Well yeah, but the article is big on 'It's quick and easy to learn!' - my point was that if it's quick and easy, a few days is plenty of time to decide if you wanna move to Dvorak full time
Look at this page, third row, second panel. The article claims that with 52 hours of training, you can be back to your QWERTY typing speeds.
Now, given that claim, you'd expect to be at least slightly proficient after a few days - enough so you'd 'have the hang of it'. A 'few days' seems perfectly reasonable.
We're just asking which pci registers to poke to get the chip to go "bleep".
DOS emulates the 'bleep' in software with it's superior 'beep' method, called with something like: MOV DL 7 MOV AH 2 INT 21
And it has the advantage that you don't need to know anything about these nebulous 'pci registers' of which you speak. Silly hardware programmers always trying to reinvent the wheel.
"We have a sound system that works most (but not all) of the time if you are lucky."
How is this different from OSX or Windows?
Are you kidding?
In Windows, install the drivers for your sound card, reboot and sound works in every app, at the same time if you so wish.
In Linux, alsa has made great strides, but still doesn't support a lot of cards out there and a lot of the supported cards have trouble mixing audio from more then one app. In fact, the whole reason jwz is now using OSX, the whole point of this article, is that the sound system in Linux sucks hard.
...the attack is not a general way to forge an MD5-signed document...
True, but it has enough application to be a little worried. Imagine a company using a contractor to do some renovations, the company sends the contractor an electronic document (a.doc for arguments sake, widely accepted and contains a level of indeciferable junk) with a set of requirements, which the contractor digitally signs. A month later, when the work is finished and the contractor asks for payment - the company whips out a different document, with completely different requirements, that appears completely legitimate and matches the contractor's digital signature. The company claims the work wasn't done correctly, and uses it as an excuse to not pay.
This sort of scenario would make it very, very difficult for either side to prove their case. It is also a general enough case that it has significant real-world applications - it can effectively turn any digital contract into a "he-said, she-said" argument.
Thats why I write all my term papers in binary as Postscript files. My keyboard is a simple rocker switch, left for 1, right for 0. You crazy kids and your ASCII!
Minimalist my ass. Real men use a strong magnet and a floppy disk.
vi wouldn't be caught dead with the likes of emacs...
We all know the real story - emacs was trying to ditch vi that whole party, while he droned on and on about simplicity and speed until emacs slapped him with a spare email client he had lying around.
Yep, our nation has some serious problems right now, but we haven't (yet?) even come close to this kind of garbage.
It seems strange to justify your nation's problems by simply pointing and saying, "Well we're not there yet". Drink a cup of urine, then see if your reaction is 'Yep, I drank some urine, but I didn't come close to drinking HCl'.
It appears that if you have the Tabbrowser Preferences extension installed, then this exploit doesn't work.
I got it to work, as long as you make sure you open the exploitable page in a new window and not a new tab. I don't think the extension has anything to do with it.
I'm not sure where these 100hp ricers you're speaking of reside, but most of the ricers in SE Asia are going around with anything from 125 - 300bhp.
Well, then they don't reside in SE Asia. The two, far and away, most popular vehicles on the road here among the ricer crowd are the Lancer (non-Evo), the Civic and the Celica (mid 90s models). That'd be 80-120hp (depending on model), 115hp and 110hp respectively.
In fact, it's perfectly possible to get drunk at night, feel fine in the morning and still be over the legal driving limit (at least in the UK, YMMV of course).
With the new(ish) regulations for 'novice' drivers in Australia, it's possible to get drunk one night and not be able to drive for almost 36 hours, thanks to very sensitive breathalyzers that detect cough syrup up to 12 hours after you take it.
Information here - In Australia, if you're convicted of 'certain major alcohol-related offences' the court can elect to allow you a shorter period of disqualification if you agree to have the device installed.
There are a few instances where Java will overtake C, they're specfic though, not general case. For example, if the application is large, doesn't draw much of a GUI, does a lot of easily optimised calculations (like matrices) and is allowed a reasonable running time, Java can be faster.
Largely though, this is because C programs are usually compiled for i386 and not for a processor with something like SSE - the JIT compiler, written correctly, should be able to use the advanced processor features without the programmer knowing about them.
Also, Java GUIs are clunky. They take a long time to redraw, a long time to react, etc. when compared to GUIs that use native widgets.
And finally, the program has to be large enough so that the memory and CPU time used by the JVM isn't significant. I have done benchmarks (for a uni assignment) that show this, and it's fairly easy to check - write a console app to sum two large matrices. Java will come out ahead, but only barely (my results were in the order of seconds per hour).
Also, keep in mind in the above prime number test that the 0m7.809s for the java version included the time for the JVM to initialise. In a real world situation, this would just add to the app loading time by a few seconds and not have a lot of bearing on the actual calculation speed.
Hrm, there is that. IIRC though, the Audi 90 acheives around 170hp, and assuming that most ricers are at around 100hp, that would mean that the aftermarket turbo adds 100 or so horsepower - which is an awful lot.
You drive a 5 cylinder car? That acheives 150-180 HP *more* then some other car?
150-180hp is a fair car in itself. Around the best of the top-of-the-line (non-turbo) 4 cylinder cars, and about in the middle of 6 cylinder performance.
...but could one obfuscate so efficiently a source code, to hide a trojan inside it?
Yes - the trick would be to keep it hidden for long enough to do whatever it's meant to before discovery. I would think that this rules out the most active packages, so that would leave us with obscure packages or quick 'emergency' patches. The point being that I think it'd become less of an issue where it is in the source and more of an issue of which package you choose to attack.
So if you know your intended victim uses a specific non-mainstream media player, you could put it there in the hope that the package is obscure enough and that maybe because it's a 'toy' it doesn't get the same level of scrutiny as other, more active packages.
Or, if you know more or less what you're after and so require only the briefest glimpse, sneak it into an emergency security update or similar in the hope that the 'emergency' nature of the patch means it doesn't get looked at til later.
Basically, I would think that given that the source is out there, you should just assume you'll be found out and so you should hide your malicious code someplace that will push back the date it's found.
But that doesn't prove anything. If 10% of 100 people puts LittleCountryA at the top of the list, but BiggerCountryB has 1% of 1000 and is at the bottom of the list - then out of the total population, 20 machines of 1100 people or not even 2% are infected.
So, the argument that most european countries beat out the US in the per capita ranking does not support the argument that those same european countries, taken as part of a whole will beat the US per capita. That's not to say that it proves it won't, but your data isn't relevant to your conclusion.
The rankings are per capita, which means they're adjusted for population.
From the article: "Overall, Europe has the most zombie infested networks ranking over the United States. Hong Kong is the most infested network per capita."
So the 'Europe has more' figure is explicitly not adjusted for population.
The point is that Mozilla is simply adding a few new functions. They've also documented the functions and released them in such a way that copying them exactly woul take no real effort. Hell, you can add the same functionality to your pages, in a completely cross platform manner by including:
Array.prototype.forEach = function(fn) {
for(var i =0; i this.length; ++i) {
fn(this[i], i, this);
} }
function foo(obj, index, array) {
alert("index " + index + " is " + obj); }
[4,5,6].forEach(foo);
... in your javascript, for example. (thanks to neil.pearce)
These new functions, I would think, are for the writers of extentions and themes, not really for HTML authors. But, regardless, the changes are a far cry from MS's closed additions to Java that broke code written for Sun's standard JVM. These changes to Mozilla are more akin to a new header file included with GCC or such - where if you want to use the same thing with a different tool, just copy/paste.
Funny... that exact same argument didn't work for Microsoft with their extensions to Java... why should we let Mozilla get away with it?
If you don't want to use the new functions, don't. A bit of javascript that renders in IE doesn't magically not work in Mozilla because of these new functions. Effectively, they're adding a few new functions to their standard implementation - they're not changing the way pre-existing functions work (like MS did with Java).
There are more then a few origins of the word floating around. And given that I first heard it on IRC at least 10 years ago, I doubt Microsoft's explaination is correct.
They always did it, for a random number of links every few queries or so. It's so they can collect data on which sites people thought were relevant to their query. These links seem to have become more and more common though.
Slashdot Mirror
Well yeah, but the article is big on 'It's quick and easy to learn!' - my point was that if it's quick and easy, a few days is plenty of time to decide if you wanna move to Dvorak full time
Look at this page, third row, second panel. The article claims that with 52 hours of training, you can be back to your QWERTY typing speeds.
Now, given that claim, you'd expect to be at least slightly proficient after a few days - enough so you'd 'have the hang of it'. A 'few days' seems perfectly reasonable.
We're just asking which pci registers to poke to get the chip to go "bleep".
DOS emulates the 'bleep' in software with it's superior 'beep' method, called with something like:
MOV DL 7
MOV AH 2
INT 21
And it has the advantage that you don't need to know anything about these nebulous 'pci registers' of which you speak. Silly hardware programmers always trying to reinvent the wheel.
"We have a sound system that works most (but not all) of the time if you are lucky."
How is this different from OSX or Windows?
Are you kidding?
In Windows, install the drivers for your sound card, reboot and sound works in every app, at the same time if you so wish.
In Linux, alsa has made great strides, but still doesn't support a lot of cards out there and a lot of the supported cards have trouble mixing audio from more then one app. In fact, the whole reason jwz is now using OSX, the whole point of this article, is that the sound system in Linux sucks hard.
True, but it has enough application to be a little worried. Imagine a company using a contractor to do some renovations, the company sends the contractor an electronic document (a .doc for arguments sake, widely accepted and contains a level of indeciferable junk) with a set of requirements, which the contractor digitally signs. A month later, when the work is finished and the contractor asks for payment - the company whips out a different document, with completely different requirements, that appears completely legitimate and matches the contractor's digital signature. The company claims the work wasn't done correctly, and uses it as an excuse to not pay.
This sort of scenario would make it very, very difficult for either side to prove their case. It is also a general enough case that it has significant real-world applications - it can effectively turn any digital contract into a "he-said, she-said" argument.
Thats why I write all my term papers in binary as Postscript files. My keyboard is a simple rocker switch, left for 1, right for 0. You crazy kids and your ASCII!
Minimalist my ass. Real men use a strong magnet and a floppy disk.
QBASIC to the rescue!
SCREEN 12
CLS
CIRCLE (320, 240), 50, 15
(I'd guess there are languages out there that'd do the above all on one line, but I can't think of any off the top of my head.)
And I'd bet it's much closer to a real circle then anything you'd draw with a mouse.
vi wouldn't be caught dead with the likes of emacs...
We all know the real story - emacs was trying to ditch vi that whole party, while he droned on and on about simplicity and speed until emacs slapped him with a spare email client he had lying around.
Yep, our nation has some serious problems right now, but we haven't (yet?) even come close to this kind of garbage.
It seems strange to justify your nation's problems by simply pointing and saying, "Well we're not there yet". Drink a cup of urine, then see if your reaction is 'Yep, I drank some urine, but I didn't come close to drinking HCl'.
It appears that if you have the Tabbrowser Preferences extension installed, then this exploit doesn't work.
I got it to work, as long as you make sure you open the exploitable page in a new window and not a new tab. I don't think the extension has anything to do with it.
I'm not sure where these 100hp ricers you're speaking of reside, but most of the ricers in SE Asia are going around with anything from 125 - 300bhp.
Well, then they don't reside in SE Asia. The two, far and away, most popular vehicles on the road here among the ricer crowd are the Lancer (non-Evo), the Civic and the Celica (mid 90s models). That'd be 80-120hp (depending on model), 115hp and 110hp respectively.
In fact, it's perfectly possible to get drunk at night, feel fine in the morning and still be over the legal driving limit (at least in the UK, YMMV of course).
With the new(ish) regulations for 'novice' drivers in Australia, it's possible to get drunk one night and not be able to drive for almost 36 hours, thanks to very sensitive breathalyzers that detect cough syrup up to 12 hours after you take it.
Information here - In Australia, if you're convicted of 'certain major alcohol-related offences' the court can elect to allow you a shorter period of disqualification if you agree to have the device installed.
There are a few instances where Java will overtake C, they're specfic though, not general case. For example, if the application is large, doesn't draw much of a GUI, does a lot of easily optimised calculations (like matrices) and is allowed a reasonable running time, Java can be faster.
Largely though, this is because C programs are usually compiled for i386 and not for a processor with something like SSE - the JIT compiler, written correctly, should be able to use the advanced processor features without the programmer knowing about them.
Also, Java GUIs are clunky. They take a long time to redraw, a long time to react, etc. when compared to GUIs that use native widgets.
And finally, the program has to be large enough so that the memory and CPU time used by the JVM isn't significant. I have done benchmarks (for a uni assignment) that show this, and it's fairly easy to check - write a console app to sum two large matrices. Java will come out ahead, but only barely (my results were in the order of seconds per hour).
Also, keep in mind in the above prime number test that the 0m7.809s for the java version included the time for the JVM to initialise. In a real world situation, this would just add to the app loading time by a few seconds and not have a lot of bearing on the actual calculation speed.
I realy shouldv'e added 'And you call this car a sleeper?' to the end of my first post.
Hrm, there is that. IIRC though, the Audi 90 acheives around 170hp, and assuming that most ricers are at around 100hp, that would mean that the aftermarket turbo adds 100 or so horsepower - which is an awful lot.
You drive a 5 cylinder car? That acheives 150-180 HP *more* then some other car?
150-180hp is a fair car in itself. Around the best of the top-of-the-line (non-turbo) 4 cylinder cars, and about in the middle of 6 cylinder performance.
Yes - the trick would be to keep it hidden for long enough to do whatever it's meant to before discovery. I would think that this rules out the most active packages, so that would leave us with obscure packages or quick 'emergency' patches. The point being that I think it'd become less of an issue where it is in the source and more of an issue of which package you choose to attack.
So if you know your intended victim uses a specific non-mainstream media player, you could put it there in the hope that the package is obscure enough and that maybe because it's a 'toy' it doesn't get the same level of scrutiny as other, more active packages.
Or, if you know more or less what you're after and so require only the briefest glimpse, sneak it into an emergency security update or similar in the hope that the 'emergency' nature of the patch means it doesn't get looked at til later.
Basically, I would think that given that the source is out there, you should just assume you'll be found out and so you should hide your malicious code someplace that will push back the date it's found.
But that doesn't prove anything. If 10% of 100 people puts LittleCountryA at the top of the list, but BiggerCountryB has 1% of 1000 and is at the bottom of the list - then out of the total population, 20 machines of 1100 people or not even 2% are infected.
So, the argument that most european countries beat out the US in the per capita ranking does not support the argument that those same european countries, taken as part of a whole will beat the US per capita. That's not to say that it proves it won't, but your data isn't relevant to your conclusion.
The rankings are per capita, which means they're adjusted for population.
From the article: "Overall, Europe has the most zombie infested networks ranking over the United States. Hong Kong is the most infested network per capita."
So the 'Europe has more' figure is explicitly not adjusted for population.
The point is that Mozilla is simply adding a few new functions. They've also documented the functions and released them in such a way that copying them exactly woul take no real effort. Hell, you can add the same functionality to your pages, in a completely cross platform manner by including:
Array.prototype.forEach = function(fn) {
for(var i =0; i this.length; ++i) {
fn(this[i], i, this);
}
}
function foo(obj, index, array) {
alert("index " + index + " is " + obj);
}
[4,5,6].forEach(foo);
... in your javascript, for example. (thanks to neil.pearce)
These new functions, I would think, are for the writers of extentions and themes, not really for HTML authors. But, regardless, the changes are a far cry from MS's closed additions to Java that broke code written for Sun's standard JVM. These changes to Mozilla are more akin to a new header file included with GCC or such - where if you want to use the same thing with a different tool, just copy/paste.
Funny... that exact same argument didn't work for Microsoft with their extensions to Java... why should we let Mozilla get away with it?
If you don't want to use the new functions, don't. A bit of javascript that renders in IE doesn't magically not work in Mozilla because of these new functions. Effectively, they're adding a few new functions to their standard implementation - they're not changing the way pre-existing functions work (like MS did with Java).
There are more then a few origins of the word floating around. And given that I first heard it on IRC at least 10 years ago, I doubt Microsoft's explaination is correct.
They always did it, for a random number of links every few queries or so. It's so they can collect data on which sites people thought were relevant to their query. These links seem to have become more and more common though.
Mozilla (I don't like firefox!) has the exact same behavior
Is it just me, or is this snippet the most pointless attempt at a flame ever to be modded insightful?