Why does a Web browser have a built-in PDF viewer in the first place?
Because just as text/html is a commonly used media type on the web, so is application/pdf. Having a PDF viewer written in JavaScript contributes to the Downloads folder not being quite as littered. And because not only is JavaScript inherently less subject to accidental "undefined behavior" than the C++ in which I assume Adobe implemented its Reader, but also has Mozilla shown itself to be more responsive than Adobe to security issues. That's also why Mozilla has been working on Shumway, its SWF player.
Or is Firefox also planning to add a Microsoft Word viewer, an Apple Keynote viewer, etc?
Anyone who wants to write a JavaScript viewer for those formats is free to do so.
If you build an app, and nobody buys it, you have pretty much just wasted time, but probably aren't out much in terms of cash.
Some of that depends on how much a particular app store's entry fee compares to the wages in your country. Google Play Store is a lot cheaper to get into than the App Store, which requires a second computer (a Mac) and a $99 per year developer license in addition to the 30% cut that both take. And both are far cheaper than developing for a game console. True, a lot of residents of the most advanced economies can afford to drop a thousand dollars on a hobby that turns out to flop. But in less developed countries, the cost of a Mac mini, iPad mini, and developer license is a lot of money, especially if your country's currency is undervalued due to lack of a history of exports, or your country has an import duty greater than 100% like Brazil has.
There's a huge potential to make a product once, and sell it a million times, without any ongoing costs. No physical product allows you to do that.
Print-on-demand has been around a long time for books, CDs, and T-shirts, and now it's stuffed toys too (source: happytoymachine.com). As additive manufacturing matures, this will extend into other markets. A MakerBot Replicator is cheaper than a Mac Pro now.
In future, we will probably see "actual" 3D video, storing Z coordinates of pixels
How would cameras gather an X,Y->R,G,B,Z depth field like that, other than just by taking two X,Y->R,G,B pictures and guessing the depth value using computer vision algorithms, the way it's done in Kinect?
In music, files may not be pre-mixed channels of the completed sound wave and instead be many individual channels of information.
This is already true of file formats used in recording studios. But major record labels have been unwilling on the whole to distribute these to the public.
The problem comes when a consumer wants to become a power user. Without a reasonable upgrade path, the sticker shock of replacement might deter consumers from becoming power users in the first place.
But it's put on devices now, in August 2015. As for the time it was chosen:
UDF filled the role perfetly at the time exFAT was chosen, despite being [...] supported by every major operating system already
It wasn't. When exFAT was chosen, Windows XP without UDF write support was still in "extended support" (that is, eligible for security updates). In addition, operating systems still disagreed on whether or not UDF on a non-optical storage medium required a partition table.
If credit card payment through a smartphone is insecure, what alternative to a credit card would you prefer for a purchase outside a fixed store front? If cash, how much cash should people carry instead?
I don't know why FAT is even used on SD cards in the first place.
Because the SD Card Association has made a business decision to require exFAT in all SDXC certified devices. According to this page, reformatting a card to any other file system makes it no longer SDXC compliant.
But seriously, UDF already fills the role perfectly.
Except for lack of support on devices other than desktop and laptop computers. If it is mandatory for SDXC certified devices to use exFAT, a lot of lazy device makers won't test anything else. Besides, some operating systems recognize UDF only on a drive that has a partition table, others only without a partition table. (Source)
I don't know how slow they'll be, but every one of them will incur royalty payments to Microsoft because the SD spec requires all cards larger than 32 GB to be formatted in Microsoft's patented exFAT file system.
Measure how many days it takes from the vulnerability report (at least publicly) until it's patched in phones already used by customers. Focus on phones more than 2 years old, since your phone will be that age someday. Then: Don't buy from unresponsive makers.
And if it turns out that the only responsive maker is Apple, then what? If I'm developing apps for a device, I won't be able to verify my compiler toolchain using diverse double-compiling because only Xcode can sign apps for execution on an iOS device.
(Note to moderators: dwheeler popularized diverse double-compiling, a method of ensuring that a compiler is unlikely to contain self-propagating malware by bootstrapping it with other implementations of the same language.)
How about "I can't connect this computer bought elsewhere to Comcast's network because Comcast won't let me"? Good luck getting anything other than a Verizon or Sprint phone working on Verizon, Sprint, or Sprint MVNOs, because these networks use CDMA2000 instead of the more widespread GSM/UMTS.
Not unless you can guarantee that the defect will be found and patched before it's exploited.
The FakeID bug was patched before any exploit. Read again what swillden wrote: "Google also examine the contents of other app stores, and non-store app repositories. There wasn't a single instance of an app with a faked certificate chain, anywhere, until the public disclosure of the bug." Even when Google made like Flo from Progressive Insurance, scanning its own app store and those of its competitors, it still found no exploitation of this particular defect.
APIs are SUPPOSED to shield developers from constantly changing parent software, be it a browser or an OS.
Supposed to, yes, but a lot of app developers unwittingly end up depending on behaviors that the API specification called undefined, unspecified, or implementation-defined. Such dependency is a defect, but that doesn't stop applications from being published with hidden defects.
It is an insult to good developers who actually take more than 5 seconds to sit down and think, "HMMM, you know, changing this would break literally everything, better not do that!"
How about "the way we designed it it three years ago is vulnerable to a certain class of attacks that was discovered a couple months ago"? Windows Vista, for instance, had to break compatibility with interactive services because of the Shatter attack.
Among the four major U.S. networks, are there still any that don't have a carrier that itemizes the price of the phone and service?
MVNOs have been itemizing hardware and service for a long time. Among non-virtual U.S. carriers, T-Mobile led the way with its "Even More Plus" plan that did not include a handset, which eventually evolved into its current "un-carrier" pricing structure. Ting, an MVNO, started on the Sprint network and has expanded to be a T-Mobile MVNO as well. But what MVNO is any good for "unlocked" phones on Verizon (now that it's using UICCs for CDMA+LTE) or on AT&T?
But given that Microsoft has tried this live content crap several times before, and had to pull them precisely because they were security exploits... I was surprised to see them be such a prominent feature of Windows 8.
Microsoft could safely do this because the Windows Runtime sandbox used by Universal Windows Platform applications is more stringent than the user account separation used by Windows desktop applications.
Slashdot Mirror
Next step: do what AT&T did - offer financing
And T-Mobile even before that.
How would you recommend to use the same spectrum to move more data to more customers?
Why does a Web browser have a built-in PDF viewer in the first place?
Because just as text/html is a commonly used media type on the web, so is application/pdf. Having a PDF viewer written in JavaScript contributes to the Downloads folder not being quite as littered. And because not only is JavaScript inherently less subject to accidental "undefined behavior" than the C++ in which I assume Adobe implemented its Reader, but also has Mozilla shown itself to be more responsive than Adobe to security issues. That's also why Mozilla has been working on Shumway, its SWF player.
Or is Firefox also planning to add a Microsoft Word viewer, an Apple Keynote viewer, etc?
Anyone who wants to write a JavaScript viewer for those formats is free to do so.
Which PDF reader publisher do you trust more than Mozilla and Adobe?
If you build an app, and nobody buys it, you have pretty much just wasted time, but probably aren't out much in terms of cash.
Some of that depends on how much a particular app store's entry fee compares to the wages in your country. Google Play Store is a lot cheaper to get into than the App Store, which requires a second computer (a Mac) and a $99 per year developer license in addition to the 30% cut that both take. And both are far cheaper than developing for a game console. True, a lot of residents of the most advanced economies can afford to drop a thousand dollars on a hobby that turns out to flop. But in less developed countries, the cost of a Mac mini, iPad mini, and developer license is a lot of money, especially if your country's currency is undervalued due to lack of a history of exports, or your country has an import duty greater than 100% like Brazil has.
There's a huge potential to make a product once, and sell it a million times, without any ongoing costs. No physical product allows you to do that.
Print-on-demand has been around a long time for books, CDs, and T-shirts, and now it's stuffed toys too (source: happytoymachine.com). As additive manufacturing matures, this will extend into other markets. A MakerBot Replicator is cheaper than a Mac Pro now.
Usually it's a penis and not money in [porn]
But doesn't money cum out of a penis? If not, why the heck do they call it a money shot?
One last thing: When SDXC was being standardized, was UDF simple enough to fit in a cheap system-on-chip that could barely fit FAT32?
In future, we will probably see "actual" 3D video, storing Z coordinates of pixels
How would cameras gather an X,Y->R,G,B,Z depth field like that, other than just by taking two X,Y->R,G,B pictures and guessing the depth value using computer vision algorithms, the way it's done in Kinect?
In music, files may not be pre-mixed channels of the completed sound wave and instead be many individual channels of information.
This is already true of file formats used in recording studios. But major record labels have been unwilling on the whole to distribute these to the public.
The problem comes when a consumer wants to become a power user. Without a reasonable upgrade path, the sticker shock of replacement might deter consumers from becoming power users in the first place.
exFat wasn't put on any devices
But it's put on devices now, in August 2015. As for the time it was chosen:
UDF filled the role perfetly at the time exFAT was chosen, despite being [...] supported by every major operating system already
It wasn't. When exFAT was chosen, Windows XP without UDF write support was still in "extended support" (that is, eligible for security updates). In addition, operating systems still disagreed on whether or not UDF on a non-optical storage medium required a partition table.
If credit card payment through a smartphone is insecure, what alternative to a credit card would you prefer for a purchase outside a fixed store front? If cash, how much cash should people carry instead?
I don't know why FAT is even used on SD cards in the first place.
Because the SD Card Association has made a business decision to require exFAT in all SDXC certified devices. According to this page, reformatting a card to any other file system makes it no longer SDXC compliant.
But seriously, UDF already fills the role perfectly.
Except for lack of support on devices other than desktop and laptop computers. If it is mandatory for SDXC certified devices to use exFAT, a lot of lazy device makers won't test anything else. Besides, some operating systems recognize UDF only on a drive that has a partition table, others only without a partition table. (Source)
According to the German basic law, federal laws preempt state laws.
This is true of the U.S. Constitution's Supremacy Clause as well.
This, unfortunately, goes both ways - a lockout is forbidden by the Hesse constitution, but allowed on the federal level.
What kind of "lockouts"? I assume it doesn't refer to lockout mechanisms to prevent amateur software from executing on game consoles.
I don't know how slow they'll be, but every one of them will incur royalty payments to Microsoft because the SD spec requires all cards larger than 32 GB to be formatted in Microsoft's patented exFAT file system.
I thought this effort was in part to continue security updates on phones manufactured "some time ago", especially pre-Lollipop devices.
Measure how many days it takes from the vulnerability report (at least publicly) until it's patched in phones already used by customers. Focus on phones more than 2 years old, since your phone will be that age someday. Then: Don't buy from unresponsive makers.
And if it turns out that the only responsive maker is Apple, then what? If I'm developing apps for a device, I won't be able to verify my compiler toolchain using diverse double-compiling because only Xcode can sign apps for execution on an iOS device.
(Note to moderators: dwheeler popularized diverse double-compiling, a method of ensuring that a compiler is unlikely to contain self-propagating malware by bootstrapping it with other implementations of the same language.)
How about "I can't connect this computer bought elsewhere to Comcast's network because Comcast won't let me"? Good luck getting anything other than a Verizon or Sprint phone working on Verizon, Sprint, or Sprint MVNOs, because these networks use CDMA2000 instead of the more widespread GSM/UMTS.
Not unless you can guarantee that the defect will be found and patched before it's exploited.
The FakeID bug was patched before any exploit. Read again what swillden wrote: "Google also examine the contents of other app stores, and non-store app repositories. There wasn't a single instance of an app with a faked certificate chain, anywhere, until the public disclosure of the bug." Even when Google made like Flo from Progressive Insurance, scanning its own app store and those of its competitors, it still found no exploitation of this particular defect.
APIs are SUPPOSED to shield developers from constantly changing parent software, be it a browser or an OS.
Supposed to, yes, but a lot of app developers unwittingly end up depending on behaviors that the API specification called undefined, unspecified, or implementation-defined. Such dependency is a defect, but that doesn't stop applications from being published with hidden defects.
It is an insult to good developers who actually take more than 5 seconds to sit down and think, "HMMM, you know, changing this would break literally everything, better not do that!"
How about "the way we designed it it three years ago is vulnerable to a certain class of attacks that was discovered a couple months ago"? Windows Vista, for instance, had to break compatibility with interactive services because of the Shatter attack.
What phone are you using that makes it so you can barely use it when it is getting an update? Perhaps you have too many apps?
My Nexus 7 (2012) tablet running Lollipop is unusably slow while an app is being installed or updated.
Among the four major U.S. networks, are there still any that don't have a carrier that itemizes the price of the phone and service?
MVNOs have been itemizing hardware and service for a long time. Among non-virtual U.S. carriers, T-Mobile led the way with its "Even More Plus" plan that did not include a handset, which eventually evolved into its current "un-carrier" pricing structure. Ting, an MVNO, started on the Sprint network and has expanded to be a T-Mobile MVNO as well. But what MVNO is any good for "unlocked" phones on Verizon (now that it's using UICCs for CDMA+LTE) or on AT&T?
But given that Microsoft has tried this live content crap several times before, and had to pull them precisely because they were security exploits ... I was surprised to see them be such a prominent feature of Windows 8.
Microsoft could safely do this because the Windows Runtime sandbox used by Universal Windows Platform applications is more stringent than the user account separation used by Windows desktop applications.
Kitkat lowered the hardware requirements back to what Gingerbread needed.
And Lollipop raised them again. "System" processes on my Nexus 7 (2012) are using more RAM under Lollipop than they were under KitKat.
Furthermore, every federal state in Germany has their own constitution, although the basic law supersedes it, making them mostly worthless.
Are the constitutions of the several states of Germany more worthless than the constitutions of the several states of the USA?