The OpenBSD crowd spent their time worrying about those very security problems, as well as others. I suspect they wanted SMP now because the dual core chips are going to start coming out soon.
Also... some security problems come from race conditions. Those are a lot easier to avoid in a biglock kernel than they are in something like FreeBSD 5.
That's not entirely accurate. NetFilter can do it. It's really ugly though. You have to tell it where the ACK flag is in the headers because it doesn't know.
From the site I linked:
tc filter add dev ppp14 parent 1:0 protocol ip prio 10 u32 \
match ip protocol 6 0xff \
match u8 0x05 0x0f at 0 \
match u16 0x0000 0xffc0 at 2 \
match u8 0x10 0xff at 33 \
flowid 1:3
That will (apparently) prioritize ACK packets with no payload. Then there's the PF way. I can actually write one of these rules myself without copy & pasting some magic out of some HOWTO.
pass out on $external_nic queue( out_standard, out_fast )
You'd probably want to add a "keep state" to that, and maybe other stuff... but that's the basic idea.
FSB speed is basically irrelevant when it's fast enough to keep up with the memory bus, as Intel has demonstrated for us. The only thing the chip ever does (with some VERY RARE exceptions) is access memory.
Even on a two processor system, the speed of the memory bus is the bottleneck. Since the only thing the processors ever do is access memory, and there is only one memory bus, the extra speed doesn't help anything.
One assumes that IBM has a good reason for pumping up the bus speed, but it has nothing to do with accessing memory faster. More likely it's so they don't have to muck around with the internals of the chip when they bump the clock speed.
I'm not saying you deserved to win (as I'm sure there were hundreds of equally cool or cooler logos submitted), but you deserved to win a great deal more than the "flag of indifference".
the contest, months of waiting... for THAT?
on
NetBSD Chooses New Logo
·
· Score: 5, Interesting
I'm sorry, but it's really hard to get excited about that logo. Seems to me they wanted to be so neutral, so inoffensive to everyone in the entire world that they picked a logo that means nothing.
That sound you hear is millions of geeks the world over saying "meh".
"since BitTorrent isn't a huge central network it's quite likely IMO that Torrent users are mostly safe."
I disagree. The tracker makes no attempt to conceal your IP address. All the RIAA (or MPAA) needs to do is grab a bunch of.torrents and they can get a list of IPs from the tracker.
The strengths of bittorrent are that a) it has substantial legitimate uses (all those Linux ISOs, etc) and b) you don't have to tell anyone about your tracker.
I wouldn't feel safe and secure using suprnova though. Well, not unless I lived in Canada. Which I do.
Given the numbers (at least tens of thousands of people), it's near certain that a large number of slashdotters already have been sued. Apart from bitching and moaning, I don't see a lot of change around here.
All traffic on my network destined for the Internet passes through my OpenBSD machine, and it prioritizes ACKs for everyone. My Mac is a laptop, and when I'm elsewhere I rely on the built in, auto-configured ipfw. It doesn't do traffic shaping or anything, but it does the job.
"Why isnt this behaviour to prioritize ACK packets the default operation in Linux?"
It's not the default operation on any OS I know, the PF configuration syntax just allows you to specify what to do easier than on Linux. On Linux you must specify a mask to apply to the headers to tell the firewall which packets to consider high priority. On OpenBSD you just give it two different queues. It uses the first one by default, it uses the second one if it's important. It takes care of the details.
You need to know how fast the connection actually is, rather than what the NIC reports, which is why it can't be done by default. My NIC reports that my internet connection is 100 mbit/s, but it's actually 5 mbit/s down 512 kbit/s up. TCP throttles connections by going as fast as it can without dropping packets, so it doesn't actually know for sure how fast the connection is.
"Can any one help shed some light on doing this for Linux easily?"
Scroll down to "General Selectors". It's not what I would call easy, but that's all I could find... it's possible there's something better out there, but I'm not motivated to look because my OpenBSD setup already works.
Fortunately my Mac and my Linux box can benefit from the OpenBSD firewall. The Mac and Linux firewalls suck, but the OSes are good for other things.:)
This was posted on Slashdot a while back. I personally use this for my home network with pretty much the same results posted there (as far as I can tell without doing formal testing). It's pretty much the only way I can keep my connection usable when my web server or torrents are having a good day.
PF is now available on OpenBSD, FreeBSD, NetBSD and DragonFlyBSD. I think some of them may still be lacking ALTQ support (needed to do the stuff in that link), but I'm not sure, I don't keep track of all of them.
I'm vaguely aware of NetFilter on Linux having similar capabilities, but AFAIK you need to tell it how to detect ACK and URG packets, it doesn't "just know" like PF does. I could be wrong about that, as it's been a long time since I looked into it. IPF and IPFW may or may not be able to do this, I have no knowledge of their capabilities in this area.
But they suck anyway. I've had problems with 4 of the last 5 orders I placed with them. And with the exchange rate being what it is*, it's probably cheaper to order it from Amazon.com anyway. I guess Bush is good for something after all.
"Yeah, I am *really* sure they were *scared* of that one."
You're kidding, right? Penny Arcade is one of the most widely read and most influential gaming sites out there. They're also a good indicator of the mood of the industry.
While I agree that Nintendo took appropriate action, I think that they realized that they needed to dispose of the situation very quickly once it started hitting the major news sites. And Penny Arcade.:)
" I wonder how these babies stack up against the dual G5 machines Apple has been offering. Looking at the specs, the Mac looks like a better deal."
As always, it depends on what you want it for.
The w2100z (and the single processor w1100z) have a 10k RPM Ultra320 SCSI drive, ECC memory, etc. These machines are built to be much more reliable than anything meant for the desktop from any OEM (including Apple). Also, for some tasks, the Opteron has an edge over the G5 for various reasons (on die memory controller reduces latency, bigger cache, etc).
Another consideration is the OS choice. It'll run Windows (if for some reason you wanted to run Windows), Linux*, and Solaris. There are some things for which MacOS is better suited (that would be I own an Apple computer), but there's plenty of stuff for which Solaris or Linux is better suited.
Like I said. It depends on what you want it for.
* - Note that while Linux will run on Apple hardware, stuff like Java is not available, and some things don't run properly.
"The title is a little interesting to me. The Return of the SUN Workstation. Does this mean to say that the current versions of UltraSPARC and Sun Blade systems shouldn't be considered workstations? What do we (as a/. community) describe workstation as, anyway? Do we mean to say really high end 3D work in CAD/CAM, etc? Is the lowly XP machine I'm forced to use at work a "workstation" because it's where I get work done?"
It's a "return" because from a performance standpoint, SPARC can't keep up anymore.
"But if it turns out to be real, will they be able to gain a significant market share?"
Almost certainly yes. Mozilla derived browsers have a pretty good share with people that actually know what it is. When most others hear about another browser, they think "Oh, that's just a third party browser that probably doesn't work properly.".
On the other hand, the Google name carries vast weight. Google has a reputation for going everywhere and working with everything. A better reputation than Microsoft.
Slashdot Mirror
Note the recent decrease in hard drive warantees and the even more recent increase.
People voted with their feet, because hard drive failures are extremely annoying.
CD-ROMs usually fail harmlessly and can be replaced painlessly.
The OpenBSD crowd spent their time worrying about those very security problems, as well as others. I suspect they wanted SMP now because the dual core chips are going to start coming out soon.
Also... some security problems come from race conditions. Those are a lot easier to avoid in a biglock kernel than they are in something like FreeBSD 5.
That's not entirely accurate. NetFilter can do it. It's really ugly though. You have to tell it where the ACK flag is in the headers because it doesn't know.
From the site I linked:
tc filter add dev ppp14 parent 1:0 protocol ip prio 10 u32 \
match ip protocol 6 0xff \
match u8 0x05 0x0f at 0 \
match u16 0x0000 0xffc0 at 2 \
match u8 0x10 0xff at 33 \
flowid 1:3
That will (apparently) prioritize ACK packets with no payload. Then there's the PF way. I can actually write one of these rules myself without copy & pasting some magic out of some HOWTO.
pass out on $external_nic queue( out_standard, out_fast )
You'd probably want to add a "keep state" to that, and maybe other stuff... but that's the basic idea.
FSB speed is basically irrelevant when it's fast enough to keep up with the memory bus, as Intel has demonstrated for us. The only thing the chip ever does (with some VERY RARE exceptions) is access memory.
Even on a two processor system, the speed of the memory bus is the bottleneck. Since the only thing the processors ever do is access memory, and there is only one memory bus, the extra speed doesn't help anything.
One assumes that IBM has a good reason for pumping up the bus speed, but it has nothing to do with accessing memory faster. More likely it's so they don't have to muck around with the internals of the chip when they bump the clock speed.
I'm not saying you deserved to win (as I'm sure there were hundreds of equally cool or cooler logos submitted), but you deserved to win a great deal more than the "flag of indifference".
I'm sorry, but it's really hard to get excited about that logo. Seems to me they wanted to be so neutral, so inoffensive to everyone in the entire world that they picked a logo that means nothing.
That sound you hear is millions of geeks the world over saying "meh".
Let me know when the Gentoo zealots stop seeing my sig and deciding that they should try to convince me that my experience didn't suck.
"since BitTorrent isn't a huge central network it's quite likely IMO that Torrent users are mostly safe."
.torrents and they can get a list of IPs from the tracker.
I disagree. The tracker makes no attempt to conceal your IP address. All the RIAA (or MPAA) needs to do is grab a bunch of
The strengths of bittorrent are that a) it has substantial legitimate uses (all those Linux ISOs, etc) and b) you don't have to tell anyone about your tracker.
I wouldn't feel safe and secure using suprnova though. Well, not unless I lived in Canada. Which I do.
Given the numbers (at least tens of thousands of people), it's near certain that a large number of slashdotters already have been sued. Apart from bitching and moaning, I don't see a lot of change around here.
"So, you run PF on your Mac then?"
No. MacOS uses ipfw.
All traffic on my network destined for the Internet passes through my OpenBSD machine, and it prioritizes ACKs for everyone. My Mac is a laptop, and when I'm elsewhere I rely on the built in, auto-configured ipfw. It doesn't do traffic shaping or anything, but it does the job.
"Why isnt this behaviour to prioritize ACK packets the default operation in Linux?"
:)
It's not the default operation on any OS I know, the PF configuration syntax just allows you to specify what to do easier than on Linux. On Linux you must specify a mask to apply to the headers to tell the firewall which packets to consider high priority. On OpenBSD you just give it two different queues. It uses the first one by default, it uses the second one if it's important. It takes care of the details.
You need to know how fast the connection actually is, rather than what the NIC reports, which is why it can't be done by default. My NIC reports that my internet connection is 100 mbit/s, but it's actually 5 mbit/s down 512 kbit/s up. TCP throttles connections by going as fast as it can without dropping packets, so it doesn't actually know for sure how fast the connection is.
"Can any one help shed some light on doing this for Linux easily?"
Some HOWTO somewhere
Scroll down to "General Selectors". It's not what I would call easy, but that's all I could find... it's possible there's something better out there, but I'm not motivated to look because my OpenBSD setup already works.
Fortunately my Mac and my Linux box can benefit from the OpenBSD firewall. The Mac and Linux firewalls suck, but the OSes are good for other things.
From RFC 3449: "performance often degrades significantly because of imperfection and variability in the ACK feedback from the receiver to the sender."
prioritizing ACK packets with PF on OpenBSD
This was posted on Slashdot a while back. I personally use this for my home network with pretty much the same results posted there (as far as I can tell without doing formal testing). It's pretty much the only way I can keep my connection usable when my web server or torrents are having a good day.
PF is now available on OpenBSD, FreeBSD, NetBSD and DragonFlyBSD. I think some of them may still be lacking ALTQ support (needed to do the stuff in that link), but I'm not sure, I don't keep track of all of them.
I'm vaguely aware of NetFilter on Linux having similar capabilities, but AFAIK you need to tell it how to detect ACK and URG packets, it doesn't "just know" like PF does. I could be wrong about that, as it's been a long time since I looked into it. IPF and IPFW may or may not be able to do this, I have no knowledge of their capabilities in this area.
I don't believe they use a forever cookie, they use a cookie that's invalidated after you log out OR (optionally) a 2 week cookie.
What I don't like about it is that it doesn't use SSL after you log in.
But they suck anyway. I've had problems with 4 of the last 5 orders I placed with them. And with the exchange rate being what it is*, it's probably cheaper to order it from Amazon.com anyway. I guess Bush is good for something after all.
* USD$1.00 = CDN$0.821
"Yeah, I am *really* sure they were *scared* of that one."
You're kidding, right? Penny Arcade is one of the most widely read and most influential gaming sites out there. They're also a good indicator of the mood of the industry.
I'm not a gamer, but even I know that much.
While I agree that Nintendo took appropriate action, I think that they realized that they needed to dispose of the situation very quickly once it started hitting the major news sites. And Penny Arcade. :)
I think it's a conspiracy. One assumes at least some of the 200k geeks will pay to see the hot goth chicks naked. They both benefit.
It might be harder, but it's possible, and the signal has to go through routers, which can be compromised.
To store it, I imagine you're want a RAID array. A big one.
Do you want your confidential data shooting across this network in plaintext?
Alternatively, do you want to encrypt data fast enough for it to be worth it?
No, I'm not. Fark is completely different.
For one thing, on Fark people would be posting barely SFW pictures.
No chance of intelligent conversation in this thread. At all.
" I wonder how these babies stack up against the dual G5 machines Apple has been offering. Looking at the specs, the Mac looks like a better deal."
As always, it depends on what you want it for.
The w2100z (and the single processor w1100z) have a 10k RPM Ultra320 SCSI drive, ECC memory, etc. These machines are built to be much more reliable than anything meant for the desktop from any OEM (including Apple). Also, for some tasks, the Opteron has an edge over the G5 for various reasons (on die memory controller reduces latency, bigger cache, etc).
Another consideration is the OS choice. It'll run Windows (if for some reason you wanted to run Windows), Linux*, and Solaris. There are some things for which MacOS is better suited (that would be I own an Apple computer), but there's plenty of stuff for which Solaris or Linux is better suited.
Like I said. It depends on what you want it for.
* - Note that while Linux will run on Apple hardware, stuff like Java is not available, and some things don't run properly.
"The title is a little interesting to me. The Return of the SUN Workstation. Does this mean to say that the current versions of UltraSPARC and Sun Blade systems shouldn't be considered workstations? What do we (as a /. community) describe workstation as, anyway? Do we mean to say really high end 3D work in CAD/CAM, etc? Is the lowly XP machine I'm forced to use at work a "workstation" because it's where I get work done?"
It's a "return" because from a performance standpoint, SPARC can't keep up anymore.
What do you hate about NFS? Please note that I'm not deffending it, I'm merely curious.
"But if it turns out to be real, will they be able to gain a significant market share?"
Almost certainly yes. Mozilla derived browsers have a pretty good share with people that actually know what it is. When most others hear about another browser, they think "Oh, that's just a third party browser that probably doesn't work properly.".
On the other hand, the Google name carries vast weight. Google has a reputation for going everywhere and working with everything. A better reputation than Microsoft.