First, is it genetically impossible for slashdotters to discuss someting without bringing MS into it? Microsoft has nothing to do with this issue, idiot.
Second, WFT are you talking about? Since when has Microsoft charged for fixes to IE, moron?
Relax. As you yourself point out, Microsoft is often mentioned here. Therefore, the Microsoft reference was a well-known, and thus easily-utilized, example. Also, the implied example was along the lines of reasons given for upgrading from Windows 98 to XP, and now from XP to Vista, all of which do cost money. That Microsoft also fixes other software without charge does not invalidate this example, since no claim was made that Microsoft never uses any other tactic. However, if you have some kind of ultra-sensitivity, I suppose you could invent such a claim in your own perception, but in that case why call me the idiot?
The least they could do is say "we patched two security holes, but we won't tell you what they are". Doing anything more secret looks immediately suspicious.
Indeed. I also resent Opera's unstated assumption that we're all so stupid we would never notice or care about their secrecy. Put another way, you don't do things like this unless you expect it to go unnoticed. I believe them to be either crazy or stupid or just plain arrogant to fail to consider that it only takes one person out there to notice this and point it out to cause many people to question the merits of trusting them.
The solution to that, AC, is to describe the update as both "New Themes!" etc. and "Better Security" so that the "Ohh, Shiny!" crowd who think security does not matter will appreciate the new themes and download the update, while those who are more pragmatic will see that this is, in fact, also a security update and will apply it for that reason. This could only increase the overall acceptance of the patch.
Given how easily this could have been done, there simply is no justification for the secrecy. The most likely reason why they would have done it is some selfish attempt to save face (Who us? Exploitable? Nah....). While this is slightly better than the Microsoft method of "buy our next version, it'll be fixed in that one", it is definitely less than optimal.
Security is important -- just ask any victim of identity theft. No matter which browser you use, mistakes will be made, and flaws will be found; this is common to any complex piece of software. Therefore what distinguishes one from the others is the openness of this process, the willingness to admit and redress failures, and the promptness with which this is done. I am quite satisfied with Firefox, but if I were looking for a new browser, this little incident would immediately make me distrust Opera and I would make it a point to look elsewhere.
One has made a very successful product and made lots of money, One has produced a probably vastly superior OS that nobody uses. Windows might be bag of shit but in terms of the aims Bill set out to achieve (Getting filthy rich) it is a runaway success.
You're making my point for me, actually. That Windows accomplished Bill's goals does benefit Bill, but it does nothing for me and nothing for your average user who has a Windows installation. For the 99% of the population who are not Microsoft employees and do not own significant stock in Microsoft, this means nothing. I'm fine with Bill getting rich, but when he can do that by delivering a bag of shit, this is evidence that the current way of doing things is broken. You know, the "free market provides the best solution" idea rests on the assumption of an informed population who make rational purchasing decisions; break that, and you could also be opening the door for unwanted government regulation of this market.
I can't think of one other industry that can so easily get away with shoddy quality. The hard (but best) way to fix this is for average users to get a clue, understand that the current status quo is shit, and understand that if you reward shit, you get more of it. An easier way to fix this might come about as a side-effect of the black hats constantly demonstrating the sorry state of Microsoft's products. This is possible because the current situation is getting worse and, long-term, is simply not sustainable. In fact, considering other, unrelated practices such as national deficit spending and the constant expansion of governmental power and size makes me marvel at our general willingness to tolerate situations that are not sustainable and will foreseeably reach a breaking point, after which time people will ask "how could this happen?".
As the black hats continue to change from script kiddies who perform DoS attacks and deface Web pages for shits and giggles to organized crime rings who want to steal your identity and destroy your credit, the incentive for giving a damn about security is only getting stronger. Like most things people do on anything but the smallest and most local scale, I expect that everyone will wait until it becomes a crisis before there's any real demand to fix this situation.
Want to call me a cynic? That's easy. Want to give me a plausible reason not to be? Good luck.
The summary and article talk about withholding the exploit information until the vendor is able to release a patch, as though this is the only possible scenario that could be happening just because it's the only other option (as opposed to immediate full disclosure) happening today.
But the most egregious examples of "Find security flaw -> Issue patch -> Wash, rinse, repeat" are found in programs (Sendmail? Bind, anyone?) or operating systems (Windows.. 'nuff said) where security was an afterthought that was bolted-on later. What I would like to see is complete and instant full disclosure that is sufficient and inevitable enough to encourage vendors to make this entire model obsolete, namely by making it no longer practical to handle these issues by issuing patches. This would provide an incentive to redesign from the ground up with security in mind so that many of these issues don't happen in the first place, and the ones which occur are reduced in severity.
Consider the OpenBSD approach, where security was a priority from day one, and the excellent track record they have in this area, and contrast it with Microsoft's track record, where only marketing was a priority from day one. The only way this will change is when it is no longer profitable to place such a low priority on security, and the two ways you arrange that are by demonstrating that the current situation is an arms race that is not sustainable, or, by waiting for a day when Grandma and Joe Sixpack care about computer security enough to refuse to buy anything that doesn't deliver it. Personally, I find the first option to be far more realistic, and it also helps to avoid the "only two choices" dualism that I keep seeing everywhere (especially in politics... "Democrat vs. Republican", "Left vs. Right", "With us or Against us") that is suffocating real change.
(Equally, the pro-Linux crowd is not above lies, misconceptions, and FUD themselves.)
Except that the "pro-Linux crowd" does not generally have a financial incentive motivating them to engage in FUD. Microsoft routinely engages in astroturfing, both with its shills and by sponsoring "independent" groups who are paid to have a certain opinion (if their product were truly so great, then why the need for deception?).
However poorly they may perform the task of advocating Linux, to most members of the "pro-Linux crowd" the goal is to obtain what they believe to be a superior computing experience, both in terms of technical capability and user freedom. Whereas Microsoft would happily market an operating system that could run no 3rd party applications and popped up a dialog that said "Fuck You for Using Windows" every thirty seconds so long as people were still willing to pay for it. One is a fairly grassroots movement in which users are expressing their true feelings about a subject, while the other has its roots in a top-down corporate environment designed for the sole purpose of making money in a market where the vast majority of customers are extremely ignorant about the technical merits of the product.
There is such a thing as purity of motive, and it counts for a lot.
Incidentally, because this was mentioned in the GP, I will say that Linux (and *nix in general) is not at all difficult to use. It is more difficult to learn than Windows, but the effort required to understand how the system works is a one-time investment, after which you find yourself with a rather straightforward operating system in which it is a simple matter to perform most tasks -- my personal opinion is that this is because unlike Windows, Linux does not assume that the user is an idiot. It also does not assume that the user intends to use the same machine for months or years without ever learning more about it than what was learned during the first week of use (although perhaps I repeat myself; to me one symptom that someone is an idiot is that they do not value or even hate learning). In comparison, Windows is easier to learn how to use, but learning more and more about how the system works does not provide the user with fewer annoying explanation and confirmation dialogs to click through, nor does it make the "power user" options less buried in the user interface, to name just two examples of the tedium involved.
Yeah, that's nice. Chip with what? A chisel and a wooden mallet? Another stone? A bronze hammer? To a tolerance of just over 350 feet and only one quarter of an inch (along that entire length) from being a perfectly straight plane? A small amount of research will reveal to you that modern masonry equipment simply could not do that, although visually the results would certainly look really straight. I would be amazed if you could even approach that precision marking with a string (i.e. a chalk line), let alone the cutting. Also, you do understand that I am referring to a two-dimensional planar surface of a three-dimensional object? String is much less useful when you need an entirely straight plane as opposed to a mere straight line.
I find it easier to believe that aliens built the pyramid, since that's only incredibly unlikely; what you are saying is impossible.
Of course you would have noted almost all of what I am pointing out here if you actually read the post to which you are replying. Or perhaps you did read it and you are simply failing to understand how difficult it really is to achieve that degree of precision with such a large structure. Either way, "Funny" would have been a much more appropriate moderation, not "Informative."
Actually a number of strange artifacts have been found, such as the so-called Baghdad Battery or ancient designs that bear a strong resemblence to modern aircraft, or giant figures that are unrecognizable unless viewed from the air, or ancient computing devices long before Charles Babbage, among others. Also fascinating are ideas about what things like the Ark of the Covenant or the Holy Grail actually were.
If you pay attention, you will notice that the less discoveries like this fit in with our existing ideas of how things were, the less likely anyone is to have heard of them. If we really valued the purpose of science then we would focus the most attention on the oddball discoveries that seem to defy our theories, rather than the current focus which is on research that is the most likely to be commercially useful and thus the most likely to receive funding. It disturbs me that the mainstream knee-jerk response to anomalies is to find a way to dismiss them based on what we think we know. I would much rather see the fascination with the unknown. Scientific skepticism means you do not draw unfounded conclusions or rely on assumptions; it does not mean that you make excuses for not investigating.
That's about as plausible as any more serious explanation I have ever heard.
The problem with explaining say, the Great Pyramid at Giza, is that given near-infinite wealth and all available modern technology, we either could not build it today or it would be extremely difficult.
...
The casing stones of the Great Pyramid and Khafre's Pyramid (constructed directly beside it) were cut to such optical precision as to be off true plane over their entire surface area by only 1/50th of an inch. They were fitted together so perfectly that the tip of a knife cannot be inserted between the joints even to this day.
The passages inside the pyramid are all extremely straight and precise, such that the longest of them, referred to as the descending passage, which is 350' 0.25" long deviates from being truly straight by less then 0.25 inches, while one of the shorter passages with a length of just over 150 feet deviates from being truly straight by a mere 0.020 inches. These and the above statistics prove the pyramid to be literally the most accurately constructed building on the face of the earth despite having been created several millennia ago. All theories which sufficiently allow for this level of accuracy assume a level of technology approximately equal to or exceeding current technology, at least in the area of tool making and construction.
Whether they can cast concrete or not, the idea that a civilization which did not even have the wheel could build a structure that was visually indistinguishable from the Great Pyramid, if they were willing to work hard enough to do it, could maybe be plausible. But the idea that they could have built such a structure, to those tolerances and with that degree of precision is laughable at best. The diamond-tipped blades typically used to cut large blocks of stone wear and warp (both due to mechanical stress and due to heat) during use sufficiently that they could not cut stone with that kind of precision -- to the casual observer the cut would look quite straight, but detailed measurements would not show the kind of tolerances found in the Great Pyramid.
Additionally, the Great Pyramid is currently aligned with true (not magnetic) North with only 3/60th of one degree of error; bear in mind the true North shifts position over time, therefore in the past it was aligned exactly. The king's coffer in the Grand Chamber is made of one solid piece of granite; microscopic analysis of the holes drilled into it indicate that it had to have been done with a fixed-point drill, using hard jewel bits and a drilling force of two tons. The measurements of the pyramid's features "coincidentally" yields, to a high precision, numbers such as the number of days in a year, the earth's distance to the sun, the earth's mass, the speed of light, the sun's radius, etc. See this link.
The Pyramid is far more mysterious than most people would have you believe. My personal theory is that civilization is cyclical just as every other aspect of nature, that is, that eons ago there were civilizations that existed and had high technology, probably superior to ours, which either eventually destroy themselves (and civilization) or are destroyed by polar reversals, asteroid impacts, or other such cataclysms. The idea that we are the very first people who have ever had computing power or nanotechnology is at best an unfounded assumption.
While theories etc. are fun, I honestly have to say that I have no idea how that pyramid got there. And from what I can tell, neither does anyone else.
Maybe this could be a solution for Bovine America. If only they could come up with a video game controller that removed excess complacency and enabled one to recognize propaganda, then we might even go back to having a free country again!
Did you not read what he actually said, or do you just disagree with the utility of reading comprehension?
He's talking about a system that would return the correct vote to any individual who decides to check theirs, or to any small number of grouped requests. And he's also talking about a system that would return completely false aggregate numbers. This would have the net effect of giving the illusion that each individual vote was handled correctly, since each person who checks their own obtains the correct result, yet, the candidate who actually wins the election has nothing to do with the results of the voting. Think of it as having two databases, one that is rewritten, and one that is not, and the one you get depends on who is asking.
Also, vote buying happens all the time. It goes by different names, you may have heard a few of them: Social Security, the prescription drug program, child tax credits, etc., all of which are designed to get people to vote for the candidates who promote programs that provide some form of kickback. And please spare the bullshit about how important Social Security is; America used to be full of the kind of people who could understand at 18 and 20 that one day, barring some nasty misfortune, they will get old enough that they will not want to work any longer or will not be able to work any longer, so they better start preparing for that eventuality now (pretending for a moment that the senior citizens aren't collectively one of the wealthiest segment of the population). This country used to be made of people who could handle things like this on their own, unassisted, with no help needed from the police power of government combined with an income redistribution program. Strangely enough, it also once contained people who could decide for themselves which substances they will and will not put into their bodies.
Did anyone ever stop to think that if society would even come close to falling apart due to insufficient income redistribution and no prohibition laws (or any other victimless-crime laws, for that matter... drug prohibition just happens to highlight the absurdity and futility of the concept), then perhaps it deserves to fall apart?
The root of this problem is not to be found in the method of voting, or the corruption of government contractors, or the incompetence of election commissions, but rather, in the fucking pitiful level of helplessness and complacency shown by the average American today.
And as a Firefox evangelist, how am I supposed to convince people that Firefox's regular releases are any better than the few-and-far-between releases of Internet Explorer if many of the updates seem mostly cosmetic or security related?
Um, the security-related releases are far better, and that this is regularly performed is better still. Unless you really like the idea of being the victim of identity theft, or a host in a botnet, then the fact that they are "just" for security reasons should be a great advantage.
Yeah, there's no agenda here. Why, this is only being done to make each of them better, happier, and more productive citizens. As an Anonymous Coward said, this is a reiteration of Hitler Youth, much like the D.A.R.E. program.
The D.A.R.E. program will never encourage children to consider whether it is just for a government of a "free country" to tell its citizens what they may or may not put into their own bodies (on the basis of regulating interstate trade, no less... aren't those "implied powers" great?) -- if it were such an absurd thing to consider, then it could at least be mentioned and demonstrated as such. No, instead, D.A.R.E. is "taught" by armed, uniformed police officers instead of former drug addicts who have overcome an addiction and don't want someone else to go through the same ordeal, because former drug addicts would not be so interested in encouraging the children to help them police the parents and extended family. The basic idea here is that if your law requires police-state tactics to enforce, then your law is broken.
Likewise, you can bet your ass that this program will never encourage children to evaluate for themselves whether the RIAA/MPAA are using the law to prop up an obsolete business model and whether or not these future voters should consider eliminating such corruption, which is what being a good citizen is all about. Rather, you can expect that this civil matter concerning arbitrary copyright and its infringement will be falsely elevated to the status of a moral question and will be taught in terms of right and wrong.
In both situations the parents are reaping the rewards of ignoring their responsibility and depending on large organizations like the government education monopolists or the Boy Scouts to take care of the upbringing of their children. Not that it matters, really, since vast numbers of them love their children so much that they decided to allow themselves to become single parents and/or to allow their children to be born into poverty. I guess "free" education starts looking pretty good when you put no forethought into one of the most important decisions you can make.
We badly need for a country that values independent thought, critical thinking, and minimal government to economically kick the asses of the rest of the world and demonstrate that these things are more than luxuries. Unfortunately I don't know of such a domain; a long time ago this was the USA, but oh how far we have fallen. Most of the rest of the world seems heavily invested in the groupthink bandwagon as well.
The wording of your post might lead uninformed masses that all Internet Explorer exploits lead to root-like priviledges. They don't. I was only making a clarification on what you said.
So you clarified what I said, because you were concerned that someone might think I said something that I clearly did not say? I don't think you understand that if the reader magically adds words such as "all" or "each and every" to sentences which obviously do not contain them, it is because they are believing what they want to believe, and no amount of clarification can disabuse someone of such an annoying habit. Shit like this is why everyone feels a compulsion to add "but of course there are exceptions" or equivalent to nearly every damned thing they say, just because ignorant people don't understand that anytime you are speaking of more than one specific item, you must speak in general terms.
Thus, my response was not because I was "offended" by what you said (no one is ever offended by anything that is not a threat, such as another person's opinion, unless they choose to be... such people typically also subscribe to the victim mentality that is so prevalent), but because I tire of this practice of always catering to the ignorant, rather than allowing them to feel the pain of misinterpretation that may motivate them to a better understanding. Also, if you really examine this culture of "that's offensive!" you will find that this claim is often nothing more than a thinly-veiled attempt at squelching ideas that the "offended" person does not like or finds too challenging to deal with.
Unlike your knee-jerk assumption that I would allow anything you say on Slashdot to impact my emotions negatively (I understand it though, because most people do give away their power and self-control this easily), I do not assume you are a Microsoft apologist. I merely detected your desire to soften any negative impact of what I said regarding Internet Explorer and speculated that perhaps you could be; I was careful to say I do not know whether this is the case. I then proceeded to make a point that I have yet to hear the confirmed Microsoft lovers address, which is that when you deliberately target a non-technical market, you bear a responsibility to take care of problems that are caused by... a lack of technical knowledge. I certainly like that better than the current situation, in which the average user assumes that lockups, crashes, e-mail worms, trojans, spyware, and the like are inherent features of computers (they're not). That this situation has become accepted as normal has done far more damage to IT than most people care to admit.
You may assume a blind hatred of Microsoft on my part if assuming this brings you some kind of comfort (because after all, you could then pigeonhole every future statement I make about the subject), but the real problem is that there is a basic conflict of interest here - patching their software flaws and/or redesigning the OS, in part or as a whole, is generally nothing but an expense for Microsoft, which, like all companies, exists for the sole purpose of making money. This conflict of interest is not going to go away unless they fundamentally redesign their business model and become something akin to a non-profit organization; only then would "getting it right" become more important than "getting it out the door." With the current situation, don't expect to see serious security improvements in Windows until it gets to a point that no one will buy a version of Windows without them. Based on the prevalence of the "I just want it to work, having to learn technical details is EVIL!!" crowd, I don't see this happening anytime soon, whether Vista is better than XP in this area or not.
I also have a hard time understanding the urge most feel to defend and/or identify with people and organizations who don't give a shit about them, such as sports teams, political parties, celebrities, and
There is no good reason why a Web browser should ever run as a privileged user. I acknowledge that there may be reasons why this is done, but none of them are good reasons.
As I never said "in each and every known and possible example of IE exploits, all have been observed to grant Administrator access", I do not understand the purpose of your reply. My sentence as quoted, which read "this is not as bad as, say, an Internet Explorer exploit that gives complete 'Administrator' access to the entire machine and all accounts on it" only requires that one such event has ever happened for the statement to be true (and these are not in short supply).
I have no idea if you could be called a Microsoft apologist, but this is what I wish such people would understand: Mass-marketing a product to a customer base not generally known for possessing a high degree of technical skill, on the basis of being "easy to use", with defaults such as a web browser running as a privileged user, is just plain irresponsible. The fact that this has been the case for so long suggests that the irresponsibility is willful (deliberate "evil" or "the market doesn't demand that we fix this shit, so why should we?" or "what's the difference?" is up to you).
Wouldnt having at least your web browser running under a non-priveleged account other than root protect you from buffer overflows being able to damage the system?
A buffer overflow exploit can allow attackers to gain the same privileges as the user who is running the browser. A regular user account is sufficient to participate in a botnet (including DDoS attacks), become a spam zombie, or become some script kiddie's "warez" fileshare. Consider also that most of your data would be stored in your user's home directory, and you now have a potential identity theft (depending on your habits and whether you use strong encryption). This is not as bad as, say, an Internet Explorer exploit that gives complete "Administrator" access to to the entire machine and all accounts on it, but (as you mentioned) it could be followed up by privilege escalation attacks which could then lead to root access.
To dismiss regular user accounts as unworthy of protection is a big mistake. When discussing remote exploits (as opposed to local security), the user system is more like a form of damage control.
you know nothing about these ppl, they are blackhats, they ruin things for no other reason than to piss ppl off and have a laugh at their expense.
This is why good security is done in layers. If your sole defense against having your user account, your root account, and possibly even your identity owned by some script kiddie is to depend on the maintainers of $PROGRAM to patch all exploitable flaws in a timely manner, this is what you call putting all of your eggs into one basket. For this, there are things like the Gentoo Hardened Project, which ensure that a mere buffer overflow alone will not grant someone access to your system (of course this is not Gentoo-specific; Gentoo has merely organized such things as PaX and Grsecurity and the toolchain in such a way that it is a relatively simple matter to use the Hardened profile). In my opinion, you're crazy not to take some kind of extra measures like this, if you are going to use a potentially hostile network on a daily basis.
Ideally, the good people who maintain Firefox can stay on top of the arms race to improve the browser's security as fast as flaws can be found. But the odds are against them -- in order to succeed, they have to find every possible security flaw; the blackhats only need to find the one thing that they missed to have a workable exploit. If you don't like being exploited, then this situation is not good. There is no such thing as absolute security, and no programmer is perfect, but precisely because programmers make mistakes, there are non-executable stacks, random memory addresses, user-space SSP protections, chroot() jail restrictions, and many other measures one can take to ensure that security does not have a single point of failure.
Health care is not something "nice to have", it is quite literally life and death. If you don't get care at a critical moment, you'll die or wind up unable to work for the rest of your life.
Hospitals are not allowed to refuse necessary medical procedures. The only thing health insurance does for you, is that it prevents you from going bankrupt after you get better and leave the hospital and have a ton of medical bills to pay. This is not literally life or death, except maybe for your credit report.
I am undecided whether you were being deliberately melodramatic or whether you truly did not know this.
Well I would have moderated, but I think this one needed to be said.
The custom of employers providing health insurance is not because someone, in a vacuum, said "hey, what a great idea this would be!". Not by any means.
During World War II, the USA federal government froze wages. This meant that if you were an employer, you could no longer decide for yourself how much you will pay your employees. If you wanted to attract the best talent, you had to find other ways to make them want to work for you. In order to get around this restriction, companies began to provide benefits for free that the employee would otherwise have to pay for, as a method other than wage that could be considered a part of that employee's compensation.
This, like the federal income tax, was a "temporary" wartime measure (like the Patriot Act of today). The result has been that now you have no buying power as an individual; the companies who go to health insurance providers and say "I have 50,000 employees, let's discuss price" are able to obtain decent group rates but the single individual is not. If you are in the USA, try shopping around for individual health insurance sometime -- it's ridiculously expensive. This is a form of inertia that has made employer-provided health insurance difficult to reverse. This also means that your employer has more leverage over you, and is part of why companies are not nearly as worried about losing employees as employees are worried about getting fired (which to me is one of the flaws in how business is done; unions are a horrible hack that take on agendas of their own and usually fail to address this).
It does, however, serve as a great reminder for those of you who think that the government's definition of "temporary" means anything less than "until the Sun starts running out of nuclear fuel."
The reason why IE starts up so quickly is because the act of booting up Windows pre-loads IE in memory. When you click that blue 'E' icon (which points to an.exe file that is about 30k, as the rest is in DLLs which are already in memory), you're loading practically all of the program from memory, not the hard drive. This also means that whether you are using it or not, the amount of memory required for IE is always being consumed, even after you "close" it. Contrast this with clicking the Firefox icon, which has to read the executable off the hard drive and into memory prior to being able to run it. You didn't think the difference was due to IE being a leaner, more efficient program, did you?
There is a utility which will allow you to also preload Firefox in memory on Windows. Of course, this does not give you the ability to unload IE from memory (decoupling IE from Windows, to any degree, is problematic at best).
Of course, how much an extra 6-7 seconds of load time will impact you would depend on usage. Personally I often leave the same instance of Firefox running for days at a time and leave it minimized on a virtual desktop when it is not in use, but if I were really worried about this on a Linux box then I would use prelink.
What must be even more annoying is when someone submits a given article, it is rejected, and then at a later time another person submits the exact same article and it is accepted and put on Slashdot's main page.
I think these are just signs that Slashdot has grown to where the left hand knows not what the right hand is doing.
Now sit back and watch while both of us are modded "Offtopic" into oblivion, even though there is no other place to discuss these things.
Slashdot Mirror
Indeed. I also resent Opera's unstated assumption that we're all so stupid we would never notice or care about their secrecy. Put another way, you don't do things like this unless you expect it to go unnoticed. I believe them to be either crazy or stupid or just plain arrogant to fail to consider that it only takes one person out there to notice this and point it out to cause many people to question the merits of trusting them.
The solution to that, AC, is to describe the update as both "New Themes!" etc. and "Better Security" so that the "Ohh, Shiny!" crowd who think security does not matter will appreciate the new themes and download the update, while those who are more pragmatic will see that this is, in fact, also a security update and will apply it for that reason. This could only increase the overall acceptance of the patch.
Given how easily this could have been done, there simply is no justification for the secrecy. The most likely reason why they would have done it is some selfish attempt to save face (Who us? Exploitable? Nah....). While this is slightly better than the Microsoft method of "buy our next version, it'll be fixed in that one", it is definitely less than optimal.
Security is important -- just ask any victim of identity theft. No matter which browser you use, mistakes will be made, and flaws will be found; this is common to any complex piece of software. Therefore what distinguishes one from the others is the openness of this process, the willingness to admit and redress failures, and the promptness with which this is done. I am quite satisfied with Firefox, but if I were looking for a new browser, this little incident would immediately make me distrust Opera and I would make it a point to look elsewhere.
You're making my point for me, actually. That Windows accomplished Bill's goals does benefit Bill, but it does nothing for me and nothing for your average user who has a Windows installation. For the 99% of the population who are not Microsoft employees and do not own significant stock in Microsoft, this means nothing. I'm fine with Bill getting rich, but when he can do that by delivering a bag of shit, this is evidence that the current way of doing things is broken. You know, the "free market provides the best solution" idea rests on the assumption of an informed population who make rational purchasing decisions; break that, and you could also be opening the door for unwanted government regulation of this market.
I can't think of one other industry that can so easily get away with shoddy quality. The hard (but best) way to fix this is for average users to get a clue, understand that the current status quo is shit, and understand that if you reward shit, you get more of it. An easier way to fix this might come about as a side-effect of the black hats constantly demonstrating the sorry state of Microsoft's products. This is possible because the current situation is getting worse and, long-term, is simply not sustainable. In fact, considering other, unrelated practices such as national deficit spending and the constant expansion of governmental power and size makes me marvel at our general willingness to tolerate situations that are not sustainable and will foreseeably reach a breaking point, after which time people will ask "how could this happen?".
As the black hats continue to change from script kiddies who perform DoS attacks and deface Web pages for shits and giggles to organized crime rings who want to steal your identity and destroy your credit, the incentive for giving a damn about security is only getting stronger. Like most things people do on anything but the smallest and most local scale, I expect that everyone will wait until it becomes a crisis before there's any real demand to fix this situation.
Want to call me a cynic? That's easy. Want to give me a plausible reason not to be? Good luck.
The summary and article talk about withholding the exploit information until the vendor is able to release a patch, as though this is the only possible scenario that could be happening just because it's the only other option (as opposed to immediate full disclosure) happening today.
.. 'nuff said) where security was an afterthought that was bolted-on later. What I would like to see is complete and instant full disclosure that is sufficient and inevitable enough to encourage vendors to make this entire model obsolete, namely by making it no longer practical to handle these issues by issuing patches. This would provide an incentive to redesign from the ground up with security in mind so that many of these issues don't happen in the first place, and the ones which occur are reduced in severity.
But the most egregious examples of "Find security flaw -> Issue patch -> Wash, rinse, repeat" are found in programs (Sendmail? Bind, anyone?) or operating systems (Windows
Consider the OpenBSD approach, where security was a priority from day one, and the excellent track record they have in this area, and contrast it with Microsoft's track record, where only marketing was a priority from day one. The only way this will change is when it is no longer profitable to place such a low priority on security, and the two ways you arrange that are by demonstrating that the current situation is an arms race that is not sustainable, or, by waiting for a day when Grandma and Joe Sixpack care about computer security enough to refuse to buy anything that doesn't deliver it. Personally, I find the first option to be far more realistic, and it also helps to avoid the "only two choices" dualism that I keep seeing everywhere (especially in politics... "Democrat vs. Republican", "Left vs. Right", "With us or Against us") that is suffocating real change.
You left out another leading cause of death, and the real number one threat to freedom: excess state power.
However poorly they may perform the task of advocating Linux, to most members of the "pro-Linux crowd" the goal is to obtain what they believe to be a superior computing experience, both in terms of technical capability and user freedom. Whereas Microsoft would happily market an operating system that could run no 3rd party applications and popped up a dialog that said "Fuck You for Using Windows" every thirty seconds so long as people were still willing to pay for it. One is a fairly grassroots movement in which users are expressing their true feelings about a subject, while the other has its roots in a top-down corporate environment designed for the sole purpose of making money in a market where the vast majority of customers are extremely ignorant about the technical merits of the product.
There is such a thing as purity of motive, and it counts for a lot.
Incidentally, because this was mentioned in the GP, I will say that Linux (and *nix in general) is not at all difficult to use. It is more difficult to learn than Windows, but the effort required to understand how the system works is a one-time investment, after which you find yourself with a rather straightforward operating system in which it is a simple matter to perform most tasks -- my personal opinion is that this is because unlike Windows, Linux does not assume that the user is an idiot. It also does not assume that the user intends to use the same machine for months or years without ever learning more about it than what was learned during the first week of use (although perhaps I repeat myself; to me one symptom that someone is an idiot is that they do not value or even hate learning). In comparison, Windows is easier to learn how to use, but learning more and more about how the system works does not provide the user with fewer annoying explanation and confirmation dialogs to click through, nor does it make the "power user" options less buried in the user interface, to name just two examples of the tedium involved.
Yeah, that's nice. Chip with what? A chisel and a wooden mallet? Another stone? A bronze hammer? To a tolerance of just over 350 feet and only one quarter of an inch (along that entire length) from being a perfectly straight plane? A small amount of research will reveal to you that modern masonry equipment simply could not do that, although visually the results would certainly look really straight. I would be amazed if you could even approach that precision marking with a string (i.e. a chalk line), let alone the cutting. Also, you do understand that I am referring to a two-dimensional planar surface of a three-dimensional object? String is much less useful when you need an entirely straight plane as opposed to a mere straight line.
I find it easier to believe that aliens built the pyramid, since that's only incredibly unlikely; what you are saying is impossible.
Of course you would have noted almost all of what I am pointing out here if you actually read the post to which you are replying. Or perhaps you did read it and you are simply failing to understand how difficult it really is to achieve that degree of precision with such a large structure. Either way, "Funny" would have been a much more appropriate moderation, not "Informative."
Actually a number of strange artifacts have been found, such as the so-called Baghdad Battery or ancient designs that bear a strong resemblence to modern aircraft, or giant figures that are unrecognizable unless viewed from the air, or ancient computing devices long before Charles Babbage, among others. Also fascinating are ideas about what things like the Ark of the Covenant or the Holy Grail actually were.
If you pay attention, you will notice that the less discoveries like this fit in with our existing ideas of how things were, the less likely anyone is to have heard of them. If we really valued the purpose of science then we would focus the most attention on the oddball discoveries that seem to defy our theories, rather than the current focus which is on research that is the most likely to be commercially useful and thus the most likely to receive funding. It disturbs me that the mainstream knee-jerk response to anomalies is to find a way to dismiss them based on what we think we know. I would much rather see the fascination with the unknown. Scientific skepticism means you do not draw unfounded conclusions or rely on assumptions; it does not mean that you make excuses for not investigating.
The problem with explaining say, the Great Pyramid at Giza, is that given near-infinite wealth and all available modern technology, we either could not build it today or it would be extremely difficult.
From http://en.wikipedia.org/wiki/Great_Pyramid_of_Giz
Whether they can cast concrete or not, the idea that a civilization which did not even have the wheel could build a structure that was visually indistinguishable from the Great Pyramid, if they were willing to work hard enough to do it, could maybe be plausible. But the idea that they could have built such a structure, to those tolerances and with that degree of precision is laughable at best. The diamond-tipped blades typically used to cut large blocks of stone wear and warp (both due to mechanical stress and due to heat) during use sufficiently that they could not cut stone with that kind of precision -- to the casual observer the cut would look quite straight, but detailed measurements would not show the kind of tolerances found in the Great Pyramid.
Additionally, the Great Pyramid is currently aligned with true (not magnetic) North with only 3/60th of one degree of error; bear in mind the true North shifts position over time, therefore in the past it was aligned exactly. The king's coffer in the Grand Chamber is made of one solid piece of granite; microscopic analysis of the holes drilled into it indicate that it had to have been done with a fixed-point drill, using hard jewel bits and a drilling force of two tons. The measurements of the pyramid's features "coincidentally" yields, to a high precision, numbers such as the number of days in a year, the earth's distance to the sun, the earth's mass, the speed of light, the sun's radius, etc. See this link.
The Pyramid is far more mysterious than most people would have you believe. My personal theory is that civilization is cyclical just as every other aspect of nature, that is, that eons ago there were civilizations that existed and had high technology, probably superior to ours, which either eventually destroy themselves (and civilization) or are destroyed by polar reversals, asteroid impacts, or other such cataclysms. The idea that we are the very first people who have ever had computing power or nanotechnology is at best an unfounded assumption.
While theories etc. are fun, I honestly have to say that I have no idea how that pyramid got there. And from what I can tell, neither does anyone else.
Maybe this could be a solution for Bovine America. If only they could come up with a video game controller that removed excess complacency and enabled one to recognize propaganda, then we might even go back to having a free country again!
And on the subject of idiots..."It's a troll!"
What's the saying? "If you get in bed with Microsoft, you're going to get fucked."
Did you not read what he actually said, or do you just disagree with the utility of reading comprehension?
He's talking about a system that would return the correct vote to any individual who decides to check theirs, or to any small number of grouped requests. And he's also talking about a system that would return completely false aggregate numbers. This would have the net effect of giving the illusion that each individual vote was handled correctly, since each person who checks their own obtains the correct result, yet, the candidate who actually wins the election has nothing to do with the results of the voting. Think of it as having two databases, one that is rewritten, and one that is not, and the one you get depends on who is asking.
Also, vote buying happens all the time. It goes by different names, you may have heard a few of them: Social Security, the prescription drug program, child tax credits, etc., all of which are designed to get people to vote for the candidates who promote programs that provide some form of kickback. And please spare the bullshit about how important Social Security is; America used to be full of the kind of people who could understand at 18 and 20 that one day, barring some nasty misfortune, they will get old enough that they will not want to work any longer or will not be able to work any longer, so they better start preparing for that eventuality now (pretending for a moment that the senior citizens aren't collectively one of the wealthiest segment of the population). This country used to be made of people who could handle things like this on their own, unassisted, with no help needed from the police power of government combined with an income redistribution program. Strangely enough, it also once contained people who could decide for themselves which substances they will and will not put into their bodies.
Did anyone ever stop to think that if society would even come close to falling apart due to insufficient income redistribution and no prohibition laws (or any other victimless-crime laws, for that matter... drug prohibition just happens to highlight the absurdity and futility of the concept), then perhaps it deserves to fall apart?
The root of this problem is not to be found in the method of voting, or the corruption of government contractors, or the incompetence of election commissions, but rather, in the fucking pitiful level of helplessness and complacency shown by the average American today.
Um, the security-related releases are far better, and that this is regularly performed is better still. Unless you really like the idea of being the victim of identity theft, or a host in a botnet, then the fact that they are "just" for security reasons should be a great advantage.
Yeah, there's no agenda here. Why, this is only being done to make each of them better, happier, and more productive citizens. As an Anonymous Coward said, this is a reiteration of Hitler Youth, much like the D.A.R.E. program.
... aren't those "implied powers" great?) -- if it were such an absurd thing to consider, then it could at least be mentioned and demonstrated as such. No, instead, D.A.R.E. is "taught" by armed, uniformed police officers instead of former drug addicts who have overcome an addiction and don't want someone else to go through the same ordeal, because former drug addicts would not be so interested in encouraging the children to help them police the parents and extended family. The basic idea here is that if your law requires police-state tactics to enforce, then your law is broken.
The D.A.R.E. program will never encourage children to consider whether it is just for a government of a "free country" to tell its citizens what they may or may not put into their own bodies (on the basis of regulating interstate trade, no less
Likewise, you can bet your ass that this program will never encourage children to evaluate for themselves whether the RIAA/MPAA are using the law to prop up an obsolete business model and whether or not these future voters should consider eliminating such corruption, which is what being a good citizen is all about. Rather, you can expect that this civil matter concerning arbitrary copyright and its infringement will be falsely elevated to the status of a moral question and will be taught in terms of right and wrong.
In both situations the parents are reaping the rewards of ignoring their responsibility and depending on large organizations like the government education monopolists or the Boy Scouts to take care of the upbringing of their children. Not that it matters, really, since vast numbers of them love their children so much that they decided to allow themselves to become single parents and/or to allow their children to be born into poverty. I guess "free" education starts looking pretty good when you put no forethought into one of the most important decisions you can make.
We badly need for a country that values independent thought, critical thinking, and minimal government to economically kick the asses of the rest of the world and demonstrate that these things are more than luxuries. Unfortunately I don't know of such a domain; a long time ago this was the USA, but oh how far we have fallen. Most of the rest of the world seems heavily invested in the groupthink bandwagon as well.
Said another way, you have no meaningful reply, thus you resort to irrelevant comments about the author and not about what he posted. Brilliant.
So you clarified what I said, because you were concerned that someone might think I said something that I clearly did not say? I don't think you understand that if the reader magically adds words such as "all" or "each and every" to sentences which obviously do not contain them, it is because they are believing what they want to believe, and no amount of clarification can disabuse someone of such an annoying habit. Shit like this is why everyone feels a compulsion to add "but of course there are exceptions" or equivalent to nearly every damned thing they say, just because ignorant people don't understand that anytime you are speaking of more than one specific item, you must speak in general terms.
... such people typically also subscribe to the victim mentality that is so prevalent), but because I tire of this practice of always catering to the ignorant, rather than allowing them to feel the pain of misinterpretation that may motivate them to a better understanding. Also, if you really examine this culture of "that's offensive!" you will find that this claim is often nothing more than a thinly-veiled attempt at squelching ideas that the "offended" person does not like or finds too challenging to deal with.
... a lack of technical knowledge. I certainly like that better than the current situation, in which the average user assumes that lockups, crashes, e-mail worms, trojans, spyware, and the like are inherent features of computers (they're not). That this situation has become accepted as normal has done far more damage to IT than most people care to admit.
Thus, my response was not because I was "offended" by what you said (no one is ever offended by anything that is not a threat, such as another person's opinion, unless they choose to be
Unlike your knee-jerk assumption that I would allow anything you say on Slashdot to impact my emotions negatively (I understand it though, because most people do give away their power and self-control this easily), I do not assume you are a Microsoft apologist. I merely detected your desire to soften any negative impact of what I said regarding Internet Explorer and speculated that perhaps you could be; I was careful to say I do not know whether this is the case. I then proceeded to make a point that I have yet to hear the confirmed Microsoft lovers address, which is that when you deliberately target a non-technical market, you bear a responsibility to take care of problems that are caused by
You may assume a blind hatred of Microsoft on my part if assuming this brings you some kind of comfort (because after all, you could then pigeonhole every future statement I make about the subject), but the real problem is that there is a basic conflict of interest here - patching their software flaws and/or redesigning the OS, in part or as a whole, is generally nothing but an expense for Microsoft, which, like all companies, exists for the sole purpose of making money. This conflict of interest is not going to go away unless they fundamentally redesign their business model and become something akin to a non-profit organization; only then would "getting it right" become more important than "getting it out the door." With the current situation, don't expect to see serious security improvements in Windows until it gets to a point that no one will buy a version of Windows without them. Based on the prevalence of the "I just want it to work, having to learn technical details is EVIL!!" crowd, I don't see this happening anytime soon, whether Vista is better than XP in this area or not.
I also have a hard time understanding the urge most feel to defend and/or identify with people and organizations who don't give a shit about them, such as sports teams, political parties, celebrities, and
There is no good reason why a Web browser should ever run as a privileged user. I acknowledge that there may be reasons why this is done, but none of them are good reasons.
As I never said "in each and every known and possible example of IE exploits, all have been observed to grant Administrator access", I do not understand the purpose of your reply. My sentence as quoted, which read "this is not as bad as, say, an Internet Explorer exploit that gives complete 'Administrator' access to the entire machine and all accounts on it" only requires that one such event has ever happened for the statement to be true (and these are not in short supply).
I have no idea if you could be called a Microsoft apologist, but this is what I wish such people would understand: Mass-marketing a product to a customer base not generally known for possessing a high degree of technical skill, on the basis of being "easy to use", with defaults such as a web browser running as a privileged user, is just plain irresponsible. The fact that this has been the case for so long suggests that the irresponsibility is willful (deliberate "evil" or "the market doesn't demand that we fix this shit, so why should we?" or "what's the difference?" is up to you).
A buffer overflow exploit can allow attackers to gain the same privileges as the user who is running the browser. A regular user account is sufficient to participate in a botnet (including DDoS attacks), become a spam zombie, or become some script kiddie's "warez" fileshare. Consider also that most of your data would be stored in your user's home directory, and you now have a potential identity theft (depending on your habits and whether you use strong encryption). This is not as bad as, say, an Internet Explorer exploit that gives complete "Administrator" access to to the entire machine and all accounts on it, but (as you mentioned) it could be followed up by privilege escalation attacks which could then lead to root access.
To dismiss regular user accounts as unworthy of protection is a big mistake. When discussing remote exploits (as opposed to local security), the user system is more like a form of damage control.
This is why good security is done in layers. If your sole defense against having your user account, your root account, and possibly even your identity owned by some script kiddie is to depend on the maintainers of $PROGRAM to patch all exploitable flaws in a timely manner, this is what you call putting all of your eggs into one basket. For this, there are things like the Gentoo Hardened Project, which ensure that a mere buffer overflow alone will not grant someone access to your system (of course this is not Gentoo-specific; Gentoo has merely organized such things as PaX and Grsecurity and the toolchain in such a way that it is a relatively simple matter to use the Hardened profile). In my opinion, you're crazy not to take some kind of extra measures like this, if you are going to use a potentially hostile network on a daily basis.
Ideally, the good people who maintain Firefox can stay on top of the arms race to improve the browser's security as fast as flaws can be found. But the odds are against them -- in order to succeed, they have to find every possible security flaw; the blackhats only need to find the one thing that they missed to have a workable exploit. If you don't like being exploited, then this situation is not good. There is no such thing as absolute security, and no programmer is perfect, but precisely because programmers make mistakes, there are non-executable stacks, random memory addresses, user-space SSP protections, chroot() jail restrictions, and many other measures one can take to ensure that security does not have a single point of failure.
Hospitals are not allowed to refuse necessary medical procedures. The only thing health insurance does for you, is that it prevents you from going bankrupt after you get better and leave the hospital and have a ton of medical bills to pay. This is not literally life or death, except maybe for your credit report.
I am undecided whether you were being deliberately melodramatic or whether you truly did not know this.
Well I would have moderated, but I think this one needed to be said.
The custom of employers providing health insurance is not because someone, in a vacuum, said "hey, what a great idea this would be!". Not by any means.
During World War II, the USA federal government froze wages. This meant that if you were an employer, you could no longer decide for yourself how much you will pay your employees. If you wanted to attract the best talent, you had to find other ways to make them want to work for you. In order to get around this restriction, companies began to provide benefits for free that the employee would otherwise have to pay for, as a method other than wage that could be considered a part of that employee's compensation.
This, like the federal income tax, was a "temporary" wartime measure (like the Patriot Act of today). The result has been that now you have no buying power as an individual; the companies who go to health insurance providers and say "I have 50,000 employees, let's discuss price" are able to obtain decent group rates but the single individual is not. If you are in the USA, try shopping around for individual health insurance sometime -- it's ridiculously expensive. This is a form of inertia that has made employer-provided health insurance difficult to reverse. This also means that your employer has more leverage over you, and is part of why companies are not nearly as worried about losing employees as employees are worried about getting fired (which to me is one of the flaws in how business is done; unions are a horrible hack that take on agendas of their own and usually fail to address this).
It does, however, serve as a great reminder for those of you who think that the government's definition of "temporary" means anything less than "until the Sun starts running out of nuclear fuel."
The reason why IE starts up so quickly is because the act of booting up Windows pre-loads IE in memory. When you click that blue 'E' icon (which points to an .exe file that is about 30k, as the rest is in DLLs which are already in memory), you're loading practically all of the program from memory, not the hard drive. This also means that whether you are using it or not, the amount of memory required for IE is always being consumed, even after you "close" it. Contrast this with clicking the Firefox icon, which has to read the executable off the hard drive and into memory prior to being able to run it. You didn't think the difference was due to IE being a leaner, more efficient program, did you?
There is a utility which will allow you to also preload Firefox in memory on Windows. Of course, this does not give you the ability to unload IE from memory (decoupling IE from Windows, to any degree, is problematic at best).
Of course, how much an extra 6-7 seconds of load time will impact you would depend on usage. Personally I often leave the same instance of Firefox running for days at a time and leave it minimized on a virtual desktop when it is not in use, but if I were really worried about this on a Linux box then I would use prelink.
What must be even more annoying is when someone submits a given article, it is rejected, and then at a later time another person submits the exact same article and it is accepted and put on Slashdot's main page.
I think these are just signs that Slashdot has grown to where the left hand knows not what the right hand is doing.
Now sit back and watch while both of us are modded "Offtopic" into oblivion, even though there is no other place to discuss these things.