Quite apart from clearly ultra vires decisions
like preventing American Citizens to re-enter their own country,
And the technological stupidity of adding un-encrypted RFID tags to passports, "to make it
easier for third world goverments" that will be
able to find a RFID reader, but not a lap-top PC, leading to a world market in Faraday Passort Covers, undoubtably a new export opportunity for China,
I wonder how long it will take these insular beaurocrats to understand that
the rest of the world won't stand for it!
I look fondly forward to returning to Switzerland to see a VERY long line of US Citizens waiting to be fingerprinted by a single Polizstin doing her job, slowly, very carefully and with Swiss precision.
It is easy really, we just are not quite back to the point when many IT departments are back in 'we have to get this done' mode from 'don't spend any money'.
Once IT departments have to get things actualy done they find that that the 'fit-for-purpose' developers are neither cost effective, efficient or trustworthy.
They can't be because they don't know how and that is re-doubled for the small armies of asian and indian coders now sold, in another time zone, as out-source developers.
As anyone who has rescued a number of business critical projects from a boondogle of procurement agents, out-sources and incompetant internal IT managers I can tell you there is good money in it and a need for real developers, who can write code that works and contributes to the solution of the problem.
The difficulty with OO, design patterns, frameworks, containers, managed XXX and IDEs is they all assume you have a clear vision as to what you want and need to do do and just need some help getting there.
Sadly nothing could be further from the truth, lack of clear requirement, projected project vision, a properly scaled architecture and design/code/test implementation plan are normal as the unnecessary complexity spirals out of control.
Finally, one must address IDEs and ToolKits, both of which are brilliant ideas in themselves, so for example no one in their right mind would build a UI without GUI help if available; BUT they now cover some dreadful design errors, further increasing complexity, an example is the contruction of an Enterprise Java Bean, why is marsheling/un-marsheling done by hand in each bean, not in the JVM/Container? In an interpreted language, which can do introspection falling off a log!
Sorry, The first part of your comment is right on,
the second, re the DMCA, is much more problematic.
Thankfully Federal Courts have already de-fanged DMCA in the Lexmark case, by looking behind anti-circumvention to the goal of the plaintiff.
This means that almost all scams like, Lexmark's,
are not worth litigating, and my own guess is the entire bill is un-constitutional; the message is that these people are no better at drafting law for their tame Congress-Critters to pass than they are at applied Cryptography!
Sadly, you will find that what the said was weasled, exactly to prevent you prevailing so...
"Copying this DVD ___may___be___ unlawful..."
in which case they will rely on ___may___.
IAAL
Your comment is a definative example as to why the broken US Court System continues to do dis-service to the Law Abiding and to the clarity, the law itself, needs to have.
Having failed, conspicuously, to prevent citizens from their lawfull excercise of their rights e.g. making a backup of a CD/DVD the IP/media industry attempts to attack the process, e.g. DeDCSS, not the end result, using anti-circumvention.
Any sensible Court system would already have establised rules that that state that the end result must be shown to be unlawful before the court will entertain arguement as to method.
There is a very pressing need for reform in this area, so that the process of the law becomes more transparent.
The __REAL__ reason is prestiege and status, the industry persuaded people it was the way to go, and
lo, everybody wanted one
I am 61, with good eyesight, I still fly both fixed and rotary wing, and standing in as CIO in a hospital, for three months, I found a LDC on my desk and had it swapped for a 17" Sony Trinitron the next day, I far prefer CRTs
I also stopped the CRT->LCD upgrade aka waste-money program and when I got the RADIATION argument I had the Radiology department come into clustered areas with their sophisticated and calibrated radiation detectors and they could not tell a computer work area from the tea room, with a TV.
Exactly the last thing the world needs is an un-accountable, corrupt, in-effective beaurocracy interfearing in something that works and has contributed much more to international freedom than they have ever done.
Paul Vocker's report suggests that these people should STRICTLY CONFINED to putting their own house in order so that they can make the contribution to world peace that they were created for.
Issued of waste and genocide need to be urgently addressed by UN reform.
When the UN has worked properly for 20 years I might be prepared to listen to their views, so far they ahve been a 60 year disaster.
The primary complaint is that SUN insist on heavy handed control of Java, and particularly the JVM, now this is not a problem for Redhat or SuSE who, who have re-distribution rights with SUN, but is inhibative for non-commercial distributions, SUN could solve this, for very little cost, by providing certified freely-re-distributable JVM's for all common architectures (ia32, ia64, 86-64, sparc, ppc, arm...) tarball + sig; with re-distribution allowed with the SUN computed sig.
Most of this work needs to be done anyway, for good commercial reasons, to sell into the embedded markets.
Miguel, perceptively, realizes that M$ had done something right and if you don't realize it there is a convergence of (interpreted) virtualization technologies perl6 (parrot), JVM (groovy) and CLR (C#), and what this really means is that we will be seening much more of interpreted languages [C#, Java, Lisp, Perl, Python] since they permit a much more effective programming paridgm.
If the hype on these issue went away Java would be much more usable.
And interestingly Java client-side's suck as much, or more on Linux than Windoze; you want to know why, it is simple, you either need to keep cranking up a new, virgin, JVM (in which initialization optimization was never a goal) or go the Container route, which is only viable on the server side.
Once you understand Java's history, originally as OAK, all this makes sense, you initialize the JVM once, when the appliance is turned on.
This implies that the JVM should load, on Linux, as a module, and bytecodes should be loaded by the kernel binary loader, calling out to the JVM module --- this would make Java truely native, and focus on optimizing startup. This ammounts essentially to JVM virtualization; suddenly Beans and Containers would become much less intrusive but with a role in managed Web Channels and BL layers.
Finally I despair of the 'pure Java' client side UI layers SWT/Swing/AWT which are all underfeatured, ugly slow and bloated; this is, once again, insularity. Qt, for example, is easily embeddable in Java, and enables quick construction of UIs that dont look like the work of a 3 year old.
What is really wrong here is that that the FEC thinks they can get away with this nonsense; it is clearly an abridgement of free speach on a global basis and specifically contrary to the US constitution.
If the US court system was working properly they would know the game was up, and not waste their time.
I am sorry to say that I am very uhappy with the
recent directions at Mozilla. I had just downloaded SeaMonkey 1.8b1 and installed it when the news that was not to be fully surfaced through a fog of confusion.
Since the mail/news in 1.8b1 was a bit unstable I decided to migrate to Thunderbird which feels unpleasant and clunky, just like IE/Outlook, and then I find that changing things is also wrongly/poorly documented and hard eg ~/.thunderbird not ~/.mozilla/thunderbird at the top level, where are the hidden prefs documented, how do you change the
I really cannot understand the reasoning, if any,
behind this comment. If a for profit corporation
wants IP protection, it takes out a patent, and
must disclose.
How do you know, or judge, whether research is good unless you can read, understand and measure it?
No research is simple FUD, if anything we probably have far too much junk research today.
And that is an entirely predictable consequence of the re-definition of the PhD (Doctor of Philosophy)
standard.
The legal phrase is "reasonable and non-descrimatory terms".
So, for example, when IBM was faced with a
similar requirement they were allowed to charge
USD 5 per printed manual, and , in general, up to 5 manuals per product were allowed.
These days one would expect the.pdf(s) to be almost free.
The main point is that M$ blatant contempt of court orders will catch up with them much faster here when whole actions are often struck-out (dismissed) or decided in a month -- none of your SCO circus.
Finally, company officers can go to jail for contempt.
This is yet further evidence, if that was needed, of the cluelessness and lack of direction now pervading SUN.
I, for one, am really sad.
SUN used to be a great computer company, hugely innovative and a major donor to the community.
Gosling's FUD and marketspeak cannot hide the fact that 3 months after OpenSourcing at least 20 of the most annoying bugs and the huge bloat of the current Java implementation would be gone.
Two simple examples, which pose NO risk of INCOMPATIPILITY: (a) a '\n' to JDB does nothing, it should repeat the last command so n '\n' '\n'... would step through a program like it does in Perl, (b) add a pre-fork option to JVM startup so executing "Hello World" didnt take 5-10 seconds an the average laptop. This would change the face of development by making much of the containerisation un-necessary.
As one who uses C, C++, Perl and Java in my everyday work I cannot stress too strongly that tools developed behind a baracade quickly suffer from the prejudices of a small team, while, in the OpenSource arena natural selection means that good ideas are quickly adopted.
Finally, the fear of forking and incompatibility relating to Java is a reflection to SUNs FUDing in the past. Six months of creative matketing could easily reverse that. Many IT managers are realising that, as we all know, a tool does not a good programmer make! Many are beginning to turn away from Java. This is unwise but something must be done about the bloat and verbosity of the current Java paradigm.
You only think this because, (a) you
really do not understand authentication, and
(b) you hane not looked outside the very propreitary PKI world
X509 certificates are designed to make the CAs
money
Schneier's first book, "Applied Cryptograpy"
fully discusses the issues of identity, authentication and non-repudiation in digital signatures, and is up-2-date since it concentrates on priciples not technology (eg. SHA1 is compromised, move to SHA265).
The essential answer is move to a web of trust, co-signed key structure.
So to fix ideas, if I generate a long, 4096+ RSA or EC key I can send a _secure_digest_ of my private key to my bank, who sign it ie encrypt it with their secure private key and send me back the result; I can append this co-sign to all others, buth each co-signing institution can verify I am using a key pair I have registered with them.
And I can do all this and maintain it with an SSL enabled browser.
No, wrong again; I hope that you are not responsible for the security of anything important.
If you devise your security policy/implementation
very carefully you may get it wrong, if you take your approach you will survive on the internet for
less than 5 mins. before being owned.
As an amusing aside, I had to call my ISP, who I wont shame by naming them because their POP3 server
was no longer responding, subsequently traced to
faulty re-configuration of their load-balance. In the process the advisor both asked for my password, and said he could not do certain checks wothout. He also asked me to turn my firewall off.
Schneier has a 10 year record of being right in a
very difficult arena.
Almost _ALL_ organizations would rather do something stupid this afternoon, than think about
what they should do. Finally, almost none of them have read Schneier's books.
As I suspect you havn't either
I happen to believe "Secrets and Lies" is up there in the top 10 most-useful Computing books ever written, right up there with Fred Brooks: The Mythical Man Month.
Slashdot Mirror
And the technological stupidity of adding un-encrypted RFID tags to passports, "to make it easier for third world goverments" that will be able to find a RFID reader, but not a lap-top PC, leading to a world market in Faraday Passort Covers, undoubtably a new export opportunity for China,
I wonder how long it will take these insular beaurocrats to understand that the rest of the world won't stand for it!
I look fondly forward to returning to Switzerland to see a VERY long line of US Citizens waiting to be fingerprinted by a single Polizstin doing her job, slowly, very carefully and with Swiss precision.
Attempts to find genuineuley free re-targetable components has, only because of SUN, been much harder in Java than, say Perl.
Good luck.
Once IT departments have to get things actualy done they find that that the 'fit-for-purpose' developers are neither cost effective, efficient or trustworthy.
They can't be because they don't know how and that is re-doubled for the small armies of asian and indian coders now sold, in another time zone, as out-source developers.
As anyone who has rescued a number of business critical projects from a boondogle of procurement agents, out-sources and incompetant internal IT managers I can tell you there is good money in it and a need for real developers, who can write code that works and contributes to the solution of the problem.
The difficulty with OO, design patterns, frameworks, containers, managed XXX and IDEs is they all assume you have a clear vision as to what you want and need to do do and just need some help getting there.
Sadly nothing could be further from the truth, lack of clear requirement, projected project vision, a properly scaled architecture and design/code/test implementation plan are normal as the unnecessary complexity spirals out of control.
Finally, one must address IDEs and ToolKits, both of which are brilliant ideas in themselves, so for example no one in their right mind would build a UI without GUI help if available; BUT they now cover some dreadful design errors, further increasing complexity, an example is the contruction of an Enterprise Java Bean, why is marsheling/un-marsheling done by hand in each bean, not in the JVM/Container? In an interpreted language, which can do introspection falling off a log!
This is just another clueless piece of op-ed from someone who neither knows nor understands Open Source.
What is really begining to annoy me is the ease with which these idiots get published.
Yes, and I wonder whether a consumer group will sue these ultra-vires idiots
Thankfully Federal Courts have already de-fanged DMCA in the Lexmark case, by looking behind anti-circumvention to the goal of the plaintiff.
This means that almost all scams like, Lexmark's, are not worth litigating, and my own guess is the entire bill is un-constitutional; the message is that these people are no better at drafting law for their tame Congress-Critters to pass than they are at applied Cryptography!
Sadly, you will find that what the said was weasled, exactly to prevent you prevailing so ...
"Copying this DVD ___may___be___ unlawful ..."
in which case they will rely on ___may___.
IAAL
Having failed, conspicuously, to prevent citizens from their lawfull excercise of their rights e.g. making a backup of a CD/DVD the IP/media industry attempts to attack the process, e.g. DeDCSS, not the end result, using anti-circumvention.
Any sensible Court system would already have establised rules that that state that the end result must be shown to be unlawful before the court will entertain arguement as to method.
There is a very pressing need for reform in this area, so that the process of the law becomes more transparent.
I am 61, with good eyesight, I still fly both fixed and rotary wing, and standing in as CIO in a hospital, for three months, I found a LDC on my desk and had it swapped for a 17" Sony Trinitron the next day, I far prefer CRTs
I also stopped the CRT->LCD upgrade aka waste-money program and when I got the RADIATION argument I had the Radiology department come into clustered areas with their sophisticated and calibrated radiation detectors and they could not tell a computer work area from the tea room, with a TV.
Paul Vocker's report suggests that these people should STRICTLY CONFINED to putting their own house in order so that they can make the contribution to world peace that they were created for.
Issued of waste and genocide need to be urgently addressed by UN reform.
When the UN has worked properly for 20 years I might be prepared to listen to their views, so far they ahve been a 60 year disaster.
The primary complaint is that SUN insist on heavy handed control of Java, and particularly the JVM, now this is not a problem for Redhat or SuSE who, who have re-distribution rights with SUN, but is inhibative for non-commercial distributions, SUN could solve this, for very little cost, by providing certified freely-re-distributable JVM's for all common architectures (ia32, ia64, 86-64, sparc, ppc, arm ...) tarball + sig; with re-distribution allowed with the SUN computed sig.
Most of this work needs to be done anyway, for good commercial reasons, to sell into the embedded markets.
Miguel, perceptively, realizes that M$ had done something right and if you don't realize it there is a convergence of (interpreted) virtualization technologies perl6 (parrot), JVM (groovy) and CLR (C#), and what this really means is that we will be seening much more of interpreted languages [C#, Java, Lisp, Perl, Python] since they permit a much more effective programming paridgm.
If the hype on these issue went away Java would be much more usable.
Once you understand Java's history, originally as OAK, all this makes sense, you initialize the JVM once, when the appliance is turned on.
This implies that the JVM should load, on Linux, as a module, and bytecodes should be loaded by the kernel binary loader, calling out to the JVM module --- this would make Java truely native, and focus on optimizing startup. This ammounts essentially to JVM virtualization; suddenly Beans and Containers would become much less intrusive but with a role in managed Web Channels and BL layers.
Finally I despair of the 'pure Java' client side UI layers SWT/Swing/AWT which are all underfeatured, ugly slow and bloated; this is, once again, insularity. Qt, for example, is easily embeddable in Java, and enables quick construction of UIs that dont look like the work of a 3 year old.
Yes, but only because SUN helped them.
You can easily argue that short-sightedness, bloat, clunkiness all stems from insularity.
One cannot argue that Java solutions are normally HUGE in terms of code and memory footprint.
Bean and Container architectures further the problem not the solution; nor does it help if much of the code is written by Wizards or IDEs.
This furthers the fallacy that specializing the most general solution is the Enterprise way to go.
I predict this will become an increasing problem.
If the US court system was working properly they would know the game was up, and not waste their time.
Since the mail/news in 1.8b1 was a bit unstable I decided to migrate to Thunderbird which feels unpleasant and clunky, just like IE/Outlook, and then I find that changing things is also wrongly/poorly documented and hard eg ~/.thunderbird not ~/.mozilla/thunderbird at the top level, where are the hidden prefs documented, how do you change the
CANCEL OK
button order back to OK CANCEL in the chrome.
I am disappointed.
How do you know, or judge, whether research is good unless you can read, understand and measure it?
No research is simple FUD, if anything we probably have far too much junk research today.
And that is an entirely predictable consequence of the re-definition of the PhD (Doctor of Philosophy) standard.
It would be better if you understood the difference between rote and wrote!
So, for example, when IBM was faced with a similar requirement they were allowed to charge USD 5 per printed manual, and , in general, up to 5 manuals per product were allowed.
These days one would expect the .pdf(s) to be almost free.
The main point is that M$ blatant contempt of court orders will catch up with them much faster here when whole actions are often struck-out (dismissed) or decided in a month -- none of your SCO circus.
Finally, company officers can go to jail for contempt.
Keep it up Sir Bill!
It is NOT USD 5 mil per day, it is 5% of global worldwide annual global turnover per day at maximum; ie 20 days 0 income in 2005! Much more like it.
This post contains two very great fallacies:
1 OO -> Very.long.object.names
2 Pointing at worse tools eg COBOL excuses anything
Writing good, clear, correct programs is hard enough without having to specify un-necessary defaults for everything!
I, for one, am really sad.
SUN used to be a great computer company, hugely innovative and a major donor to the community.
Gosling's FUD and marketspeak cannot hide the fact that 3 months after OpenSourcing at least 20 of the most annoying bugs and the huge bloat of the current Java implementation would be gone.
Two simple examples, which pose NO risk of INCOMPATIPILITY: (a) a '\n' to JDB does nothing, it should repeat the last command so n '\n' '\n' ... would step through a program like it does in Perl, (b) add a pre-fork option to JVM startup so executing "Hello World" didnt take 5-10 seconds an the average laptop. This would change the face of development by making much of the containerisation un-necessary.
As one who uses C, C++, Perl and Java in my everyday work I cannot stress too strongly that tools developed behind a baracade quickly suffer from the prejudices of a small team, while, in the OpenSource arena natural selection means that good ideas are quickly adopted.
Finally, the fear of forking and incompatibility relating to Java is a reflection to SUNs FUDing in the past. Six months of creative matketing could easily reverse that. Many IT managers are realising that, as we all know, a tool does not a good programmer make! Many are beginning to turn away from Java. This is unwise but something must be done about the bloat and verbosity of the current Java paradigm.
X509 certificates are designed to make the CAs money
Schneier's first book, "Applied Cryptograpy" fully discusses the issues of identity, authentication and non-repudiation in digital signatures, and is up-2-date since it concentrates on priciples not technology (eg. SHA1 is compromised, move to SHA265).
The essential answer is move to a web of trust, co-signed key structure.
So to fix ideas, if I generate a long, 4096+ RSA or EC key I can send a _secure_digest_ of my private key to my bank, who sign it ie encrypt it with their secure private key and send me back the result; I can append this co-sign to all others, buth each co-signing institution can verify I am using a key pair I have registered with them. And I can do all this and maintain it with an SSL enabled browser.
If you devise your security policy/implementation very carefully you may get it wrong, if you take your approach you will survive on the internet for less than 5 mins. before being owned.
As an amusing aside, I had to call my ISP, who I wont shame by naming them because their POP3 server was no longer responding, subsequently traced to faulty re-configuration of their load-balance. In the process the advisor both asked for my password, and said he could not do certain checks wothout. He also asked me to turn my firewall off.
Jezz, Schneier is right on the money
Almost _ALL_ organizations would rather do something stupid this afternoon, than think about what they should do. Finally, almost none of them have read Schneier's books.
As I suspect you havn't either
I happen to believe "Secrets and Lies" is up there in the top 10 most-useful Computing books ever written, right up there with Fred Brooks: The Mythical Man Month.