A phenomenon enabled by and contained within the MS ghetto. So why doesn't the summary mention it in big flashing letters? This is part of the Windows experience!
For a historical overview, detailed reminiscences of phreaking and interviews with Draper, Wozniak and Mitnick, see The Secret History of Hacking (50 minutes). In particular it details how the phreaking story hit national headlines, how Draper and Wozniak met, prank calling the Vatican, and the blind hacker with perfect pitch who can control phone switches around the world by whistling.
A couple of semi-obvious tips on spotting a stolen computer: 1. very careless packaging; 2. personal data intact.
In both cases we contacted police. In one case, apparently little was done by police, despite serial number check immediately revealing that the machine had been recently stolen from a school. In the 2nd case, the stolen laptop - full of personal data, mostly irreplaceable - was the only lead in solving a major house burglary. Laptop returned to owner, thief arrested, eventually had to pay restitution to ebay purchaser. In the second case, the ebay seller's transaction history looked very suspicious. If you have any suspicions - random tips: comb feedback logs in detail; if machine has personal data, contact previous owner (in our case, they confirmed the robbery and were very grateful); Try to get as much identifying detail from seller as possible in case it must be given to police; Don't meet them in person; Get serial numbers and check with police before concluding the sale; contact police and ask for advice.
I don't think you have much to fear when your resignation immediately makes positive front page coverage on both Slashdot and Groklaw. 100 million people just found out Jeremy Allison's looking for work.
I'd feel better about my own career if I had that kind of visibility. PS. I'm looking for a job.:)
They'll probably come out of this looking foolish, whatever Apple does.
Thirty exploits for OS X would be quite a find - and if they have them, let's get them outed; OS X users aren't in as much danger from this as people around here are trying to claim.
If he's sitting on remote exploits for OS X, we might as well get them out in the open.
As others have pointed out, it's pretty difficult to make your OS X system vulnerable. Many home and corporate users are already behind a router. The others can tighten their software firewall and disable unnecessary services.
That leaves the usual attack vectors, Outlook and IE... uh wait... Mail.app and Safari. Even if he has some remote exploit against standard mail client and browser, unless this stunt suddenly changes the character of incoming spam, I don't see that having much effect on end users. I still think Apple's best response is to make lemonade.
Whatever they do, they can't do worse than MS (delay, denial, and more defects).
I think anything Apple says in response will have a wide audience, which means its message won't be lost. And that message could be as simple as, "We know we have bugs. Instead of pretending we don't or burying them in bureaucracy, we're going to fix whatever he finds. Keep em coming!"
Memo to Apple PR: Work with this guy. Simply ensure that each bug identified is fixed ASAP, and issue a press release about it. This lets you capture and keep the high ground by showing that you care more about security and quality than the competition does. Up for it?
Just remember, where the big bad guys see "little people to be silenced," others see "opportunity."
Over past months, I've read a lot of people commenting on ZFS who have no idea what it is. What it is, is the next generation of filesystems, not a "tweak" of current fs technology. It just happens to "look like" an ordinary POSIX fs, from a distance (if you ignore the administration/pool stuff...) But inside, it's something new under the Sun, folks.
RAID experts don't grok it, because it does things RAID can't do (end-to-end).
Devotees of ext2fs, reiserfs (yay!), NTFS (LOL!), or HFS+ don't grok it, because none of those filesystems do what ZFS does.
Read about it before you write it off as old wine in a new bottle. To ask the question, "Does OS X need a new filesystem?" is a perfect example of missing the point. Once you've looked at what ZFS really brings to the table, you'll see why it's an inevitable future, sooner or later, and you'll stop looking foolish.
But Microsoft does, through their announced product lifecycle, promise to deliver security and other fixes for a period of up to 10 years beyond "general availability" (NOT date of license purchase, a nice loophole penalising customers who buy late in the lifecycle). According to that page, Business customers can expect security updates through 2010. Perhaps they don't classify Spyware as a security issue (would explain a lot).
Al Capone put it best. You can get more upgrades bought with flashy launch hype and a gun, than just flashy launch hype.
Slashdot Mirror
A phenomenon enabled by and contained within the MS ghetto. So why doesn't the summary mention it in big flashing letters? This is part of the Windows experience!
It's the end of the (IT) world as we know it - a riff on Carr's "IT Doesn't Matter" memo.
...It's anything relating to Microsoft.
Erasing them and everything they touch from the face of the earth is one of the most helpful things we can do for future civilisation.
How many OS X users lost money?
Why doesn't the headline name the real enabler: Microsoft.
Running Windows is like putting your money in a cardboard safe. Wet cardboard.
And this story hit the UK Guardian on 9 Nov 2006. (via CS maven my slice of pizza.)
For a historical overview, detailed reminiscences of phreaking and interviews with Draper, Wozniak and Mitnick, see The Secret History of Hacking (50 minutes). In particular it details how the phreaking story hit national headlines, how Draper and Wozniak met, prank calling the Vatican, and the blind hacker with perfect pitch who can control phone switches around the world by whistling.
A couple of semi-obvious tips on spotting a stolen computer: 1. very careless packaging; 2. personal data intact.
In both cases we contacted police. In one case, apparently little was done by police, despite serial number check immediately revealing that the machine had been recently stolen from a school. In the 2nd case, the stolen laptop - full of personal data, mostly irreplaceable - was the only lead in solving a major house burglary. Laptop returned to owner, thief arrested, eventually had to pay restitution to ebay purchaser. In the second case, the ebay seller's transaction history looked very suspicious. If you have any suspicions - random tips: comb feedback logs in detail; if machine has personal data, contact previous owner (in our case, they confirmed the robbery and were very grateful); Try to get as much identifying detail from seller as possible in case it must be given to police; Don't meet them in person; Get serial numbers and check with police before concluding the sale; contact police and ask for advice.
"Why ZFS for home": - http://uadmin.blogspot.com/2006/05/why-zfs-for-hom e.html
"Here are ten reasons why you'll want to reformat all of your systems and use ZFS.": http://www.tech-recipes.com/rx/1446/zfs_ten_reason s_to_reformat_your_...
And some more technical explanations from Sun's Chief Engineer: - http://blogs.sun.com/bonwick/entry/zfs_end_to_end_ data
- http://blogs.sun.com/bonwick/entry/smokin_mirrors
a transactional storage engine that is not controlled by a hostile company
Which brings the total to at least 3 such so far: SolidDB, PBXT in addition to the well-known Falcon project.
If Oracle intended to weaken MySQL's market position by the acquisitions of Sleepycat and Innobase, they seriously miscalculated.
The obvious way to handle it, I thought when the story broke last month...
I don't think you have much to fear when your resignation immediately makes positive front page coverage on both Slashdot and Groklaw. 100 million people just found out Jeremy Allison's looking for work.
:)
I'd feel better about my own career if I had that kind of visibility. PS. I'm looking for a job.
I don't see that this would do any harm to his career at all.
He's just proven himself to be a highly ethical person. Some employers like that.
They'll probably come out of this looking foolish, whatever Apple does.
Thirty exploits for OS X would be quite a find - and if they have them, let's get them outed; OS X users aren't in as much danger from this as people around here are trying to claim.
If he's sitting on remote exploits for OS X, we might as well get them out in the open.
As others have pointed out, it's pretty difficult to make your OS X system vulnerable. Many home and corporate users are already behind a router. The others can tighten their software firewall and disable unnecessary services.
That leaves the usual attack vectors, Outlook and IE... uh wait... Mail.app and Safari. Even if he has some remote exploit against standard mail client and browser, unless this stunt suddenly changes the character of incoming spam, I don't see that having much effect on end users. I still think Apple's best response is to make lemonade.
Whatever they do, they can't do worse than MS (delay, denial, and more defects).
If this guy really has 30 zero-day remote exploits for OS X, then Apple really does have a problem.
He'll be scraping the barrel to find one or two. And either way, I still think it's a PR opportunity for Apple. Or at worst, tuff love!
I think anything Apple says in response will have a wide audience, which means its message won't be lost. And that message could be as simple as, "We know we have bugs. Instead of pretending we don't or burying them in bureaucracy, we're going to fix whatever he finds. Keep em coming!"
Yeah, I know, I'm hopelessly naïve.
... :-)
Memo to Apple PR:
Work with this guy. Simply ensure that each bug identified is fixed ASAP, and issue a press release about it. This lets you capture and keep the high ground by showing that you care more about security and quality than the competition does. Up for it?
Just remember, where the big bad guys see "little people to be silenced," others see "opportunity."
no/t
If you don't realise where ZFS goes beyond ext3fs, you got some readin' to do, Lucy.
Over past months, I've read a lot of people commenting on ZFS who have no idea what it is. What it is, is the next generation of filesystems, not a "tweak" of current fs technology. It just happens to "look like" an ordinary POSIX fs, from a distance (if you ignore the administration/pool stuff...) But inside, it's something new under the Sun, folks.
RAID experts don't grok it, because it does things RAID can't do (end-to-end).
Devotees of ext2fs, reiserfs (yay!), NTFS (LOL!), or HFS+ don't grok it, because none of those filesystems do what ZFS does.
Read about it before you write it off as old wine in a new bottle. To ask the question, "Does OS X need a new filesystem?" is a perfect example of missing the point. Once you've looked at what ZFS really brings to the table, you'll see why it's an inevitable future, sooner or later, and you'll stop looking foolish.
Some links I posted this week:
- http://www.osnews.com/story.php/16739/Screenshot-Z FS-in-Leopard
- http://mac4ever.com/news/27485/zettabyte_sur_leopa rd/
(older rumour http://www.osnews.com/story.php?news_id=14473)
For OS X people wondering why the fuss about ZFS - summaries include: - http://www.sun.com/2004-0914/feature/ - http://www.sun.com/bigadmin/features/articles/zfs_ part1.scalable.html
"Why ZFS for home": - http://uadmin.blogspot.com/2006/05/why-zfs-for-hom e.html
"Here are ten reasons why you'll want to reformat all of your systems and use ZFS.": http://www.tech-recipes.com/rx/1446/zfs_ten_reason s_to_reformat_your_...
And some more technical explanations from Chief Engineer: - http://blogs.sun.com/bonwick/entry/zfs_end_to_end_ data
- http://blogs.sun.com/bonwick/entry/smokin_mirrors
But Microsoft does, through their announced product lifecycle, promise to deliver security and other fixes for a period of up to 10 years beyond "general availability" (NOT date of license purchase, a nice loophole penalising customers who buy late in the lifecycle). According to that page, Business customers can expect security updates through 2010. Perhaps they don't classify Spyware as a security issue (would explain a lot).
Al Capone put it best. You can get more upgrades bought with flashy launch hype and a gun, than just flashy launch hype.
IN5T4LL L1NUX, PR0BL3M S0LVED.
Gates is without doubt the root of the bad ethics and dirty business, and likely the technical failures. He believed his own myth.
Philanthrophy with stolen money doesn't change a thing.
"forefront leaders" makes no sense (did you mean "foremost"?)
Apart from that, what a dumb question. Are you trolling, or just inexcusably ignorant? Go educate yourself, read Groklaw - you may as well start here.