Personlly I think foreign governments are smart enough to do the ckecks without making a fuss or going public about it. Do you seriously think that the UK, Germany, France, Russia et al dont look at US made products that they use in sensitive areas? The stupid part on this is that the US isnt just doing this quietly. Counter-espionage, just like Espionage works best when people dont know about it. - Especially against a "Friendly" power.
My final point is that microsoft need to drop compatability in at least their home versions of their OS's to improve performance, if it is 30% loss then that is significant. Secondly if it is practicable legacy suport should an add on to the Os (or a different version...) rather than a default inclusion.
Finally compatability only sems to be effective for popular titles therefore throwing out its usefulness in a corporate environment where there are bespoke (and often poorly concieved/coded) legacy applications.
Good discussion though
Point taken but we are taking windows being "slow", possibly due to binary compatibility. binary compatibility is included to support legacy software, not for the purity of binary compatibility.
So to get rid of the issue of binary compatibility, and other methods of allowing legacy code to run (emulation) you either a) don't make stuff compatible or b) recompile the software for the OS or c) make the OS support a large number of legacy binaries by whatever method.
Just because MS have opted to do something that has the impact of (apparently) "slowing" the OS is not a justification for the OS being "slow".
Now just to clarify, your parent article:
They fail to mention that their use of the word "software" only applies to M$ products. Legacy support for other applications is still as flawed as it is on any OS.
I don't think that is true at all. Microsoft spends a fortune supporting other apps that are popular. And you see the difference on Mac something like 10% of all apps need a patch to run after even minor OS upgrades. Linux is much worse. OTOH you can probably run something like 50% of your Windows 3.0 programs today. Neither OS is even close to that. Only Sun does a better job (assuming you consider binary compatibility a plus).
So no I don't see evidence of bias in terms of compatibility.
--------------------
Emphasis mine - suggests that you are not talking about binary compatibility anyway, but any method used to allow legacy code to run, on Linux that method can be either including a shed load of dependencies for pre compiled but legacy applications, recompilation and the inclusion of libraries, emulation or any combination.
This works It does not compromise the OS Is possible due to the Open nature of the software It does require technical knowledge to add some elements of backward compatilbility (which anyway is not as critical as you are unlikley to be simply running a legacy application for the sake of it and therefore would probably be able to invest some time into getting it right)
You can't take a debian 1.3.deb file force and install and expect it to work.
Nope but i can make it work, (and depending on the application it might just work), and don't have to live with all the code that supports that if i don't want it to. Plus If i take a win3.1 application or even a win95 application and try to install (if you are thinking just as a user) or run it on XP i am going to hit some issues, especially if the application isn't 32bit (I've done this a lot, there are quite a few pieces of bespoke financial software that doesn't run on anything other than the OS's they were designed for, not Microsofts fault but still my problem) This is a feature that affects corporate users (who have staff and could deal with installing additional legacy support etc..).
More to the point if the OS is slow because of this issue then why is not offering binary compatibility and other enablers by default such a bad thing, would you rather be able to run a 1990 era application out of the box on your 2005 purchased OS or would you rather have your 2005 OS make better use out of your hardware?
I use Linux because it does what I need it to do, as long as windows works and works well for the people that use it that's good, but when there are features that many people especially home users don't want, and it affects performance why is it included by default?
If some of this bloat is removed not only might it increase the performance of XP (or in future Vista) it may even help clean up the code base and get rid of some of the other issues that the MS code base suffers from. It would be a good thing for Microsoft to do. However, Im not sure if the assumption that backwards compatibility is a major factor for Windows products not performing as well as they might, and I'd like to see some details as to why Windows boxes in a clean environment (i.e. no internet connection, viri etc, regul
I don't think that is true at all. Microsoft spends a fortune supporting other applications that are popular. And you see the difference on Mac something like 10% of all apps need a patch to run after even minor OS upgrades. Linux is much worse..
The bonus with Linux is that you can upgrade elements as you see fit and as you require and decide how much legacy code support you need, you don't have to keep all of it. I have a Debian box that I mess about with that has just been repeatedly upgraded from 2.2 to 2.6.14 (kernel versions) through every minor increment, sure I have had to upgrade a lot of stuff but apt-get upgrade just does it. - I have even gone through downgrades (mainly to match other stuff I am working with) and with a few minor glitches everything has gone well. - whilst with my production boxes I upgrade when I feel there is a valid reason too
More to the point because there are multiple standards of up-to date (/stable/testing/unstable/experimental) there isn't a point where I am most up to date or a point I need to aim for (think WinXPSP2 at the moment with Office2003 SP? Adobe Acrobat 7 Photoshop whatever plus whatever number of security fixes etc etc...). plus with Linux I never had to pay for the upgraded software or OS releases other than with the occasional donation to a project and by making sure I spend some time answering questions in a support forum.
The problem with Microsoft and to a lesser degree with Apple (Apple computer not Apple Corp unless you were getting confused) (I have a powerbook 1400c that got upgraded occasionally a few years back and now is never going to see another change) is that there is a de facto end point that is always shifting and with each shift you need to replace everything affected, with Linux everything kind of goes with the core changes, some things are dropped along the way but you can always add compatibility to support them if they do.
what other OS lets you go back to and download a minor increment version of some software that was released 10-15 years ago with some minor tweaks whilst not including tons of legacy code to support applications that 99% of users no longer use?
And one final point (and one of my favourite bits about the whole Linux platform), is that if I install a new machine I can do so directly using all the software at the version I want with all the legacy support (or none) as I see fit without going through an OS installation, a couple of Service pack installations, some software installations then some software upgrades, then some more windows updates to get to a point where it is secure enough to use and has everything I need in a working configuration. I remember upgrading a Compaq presario from win3.1 through to win2000 by installing each OS as an upgrade, they were all off the shelf OS upgrade CD's except the Win98 install which for some insane reason was on 50 or so floppy Disks. Still got the floppy disks, never know when you might need one:)
Never worked at Oracle but ended up doing an eval of 10g, which whilst it wasnt what I needed, certainly wasnt poor.
I guess I dont understand IT Pro's who arent fanatical about IT and therefore are at least aware of issues like this one - although I admit that I have failed to patch windows boxes when needed to ensure that my dev or production environments stayed stable.
I figure that if you dont patch though you dont get to whine. - Before I get flamed on that point obviously you can only patch when you have a patch available - and if you dont patch you have got to use other forms of protection.
(turning you PC off and leaving it off works well but hurts productivity - or at least should hurt productivity!)
* Usual disclaimer IANAL and I am not involved in IP or copyright issues in any capacity... *
Do you grant royalty free rights to your content? I havent used flickr but the T&C prior to Yahoo's takeover dont seem to cover it. (yahoo refer to you granting them non-exclusive and royalty free redistribution rights or some such) I therefore assume that if you submit content you still hold copyright and therefore have the usual protections (assuming you signed up prior to the yahoo takeover). I doubdt that a change to the T&C's after you agreed them is binding if it infringes on your copyright so someone selling copys of your work without your consent would be a breach
Im probably wrong and I assume that there would be no way of enforcingit anyway but still. Im a fan of copyright as far as preventing abuses is concerned and where it protects legitimate works / individuals etc so if you dont want your content "sold" id check what you can do.
your photos are pretty cool though, who do I contact if i want to mod and use some of them on some sites I am working on???
A few years back I was working for DOD. Someone was trying to make a sales pitch for equipment they wanted to sell us, for use in classified environments. They claimed to be a US company.........The company was a US company in name only. The entire company was infested at the upper levels by former intelligence personnel from one of the above countries already mentioned. Most of their company also, was in this foreign country too. Only a small amount of sales ppl actually were in the US for the company.
Have you simplified your story for the purpose of this post? if so I apologise in advance:)
This company making the sales pitch; they did a god job of hiding the fact that they were hostile then? If you were going to dupe a government into thinking you were suitable for a contract you would have a couple of layers of security to protect yourself wouldn't you? like maybe a US company that thought it was legit, with good American employees, paying good wages etc.. with any intelligence gathering function hidden and not available on say the internet? Maybe something complex that would require whatever agency that deals with counter-intelligence to identify it? (Is that the FBI or have you guys added that to the DHS yet?
I just cant see a foreign company with a US shell walking into the DoD and saying "Hi we are a good American company we would like a contract to deal with your very very secret documents, comrade... I am Ivan, this is Jean and Xi Lu and David are just over there, yeah they are the ones with the trench coats and fedoras.. Anyway, so what about it? "
The Russians, Israelis and others are actually quite good at the whole intelligence thing. Plus espionage is safer if no one knows you are doing it...
As far as this article is concerned I would suggest that the DoD either don't want support functions to be moved outside of the US or that they are worried that information that is sensitive (but probably not classified) could be passed to potentially hostile parties. Now IANAL but - I say not classified because any classified information should be protected by contracts and law in any case, and that kind of stuff doesn't belong to the company but the government and therefore cannot be sold on
I got annoyed with it, I implemented an open source POE system when the company was 2 years old, the board touted it as bespoke and secure, our partners loved it (think major banks) 2 years later I put together proposal for a replacement (after 400% growth of the company) that weighed in at @10k (GBP) - mostly hardware related costs, and the Board rejected it, spent much more on outsourcing to provide the same service and then found it wasn't flexible enough. End result, I did my proposal again, as a contractor...
what I did:
1) Left the company established my own consultancy
2) Became a Sun Advantage Partner (for the hardware)
3) Consult..
Not only does it pay a lot better, it also means that the company gets a better deal in the long run and you can put some of that money back into open source projects. Its amazing how far you can undercut a traditional software provider, I can generally provide a product (Cyrus imap implementation is one of my best) for the price of the hardware and 3 days work, nearest traditional quote usually comes in as multiples of my quote without the hardware or time.
Shame my company is too small to do any real general work (its all hand picked contracts) but at least we are getting them... The only thing I wont do is provide long term support, maybe one day....
Clearly your organisation is taking measures to protect its client base in the event of a failure, however what happens where a SaaS company does not?
This I assume would be the case if a company's primary asset is the code it is using to provide a service (if any hardware considerations such server farms or even device manufacturing are sourced from third parties) and would under worst case scenarios be sold if that company found itself in difficulty....
However even in that situation the buyer would ordinarily have some obligations to the client base of the first company.
But what if it isn't?
Businesses (especially large corporates) have to build their business plans around their reliance on technology and on the companies or organisations providing it, whether that is for continued support, security patches, ongoing development or any other factor.
The level of development and change in the industry now is so fast it is no longer acceptable to simply use the 10 years for the software product to reach the end of its life cycle to identify a new one. The cessation of security patching or development (along a clearly stated roadmap) can be problematic.
Where software is provided as a service the issue becomes even more of a problem, assuming that a SaaS provider does not release code under fixed terms if it goes under, then you may be left with nothing (and this is especially true of small businesses who will see some cost benefit of SaaS) or possibly find that you have to deal with another company from a position of significant weakness.
The open source model prevents some of this by having all the code available, a license that guarantees access to OS derived software to some extent and a community that will generally pick up the pieces when a project fails forking the code.
However to be blunt the only really secure way of procuring ICT services or products is to go with the biggest companies out there (Nobody ever got sacked for buying Microsoft apparently) and ensuring that you have contingency plans. After all if a SaaS or Open source effort fail it is up to the customer base to ensure that their systems are diverse enough to deal with it.
This however is an issue with services in general including outsourcing, web hosts, payment processing etc.. and anyone who provides information to a business (think credit checks and market research). Most of these wont kill a company immediately if they fail but they can do enough damage in the short term to kill the company in the near term after the event.
Telecom is a biggie, any company of a moderate size who doesn't have a decent fail over on comms is dead in the water if it happens. I had a telco go bad on me a while back and it can be difficult to move voice and data comms from one provider to another at short notice but we did have a contingency plan, which was basically sod the savings made from the deal we had with the telco and get on the phone to BT (We were a small company and couldnt justify redundant comms to duplicate our complete requirements in a true N+1 manner) and then work out a better deal later in a more sane manner...
Ah well I digress, I still see some major advantages of open source software over Software as a Service, sadly they are difficult to present to a board without ridicule (why is it when you mention that something doesn't cost anything that anyone above senior management assumes that it is too god to be true?).
No reason you cant upgrade single apps under debian using apt, I do it all the time and generally dont have any issues, plus at least if i do run an update on debian I know that I can always roll back.
-- Whilst Im at it I also know that if I need to upgrade anything else (I use KDE and there are some moderate dependency issues surrounding KDE upgrades) I can always upgrade (or downgrade) everything else.
I love apt.
smbarbour,
A good and valid point, I tend to find that updates to code that I write is smaller than the initial code (as I get better at writing it I suppose). But this is Microsoft we are talking about, you are assuming that the "fixes" will be replacements of existing files, going on experience (XPSP2) the fix may well be a rewrite again. Its true to say that a large number of the fixes usually released by MS are patches in the sense that they replace files found to contribute to or constitute a vulnerability, however aren't the service packs supposed to be when they put all those fixes together in an elegant fashion? (well as elegant as is possible...). Seriously I would expect SP3 to weigh in at 500Mb+ given that it will be cumulative, i.e you should be able to apply it to a vanilla XP install, and that SP1 was @133Mb and SP2 272Mb. I admit that isn't in DVD territory just yet, though it will depend on what "features" are added (I'm thinking DRM and prettiness).
Less seriously here are some predictions:
1. It will break most AV applications immediately
2. At least one MS application will not be compatible when the fix is released
3. SP3a will be available to fix whatever SP3 breaks within two months of the original
4. Something will move (i.e. the network config applet or the accessibility settings)
5. It will be hailed as an all singing all dancing update yet there will be a vulnerability that neither SP3 (or SP3a) address that has been present since Win95 identified shortly after the release...
6. I will have to rewrite anything that hooks into kerberos.... (that's just a potential personal nightmare...)
n.b. I suppose we shouldn't bash MS too much, at least they are releasing patches and service packs. Personally I'll stick to Debian.
Given the number of fixes released annually I assume MS have to wait till 2007 for gigabit boradband speeds to make it a viable download.... or send a SAE for the 7 DVD SP3 set.
Slashdot Mirror
Personlly I think foreign governments are smart enough to do the ckecks without making a fuss or going public about it. Do you seriously think that the UK, Germany, France, Russia et al dont look at US made products that they use in sensitive areas? The stupid part on this is that the US isnt just doing this quietly. Counter-espionage, just like Espionage works best when people dont know about it. - Especially against a "Friendly" power.
My final point is that microsoft need to drop compatability in at least their home versions of their OS's to improve performance, if it is 30% loss then that is significant. Secondly if it is practicable legacy suport should an add on to the Os (or a different version...) rather than a default inclusion. Finally compatability only sems to be effective for popular titles therefore throwing out its usefulness in a corporate environment where there are bespoke (and often poorly concieved/coded) legacy applications. Good discussion though
So to get rid of the issue of binary compatibility, and other methods of allowing legacy code to run (emulation) you either a) don't make stuff compatible or b) recompile the software for the OS or c) make the OS support a large number of legacy binaries by whatever method.
Just because MS have opted to do something that has the impact of (apparently) "slowing" the OS is not a justification for the OS being "slow".
Now just to clarify, your parent article:
They fail to mention that their use of the word "software" only applies to M$ products. Legacy support for other applications is still as flawed as it is on any OS. I don't think that is true at all. Microsoft spends a fortune supporting other apps that are popular. And you see the difference on Mac something like 10% of all apps need a patch to run after even minor OS upgrades. Linux is much worse. OTOH you can probably run something like 50% of your Windows 3.0 programs today. Neither OS is even close to that. Only Sun does a better job (assuming you consider binary compatibility a plus). So no I don't see evidence of bias in terms of compatibility.
--------------------
Emphasis mine - suggests that you are not talking about binary compatibility anyway, but any method used to allow legacy code to run, on Linux that method can be either including a shed load of dependencies for pre compiled but legacy applications, recompilation and the inclusion of libraries, emulation or any combination.
This works
It does not compromise the OS
Is possible due to the Open nature of the software
It does require technical knowledge to add some elements of backward compatilbility
(which anyway is not as critical as you are unlikley to be simply running a legacy application for the sake of it and therefore would probably be able to invest some time into getting it right)
You can't take a debian 1.3 .deb file force and install and expect it to work.
Nope but i can make it work, (and depending on the application it might just work), and don't have to live with all the code that supports that if i don't want it to. Plus If i take a win3.1 application or even a win95 application and try to install (if you are thinking just as a user) or run it on XP i am going to hit some issues, especially if the application isn't 32bit (I've done this a lot, there are quite a few pieces of bespoke financial software that doesn't run on anything other than the OS's they were designed for, not Microsofts fault but still my problem) This is a feature that affects corporate users (who have staff and could deal with installing additional legacy support etc..).
More to the point if the OS is slow because of this issue then why is not offering binary compatibility and other enablers by default such a bad thing, would you rather be able to run a 1990 era application out of the box on your 2005 purchased OS or would you rather have your 2005 OS make better use out of your hardware?
I use Linux because it does what I need it to do, as long as windows works and works well for the people that use it that's good, but when there are features that many people especially home users don't want, and it affects performance why is it included by default?
If some of this bloat is removed not only might it increase the performance of XP (or in future Vista) it may even help clean up the code base and get rid of some of the other issues that the MS code base suffers from. It would be a good thing for Microsoft to do. However, Im not sure if the assumption that backwards compatibility is a major factor for Windows products not performing as well as they might, and I'd like to see some details as to why Windows boxes in a clean environment (i.e. no internet connection, viri etc, regul
The bonus with Linux is that you can upgrade elements as you see fit and as you require and decide how much legacy code support you need, you don't have to keep all of it. I have a Debian box that I mess about with that has just been repeatedly upgraded from 2.2 to 2.6.14 (kernel versions) through every minor increment, sure I have had to upgrade a lot of stuff but apt-get upgrade just does it. - I have even gone through downgrades (mainly to match other stuff I am working with) and with a few minor glitches everything has gone well. - whilst with my production boxes I upgrade when I feel there is a valid reason too
More to the point because there are multiple standards of up-to date (/stable /testing /unstable /experimental) there isn't a point where I am most up to date or a point I need to aim for (think WinXPSP2 at the moment with Office2003 SP? Adobe Acrobat 7 Photoshop whatever plus whatever number of security fixes etc etc...). plus with Linux I never had to pay for the upgraded software or OS releases other than with the occasional donation to a project and by making sure I spend some time answering questions in a support forum.
The problem with Microsoft and to a lesser degree with Apple (Apple computer not Apple Corp unless you were getting confused) (I have a powerbook 1400c that got upgraded occasionally a few years back and now is never going to see another change) is that there is a de facto end point that is always shifting and with each shift you need to replace everything affected, with Linux everything kind of goes with the core changes, some things are dropped along the way but you can always add compatibility to support them if they do.
what other OS lets you go back to and download a minor increment version of some software that was released 10-15 years ago with some minor tweaks whilst not including tons of legacy code to support applications that 99% of users no longer use?
And one final point (and one of my favourite bits about the whole Linux platform), is that if I install a new machine I can do so directly using all the software at the version I want with all the legacy support (or none) as I see fit without going through an OS installation, a couple of Service pack installations, some software installations then some software upgrades, then some more windows updates to get to a point where it is secure enough to use and has everything I need in a working configuration. I remember upgrading a Compaq presario from win3.1 through to win2000 by installing each OS as an upgrade, they were all off the shelf OS upgrade CD's except the Win98 install which for some insane reason was on 50 or so floppy Disks. Still got the floppy disks, never know when you might need one :)
just a thought
Having your corporate VPN un/pw disclosed to [the evildoers] hackers whatever.. - £20
Not telling your boss about it or changing your password after posting the fact on the internet - Priceless
---
alright its lame but it was funny in my head
I guess I dont understand IT Pro's who arent fanatical about IT and therefore are at least aware of issues like this one - although I admit that I have failed to patch windows boxes when needed to ensure that my dev or production environments stayed stable.
I figure that if you dont patch though you dont get to whine. - Before I get flamed on that point obviously you can only patch when you have a patch available - and if you dont patch you have got to use other forms of protection.
(turning you PC off and leaving it off works well but hurts productivity - or at least should hurt productivity!)
So he really should know better then?
Do you grant royalty free rights to your content? I havent used flickr but the T&C prior to Yahoo's takeover dont seem to cover it. (yahoo refer to you granting them non-exclusive and royalty free redistribution rights or some such) I therefore assume that if you submit content you still hold copyright and therefore have the usual protections (assuming you signed up prior to the yahoo takeover). I doubdt that a change to the T&C's after you agreed them is binding if it infringes on your copyright so someone selling copys of your work without your consent would be a breach
Im probably wrong and I assume that there would be no way of enforcingit anyway but still. Im a fan of copyright as far as preventing abuses is concerned and where it protects legitimate works / individuals etc so if you dont want your content "sold" id check what you can do.
your photos are pretty cool though, who do I contact if i want to mod and use some of them on some sites I am working on???
cheers
Have you simplified your story for the purpose of this post? if so I apologise in advance :)
This company making the sales pitch; they did a god job of hiding the fact that they were hostile then? If you were going to dupe a government into thinking you were suitable for a contract you would have a couple of layers of security to protect yourself wouldn't you? like maybe a US company that thought it was legit, with good American employees, paying good wages etc.. with any intelligence gathering function hidden and not available on say the internet? Maybe something complex that would require whatever agency that deals with counter-intelligence to identify it? (Is that the FBI or have you guys added that to the DHS yet?
I just cant see a foreign company with a US shell walking into the DoD and saying "Hi we are a good American company we would like a contract to deal with your very very secret documents, comrade... I am Ivan, this is Jean and Xi Lu and David are just over there, yeah they are the ones with the trench coats and fedoras.. Anyway, so what about it? "
The Russians, Israelis and others are actually quite good at the whole intelligence thing. Plus espionage is safer if no one knows you are doing it...
As far as this article is concerned I would suggest that the DoD either don't want support functions to be moved outside of the US or that they are worried that information that is sensitive (but probably not classified) could be passed to potentially hostile parties. Now IANAL but - I say not classified because any classified information should be protected by contracts and law in any case, and that kind of stuff doesn't belong to the company but the government and therefore cannot be sold on
Um a foreign company already owns those port facilities, P&O are not a US company.
I got annoyed with it, I implemented an open source POE system when the company was 2 years old, the board touted it as bespoke and secure, our partners loved it (think major banks) 2 years later I put together proposal for a replacement (after 400% growth of the company) that weighed in at @10k (GBP) - mostly hardware related costs, and the Board rejected it, spent much more on outsourcing to provide the same service and then found it wasn't flexible enough. End result, I did my proposal again, as a contractor... what I did: 1) Left the company established my own consultancy 2) Became a Sun Advantage Partner (for the hardware) 3) Consult.. Not only does it pay a lot better, it also means that the company gets a better deal in the long run and you can put some of that money back into open source projects. Its amazing how far you can undercut a traditional software provider, I can generally provide a product (Cyrus imap implementation is one of my best) for the price of the hardware and 3 days work, nearest traditional quote usually comes in as multiples of my quote without the hardware or time. Shame my company is too small to do any real general work (its all hand picked contracts) but at least we are getting them... The only thing I wont do is provide long term support, maybe one day....
Clearly your organisation is taking measures to protect its client base in the event of a failure, however what happens where a SaaS company does not?
This I assume would be the case if a company's primary asset is the code it is using to provide a service (if any hardware considerations such server farms or even device manufacturing are sourced from third parties) and would under worst case scenarios be sold if that company found itself in difficulty....
However even in that situation the buyer would ordinarily have some obligations to the client base of the first company.
But what if it isn't?
Businesses (especially large corporates) have to build their business plans around their reliance on technology and on the companies or organisations providing it, whether that is for continued support, security patches, ongoing development or any other factor.
The level of development and change in the industry now is so fast it is no longer acceptable to simply use the 10 years for the software product to reach the end of its life cycle to identify a new one. The cessation of security patching or development (along a clearly stated roadmap) can be problematic.
Where software is provided as a service the issue becomes even more of a problem, assuming that a SaaS provider does not release code under fixed terms if it goes under, then you may be left with nothing (and this is especially true of small businesses who will see some cost benefit of SaaS) or possibly find that you have to deal with another company from a position of significant weakness.
The open source model prevents some of this by having all the code available, a license that guarantees access to OS derived software to some extent and a community that will generally pick up the pieces when a project fails forking the code.
However to be blunt the only really secure way of procuring ICT services or products is to go with the biggest companies out there (Nobody ever got sacked for buying Microsoft apparently) and ensuring that you have contingency plans. After all if a SaaS or Open source effort fail it is up to the customer base to ensure that their systems are diverse enough to deal with it.
This however is an issue with services in general including outsourcing, web hosts, payment processing etc.. and anyone who provides information to a business (think credit checks and market research). Most of these wont kill a company immediately if they fail but they can do enough damage in the short term to kill the company in the near term after the event.
Telecom is a biggie, any company of a moderate size who doesn't have a decent fail over on comms is dead in the water if it happens. I had a telco go bad on me a while back and it can be difficult to move voice and data comms from one provider to another at short notice but we did have a contingency plan, which was basically sod the savings made from the deal we had with the telco and get on the phone to BT (We were a small company and couldnt justify redundant comms to duplicate our complete requirements in a true N+1 manner) and then work out a better deal later in a more sane manner...
Ah well I digress, I still see some major advantages of open source software over Software as a Service, sadly they are difficult to present to a board without ridicule (why is it when you mention that something doesn't cost anything that anyone above senior management assumes that it is too god to be true?).
No reason you cant upgrade single apps under debian using apt, I do it all the time and generally dont have any issues, plus at least if i do run an update on debian I know that I can always roll back. -- Whilst Im at it I also know that if I need to upgrade anything else (I use KDE and there are some moderate dependency issues surrounding KDE upgrades) I can always upgrade (or downgrade) everything else. I love apt.
smbarbour, A good and valid point, I tend to find that updates to code that I write is smaller than the initial code (as I get better at writing it I suppose). But this is Microsoft we are talking about, you are assuming that the "fixes" will be replacements of existing files, going on experience (XPSP2) the fix may well be a rewrite again. Its true to say that a large number of the fixes usually released by MS are patches in the sense that they replace files found to contribute to or constitute a vulnerability, however aren't the service packs supposed to be when they put all those fixes together in an elegant fashion? (well as elegant as is possible...). Seriously I would expect SP3 to weigh in at 500Mb+ given that it will be cumulative, i.e you should be able to apply it to a vanilla XP install, and that SP1 was @133Mb and SP2 272Mb. I admit that isn't in DVD territory just yet, though it will depend on what "features" are added (I'm thinking DRM and prettiness). Less seriously here are some predictions: 1. It will break most AV applications immediately 2. At least one MS application will not be compatible when the fix is released 3. SP3a will be available to fix whatever SP3 breaks within two months of the original 4. Something will move (i.e. the network config applet or the accessibility settings) 5. It will be hailed as an all singing all dancing update yet there will be a vulnerability that neither SP3 (or SP3a) address that has been present since Win95 identified shortly after the release... 6. I will have to rewrite anything that hooks into kerberos.... (that's just a potential personal nightmare...) n.b. I suppose we shouldn't bash MS too much, at least they are releasing patches and service packs. Personally I'll stick to Debian.
Given the number of fixes released annually I assume MS have to wait till 2007 for gigabit boradband speeds to make it a viable download.... or send a SAE for the 7 DVD SP3 set.