (accurately) that:
(a) So far there have been no banner ads in menus as you suggest. I'm not sure this feature even exists in the current software.
(b) While the "ad on pause" feature does still exist, it hasn't been used for a paid ad in over a year. The only ads that have appeared there recently are ads for discounted versions of Sonicblue's new products, to reward loyal Replay customers. And frankly they are not that intrusive, all you have to do is hit the EXIT button to clear them off and see the paused screen underneath.
If you are careful about the DVD mastering, you can do both, actually. Check out the Terminator 2: Ultimate Edition DVD sometime.
It's a two disk set (or two sided disk, depending on when you bought it). On the first side/disk are three different edits of the film: the original edit, the "special edition" they did for cable a few years back, and an extended edition (hidden behind an easter egg) that includes a few more scenes that aren't even in the special edition. What's great about it is everyone gets what they want: Cameron can deliver the recut version he likes best, and fans can see the other two versions as well. (Cameron's preference apparently is the middle version, which is why the longest one is hidden behind an easter egg).
How do they jam three separate edits of a 152 minute movie on one DVD? They don't. They take advantage of the seamless branching functionality that has been in the DVD format all along, and re-use the sections of the flick that are unchanged from one edit to the other.
Now, the question is: is Lucas is smart enough to do this?
I had been shopping for a PDA/phone a few months ago, and looked at the Samsung I300 and Kyocera QCP-6035, both of which are nice phones available for CDMA networks (I'm on Sprint and don't really see a new handset as a compelling reason to switch).
However I decided to wait for now for two reasons. One is that Handspring recently announced that they will be supporting CDMA (logical considering Qualcomm just invested $10 Million in them). Thus I expect a CDMA Treo will come out some time this year.
The other reason I am waiting is that Sprint PCS is about to roll out their new 3G Network this summer. Among other things, this will offer data speeds up to 10 times faster than the current network can. In fact, Wired is running a story today on the demo roadshow that Sprint is running right now to show off applications of their new network.
Sprint isn't showing any new handsets for it yet, but one will presume they are forthcoming. In fact, I'm guessing thats why the price on the QCP-6035 has dropped so preciptously (from like $300 to $100 or so) in the last couple of months---I'm guessing Kyocera has a successor model waiting in the wings.
> You can cough up 30$ a year (50$ for 2)
> and enjoy Salon in its entirety and
> completely ad-free.
Or simply do what I do. Put *.salon.com in your RESTRICTED SITES security zone, and have all scripting and plugins disabled in that zone. Voila, I never get popups on Salon. Still see some normal ads, but they are tolerable.
This doesnt work with all sites, because some also use Javascript for navigation or other essential stuff, but Salon currently doesn't.
Re:How to spam the web with links
on
Google Juice
·
· Score: 2
...a really insightful comment and it gets a +5. Then in my.sig I put a link to the URL I'm trying to promote...
You can solve that too.
Change the Googlebot so that it has a login to Slashdot. Change the comment preferences for that login so that the option:
Disable Sigs (strip sig quotes from comments)
...is checked. Voila, Google does not see sigs.
Devil's advocate: so then the person starts putting the meanintless URL's directly in the posts. Then we have to rely on moderators to notice this and not moderate it up as much.
Re:How to spam the web with links
on
Google Juice
·
· Score: 3, Insightful
A way may be found to determine if a page is a Weblog and take it out of the equation.
Or better yet, how about a way to piggyback off the weblog's own way of rating the post? I.e. pick up and use the "Score" on a post here at Slashdot to decide how to rank it? It seems like a no-brainer.
Re:How to spam the web with links
on
Google Juice
·
· Score: 2
1) Add keywords and/or URL`s to your.sig file.
This does work. I noticed my homepage has started coming up at the top in a Google search for my name. Why? Because I post to Slashdot a fair amount and my profile includes it above. I've never submitted my (crappy) home page to Google, and to my knowledge nobody intentionally links to it.
The weird part is even though it comes out tops in the rankings for my name, if you ask Google who links to that page the answer is nobody!
You can even change the thing to tell it to search using google.
But even if you do, it actually redirects through auto.search.msn.com first! See my post above on how to avoid this.
Re:Doesn't XP/IE 6 Do The SameThing?
on
Netscape 6 is Spyware?
·
· Score: 5, Informative
Yes, the article got this wrong. IE does the exact same thing if you use what they call "Auto Search".
In IE 5.5 or 6.0, if you click the SEARCH button, then click CUSTOMIZE in the panel that appears, you can choose which engine that IE uses to search for you. If you then click AUTOSEARCH SETTINGS you can set a default search engine.
Once this is done, you can type search terms in the URL box, and if they can't be somehow interpreted as a hostname or domain name, they get routed to your favorite search engine.
But not directly! They go through the host auto.search.msn.com. You can see this quite easily even if you don't have a sniffer. Simply edit your HOSTS file under Windows to redirect the name auto.search.msn.com to some other address, like the loopback address (127.0.0.1). Once you do this, your auto-searches will start failing with 404's, and you will see the URL they use to do the redirection.
I've wondered for a long time what Microsoft does with this data. Fortunately, if you are willing to do a little registry hacking and a tiny bit of extra typing, you CAN avoid this in IE. You can create keywords like "google" that you type first in the URL box, before your search term, and these are redirected from your chosen registry setting to the search engine. These do NOT redirect through MSN so Microsoft can't spy on you. Instead of typing just the "my search term" in the URL box, you type "g my search term" and it goes right to google (or whatever).
This latter ability has existed since IE 3.0, but in current versions of IE it has NOTHING configured in it by default. However, if you download this free tool from Microsoft, it adds a way to configure them. Why is this hidden off as a free download instead of included with IE? Dunno, but feel free to insert your favorite conspiracy theory here.
The BSA engages in lots of manipulation and such that I think is under-reported in the mainstream press. As I posted in the previous Slashdot article "A Look Inside the BSA", there are countries where the local BSA office is little more than a field office for Microsoft sales.
Don't take my word for it. Instead read this article from a couple years ago in Mother Jones magazine. It talks about how BSA offices end up pushing licenses for MS products even on companies that weren't illegally using them, but in fact were using other (competing) products.
For fairness, here is a link to a follow up letters column that disputes some of the facts in the article.
Slashdot Mirror
I think you should read the referenced document more carefully, and follow the links in the post above yours you'd find that the IP auto-configuration method used by Apple Rendezvous and Microsoft UPnP is identical. It's all based on what the zeroconf guys did.
Yes both Apple's and Microsoft's solutions go further, but at the low level this stuff does interoperate.
No I'm not karma whoring, already at max.
...a 2.5 million ton refrigerator to stick it on.
Good post, but you missed something here.
Microsoft (and most of the other console vendors) actually sell their consoles at a loss. They make up the profit by getting a cut of every game sold. By hacking the box and running Linux on it, you are completely removing their profit potential for that unit. Effectively, they just paid you to have a new Linux box in your living room.
In word the feature is called AutoText. This is the feature that turns "thier" into "their" as you type. I know some people rant about this being annoying in some cases, but the important aspect of it here is that it is configurable.
All these people need to do is to add the l33t words to their AutoCorrect setup. Have it convert "u" to "you", and "wuz" to "was" and so on. To take it one step further, the teachers could just create a prefab template that contains the most common ones and hand it out. Then you can choose Tools | Templates and Add-Ins... and click Organizer... to bring up a dialog that lets you (among other things) copy AutoText between files. Just copy them to your normal.dot (default template) and you are done.
I am sure other word processors have similar features, someone chime in with the procedures for those if you wish.
Not only does this fix the problem, but the student gets to see the substitutions as they type so they get the reinforcement of what the correct English form is.
Not coincidentally, ISS has a quite nice offering in this area as well.
In an ideal world, yes. And in such an ideal world, your brilliantly trained security experts could tweak and tweak and end up with something that probably works as good or better as the much more expensive commercial solution.
There's a slight problem.
In case you haven't noticed, we don't live in an ideal world. The facts are that: (a) there are simply not enough security-savvy people to go around, (b) those that are available can command a high price, perhaps just as high or higher than what you would spend on a commercial system and (c) frankly most companies don't want to be bothered to hassle with hiring people with such esoteric knowledge.
In this, the real world, the commercial products that you deride play a vital role for such companies.
Yes, if I was running a company I would prefer to have security expertise in house doing this. But the world is full of compromises, and frankly one very valid compromise people make is to buy commercial systems instead of hiring bodies to tweak something up with Snort.
P.S. You might want to actually try out the commercial systems you deride. I think you would find that yes, the current version of RealSecure is very expensive but in the long run it saves you money because (a) it is so heavily optimized over something like snort that you end up buying less hardware to monitor the same network and (b) you don't need as many expensive propeller-heads around to set it up and run it.
Disclaimer: Yes, I own stock in ISS, and I used to work for them. They are a good company with good products.
No offense to our open-source IDS friends, but the commercial IDS world realized this exact thing at least 5 years ago. I used to work on the network based IDS products at ISS, and we started recommending this back in 1997 (when I started working there). Here is a link (PDF) to a document that describes (among other things) running RealSecure in "stealth mode" and it dates from 1998.
> windows with advertisements...
Even if you are forced to use Outlook and IE at work or something, there is NO NEED to tolerate this. Despite all the anti-Outlook sentiment in these pages, it is easy to configure it to avoid problems.
Simply go into the security settings in Outlook and tell it to treat all incoming HTML mail as if it were in the "Restricted Sites" zone. And make sure that EVERYTHING (especially all scripting and java) is turned off in Restricted Sites. Boom, no more email popups (or cookies tracking when you read it, etc, etc).
It is also recommended that you install the latest security patches of course. You can go to the Windows Update site and it will automatically tell you what you need.
You don't even need to be running the latest Outlook or IE to do this, and you don't need to install the "Outlook Security Update" that cripples your ability to use certain attachments. It works back to Outlook 98 and IE 4.x.
Here is a good page on configuring Outlook to avoid malware.
P.S. While you are tweaking Outlook, take a look at SpamNet by CloudMark. It was written up here at Slashdot a few weeks back. I've been using it since then and it does a great job of culling annoying emails for you.
Well, Ad-Aware gives the box a clean bill of health post install, but given the fact that this is a beta, I wonder if they plan on adding other components later?
Check out this excerpt from the EULA:
Certain third-party modules may be bundled with the Software and may be provided to You subject to separate license terms, in which case they would not be covered under this Agreement. Any such separate license terms are provided in a text file accompanying each individual third-party module.
Sure sounds like a Spyware clause to me! I'll let you know when I finish installing...
I've heard various versions of this story over the years, but the best link I can find attributes it to a General Electric engineer named Charles Steinmetz (1865-1923):
One day a whole roomful of General Electric's most expensive machinery went out of order. By this time Steinmetz had retired, but the company's baffled engineers called him back as a consultant. Steinmetz ambled from machine to machine, taking a measurement here, scribbling something in his noteboook there. After about an hour, he took out a large piece of chalk and marked a large 'X' on the casing of one machine. Workers pried off the casing and found the problem at once.
When the company executives got Steinmetz's bill for $10,000, they were reluctant to pay it. "This seems a bit excessive for one chalk mark," Steinmetz was told. "Perhaps you'd better itemize your charges."
Within a few days, they received the following itemized bill:
Making one chalk mark $1.00
Knowing where to make one chalk mark $9,999.00
First of all, the fact that you had to get that page from the Google cache and not from Sonicblue's own web site is a major clue that it is out of date information.
Second of all, I've owned a Replay for going on 3 years and I can report (accurately) that:
(a) So far there have been no banner ads in menus as you suggest. I'm not sure this feature even exists in the current software.
(b) While the "ad on pause" feature does still exist, it hasn't been used for a paid ad in over a year. The only ads that have appeared there recently are ads for discounted versions of Sonicblue's new products, to reward loyal Replay customers. And frankly they are not that intrusive, all you have to do is hit the EXIT button to clear them off and see the paused screen underneath.
So much hysteria, so few facts.
It's a two disk set (or two sided disk, depending on when you bought it). On the first side/disk are three different edits of the film: the original edit, the "special edition" they did for cable a few years back, and an extended edition (hidden behind an easter egg) that includes a few more scenes that aren't even in the special edition. What's great about it is everyone gets what they want: Cameron can deliver the recut version he likes best, and fans can see the other two versions as well. (Cameron's preference apparently is the middle version, which is why the longest one is hidden behind an easter egg).
How do they jam three separate edits of a 152 minute movie on one DVD? They don't. They take advantage of the seamless branching functionality that has been in the DVD format all along, and re-use the sections of the flick that are unchanged from one edit to the other.
Now, the question is: is Lucas is smart enough to do this?
>
> people who can make a movie as physically engaging
> as episodes IV, V and II.
How about practicing what you preach? Lucas did not direct V, Irvin Kershner did.
Barbarella is in the list, but Forbidden Planet is not? Blasphemy!
However I decided to wait for now for two reasons. One is that Handspring recently announced that they will be supporting CDMA (logical considering Qualcomm just invested $10 Million in them). Thus I expect a CDMA Treo will come out some time this year.
The other reason I am waiting is that Sprint PCS is about to roll out their new 3G Network this summer. Among other things, this will offer data speeds up to 10 times faster than the current network can. In fact, Wired is running a story today on the demo roadshow that Sprint is running right now to show off applications of their new network.
Sprint isn't showing any new handsets for it yet, but one will presume they are forthcoming. In fact, I'm guessing thats why the price on the QCP-6035 has dropped so preciptously (from like $300 to $100 or so) in the last couple of months---I'm guessing Kyocera has a successor model waiting in the wings.
Hence I wait.
> and enjoy Salon in its entirety and
> completely ad-free.
Or simply do what I do. Put *.salon.com in your RESTRICTED SITES security zone, and have all scripting and plugins disabled in that zone. Voila, I never get popups on Salon. Still see some normal ads, but they are tolerable.
This doesnt work with all sites, because some also use Javascript for navigation or other essential stuff, but Salon currently doesn't.
You can solve that too.
Change the Googlebot so that it has a login to Slashdot. Change the comment preferences for that login so that the option:
Disable Sigs (strip sig quotes from comments)
...is checked. Voila, Google does not see sigs.
Devil's advocate: so then the person starts putting the meanintless URL's directly in the posts. Then we have to rely on moderators to notice this and not moderate it up as much.
Or better yet, how about a way to piggyback off the weblog's own way of rating the post? I.e. pick up and use the "Score" on a post here at Slashdot to decide how to rank it? It seems like a no-brainer.
This does work. I noticed my homepage has started coming up at the top in a Google search for my name. Why? Because I post to Slashdot a fair amount and my profile includes it above. I've never submitted my (crappy) home page to Google, and to my knowledge nobody intentionally links to it.
The weird part is even though it comes out tops in the rankings for my name, if you ask Google who links to that page the answer is nobody!
But even if you do, it actually redirects through auto.search.msn.com first! See my post above on how to avoid this.
In IE 5.5 or 6.0, if you click the SEARCH button, then click CUSTOMIZE in the panel that appears, you can choose which engine that IE uses to search for you. If you then click AUTOSEARCH SETTINGS you can set a default search engine.
Once this is done, you can type search terms in the URL box, and if they can't be somehow interpreted as a hostname or domain name, they get routed to your favorite search engine.
But not directly! They go through the host auto.search.msn.com. You can see this quite easily even if you don't have a sniffer. Simply edit your HOSTS file under Windows to redirect the name auto.search.msn.com to some other address, like the loopback address (127.0.0.1). Once you do this, your auto-searches will start failing with 404's, and you will see the URL they use to do the redirection.
I've wondered for a long time what Microsoft does with this data. Fortunately, if you are willing to do a little registry hacking and a tiny bit of extra typing, you CAN avoid this in IE. You can create keywords like "google" that you type first in the URL box, before your search term, and these are redirected from your chosen registry setting to the search engine. These do NOT redirect through MSN so Microsoft can't spy on you. Instead of typing just the "my search term" in the URL box, you type "g my search term" and it goes right to google (or whatever).
This latter ability has existed since IE 3.0, but in current versions of IE it has NOTHING configured in it by default. However, if you download this free tool from Microsoft, it adds a way to configure them. Why is this hidden off as a free download instead of included with IE? Dunno, but feel free to insert your favorite conspiracy theory here.
Hi Ho! Hi Ho!
Don't take my word for it. Instead read this article from a couple years ago in Mother Jones magazine. It talks about how BSA offices end up pushing licenses for MS products even on companies that weren't illegally using them, but in fact were using other (competing) products.
For fairness, here is a link to a follow up letters column that disputes some of the facts in the article.
Quite an eye-opener.