The Daily Mail? That's the one with the cover article of: 'Name the Devil Boys, we must not let them hide', and whose cover photo is 'End of Brangelina'? Oh, dear. Yes, I'll assume they didn't quote anything out of context, shall I?
I've apparently violated Slashdot rules and actually looked at the article. His suit basically looks like a space suit, unsurprisingly. I'm very curious about its maneuverability, and if he's tried it in one of those vertical wind tunnels used for testing skydiving gear, or if it's a reconditioned flight suit for a military pilot, or what.
A suit with big levered fins that make it spin like a propeller would be "high drag". That's an absolute no-no for this: the spin at Mach 1 in thin air would be ludicrous, and could cause fascinating circulation problems to whatever the furthest organs are from his axis. If he's spinning sideways, as might occur of he's falling face down like most skydivers, that could knock him out pretty easily.
I read what you wrote. I took you seriously. The IE vulnerability was fairly minor at the time Microsoft was notified, as I understand the timeline: there were far more active and dangerous vulnerabilities already in the pipeline. Compared to the plethora of _other_ IE flaws, it was understandably dealt with at a low priority level.
This one has merely gotten more attention due to the Chinese/Google situation, but make no mistake, it's not that big a deal compared to the other huge security flaws going on. If such dangerous flaws were taken seriously, for an open source xample, Subversion would have stopped automatically storing your SSH, HTTPS, and HTTP passwords in cleartext years ago.
You've got it backwards. What is _more_ critical? A bug that prevents Microsoft from booting on new OEM systems? A bug that fails to reset IE as your default web browser? A bug that breaks the MS update tools and blocks other updates? A bug that causes 2003 servers to crash on Jan 1., 2010?
I don't know the full set of bugs recently patched, but a fast look at Windows Update shows a whole stack of "Windows Defender" updates, and other security updates, that were doubtless already in the queue.
There is enough of it to make a meaningful comparison. Take a look at Phil Zimmermans's conviction for publishing PGP. I'd agree that it is not _equivalent_, but I'd say that its extent and its pernicious nature do allow it to be compared to Chinese censorship. If you disagree, go try to get a copy of "The Anarchist's Cookbook" at your local city library.
Oh, there will be lateral drift due to the wind at maximum altitude, versus the wind at every altitude below that.
For reference, the speed of sound is _slower_ at higher altitudes. There is a chart at http://www.aerospaceweb.org/question/atmosphere/q0112.shtml. And for him to achieve transonic speeds for parts of his body but not other parts, he'll be breaking the local sound barrier.
Breaking the sound barrier also produces a _profound_ braking effect: you wind up providing tremendous power to compress the medium in front of you. All that energy that goes into the shock wave and the turbulence as you pass through the medium and the "sonic boom" itself, is a continuing drain on your kinetic energy. So I suspect his speed will max out at or barely above the sound barrier, and he'll certainly slow more rapidly as he hits thicker air and experiences more drag, slowing all the way to his freefall velocity in the denser air. That depends a lot on the shape of his suit: I'd expect him to want a high drag suit for maximum fall time.
Maybe, just maybe, they should throw out most XML use. It's expandability and flexibility have caused repeated security and performance issues, and it's being used consistently instead of far simpler and more robust configuration technologies.
Not to defend Microsoft's consistent failure to address security issues, but 4 months is not an unusual release time for a non-critical bug. It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well. And for we who install patches, we expect official vendor patches to _not break other things_.
The risk of breaking things with an untested patch has to be measured against the risk of leaving the vulnerability open: this is why so many server-class systems out there have _no_ scheduled updates, and rely on "we trust the people we work with" to protect their internal services, and will never _get_ this recently published patch.
We'll see micropayments work when we see fusion power. The overhead of authentication and actually processing money are so large that they are simply not practical for normal email, and the kind of idiot who does spamming now would simply steal funds from your mail servers.
_Reporting_ spam is often routed to the help desk. And the intricacies of reporting the entire, unedited message with all the headers intact is often beyond a casual email user. Particularly irritating email also climbs up the reporting priority list and wastes helpdesk time, such as email being forged from one domain to pretend that it is from another domain and getting other people's email being blocked or taking advantage of their whitelisted domains (known as "joe jobs").
Let's keep a sense of scale. Guantanamo Bay, and a lot going on in Iraq and Afghanistan, is awful and the information tightly controlled. But given that China willingly and effectively censors political speech and porn, but is unwilling or unable to do anything about the 99% spam email coming from their domains, is an indication that they can't be bothered with censoring criminal behavior. They only censor political or politically embarrassing behavior.
It is strong, considering that "censorship" does include US censorship. The Chinese are far worse about this, but given that child pornography, atom bomb plans, and cryptography have all been limited by the US government, we can't claim complete innocence. And US companies have accepted cryptography censorship as a part of selling software internationally for decades.
I'm glad at Clinton's stand, but the devil is in the details. We'll see if this helps reduce censorship in the USA as well as in China and other, more politically repressive domains worldwide. In fact, helping fund Wikileaks would be a great step in supporting free speech: if you've recovered from your Christmas bills, now might be a good time to send them a money order.
For RHN, you don't get the service and the upstream package management and system integration tools. You get access to updates whenever CentOS gets around to them, which is actually quite fast. I have no issue with a RedHat tech being helpful for you, and helping you steer around their licensing. It's just the claim that you automatically get all RHEL software. Things like VMWare cooperation and XFS (you were right, that's what I meant) are reliant on tools that are not in the RHEL published SRPM's.
And switching between RHEL and CentOS is a bit trickier than you may realize. There are some conflicting packages, such as the "redhat-release" versus "centos-release", and various oddities that RHEL did to yum. Ideally, you also need to replace every single RPM with the RHEL version, even if the "release" number is identical or slightly older from the RHEL version. That takes a local repository of all the RedHat packages, or of CentOS, and keeping track of which ones have been successfully replaced. It's bothersome, especially if you've been using tools from the centosplus repository such as kernels (which enable NTFS, RHEL does not).
No, you can't use it all for free. You don't get RHN, you don't get ZFS, you don't get RedHat trademarks, and you don't get built-in compatibility with VMWare and various commercial installers. You *can* run more than 4 VM's, supported, with the "server" licenses, not the desktop licenses.
You can use CentOS for many purposes quite effectively, and switch to RHEL when needed. I've done that, and used CentOS for testing setups on non-standard hardware. That's difficult to do with Windows, you need the registered licenses.
You wrote: > As long as spam remains highly profitable spamming will continue.
No, as long as spam is _perceived_ as effective by enough people it will continue. Spam need not be commercial: harassing spam is quite effective. Spam need not actually be profitable: as long as enough fools pay someone to send it, or don't realize that what they are being is actually spam services, it will continue splashing into our spam folders at an amazing pace.
Spam is already being highly contained: given that well over 1/2 of all email is spam, and the fact that few of us see even 1% of our incoming email as spam after all the filters in front of it, it's at manageable levels. And spam is much more easily defined and blocked than "cancer", which covers a wide range of naturally occurring and exposure caused diseases. Think of it more like malaria: we've found it difficult to get buy-in to actually drain the swamps and kill all the mosquitos in the world, but we do know how to treat it and to contain it. We just haven't devoted the effort.
No, it's effectively dead. No one I've worked with in 5 years has started a project with Berkeley DB: every use of it that I've dealt with has been migrated to new systems, usually MySQL. And many of the lightweight uses of it, such as RPM databases and Subversion, have thrown it out with extreme prejudice in favor of SQLite. Oracle bought BerkeleyDB in time to harvest its good ideas and throw it onto the "support it by migrating to something that works better", and simplify the market to their own advantage.
Threatening Microsoft is not Oracle's business. Selling Oracle software, servers, and services is.
Expect MySQL support for large scale customers to be phased out starting... oh, wait, it's already been occurring. The Oracle sales staff have been eager to migrate MySQL customers, and now they have Sun's client list to work on. And they've been encouraging migration since the sale started. Not without cause, and it often makes sense for large customers.
Oh, the fixes of SATA and SAS are rather distinct from the SCSI problems: neither of those are normally used outside the box, nor do either of those use an arbitrary set of multiple connectors. My concern here is whether this new technology, by doing a "dumb down to slowest speed", is going to repeat some of the big problems of external SCSI. Some of those problems occurred with USB as well, with USB 1.1 devices messing up whole chains of USB 2.0 devices.
I remember this mess, where SCSI devices would be connected as a series, and a single slow component would silently downgrade the chain to the slowest speed. I wonder if they've duplicated the stupid termination problems as well? And the dozen different types of connectors?
And their customers deserve to be vulnerable for weeks or months longer if D-Link lags in producing an update or patch? Or not to be notified that they can simply turn off remote administration in the short term? No, leaving them vulnerable this way is a frequent problem with many software packages, and we as customers don't deserve to not be notified of these issues.
Or fire you for playing on work machines on work time. Or use it in the divorce suit because you're neglecting your kids. The possibilities are endless: I wouldn't consider all of them improper, but it does create some risks.
It also gives them the "chance" to slap you with a court order to shut you up. Take a look at the history of the "8lgm", or "eight-legged groove machine". Their old site is at http://www.8lgm.org/: it's a fascinating bit of security and legal history.
20 years ago, I would have agreed with you. But I survived the Morris Worm attack back then because I'm paranoid, and repeated attacks since then due to vulnerabilities that vendors refused to address. And the secrecy of such graceful submissions just leaves the knowledge in the hands of the crackers, who share it on their warez sites and IRC channels, and not in the hands of reasonable admins who need to assess the risks of patching and the risks of particular products. I've in fact seen this occurr with CERT, where I and peers have submitted security bug reports and seen them buried. And I've got reports from supervisors of security personnel in the US of vendors slapping them with court orders to prevent publication of the vulnerability.
The kind of gracious pre-notification you are suggesting, in this day and age, needs to be earned. And D-Link hasn't earned it, with their history of GPL violations and delay on publication of security vulnerabilities.
And I know a stack of corporate and educational sites, and household setups, that allow this. Some consider their internal machines secure (which they are not), others consider the "open environment" more important, others consider the ease of remote access for their single admin or their often telecommuting key technical admin more important.
Slashdot Mirror
The Daily Mail? That's the one with the cover article of: 'Name the Devil Boys, we must not let them hide', and whose cover photo is 'End of Brangelina'? Oh, dear. Yes, I'll assume they didn't quote anything out of context, shall I?
I've apparently violated Slashdot rules and actually looked at the article. His suit basically looks like a space suit, unsurprisingly. I'm very curious about its maneuverability, and if he's tried it in one of those vertical wind tunnels used for testing skydiving gear, or if it's a reconditioned flight suit for a military pilot, or what.
A suit with big levered fins that make it spin like a propeller would be "high drag". That's an absolute no-no for this: the spin at Mach 1 in thin air would be ludicrous, and could cause fascinating circulation problems to whatever the furthest organs are from his axis. If he's spinning sideways, as might occur of he's falling face down like most skydivers, that could knock him out pretty easily.
I read what you wrote. I took you seriously. The IE vulnerability was fairly minor at the time Microsoft was notified, as I understand the timeline: there were far more active and dangerous vulnerabilities already in the pipeline. Compared to the plethora of _other_ IE flaws, it was understandably dealt with at a low priority level.
This one has merely gotten more attention due to the Chinese/Google situation, but make no mistake, it's not that big a deal compared to the other huge security flaws going on. If such dangerous flaws were taken seriously, for an open source xample, Subversion would have stopped automatically storing your SSH, HTTPS, and HTTP passwords in cleartext years ago.
You've got it backwards. What is _more_ critical? A bug that prevents Microsoft from booting on new OEM systems? A bug that fails to reset IE as your default web browser? A bug that breaks the MS update tools and blocks other updates? A bug that causes 2003 servers to crash on Jan 1., 2010?
I don't know the full set of bugs recently patched, but a fast look at Windows Update shows a whole stack of "Windows Defender" updates, and other security updates, that were doubtless already in the queue.
There is enough of it to make a meaningful comparison. Take a look at Phil Zimmermans's conviction for publishing PGP. I'd agree that it is not _equivalent_, but I'd say that its extent and its pernicious nature do allow it to be compared to Chinese censorship. If you disagree, go try to get a copy of "The Anarchist's Cookbook" at your local city library.
Oh, there will be lateral drift due to the wind at maximum altitude, versus the wind at every altitude below that.
For reference, the speed of sound is _slower_ at higher altitudes. There is a chart at http://www.aerospaceweb.org/question/atmosphere/q0112.shtml. And for him to achieve transonic speeds for parts of his body but not other parts, he'll be breaking the local sound barrier.
Breaking the sound barrier also produces a _profound_ braking effect: you wind up providing tremendous power to compress the medium in front of you. All that energy that goes into the shock wave and the turbulence as you pass through the medium and the "sonic boom" itself, is a continuing drain on your kinetic energy. So I suspect his speed will max out at or barely above the sound barrier, and he'll certainly slow more rapidly as he hits thicker air and experiences more drag, slowing all the way to his freefall velocity in the denser air. That depends a lot on the shape of his suit: I'd expect him to want a high drag suit for maximum fall time.
Maybe, just maybe, they should throw out most XML use. It's expandability and flexibility have caused repeated security and performance issues, and it's being used consistently instead of far simpler and more robust configuration technologies.
Not to defend Microsoft's consistent failure to address security issues, but 4 months is not an unusual release time for a non-critical bug. It needs to be tested, it needs to be reviewed if it changes or breaks any other tools that rely on a sloppy API or tricky "feature", and it needs to pass regression testing. When you're running core servers, worldwide, and stand to lose millions of dollars if you accidentally break something critical, you'd better test it well. And for we who install patches, we expect official vendor patches to _not break other things_.
The risk of breaking things with an untested patch has to be measured against the risk of leaving the vulnerability open: this is why so many server-class systems out there have _no_ scheduled updates, and rely on "we trust the people we work with" to protect their internal services, and will never _get_ this recently published patch.
We'll see micropayments work when we see fusion power. The overhead of authentication and actually processing money are so large that they are simply not practical for normal email, and the kind of idiot who does spamming now would simply steal funds from your mail servers.
_Reporting_ spam is often routed to the help desk. And the intricacies of reporting the entire, unedited message with all the headers intact is often beyond a casual email user. Particularly irritating email also climbs up the reporting priority list and wastes helpdesk time, such as email being forged from one domain to pretend that it is from another domain and getting other people's email being blocked or taking advantage of their whitelisted domains (known as "joe jobs").
Let's keep a sense of scale. Guantanamo Bay, and a lot going on in Iraq and Afghanistan, is awful and the information tightly controlled. But given that China willingly and effectively censors political speech and porn, but is unwilling or unable to do anything about the 99% spam email coming from their domains, is an indication that they can't be bothered with censoring criminal behavior. They only censor political or politically embarrassing behavior.
It is strong, considering that "censorship" does include US censorship. The Chinese are far worse about this, but given that child pornography, atom bomb plans, and cryptography have all been limited by the US government, we can't claim complete innocence. And US companies have accepted cryptography censorship as a part of selling software internationally for decades.
I'm glad at Clinton's stand, but the devil is in the details. We'll see if this helps reduce censorship in the USA as well as in China and other, more politically repressive domains worldwide. In fact, helping fund Wikileaks would be a great step in supporting free speech: if you've recovered from your Christmas bills, now might be a good time to send them a money order.
For RHN, you don't get the service and the upstream package management and system integration tools. You get access to updates whenever CentOS gets around to them, which is actually quite fast. I have no issue with a RedHat tech being helpful for you, and helping you steer around their licensing. It's just the claim that you automatically get all RHEL software. Things like VMWare cooperation and XFS (you were right, that's what I meant) are reliant on tools that are not in the RHEL published SRPM's.
And switching between RHEL and CentOS is a bit trickier than you may realize. There are some conflicting packages, such as the "redhat-release" versus "centos-release", and various oddities that RHEL did to yum. Ideally, you also need to replace every single RPM with the RHEL version, even if the "release" number is identical or slightly older from the RHEL version. That takes a local repository of all the RedHat packages, or of CentOS, and keeping track of which ones have been successfully replaced. It's bothersome, especially if you've been using tools from the centosplus repository such as kernels (which enable NTFS, RHEL does not).
No, you can't use it all for free. You don't get RHN, you don't get ZFS, you don't get RedHat trademarks, and you don't get built-in compatibility with VMWare and various commercial installers. You *can* run more than 4 VM's, supported, with the "server" licenses, not the desktop licenses.
You can use CentOS for many purposes quite effectively, and switch to RHEL when needed. I've done that, and used CentOS for testing setups on non-standard hardware. That's difficult to do with Windows, you need the registered licenses.
You wrote:
> As long as spam remains highly profitable spamming will continue.
No, as long as spam is _perceived_ as effective by enough people it will continue. Spam need not be commercial: harassing spam is quite effective. Spam need not actually be profitable: as long as enough fools pay someone to send it, or don't realize that what they are being is actually spam services, it will continue splashing into our spam folders at an amazing pace.
Spam is already being highly contained: given that well over 1/2 of all email is spam, and the fact that few of us see even 1% of our incoming email as spam after all the filters in front of it, it's at manageable levels. And spam is much more easily defined and blocked than "cancer", which covers a wide range of naturally occurring and exposure caused diseases. Think of it more like malaria: we've found it difficult to get buy-in to actually drain the swamps and kill all the mosquitos in the world, but we do know how to treat it and to contain it. We just haven't devoted the effort.
No, it's effectively dead. No one I've worked with in 5 years has started a project with Berkeley DB: every use of it that I've dealt with has been migrated to new systems, usually MySQL. And many of the lightweight uses of it, such as RPM databases and Subversion, have thrown it out with extreme prejudice in favor of SQLite. Oracle bought BerkeleyDB in time to harvest its good ideas and throw it onto the "support it by migrating to something that works better", and simplify the market to their own advantage.
Threatening Microsoft is not Oracle's business. Selling Oracle software, servers, and services is.
Expect MySQL support for large scale customers to be phased out starting... oh, wait, it's already been occurring. The Oracle sales staff have been eager to migrate MySQL customers, and now they have Sun's client list to work on. And they've been encouraging migration since the sale started. Not without cause, and it often makes sense for large customers.
Oh, the fixes of SATA and SAS are rather distinct from the SCSI problems: neither of those are normally used outside the box, nor do either of those use an arbitrary set of multiple connectors. My concern here is whether this new technology, by doing a "dumb down to slowest speed", is going to repeat some of the big problems of external SCSI. Some of those problems occurred with USB as well, with USB 1.1 devices messing up whole chains of USB 2.0 devices.
I remember this mess, where SCSI devices would be connected as a series, and a single slow component would silently downgrade the chain to the slowest speed. I wonder if they've duplicated the stupid termination problems as well? And the dozen different types of connectors?
And their customers deserve to be vulnerable for weeks or months longer if D-Link lags in producing an update or patch? Or not to be notified that they can simply turn off remote administration in the short term? No, leaving them vulnerable this way is a frequent problem with many software packages, and we as customers don't deserve to not be notified of these issues.
Or fire you for playing on work machines on work time. Or use it in the divorce suit because you're neglecting your kids. The possibilities are endless: I wouldn't consider all of them improper, but it does create some risks.
It also gives them the "chance" to slap you with a court order to shut you up. Take a look at the history of the "8lgm", or "eight-legged groove machine". Their old site is at http://www.8lgm.org/: it's a fascinating bit of security and legal history.
20 years ago, I would have agreed with you. But I survived the Morris Worm attack back then because I'm paranoid, and repeated attacks since then due to vulnerabilities that vendors refused to address. And the secrecy of such graceful submissions just leaves the knowledge in the hands of the crackers, who share it on their warez sites and IRC channels, and not in the hands of reasonable admins who need to assess the risks of patching and the risks of particular products. I've in fact seen this occurr with CERT, where I and peers have submitted security bug reports and seen them buried. And I've got reports from supervisors of security personnel in the US of vendors slapping them with court orders to prevent publication of the vulnerability.
The kind of gracious pre-notification you are suggesting, in this day and age, needs to be earned. And D-Link hasn't earned it, with their history of GPL violations and delay on publication of security vulnerabilities.
And I know a stack of corporate and educational sites, and household setups, that allow this. Some consider their internal machines secure (which they are not), others consider the "open environment" more important, others consider the ease of remote access for their single admin or their often telecommuting key technical admin more important.
This worked really well on Cuba, didn't it?