for one thing you'd have to run OSX, and the other problem is that you'd have to run Apple hardware. Seems like a couple of deal breakers to me.
Haha, you're such a jackass...
Seriously...
Out of all the expenses involved with running a data center, the so call extra cost of OSX and the Apple hardware is in the noise level. I think it's time for you to get back to playing your XBOX.
Targeted ads are better than the usual wide-angle shotgun spamming we see now.
It's sad when someone actually prefers a spammer that knows about their preferences, shopping, and searching habits over someone who "shotgun spams" without a clue about who they send the spam to..
If you actually paid attention what's going on, Google is speculated to be making an OS for phones, not phones themselves, and certainly not the network the phones will connect to. This is good - if wireless companies actually adopt this, it means more interoperability and less lock-down, and an open platform for you to make your own phone apps, etc.... How you get out of this that Google will be tracking your phone calls is beyond me,
Paid attention? What? You mean the fact that they are working on web applications that put our documents on THEIR servers. Ad-Words, and tracking our search histories..
Google collects personal information when you register for a Google service or otherwise voluntarily provide such information. We may combine personal information collected from you with information from other Google services or third parties to provide a better user experience, including customizing content for you.
Google uses cookies and other technologies to enhance your online experience and to learn about how you use Google services in order to improve the quality of our services.
Google's servers automatically record information when you visit our website or use some of our products, including the URL, IP address, browser type and language, and the date and time of your request.
Read more in the full privacy policy.
Uses
We may use personal information to provide the services you've requested, including services that display customized content and advertising.
We may also use personal information for auditing, research and analysis to operate and improve Google technologies and services.
We may share aggregated non-personal information with third parties outside of Google.
When we use third parties to assist us in processing your personal information, we require that they comply with our Privacy Policy and any other appropriate confidentiality and security measures.
We may also share information with third parties in limited circumstances, including when complying with legal process, preventing fraud or imminent harm, and ensuring the security of our network and services.
Google processes personal information on our servers in the United States of America and in other countries. In some cases, we process personal information on a server outside your own country.
Read more in the full privacy policy.
So who is the one not paying attention?? You may want to stop drinking the kool-aid.
It's not clear to me what problem is being solved by having virtual OSX.
Availability
Imagine having an instance of an OSX operating system running on a rack of XServers. Now imagine that particular XServer getting bogged down by another OSX instance, or worse beginning to show signs of failing. By having instances of OSX running on virtuallized servers (especially on identical hardware), that particular instance of OSX can migrate to a better performing XServer within the rack without the software or the users of the instance realizing that a change has been made. Other than some latency due to the migration.
Wow I talked about migrating virtual operating systems twice in one week, this is an omen...
Great. Now Google will not only know what I search for but also who I talk to on the phone....
The weird and scary part about this is the number of slashdotters who can't wait for this to happen.
So let me get this straight. AT&T as a communication monopoly is bad. Microsoft as a operating systems monopoly is bad. Google as a monopoly on all things data is good? Let me clarify: Google as an all knowing overseer of all things being communicated is good??
We worry about the government tracking us, but not a corporation that derives it's income from targeted ads??
I'd hope that memory randomization and sandboxing would take care of most of the vulnerabilities.
The job of the firewall is not to prevent vulnerabilities, it is to prevent unauthorized access.
While the above is true, you are correct that a firewall can help prevent exploits by limiting access. However, setting the service configuration files correctly and disabling unused services are a better solution.
I might add that if you were to install services manually, you can still manually setup the firewall rules (ipfw) to do what you want. So what was your point?
But signed does not mean flawless (i.e. not exploitable).
True, but:
A>> Firewalled doesn't mean protected from exploitation. If you don't need the service, then disable it.
B>> One of the new security features of 10.5 is having the services running in a sandbox. If the service is actually running in a sandbox, then this would take care of most concerns about an undiscovered exploit.
I thought the appeal of Apple was that Things Just Work and it is so intuitive you don't have read the documentation? This is a major bug.
I think you missed a huge point in your haste to make a point against Apple. When the "Block all incoming connections" it blocks all user applications, not root applications.
now for a legitimate complaint -- Why did it disable my firewall during the upgrade? or did it??
So I decided to do an EXTERNAL port scan to see what was happening. Admittedly, I'm too lazy right now to set up my other computer and run nmap, so I'm using a TCP port scanner hosted on the internet. After running port 0 through 1055, all the ports came back closed with the exception of ports 135-139 and port 445 being stealthed. Ok this is a minor bug, because my computer now responds to pings and actively returns the port status for all but the Microsoft related ports (ok maybe Netbios is a better term than Microsoft related). However, NONE of the ports are functional.
So the default firewall settings are to drop the ICMP packets for 135-139 and 445.
So after setting the firewall to "block incoming connections for applications" running as my user account, I can re-enable the advance option to stealth all closed ports. I re-ran the tests and my computer no longer accepts pings or return the ICMP messages. As far as the external scanner knows, my computer no longer exists.
OK so what does this mean? Well it means that if I ran an application that used the network, I wouldn't be asked to allow the connection. OK, so I *may* become stupid one day and run a program that creates an available port - what's the big deal? Well it will have access to my directory and anything my user account can access, but not my root account. This is a user education problem, not an OS design issue. enabling the "block incoming options" should safeguard against some lapses in judgement.
What about the services running a root (like bonjour)? From Apple:
"Sandbox tested.
Sometimes hackers try to hijack an application to run malicious code. Sandboxing helps ensure that applications do only what they're intended to by restricting which files they can access, whether they can talk to the network, and whether they can be used to launch other applications. Helper applications in Leopard -- including the software that enables Bonjour and the Spotlight indexer -- are sandboxed to guard against attackers."
OK - So can we now dial down the hyperbole a little???
Don't try to downplay it like its no big deal. Security is always a big deal. I thought we all learned that from the countless Windows worms?
In order for a worm to work, we would have to have some method of it being able to propagate itself without user intervention. This requires teaching the user not to run applications from dubious sources, I see this as a problem for ALL operation systems.
(*) Ok some of the caveats of this new design: The firewall automatically trusts all applications digitally signed by Apple. The problem is, that Apple delivers a digitally signed version of netcat, which provides you with a transparent communication endpoint (signed by Apple, therefor passing the firewall in limited access mode). So all the programmer of an (unsigned!) trojan needs to do is replace his calls to listen() (that would present a dialog asking for permssion) with a suitable combination of fork/exec -- in fact he could even write a wrapper library implementing this. So at the end of the day, your firewall is worthless again.
If you don't mind, could you try that explanation one more time. I'm just casually looking at what you wrote, and I spot a problem with your trojan theory. How does a trojan promote itself to root? And what combination of fork/exec would cause the trojan to be able to promote itself to root? I only assumed that in your scenario that the trojan is root because it seems to be able to intercept system calls...
I have an idea on how this can be done (by fooling the user to allow an superuser operation at least once) but this degenerates into a user education problem... (eg. Once I fooled the user into giving me root, I can do anything I want to do anyway).
I can see the reasoning behind Apple's decision to auto-allow digitally signed applications. This is how they keep the "It just works" mantra true. Public-Key encryption should have enough milage on it by now to prove that it's a viable security tool... sigh.
Anyway you've demonstrated your ability to list running services, but you haven't followed up with what the *real* consequences are.
Believe me when I say that I am giving you the utmost benefit of the doubt about your findings. I just want to make sure it more substance than hyperbole. I do believe that if the mere act of upgrading to leopard turns off an already activated firewall, this is a bad thing (but not horribly bad). Of course I would have to actually look and verify that the firewall is working since (unlike some other OS) there isn't an annoying icon jumping up and down telling me that the firewall is working.
Of course, If your really super paranoid, you can always just override the firewall rules yourself (as you demonstrated in your article).
Anyway, it's been a long day but I still look forward to verifying your hypothesis (when I get home).
I've been on the fence about virtualization for a very long time now. Sure, it's quite convenient to install VMware, load up a guest OS, and tinker with new features. But to load up a server with multiple instances of the same operating system is ludicrous. It certainly doesn't scale well at all. And the marketing teams are incredibly good at making people believe that by installing their virtualization software, you'll suddenly have a bunch of "virtual" servers with the same capabilities as a single server. Sure, they all have the same capabilities from an OS standpoint, but performance isn't going to be anything close to a standalone server..
Performance will take a hit from the overhead involved, but availability should increase. Most server applications don't fully utilize the CPU anyway, so sacrificing some cycles to run the apps in a virtualized environment is not really a big deal. Where virtualization shines is availability. If a server is malfunctioning or overburdened, the virtualized environment can migrate to another server without the server clients knowing this has taken place (other than some latency caused by the migration). This is actually the coolest part of this technology.
I never thought about using virtual servers to increase security. Except for running windows within Mac OS X, I really don't see virtualization making anything more secure.
I think this is much ado about nothing. It is only here because Theo is getting upset...
I've had a balloon flight aborted due to a tear on a balloon. Even with a 4600 pound gondola, the balloon flew for at least 3 additional hours. Balloons this size have low pressure, and are fairly robust. They don't behave the same as the balloons used for birthday parties..
The project may usher in a new generation of balloon-borne scientific missions that cost less than sending instruments into space. Scientists also can test an instrument on a balloon before making a commitment to launch it on a rocket. The balloon, with its gondola of scientific instruments, was launched successfully on the morning of October 3 from the Columbia Scientific Balloon Facility in Fort Sumner, New Mexico.
Sounds like someone is a little excited about their balloon flight. First of all, congratulations on a successful flight!
Is there a decent pirated version of Vista yet? I usually use the pirated version of software, even if I have paid for it. Everything works better that way
Everything works better like that malware that may be hidden in that piece of pirated software. I just don't see how people can trust cracked software from anonymous sources. I bet these same people complain the most about how unstable an OS or any other piece of software may be.
I see nothing wrong with modifying a piece of software you bought using a script or patch that you understand well enough to know it doesn't introduce any malware. But to just pirate something off the internet is just playing russian roulette...
Name one. No one *has* to use anything. When I got sick of developing software on Windows I shifted my career to develop on Linux.
First of all you are correct - Nobody on this planet has to use Vista (much to the disappointment of MS). Well maybe the players of Vista only games, but there is always the XBox (I agree with you here too.)
Where we *may* disagree is that I believe there are people who have to use XP. There are applications available on the XP that are not available on Linux (w/o screwing with Wine and even then it may not actually work).
I do admire your dedication to the Linux platform, but Linux is not the panacea of computing. FWIW, I use Linux at work and OS X at home... So I agree with you that you don't need Windows to make money as long as you are in a field that doesn't use a commercial application that is only on Windows (No not office, more like CAD, Thermal Modelers, etc. that some PI decided to require for a project.).
Trying to play god with Hurricanes is not a new idea. Living on the gulf coast, every June (back in the 80's) I would hear talk, on the local radio stations, about the possibility of preventing strong hurricane. One technique that was tossed around was Cloud Seeding.
Anyway, the problem that was a huge hurdle back then, and remains today is LIABILITY. If the US Government was to attempt to manipulate a hurricane and it had little effect or worse increased the strength of a hurricane, the government may open itself to litigation. This is mostly an issue if the targeted hurricane makes landfall in a foreign country (eg. Mexico, the many Caribbean countries, or *shudder* Cuba), since suspicions on the US's intent would most likely cause an international crisis. Remember there was a cold war going on at the time...
After reading the article, I came to the conclusion:
While he may have been fired due to his age, he actually experienced a hostile work environment because of it. Come on, what if they said his ideas were too urban or feminine. What is they always referred to him as gang-banger or a sissy?
Obviously you can... a black woman cannot sue a studio for not giving her the part of Adolf Hitler in a movie. Same for strippers.
You're trying to confuse the issue. Is a black woman qualified to play a convincing white german? Maybe not as much as an actual white german. As for the stripper, WTF? Just because she strips at a "gentlemens" club doesn't mean she strips in public. A stripper who wants to be an actor, would be perfect to play Eva Braun.
Besides you act like the law forces you to hire old people just for the sake of hiring an old person. The law states that you can't deny a qualified person from a job based solely on race, gender, age, etc...
That all men are created equal has nothing to do with anti-discrimination law !
Yes it does. How can we say we live in a free society, if we chose to exclude participants based on sex, race, age, etc. ?
My refusing to hire straight white people has nothing to do with their rights, they don't have a "right to be hired", the right that matter in this case is mine, the right to freely associate with whom I want.
You're confused. Let me fix that for you: Nobody has the right to be hired by you, AND everybody has a right to not be discriminated against by you. I tell you what, give someone a letter saying that you did not hire them based on them being a straight white person. Let's see what happens next...
If anti-discrimination law followed from "equal rights" then why doesn't it apply to sex as well ? Doesn't everyone have a "right to get laid" as much as a "right to hired" ? By not being bisexual you'd be discriminating based on sex.
You're desperate.
If I am free to choose who I fuck with, I should be free to choose who I work with.
That sentence makes sense if you are a prostitute. Are you a prostitute? Now if prostitution was legal, you might not be so free to choose who you have intercourse with.
Politicians have turned the meaning towards : discriminating on criterions we don't judge relevant to do the job. There are two problems with that.
Huh?
I've always heard it as "You can't be discriminated against based on race, age, sex, etc." this is the same as "You can't be eliminated from being chosen based on...."
We labeled the act as "Racial Discrimination" or "Age Discrimination" these are nouns, and are used to convey "To be discriminated against based on race" or "To be discriminated against based on age". The jest being that "discriminate" is a verb and its meaning is as you said it was.
Discriminating is the act of choosing among different possibilities.
What's strange is that people believe that laws against discrimination is a new concept for the US. The founding fathers wrote the constitution on the basis that all men are created equal. Unfortunately it took admendments to make a more concise definition of what equal treatment means. And when further definition was called for, we lobbied for laws that give detail descriptions on what is legal and what is not.
As for your two problems... It sounds like the same reasoning behind the "Jim Crow" laws.
Slashdot Mirror
Bullets don't kill presentations, people kill presentations...
Someone had to say it... I still don't know why it had to be me...
Haha, you're such a jackass...
Seriously...
Out of all the expenses involved with running a data center, the so call extra cost of OSX and the Apple hardware is in the noise level. I think it's time for you to get back to playing your XBOX.
It's sad when someone actually prefers a spammer that knows about their preferences, shopping, and searching habits over someone who "shotgun spams" without a clue about who they send the spam to..
Paid attention? What? You mean the fact that they are working on web applications that put our documents on THEIR servers. Ad-Words, and tracking our search histories..
Oh let's be fair and ask google what their privacy policy is.. http://www.google.com/privacy.html
So who is the one not paying attention?? You may want to stop drinking the kool-aid.
Availability
Imagine having an instance of an OSX operating system running on a rack of XServers. Now imagine that particular XServer getting bogged down by another OSX instance, or worse beginning to show signs of failing. By having instances of OSX running on virtuallized servers (especially on identical hardware), that particular instance of OSX can migrate to a better performing XServer within the rack without the software or the users of the instance realizing that a change has been made. Other than some latency due to the migration.
Wow I talked about migrating virtual operating systems twice in one week, this is an omen...
Great. Now Google will not only know what I search for but also who I talk to on the phone....
The weird and scary part about this is the number of slashdotters who can't wait for this to happen.
So let me get this straight. AT&T as a communication monopoly is bad. Microsoft as a operating systems monopoly is bad. Google as a monopoly on all things data is good? Let me clarify: Google as an all knowing overseer of all things being communicated is good??
We worry about the government tracking us, but not a corporation that derives it's income from targeted ads??
Where can I get some of this google kool-aid?
I'd hope that memory randomization and sandboxing would take care of most of the vulnerabilities.
The job of the firewall is not to prevent vulnerabilities, it is to prevent unauthorized access.
While the above is true, you are correct that a firewall can help prevent exploits by limiting access. However, setting the service configuration files correctly and disabling unused services are a better solution.
I might add that if you were to install services manually, you can still manually setup the firewall rules (ipfw) to do what you want. So what was your point?
Why do people always overlook the internal threats from "nosey" coworkers or disgruntled employees?
True, but:
A>> Firewalled doesn't mean protected from exploitation. If you don't need the service, then disable it.
B>> One of the new security features of 10.5 is having the services running in a sandbox. If the service is actually running in a sandbox, then this would take care of most concerns about an undiscovered exploit.
I think you missed a huge point in your haste to make a point against Apple. When the "Block all incoming connections" it blocks all user applications, not root applications.
now for a legitimate complaint -- Why did it disable my firewall during the upgrade? or did it??
So I decided to do an EXTERNAL port scan to see what was happening. Admittedly, I'm too lazy right now to set up my other computer and run nmap, so I'm using a TCP port scanner hosted on the internet. After running port 0 through 1055, all the ports came back closed with the exception of ports 135-139 and port 445 being stealthed. Ok this is a minor bug, because my computer now responds to pings and actively returns the port status for all but the Microsoft related ports (ok maybe Netbios is a better term than Microsoft related). However, NONE of the ports are functional.
So the default firewall settings are to drop the ICMP packets for 135-139 and 445.
So after setting the firewall to "block incoming connections for applications" running as my user account, I can re-enable the advance option to stealth all closed ports. I re-ran the tests and my computer no longer accepts pings or return the ICMP messages. As far as the external scanner knows, my computer no longer exists.
OK so what does this mean? Well it means that if I ran an application that used the network, I wouldn't be asked to allow the connection. OK, so I *may* become stupid one day and run a program that creates an available port - what's the big deal? Well it will have access to my directory and anything my user account can access, but not my root account. This is a user education problem, not an OS design issue. enabling the "block incoming options" should safeguard against some lapses in judgement.
What about the services running a root (like bonjour)? From Apple:
"Sandbox tested.
Sometimes hackers try to hijack an application to run malicious code. Sandboxing helps ensure that applications do only what they're intended to by restricting which files they can access, whether they can talk to the network, and whether they can be used to launch other applications. Helper applications in Leopard -- including the software that enables Bonjour and the Spotlight indexer -- are sandboxed to guard against attackers."
OK - So can we now dial down the hyperbole a little???
In order for a worm to work, we would have to have some method of it being able to propagate itself without user intervention. This requires teaching the user not to run applications from dubious sources, I see this as a problem for ALL operation systems.
If you don't mind, could you try that explanation one more time. I'm just casually looking at what you wrote, and I spot a problem with your trojan theory. How does a trojan promote itself to root? And what combination of fork/exec would cause the trojan to be able to promote itself to root? I only assumed that in your scenario that the trojan is root because it seems to be able to intercept system calls...
I have an idea on how this can be done (by fooling the user to allow an superuser operation at least once) but this degenerates into a user education problem... (eg. Once I fooled the user into giving me root, I can do anything I want to do anyway).
I can see the reasoning behind Apple's decision to auto-allow digitally signed applications. This is how they keep the "It just works" mantra true. Public-Key encryption should have enough milage on it by now to prove that it's a viable security tool... sigh.
Anyway you've demonstrated your ability to list running services, but you haven't followed up with what the *real* consequences are.
Believe me when I say that I am giving you the utmost benefit of the doubt about your findings. I just want to make sure it more substance than hyperbole. I do believe that if the mere act of upgrading to leopard turns off an already activated firewall, this is a bad thing (but not horribly bad). Of course I would have to actually look and verify that the firewall is working since (unlike some other OS) there isn't an annoying icon jumping up and down telling me that the firewall is working.
Of course, If your really super paranoid, you can always just override the firewall rules yourself (as you demonstrated in your article).
Anyway, it's been a long day but I still look forward to verifying your hypothesis (when I get home).
Later,
Bill
Windows: "By the power of the Blue Screen, I shall take another coffee break!"
Performance will take a hit from the overhead involved, but availability should increase. Most server applications don't fully utilize the CPU anyway, so sacrificing some cycles to run the apps in a virtualized environment is not really a big deal. Where virtualization shines is availability. If a server is malfunctioning or overburdened, the virtualized environment can migrate to another server without the server clients knowing this has taken place (other than some latency caused by the migration). This is actually the coolest part of this technology.
I never thought about using virtual servers to increase security. Except for running windows within Mac OS X, I really don't see virtualization making anything more secure.
I think this is much ado about nothing. It is only here because Theo is getting upset...
Two words: Sadie's and Fred's...
Balloon people know what I'm talking about...
I've had a balloon flight aborted due to a tear on a balloon. Even with a 4600 pound gondola, the balloon flew for at least 3 additional hours. Balloons this size have low pressure, and are fairly robust. They don't behave the same as the balloons used for birthday parties..
Sounds like someone is a little excited about their balloon flight. First of all, congratulations on a successful flight!
Now telescopes flying on balloons are not new.
HERO (High Energy Remote Observatory) Balloon project flew it's 4th flight last spring from Ft. Sumner. http://wwwastro.msfc.nasa.gov/research/hero/hero_index.html
GLAST (Gamma Ray Large Area Space Telescope) flew back in 2006.
Caltech's Boomerang balloon http://www.astro.caltech.edu/~lgg/boomerang_front.htm
And many more http://www.csbf.nasa.gov/
I am always happy when a colleague has a successful flight...
The best solution is to press the monitor power switch... it's instant.
QRZ.com has been using this technique for a very, very long time.
just type www.qrz.com/CALLSIGN and it brings up a database record associated with that ham radio callsign.
Except for the secured file archives, created using Disk Image, that has its own password.
Everything works better like that malware that may be hidden in that piece of pirated software. I just don't see how people can trust cracked software from anonymous sources. I bet these same people complain the most about how unstable an OS or any other piece of software may be.
I see nothing wrong with modifying a piece of software you bought using a script or patch that you understand well enough to know it doesn't introduce any malware. But to just pirate something off the internet is just playing russian roulette...
First of all you are correct - Nobody on this planet has to use Vista (much to the disappointment of MS). Well maybe the players of Vista only games, but there is always the XBox (I agree with you here too.)
Where we *may* disagree is that I believe there are people who have to use XP. There are applications available on the XP that are not available on Linux (w/o screwing with Wine and even then it may not actually work).
I do admire your dedication to the Linux platform, but Linux is not the panacea of computing. FWIW, I use Linux at work and OS X at home... So I agree with you that you don't need Windows to make money as long as you are in a field that doesn't use a commercial application that is only on Windows (No not office, more like CAD, Thermal Modelers, etc. that some PI decided to require for a project.).
PS: PI = Primary Investigator.
Trying to play god with Hurricanes is not a new idea. Living on the gulf coast, every June (back in the 80's) I would hear talk, on the local radio stations, about the possibility of preventing strong hurricane. One technique that was tossed around was Cloud Seeding.
Anyway, the problem that was a huge hurdle back then, and remains today is LIABILITY. If the US Government was to attempt to manipulate a hurricane and it had little effect or worse increased the strength of a hurricane, the government may open itself to litigation. This is mostly an issue if the targeted hurricane makes landfall in a foreign country (eg. Mexico, the many Caribbean countries, or *shudder* Cuba), since suspicions on the US's intent would most likely cause an international crisis. Remember there was a cold war going on at the time...
After reading the article, I came to the conclusion:
While he may have been fired due to his age, he actually experienced a hostile work environment because of it. Come on, what if they said his ideas were too urban or feminine. What is they always referred to him as gang-banger or a sissy?
You're trying to confuse the issue. Is a black woman qualified to play a convincing white german? Maybe not as much as an actual white german. As for the stripper, WTF? Just because she strips at a "gentlemens" club doesn't mean she strips in public. A stripper who wants to be an actor, would be perfect to play Eva Braun.
Besides you act like the law forces you to hire old people just for the sake of hiring an old person. The law states that you can't deny a qualified person from a job based solely on race, gender, age, etc...
Yes it does. How can we say we live in a free society, if we chose to exclude participants based on sex, race, age, etc. ?
You're confused. Let me fix that for you: Nobody has the right to be hired by you, AND everybody has a right to not be discriminated against by you. I tell you what, give someone a letter saying that you did not hire them based on them being a straight white person. Let's see what happens next...
You're desperate.
That sentence makes sense if you are a prostitute. Are you a prostitute? Now if prostitution was legal, you might not be so free to choose who you have intercourse with.
Huh?
I've always heard it as "You can't be discriminated against based on race, age, sex, etc." this is the same as "You can't be eliminated from being chosen based on ...."
We labeled the act as "Racial Discrimination" or "Age Discrimination" these are nouns, and are used to convey "To be discriminated against based on race" or "To be discriminated against based on age". The jest being that "discriminate" is a verb and its meaning is as you said it was.
What's strange is that people believe that laws against discrimination is a new concept for the US. The founding fathers wrote the constitution on the basis that all men are created equal. Unfortunately it took admendments to make a more concise definition of what equal treatment means. And when further definition was called for, we lobbied for laws that give detail descriptions on what is legal and what is not.
As for your two problems... It sounds like the same reasoning behind the "Jim Crow" laws.