Slashdot Mirror


User: Decker-Mage

Decker-Mage's activity in the archive.

Stories
0
Comments
805
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 805

  1. Re:So, nobody read the patents yet...? on Company Claims Patent Over XML · · Score: 1

    I *think* that (13) would cover the specialized XML's that are being created that have well defined namespaces (types), which leads you to (14) and (17). But that's my interpretation and I still think the examiner who issued this should have his/her head examined.

  2. Re:Patenting Patents on Company Claims Patent Over XML · · Score: 1

    Well, if you modified that to a numerically based moderation system you (and Slashdot) might have something. Moderation is mucho prior art both in the newsgroups and, from my experience, on CompuServe where I was a SysOp and librarian for almost two decades.

  3. Re:Patenting Patents on Company Claims Patent Over XML · · Score: 1

    And I thought it was just me that noticed the patterns. You could almost perl-script many of the postings {sigh}.

  4. Re:Why not?! on Insecure Code - Vendors or Developers To Blame? · · Score: 1

    Not true for the stuff I was writing. Can you say mission critical? I thought you could ;-).

  5. Re:Why not?! on Insecure Code - Vendors or Developers To Blame? · · Score: 1
    Actually, if you are in the US military and write code, you are legally responsible and the penalties can include time spent in a federal prison. However, on the flip-side, you don't have some id10t who doesn't know systems analysis or software engineering jogging your elbow every ten minutes telling you to deliver the software with bugs in it. We could and would spend time in doing an extensive system analysis before even considering whether the project was possible or doable. This would be followed by several weeks just in the design phase to insure a mathematically correct design and that's before even considering the available tools which were also surveyed. Then, and only then, we'd go back and lay out the time line and budget and wait for the go-ahead (which was always given, no strings). Then we were left alone to do the job. After the coding phase, and testing to insure that all hardware/OS/compiler bugs were dealt with, extensive testing was done with real users operating the software while under observation. I've never seen that done in the civilian world, ever. Yeah, they have beta testing and "community technical previews", but that's far too late in the process, in my not so humble opinion, as most features/functionality is set in stone. In any case, our results, zero defects/bugs/security holes, speaks for itself and some of the programs are over twenty years old and still in use (yep, MS-DOS programs used on Windows XP with no problems).

    I didn't allow freeping creaturitis (creeping featuritis) although some functionality (ordering of events, extra validation, etc.) was allowed. You change the spec on me, the whole thing gets trashed and done over just as with any of the other professional engineering fields I've worked in. You do not engineer a nuke plant or a ship to a moving target (although I've seen them do that with the latter and in every case it was a disaster). If you expect the same standards of quality/responsibility from people who develop/engineer software, you are going to have to also adhere to the other side of the contract. Hard specifications/requirements, project time lines/resources set by the engineering team and enforceable by both sides, and penalties to both sides for missed targets, defects, and especially changed requirements, inadequate resources, and poor specifications.

    Been there, done that, burned the t-shirt folks. You can do it, but you have to be serious and you have to have the willingness to stand by your guns. Besides, chewing out a one-star can be exhilarating if not exactly fun ;-).

  6. Re:Sloppy Code or Sloppy Language on Insecure Code - Vendors or Developers To Blame? · · Score: 1
    The reason that you can get buffer overflows in the first place has nothing to do with the library routine, save that the problem manifests itself inside its code section, it has everything to do with poor software engineering practices. I've been writing secure code under far more stringent conditions than you'll ever see [screw up and you're in Leavenworth!] and I've never had a buffer overflow. Why? Simply put I as judicious in my selection of library routines and I make damn certain every input into as well as the outputs from any call are correct. Hell, I have never had to place exceptions inside my software for the simple reason that they (the conditions that would generate one) can't occur, period. The software would reject the input long before you would need exception code. Ditto anything to/from the operating system. Think big state machines and you get the idea, but here everything has to be mathematically verifiable for correctness, and despite what many software developers assert, such code can be written if you are good enough.

    If anything the greatest time waster I had while engineering software was creating specific workarounds for operating system and compiler bugs, documenting the hell out of them both in the code and in the documentation, and making sure that everyone knew that they were in there for the day the application (suite) was ported/installed in a different setup.

  7. Re:Small to Mid IT Folks - Is this a holy grail? on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 2, Insightful
    Actually I've been using VMWare Workstation version 2.0x for this purpose for years. I like to keep an eye on the dark-side so when I cruise their boards I have always used a VM to do it from. Anytime they glitch/hack/crack the VM, I would just restore from the snapshot. I'd also work this way anytime I was operating unprotected out their due to a 0-day security hole (Windows or *nix) so I could get my patches, tuck them into my shared folder, get safe again. Heck, I was running DC's on VMWare long before MS decided it was a bright idea. Crack my DC? Fine, restore from snapshot and off I go, after I patch of course

    So, for a security standpoint, yes you can do this and I'd highly recommend it. Heck, security would be what I consider a natural market for this product as testers need something a bit more robust. VMWare must think the same given the Browser Alternative image that exists. Nice to see someone else thinking security first.

    BTW, the way I'd approach it is to place a known good copy of whatever image you are going to use in a safe place, or burn it to CD, just remember to change permissions when you copy it off the CD to remove the write-protect (depending on how you copy it). Whenever the image gets totally wacked, which it will, restore from the copy. You'll lose any settings/bookmarks/cookies/etc., but this may be considered a good thing. Also do remember that there is the potential, since the VM will be sharing the connection in some way with the machine to have a worm crawl out of the VM and climb into the host OS. Small, but it is there. The way I solve this problem is to block all the ports between the VM and the Host on the host side, using a software firewall just on that adapter if you are running Windows in a VM on Windows. Windows on *nix, don't worry about it as hybrids haven't been successful (yet). Not perfect but if you don't have a separate machine to set up just for browsing that can be restored from image daily/hourly/whenever, this is about the next best thing.

  8. Re:Existing virtual machines? on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 1
    Right, those EULA's always apply and you need to read them carefully. (You are reading them all, aren't you? I do, I kid you not.) For the *nixen and a lot of other F/OSS OS's, this shouldn't be much if any problem, but be careful around included commercialized OSS. Microsoft is, of course, more than a bit of a problem but as another poster pointed out, they are revising their policies with respect to virtualization. The new policy for server software will be that you can rack 'em and stack 'em so long as you run no more than the number of copies that you are licensed for on your hardware: real and virtual total equals the number of license you require. Actually, they phrased it a bit more obtusely than that. They stated you will be billed for the number of real and virtual server software copies you are running but that's lawyers for ya!

    When Windows Server 2003 Release 2 comes out, you will have a provision in the EULA to have up to 4 copies running at the same time in all versions save the Datacenter version. For Datacenter, it will be unlimited, but hell if you can afford Datacenter, and the attendant hardware that comes with it (it is not a separate product), you aren't worried about licensing! Still, it is an acknowledgment that virtualization changes the rules and is far less weird than the approach Oracle is taking with, for instance, multicore-CPU's (second CPU = 75% of a CPU for licensing costs ;-). MS is still a bit up in the air about Vista but who knows. The last time I looked it was at nine tailored versions and counting and I'm fairly certain that it will vary by version. Vista Server is too far out on the time line to say anything.

    BTW, nowhere in anything I've seen to date is there any restriction on whose VM you can use these provisions on and frankly I don't expect to see any. MS is not suicidal. Enterprise users are far more likely, at this stage, to be using GSX and ESX so such a restriction would knock Windows right out of the high-end virtualization market. Not on the hosting end: on the client end. That's a lot of lost license sales as anyone playing in that arena isn't just buying Windows Server 2003, they are going to be picking up the rest of the suite as well. Priced SQL Server 2000 Enterprise, or 2005 for that matter? Costs a lot more than WS2003EE by a fair chunk. Toss in Host and Integration Server, BizTalk 2005, etc., you are talking serious cash.

    That's why all this talk about MS locking out VMWare is idiotic. Sure, it might, just might, increase sales of Virtual Server 2005 Release 2 by a few percentage points. Meanwhile they kill the enterprise cash cow when the enterprise mass migrates to *nix using IBM Global Services. Duh! Badly flawed economic analysis on those people's part. If it's one thing I know, MS understands the economics (monopoly/oligopoly) part of the equation quite well. Too well in the opinion of many here.

  9. Re:Wondering on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 1
    They keep putting *experimental* (yes, they put asterisks around it in the docs) support for D3D in the betas but so far I haven't had much luck with it. The problem here is that Direct 3D lives up to its name and wants to go bang on the hardware directly. Well, when you are in a running a VM on top of another OS that can get more than a little hairy, especially if there is anything else out there that is using D3D to do anything (and you be surprised at the amount of stuff that does that you weren't aware of!). It would help if I had more lower-end D3D stuff laying around to play with. Time to dig out the old CD's from the box at the back or the closet to see if I can find any as I really didn't give it a serious test in any of the prior betas that included it.

    I wouldn't even think of trying it on Linux though. That's a match made in hell! OTOH, if anyone can get it to work, they may. I remember when Solaris 10 was *experimental* and it works fine now. I finally got to see it in action without slicking a drive.

  10. Re:Not entirely accurate on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 1
    Actually, VMWare pretty much owns their market segment and will for the forseeable future at least until Vista comes along. Currently MS has Virtual PC and Virtual Server 2005 (soon to be in Release 2). I've used both and have tested the later extensively, both beta and release, as well as VMWare Workstation since the 2.0 version. To put it mildly, VMWare is the consistent hands-down performance and feature winner and MS hasn't even come close and still won't for quite a while. That doesn't even take into account GSX or ESX. Vista, in the versions that will include virtualization, may allow for better performance but again, VMWare will also be sitting there coding for the hypervisor as well and they consistently code better. Personally, I call it no contest and worth the money if you are at all serious about virtualization and I be serious given the amount of beta work that I do here.

    For the casual/home/work-at-home user, VPC or the upcoming virtualization in Vista will be a more financially sound decision, but that's already the case now as VPC is much cheaper than VMWare WS. It just isn't nearly as capable but that category of user won't be using those capabilities anyway. Totally different market segments which you are, mistakenly, merging into on overarching market segment. BTW, I should point out that even MS uses VMWare for some of its labs and partner demo CD's. Once I get my copy of the player the very first thing I'm going to fire up is the ISA lab just to see if it works.

  11. Re:Existing virtual machines? on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 1

    Thanks for the heads up! Probably has to do with using the same registry keys would be my guess but I'll know more when the VMWare site recovers from a serious slashdotting. I'll also want to check it against the next version of VMWareWS.

  12. Re:Existing virtual machines? on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 1

    Thanks for posting the link. I knew you could do it but somewhere along the way I lost the info.

  13. Re:Existing virtual machines? on VMWare Inc. Releases Free Virtual Machine Runtime · · Score: 2, Insightful

    Nope, nothing in the EULA for VMWare Workstation to prevent you from sharing/distributing images and I've read that sucker each and every time we do another beta/release candidate (mostly to catch typos). You're supposed to stockpile these puppies if you need them so you have a stack of testing platforms. Now I'd be real careful about Microsoft EULA's, but those are supposed to be modified here shortly, if they haven't been already.

  14. Re:More sec bugs = more downloads on Firefox Tops 100 Million Downloads · · Score: 1
    This whole download thing is seriously flawed anyway, now matter which way you look at it. There is no telling how many of the downloads represent new users versus updates, just as there is no telling if a download count represents only one machine or several [I download once, install many here], nor whether a download results in an install that will be used in the future. By that last one you have to remember that not everyone that downloads it actually follows through with the install, nor are all successful, nor do all continue as FF users (i.e. they uninstall it).

    Frankly I'm more interested in the site logs although there is no uniform way of even sampling those (!!) cross-industry. You ain't gonna see a whole heck of a lot of FF entries in AOL's site logs I imagine (and that's all it is, imagine as I have no idea). Heck, maybe the most reliable indicators would be what Google and the other major search engines show in their logs and so far as I know, more than one of them ain't talking either. Yet another worthless statistic, and I should know one when I see one as one of my degrees is in stat.

  15. Re:Opera 8.5 reports itself as IE by default on Firefox Tops 100 Million Downloads · · Score: 1

    Actually, I have them all installed (although IE is on strike since last patch Tuesday, no loss there!). Each has its strengths and they all have some sort of weakness somewhere although I do agree about your Opera comments. I still like FF better (I'm an extension whore), but Opera is solid.

  16. Re:Some misc. Browser Percentage Data - GO FF! on Firefox Tops 100 Million Downloads · · Score: 1
    Actually I'm not interested in money or power although I could definitely have the first if I wished and with that I do have the contacts to acquire the other (as well as the skills). As for the ladies, well I've never had a problem there either but I'm not interested in 99% of them as that set wouldn't know an intelligent conversation if it bit them (and I'm not talking just geek stuff either). Usually they pick me up and I ain't that good looking (rather plain actually).

    Sorry, I'm here to have fun which is why when they medically retired me I stayed retired, thank you, with the odd consulting gig on the side if it looks interesting (i.e. it's more fun!). And now I have the contacts and the time to do nothing but invent/design/create neat things and feed it back to the mega-corps and other teams around the world. Call it intellectual masturbation, call it what you will. Oh and be a gadfly here ;-).

  17. Re:bait and switch tactic on Office + OpenDocument, Never Say Never · · Score: 1
    Actually I have both Office XP and OpenOffice installed on the same machines (I have four here and three at various remote sites) as I never know what I'm going to have to use at any given time. It's pretty much the same down the line with multiple OS's per machine, mixed open source and proprietary (MS, IBM, etc.), and so on. If anything I'm a little too hardware/OS/software agnostic although I have to be to give good advice to clients, engineer good systems, as well as troubleshoot/repair what I might find out there. However that doesn't get back to the basic point which is you really need to look at all the options out there. As a result of joining the partner program (at Microsoft's request oh so many moons ago) and obtaining one of their ActionPacks ($299 total), I have more licenses than I know what to do with and it ranges from Server 2003 on down through almost everything they make and for the client/application side, you get ten of them... each. IBM and the rest have similar programs for people that are willing to investigate their options, ya just gotta know that they exist! That can take some digging, especially on the IBM site.

    Not for everyone, although it's not like they ask me to really do anything. It does put a lot of information at my fingertips and when someone wants to know their options, I have it right in front of my mind. Ditto F/OSS, IBM, Sun, Novell, etc. Hell, none of them even ask that I push their stuff, although I'm sure that is part of the idea that they have in their skulls . Again, I'm agnostic [and for this place downright weird!]. I listen to what the client wants to do, figure out how to do it in the budget they set or less, if at all possible, and then go do it once given the go ahead. Using whatever. I've been at this a long time, since before MS even came along. Started on punch-cards on an IBM/360 when they were new if that gives you any idea.

  18. Re:bait and switch tactic on Office + OpenDocument, Never Say Never · · Score: 1
    If you spent $400 for your copy of Office, you screwed yourself. I'm not talking piracy, I'm talking economic reality here. Hell, I haven't spent $400 for the total sum of all the MS software (Windows Server 2003 Enterprise, Office, Exchange, SQL Server..., i.e. dang near everything MS makes!) total. I know for a fact that you won't pay anything near that as a business or enterprise under any of their licensing schemes either, which they are also changing again, especially in the light of multiple processing and virtual machines.

    And that doesn't even count the fact that OpenDoc is nowhere to be found in Office97, so if you are facing a mandate from on high to have OpenDoc support, Office97 won't cut it. That mandate can also apply to businesses in certain circumstances as well, do remember, if you do any kind of federal, state, city, or municipal work and their contracting requires supporting such formats. [This wasn't something that I saw brought up in the Ma. OpenDoc thread, the unfunded mandate aspect of their requirement.]

    BTW, I happen to agree with you about the Office97 feature set.

  19. Re:Wow... on Magnetic Field Thruster Developed · · Score: 1

    You've obviously never learned German! If you are a student of German, the translation is not that hard to restructure in your mind. As machine translations go, it's not too shabby.

  20. Re:Yeah but the article is inacurate. on Magnetic Field Thruster Developed · · Score: 2, Informative
    Most of the weight of a reactor are in the ancillary components and shielding. In space if you mount the reactor on a long boom you need only shield the aft end at the top of the boom, just before the working capsule (cargo, passengers, etc.). Also, I don't think you'll be wanting to be using a pressurized, light-water reactor design in space. Not a good idea at all! I'd be thinking more along the lines of the liquid sodium (metal) designs we started playing with back in the '60's. We have much better materials for the plumbing now so corrosion in that part of the design could be significantly minimimuzed. Indeed, using a ceramic fuel element design, you'd eliminate fuel cell corrosion entirely. I wonder if Corning wouldn't mind a rather large contract to test using their diamond deposition process for lining the the other components. That's just a few issues off the top of my head that would be easy to address.

    Actually, I'd be thinking more along the lines of using plutonium or duterium fuel cell batteries rather than an actual reactor although a good reactor design gives a much higher power density and is (usually) easier to refuel.

  21. Been there, done that,... on AMD / Intel Hybrid Motherboard · · Score: 2, Interesting
    burned the t-shirt. Mi Amiga 2000 could accept a daughter-board that could bus-master (or negotiate bus-mastering with SCSI controllers for that matter) the whole system. EXCEPT in it's case, that design was bright enough done to take advantage of other system components that were still left on the motherboard. Putting this through my computer hardware engineering lens here, especially where the various components are located (!!), and I see nothing of advantage to the USER. Not a thing. You are far better off purchasing similarly priced motherboards which will provide you with more capabilities. That does not even count the poor reputation that this (these) manufacturer(s) have with me, and others, historically.

    Worse, putting my economist hat on, the only people that this makes sense for are the manufacturer and a few OEM's that may be crazy enough to go for this design. None of the top OEM's I know of would even consider it. Any who would have poor reputations from what I've been able to discern historically. Someone may surprise me and come up with an economic justification here aside from those two considerations, but I haven't seen it in the threads so far.

    Nothing to see here. Move on.

  22. Re:Simple defense against rootkits on No Defense Against Windows Rootkits? · · Score: 1
    Actually it's not so theoretical as it is part of my monthly plan for all computers. Each month every computer, server or no, gets cleaned out, connection seating checked, internals inspected for things like singns of overheating, and generally given the once over. They also get a full virus scan, trojan scan, registry verification/validation, and yes those MD5 checksums are compared. Security is a process and if you don't engage the full process, you might as well not bother engaging in any if your data is that important.

    As for the managers at the various sites they know they don't understand what the rat frag I'm doing even though I do explain it very politely and in very simple terms with talking down to them. What they do understand is that if I can commune with each machine for an 8-10 hour period each month, they rarely if ever see any downtime. I've been doing this for twenty-five years now and not just with computers. I do it with all electronic devices from TACANs (VORTAC is the civilian countnerpart), radar systems, satcom, firecontrol, whatever. I've had systems with a MTBF of 108 days go four years with zero on-demand downtime simply by following this routine. I catch the problems before they become a problem and replace/repair/reprogram appropriately. I do the same thing with my home machines as well and I have machines that have been chirping along into their second decade and in one case third.

    BTW, if your site is running on only one server with no backup, you already have a severe risk management problem. What will you do when that power-supply or other critical component (cpu anyone) craps out? Hmmm...? Sheesh. Mission critical my ass if you don't have a backup.

  23. Re:What rootkits? on No Defense Against Windows Rootkits? · · Score: 1
    I think they are getting better about this. For instance, my machine here is schizoid. Sitting on top of the kernel are two OS's: Windows Server 2003 Enterprise and the POSIX based Interix/X11R6 courtesy of Windows Services For Unix (SFU) 3.5. Before I was using Cygwin, this beats the stuffing out of that approach and I have all the tools I could ask for right down to GCC. It's actually quite slick to hit Ctrl-Alt-C (my selection) and up pops C-Shell, my old friend.

    On the Linux front, expect to see Virtual Server 2005 Release 2 (was Service Pack 1 but they changed it) to support it. Right now I'm trying to get Solaris up and running on it as well. It's quite different in approach than VMWare's Workstation 5.5 (testing here as well), GSX or ESX, but it does work and they are trying to break it out of the Windows only mode. I don't know if they will make it. We shall see.

    That's not to say it will all be roses and candlelight. I don't think that will ever be the case so long as Linux is perceived as a threat to their monopoly on the desktop and the corporate office suite but I'm seeing some flexibility and I do know that they are talking to the partners more about newer and different ways to reach SMBs. [They called me today ;-) ]. Again, we shall see.

  24. Re:Unacceptable for national defense on No Defense Against Windows Rootkits? · · Score: 1

    While I was in the US Navy and onboard a ship I worked on every system on the ship except the pumps in pump alley and the sewage plant due to my background prior to joining and extensive engineering training. Except for the main computer, every one of the systems used a custom embedded processor and operating system, if you could call what they had an OS. The main computer used a custom OS as well, not even a form of Unix. Heck, one of the computers was still programmed using paper tape! It was only when you got to the administrative computer(s) that you encountered more pedestrian operating systems that a mortal might be familiar with.

  25. Re:Unacceptable for national defense on No Defense Against Windows Rootkits? · · Score: 1
    I can't talk about it much as the NDA they had me sign involves a prison term ;-). However, those Win'2K boxen aren't connected to the fire-control systems nor navigation, nor much of anything else and even if they were, they wouldn't get anywhere. That Windows Rootkit would have to be able to grok something like a Sperry/Univac or a custom embedded processor system (which is what all the nav systems use btw). You'd have to quite literally be proficient not only at the engineering level with the various systems as well as Win'2K and establish a cross-connection between the two. If you are that good it'd be far easier to just RootKit that Sperry/Univac itself. And yes, even the new ships are using systems that old. They take them out of older, decomissioning ships and install them in the new ones. The US Navy hardly ever throws anything away and most all of it is proprietary to a fare-thee-well and unless you are a hard-core engineer (moi), you won't know how it really works, or how to reprogram it anyway.

    Now that isn't to say you couldn't play havoc with other subsystems on the ships since the supply and stores inventories, electronic copies of service and health records, even the 3M (Maintenance Management, i.e. preventive maintenance) system are kept on those boxen but that isn't the same thing as crippling the war-fighting capability of the ship. We do have paper copies for everything if the computers go tits up or give us odd results. Heck, for the most part, everything is done on paper anyway then it is entered into the computer. I tilted against that windmill many a year with no success.

    The US Navy is one of the most conservative, i.e. old-fashioned sense not political but somewhat there too, institutions on the planet. Change is positively glacial unless you can convince your superiors that it will make them look really, really good. That's the only way I got anything done.