IMHO, there is only one military power in the EU, the UK. Potential military power is bull without the will to use it.
In times of peace, I'm quite happy with countries who are not picking a fight whenever a chance remotely offers itself (and create one if it doesn't). Military power is often dormant - Switzerland is a great example. It's never been conquered because even though it has a tiny standing army, it has a huge reserve force - namely, every male over the age of 18. You don't want to fight a country where really everyone is armed and ready to shoot you, from behind if necessary. You get a taste of that in Iraq right now. It isn't pretty, is it? Add mountains and multiply by 10 and you know why Switzerland is a military power - on defense only.
The US has been accused of being an imperial power for close to 100 years. If we are, we aren't very good at it. I think we have a case of "Imperialphobia".
No, you just suck at it. You try to run an empire the way Britain did, except even more on remote control, and it simply doesn't work.
Look, we don't want to rule the world.
True. You just want it to be your slaves voluntarily.
Fact is, the USA today needs the rest of the world, and desperately. 90% of what you buy at WalMart is not "made in USA", it's imported. But if wages elsewhere were at minimum wage for the US, you couldn't afford it. If everyone would use as much oil as the average american does, we'd run out in just a few years.
Fact is: Most of the rest of the world lacks indoor plumbing and air conditioning exactly because you have it.
"Inadequate security" would mean it's impossible to safely run a Windows system. Since this is demonstrably false - and fairly trivial to enforce in a managed environment - then it's simply not a factor.
"Inadequate security" is first and foremost a very generic term open to interpretation. And if you think you can safely run a Windows system in any environment (except one allowing no access at all, neither local nor remote) than you are betting the farm that despite a couple hundred root-level exploits having been found in the past there are no future ones.
If you built a really secure system, you always assume your attacker knows something you don't. Because very often he does. They aren't called 0days for nothing.
The vast majority of security breaches come from end users, either deliberately (corporate espionage style) or inadvertently (running virus-laden files from email attachments or downloads).
We could fight over how exactly to count what exactly. I do agree that these two are major problems. I think you can agree that bugs often have serious security implications. That's good enough for me.
The most common vector into the typical machine for malicious code is the end user deliberately executing it, either knowingly or unknowingly.
Yes, but that is a vector that I can control. On both Windows and Unix there are several ways to prevent that. They aren't used often because of the inconveniences attached, but they exist and anyone not using them is deliberately taking a risk.
You apparently go by sheer quantity. And yes, on that scale you are correct, the 1000 or so compromised server machines a day don't even compare to the 100,000 or so compromised windos workstations.
However, except for DDoSing and Spam, a cracked server is more valuable than 100 cracked XP Home machines on DSL. And if you are looking for something specific (say, half a million credit card numbers) then servers are where you're going and remote code execution is what you're looking for, even though by pure quantity that is a minor vector.
Numbers alone don't mean shit. At the very least, you have to take Numbers times Impact.
Again, you are largely describing problems caused by software bugs, not "inadequate security".
You make a differentiation without merit, except for pure academic theory maybe.
Most security problems are software bugs. The fact that it is very hard to write bug-free software with current tools, technology and methods is one of the main headaches of the security people. I am one. Buggy software and users are what I am most worried about, in this order. False policies, configurations and errors in concepts and methods come way after those.
but I honestly can't make a good argument against VB because I'm not familiar enough with it.
There's your argument right there. If you're not familiar with it, then either you're the wrong guy for the job, or the tool is bad. It's up to you to prove that a different tool would be better.
Ask him for a chance. Take a small, standalone part if it exists and rewrite only that in your favourite language as a proof-of-concept.
The EU has two nuclear nations (France and the UK) and considerable military technology in all fields. True, the standing armies don't compare to the USA, but if you've read "The Rise and Fall of the Great Powers" or any other in-depth book about war and empires, you'll know that it's not what you have today, it's what you can build in a short time - at the start of WW2, Germany had considerably more air- and ground power than even the US. But once the US switched to war production, things changed quickly and so did the battle fortunes.
Some end users are upset with Microsoft, as the move effectively forces gamers to buy Vista if they do intend to remain serious about cutting-edge PC gaming.
Oh, really? As if that is a surprise. When's the last time MS did not use every dirty trick in the book in order to force itself into a market or its products unto "customers"?
There's no such thing as "slacking off". Let me explain:
People have a need for rest. Biology, instinct, call it what you will. Your body and mind need rest and they will take it. If you can't get enough rest into your day or sleep into your night, your body and mind will compensate for the loss. Either by what's seen as slacking or if you still don't give in by physical or mental breakdown.
There's no "slacking". Your body and mind are just taking what they need. If you want to eliminate "slacking", you need to make sure everyone gets enough rest. With a rested and motivated workforce, there is no "slacking" problem.
They aren't "held back" by the same morality and environmental issues we are.
We used to be that way, too. Not 100 years in the past, more like 50.
I'm sure the chinese will follow a similar pattern. Sure they will be a huge force in the near future, probably stronger than the US in both economics and military power and very close to the EU (which is still growing in number of participating nations, remember). But even as a strong force, they will start to feel the impact themselves. The dam will be built, but they probably won't build a 2nd one once all the shit hit the fan. Anyone remember the Nile dam? When it was built, it was a marvel of engineering, too. Today it is widely regarded as a bad idea and if it weren't for the fact that Egypt needs the electricity, there would be talks about tearing it down.
When using Microsoft products, how is your data being "locked-in".
By being stored in a format I can not access without paying the MS tax.
You can easily take data from a word or excel document and move it to any format.
No, you can't. You can take the data, but it isn't easy. Yes, OO can open these document - thanks to endless hours of work by Free Software people who disliked the lock-in as much as I do. It's not Word exporting to OO format, remember? The ODF group came up with a Word ODF plugin, not MS. Again, there is a way out of the prison only because Free Software people built one.
Your point was what, exactly?
The only thing you really save on is the cost of licenses, which is small in the overall cost of things.
You must've missed the part where they explained the free in "free market". Hint: It's about me choosing where I spend my money. No choice == no free market.
I have yet to read even one reason why anyone should get Vista. Everything that was somewhat interesting when they were creating buzz around what was called Longhorn back then has since been stripped, leaving what behind? XP SP3, essentially.
Nobody will run games on Vista except for the folks who buy a new machine where it's pre-installed. Since that'll be no earlier than 2008 what exactly is the point of testing an incomplete beta version now?
Use the best tool for the job, regardless of philosophical ideal.
Bzzzt, wrong.
Governments are based on ideals. Such as democracy, freedom, equality, whatever.
A tool that blatantly violates these should not be used by a government, even if it is the best one. For example, many governments have strict quotes for minimum numbers of disabled employees even though they would probably "function" better without.
Free Software is important because it prevents data lock-in. One of the main reasons for Free Software by governments is that you can't make electronic tax forms mandatory if using the system requires a proprietory software that costs money (such as Windos). It's just not the government's job to force people into the direction of a specific company.
38k may sound like a lot, but more people have died in the same time due to car accidents, smoking or at least a dozen other reasons.
I'm not trying to say 38k additional and unnecessary deaths isn't a bad thing. In fact, I believe Bush should get the electric chair for starting that war based on lies and deceit.
However, in the grand scale, the death count isn't what makes that war so horrible and if you want to compare events, you also need to take into account that something going on for several years will naturally cause more mayhem than something happening once for a day.
Officials caution that much of the increase, due to be reported publicly next week, stems from a change last year in how terrorist attacks are counted, (read: The actual increase was a fraction of the reported one)
More than half the deaths from terrorism worldwide last year occurred in Iraq, (read: If you guys hadn't smashed the country to pieces, most of the shit wouldn't have hit the fan)
The point however is that these regulations aren't to prevent terrorists entering the US through an airport, they're to prevent them entering through a skyscraper (think 9/11) so collecting the personal info on the ground after they land is too late.
Reality check: * All flights used in 9/11 were domestic flights. * All terrorists involved had entered the USA some time before the event * Very likely, none of them would have registered as suspicious according to their flight data
And yet our entire country gets bent out of shape just beacuse a few thousand people happened to die in the same incident. Honestly, it isn't that big a problem!
Not on a death-toll scale, really. Then again, on that same scale the Iraq war isn't much of a problem, either.
There are things besides body counting, however, that matter. The Iraq war is wrong for many reasons, and probably criminal enough that Bush should be jailed and get a death sentence. The 9/11 thingy was likewise wrong for many reasons and its impact goes far beyond the few thousand dead people - which, btw., was exactly the purpose.
Fact is, we live in an ever-increasingly dangerous world.
I call bullshit on that. Please, where is your data?
There is no way anyone or any government can protect against everything or everyone.
True. And it isn't their job to do it. Somehow the US citizen tend to extremes - they want no government at all, or they want to sue if they put their hamster in the microwave. Most people in the EU can live with a balance - we don't expect the government to protect us from everything (especially not our own stupidity) but we do expect a certain level of safety and are willing to take the necessary amount of government and bureaucracy that comes with that.
if the mysql people slack off with security, you can drop them in favour of postgres, with practically no interruption and minimal retooling.
Yes, except for the "practically no" part.
I have a wall-sized (40,000 LOC) PHP/mysql application that I've wanted to move to Postgres for years. It's not something you can do in your spare time, even if you do have a thin database abstraction layer (i.e. you don't call mysql_* functions in your code, but db_* functions that mostly pass through and do some error handling).
It's not, of course, because if we standardize on an open document format and a crippling bug is discovered in, say, OpenOffice, there are many other programs that exist or could be written implementing the same functionality.
A bug that allows access to the operating system would almost certainly not be in the document format specifications, but in the individual implementation. Therefore, of the many different programs implementing ODF, for example, only one or at worst a few would be subject to the bug.
The fact is that computers are not biological organisms and "viruses" don't work the same way.
In certain areas, they do and the analogy is quite valid. For example, worm propagation on the Internet very closely resembles biological population growth models.
While computers and biological organisms are indeed very different critters, on the systems level (i.e including their environments) there are many similarities.
If everybody ran Linux and such a vulnerability existed, the same thing would happen.
Maybe, maybe not. Remember that many exploits (such as buffer overflows) are sensitive to the precise binary version you use. The ancient ssh exploits, for example, required different parameters depending on their target (i.e. Debian, Redhat, etc. - often even different for different releases).
So if everyone ran Linux, then most likely there would still be 5+ major distributions in 10+ release versions. Plus a lot of people who had non-matching version (manual install or a newer version from somewhere else).
Four days ago, Dan's prediction came true...for the 200th or so time. Remember Outlook? The corporate mail system monoculture? At home, it might have 20% or so of the market, but it's big with business users.
True, the Word thing is more nifty, because people don't expect it, and it's not a macro virus. But even so, this is hardly the first time MS users get bitten exactly because they are MS users.
Slashdot Mirror
IMHO, there is only one military power in the EU, the UK. Potential military power is bull without the will to use it.
In times of peace, I'm quite happy with countries who are not picking a fight whenever a chance remotely offers itself (and create one if it doesn't). Military power is often dormant - Switzerland is a great example. It's never been conquered because even though it has a tiny standing army, it has a huge reserve force - namely, every male over the age of 18. You don't want to fight a country where really everyone is armed and ready to shoot you, from behind if necessary. You get a taste of that in Iraq right now. It isn't pretty, is it? Add mountains and multiply by 10 and you know why Switzerland is a military power - on defense only.
The US has been accused of being an imperial power for close to 100 years. If we are, we aren't very good at it. I think we have a case of "Imperialphobia".
No, you just suck at it. You try to run an empire the way Britain did, except even more on remote control, and it simply doesn't work.
Look, we don't want to rule the world.
True. You just want it to be your slaves voluntarily.
Fact is, the USA today needs the rest of the world, and desperately. 90% of what you buy at WalMart is not "made in USA", it's imported. But if wages elsewhere were at minimum wage for the US, you couldn't afford it. If everyone would use as much oil as the average american does, we'd run out in just a few years.
Fact is: Most of the rest of the world lacks indoor plumbing and air conditioning exactly because you have it.
"Inadequate security" would mean it's impossible to safely run a Windows system. Since this is demonstrably false - and fairly trivial to enforce in a managed environment - then it's simply not a factor.
"Inadequate security" is first and foremost a very generic term open to interpretation. And if you think you can safely run a Windows system in any environment (except one allowing no access at all, neither local nor remote) than you are betting the farm that despite a couple hundred root-level exploits having been found in the past there are no future ones.
If you built a really secure system, you always assume your attacker knows something you don't. Because very often he does. They aren't called 0days for nothing.
The vast majority of security breaches come from end users, either deliberately (corporate espionage style) or inadvertently (running virus-laden files from email attachments or downloads).
We could fight over how exactly to count what exactly. I do agree that these two are major problems. I think you can agree that bugs often have serious security implications. That's good enough for me.
The most common vector into the typical machine for malicious code is the end user deliberately executing it, either knowingly or unknowingly.
Yes, but that is a vector that I can control. On both Windows and Unix there are several ways to prevent that. They aren't used often because of the inconveniences attached, but they exist and anyone not using them is deliberately taking a risk.
You apparently go by sheer quantity. And yes, on that scale you are correct, the 1000 or so compromised server machines a day don't even compare to the 100,000 or so compromised windos workstations.
However, except for DDoSing and Spam, a cracked server is more valuable than 100 cracked XP Home machines on DSL. And if you are looking for something specific (say, half a million credit card numbers) then servers are where you're going and remote code execution is what you're looking for, even though by pure quantity that is a minor vector.
Numbers alone don't mean shit. At the very least, you have to take Numbers times Impact.
Again, you are largely describing problems caused by software bugs, not "inadequate security".
You make a differentiation without merit, except for pure academic theory maybe.
Most security problems are software bugs. The fact that it is very hard to write bug-free software with current tools, technology and methods is one of the main headaches of the security people. I am one. Buggy software and users are what I am most worried about, in this order. False policies, configurations and errors in concepts and methods come way after those.
but I honestly can't make a good argument against VB because I'm not familiar enough with it.
There's your argument right there. If you're not familiar with it, then either you're the wrong guy for the job, or the tool is bad. It's up to you to prove that a different tool would be better.
Ask him for a chance. Take a small, standalone part if it exists and rewrite only that in your favourite language as a proof-of-concept.
The EU has two nuclear nations (France and the UK) and considerable military technology in all fields. True, the standing armies don't compare to the USA, but if you've read "The Rise and Fall of the Great Powers" or any other in-depth book about war and empires, you'll know that it's not what you have today, it's what you can build in a short time - at the start of WW2, Germany had considerably more air- and ground power than even the US. But once the US switched to war production, things changed quickly and so did the battle fortunes.
The bigger issue for most is that OpenGL becomes a "second class citizen" on Vista
Yepp, MS trying to break OpenGL again. You can't say they aren't persistent.
Some end users are upset with Microsoft, as the move effectively forces gamers to buy Vista if they do intend to remain serious about cutting-edge PC gaming.
Oh, really? As if that is a surprise. When's the last time MS did not use every dirty trick in the book in order to force itself into a market or its products unto "customers"?
There's no such thing as "slacking off". Let me explain:
People have a need for rest. Biology, instinct, call it what you will. Your body and mind need rest and they will take it. If you can't get enough rest into your day or sleep into your night, your body and mind will compensate for the loss. Either by what's seen as slacking or if you still don't give in by physical or mental breakdown.
There's no "slacking". Your body and mind are just taking what they need. If you want to eliminate "slacking", you need to make sure everyone gets enough rest. With a rested and motivated workforce, there is no "slacking" problem.
They aren't "held back" by the same morality and environmental issues we are.
We used to be that way, too. Not 100 years in the past, more like 50.
I'm sure the chinese will follow a similar pattern. Sure they will be a huge force in the near future, probably stronger than the US in both economics and military power and very close to the EU (which is still growing in number of participating nations, remember). But even as a strong force, they will start to feel the impact themselves. The dam will be built, but they probably won't build a 2nd one once all the shit hit the fan. Anyone remember the Nile dam? When it was built, it was a marvel of engineering, too. Today it is widely regarded as a bad idea and if it weren't for the fact that Egypt needs the electricity, there would be talks about tearing it down.
When using Microsoft products, how is your data being "locked-in".
By being stored in a format I can not access without paying the MS tax.
You can easily take data from a word or excel document and move it to any format.
No, you can't. You can take the data, but it isn't easy. Yes, OO can open these document - thanks to endless hours of work by Free Software people who disliked the lock-in as much as I do. It's not Word exporting to OO format, remember? The ODF group came up with a Word ODF plugin, not MS. Again, there is a way out of the prison only because Free Software people built one.
Your point was what, exactly?
The only thing you really save on is the cost of licenses, which is small in the overall cost of things.
You must've missed the part where they explained the free in "free market". Hint: It's about me choosing where I spend my money. No choice == no free market.
I have yet to read even one reason why anyone should get Vista. Everything that was somewhat interesting when they were creating buzz around what was called Longhorn back then has since been stripped, leaving what behind? XP SP3, essentially.
Nobody will run games on Vista except for the folks who buy a new machine where it's pre-installed. Since that'll be no earlier than 2008 what exactly is the point of testing an incomplete beta version now?
How long until the last backup goes live on some other server somewhere else?
If anyone really thinks that DRM is or should be outside the FSF's agenda, he should read The Right to Read.
DRM is exactly the kind of things that caused Stallman to launch the FSF in the first place.
Use the best tool for the job, regardless of philosophical ideal.
Bzzzt, wrong.
Governments are based on ideals. Such as democracy, freedom, equality, whatever.
A tool that blatantly violates these should not be used by a government, even if it is the best one. For example, many governments have strict quotes for minimum numbers of disabled employees even though they would probably "function" better without.
Free Software is important because it prevents data lock-in. One of the main reasons for Free Software by governments is that you can't make electronic tax forms mandatory if using the system requires a proprietory software that costs money (such as Windos). It's just not the government's job to force people into the direction of a specific company.
38k may sound like a lot, but more people have died in the same time due to car accidents, smoking or at least a dozen other reasons.
I'm not trying to say 38k additional and unnecessary deaths isn't a bad thing. In fact, I believe Bush should get the electric chair for starting that war based on lies and deceit.
However, in the grand scale, the death count isn't what makes that war so horrible and if you want to compare events, you also need to take into account that something going on for several years will naturally cause more mayhem than something happening once for a day.
Did you actually read that source?
Officials caution that much of the increase, due to be reported publicly next week, stems from a change last year in how terrorist attacks are counted,
(read: The actual increase was a fraction of the reported one)
More than half the deaths from terrorism worldwide last year occurred in Iraq,
(read: If you guys hadn't smashed the country to pieces, most of the shit wouldn't have hit the fan)
If they do not serve the claimed purpose even a small, tiny fraction of a bit then the claimed purpose is most likely not the real purpose.
The point however is that these regulations aren't to prevent terrorists entering the US through an airport, they're to prevent them entering through a skyscraper (think 9/11) so collecting the personal info on the ground after they land is too late.
Reality check:
* All flights used in 9/11 were domestic flights.
* All terrorists involved had entered the USA some time before the event
* Very likely, none of them would have registered as suspicious according to their flight data
And yet our entire country gets bent out of shape just beacuse a few thousand people happened to die in the same incident. Honestly, it isn't that big a problem!
Not on a death-toll scale, really. Then again, on that same scale the Iraq war isn't much of a problem, either.
There are things besides body counting, however, that matter. The Iraq war is wrong for many reasons, and probably criminal enough that Bush should be jailed and get a death sentence. The 9/11 thingy was likewise wrong for many reasons and its impact goes far beyond the few thousand dead people - which, btw., was exactly the purpose.
Fact is, we live in an ever-increasingly dangerous world.
I call bullshit on that. Please, where is your data?
There is no way anyone or any government can protect against everything or everyone.
True. And it isn't their job to do it. Somehow the US citizen tend to extremes - they want no government at all, or they want to sue if they put their hamster in the microwave. Most people in the EU can live with a balance - we don't expect the government to protect us from everything (especially not our own stupidity) but we do expect a certain level of safety and are willing to take the necessary amount of government and bureaucracy that comes with that.
if the mysql people slack off with security, you can drop them in favour of postgres, with practically no interruption and minimal retooling.
Yes, except for the "practically no" part.
I have a wall-sized (40,000 LOC) PHP/mysql application that I've wanted to move to Postgres for years. It's not something you can do in your spare time, even if you do have a thin database abstraction layer (i.e. you don't call mysql_* functions in your code, but db_* functions that mostly pass through and do some error handling).
It's not, of course, because if we standardize on an open document format and a crippling bug is discovered in, say, OpenOffice, there are many other programs that exist or could be written implementing the same functionality.
A bug that allows access to the operating system would almost certainly not be in the document format specifications, but in the individual implementation. Therefore, of the many different programs implementing ODF, for example, only one or at worst a few would be subject to the bug.
The fact is that computers are not biological organisms and "viruses" don't work the same way.
In certain areas, they do and the analogy is quite valid. For example, worm propagation on the Internet very closely resembles biological population growth models.
While computers and biological organisms are indeed very different critters, on the systems level (i.e including their environments) there are many similarities.
If everybody ran Linux and such a vulnerability existed, the same thing would happen.
Maybe, maybe not. Remember that many exploits (such as buffer overflows) are sensitive to the precise binary version you use. The ancient ssh exploits, for example, required different parameters depending on their target (i.e. Debian, Redhat, etc. - often even different for different releases).
So if everyone ran Linux, then most likely there would still be 5+ major distributions in 10+ release versions. Plus a lot of people who had non-matching version (manual install or a newer version from somewhere else).
It wouldn't be quite such mono.
Four days ago, Dan's prediction came true ...for the 200th or so time. Remember Outlook? The corporate mail system monoculture? At home, it might have 20% or so of the market, but it's big with business users.
True, the Word thing is more nifty, because people don't expect it, and it's not a macro virus. But even so, this is hardly the first time MS users get bitten exactly because they are MS users.