The thing is that web standards are only of use if all the major browser vendors (that is MS, mozilla, apple and google) actually support them. Since the w3c has no power to force browser vendors to implement their standards and since many of the vendors are deeply opposed on key issues (such as video codecs) they are stuck between a rock and a hard place.
Without patents you would not have copyright either and so on no GPL or any other license than just public domain
BULLSHIT
Patents and copyrights are very different and there is no reason you can't have one without the other. Software has been copyrighted for far longer than it has been patented. In particular copyrights protect a particular implementation of a method but there is nothing to stop someone else implementing the idea themselves. Patents protect the method itself which can mean there is no way to implement a standard format without giving into the patent holders demands (which are often incompatible with the terms of licenses like the GPL).
AFAIK, Windows isn't released with any firmware on the release CD either.
On what do you base this claim? afaict many drivers contain firmware and windows contains many drivers (most of which afaict were not written by MS) so i'd be very surprised if their wasn't firmware on the windows CD.
The complexity of the problem is auto-adjusted to keep the block generation rate pretty much constant. A sudden increase in computing power will cause a spike in block generation rates but then the network will increase the difficulty and pull things back down again.
Seems strange to me, do the casinos have a mechanism to stop someone just handing their chips over to another guy and yet no mechanism to ensure that the person who picks up the prize is the same one that placed the bet?!
I expect Google know this - they recently implemented happy eyeballs [ietf.org] in Chrome
FINALLY the powers that be are waking up to the fact that using the standard OS connect timeout as a fallback timeout for interactive applications is a STUPID idea. Their failure to realise this obvious issue years ago has lead to the default advice for weird network slowness in many situations to be "try disabling IPv6"!
There is a catch 22 with IPv6 deployment. There is little point in deploying v6 on your servers unless you belive there will be a significant number of V6 only clients in the next few years (or whatever your "major upgrade" cycle is) and noone will want to deploy clients that cannot access v4 servers while there a significant number of v4 only servers.
Now the question is will the global v4 pool running out break this catch-22? I suspect the answer is no since clients without public v4 address are likely to still be able to access v4 only servers through some mechanism (e.g. NAT444, ds-lite, NAT64 or proxies).
Right now if I was a proper server admin (I do run a hosted server but it's mostly for personal use so it doesn't really count) i'd be making sure all newly introduced software supported IPv6 and if the cost was close enough to zero and my ISP offered proper v6 rather than some crappy tunnel I might consider actually using it..
It would intially seem that way. However when we look at the 256/8 blocks we see that many of them are not normal IPv4 addreses.
1 block is assigned to local identification 1 block is assigned to private use (there are also private use blocks elsewhere but only one is a full/8) 1 block is reserved for local loopback 16 blocks are allocated to multicast 16 blocks are practically unusable because they were never defined as either unicast or multicast and IIRC windows won't accept them as addresses
So there are only arround 3.7 billion "regular" addresses rather than the approximately 4.3 billion that one would nievely expect. Further conventional subnetting wastes quite a few addresses too, you waste one for network, one for broadcast, one for gateway and however many are needed to make the number of addresses up to a power of two. So i'd imagine the number of usable addresses is more like 3 billion.
And the cynic in me tells me it's not going to be our home broadband plans
What I expect will happen in the west is that public addresses will gradually (it will vary a lot by the particular ISP's growth rate and address situation at the time of exhaustion) become an extra cost option. If an ISP charges a couple of bucks extra a month for one then they are likely to free up a lot of addresses without pissing off the geeks too much.
One thing that is not clear at this point is whether it will be possible for ISPs to sell addresses across RIR boundries or if sales will be restricted to one RIR's area.
Real developers know it's a compromise, using the OS libraries means there is less duplication (which means less ram use and only one place to fix stuff when a problem is discovered) but it also makes it harder to be consistent across platforms and means you are at the mercy of the OS vendor regarding fixes and updates. In particular said OS vendor may use such features as an opertunity to ram a new major version down your throat.
Regardless of the merits of platform libraries VS rolling your own though I think this is a case of MS being pig headed. They could have easilly fixed something that is a major PITA for web server operators and didn't and given that the specs for it appear to have come out no later than 2003 they can't really use the excuse that it only came out after vista's release.
No. The salt helps against dictionary attacks. Normally, it is different for every user, but not secret. It does not help against brute-force attacks.
Correction the salt helps against precomputed attack tables it does not help against direct attacks. Whether the attack uses a dictionary or simple brute force is irrelevent.
It's going to make sense when we run out of fucking addresses.
Of course there is the definition of "RUN out" to consider. IP addresses aren't like oil, we don't use them up. When demand exceeds supply then (provided the RIRs don't mess things up too much) they will simply become more expensive causing the least profitable uses to be sacrificed.
I'm betting the first thing to be sacrificed will be public IPs for people on normal home broadband plans (mobile broadband seems to be using private IPs already)
This is why I generally support the big guys, Google et. all, when they go out and state they will no longer support older browsers.
The problem as I understand it in the case of IE is that MS considers the SSL implementation to be part of the OS not part of the browser and as such they won't implement SNI in IE on XP.
People are far more reluctant to upgrade their entire OS than to merely upgrade their browser.
the benefits of "free" outweights the lower bandwidth due to several people using the line.
There is also the not insubstantial advantage that a system built into the vehicle is likely to have an external antenna and possiblly a more powerful radio which should allow it to keep a much more stable connection. Some people apparently still buy fixed carphones (rather than just handsfree kits) for this reason.
My experiance with trying to use 3G mobile broadband sticks on trains is that the connection varies between slow and nonexistant.
Which means that, for all practical purposes, bcrypt is not really "tunable" at all. Once you have users with established passwords, changing bcrypt's "work factor" will require each of those passwords to be re-computed. Which means the end user will have to manually enter it again.
Your users enter their passwords when they log in giving you an opertunity to replace their password hash.
So provided you have some policy on expiring inactive accounts you can switch to a new hash scheme (or the same scheme with different settings) over whatever your inactivity timeout period is without users noticing a thing.
Is that in the way SSL is typically implemented the crypto is not the main weakness. In a typical SSL setup the client verifies the server is who it says it is is by looking at a certificate chain and checking that chain against a list of "trusted" roots. The server then verifies the client is who it says it is by requesting a password or other credentials be transmitted across the encrypted channel (in the https case this happens in the form of a http post followed by http cookies).
The problem comes that in typical implementations of SSL the list of trusted roots is HUGE and if the holders of ANY of those trusted roots can be compromised then a MITM attack can be mounted against your communications.
If you have control over both endpoints of an encrypted link you can make SSL far more secure by using your own root and making sure that is the ONLY root the client trusts.
OTOH people have been using third party clients on the msn messenger network for years reverse engineering each new version of the protocol as it came out and MS doesn't seem too bothered (then even published an early version of the protocol though according to wikipedia it was subtuly different from what MS were actually running)..
The 12-core X56xx's solutions arent touching the 48-core solutions from AMD as of yet in parallel workloads
Yeah if you push the core count insanely high you can get to the point where (for some workloads) the number of cores makes up for the low performance of the individual cores but afaict there is no 16-core system on the market that is faster overall than a 12 core 56xx series system.
It depends whether he means 16 good cores or 16 shitty cores;)
Yes both intel and AMD sell CPUs that let you put 16+ cores in one machine BUT afaict in both cases the individual cores are substantially slower than you can get in a 12-core (2x6) xeon 56xx machine. The prices are also pretty crazy afaict.
AIUI you don't HAVE to but if you do it's much easier to avoid inadvertantly violating copyright and/or mount a defense against accusitions of doing so if you do it that way. In particular there may be some things that only have one or two reasonable ways to implement them but are nonetheless complex enough that a court may consider them eligible for copyright.
Afaict skype got it's userbase because it "just worked", no worrying about firewalls or NAT types or port forwarding or other shit like that. IIRC they used some dirty tactics to acheive this like using people with fast open internet connections as router nodes (I think they later moved to routing the worst case traffic through their own servers)
Most clients will fall back to v4 if v6 fails. The problem comes when the v6 connection attempt gets no reply at all (e.g. due to routing problems, firewalls, links that are down but the system doesn't know they are down or some combination), the client will then wait for it to time out before falling back which if the client uses standard OS timeouts can take an excruciatingly long time.
The cause of the packets not getting any reply at all may be local to the client but it could also quite possiblly be in an ISP nework somewhere. Remember the internet (whether v4 or v6) is just a (very large) set of network providers cooperating (through ICANN and the organisations it delegates to) to use non-conflicting addressing and to foward traffic to each other. Even on the better maintained v4 side it's not that unusual for two ISPs to be unable to exchange traffic for a while due to some screwup.
hmm, my experiance is that laptop screen resoloution has stayed at about the same. The 10 inchers are mostly 1024x600, the 12-13 inchers are mostly 1366x768 (which is slightly more pixels than the older 1280x800) as are the bottom of the barrel 15 inchers.
Whe I say "removing the classic option" I should clarify, there is a theme that looks sorta like 98/2K/classic mode XP but behaviourally it's far more like normal win7 than it is like those systems
Slashdot Mirror
The thing is that web standards are only of use if all the major browser vendors (that is MS, mozilla, apple and google) actually support them. Since the w3c has no power to force browser vendors to implement their standards and since many of the vendors are deeply opposed on key issues (such as video codecs) they are stuck between a rock and a hard place.
Without patents you would not have copyright either and so on no GPL or any other license than just public domain
BULLSHIT
Patents and copyrights are very different and there is no reason you can't have one without the other. Software has been copyrighted for far longer than it has been patented. In particular copyrights protect a particular implementation of a method but there is nothing to stop someone else implementing the idea themselves. Patents protect the method itself which can mean there is no way to implement a standard format without giving into the patent holders demands (which are often incompatible with the terms of licenses like the GPL).
AFAIK, Windows isn't released with any firmware on the release CD either.
On what do you base this claim? afaict many drivers contain firmware and windows contains many drivers (most of which afaict were not written by MS) so i'd be very surprised if their wasn't firmware on the windows CD.
The complexity of the problem is auto-adjusted to keep the block generation rate pretty much constant. A sudden increase in computing power will cause a spike in block generation rates but then the network will increase the difficulty and pull things back down again.
Seems strange to me, do the casinos have a mechanism to stop someone just handing their chips over to another guy and yet no mechanism to ensure that the person who picks up the prize is the same one that placed the bet?!
I expect Google know this - they recently implemented happy eyeballs [ietf.org] in Chrome
FINALLY the powers that be are waking up to the fact that using the standard OS connect timeout as a fallback timeout for interactive applications is a STUPID idea. Their failure to realise this obvious issue years ago has lead to the default advice for weird network slowness in many situations to be "try disabling IPv6"!
Bullshit, there is this little thing called NAT which allows hosts to reach v4 servers even if they don't have their own public v4 IP.
There is a catch 22 with IPv6 deployment. There is little point in deploying v6 on your servers unless you belive there will be a significant number of V6 only clients in the next few years (or whatever your "major upgrade" cycle is) and noone will want to deploy clients that cannot access v4 servers while there a significant number of v4 only servers.
Now the question is will the global v4 pool running out break this catch-22? I suspect the answer is no since clients without public v4 address are likely to still be able to access v4 only servers through some mechanism (e.g. NAT444, ds-lite, NAT64 or proxies).
Right now if I was a proper server admin (I do run a hosted server but it's mostly for personal use so it doesn't really count) i'd be making sure all newly introduced software supported IPv6 and if the cost was close enough to zero and my ISP offered proper v6 rather than some crappy tunnel I might consider actually using it..
There are after all 4 billion IPv4 addresses
It would intially seem that way. However when we look at the 256 /8 blocks we see that many of them are not normal IPv4 addreses.
1 block is assigned to local identification /8)
1 block is assigned to private use (there are also private use blocks elsewhere but only one is a full
1 block is reserved for local loopback
16 blocks are allocated to multicast
16 blocks are practically unusable because they were never defined as either unicast or multicast and IIRC windows won't accept them as addresses
So there are only arround 3.7 billion "regular" addresses rather than the approximately 4.3 billion that one would nievely expect. Further conventional subnetting wastes quite a few addresses too, you waste one for network, one for broadcast, one for gateway and however many are needed to make the number of addresses up to a power of two. So i'd imagine the number of usable addresses is more like 3 billion.
And the cynic in me tells me it's not going to be our home broadband plans
What I expect will happen in the west is that public addresses will gradually (it will vary a lot by the particular ISP's growth rate and address situation at the time of exhaustion) become an extra cost option. If an ISP charges a couple of bucks extra a month for one then they are likely to free up a lot of addresses without pissing off the geeks too much.
One thing that is not clear at this point is whether it will be possible for ISPs to sell addresses across RIR boundries or if sales will be restricted to one RIR's area.
Real developers use available APIs
Real developers know it's a compromise, using the OS libraries means there is less duplication (which means less ram use and only one place to fix stuff when a problem is discovered) but it also makes it harder to be consistent across platforms and means you are at the mercy of the OS vendor regarding fixes and updates. In particular said OS vendor may use such features as an opertunity to ram a new major version down your throat.
Regardless of the merits of platform libraries VS rolling your own though I think this is a case of MS being pig headed. They could have easilly fixed something that is a major PITA for web server operators and didn't and given that the specs for it appear to have come out no later than 2003 they can't really use the excuse that it only came out after vista's release.
No. The salt helps against dictionary attacks. Normally, it is different for every user, but not secret. It does not help against brute-force attacks.
Correction the salt helps against precomputed attack tables it does not help against direct attacks. Whether the attack uses a dictionary or simple brute force is irrelevent.
It's going to make sense when we run out of fucking addresses.
Of course there is the definition of "RUN out" to consider. IP addresses aren't like oil, we don't use them up. When demand exceeds supply then (provided the RIRs don't mess things up too much) they will simply become more expensive causing the least profitable uses to be sacrificed.
I'm betting the first thing to be sacrificed will be public IPs for people on normal home broadband plans (mobile broadband seems to be using private IPs already)
This is why I generally support the big guys, Google et. all, when they go out and state they will no longer support older browsers.
The problem as I understand it in the case of IE is that MS considers the SSL implementation to be part of the OS not part of the browser and as such they won't implement SNI in IE on XP.
People are far more reluctant to upgrade their entire OS than to merely upgrade their browser.
the benefits of "free" outweights the lower bandwidth due to several people using the line.
There is also the not insubstantial advantage that a system built into the vehicle is likely to have an external antenna and possiblly a more powerful radio which should allow it to keep a much more stable connection. Some people apparently still buy fixed carphones (rather than just handsfree kits) for this reason.
My experiance with trying to use 3G mobile broadband sticks on trains is that the connection varies between slow and nonexistant.
£0.10 to send an email is fine.
I wouldn't even want to connect my computer on a service that expensive because i'd be worried about background data use racking up a huge bill.
Which means that, for all practical purposes, bcrypt is not really "tunable" at all. Once you have users with established passwords, changing bcrypt's "work factor" will require each of those passwords to be re-computed. Which means the end user will have to manually enter it again.
Your users enter their passwords when they log in giving you an opertunity to replace their password hash.
So provided you have some policy on expiring inactive accounts you can switch to a new hash scheme (or the same scheme with different settings) over whatever your inactivity timeout period is without users noticing a thing.
Is that in the way SSL is typically implemented the crypto is not the main weakness. In a typical SSL setup the client verifies the server is who it says it is is by looking at a certificate chain and checking that chain against a list of "trusted" roots. The server then verifies the client is who it says it is by requesting a password or other credentials be transmitted across the encrypted channel (in the https case this happens in the form of a http post followed by http cookies).
The problem comes that in typical implementations of SSL the list of trusted roots is HUGE and if the holders of ANY of those trusted roots can be compromised then a MITM attack can be mounted against your communications.
If you have control over both endpoints of an encrypted link you can make SSL far more secure by using your own root and making sure that is the ONLY root the client trusts.
OTOH people have been using third party clients on the msn messenger network for years reverse engineering each new version of the protocol as it came out and MS doesn't seem too bothered (then even published an early version of the protocol though according to wikipedia it was subtuly different from what MS were actually running)..
The 12-core X56xx's solutions arent touching the 48-core solutions from AMD as of yet in parallel workloads
Yeah if you push the core count insanely high you can get to the point where (for some workloads) the number of cores makes up for the low performance of the individual cores but afaict there is no 16-core system on the market that is faster overall than a 12 core 56xx series system.
It depends whether he means 16 good cores or 16 shitty cores ;)
Yes both intel and AMD sell CPUs that let you put 16+ cores in one machine BUT afaict in both cases the individual cores are substantially slower than you can get in a 12-core (2x6) xeon 56xx machine. The prices are also pretty crazy afaict.
AIUI you don't HAVE to but if you do it's much easier to avoid inadvertantly violating copyright and/or mount a defense against accusitions of doing so if you do it that way. In particular there may be some things that only have one or two reasonable ways to implement them but are nonetheless complex enough that a court may consider them eligible for copyright.
Afaict skype got it's userbase because it "just worked", no worrying about firewalls or NAT types or port forwarding or other shit like that. IIRC they used some dirty tactics to acheive this like using people with fast open internet connections as router nodes (I think they later moved to routing the worst case traffic through their own servers)
Most clients will fall back to v4 if v6 fails. The problem comes when the v6 connection attempt gets no reply at all (e.g. due to routing problems, firewalls, links that are down but the system doesn't know they are down or some combination), the client will then wait for it to time out before falling back which if the client uses standard OS timeouts can take an excruciatingly long time.
The cause of the packets not getting any reply at all may be local to the client but it could also quite possiblly be in an ISP nework somewhere. Remember the internet (whether v4 or v6) is just a (very large) set of network providers cooperating (through ICANN and the organisations it delegates to) to use non-conflicting addressing and to foward traffic to each other. Even on the better maintained v4 side it's not that unusual for two ISPs to be unable to exchange traffic for a while due to some screwup.
hmm, my experiance is that laptop screen resoloution has stayed at about the same. The 10 inchers are mostly 1024x600, the 12-13 inchers are mostly 1366x768 (which is slightly more pixels than the older 1280x800) as are the bottom of the barrel 15 inchers.
Whe I say "removing the classic option" I should clarify, there is a theme that looks sorta like 98/2K/classic mode XP but behaviourally it's far more like normal win7 than it is like those systems