If you don't intend to apply the security fixes to your server, do not run a server. Afaict a lot of debian users think (and the messages in the installer and the information on the website implies it) that if they have the security repositry in the sources.list and run apt-get update && apt-get upgrade (or the equivalent commands for their preferred high level package manager) frequently that they have done all they reasonably can do regarding keeping their server patched.
However this is NOT enough. Sometimes the debian security team will consider a version of something unsupportable before security support for the release in general is discontinued. Users needing security support for said package need to make other arrangements (e.g. using volatile). However they will only know that they need to do so if they subscribe to the debian-security-announce mailing list. This fact is NOT well communicated to users (the debian page on "security information" makes no mention of this fact!).
If you are running Debian on a server and are not subscribed to that list I suggest you both subscribe to it ASAP AND go through the list archives! If you run another distribution I suggest you check for a similar list there.
Indeed clamav were stuck between a rock and a hard place on this one. Whichever option they chose some people would say it was the wrong one.
The real problem is that there was no effective way of communicating this to users. People clearly either didn't read logs or took the "don't panic" part of the log message a bit to literally and didn't realise they should be subscribed to the announce list for the virus scanner.
Desktop AV posts lots of nag messages to the screen when updates are going to be discontinued but that isn't really practical for an AV that is both running on a server and only a small part of the larger soloution (in the unix traditions of ways of doing things).
Further compounding the problem is that Debian put clamav in stable and then abandoned the version in stable telling users to use the one from volatile (because ClamAV had made changes that weren't acceptable within a stable release) but not everyone knows about volatile (it's a relatively recent addition). Most likely in future releases Debian will only put clamav in volatile.
It doesn't have to be so extreme though. You can always implement pieces of the game not related to rendering on the server. Which is essentially why Ubisoft has done here. The question then becomes how difficult is it to reimplement those parts...
And the answer so far seems to be harder than cracking traditional drm but within the pirates capabilities to do eventually.
It is the same with Paypal and credit cards with the difference that the merchant pays the markup. The thing with services like this is you end up paying TWICE. You end up paying card/paypal fees shipping etc to the original vendor, and then you end up paying them again to the forwarder plus the forwarder needs to cover thier time and efford making and forwarding the order and make some profit.
Sometimes you end up paying sales tax in the forwarder's jurisdiction too (at least that was the case when I looked into using a service called "shop any american store" to get an item from the US sent to the UK).
The net result is that this is an expensive way to buy stuff. If I can find a vendor who will ship direct it will almost certainly be much cheaper.
good question and there are a few reasons all coming back to the internet's nature as a packet switched network
Firstly there is the fact that matching on variable length and potentially text strings is a lot more overhead than matching parts of numbers that have a known maximum length (so you can have fixed size address and mask fields for your routes)
Secondly there is aggregation. Domain names are allocated to machines administered by the same company but which may (should) be spread over the internet. IP blocks are allocated to providers and larger companies and machines on the same network tend to use bits of the same block. This makes the routing tables FAR simpler than if every machine was routed individually.
Thirdly there is packet size overhead, each packet needs the addresses of two machines, the sender and the recipiant. While IPV6 addresses are much longer than V4 ones they are still much shorter than an average full text address (particulally a client address) would be.
1: multinationals will probablly try to bend the rules to try and get IPs from a different rir (some rirs will run out before others). 2: isps will push end lusers* behind ISP level NAT in order to free up addresses for more important/lucrative purposes. 3: some sort of sale of IPs will probablly happen, whether it is sanctioned by IANA and the RIRs or not.
* we geeks will probablly be able to get public IPs but at a price premium.
The real problem is that the grid is ancient (relatively) and uses old, broken tech. There isn't really anything wrong with the tech per-se.
The real problem IMO is that electricity is expensive to store and storage capcity for it is very limited. While wholesale electricity is a complex market designed to take account of this retail electricity is still sold on a very crude system (at worst the same rate at all times, at best a couple of rates based on time of day).
There is talk of pushing retail customers towards time of day pricing but I would expect a lot of resistance to it because it will add a lot of worry about electricity costs that those customers don't really want to deal with. It will also require a complete replacement of metering equipment.
Don't you think the power company already knows how much power you're using? In an old fashioned setup they know how much the average customer is using at any given time and they know your total usage over a long period (often longer than the billing period!)
With "smart meters" they know exactly what each individual customer is using when.
This system though seems relatively benign as there doesn't seem to be any back communication (at least not yet).
Often web forms don't seem to respond in a reasonable time. sometimes clicking again helps because it stops some hung process or hits a better server in the pool or whatever other times it just restarts the delay.
Right now on newegg you can get an 80GB sata laptop drive for $40, and 120GB for $45, and a 250 for $47.
There seems to be a similar effect with SSDs while there are 8 and 16GB drives on the market they cost as much (sometimes more) as the cheap 30GB ones (admittedly the smaller drives are SLC but the smaller number of chips and older controllers means this doesn't bring a performance advantage afaict). The sweet spot price for SSDs seems to be arround the 60-120GB mark.
Netbooks with 2 and 4GB flash disks prove this. Notice that those (and the slightly later models with about 20GB of flash and a screen that actually filled the space available) have mostly dissapeared replaced by slightly larger ones with 80GB-160GB HDDs? Performance (particulally write performance) on those things was shit and the capacity limit was pretty crippling.
One thing to remember is that individual flash chips aren't particulally fast but by combining lots of them in paralell with a good controller high performance can be acheived. OTOH devices like USB sticks with a cheap controller and a handfull of flash chips tend to be slower than HDDs (especially when writing). This along with mounting requirements means that the price floor for SSDs that actually perform better than hard drives and can be fitted in place of a traditional hard drive will be higher than USB sticks, CF cards etc.
Agreed, you can get SSDs that are nearly as big as the biggest laptop drives but expect them to cost about as much (sometimes a bit more, sometimes a bit less depending on your taste in laptops) as the rest of the machine put together.
RAID-0 pretty much doubles your risk of failure. Worse than that because as well as the risk of either drive failing you have the risk of something going screwy with the raid implemenation (especially with the cheap fakeraids seen in desktop systems) and breaking the array. Maybe you can rebuild it somehow but it's likely to be rather painful.
Remember arm is a british company and apple operate internationally (arm probablly do to but i'm not positive) so the US regulators won't be the only ones looking at such a deal!
I'm sure Intel, AMD, or some other company no one has heard of yet would love to take over ARM's spot. I'd think mips (and it's chineese clones) are the most likely contender.
Antivirus is dangerous pretty much by definition. It's job is to identify viruses which often use self modification techniques. With viruses getting ever better at avoiding detection false positives are practically a certainty.
Not saying this incident is excusable (they REALLY should be testing every version of core windows files, surely it can't be that hard to extract every MS patch to a "test clean" directory) but they can't be expected to check every bit of software out there.
And desktop antivirus should really be your last line of defense. If things are hitting it on a regular basis you have bigger problems to fix. Even if you update it regulally as soon as the definitions come out there will still be threats too new to be detected.
Afaict most people in the UK are on some form of rate adaptive ADSL. If you are lucky you get about 8 Mbps out of this if it's ADSL1 (most BT wholesale stuff) and more (up to 24MBPs in theory but i've if it's ADSL2 (most LLU stuff). If you are not so lucky you may only get 1MBPs or so.
Furthermore with BT wholesale based providers (who are the only option in many areas) the cost of links into the BT wholesale backend network is rather high. So ISPs tend to have at least one of bad congestion, throtting or traffic limits.
Virgin cable is pretty good on perfomrance for traditional server based services but afaict they take steps to deliberately throttle bittorrent.
Afaict the reason desktop CPUs aren't soldered to the motherboard (many laptop CPUs are because thickness is at a premium) is because it would mean OEMs would have to decide what CPU was going in a machine much earlier. This would both require the OEM to hold more stock (bad for the OEM) and make the OEM less likely to offer higher end CPUs as build to order options (bad for intel).
With socketed CPUs an OEM can design and build most of a system and only decide late on in the process (sometimes even only when the customer actually buys it) what CPU to drop in and hence where in the lineup it will come.
But for a desktop PC, isn't this a disadvantage? If you're using a proper graphics card, couldn't that space in the CPU be used for better things than a redundant graphics circuit? I doubt it's worth intels while to produce a specific chip for those who want a generally low-midrange config (2-4 cores, 2 channel memory, limited PCIe etc) and yet don't want integrated graphics. Especially as even with the integrated graphics disabled these will probablly be among the most power efficiant chips in their class.
The high end stuff (which will be on other sockets that support more stuff) will probably remain free of integrated graphics.
One less pin sounds like they wanted a different name so tweaked the number of power/ground pins marginally and/or removed some debug/test pin.
There isn't much of a chipset with the LGA1156 stuff anyway. All the chipset does is deal with the slower stuff (SATA, low lane count PCIe, traditional PCI) and provide the physical layer stuff for the video. The video core (where present), fast PCIe and memory controller are already on the processor package anyway.
P.S. According to TFA, it's actually TWO new sockets, LGA1366 is apparently going to get replaced as well (YAY quad channel memory, lets hope there is a dual socket version of it to get 8 channels total).
An antivrus update pretty much by definition has the ability to do some serious damage.
Not that I think this was a good thing (far from it) but if you are using antivirus in an environment that important you readlly should be testing all your updates.
Afaict it won the market for home-cinema buffs but many normal people don't care about HD enough to pay the extra and lose compatibility with their existing players.
in countries with decent broadband that is to reliably stream proper HD video you probably want at least a nominal 10 megabit connection that actually delivers a significant proportion of it's bandwidth. How many countries can reliably deliver that?
Plus I bet the quality still won't be good as bluray and the DRM will probably be worse.
"One fix is to delete the bad DAT file the client at "C:\Program Files\Common Files\McAfee\Engine". Delete any av*.dat. Then reboot and the old DAT should be grabbed."
Slashdot Mirror
If you don't intend to apply the security fixes to your server, do not run a server.
Afaict a lot of debian users think (and the messages in the installer and the information on the website implies it) that if they have the security repositry in the sources.list and run apt-get update && apt-get upgrade (or the equivalent commands for their preferred high level package manager) frequently that they have done all they reasonably can do regarding keeping their server patched.
However this is NOT enough. Sometimes the debian security team will consider a version of something unsupportable before security support for the release in general is discontinued. Users needing security support for said package need to make other arrangements (e.g. using volatile). However they will only know that they need to do so if they subscribe to the debian-security-announce mailing list. This fact is NOT well communicated to users (the debian page on "security information" makes no mention of this fact!).
If you are running Debian on a server and are not subscribed to that list I suggest you both subscribe to it ASAP AND go through the list archives! If you run another distribution I suggest you check for a similar list there.
Indeed clamav were stuck between a rock and a hard place on this one. Whichever option they chose some people would say it was the wrong one.
The real problem is that there was no effective way of communicating this to users. People clearly either didn't read logs or took the "don't panic" part of the log message a bit to literally and didn't realise they should be subscribed to the announce list for the virus scanner.
Desktop AV posts lots of nag messages to the screen when updates are going to be discontinued but that isn't really practical for an AV that is both running on a server and only a small part of the larger soloution (in the unix traditions of ways of doing things).
Further compounding the problem is that Debian put clamav in stable and then abandoned the version in stable telling users to use the one from volatile (because ClamAV had made changes that weren't acceptable within a stable release) but not everyone knows about volatile (it's a relatively recent addition). Most likely in future releases Debian will only put clamav in volatile.
It doesn't have to be so extreme though. You can always implement pieces of the game not related to rendering on the server. Which is essentially why Ubisoft has done here.
The question then becomes how difficult is it to reimplement those parts...
And the answer so far seems to be harder than cracking traditional drm but within the pirates capabilities to do eventually.
It is the same with Paypal and credit cards with the difference that the merchant pays the markup.
The thing with services like this is you end up paying TWICE. You end up paying card/paypal fees shipping etc to the original vendor, and then you end up paying them again to the forwarder plus the forwarder needs to cover thier time and efford making and forwarding the order and make some profit.
Sometimes you end up paying sales tax in the forwarder's jurisdiction too (at least that was the case when I looked into using a service called "shop any american store" to get an item from the US sent to the UK).
The net result is that this is an expensive way to buy stuff. If I can find a vendor who will ship direct it will almost certainly be much cheaper.
good question and there are a few reasons all coming back to the internet's nature as a packet switched network
Firstly there is the fact that matching on variable length and potentially text strings is a lot more overhead than matching parts of numbers that have a known maximum length (so you can have fixed size address and mask fields for your routes)
Secondly there is aggregation. Domain names are allocated to machines administered by the same company but which may (should) be spread over the internet. IP blocks are allocated to providers and larger companies and machines on the same network tend to use bits of the same block. This makes the routing tables FAR simpler than if every machine was routed individually.
Thirdly there is packet size overhead, each packet needs the addresses of two machines, the sender and the recipiant. While IPV6 addresses are much longer than V4 ones they are still much shorter than an average full text address (particulally a client address) would be.
1: multinationals will probablly try to bend the rules to try and get IPs from a different rir (some rirs will run out before others).
2: isps will push end lusers* behind ISP level NAT in order to free up addresses for more important/lucrative purposes.
3: some sort of sale of IPs will probablly happen, whether it is sanctioned by IANA and the RIRs or not.
* we geeks will probablly be able to get public IPs but at a price premium.
The real problem is that the grid is ancient (relatively) and uses old, broken tech.
There isn't really anything wrong with the tech per-se.
The real problem IMO is that electricity is expensive to store and storage capcity for it is very limited. While wholesale electricity is a complex market designed to take account of this retail electricity is still sold on a very crude system (at worst the same rate at all times, at best a couple of rates based on time of day).
There is talk of pushing retail customers towards time of day pricing but I would expect a lot of resistance to it because it will add a lot of worry about electricity costs that those customers don't really want to deal with. It will also require a complete replacement of metering equipment.
Don't you think the power company already knows how much power you're using?
In an old fashioned setup they know how much the average customer is using at any given time and they know your total usage over a long period (often longer than the billing period!)
With "smart meters" they know exactly what each individual customer is using when.
This system though seems relatively benign as there doesn't seem to be any back communication (at least not yet).
Often web forms don't seem to respond in a reasonable time. sometimes clicking again helps because it stops some hung process or hits a better server in the pool or whatever other times it just restarts the delay.
Right now on newegg you can get an 80GB sata laptop drive for $40, and 120GB for $45, and a 250 for $47.
There seems to be a similar effect with SSDs while there are 8 and 16GB drives on the market they cost as much (sometimes more) as the cheap 30GB ones (admittedly the smaller drives are SLC but the smaller number of chips and older controllers means this doesn't bring a performance advantage afaict). The sweet spot price for SSDs seems to be arround the 60-120GB mark.
Netbooks with 2 and 4GB flash disks prove this.
Notice that those (and the slightly later models with about 20GB of flash and a screen that actually filled the space available) have mostly dissapeared replaced by slightly larger ones with 80GB-160GB HDDs? Performance (particulally write performance) on those things was shit and the capacity limit was pretty crippling.
One thing to remember is that individual flash chips aren't particulally fast but by combining lots of them in paralell with a good controller high performance can be acheived. OTOH devices like USB sticks with a cheap controller and a handfull of flash chips tend to be slower than HDDs (especially when writing). This along with mounting requirements means that the price floor for SSDs that actually perform better than hard drives and can be fitted in place of a traditional hard drive will be higher than USB sticks, CF cards etc.
Agreed, you can get SSDs that are nearly as big as the biggest laptop drives but expect them to cost about as much (sometimes a bit more, sometimes a bit less depending on your taste in laptops) as the rest of the machine put together.
RAID-0 pretty much doubles your risk of failure.
Worse than that because as well as the risk of either drive failing you have the risk of something going screwy with the raid implemenation (especially with the cheap fakeraids seen in desktop systems) and breaking the array. Maybe you can rebuild it somehow but it's likely to be rather painful.
Remember arm is a british company and apple operate internationally (arm probablly do to but i'm not positive) so the US regulators won't be the only ones looking at such a deal!
I'm sure Intel, AMD, or some other company no one has heard of yet would love to take over ARM's spot.
I'd think mips (and it's chineese clones) are the most likely contender.
IIRC it was only ground support equipment that they were using used parts in, not the shuttle itself.
Obsolescence is a BIG problem when you try and keep a electronic system running for that many years with minimal changes.
Antivirus is dangerous pretty much by definition. It's job is to identify viruses which often use self modification techniques. With viruses getting ever better at avoiding detection false positives are practically a certainty.
Not saying this incident is excusable (they REALLY should be testing every version of core windows files, surely it can't be that hard to extract every MS patch to a "test clean" directory) but they can't be expected to check every bit of software out there.
And desktop antivirus should really be your last line of defense. If things are hitting it on a regular basis you have bigger problems to fix. Even if you update it regulally as soon as the definitions come out there will still be threats too new to be detected.
Do you count the UK in western europe?
Afaict most people in the UK are on some form of rate adaptive ADSL. If you are lucky you get about 8 Mbps out of this if it's ADSL1 (most BT wholesale stuff) and more (up to 24MBPs in theory but i've if it's ADSL2 (most LLU stuff). If you are not so lucky you may only get 1MBPs or so.
Furthermore with BT wholesale based providers (who are the only option in many areas) the cost of links into the BT wholesale backend network is rather high. So ISPs tend to have at least one of bad congestion, throtting or traffic limits.
Virgin cable is pretty good on perfomrance for traditional server based services but afaict they take steps to deliberately throttle bittorrent.
Afaict the reason desktop CPUs aren't soldered to the motherboard (many laptop CPUs are because thickness is at a premium) is because it would mean OEMs would have to decide what CPU was going in a machine much earlier. This would both require the OEM to hold more stock (bad for the OEM) and make the OEM less likely to offer higher end CPUs as build to order options (bad for intel).
With socketed CPUs an OEM can design and build most of a system and only decide late on in the process (sometimes even only when the customer actually buys it) what CPU to drop in and hence where in the lineup it will come.
But for a desktop PC, isn't this a disadvantage? If you're using a proper graphics card, couldn't that space in the CPU be used for better things than a redundant graphics circuit?
I doubt it's worth intels while to produce a specific chip for those who want a generally low-midrange config (2-4 cores, 2 channel memory, limited PCIe etc) and yet don't want integrated graphics. Especially as even with the integrated graphics disabled these will probablly be among the most power efficiant chips in their class.
The high end stuff (which will be on other sockets that support more stuff) will probably remain free of integrated graphics.
One less pin sounds like they wanted a different name so tweaked the number of power/ground pins marginally and/or removed some debug/test pin.
There isn't much of a chipset with the LGA1156 stuff anyway. All the chipset does is deal with the slower stuff (SATA, low lane count PCIe, traditional PCI) and provide the physical layer stuff for the video. The video core (where present), fast PCIe and memory controller are already on the processor package anyway.
P.S. According to TFA, it's actually TWO new sockets, LGA1366 is apparently going to get replaced as well (YAY quad channel memory, lets hope there is a dual socket version of it to get 8 channels total).
An antivrus update pretty much by definition has the ability to do some serious damage.
Not that I think this was a good thing (far from it) but if you are using antivirus in an environment that important you readlly should be testing all your updates.
Is there a complete list of attack vectors including bugs in software? no
Can all those all reasonably be closed? no
It's good to close as many attack vectors as possible but in the modern hostile world I would still keep antivirus as a second line of defence.
Afaict it won the market for home-cinema buffs but many normal people don't care about HD enough to pay the extra and lose compatibility with their existing players.
in countries with decent broadband that is
to reliably stream proper HD video you probably want at least a nominal 10 megabit connection that actually delivers a significant proportion of it's bandwidth. How many countries can reliably deliver that?
Plus I bet the quality still won't be good as bluray and the DRM will probably be worse.
From a comment on TFA
"One fix is to delete the bad DAT file the client at "C:\Program Files\Common Files\McAfee\Engine". Delete any av*.dat. Then reboot and the old DAT should be grabbed."