1. I don't think mature Linux users will care. Linux is a great tool and does some things that osx can't do. At some point the killer Linux app will come along that will drive adoption. This is pretty much how it's always worked. This is how Linux is gaining now.
2. Stealing desktop share is a moot point. Apple has been trying for as long as I can remember to switch windows users and it doesn't work that well on its own until Vista came along.
3. Right now, Linux is the third alternative that will probably make either osx or vista look better to most. It's the shouting (advertising) that makes Apple products more viable. If Ubuntu could afford Apple-scale advertising, then you would see even more adoption.
1. This so-called progress microsoft claims to make in server license penetration conveniently disregards the fact that the number of OSS server projects is multiplying faster and still growing faster than their numbers.
2. Who buys a windows server license with the expectation that they'll do their own hosting???? Most don't and won't ever. For the person that jumps up and says "I will! It'll run my corporate wiki!" That's one very narrow case in which license compliance (CAL's) would be conveniently disregarded anyway.
3. Most shops have either a site license or run the enterprise versions. They will continue to cook the numbers by offering more sweet deals to hosts like godaddy.
Ummm. Can someone explain about the smoke and mirrors? No Energy Star? Please.
That's exactly how a publication like PC Mag works if you don't have a big PR machine and advertising budget behind you. They use odd reasons peppered throughout a review to discredit the product. It's all vaguely based in facts that are used to come to a non-sensical conclusion that the product is "bad."
It's important to acknowledge the legitimate shortcomings of the product. In this case it's the fact that their e17 desktop has many shortcomings.
Before yet another post dismissing the review in its entirety is posted, there are some totally valid claims.
1. Lack of flash plugin. Yes, they totally side-stepped the legal problems, but how about a script to do the job on startup?? 2. Lack of polish. I backported everex's e17 gui onto an older kubuntu and I found the same issues the reviewer did. Plug a flash drive in and watch what doesn't happen. No system tray and none was ever planned. I discovered pulseaudio though and that was worth the effort. 3. It's under-powered. Until Microsoft sells PC Magazine's editors on a "new low-power market" PC Mag will call low-power anything bad.
It should go without saying that a $299 PC is the worst possible thing to happen to PC Magazine. Everex certainly isn't going to spend money on PC Magazine's editors or buy adverts with the tiny profit margins.
As an FYI: Everex's one or two of the e17 source packages are very broken. They aren't even ubuntu quality and they would never make it into a Debian repo. I took careful notes during the whole build and I'll forward them to anyone who is interested in building the desktop.
Attention KDE developers! Add native pulseaudio support to the kde desktop ASAP!
The summary is 99% vaporware. The FBI people that are spending the money on this boondoggle are over promising on a big IT project. It's not going to work out the way everyone thinks it will. I replied before I checked if anyone from the biometrics industry replied, so hopefully I'm repeating what they said.
1. Data isn't shared or otherwise capable of being shared. Biometric systems from the gui all the way back to the template that's stored is proprietary. Short-story, biometric systems are a GIANT black box. The biometric scenarios in the summary are just wrong. 100% wrong.
2. I'm not aware of any gov't agencies operating as the paragon of customer service, so they are going to start now?????
3. I'm too lazy to dig up the stories about the FBI's IT problems. But they've got em and another silo won't make them more effective.
The summary is a bit misleading. Notebook manufacturers are in a gruesome race for ODM/OEM contracts. The only reason they have for spec'ing more RAM is because the customer (DELL, HP, etc) are paying for it and the price for the larger RAM spec is lower.
This is how retail works in the U.S. When the market for a new gadget gets big enough and HP has a couple products in the market to test and get feedback on, they then buy all of the retailer's space devoted to the weakest competitors. From there it is only a matter of time before other weak competitors cannot afford to stay in the retailer.
Case in point: HP digital cameras and LCD panels. Both categories have POS HP products compared to many competitors and yet they dominate the category. The magic bullet is buying out the retailer.
How many vendors of proprietary applications have their source repositories sitting on the Internet with a visible public interface and developers who may never have even met each other logging in from all over the world?
What's wrong with anything you just described? These are all good traits. It maximizes cooperation toward a common goal. It's terribly misleading to ignore the fact that the public access is read-only.
I also like how you blanket-troll all vendors of proprietary applications as if none posses basic ethics.
In my experience, there are some ethical vendors. But they are few and very far between. As a general market condition honesty is not rewarded.
EAL is not about security features, it is about assurance levels
Your initial post suggest EAL would magically expose the back door. It will not. That is not how an CC review works.
CC evaluation lab has source level access to the system
As if source code access would expose the back door? It would not. Source code needs to agree with the documentation provided. Period. Back doors to a cryptographic algorithm are way outside the scope of CC certification.
I am running Windows Server 2K8 Don't get me started on Microsoft's elaborate blame-shifting system (Are you sure?) that's difficult to use. Maintaining a mixed environment of 2000/2003/MSSQL is extremely difficult. I can't keep a single cluster node at 99.999 uptime. Meanwhile, my Linux servers are running at 99.999% uptime.
Let's walk through these expert comments one step at a time:
Anybody who is paranoid about this issue
Did you see what just happened there? This is a clever sleight of words used to disparage and marginalize anyone who questions his premise. Disagree? Put on your tin foil hat and go to the psych ward. There's no room for discussion or even consideration of alternatives. Based on my direct, but very distant experience, Bruce is right in calling the backdoor.
The Common Criterial evaluators look for such issues They do? Really? Anyone that has undergone EAL evaluation knows it's a giant tree-killing documentation project above all. I don't want to bore anyone with the details of CC evaluation, but it's not a creditable rebuttal to the issue. The meat of the matter from wikipedia "Higher EAL levels do not necessarily imply "better security", they only mean that the claimed security assurance of the TOE has been more extensively validated." http://en.wikipedia.org/wiki/Common_Criteria
As another post so insightfully states, there's no reason why, IF some project actually needs the feature, they can't install it as a library. Just like we all do for openssl on windows.
We all know Microsoft's target audience is the PHB. They will race to the faulty assumption the OS security is bulletproof. A condition which is not knowable, nor very likely considering their long-time meme that "good security" = "good firewall"
port filtering is just one property of a firewall, that alone does not constitute a firewall
Let's not get into a game of semantics abuse.
The author boldly states they use no firewall which leads one to believe they gave the machines a public IP address with no other protection. And then buried in the story is the method by which they protect the servers.
The author has undeniably mislead readers. Because of Microsoft's long history of misleading practically everyone at one time or another to meet their end goals, it is reasonable to assume this was intentional.
1. The asshat highlights they use no firewall, and yet buried deeper in the article is this "Router ACLs are in place to block unnecessary ports" That's the functional equivalent of a firewall.
2. I get into discussions where tech guys spew traffic numbers and I'm never impressed. It creates issues if you want to actually do something with the data which I doubt they do much beyond running the usual marketing metrics. Until you actually shoot for 99.99 service uptime, you begin to comprehend the challenge it is (on any platform) the traffic itself is not the challenge.
3. I'm very interested in reading what their hardware budget is like. I get excellent performance out of Linux compared to server 2003 boxes on similar compaq dl380's.
Anyone who's been around a while will recognize this as low-quality legal practice. It's your typical drag net style of litigation.
In better cases, it's simple intimidation. In the worst case scenario, the lawyers actually hope to get something out of everyone. Either way, a polite letter back that says, "Nothing to see here. Move along." will pretty much chase the scum bags away.
Like the RIAA file sharing lawyers, the jokers pulling this stunt should be dragged before their respective bar association and flogged with paper clips. ( or whatever the bar does to punish lawyers)
Warning! You've entered the Microsoft Reality Distortion Field.
While it **looks** like a proper unix-ish escalation at the gui level, it most certainly is not at the OS level. UAC is not and does not prevent privilege escalation in the same manner as a unix-ish OS.
UAC is permeable. Despite Microsoft's efforts to paint it as unix-ish, it is not. It is nothing like it. Mark Russinovich describes UAC's massive shortcomings in great technical detail.
I'm all for using the best tool for the job. In fact I make my living babysitting windows boxes, but Vista is not the best tool for the unknowing user as a desktop.
As individuals, yes I agree 100%. Especially as a sysadmin, no one bats 1000. It's all about setting things up so the failures are graceful rather than total flame-outs.
But we're talking about a company with proprietary operating system and total market control that spent man-years developing kernel-level DRM for practically all I/O instead of developing a sane security model. "Allow/Deny?" is not a security model. Neither is UAC. It allows privilege escalation. Mark Russinovich, MS's own man said so much to the chagrin of corporate I'm sure.
Some of the people modding your comment insightful have (probably) fallen into Microsoft's version of the Steve Jobs Reality Distortion Field.
Totally my personal experience when I proclaim there are extremely talented software engineers in Russia that are under-utilized in the global market. I will definitely be watching closely. Maybe some others can share their experiences?
Having had only a tiny glimpse into the world of government contracting, I find it impossible to believe it will all come down to the price Google pays.
Some other/.'ers with contracting experience will probably back me up when I claim the price offered (or paid in this case) has nothing to do with winning a contract.
Head of digital media research company conveniently forgets the enormous costs of producing and distributing CD's.
Let's say for argument's sake, 100,000 CD kits cost $5 to make. Before you sink a half-million on inventory, you pay the printer, graphic designer, shipping costs, editors/proof readers and logistics personnel to get everything to the final CD packager.
You still haven't distributed a single CD. To distribute the CD you pay shipping and a variety of logistics personnel to make sure they are getting where they need to go.
Your sales/marketing costs don't go away with digital distribution and for that reason, the media conglomerates will maintain their cartel and probably make MORE MONEY THAN EVER
Since when are white collar crimes & cheating at board games considered violence? An admittedly ham-fisted attempt to highlight the slippery slope about the ridiculous generalizations.
a bunch of scientists can't do some basic tests to find out if an adult or child has pre-existing violent tendancies?
You mean like in-eutero testing? There is no such thing as pre-existing violent conditions except in children with permanent developmental problems.
Maybe you are proposing establishing a baseline for violence and then letting them play a bunch of FPS games? Let's just say experimenting on children by exposing them to violence wouldn't go over very well pretty much anywhere...
Slashdot Mirror
1. I don't think mature Linux users will care. Linux is a great tool and does some things that osx can't do. At some point the killer Linux app will come along that will drive adoption. This is pretty much how it's always worked. This is how Linux is gaining now.
2. Stealing desktop share is a moot point. Apple has been trying for as long as I can remember to switch windows users and it doesn't work that well on its own until Vista came along.
3. Right now, Linux is the third alternative that will probably make either osx or vista look better to most. It's the shouting (advertising) that makes Apple products more viable. If Ubuntu could afford Apple-scale advertising, then you would see even more adoption.
1. This so-called progress microsoft claims to make in server license penetration conveniently disregards the fact that the number of OSS server projects is multiplying faster and still growing faster than their numbers.
2. Who buys a windows server license with the expectation that they'll do their own hosting???? Most don't and won't ever. For the person that jumps up and says "I will! It'll run my corporate wiki!" That's one very narrow case in which license compliance (CAL's) would be conveniently disregarded anyway.
3. Most shops have either a site license or run the enterprise versions. They will continue to cook the numbers by offering more sweet deals to hosts like godaddy.
Ummm. Can someone explain about the smoke and mirrors? No Energy Star? Please.
That's exactly how a publication like PC Mag works if you don't have a big PR machine and advertising budget behind you. They use odd reasons peppered throughout a review to discredit the product. It's all vaguely based in facts that are used to come to a non-sensical conclusion that the product is "bad."
It's important to acknowledge the legitimate shortcomings of the product. In this case it's the fact that their e17 desktop has many shortcomings.
Before yet another post dismissing the review in its entirety is posted, there are some totally valid claims.
1. Lack of flash plugin. Yes, they totally side-stepped the legal problems, but how about a script to do the job on startup??
2. Lack of polish. I backported everex's e17 gui onto an older kubuntu and I found the same issues the reviewer did. Plug a flash drive in and watch what doesn't happen. No system tray and none was ever planned. I discovered pulseaudio though and that was worth the effort.
3. It's under-powered. Until Microsoft sells PC Magazine's editors on a "new low-power market" PC Mag will call low-power anything bad.
It should go without saying that a $299 PC is the worst possible thing to happen to PC Magazine. Everex certainly isn't going to spend money on PC Magazine's editors or buy adverts with the tiny profit margins.
As an FYI: Everex's one or two of the e17 source packages are very broken. They aren't even ubuntu quality and they would never make it into a Debian repo. I took careful notes during the whole build and I'll forward them to anyone who is interested in building the desktop.
Attention KDE developers! Add native pulseaudio support to the kde desktop ASAP!
The summary is 99% vaporware. The FBI people that are spending the money on this boondoggle are over promising on a big IT project. It's not going to work out the way everyone thinks it will. I replied before I checked if anyone from the biometrics industry replied, so hopefully I'm repeating what they said.
1. Data isn't shared or otherwise capable of being shared. Biometric systems from the gui all the way back to the template that's stored is proprietary. Short-story, biometric systems are a GIANT black box. The biometric scenarios in the summary are just wrong. 100% wrong.
2. I'm not aware of any gov't agencies operating as the paragon of customer service, so they are going to start now?????
3. I'm too lazy to dig up the stories about the FBI's IT problems. But they've got em and another silo won't make them more effective.
The summary is a bit misleading. Notebook manufacturers are in a gruesome race for ODM/OEM contracts. The only reason they have for spec'ing more RAM is because the customer (DELL, HP, etc) are paying for it and the price for the larger RAM spec is lower.
So, how functional will this compatibility mode be? Maybe like user mode in XP? Like the blame-shifting mechanism UAC in Vista?
Allow or Deny this comment?
This is how retail works in the U.S. When the market for a new gadget gets big enough and HP has a couple products in the market to test and get feedback on, they then buy all of the retailer's space devoted to the weakest competitors. From there it is only a matter of time before other weak competitors cannot afford to stay in the retailer.
Case in point: HP digital cameras and LCD panels. Both categories have POS HP products compared to many competitors and yet they dominate the category. The magic bullet is buying out the retailer.
How many vendors of proprietary applications have their source repositories sitting on the Internet with a visible public interface and developers who may never have even met each other logging in from all over the world?
What's wrong with anything you just described? These are all good traits. It maximizes cooperation toward a common goal. It's terribly misleading to ignore the fact that the public access is read-only.
I also like how you blanket-troll all vendors of proprietary applications as if none posses basic ethics.
In my experience, there are some ethical vendors. But they are few and very far between. As a general market condition honesty is not rewarded.
If this were to happen to a proprietary application you wouldn't get an honest answer from the vendor. The bigger the vendor the worse the response.
EAL is not about security features, it is about assurance levels
Your initial post suggest EAL would magically expose the back door. It will not. That is not how an CC review works.
CC evaluation lab has source level access to the system
As if source code access would expose the back door? It would not. Source code needs to agree with the documentation provided. Period. Back doors to a cryptographic algorithm are way outside the scope of CC certification.
I am running Windows Server 2K8
Don't get me started on Microsoft's elaborate blame-shifting system (Are you sure?) that's difficult to use. Maintaining a mixed environment of 2000/2003/MSSQL is extremely difficult. I can't keep a single cluster node at 99.999 uptime. Meanwhile, my Linux servers are running at 99.999% uptime.
Let's walk through these expert comments one step at a time:
Anybody who is paranoid about this issue
Did you see what just happened there? This is a clever sleight of words used to disparage and marginalize anyone who questions his premise. Disagree? Put on your tin foil hat and go to the psych ward. There's no room for discussion or even consideration of alternatives. Based on my direct, but very distant experience, Bruce is right in calling the backdoor.
The Common Criterial evaluators look for such issues
They do? Really? Anyone that has undergone EAL evaluation knows it's a giant tree-killing documentation project above all. I don't want to bore anyone with the details of CC evaluation, but it's not a creditable rebuttal to the issue. The meat of the matter from wikipedia "Higher EAL levels do not necessarily imply "better security", they only mean that the claimed security assurance of the TOE has been more extensively validated." http://en.wikipedia.org/wiki/Common_Criteria
As another post so insightfully states, there's no reason why, IF some project actually needs the feature, they can't install it as a library. Just like we all do for openssl on windows.
We all know Microsoft's target audience is the PHB. They will race to the faulty assumption the OS security is bulletproof. A condition which is not knowable, nor very likely considering their long-time meme that "good security" = "good firewall"
port filtering is just one property of a firewall, that alone does not constitute a firewall
Let's not get into a game of semantics abuse.
The author boldly states they use no firewall which leads one to believe they gave the machines a public IP address with no other protection. And then buried in the story is the method by which they protect the servers.
The author has undeniably mislead readers. Because of Microsoft's long history of misleading practically everyone at one time or another to meet their end goals, it is reasonable to assume this was intentional.
1. The asshat highlights they use no firewall, and yet buried deeper in the article is this "Router ACLs are in place to block unnecessary ports" That's the functional equivalent of a firewall.
2. I get into discussions where tech guys spew traffic numbers and I'm never impressed. It creates issues if you want to actually do something with the data which I doubt they do much beyond running the usual marketing metrics. Until you actually shoot for 99.99 service uptime, you begin to comprehend the challenge it is (on any platform) the traffic itself is not the challenge.
3. I'm very interested in reading what their hardware budget is like. I get excellent performance out of Linux compared to server 2003 boxes on similar compaq dl380's.
Anyone who's been around a while will recognize this as low-quality legal practice. It's your typical drag net style of litigation.
In better cases, it's simple intimidation. In the worst case scenario, the lawyers actually hope to get something out of everyone. Either way, a polite letter back that says, "Nothing to see here. Move along." will pretty much chase the scum bags away.
Like the RIAA file sharing lawyers, the jokers pulling this stunt should be dragged before their respective bar association and flogged with paper clips. ( or whatever the bar does to punish lawyers)
This is one of the few times an accurate comment has been posted on debit/credit stories. Learn well.
Warning! You've entered the Microsoft Reality Distortion Field.
While it **looks** like a proper unix-ish escalation at the gui level, it most certainly is not at the OS level. UAC is not and does not prevent privilege escalation in the same manner as a unix-ish OS.
UAC is permeable. Despite Microsoft's efforts to paint it as unix-ish, it is not. It is nothing like it. Mark Russinovich describes UAC's massive shortcomings in great technical detail.
I'm all for using the best tool for the job. In fact I make my living babysitting windows boxes, but Vista is not the best tool for the unknowing user as a desktop.
Tell your friend to run codeblocks as an administrator
Really? Another instance where a sane security model was ignored.
As individuals, yes I agree 100%. Especially as a sysadmin, no one bats 1000. It's all about setting things up so the failures are graceful rather than total flame-outs.
But we're talking about a company with proprietary operating system and total market control that spent man-years developing kernel-level DRM for practically all I/O instead of developing a sane security model. "Allow/Deny?" is not a security model. Neither is UAC. It allows privilege escalation. Mark Russinovich, MS's own man said so much to the chagrin of corporate I'm sure.
Some of the people modding your comment insightful have (probably) fallen into Microsoft's version of the Steve Jobs Reality Distortion Field.
Totally my personal experience when I proclaim there are extremely talented software engineers in Russia that are under-utilized in the global market. I will definitely be watching closely. Maybe some others can share their experiences?
Having had only a tiny glimpse into the world of government contracting, I find it impossible to believe it will all come down to the price Google pays.
/.'ers with contracting experience will probably back me up when I claim the price offered (or paid in this case) has nothing to do with winning a contract.
Some other
Head of digital media research company conveniently forgets the enormous costs of producing and distributing CD's.
Let's say for argument's sake, 100,000 CD kits cost $5 to make. Before you sink a half-million on inventory, you pay the printer, graphic designer, shipping costs, editors/proof readers and logistics personnel to get everything to the final CD packager.
You still haven't distributed a single CD. To distribute the CD you pay shipping and a variety of logistics personnel to make sure they are getting where they need to go.
Your sales/marketing costs don't go away with digital distribution and for that reason, the media conglomerates will maintain their cartel and probably make MORE MONEY THAN EVER
For once a post that argues insightfully and sticks to the facts. I stand corrected on many details. Good job AC!
Since when are white collar crimes & cheating at board games considered violence?
An admittedly ham-fisted attempt to highlight the slippery slope about the ridiculous generalizations.
a bunch of scientists can't do some basic tests to find out if an adult or child has pre-existing violent tendancies?
You mean like in-eutero testing? There is no such thing as pre-existing violent conditions except in children with permanent developmental problems.
Maybe you are proposing establishing a baseline for violence and then letting them play a bunch of FPS games? Let's just say experimenting on children by exposing them to violence wouldn't go over very well pretty much anywhere...