But nobody with a Mac or a Linux PC has had to lose a moment of sleep over these outbreaks
Wrong, dead wrong. I use nothing but Linux and OpenBSD and Sobig caused me a lot of headaches:
1) At work, where I'm the residential security guru, I had to kick the windos admins so they go and patch their systems.
2) Also, as an ISP we had a serious bandwidth problem incoming and had to find ways in dealing with it (blaster was worse than sobig, but easier to handle, we just dropped some ports).
3) At home, I was drowning in sobig mails. A regex in postfix took care of that, but it took me half an hour to work that out
4) To this day, I'm getting these bullshit notifications. Whoever has a virus scanner and is still sending out notifications after Klez and Sobig have been using faked from headers for months should be shot for stupidity.
As a matter of fact, my main complaint about the whole virus crap is that even though there's been one virus during the past years that I've been vulnerable to (Slapper), I still get a good part of the damage. If it'd all "stay in the family", I couldn't care less about windos and its inherent virus problem.
I have a website. I publish "Bob is kissing Alice, he probably just wants to inherit her family fortune." Bob demands that I publish his counter-statement and sends it to me. I cut and paste it into a footnote, with a preface "counter-statement by Bob:"
Big deal. Very chilling. I'll make sure to close my website down right away.
If anything, it's more free speech for Bob, not less for me (I can still say whatever I want to say, can't I?).
See my other comment. Yes, the users pay, no I'm not amongst those advocating throtteling of P2P or anything else in that direction.
Nevertheless, from a pure technical POV, P2P wastes bandwidth. As in efficiency. How much bytes traverse the wire to download 100 MB via FTP? via HTTP? via scp? Compare that to P2P. Add the traffic for searches. Add 50% overhead because half of your downloads never complete or have to be restarted half-way through.
That's what I mean with "waste". Most large ISPs don't pay for bandwidth by the byte anyways, they peer. But if the total demand goes up, you have to widen the pipes, and that's expensive.
The main theme of the article is a complaint about how much file sharing is costing the ISP.
Sorry? You sell a service (internet connectivity). People want that service, or else they wouldn't be buying it. Then you turn around and complain that it costs you money to provide said service? Now that is an idea. Let's open a store and complain that shipping all those goods in from the warehouse is so expensive.
Linuxtag is a trade fair, but Linuxtag e.V., the legal body behind the fair, is an "eingetragener Verein", which is essentially german for tax-exempt non-profit organisation.
All german "e.V."s have a "common good" purpose in their charta. That of Linuxtag e.V. almost certainly reads something like "to advance Linux in the business world". Certainly, stopping harm against the community falls flat within that purpose.
Also, german Wettbewerbsrecht (law about fair competition) allows almost everyone to bring a lawsuit against someone violating it. This was done to make sure that consumers, even would-be consumers (e.g. I'd love to buy that X, but company Y has driven them out of business using unfair means, so I'm not a customer of either, legally) have a standing.
I know Till (the lawyer here) in person. He's a good guy, and he certainly knows what he's doing.
I am a security officer with an ISP and telecom company, here's how I got there: Real-life work experience.
Unless you are already a proficient hacker and have published a couple of advisories, don't try to get started in network security. Start as a sysadmin. Get some experience on how the system works. When you can run a system (and believe me, if you want to tell admins what to do or not to do, you must be on their level or they'll laugh you out the door), start to concentrate on the security aspects. Dig deeper into the host-based firewall, install an IDS or tripwire, that stuff.
Move up, step by step. There are already way too many people with a solid half-true partial knowledge of the field in the security business. Lay a solid foundation. If you don't know how to operate a server or a network, you have no business securing it.
Very obviously, the first thing you should do is read the company security policy and find out whether your find conflicts with it. If it does, shut up or give an anonymous hint to the police.
I've written a security policy for a company. Data privacy and data security do sometimes conflict, and if the company doesn't have that problem sorted out in a written document, urge it to do so.
Surely there are adacemic researchers out there probing the frontier of human-computer interaction that could use Linux as the basis for their work? Could it be that X is slowing us down somehow?
No, it's not X. I've done some HCI work, including some very early contributions to Gnome. It is almost never the technology that slows you down in this area, it's almost always people's mindset.
One thing that's been really damaging Linux in this regard is the load of people who believe that Linux absolutely has to copy windows. Very obviously, innovation and copycat behaviour don't work well together.
No. Stupid people should not be allowed to use cars.
I couldn't agree more. Except of course, that you have confused understanding of a cars handling with understanding of its working.
I damn sure don't want people who don't know how to handle a car on the road. Likewise, people who don't know how to handle a computer don't belong on the Internet. In both cases, the stupid are a danger to everyone else.
To which I respond, where do you keep your Mozilla plugins?
The important question is: Does it matter?
If my system is smart enough to find the stuff (or help me put it in the right place), what do I care? For example, I almost never visit the/usr/lib tree anyways, since it's all system stuff. The daemons could be holding in orgy in/usr/lib/whatever and I'd never know.
How much difference does it make to you whether gcc is in/usr/bin or/Programs/gcc/3.0 ? You just type "gcc" anyways and let the shell find it for you via the PATH.
(to answer your question: ~/.mozilla/plugins, of course.)
Microsoft tried that approach, and we all know what a total mess any and all windows systems are after a few months and a couple installations and removals of software.
And if they had put some thought into this instead of playing "look ma', I can rename files (and break pretty much every./configure and Makefile install)", they would've worked with links and retained compatability. Or better yet, left the filesystem alone and added an abstraction layer on top of it.
There's a ton of not-yet-very-much-implemented innovations in the filesystem area, from document-oriented approaches to database-like systems (instead of the hierarchical ones we use currently).
Please turn on your brains. The RIAA is not stupid. Quite to the contrary, they have a bunch of very smart people. The game isn't cyberwarfare. The game is psychological warfare. Most of/. may call them crazy over such ideas, but somewhere out there a 12 year old has been scared away from copying music (legal or illegal, doesn't matter, neither for the boy nor for the RIAA). A few homes further down the street, a mother is frightened, and tells her son to remove that gnutella program again, and never use that again or he'll be grounded.
You don't have to actually write or use these programs. Making enough people believe that you do has almost the same effect, with none of the legal dangers or possible repercussions.
Wake up, people. These guys have been at the game for a while longer than any of us have. They aren't playing our game, they're playing their own game. They're not writing code, they're writing press releases, strategy papers, and while they're at it, the next copyright laws.
I like that this guy is looking for a _technical_ solution to the spam problem. Too many legal solutions have been proposed. While I'm the first to say spammers should be fined $100 plus one 0 tacked to the end for each repetition, the very real problems of identifying and dragging them to court remain.
The bad is that it won't work. Allegedly modern companies still use Microsoft Word 97 - if that ain't the pinnacle of cluelessness, I don't know what is. Same companies will use SMTP on their exchange servers in 2020, even if we start using a better system _today_.
Some other poster hit the nail right on the head: Not enough mailboxes are protected. Especially not mailboxes of idiots. The spammer business model works on the 0.01% of total retards their scattershot approach hits. I think they couldn't care less if the clueful 5% of the internet population use spamfilters, they aren't the target anyway. AOL using good spamfilters does more damage to spammers than all of RBL, Orbs, Spamassassin and Razor together. Because, on a rough estimate, AOL users are 97.462% more likely to fall for a scam^H^H^Hpam than someone who knows about Spamassassin.
Tarpits seem to be the most effective attack, IMHO. If I can keep the spambot occupied for 1 min instead of 0.1 sec, and even 1% of the net population does that, his "cost" for sending spam will increase by about 700% (for 1 mio mails, from 27 hours to 194 hours).
Got a split opinion about that. For one, everything in the docs seems pretty solid. They have a concept more advanced than "let's copy outlook" and seem to know what they're doing. This might go far.
On the other hand, I ask myself why everyone and his dog is copying outlook/exchange? I'm forced to use outlook at work, and frankly, it sucks. The calender is about the only thing remotely useable, and even it has many serious shortcomings.
It can't be that difficult to write something better, can it? I mean, NOTES had features 5 years ago that are still missing from outlook today.
I'd be my marbles on a project that tries to put outlook to shame over one that tries to merely copy it any day.
Does it strike anyone else as odd that all "anti-piracy" technology essentially boils down to reducing the quality of the movie/music or, in the case of data, introducing errors on purpose?
"Imperceptible" is a very strong word. Our senses and brains still surprise us with their capabilities. Other "imperceptible" flickers are known to introduce anything from motion sickness to seizures.
High time for a "Not Degraded / No Copy-Protection" campaign. I know I would look for a sticker like that if it were around.
Until someone actually writes a massivily spreading virus/worm that jumps from Windows PC to Windows PC doing precisely that (formatting hard drives)
Did you just volunteer? In fact, all you need to do is modify any of the existing virus codes. Most of them already work by running an arbitrary command.
Your most difficult decision would be WHEN to go into "kill myself" mode. If it takes too long, many machine will have been shut down before. If it doesn't take long enough, your infection rate drops below the critical mass level.
Unfortunately, as soon as lawyers get involved, there are no "simple answers" anymore.
Wanna bet that any 2 lawyers can have a 3-hour discussion about whether or not posting someones address is a violation of privacy, a public record, both or neither?
If Debian were to receive a couple million dollars from Bill Gates, there'd be 500 posts here within the first 15 minutes with much more than "uncomfortable" feelings.
He's worried, and some of the postings here already explain pretty well why, namely those that ask if he's selling out, going commercial, etc.
Slashdot Mirror
not enter - reenter.
But nobody with a Mac or a Linux PC has had to lose a moment of sleep over these outbreaks
Wrong, dead wrong. I use nothing but Linux and OpenBSD and Sobig caused me a lot of headaches:
1) At work, where I'm the residential security guru, I had to kick the windos admins so they go and patch their systems.
2) Also, as an ISP we had a serious bandwidth problem incoming and had to find ways in dealing with it (blaster was worse than sobig, but easier to handle, we just dropped some ports).
3) At home, I was drowning in sobig mails. A regex in postfix took care of that, but it took me half an hour to work that out
4) To this day, I'm getting these bullshit notifications. Whoever has a virus scanner and is still sending out notifications after Klez and Sobig have been using faked from headers for months should be shot for stupidity.
As a matter of fact, my main complaint about the whole virus crap is that even though there's been one virus during the past years that I've been vulnerable to (Slapper), I still get a good part of the damage.
If it'd all "stay in the family", I couldn't care less about windos and its inherent virus problem.
I have a website.
I publish "Bob is kissing Alice, he probably just wants to inherit her family fortune."
Bob demands that I publish his counter-statement and sends it to me.
I cut and paste it into a footnote, with a preface "counter-statement by Bob:"
Big deal. Very chilling. I'll make sure to close my website down right away.
If anything, it's more free speech for Bob, not less for me (I can still say whatever I want to say, can't I?).
See my other comment. Yes, the users pay, no I'm not amongst those advocating throtteling of P2P or anything else in that direction.
Nevertheless, from a pure technical POV, P2P wastes bandwidth. As in efficiency. How much bytes traverse the wire to download 100 MB via FTP? via HTTP? via scp? Compare that to P2P. Add the traffic for searches. Add 50% overhead because half of your downloads never complete or have to be restarted half-way through.
That's what I mean with "waste". Most large ISPs don't pay for bandwidth by the byte anyways, they peer. But if the total demand goes up, you have to widen the pipes, and that's expensive.
Seriously, whatever he's smoking, I want some.
The main theme of the article is a complaint about how much file sharing is costing the ISP.
Sorry? You sell a service (internet connectivity). People want that service, or else they wouldn't be buying it. Then you turn around and complain that it costs you money to provide said service?
Now that is an idea. Let's open a store and complain that shipping all those goods in from the warehouse is so expensive.
It's a fact. I work for an ISP. 60% is a conservative figure, we've seen more than that at times.
Thing is: P2P wastes tons of bandwidth. The continuous searches, all the broken or incomplete downloads, not even to speak of the overhead.
*bzzt*, wrong.
Linuxtag is a trade fair, but Linuxtag e.V., the legal body behind the fair, is an "eingetragener Verein", which is essentially german for tax-exempt non-profit organisation.
All german "e.V."s have a "common good" purpose in their charta. That of Linuxtag e.V. almost certainly reads something like "to advance Linux in the business world". Certainly, stopping harm against the community falls flat within that purpose.
Also, german Wettbewerbsrecht (law about fair competition) allows almost everyone to bring a lawsuit against someone violating it. This was done to make sure that consumers, even would-be consumers (e.g. I'd love to buy that X, but company Y has driven them out of business using unfair means, so I'm not a customer of either, legally) have a standing.
I know Till (the lawyer here) in person. He's a good guy, and he certainly knows what he's doing.
I am a security officer with an ISP and telecom company, here's how I got there: Real-life work experience.
Unless you are already a proficient hacker and have published a couple of advisories, don't try to get started in network security. Start as a sysadmin. Get some experience on how the system works.
When you can run a system (and believe me, if you want to tell admins what to do or not to do, you must be on their level or they'll laugh you out the door), start to concentrate on the security aspects. Dig deeper into the host-based firewall, install an IDS or tripwire, that stuff.
Move up, step by step. There are already way too many people with a solid half-true partial knowledge of the field in the security business. Lay a solid foundation. If you don't know how to operate a server or a network, you have no business securing it.
IOF#CC just doesn't have the right ring to it. I'll stick with C. :)
Has someone in Redmond realized they might have stolen the wrong parts from the Linux code? ;)
Very obviously, the first thing you should do is read the company security policy and find out whether your find conflicts with it. If it does, shut up or give an anonymous hint to the police.
I've written a security policy for a company. Data privacy and data security do sometimes conflict, and if the company doesn't have that problem sorted out in a written document, urge it to do so.
Surely there are adacemic researchers out there probing the frontier of human-computer interaction that could use Linux as the basis for their work? Could it be that X is slowing us down somehow?
No, it's not X. I've done some HCI work, including some very early contributions to Gnome. It is almost never the technology that slows you down in this area, it's almost always people's mindset.
One thing that's been really damaging Linux in this regard is the load of people who believe that Linux absolutely has to copy windows. Very obviously, innovation and copycat behaviour don't work well together.
Hardware is cheaper.
You're good, but that one gave you away.
No. Stupid people should not be allowed to use cars.
I couldn't agree more. Except of course, that you have confused understanding of a cars handling with understanding of its working.
I damn sure don't want people who don't know how to handle a car on the road. Likewise, people who don't know how to handle a computer don't belong on the Internet. In both cases, the stupid are a danger to everyone else.
When the sh*t hits the fan, I need to be able to log in - as root. The last thing I need is root's home dir inaccessible.
My thoughts exactly when I read that.
Not broke ? Don't fix.
More importantly: Don't break.
To which I respond, where do you keep your Mozilla plugins?
/usr/lib tree anyways, since it's all system stuff. The daemons could be holding in orgy in /usr/lib/whatever and I'd never know.
/usr/bin or /Programs/gcc/3.0 ? You just type "gcc" anyways and let the shell find it for you via the PATH.
The important question is: Does it matter?
If my system is smart enough to find the stuff (or help me put it in the right place), what do I care? For example, I almost never visit the
How much difference does it make to you whether gcc is in
(to answer your question: ~/.mozilla/plugins, of course.)
Microsoft tried that approach, and we all know what a total mess any and all windows systems are after a few months and a couple installations and removals of software.
./configure and Makefile install)", they would've worked with links and retained compatability. Or better yet, left the filesystem alone and added an abstraction layer on top of it.
And if they had put some thought into this instead of playing "look ma', I can rename files (and break pretty much every
There's a ton of not-yet-very-much-implemented innovations in the filesystem area, from document-oriented approaches to database-like systems (instead of the hierarchical ones we use currently).
Actually, had you read the article:
Please turn on your brains. The RIAA is not stupid. Quite to the contrary, they have a bunch of very smart people. /. may call them crazy over such ideas, but somewhere out there a 12 year old has been scared away from copying music (legal or illegal, doesn't matter, neither for the boy nor for the RIAA).
The game isn't cyberwarfare. The game is psychological warfare. Most of
A few homes further down the street, a mother is frightened, and tells her son to remove that gnutella program again, and never use that again or he'll be grounded.
You don't have to actually write or use these programs. Making enough people believe that you do has almost the same effect, with none of the legal dangers or possible repercussions.
Wake up, people. These guys have been at the game for a while longer than any of us have. They aren't playing our game, they're playing their own game. They're not writing code, they're writing press releases, strategy papers, and while they're at it, the next copyright laws.
I like that this guy is looking for a _technical_ solution to the spam problem. Too many legal solutions have been proposed. While I'm the first to say spammers should be fined $100 plus one 0 tacked to the end for each repetition, the very real problems of identifying and dragging them to court remain.
The bad is that it won't work. Allegedly modern companies still use Microsoft Word 97 - if that ain't the pinnacle of cluelessness, I don't know what is. Same companies will use SMTP on their exchange servers in 2020, even if we start using a better system _today_.
Some other poster hit the nail right on the head: Not enough mailboxes are protected. Especially not mailboxes of idiots. The spammer business model works on the 0.01% of total retards their scattershot approach hits. I think they couldn't care less if the clueful 5% of the internet population use spamfilters, they aren't the target anyway.
AOL using good spamfilters does more damage to spammers than all of RBL, Orbs, Spamassassin and Razor together. Because, on a rough estimate, AOL users are 97.462% more likely to fall for a scam^H^H^Hpam than someone who knows about Spamassassin.
Tarpits seem to be the most effective attack, IMHO. If I can keep the spambot occupied for 1 min instead of 0.1 sec, and even 1% of the net population does that, his "cost" for sending spam will increase by about 700% (for 1 mio mails, from 27 hours to 194 hours).
Got a split opinion about that. For one, everything in the docs seems pretty solid. They have a concept more advanced than "let's copy outlook" and seem to know what they're doing. This might go far.
On the other hand, I ask myself why everyone and his dog is copying outlook/exchange? I'm forced to use outlook at work, and frankly, it sucks. The calender is about the only thing remotely useable, and even it has many serious shortcomings.
It can't be that difficult to write something better, can it? I mean, NOTES had features 5 years ago that are still missing from outlook today.
I'd be my marbles on a project that tries to put outlook to shame over one that tries to merely copy it any day.
Does it strike anyone else as odd that all "anti-piracy" technology essentially boils down to reducing the quality of the movie/music or, in the case of data, introducing errors on purpose?
"Imperceptible" is a very strong word. Our senses and brains still surprise us with their capabilities. Other "imperceptible" flickers are known to introduce anything from motion sickness to seizures.
High time for a "Not Degraded / No Copy-Protection" campaign. I know I would look for a sticker like that if it were around.
Until someone actually writes a massivily spreading virus/worm that jumps from Windows PC to Windows PC doing precisely that (formatting hard drives)
Did you just volunteer? In fact, all you need to do is modify any of the existing virus codes. Most of them already work by running an arbitrary command.
Your most difficult decision would be WHEN to go into "kill myself" mode. If it takes too long, many machine will have been shut down before. If it doesn't take long enough, your infection rate drops below the critical mass level.
Unfortunately, as soon as lawyers get involved, there are no "simple answers" anymore.
Wanna bet that any 2 lawyers can have a 3-hour discussion about whether or not posting someones address is a violation of privacy, a public record, both or neither?
If Debian were to receive a couple million dollars from Bill Gates, there'd be 500 posts here within the first 15 minutes with much more than "uncomfortable" feelings.
He's worried, and some of the postings here already explain pretty well why, namely those that ask if he's selling out, going commercial, etc.