Slashdot Mirror


User: Temporal

Temporal's activity in the archive.

Stories
0
Comments
1,094
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,094

  1. Re:GoDaddy does something similar on Wired Strongarms Subscribers? · · Score: 1

    I guess I hadn't seen that. I still think the "Warning: This is going to expire if you don't renew" e-mails are deceptive.

    And, if you read the article, this is exactly what Wired is doing. They tell you that the subscription will auto-renew, but the guy complaining didn't realize this.

  2. GoDaddy does something similar on Wired Strongarms Subscribers? · · Score: 2, Interesting

    If you register domain names or purchase other services through GoDaddy.com, you might find yourself in a similar situation. They don't, to my knowledge, sick a collection agency on you, but they do automatically renew stuff without warning.

    More specifically, deep in the fine print of GoDaddy's terms of service, they mention that they will assume that you want to auto-renew a service when it expires. However, nowhere else do they mention this. In fact, 90 days, 60 days, and 30 days before the service expires, they will send you e-mails saying "This service is going to expire! Renew now so it won't happen!". Naturally, if you're like me, you would assume that such a message is implying that the service will simply end if you do nothing. Not so! Instead, on the day of expiration, you will get a notice from GoDaddy that they have billed your credit card for renewal, like it or not.

    Now, for me, the service in question was not a domain name. I immediately contacted them an asked them to cancel the service and refund me, and they did. However, domain names (their primary business) can NOT be refunded, presumably since ICANN or whoever does not allow this. So, if this happens to you with a domain name, you're screwed.

    Interestingly, GoDaddy also provides a feature that lets you "synchronize" your renewals, making all your services expire on the same date. Since you can renew any service at any time anyway (long before expiration), I see no reason for this feature to exist, other than to trick people into letting GoDaddy auto-renew all of their services at once.

    Moral: Always explicitly cancel renewable services.

    (Side note: Other than the above shady stuff, I find GoDaddy to be a very nice, high-quality service. I don't feel this is reason for a boycott, but you may make your own decision. I certainly would trust GoDaddy over Verisign, but that's not saying much.)

  3. Vulnerability in Apache PROXY, NOT Apache SERVER on Apache Request Smuggling Vulnerability Found · · Score: 3, Informative

    There has been a LOT of confusion among posts here. Let me spell it out:
    1. This vulnerability is in the Apache web proxy version 2.x.
    2. This vulnerability does NOT affect the Apache web server, unless an Apache web proxy is running infront of it.
    3. The vulnerability is discussed on page 12 of the whitepaper. The rest of the whitepaper is about other similar vulnerabilities in other software.


    I read the whitepaper in detail because I have written an HTTP server and wanted to know if I am vulnerable to this attack. The paper actually describes a very large number of attacks, most of which have to do with bugs in old web servers and proxies (not even Apache). Most of the people I see posting here, including those who claim they read the article, are clueless, as they did not read through the whole paper to find the one page related to Apache.

    Well, it turns out that this bug is NOT in the Apache server. It is in the Apache web proxy. So, if you use an Apache web proxy infront of your server (regardless of what actual server software you use), you are vulnerable. Also, if you have clients who use an Apache proxy on their end, they are vulnerable. Server administrators should only worry about the former case, obviously.

    Yes, a lot of people run caching proxies infront of their own web server, such that every single request to the server -- from all clients -- goes through the proxy. This is often done for performance with dynamically-generated web sites. If you have not heard of this type of setup, then you clearly don't have one, and you can ignore this vulnerability.

    The following claims, made in other posts, are FALSE:
    - "It's an HTTP vulnerability, not Apache specifically" (Wrong. The Apache proxy clearly mis-handles requests with a Transfer-Encoding header.)
    - "To affect someone directly, the client browser would have to be compromised to send doctored HTTP requests." (Wrong. The paper is about using malformed requests to damage a server. The client would send such requests intentionally, in order to cause such damage.)
    - This entire post. (The guy only read the first vulnerability described in the paper, not the Apache-specific one.)
    - "Sure, this effects Apache, but this also effects just about all web servers where the request is first filtered through a cache or proxy..." (No, only ones filtered through an Apache proxy.)

  4. Re:Wow is the slash article wildly inaccurate! on Apache Request Smuggling Vulnerability Found · · Score: 1

    Please refer to page 12 of the whitepaper, where the Apache-specific vulnerability is discussed. The paper discusses many vulnerabilities in many different proxies and web servers. The one you are talking about is NOT the Apache one.

    Also note that the vulnerability is in the Apache proxy, not the Apache web server.

  5. Re:Not trolling, they screwed it up. on Interview with Leeeroy Jeeenkins · · Score: 1

    Who says it was supposed to appear real? I interpreted the video as a parody skit which never intended to be realistic. The line you're complaining about was intended to be over-the-top. That's the whole point.

  6. Re:Mod me down... on Interview with Leeeroy Jeeenkins · · Score: 1

    Whoa, there, mods... whoever modded this "informative" is an idiot. The video linked is completely unrelated, and parent poster was obviously trying to be funny...

  7. Re:Um, no. on IETF Approves SPF and Sender-ID · · Score: 1

    The original poster was not specific about why his boss's e-mail was rejected. One possible reason is because his boss was e-mailing someone with a setup like mine. Removing the SPF records from his domain would have solved the problem.

    Of course, you can blame the problem on me for using a forwarding server that doesn't support SRS. Unfortunately, there are so many setups like this out there that you can't possibly rely on everyone updating. Hell, I'm trying to figure out how to make my server compliant, but I'm having trouble finding any web page that gives simple step-by-step instructions for adding SRS support to qmail.

    As long as this is the case, adding SPF records to your domain -- even if done correctly -- is likely to cause some of your outbound e-mail to be lost. I don't know about you, but I find that unacceptable. As such, I will not be adding SPF records to my domain anytime soon.

    It is unfortunate that the SMTP protocol was left so open to misuse in the first place, and that we have no practical way to fix it now. Personally I'd vote for scrapping the whole thing and starting over...

  8. Re:Um, no. on IETF Approves SPF and Sender-ID · · Score: 1

    Say the receiver forwards e-mail to another address. For example, I run my own mail server for my domains, but I have it set up to simply forward all of my e-mail to my gmail account. If gmail were to reject e-mail based on SPF, then any e-mail sent by the grandparent poster's boss to my address would never reach me. Why? Gmail would see the mail as coming from my mail server, which is not authorized to send mail from the grandparent poster's boss.

    Also note that if I subscribe to any mailing lists -- even directly, without using any forwarding on my end -- any mail sent to the list from an SPF-complaint sender would end up being rejected. Why? Because my mail server will see the mail coming from the mail list server, which is not authorized to send mail for the original sender.

    Face it: SPF breaks a lot of very common uses of SMTP.

  9. Re:I challenge you on Keyboards are Good; Mouses are Dumb · · Score: 1

    My point exactly.

  10. I challenge you on Keyboards are Good; Mouses are Dumb · · Score: 1

    I challenge you to a game of any popular FPS or RTS. You use only a keyboard, while I use a mouse. If you insist, I will even play with only the mouse (as long as it's a 5-button with scroll wheel).

    I'll put $10 on me winning.

  11. Re:Not in Duluth, Minnesota on Cell Phone Service as High Speed Internet Link? · · Score: 1

    Eh. In rural Minnesota they have accents, but that's true of just about any rural area. In unban areas like the Twin Cities (where I live) and Duluth (where the original poster lives) they don't.

    I have friends in California and Washington that say I have no accent whatsoever. And those people in movies like Fargo sound really freeking weird to me.

  12. Re:There Is No Comparison on G5 vs. x86 and Mac OS X vs. Linux · · Score: 2, Interesting

    Lamborghini? Did you read the article? They found that Linux was ten times faster for high-end server apps that make lots of system calls. That's more like comparing that old Charger to a shiny new bicycle. I love OSX's GUI too, but is it worth an order of magnitude speed penalty? On a server system? Hell no.

    (I similarly dislike Linux and like OSX, so this article disappointed me. I do think they made some mistakes in their testing. However, the unerlying problems causing the performance issues are certainly real.)

  13. Re:Not in Duluth, Minnesota on Cell Phone Service as High Speed Internet Link? · · Score: 1

    I hate to break it to you, but Minnesotans only have accents in movies.

  14. Re:Only 60%? on 60% Of U.S. Believe Life Exists On Other Planets · · Score: 1

    These are all either variants of hiding from us or involve life living outside our galaxy, where I explicitly said I was only talking about life in our galaxy.

  15. Re:Only 60%? on 60% Of U.S. Believe Life Exists On Other Planets · · Score: 1

    Those are all variants of my point (2).

  16. Re:Hypocritical - not in the least. on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    Then you completely missed the context, since he was quite obviously referring to GCC in particular.

    To be perfectly honest, the guy's broken English and poorly-organized writing did not entice me to read the article in detail. I was mainly going on the Slashdot summary. And even then I was mainly making a related point that I feel strongly about, not directly replying to what he said.

    Oh, so it was some theoretical entity that was being hypocritical, then?

    For a Linux user to say that AIX support is a waste of time is hypocritical, yes. Indeed, for a Linux user to claim that the minority should be ignored in order to focus on serving the majority is absurdly hypocritical. Ulrich makes both claims.

    It's also hypocritical for a Linux user to refuse to port to Windows in an attempt to force people to use Linux. But that point is not directly related to Ulrich's post.

    Because if they're not in GCC, I don't see how that is the least bit relevant.

    My original comment had nothing directly to do with GCC. I was responding to the idea that OSS projects in general should not support "minor" OS's. Even if that wasn't Ulrich's point, it's what the Slashdot summary said, and I wanted to respond to that.

  17. Re:Hypocritical - not in the least. on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    This guy is one of the main GCC hackers.

    GCC is obviously an exception. However, I interpreted the guy's statement as being directed at OSS projects in general, not just GCC.

    Lack of windows support in GCC has little to do with hating windows and a lot more to do with a lack of developers on windows.

    Err. This statement confuses me, being that I've been using GCC for all my Windows coding for several years now.

    And where did Ulrich complain about major software not supporting Linux?

    Again, I wasn't making a direct repely to this guy's statement so much as expressing my opinion on a related topic. But, I'd be surprised if someone who worked for Red Hat didn't want more Windows software ported to Linux.

    Yeah, it's easy to tell others what they should do when you're not doing the work yourself.

    Lines of GPL code designed, written, and released by me in the last year and a half: 43,380

    Operating systems to which I personally ported said code: Windows, FreeBSD, Mac OSX, Linux

    Thank you, have a nice day.

  18. Re:Hypocritical on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    Then compare it to Konqueror, which was way ahead of Firefox at one time but never had a Windows port.

    Yeah.

  19. Re:Sure. on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    For simple numeric code, Java is plenty efficient, sure.

    For real code that utilizes abstraction, synchronization, etc., Java can't be as fast as C or even C++. Though, in practice in most software I would say the difference is irrelevant.

    The real problem with Java is memory usage. I know Java developers who have found that in large-scale projects, they need to reduce the object orientation of their system in order to improve memory usage. Objects have a whole lot of overhead in Java that they just don't have in C++. Every object contains a mutex, a signal, type information, and other crap.

    As an extreme example, imagine trying to represent a 3D model using an array of vectors. You would like each vector to be a Vector object, right? Bad idea. Every one would have to be allocated separately, and would carry Java object overhead far larger than the 12 bytes needed to store the vector's coordinates. So instead you have to do things the old-fashion C way and use parallel or interleaved arrays. Ick.

    All that said, I think Java is a decent choice for many types of software... But if all my apps were written in it, my GB of RAM would be gone way too quick.

  20. Re:Not at all on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    Why should someone creating software for fun feel pressured to support a platform he doesn't want to?

    Indeed, if OSS is to be considered "just for fun", then by all means, do whatever you want. But I think a lot of projects take themselves a lot more seriously.

    For another thing, supporting Windows is in an entirely different class than supporting BSD/Solaris/m68k/x86-64/etc.

    Indeed. As an example, I recently finished a prototype virtual machine for a programming language I designed. It's a bit over 20k lines of C++. This, of course, used a lot of low-level OS features, like direct memory management (mmap/VirtualAlloc) and asynchronous I/O and event processing (AIO/overlapped IO/kqueue/MsgWaitForMultipleObjectsEx/epoll).

    After spending a year developing on Windows, the initial port to FreeBSD took a whole two days. But, from there to OSX took only a couple hours. And writing a generic driver that should work on all POSIX systems was only a few more hours. So, indeed, Win32->POSIX was the hardest part. But compared to the time taken developing the rest of the project, it was practically irrelevant.

    The fact is, if you're smart about it and use the proper abstraction layers, porting is practically a non-issue, even between Win32 and POSIX.

    But "portablity at any expense", like every "X at any expense", is overdoing it.

    I didn't mean it that way. I just think that the average OSS developer needs to take it more seriously than they currently do.

    [*] If being able to build on Cygwin is enough for you, then by all means add support for it, but I'm of the "if you're going to do something, do it right" belief.

    Cygwin is better than nothing. If your project is heavily dependent on shells and other unix-isms, then Cygwin is probably ideal. But I do agree that serious software should go straight Win32.

  21. Re:Hypocritical on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    Some might be toolkit-related (QT isn't free for Windows, last I checked).

    This is a valid reason, but I would encourage developers to avoid libraries which are themselves not portable for whatever reason. There are cross-platform GUI frameworks available.

    Qt's licensing is unfortunate. I don't understand they don't just make it GPL on all platforms. People selling proprietary software on Windows would still have to pay, and they're the only ones with money anyway.

    Others might only have the time/energy to test for one or two platforms - usually the ones they use personally.

    For very small projects, I can understand this. However, I feel like a serious developer should spend a few bucks for a second system to run alternative OS's. Cheap old junk should be fine if it's just for porting.

    Well-written software should not take more than a day or two to port between Unix and Windows, and a few hours to port between various Unix variants, regardless of code size. Though, unfortunately, not all developers know exactly what needs to be abstracted in order to make their code portable.

    Finally, some might believe in promoting free and "more open" (think Mac OS X) OSes by refusing to support Windows. If the application is really stellar, it might encourage use of non-Windows operating systems.

    I don't accept this reasoning. I think a good developer should put users first, not their own OS preferences and ideologies. Let the user choose their OS based on the merits of the OS, not on what software it has.

  22. Re:Hypocritical on Porting Open Source to Minor Platforms is Harmful · · Score: 1

    If Linux and OS X suddenly have better software than Windows, and people see this, might they be more obliged to make the switch?

    Users should choose their OS based on the merit of the OS, not the merit of the software running on it.

    Also, this philosophy forces users to switch all of their software at once. It would be better for most if they could switch gradually (by switching to OSS software while still running on Windows).

    Furthermore, you are locking out users who are completely unable to switch for whatever reasons.

    Basically, you're putting your personal OS preference and ideology above the needs of the user. It's up to you to choose your priorities, but users will tend to prefer software written for them first.

  23. Re:Only 60%? on 60% Of U.S. Believe Life Exists On Other Planets · · Score: 1

    Is there life out there? Probably. Intelligent life? Well...

    Our galaxy is 50,000 light years across. We would expect that a civilization, say, 1000 years ahead of it would have the capability to at least send probes out to most of the galaxy. Yet we have seen no sign of them. This could mean one of a few things:
    (1) They never bothered with space flight for whatever reason. (Seems to me, though, that any being brought about by Darwinian evolution would have the same basic survival and expansion insticts.)
    (2) They're hiding from us. (Why? We would be no threat to them, we clearly want to communicate with them, etc. Even if we are of no interest to them, why would they make the effort to hide themselves? I don't think Columbus ever considered keeping Europe a secret from the native Americans.)
    (3) They are only a few tens of thousands of years ahead of or behind us in development. (Compared to the five-billion year age of the Earth, this is a very short time period. It is unlikely that the first intelligent life to evolve would have others so close behind; you'd expect more of a bell curve.)
    (4) We are the first and, as yet, only intelligent beings to evolve in this galaxy. (Some experts seem to think that our evolution was incredibly lucky. Maybe that's why we're the first?)

    All four of the above are certainly possible, but frankly #4 seems the most likely to me. It's not arrogance; I'm just deriving a conclusion based on the evidence I have. I would certainly like for there to be other intelligent life out there.

    Of course, this is only counting our galaxy. Other galaxies are so far away that #3 becomes considerably more probable.

  24. Hypocritical on Porting Open Source to Minor Platforms is Harmful · · Score: 4, Interesting

    If you write your code to be portable in the first place, fixing platform-specific issues should be quick and easy.

    And, of course, you write your code to be portable because you make sure it runs on the big three: Windows, Mac OSX, and Linux.

    Right?

    Actually, I think a much larger problem is just that: Many OSS developers don't even try to support Windows. Yes, I know you hate the OS and don't want to support Microsoft, etc., etc.. But, how can you complain about major software not supporting Linux when you're writing your own software that doesn't support Windows? Isn't that entirely hypocritical?

    My take: Port your software to every platform you can, especially Windows. This gives freedom of OS to your users. And if you're a Linux user yourself, you should understand just how valuable and important this freedom is.

  25. Re:I don't understand on Illinois Game Law Passes · · Score: 1

    Incidentally:

    (1) Slippery slope is a fallacy.
    (2) There is a reason for Godwin's Law. Please do not make Hitler comparisons.

    In any case, the courts will blow this law away just like they did last time, so don't worry about it. Even the law's sponsors seem to believe that if video games are speech, the law is unconstitutional. They just don't think video games are speech, which is absolutely ridiculous, and will be found as such by any reasonable court.