Slashdot Mirror


User: amcdiarmid

amcdiarmid's activity in the archive.

Stories
0
Comments
289
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 289

  1. Seriously on How To Argue That Open Source Software Is Secure? · · Score: 1

    This depends on the products your clients are using:

    1) You might preface with a list of MS vulnerabilities in comparative products: (This should be easy to find on the net. Does not need to be recent.)
    Do you use MySql or Postgres: make a brief paper of vulnerabilities against Access + MySQL
    Linux (Core) vs MS Windows X, Y; Z
    Office suite vs. Office suite(s)

    2) Then you might want to prepare a (preliminary) cost estimate to convert to Microsoft Products. (Seat of pants will do.)

    3) Estimate how much it will cost to prepare a "good" version of 1;2 above.

    Go to Client meeting;

    a) You understand your clients concerns with security, and are more than willing to work with them to address these concerns.
    b) You have brought with you a comparison of known vulnerabilities between some relivant products, which will naturally show that your product is more secure (use total number of vulnerabilities found, average time from vuln found to patch, whatever makes it look good for you) - which you don't really want to discuss, since they are reprints from the net.
    c) If they want to go to MS, you are willing to help them - you estimate it will cost $hardware+$oftware+$time, which may be a lot but security is worth it.
    d) You have been a trusted IT advisor/implementor for years, and really want to address their concerns raised by this marketing tactic.
    e) If they are willing to use open source code backed by Microsoft, and the NSA is willing to use OpenSource - you don't have concerns about it, at least with the products your clients are using - other open source products will have to be re$earched.
    f) Exactly what are their concerns, and how much time (Money) would they like to have you spend researching it to create proper documentation to address exactly those concerns.
    g) Obviously, you are not too concerned about the system security - or you would not have implemented it that way, without caveats up front.
    h) If they are really concerned, they can caugh up several thousand for penitration testing from $buddy-of-yours.
    i) btw. anyone can disassemble microsoft's code with an open source disassembler as well ... looking at MS code is more profitable for bad guys, but hey ... you will get them the results they authorized expendatures for.
    j) You are always happy to meet with client$ to address their concerns.

    d)

  2. am3 CPU in am2+ motherboard: OK Otherway.. no on AMD Launches New Processor Socket Despite Poor Economy · · Score: 5, Informative

    You may be able to put a am3 processor in a am2+ motherboard, but the Register says that am2+ processor in a am3 motherboard will not work. (http://www.reghardware.co.uk/2009/02/09/review_cpu_amd_phenom_ii_am3/page2.html)

    To quote:
    "makes life horribly confusing as the Phenom X4 920 and 925 and the X4 940 and 945 will be identical apart from the processor socket. This means that there is the possibility that some poor so-and-so will buy an AM2+ CPU and an AM3 motherboard when ne'er the twain shall meet." ..
    careful what you buy out there

  3. What it is... on VMware Releases Open Source Virtualization Client · · Score: 1

    It appears that (VMView) this is a client to connect to a virtualized machine (desktop) much in the same manner as the Citrix ICA client, but specifically for Linux.

    The VMware Virtual Desktop Initiative (VDI) seems to have been renamed VMware View: Formerly, you had to use a paid for client (Citrix licensed?) to reach a hosted workstation. Your options were (correct in response please) use RDP clients (bad for sound), a Citrix-involved client (cost, but you can get video), or the VMware Infrastructure Console (VIC) which is a bit kludgy on the admin overhead.

    The specifics for this is that you can have a non-admin user connect to hosted machines (linux or windows) from a linux box (thin client) at no additional cost. The play seems to be for thin client boxes to include the VMware View connector at no cost, eg: saturating the market.

    The reason for this is likely to gain parity with Citrix's ubiquity on Thin Client Boxes. Up to now, thin clients tend to have some version of the Citrix ICA client, a version of the Microsoft RDP client, and perhaps a X client, and a 3270/5250 terminal emulator. With many thin client manufacturers going to Linux based thin clients, this is an easy way to get the VMware client on Thin Clients cheap.

    You will still pay for the core product, but (hopefully) no longer will have to pay extra for the Thin Client necessary to run the VMware View (aka VDI) "system." For slashdot users, who buy Thin clients for $9 (used) this will have no effect. You will still have to kludge users into the remote users group on each workstation, and configure each thin client to connect to the correct virtualized machine.

    This has no effect on Xen (Citrix Virtualization), or Hyper-V (Microsoft Virtualization), or ESX clusters, Workstation, or Server (VMWare Virtualization). All of those will still be host bound, except for ESX - which will allow virtual systems to be moved around to maximize physical host resources.

  4. Re:If they are still not dimmable they still suck on LED Lighting As Cheap As CFLs Invented · · Score: 1

    I saw an article that said that the EPA rated bulbs for acceptiblity: Essentially they said that current LED lights are not going to be too acceptible as replacments for Incandescents, except for under counter lighting...

    However they seemed to like this CFL:
    GE Lighting Model: 21710 FLE15/2/DV/R30/SW
    claimed as a 65Watt Incandescent replacement: Dimmable.

    I think I'll buy a bunch for the recessed lighting, and revisit the issue in a few years when they burn out;)

  5. Problem not limited to Western World. on Testing the KDE 4.2 Release Candidate, On Windows · · Score: 1

    You can make a good arguement that not only does it not apply to the rest of the world, but is one of the biggest (if not the biggest) problem in most of the world.

    Of course, in many parts of the world comments like this will not only get you labeled an a**hole - they will also get you arrested.

    Seen any cartoons about Mohammed recently?

  6. Corret the title: Do nice managers finish last on Do Nice Engineers Finish Last In Tough Times? · · Score: 1

    The story is interesting, but should not be titled do nice engineers finish last. The story is about two managers, reporting to another manager. Doug, Stuart, and Kelly are all in management - although they may have some engineering duties, they are not fundimentally engineers.

    That said: For engineers, knowing your shit is required. Period. However, being nice also counts, as does schmoozing enough to have a head start on upcoming projects: This means you are nice enough, and get out enough to know what's coming down the pike before it "officially" hits your desk.

    As far as the linked story of Doug, Stuart, and Kelly goes: It can go well, or badly. I recently saw a similar situation where Manager Stuart left the company after a power struggle which Manager Doug won. Doug promoted another guy to manage a newly demoted team (Sysadmins, who had been on the same team as Helpdesk): Let's call him Bad_Manager, who acted.. badly. One of the three administrators (sysadmin3) complained to Doug, and HR about Bad_Manager - then left after no action was taken. That sysadmin3 proverbially shot Bad_Manager on the way out the door, and Bad_Manager got demoted within a week. Everyone else who worked with sysadmin3 was very happy, and he was warned to be nice when filling out the security review that he eventually got for sysadmin3.

    I suspect that Doug got dinged as well.

    $.02

  7. It's called the Peter Principle on Do Nice Engineers Finish Last In Tough Times? · · Score: 1

    You rise to your own level of incompitance.

  8. Re:Un huh. on Do Nice Engineers Finish Last In Tough Times? · · Score: 1

    Why waste time replacing the valve?

    Just drill a properly sized hole in the radiator hose: If you are going to sabotage something, you don't want to get caught. Replacing a valve takes extra time with the target vehicle. Drilling a hole the correct size does not even require opening the hood. (caveat, some cars have plastic shields underneath & you will have to open something)

    I call BS for this alone;)

    duh

  9. Databases virtualize poorly: not quite correct on Setting Up a Home Dev/Testing Environment? · · Score: 1

    Databases (Say Oracle, or Exchange) may not virtualize well, but hardware today overcomes that. VMware has some studies on Exchange that say: Expect a 40% hit. Similar documentation exists for Oracle, and other SQL systems.

    I used to run a 6 year old Oracle system for a company that used it as a back-end for accounting. (Deltek Costpoint, 1500 employees) This system is a prime target for virtualization, if you give it fast enough disk IO.

    As a practical matter, not only could it run in virtualization (and be supported by Oracle) - It did run in virutalization for DEV/Testing: on a ESX box with 8 other servers... This guy only needs it for DEV.

    Of course, what he really needs to polish with this system is: his resume.

  10. Neither: use a mid-machine, and virtualization. on Setting Up a Home Dev/Testing Environment? · · Score: 1

    The problem is a bit generic, as we do not know what "development" is. For most Linux based development (Web-display, or Database, or coding), as well as most Windows based development (Same set) - with a few exceptions, you don't need a very powerful machine, and can virutalize.

    I will state, that you can purchase a DEV box to emulate Five "Serviceable servers" for less than $1,000.00:

    For this purpose, "A Servicable Server" is: 2x 2GHZ Xeon processor, 75GB of storage space, and 2GB of memory.

    CPU: $120+ (AM2+ QuadCore @ 2.3GHZ)
    Motherboard: $70 (AM2+ Motherboard with 4x 240pin ddr2 memory slots,and SATA Raid 0,1)
    Memory (8GB): $85 (Guess what kind)
    Hard disk: $150 Say two 640GB drives configured in Raid0.
    Backup: Say $120 for a esata disk drive at 750GB

    Case, KBD, Mouse: Go use an old one...

    Total cost: ~$550 to virtualize four-five "servicable servers", with backup.

    The trick to this is this: it is unlikely that any individual machine will be maxing out resources at the same time as other machines. For example, The VMWare ESX rule of thumb for CPU is something like 1core = 4x 2year old CPU's. with other virtualization, I would suggest cutting that down to say.. 2.5-1, just to be conservative. ESX would get you fun stuff with memory, so you are going to take a hit in the memory department. What can I say: I lied, you only get something like 1.5GB of memory per VM. Unless you are using JAVA, you are unlikely to miss it. If you are really doing something resource instensive, get more memory: either duplicate this machine, or buy a better mobo.

    For many applications, an older machine is fine - especially for development: I have seen many production Oracle, and MS-SQL databases running on 2GHZ hardware. Anything running on a 32GB OS (Windows 2000/2003 anyone?) can only see 3GB, and many places never max out the memory beyond the original purchase of up to 2GB.

    Of course, the real answer is look at the requirements of the components of this project to see what you need. Then if you are virtualizing - remove some CPU, as you are unlikely to have multiple CPU stress servers.

    $02, give me back my two dollars.

  11. Re:Actually they are right on eBay To Disallow Checks and Money Orders In US · · Score: 1

    countered by: "I X by paypal, and pray I receive Y - as many times I have not." It's not worth it to deal with Paypal Protection, as a better use of my time is getting the item I may need.

  12. eSATA? on Intel Releases USB 3.0 Controller Interface Spec · · Score: 4, Interesting

    I'm certain that USB3 will be "supposed to be" backward with USB 1; 1.1; 2, but will likely only be backwards compatible with 2. Right now, a Hard disk cannot keep up with eSATA at 1.5 Gb/s, nevermind eSATA at 3Gb/s. For the past year or so, many of us have been buying $15 eSATA cards for our old computers, and new computers with eSATA built in. Considering that external HD cases with eSATA connectors cost only about $16 (something with 4 eggs, at Newegg) what is the benefit?

    Possible benefits would be increased transfer speed to peripheral devices, but can we reasonably expect devices that fast by then? Personally, I would hope that 10Gb/s ethernet would come down in price by then. The only real benefit I see with the proposed USB3 is something for a processor core to do....

    $.02

    PS: I will give a possible something to do mention to Hard Disk (Solid-State) video recorders... but they could use eSATA as well & still be saturated..

  13. Re:Come On on Intel Releases USB 3.0 Controller Interface Spec · · Score: 1

    Thank you Riddley Walker.

  14. Re:Multiprocessing Environment? on VMware ESXi Available For Free Starting Today · · Score: 1

    er: no-ish

    You can run say 10 servers on a single box without much difficulty, but not using one Gb port. ESX has some nice features that will help you save resources: Say using the same memory chunk for some dll that is the same on multiple servers so that that chunk is only created once, instead of ten times. (Think Windows 2003 SPx; AV for ten servers that are kept concurrent: Most of those system resources are exactly the same so you use about 500MB for ten systems instead of 5GB.) That's one of the features that VMware ESX has over others. The other is is Dynamic Resource Scheduling: If you have multiple Host servers w./ licensing - you can have the guest machines automatically move themselves around so that the "Maximum" amount of resources are available.

    However, you can't get away from storage. (I used NFS to a cheap server.) Nor can you get away from Bandwidth. That said, it's still cheaper to purchase a medium sized box and add many NICs to it, then to purchase multiple smaller boxes.

    Simplified Disaster Recovery is just a bonus; it's still not simple.

  15. Re:Vista... Microsoft's "New Coke" on Making the Switch To Windows "Workstation" 2008 · · Score: 1

    Having worked in several places that required RSA-ID tokens.. (you know the funny ones with the numbers that change every minute, and if you drift more than three minutes you can't log in.)and having a few friends on "isolated networks."

    I would say the microsoft requirements (change every 42 days, passwords have 8+ charachters including three types from: Numbers, lowercase, uppercase; symbols.) are not that bad: Especially if you consider how vulnerable some of their systems are.

    Consider: You run an email server. Some user has sold their password to a spammer for $.001 per email sent. Your server is sending 10,000 spam emails per hour. How long do you have before your email server is blacklisted everywhere? (The "wisdom of the crowds" in my office pool was one week.)

    If you do not have a lockout policy, a modern computer can break a six letter password in a matter of hours. (I once cracked 350 of 1500 passwords in 15 minutes, using the 2k3 password file.) - Of course, if you have a lockout policy .. it may take a number of years...

    In any case, if you look at the email case above: at least with a very short password time you can hope that the password gets changed before the email server gets blacklisted...

    $.02
    Alex

  16. Re:I dont quite trust their list...Cox says "No" on Elude Your ISP's BitTorrent Blockade · · Score: 1

    I don't know if T-Mobile's Edge is 3G, or 2.5G or what: However yesterday I gave a demo with using a t-mobile blackberry as an Internet Access Point. (AKA: Modem) The old GPRS Frankenberry (abused by another sysadmin) was horrible and laggy: only suitable for CLI geeks. The new "Edge" Crackberry was reasonable: Prob. about 200 Kbps, perhaps 300.

    This was from the Illy at NH ave & M St. in Washington DC.

    - mod down: would have been more relivant yesterday for the comparison of wireless data providers. The one that did not include T-Mobile.

  17. Re:One problem machine out of many installs on Windows XP SP3 Creating Havoc · · Score: 1

    Oh, come one...

    XP did suck pre sp1. The reason it sucked was not something the service pack fixed, but that the hardware caught up with the software: Between when XP was released, and when SP1 came out - processor speeds doubled. Ditto memory.

    Vista likely runs fine an a $2000 desktop. Perhaps even a $1000 one. (I made a amd X2 6000 with 4 GB of memory for that.) However, a typical consumer unit is one your mother bought for $500 and thinks should be fine. If she waited a year or two to buy a vista computer: it would meet the real-world requirements.

    mod down or reply: that is the question.

  18. Re:Whaa? on More DMCA Censorship at Yahoo! · · Score: 1

    ya-who?

  19. Re:Review at the register: Not so good. on Western Digital's "Green" Hard Drives · · Score: 1

    Fair point on requirements: Right now, my need is for hosting about 20 windows server instances to a VMware cluster with two teamed Gb NIC's each. (OK, I'm looking at adding more NICS to both the share, and the servers...)

    If I was just using these to store backups of movies, then the power/heat savings would be dandy. I just happen to be screwed by worries of sustained thrashing.

  20. Review at the register: Not so good. on Western Digital's "Green" Hard Drives · · Score: 2, Informative

    The Register reviewed four 1Tb drives, including this one.
    http://www.reghardware.co.uk/2008/03/26/review_four_terabyte_hard_drives/

    Product

    Hitachi Deskstar 7K1000
    Verdict

    The Hitachi set a decent benchmark for performance as a standalone drive.
    Rating

    70%
    Suggested Price

    £159
    Product

    Samsung SpinPoint F1 HD103UJ
    Verdict

    It's a straight fight between the Seagate and Samsung, and on balance we favour the Sammy despite its higher price.
    Rating

    85%
    Suggested Price

    £194
    Product

    Seagate Barracuda 7200.11 ST31000340NS
    Verdict

    The Seagate delivers sterling performance with the minimum of fuss, yet it is the cheapest of the drives on test.
    Rating

    80%
    Suggested Price

    £149
    Product

    Western Digital WD1000FYPS RE2-GP
    Verdict

    We're all in favour of reducing our dependence on electricity but the RE2-GP lagged behind in every one of our tests.
    Rating

    60%
    Suggested Price

    £159

  21. Most in US have false sense of security: News @ 11 on Most In US Have False Sense of Online Security · · Score: 1

    I think this is a piece of research that anyone with a brain knows, and won't be accepted by those without one.

    $.02: don't even have to read the article - just the post saying it's a perennial dupe

  22. Re:You are smoking crack: Re:Get GSM with a US SIM on Why Everyone Should Hate Cellphone Carriers · · Score: 1

    *** 1) GSM Phones work on two major networks in the US
                        Crapular
                        T-Shitty - both of these networks are less than... adiquate ***

          Yes, I know that Cingular's reputation is so bad that they changed their name to the fabulously well regaurded AT&T. The fact is that in Washington, DC (the capital of the US) I cannot drive eight blocks down 13th St without loosing a call about a block south of U. This happens in the middle of a big city in an area without major obstructions to wireless.

            My wife recently got back from some especially impoverished area of Cambodia: her t-mobile phone worked there, but not in Virginia 20 miles out of DC

    ***2) The GSM system in the US uses two different carrier bands than GSM systems in the rest of the world. If you want a quad band phone, you pay significantly more.***
              Significantly may vary from person to person. If you go to tigerdirect.com (for example) and sort the gsm phones by price - the first page or two have phones labelled US, European, or refurb. although there are a few that are tri band.

    ***3) If you want the ability to use another companies sim card in your GSM phone, you have to UNLOCK your phone. Various companies have variously bad policies on this, but if you don't have a good relationship with your rapist, I mean cell phone provider, - assume we are talking about something like an additional $150***
            If you can't wait three months to use your phone with your carrier. (Say you work in IT and have a wife from another country) there is a fee. If you have been with your carrier, they will *eventually* unlock you. I have done this twice - and in neither case did T-mobile, or AT&T meet the timelines they promised.

    If I sound bitter about the cellular carriers, it's because they always act bitter towards me. I have learned that acting nice towards monopolies that don't care is a waste of time.

  23. You are smoking crack: Re:Get GSM with a US SIM on Why Everyone Should Hate Cellphone Carriers · · Score: 1

    This is wrong on so many levels I have smoke coming out of my ears: Like having dealt with Verizon DSL Tech Support.

    1) GSM Phones work on two major networks in the US
              Crapular
              T-Shitty - both of these networks are less than... adiquate

    2) The GSM system in the US uses two different carrier bands than GSM systems in the rest of the world. If you want a quad band phone, you pay significantly more.

    3) If you want the ability to use another companies sim card in your GSM phone, you have to UNLOCK your phone. Various companies have variously bad policies on this, but if you don't have a good relationship with your rapist, I mean cell phone provider, - assume we are talking about something like an additional $150

  24. Re:unfair competition -- It's True on Google Caught in Comcast Traffic Filtering? · · Score: 1

    Verizon is not filtering anyone over anyone on their DSL lines: I have their DSL and it hasn't worked since April.

  25. Using Automated Lists of suspected on Terror Watch List Swells to More Than 755,000 · · Score: 0, Troll

    Democrats:

    Step1)Add all of the Democrats to a list of Terrorists
    Step2)Make it illegal for those on the Terrorist Watchlist to vote
    Step3)Profit ;)