Slashdot Mirror


User: Dalroth

Dalroth's activity in the archive.

Stories
0
Comments
362
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 362

  1. Re:NFS? on New Two-Headed Hard Drive Intended To Secure Web Sites · · Score: 1
    ...but since 99% of sites are dynamic it seems to be an impossibility anyway...

    Most of the dynamic content is coming (or really should be) from your database. All the ASP/PHP/JSP files should be quite static once compiled (and I know you can precompile JSP on at least some Java app servers).

    So, imho this tool is still applicable.

  2. Re:Huh? on New Two-Headed Hard Drive Intended To Secure Web Sites · · Score: 2

    At my previous employer we had a machine running nothing but syslogd (it was an old 386 machine no less!). All our other servers broadcasted their log entries to the syslog server. It ran NOTHING else, and in fact, if you wanted to connect to it you had to physically walk over to the machine and login at the console.

    Without a syslog exploit, that machine is near impossible to break into and a great way to protect your log files. Personally I think any company doing any serious linux server work should be doing something similar! ;)

    Bryan

  3. Re:Nasty thing to do to buffer cache on New Two-Headed Hard Drive Intended To Secure Web Sites · · Score: 1, Troll
    The OS assumes that it, and it alone, modifies the disk, and that the disk won't change state without the OS making that change. This is one of the reasons you don't want to allow raw disk access from a VMWare or DOSemu session to a mounted file system - the emulated OS will access the disk, and the host OS's file system won't know about it. Boom! Instant corrupted file system.

    There is this concept called drivers. It's the kind of thing that allows Windows 2000 to read, you know, FAT, FAT32, and NTFS file systems.

    The same goes for, oh I don't know... Linux? We know how many file systems Linx supports, don't we?

    Oh, and god forbid, what about NFS and Samba? Are the machines that host the NFS/Samba shares NOT allowed to change the contents of those systems?

    Or what about, I don't know, a USB drive on your digital camera or MP3 player?

    I'm not trying to be an asshole, but my point is this happens all the time and it's rather easy with the proper drivers installed.

  4. Re:Protection from defacement only, and then iffy. on New Two-Headed Hard Drive Intended To Secure Web Sites · · Score: 3, Interesting
    However, it won't do anything about denial of service attacks, since the server software and its modules/plugins are all in RAM, and will still be receiving inputs.

    That's a nice point, however, I don't think this should have any impact on your decision wether to use this product/strategy or not.

    DOS attacks are a problem that are near impossible to solve no matter what hardware you may have (even your 10's of thousands of dollars worth of Cisco routers). This product isn't targetted at DOS attacks.

    Buffer overflows and whatnot are still possible.

    BUT BUT BUT! They are FAR less effective. One of the problems with overflows are that they give you access to the machine. The danger is when they can login to the machine, install all their hacking tools, packet sniffers, and what not. That's where the real damage is done.

    Now, if the ENTIRE hard disk on the web server is read only, and the machine that they use to make changes to the partition is on a complete seperate network (perhaps not even connected to the internet at all) this could be a VERY effective way of limiting damage done (especially if you are carefull about what applications are installed on your server to begin with).

    Database attacks would be the worst, though, since, as Timothy again points out, they must be writeable.

    Finally, this is not necessarilly true as well. If you run a website that provides the user with realtime information (such as stock quotes, or mortgage rates), most of the data is coming from some source internal to your company. You can easily make that database readonly for the web server, and seperate any minimal user info database into it's own read/write database thus further limiting the damage they can do. In fact, if you aren't doing this already you're probably doing something wrong. Here at work we have two seperate copies of our database (replicated in realtime). One is linked directly to our internal accounting system and updated frequently. The other is 100% read only and ALL reports are run from that.

    I'm not nitpicking you, or anybody in particular. This is a GREAT option. It's not perfect yes, but if you really think about it, you can use this thing in many very very powerfull ways (and as mentioned above you can do some similar things by tweaking IDE cables and useing CD roms). Same thing can be said for Linux router distributions running off of read only 3¼ floppies or CD-Roms! :)

    Bryan

  5. Re:MSDN on Qt vs MFC · · Score: 2

    No way, MSDN is terrible. All the information is there (if you can find it), but it's highly scatterbrained and disorganized. Half of the usefull information is locked up in the Knowledge base which is just a listing of sequential articles with no organization to it at all (you have to SEARCH for everything).

    If you compare the API defintions of one API (say ADO) to the API definitions of another (say RegExps) the API documentation is often in COMPLETELY different formats, and we won't even talk about where some of those API docs are located.

    The API documentations frequently don't explain what parameters are supposed to (or allowed to) contain, and even if they do their frequently listed on a seperate page without any explanation of the meanings for the various values.

    Oh, and good, standardised documentation about those COM/COM+ error codes located in a single and easily accessible location? Forget.

    I hate to rant here, but I've been dealing with MSDN's limitations for well over 6 years now and it's hardly better now than it was 6 years ago.

    In all honesty, I can find the solution to my problem 10x faster by going straight to groups.google.com. I find information in the MSDN archive quicker from groups.google.com than I ever do searching for it directly.

    SUN's Java documentation is an example of how things should be documented. It's not perfect, but it's 1000x better than what MSDN offers.

  6. Re:A quote from my wife.... on WorldCom to File for Chapter 11 Protection · · Score: 2

    Hear Hear!

    My previous employer was a small consulting agency/ISP in Ohio, is still in business today and was doing quite well last time I checked.

    Their clients were rather large companies in the local city, and we often provided T1, frame relay, ISDN and 56k access to these corportations. Needless to say, with that kind of clientel you needed a pretty ph4t pipe.

    Now, here is where my memory gets a little hazy. I believe our T1 lines were through MCI, although Ameritech (as usual) handled all the physical wiring. It's possible MCI was the frame relay (c'mon, it's been 3 years), but regardless MCI provided a significan portion of our necessary bandwidth.

    And then the bills started coming. They started mischarging us about $5000/month extra. My boss, of course, refused to pay that portion of the bill. A few months, many nasty arguments over the phone, threats by us to sue and threats by MCI (this was just before they became C&W) to shut off our access later, they finally fixed our bill. Only to start doing it again.

    Last I remember we were in the market for either dropping MCI completely or joining a class action against them. I'm not aware of the final outcome as I graduated from College and moved to Chicago (a quick traceroute to their servers shows no uunet or worldcom hops. C&W hops used to dominate the traceroutes).

    This wasn't just us. On of our clients said that he suspected they were receiving the same billing problems as us, but they just paid their bill and didn't worry about it. Can you imagine how much money MCI would have been pocketing by misbilling customers like that? Imagine the customers who didn't notice, or just paid the bill like our one client! It's sick when you think about it.

    That was 3 years ago. I could only hope that with all the mergers and acquisitions these problems had been improved upon over time.

    Yet, something tells me they haven't! I wonder what that is. ;)

    I won't miss them.

    Bryan

  7. Re:JPEG 2000? on Suddenly a JPEG Patent and Licensing Fee · · Score: 2
    But this doesn't surprise me. After MS claimed ownership of parts of OpenGL, that sorta opened the floodgates for really sad attempts to bilk more money out of an already financialy strapped populace/industry.

    What on Earth are you talking about? Microsoft opened no flood gates in this respect. This sort of problem has been going on for a long time. This is no different than what RAMBUS did a few years ago, what Compuserve did MANY years ago, and what many companies have been doing for a long time. Microsoft has NOTHING to do with this. This is a pure greed. Nothing more, nothing less. That's been the problem with the human race since day one.

  8. why not? on Sili-Hudson Valley? · · Score: 2

    What's wrong with Albany New York? I hate to say this, but New York City, L.A. and San Francisco/Silcon Valley are *NOT* the center of this vast and great country of ours!

    We have thousands of cities across 50 states that could all just as easily serve this purpose. Quite frankly, I find it really refreshing that other people/places in this country is being given a chance.

    Not everything has to be (nor should it be) congregated into one small hub. That's how companies and governments die (think of those poor companies who were housed 100% in the WTC buildings as an example). Our tech industry SHOULD be spread across the country, it's too important to be otherwise.

  9. Re:It should! on ATI R300 and R250V · · Score: 3, Insightful

    It's a game of leap frog. It doesn't matter who had the best performance first, or who has the best performance now. It doesn't matter who's generation of cards are compared with who's generation of cards.

    All that matters is who has the best cost/performance ration (right now), and who has the best performance come Christmas time when people really start spending money.

  10. Re:How to Take Over the 3D Industry in a Ten Steps on A Lawyer's View on the OpenGL Patent Mess · · Score: 4, Funny
    Sorry, your list was VERY good, however I have to make a few small adjustments to the end of it since I believe you missed one key point. My changes are in bold towards the end.

    1. Get computers to the point where 3D is a possiblity - Done
    2. Get computers to the point where 3D is common - Done
    3. Notice a competitor/3rd party owns the dominant 3D standard - Done
    4. Develop your own standard (Direct3D maybe?) - Done
    5. Refine it to the point where it's actually useable - Done
    6. Help make many of the important features of modern 3D and get it in competitor/3rd party's standard - Done
    7. Point out that you have patents/etc on those parts of the standard and that you will charge large licensing fees on using that standard - In Progress
    8. Use fee to strangle the competing standard - To Be Done
    9. Now everyone is forced to use your software for 3D if they don't want to pay tons of license fees - To Be Done
    10. Watch as competing platforms (let's call them Fruit Computers, and Penguindynamics) die under licensing fees becase you refuse to put your royalty-free API on their platforms - To Be Done
    11. Begin charging fees to your current customers (since they no longer have a choice) - To Be Done
    12. Laugh maniacally all the way to the bank (again) - The Ultimate Goal
    See how simple that was?
  11. Re:Why this won't work on an OSS project. on Would an Ad-Sponsored OS/Desktop Work for OSS? · · Score: 2

    Yeah, but they are going to take the time to download the compiled binary of the version without the ads that somebody else put up for download. You can't from doing that, afterall, this is an open source system.

    Honestly, this is about one of the dumbest ideas I've heard of in a long time...

  12. Re:Problem with switching on Beyond Dvorak via Genetic Algorithm · · Score: 1

    1.) It's like riding a bike. My coworker Juan could switched back to DVORAK from QWERTY with about a days worth of practice after he hadn't done any DVORAK for a year. He then switched between QWERTY and DVORAK multiple times per day (none of our servers were DVORAK) and never had any problems.

    2.) You can reprogram the keys for most video games, and if you can't it's probably a crappy video game and not worth your time! :)

    3.) My hands have not gone numb, but I have had soreness in my wrists on rare occasions. Count yourself blessed.

  13. Re:I hope ... on Good Morning, Professor Romero · · Score: 5, Insightful

    Yeah, pretty amazing what you can accomplish...

    You have to consider that she actually looked GOOD before the Playboy shoot! Before the Playboy shoot she was a good looking American girl. Then came the make up, and then the boob job, and then the glamour, and post Playboy she looks like every other fake plastic slut in that magazine. Heff has not taste, he just likes fake plastic blonde bimbos. There's far more attractive women who walk by every day than what you see in playboy.

    It's sad isn't it...

  14. Re:IBM Eclipse Project on Extensible IDEs? · · Score: 2

    I can attest to this. Eclipse is very nice, and I'm currently working on a generic Syntax Highlighting plugin (for those random languages like php, Perl, tcl, VB, etc. that don't yet have full support in the IDE). The plugin interface is very powerfull, very easy to use, and very well thought out. It's just not documented very well! You can always look at the code if you aren't sure how something is supposed to work, though. The power of open source software...

    Eclipse is not as featurefull as Forte (aka Netbeans) or Visual Studio, but the community is growing fast. I expect it to easly outclass Forte very soon, and I expect it to be a better IDE than Visual Studio in the long run because the plugin interface is so nice and easy to use.

    Forte is painfull to use on most average computers. I'd only recommend it if you're doing SWING apps and need the GUI building tools. I haven't looked at the plugin interfaces, I'm sure you can do a lot, but bleah... using forte feels like you're programming in sludge. No thanks.

    Bryan

  15. Re:Woah!! on XML Namespaces and How They Affect XPath and XSLT · · Score: 1, Offtopic

    heh, this is exactly what SlashDot needs! Back in the day SlashDot used to have a ton of programmer oriented content like this, which is why I started reading SlashDot in the first place. Then, one day patents, Micro$oft abuse, privacy, and Jon Katz took over and SlashDot has not been the same since.

    SlashDot still has a lot of good content (especially if you block Katz), but face it, we're GNU/Linux geeks. We're programmers and sysadmins at heart! We need more real *TECH* content like this!

    Bryan

  16. Password vulnerabilities. on Passwords May Be Weakest Link · · Score: 2

    Why is it an accepted and often encouraged practice to force users to change their password after a certain number of days? Obviously most of the vulnerability is caused by users selecting simple and easy to remember passwords. However, changing passwords frequently causes the very behavior we are trying to avoid. In my experience, users who previously had very secure passwords switched to easy to remember passwords such as "lastname01, lastname02, lastname03..." when forced to change every 60 days.

  17. Re:Cyberspace will never be secure...EVER on Hacking Web Services · · Score: 3, Funny

    The problem with the western territories is that they are lawless lands! You'll never have enough Sherrif's to protect the cities, you'll never have enough US Marshal's to hunt down all the outlaws, you'll never have enough hunters to kill all the wolves, and let's not even forget about those blasted Indians! Nobody will ever be able to establish a good colony in those lands...

  18. whatever happened... on Maverick Rocketeers Pursue Space Access · · Score: 2

    Whatever happened to that guy who was going to try and launch himself? I remember them talking about moving the launch to Mexico because he might not be able to get permission for the launch from the FAA... unfortunately that's about all I can remember at the moment. :(

    Bryan

  19. Re:Windows users incentives to switch to Linux on Red Hat Takes Aim at SuSE, Mandrake · · Score: 1

    Yeah, I haven't seen a BSOD in a long time either. But hell, I just rebuilt my W2K machine two weeks ago and it's already screwed up. You can't open my computer without explorer hanging, and of course this causes a similar problem whenever any File Save As dialog box comes up. Oh, and let's not forget the 5 minute pause before the login screen appears at bootup.

    Two friggin' weeks! I installed the latest drivers of everything, all the windows patches, Cool Edit Pro 2.0, my Guitar Port software, Morrowind, Dungeon Seige, and Freedom Force, Mozilla, Winamp, and mIRC! That's it!

    In all honesty, I think the most recent W2K patches/updates are intentionally bad to help drive people to XP. It seems like I have no choice, since I need a fairly patched machine (IE6.0) to use my guitar port.

    /me cries

    Bryan

  20. Re:Talk to Schick. on Anti-Competitive Behavior in the Printer Industry? · · Score: 2

    I can go to Walgreens and buy razor blades that fit on my Gillete Mach 3 razor for a cheaper price. I do not recal Gillete ever attacking Walgreens or adding "smart chips" into their razors to prevent Walgreens from selling their own razor blades. However, if Gillete did decide to take such actions, I would quickly move on to a new brand of razors as their Razor blades are already overpriced as it is (and contrary to what all their commercials say don't perform significantly better on MY facial hair).

    Bryan

  21. Re:From the field . . . on Fewer Jobs, Less Pay In The IT Industry · · Score: 1

    If you can write your own scripting language, you can surely at the very least get a GED? It's sad that our society relies on stupid little pieces of paper so much, but it does and I can't see why you wouldn't do that!

  22. Re:Why drag your own subscribers away? on "EverQuest II" to debut in 2003 · · Score: 2

    UO is a 2D game with 2D play mechanics.
    Everquest is a 3D game with 3D play mechanics.

    The UO Sequel was going to be a 3D game with 3D play mechanics.
    Everquest II will be a 3D game with 3D play mechanics.

    The difference is this, when you have UO and upgraded from it, you were essentially upgrading from a car to a truck. With Everquest, you're going from a truck to a nicer truck.

    Chances are, if you want a car you're driving a car and if you want a truck you're driving a truck... Same seems to go for video games :)

    Bryan

  23. Re:hmmm .. sounds fishy on AMD's x86-64 Moves Forward · · Score: 3, Insightful

    It makes perfect sense though...

    Everybody knew Intel wanted to introduce a new instruction set with the Itanium and retire the x86 instruction set for good. It was a noble effort on Intel's part.

    AMD saw an oppurtunity. They knew that software development is slow and painful, and porting software form one architecture to another (especially when you never planed for it in the first place) is a long agonizing process. Most windows software is written for x86 32, there is a lot of it, and even with good tools it would take a long time to port everything to IA64. So, AMD did the next best thing and built 64bit extensions on top of the x86 instruction set (still some work to do, but a lot less).

    Microsoft of course, not being in this for the higher noble cause, realizs that it is cheaper, quicker, and easier to just extend their tools to use the x86+64 instruction set rather than redoing everything in IA64.

    Now, Microsoft, having the power it has tells Intel they don't want to port to the IA64. Intel panics, Microsoft gets its way (again), and we have yet another example of how Microsoft has too much power (when they can strongarm Intel like this, things have gone WAY too far).

    Just another day in cyberspace...

  24. Bravo! Bravo! on Wireless Carriers Accused of Antitrust Violations · · Score: 5, Interesting

    Bravo!

    This is highly needed. I am a big fan of Nokia phones, to the point where I won't use any other brand of phone. Unfortunately, I signed up for access with Sprint PCS 2 years ago, and a little over a year ago I extended my contract (it won't be over until May).

    When I signed up with Sprint PCS, Nokia phones were an option. Today they aren't, and no matter how many times I've contacted them things don't seem to be changing.

    My only choices are to (A) continue to use my 3 year old phone, (B) move on to a new provider, or (C) get a non-Nokia phone.

    None of those options are satisfactory to me.

    (A) my phone is outdated and no longer has the features I require. It is over large, gets horrible reception in my new Apartment, and the battery hardly lasts a day.

    (B) I would have to change my phone number as I was told I could not switch my current phone number over to the new provider (it is owned by Sprint). Secondly, my options are AT&T and Verizon who are both far worse companies than Sprint (in my experience anyway).

    (C) There are few phones I like, and after past experiences with current cell phone companies I've chosen to remain with Nokia, not just because I like their phones but because I like the way they run their business.

    As you can see, I am in a no win situation. Any choice I make leads me to make some sort of a compromise. While this lawsuit will unfortunately not go through the courts quick enough to be a benefit to me, it is long overneeded and I can only hope it helps keep others from experiencing these same problems in the future.

    Bryan

  25. come on on Is IBM on a Strategic Path to Control Java? · · Score: 2

    Obviously the writer does not realize how big IBM is already! A lot of those other companies are merging just to compete with IBM as it is right now! IBM is kicking everybody's ass without SUN.