Well, I think the key point here is what we understand as secure. "Secure" is "easy" to define in terms of a system, but, to me, seems a remarkably nebulous concept when applied to a language. While it's very easy to screw up in C, that isn't a matter of "barbed wire and armed security guards", but rather "flying trapeze and safety nets".
How is hand-coded assembly a move to a "more secure language" (whatever that means) than C (which is what I was replying to)? Is that not precisely the job for which compiled languages were created?
Regarding CoyotOS and BitC, those are quite interesting references, thank you. It might be a stillbirth, though, since one of the lead guys is leaving the BitCC team. Either way, one could argue that coming up with your own low-level language to develop your own secure operating system is pretty much the only way to be able to "prove" it correct (and "prove" there is in quotes because I doubt they proved LLVM's correctness). Still, from what I read about BitCC, the original point still stands: How intrinsically secure is the languange, in and of itself? What does it have that makes it special? Because all I can find is stuff that makes bugs less likely, like proper bounds testing.
Anything else that compiles to native opcodes? It's not like C is the only magical language capable of talking to hardware.
C is obviously not magically endowed with some special abilities. But since that was an answer to someone who wanted to replace C with something more secure, the question is: "what language that is naturally more secure than C would you suggest, then?"
Besides the obvious practical question of "give me an actual language that's actually more secure than C", there's the more theoretical question of "what the hell does it mean for a language to be secure?" A programming language is only an abstraction on top of the capabilities of the underlying hardware. Either you're hiding some capabilities the hardware is capable of, or the most a language can do is hold your hand and help you steer clear of the pitfalls. You're safer, but you're not any more secure.
And with almost everything going to interpreter environments today (Python, Ruby, Java,.Net), there's a better argument that building a JIT as a kernel component and that the message passing overhead is less of an issue.
Let me get this right, after stating that the advantage of a microkernel lies in the much smaller size in LOCs, you just argued that adding JIT compiler to the microkernel itself is a good idea?
Part of the idea behind a microkernel is that you only need to prove correctness for a small amount of code. The other part is that, when you want to add features, you only need to prove the features you want work correctly. So, instead of proving that each driver works correctly (which, for most environments where this stuff really matters, only needs to be done for a "handful" of drivers), you just upped the ante and said "prove the whole JIT compiler works correctly". And the "message passing overhead" pales in comparison with a poorly-optimized JITC, which is what you get if you want to keep TLOC count low.
Dropping C... for what exactly? We're not talking application level security. We're talking kernel level. That means talking to the bare metal. Even if you implement a microkernel with userspace modules for everything, and with those modules written in something more robust than C, that last crucial bit of code that is the microkernel itself is probably going to end up being written in C with ASM snippets, simply because at some point you need to explicitly state what the hardware is doing.
I guess the idea is less about creating an all around well-built system that's pretty secure in practice, and more about creating something that, even if it might have implementation bugs today is fundamentally, conceptually more secure.
No, the worst case scenario is that the fighters would've blown the plane up before it was overflying Manhattan. Either over an unpopulated region or, as callous as it may sound, somewhere less "important" (mostly, more sparsely populated) than Manhattan
The definition of "terrorist" is someone who fights using "terror". As in fear. By acting like a bunch of sissies, you're playing right into their hands.
Copyright is meant to give you an incentive to produce culture. If the Beatles haven't seen enough monetary incentive yet, nobody has. Copyright has, therefore, served its purpose. Let it go now.
But the point is precisely that it still has commercial value. If there was none, it wouldn't matter, really.
See, this is where we stand: The creator has been paid enough, there is demand for a good, and the supply is infinite. The cost to get things to people is distribution only. If everybody in the USA alone sees a Beatles album as being worth, say, 10 dollars, at 300M inhabitants, by saying "copy freely" the USA becomes 3 billion USD richer, without even considering the compound value of derivative pieces. And that's for one album.
Assuming of course all boxes have the same version of the OS, the same packages installed, etc.
Regarding having the same packages installed, you "only" need to make sure your local repos have all the packages that are used across your install base. The machines will then pull only their own updates, with no fuss. Regarding the heterogeneity... tough cookie. Either you have something more or less homogeneous and you can automate the process, or you're stuck doing things by hand. Especially once you enter the realm of "review each available update by hand and determine whether it's relevant", as the OP asked for. You can't have that and useful automation with 10 different distro/version setups.
Professor Hydén continues with enumerating "at least three strange things in a strange trial" (translation): First, that someone can be sentenced for being accessory to a crime for which there is no main culprit: "This assumes someone else having committed the crime, and no such individual exists here... the system cannot charge the real culprits or it would collapse in its entirety." It is unprecedented in Swedish judicial history to sentence only an accessory. Second, that the accessories should pay the fine for a crime committed by the main culprits, "which causes the law to contradict itself." And third, that accessories cannot be sentenced to harsher than the main culprit, which means that every downloader must be sentenced to a year's confinement. Prof. Hydén sums up by saying that to allow this kind of judgement the Swedish Parliament must first pass a bill making this kind of services illegal, which it has not done.
I'm not certain on the second point, but the first and third definitely don't seem like problems to me: Imagine a guy I can't identify convinces me to help him commit a crime. If I'm caught and he's not, and there is sufficient evidence that the crime occurred and that I helped, I hope that, under any sensible legal system, I can be convicted of being an accessory to a crime. On the third point, at 365 days a year, 24 hours a day, I need only be found accessory to 10,000 individual counts of something punishable by one hour in jail for my accumulated penalty to reach 1 year. If I'm found repeatedly committing the same crime (or aiding in that crime), that's an aggravation, which makes the punishment I'm due end up on the worse end of the range, whereas the "main criminal" might be a first timer and, thus, not have any aggravating circumstances, thus taking the shorter term.
Of course, those arguments suppose that TPB is actually involved in a crime, which is a different argument altogether.
"Naive" is just a loanword (from the French) that essentially expresses the same as "innocent" (in the "lacking in experience, excessively optimistic" sense.)
Seems more like a way to do what Apple did with OS9 (aka 'classic') on OSX. Hopefully, they used the chance to remove as much back-compatibility cruft as they could, too.
Ok, not to defend them but just to get you thinking about their perspective, they are attempting to protect their name. Not profits or anything really evil, just their name.
What would you say if I wrote a mischievous program and hosted it at iwikipedia.org? Wouldn't you want them to be able to go after me and shut me down?
Actually, your second paragraph isn't even necessary. If I understand Trademark law correctly, either they actively defend their trademark, or they lose it altogether.
That ain't true! Company gets monopoly only when there is not a single competitor on that market.
That is patently false. Under that definition, Microsoft never had a monopoly on PC Operating Systems, because at any point in time you've had DR-DOS, OS/2, 386BSD, Linux, etc available. I don't think there was ever only a Microsoft operating system available.
From Wikipedia: In economics, a monopoly (from Greek monos , alone or single + polein , to sell) exists when a specific individual or enterprise has sufficient control over a particular product or service to determine significantly the terms on which other individuals shall have access to it. The key here is "sufficient control". Microsoft, through its position, had enough clout to effectively lock out competitors (by altering the pricing for OEMs who don't sell enough windows boxes), and Intel also had (and, really, still has) enough pull in the PC market to exert that sort of influence if it so chooses (irrespectively of whether they do, or did).
Legal definition may vary a bit from there, but US antitrust bears out these principles.
My understanding of the matter is that, since the display subsystem is a descendant of NeXT's Display PostScript, and is essentially a subset of PDF, pdf output runs deeper than "built into the print subsystem".
Pirate Bay? What the hell does this have to do with the Pirate Bay?
Somehow, I think that, since the pirate bay guys got a bad verdict, comparing organizations to the Pirate Bay because they're screwing with your profits will become a fad. In which case, with due credit to that Godwin chap, I hereby claim ownership of Alperxe's Law: "All discussions about an organization hurting IP-based corporations will eventually devolve into the target of the discussion being compared to The Pirate Bay".
So despite all these practices (specious agreements students are forced into), turntin may still be a party to infringement...
Oh my god students are being forced into specious agreements so their essays can be abused and posted on teh interwebs! You know what? Sod the whole legal wrangling. We're talking about fair use here. They're not passing the work off as their own, they're not even using it for its original purpose. The service they off (to teachers, granted) is precisely focused on making sure nobody else passes the work off as their own (which, IMO, is the one single truly essential piece of intellectual property). If that's not fair use, none of the rather creative mashups many of us love to watch on YouTube could possibly be fair use either.
You have a very good point. I find that I'm a lazy git, and, while I have a ton of things I want to try coding up, I never end up doing so because something else easier (like playing a game) comes up to take my free time. The best code I wrote as a leisure thing (as opposed to work-related code, which ends up being at least decent whatever happens) was written because I was stuck with a computer, no 'net connection, no games, and a fair bit of free time.
Why would they need to deal with multiple vendors? Pick one. As a bonus, the price is set by competition rather than what will eke as much money out of the market as possible.
I believe the OP meant multiple vendors as in, if they drop MS Office but not Windows, they're dealing with Microsoft and $OOoVendor.
Also, I wonder why has he also fined for copyright infringement, that worries me.
I wrote it, I have copyright over it. Arguably, an answer to a classified ad is not "creative" enough to qualify, but if I litigating I just might throw that on top and see if it stuck. And, if I were the judge presiding over this scumbag's case, I just might be inclined to stretch the law to see if I could make it stick. You know those cases where a person does something that's obviously wrong but you can't pin anything illegal on it? This was the reverse: the guy did something pretty scummy, and got "unlucky" in that the court allowed all possible claims to stick. Being likeable nets you some points in court -- and this guy really didn't score any there.
I guess it helps that you can just blindly reject everything in the original post that resembles html, and then only generate the html you explicitly allow from the BBCode. That way you're preventing some funky attacks. Of course, implementations might or might not produce further errors...
Slashdot Mirror
Well, I think the key point here is what we understand as secure. "Secure" is "easy" to define in terms of a system, but, to me, seems a remarkably nebulous concept when applied to a language. While it's very easy to screw up in C, that isn't a matter of "barbed wire and armed security guards", but rather "flying trapeze and safety nets".
How is hand-coded assembly a move to a "more secure language" (whatever that means) than C (which is what I was replying to)? Is that not precisely the job for which compiled languages were created?
Regarding CoyotOS and BitC, those are quite interesting references, thank you. It might be a stillbirth, though, since one of the lead guys is leaving the BitCC team. Either way, one could argue that coming up with your own low-level language to develop your own secure operating system is pretty much the only way to be able to "prove" it correct (and "prove" there is in quotes because I doubt they proved LLVM's correctness). Still, from what I read about BitCC, the original point still stands: How intrinsically secure is the languange, in and of itself? What does it have that makes it special? Because all I can find is stuff that makes bugs less likely, like proper bounds testing.
Anything else that compiles to native opcodes? It's not like C is the only magical language capable of talking to hardware.
C is obviously not magically endowed with some special abilities. But since that was an answer to someone who wanted to replace C with something more secure, the question is: "what language that is naturally more secure than C would you suggest, then?"
Besides the obvious practical question of "give me an actual language that's actually more secure than C", there's the more theoretical question of "what the hell does it mean for a language to be secure?" A programming language is only an abstraction on top of the capabilities of the underlying hardware. Either you're hiding some capabilities the hardware is capable of, or the most a language can do is hold your hand and help you steer clear of the pitfalls. You're safer, but you're not any more secure.
So what does it do when my hands get tired? Crash my spaceship into the nearest moon?
Can't RTFA at work, but the obvious answer is "you make a gesture that signals you're detaching from the controller".
And with almost everything going to interpreter environments today (Python, Ruby, Java, .Net), there's a better argument that building a JIT as a kernel component and that the message passing overhead is less of an issue.
Let me get this right, after stating that the advantage of a microkernel lies in the much smaller size in LOCs, you just argued that adding JIT compiler to the microkernel itself is a good idea?
Part of the idea behind a microkernel is that you only need to prove correctness for a small amount of code. The other part is that, when you want to add features, you only need to prove the features you want work correctly. So, instead of proving that each driver works correctly (which, for most environments where this stuff really matters, only needs to be done for a "handful" of drivers), you just upped the ante and said "prove the whole JIT compiler works correctly". And the "message passing overhead" pales in comparison with a poorly-optimized JITC, which is what you get if you want to keep TLOC count low.
Dropping C... for what exactly? We're not talking application level security. We're talking kernel level. That means talking to the bare metal. Even if you implement a microkernel with userspace modules for everything, and with those modules written in something more robust than C, that last crucial bit of code that is the microkernel itself is probably going to end up being written in C with ASM snippets, simply because at some point you need to explicitly state what the hardware is doing.
I guess the idea is less about creating an all around well-built system that's pretty secure in practice, and more about creating something that, even if it might have implementation bugs today is fundamentally, conceptually more secure.
No, the worst case scenario is that the fighters would've blown the plane up before it was overflying Manhattan. Either over an unpopulated region or, as callous as it may sound, somewhere less "important" (mostly, more sparsely populated) than Manhattan
The definition of "terrorist" is someone who fights using "terror". As in fear. By acting like a bunch of sissies, you're playing right into their hands.
Presumably you're supposed to offload from flash to HDD when you wake up.
Copyright is meant to give you an incentive to produce culture. If the Beatles haven't seen enough monetary incentive yet, nobody has. Copyright has, therefore, served its purpose. Let it go now.
But the point is precisely that it still has commercial value. If there was none, it wouldn't matter, really.
See, this is where we stand: The creator has been paid enough, there is demand for a good, and the supply is infinite. The cost to get things to people is distribution only. If everybody in the USA alone sees a Beatles album as being worth, say, 10 dollars, at 300M inhabitants, by saying "copy freely" the USA becomes 3 billion USD richer, without even considering the compound value of derivative pieces. And that's for one album.
Assuming of course all boxes have the same version of the OS, the same packages installed, etc.
Regarding having the same packages installed, you "only" need to make sure your local repos have all the packages that are used across your install base. The machines will then pull only their own updates, with no fuss. Regarding the heterogeneity... tough cookie. Either you have something more or less homogeneous and you can automate the process, or you're stuck doing things by hand. Especially once you enter the realm of "review each available update by hand and determine whether it's relevant", as the OP asked for. You can't have that and useful automation with 10 different distro/version setups.
Professor Hydén continues with enumerating "at least three strange things in a strange trial" (translation): First, that someone can be sentenced for being accessory to a crime for which there is no main culprit: "This assumes someone else having committed the crime, and no such individual exists here... the system cannot charge the real culprits or it would collapse in its entirety." It is unprecedented in Swedish judicial history to sentence only an accessory. Second, that the accessories should pay the fine for a crime committed by the main culprits, "which causes the law to contradict itself." And third, that accessories cannot be sentenced to harsher than the main culprit, which means that every downloader must be sentenced to a year's confinement. Prof. Hydén sums up by saying that to allow this kind of judgement the Swedish Parliament must first pass a bill making this kind of services illegal, which it has not done.
I'm not certain on the second point, but the first and third definitely don't seem like problems to me: Imagine a guy I can't identify convinces me to help him commit a crime. If I'm caught and he's not, and there is sufficient evidence that the crime occurred and that I helped, I hope that, under any sensible legal system, I can be convicted of being an accessory to a crime. On the third point, at 365 days a year, 24 hours a day, I need only be found accessory to 10,000 individual counts of something punishable by one hour in jail for my accumulated penalty to reach 1 year. If I'm found repeatedly committing the same crime (or aiding in that crime), that's an aggravation, which makes the punishment I'm due end up on the worse end of the range, whereas the "main criminal" might be a first timer and, thus, not have any aggravating circumstances, thus taking the shorter term.
Of course, those arguments suppose that TPB is actually involved in a crime, which is a different argument altogether.
"Naive" is just a loanword (from the French) that essentially expresses the same as "innocent" (in the "lacking in experience, excessively optimistic" sense.)
Seems more like a way to do what Apple did with OS9 (aka 'classic') on OSX. Hopefully, they used the chance to remove as much back-compatibility cruft as they could, too.
True, I guess. It'd be innocent to think they made the same confusion as me.
Ok, not to defend them but just to get you thinking about their perspective, they are attempting to protect their name. Not profits or anything really evil, just their name.
What would you say if I wrote a mischievous program and hosted it at iwikipedia.org? Wouldn't you want them to be able to go after me and shut me down?
Actually, your second paragraph isn't even necessary. If I understand Trademark law correctly, either they actively defend their trademark, or they lose it altogether.
That ain't true! Company gets monopoly only when there is not a single competitor on that market.
That is patently false. Under that definition, Microsoft never had a monopoly on PC Operating Systems, because at any point in time you've had DR-DOS, OS/2, 386BSD, Linux, etc available. I don't think there was ever only a Microsoft operating system available.
From Wikipedia: In economics, a monopoly (from Greek monos , alone or single + polein , to sell) exists when a specific individual or enterprise has sufficient control over a particular product or service to determine significantly the terms on which other individuals shall have access to it. The key here is "sufficient control". Microsoft, through its position, had enough clout to effectively lock out competitors (by altering the pricing for OEMs who don't sell enough windows boxes), and Intel also had (and, really, still has) enough pull in the PC market to exert that sort of influence if it so chooses (irrespectively of whether they do, or did).
Legal definition may vary a bit from there, but US antitrust bears out these principles.
That would be a friend of mine's handle, not mine. Sorry.
My understanding of the matter is that, since the display subsystem is a descendant of NeXT's Display PostScript, and is essentially a subset of PDF, pdf output runs deeper than "built into the print subsystem".
Pirate Bay? What the hell does this have to do with the Pirate Bay?
Somehow, I think that, since the pirate bay guys got a bad verdict, comparing organizations to the Pirate Bay because they're screwing with your profits will become a fad. In which case, with due credit to that Godwin chap, I hereby claim ownership of Alperxe's Law: "All discussions about an organization hurting IP-based corporations will eventually devolve into the target of the discussion being compared to The Pirate Bay".
So despite all these practices (specious agreements students are forced into), turntin may still be a party to infringement...
Oh my god students are being forced into specious agreements so their essays can be abused and posted on teh interwebs! You know what? Sod the whole legal wrangling. We're talking about fair use here. They're not passing the work off as their own, they're not even using it for its original purpose. The service they off (to teachers, granted) is precisely focused on making sure nobody else passes the work off as their own (which, IMO, is the one single truly essential piece of intellectual property). If that's not fair use, none of the rather creative mashups many of us love to watch on YouTube could possibly be fair use either.
You have a very good point. I find that I'm a lazy git, and, while I have a ton of things I want to try coding up, I never end up doing so because something else easier (like playing a game) comes up to take my free time. The best code I wrote as a leisure thing (as opposed to work-related code, which ends up being at least decent whatever happens) was written because I was stuck with a computer, no 'net connection, no games, and a fair bit of free time.
Why would they need to deal with multiple vendors? Pick one. As a bonus, the price is set by competition rather than what will eke as much money out of the market as possible.
I believe the OP meant multiple vendors as in, if they drop MS Office but not Windows, they're dealing with Microsoft and $OOoVendor.
Also, I wonder why has he also fined for copyright infringement, that worries me.
I wrote it, I have copyright over it. Arguably, an answer to a classified ad is not "creative" enough to qualify, but if I litigating I just might throw that on top and see if it stuck. And, if I were the judge presiding over this scumbag's case, I just might be inclined to stretch the law to see if I could make it stick. You know those cases where a person does something that's obviously wrong but you can't pin anything illegal on it? This was the reverse: the guy did something pretty scummy, and got "unlucky" in that the court allowed all possible claims to stick. Being likeable nets you some points in court -- and this guy really didn't score any there.
I guess it helps that you can just blindly reject everything in the original post that resembles html, and then only generate the html you explicitly allow from the BBCode. That way you're preventing some funky attacks. Of course, implementations might or might not produce further errors...