Slashdot Mirror


User: Temporal

Temporal's activity in the archive.

Stories
0
Comments
1,094
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,094

  1. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1

    For CBS to work properly, software would have to be distributed as verifiable bytecode. This could be checked for illegal operations then compiled to native code on the end user's system.

    Alternatively, CBS could be implemented at the OS level, but this would not allow programs to use CBS internally. Thus, CBS really has to be a feature of the programming language.

    At the code level, capabilities are represented by objects which implement abstract interfaces. It's basically like extremely strict OOP.

  2. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1

    -how do you plan to make CBS OS and CBS based applications available to everyone?

    CBS does not need to be supported at the OS level if it is supported at the programming language level. I am currently developing a multi-language virtual machine which uses CBS.

    -does building CBS applications require a new language or can it be done with existing language such as C,C++?

    Unfortuntaley, C and C++ are not adequate for CBS since they allow raw pointer arithmetic.

    Java is adequate, though the API would have to be completely redone, and you'd probably want to prohibit non-final static variables.

    Along with my VM, I am developing a language of my own which is ideal for capability-based security. My work is at evlan.org.

    I don't pretend that it will be an easy transition to CBS. However, I believe that it is something we must do if software security is ever going to get better.

  3. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1

    In practice, CBS is just extremely strict OOP. It works great. I've implemented and used it myself.

    None of your questions even make any sense. Remember that a capability is represented by an object, not an API. Yes, you can easily have a very large number of separate objects to represent separate capabilities.

  4. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1
    As long as browsers can execute code, this will not work. You would need to assign capabilities to every code snippet that comes across the wire.

    Which is exactly what CBS does. CBS makes it trivially easy to control exactly what capabilities are accessible to each chunk of code within a piece of software.

    Each chunk of code has no capabilities other than those explicitly given to it by the caller. For example, a procedure which needed to access the filesystem would need to be passed a reference (aka handle, object, descriptor) to the filesystem as a parameter. If it does not receive such a parameter, it can't access the filesystem. (Example below.)

    if it could only guess the filename

    That's not how CBS works. In a CBS API, you can't just pass a filename to some "open" command. You would need to have explicitly received a handle to one of the parent directories of that file, then name the file within that directory. A typical plugin would, if anything, only receive such a handle to its own private directory containing only files meant for that plugin.

    In other words, instead of this:
    void myProcedure()
    {
    File myFile = open("path/to/file");
    }
    You have this:
    void myProcedure(Directory root)
    {
    File myFile = root.open("path/to/file");
    }
    If no directory is passed to myProcedure(), then the expression root.open("path/to/file") clearly makes no sense (root is undefined). Thus, myProcedure() has no way to access the filesystem.

    This makes it very easy to control exactly what parts of your code have access to what capabilities.
  5. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1

    Sorry, you kind of hit a nerve for me. Every time I try to advocate CBS, people dismiss it based on little problems that are easily solved. It particularly bugs me when people tell me that it will not work rather than asking how I would solve a problem, which is what you did.

    In fact, there is now another reply to my original post announcing "this will not work", then proceeding with an argument that shows the poster doesn't understand CBS. *sigh*

  6. Re:How to make a safe web browser... on There Is No Safe Web Browser · · Score: 1

    *sigh* Unfortunately it's really hard to fully explain CBS in the attention span of the average slashdotter.

    There are tons of ways you could make saving and loading files work without introducing any new holes into the system. One way would be to have the OS provide a file open/save dialog. The program requests that the OS produce this dialog, but the OS controls it. Once the user selects a file, the OS returns the capability to read/write just that one file to the program.

    Another (IMO better) way would be to use drag-and-drop. The browser would download the file into its own space to start, then you could drag it from the download manager to your hard drive. Alternatively, to upload files, you'd drag the file onto the form. Again, the OS/GUI would respond to these actions by transfering the capability to read/write just that file to the program.

    It's really easy to dismiss new ideas before you've had the chance to think them through. Please realize that people who have been researching this for years (like me) aren't complete idiots. If you think of an obvious problem with the system, we probably thought of it and solved it long ago.

    Which doesn't mean you shouldn't question the idea, but you don't have to be so rude and dismissive about it.

  7. How to make a safe web browser... on There Is No Safe Web Browser · · Score: 3, Informative

    It's really rather sad that we've given in to the idea that writing secure large-scale software is essentially impossible. It's not. It's only impossible in the paradigm we use.

    Here is how security works on every major OS and in every major programming language today:

    1. Tell the program about all of the features of the OS by exposing them all through an API.
    2. Let the program make any request it wants.
    3. When a request is made, check it against various lists to see if the program is allowed to do it.

    Here's how it should work:

    1. Tell the program only about the features it is allowed to use, by giving the program references to objects implementing these features (i.e. file descriptors, handles, implementations of abstract interfaces, or the like).
    2. Let the program to whatever it wants with them, because you have not even given it the ability to express a dangerous operation.

    This is called Capability-Based Security. Hopefully it is easy to see why the latter would make security much easier to manage. If not, you can read this discussion of the concept.

    CBS allows you to execute code without trusting it. In Unix, you'd have to create a new user with no permissions to run your code, which is way too much work for most purposes. In CBS, you can set up every single program to have a different set of permissions based on that program's needs. Furthermore, the program can internally manage those capabilities to insure that only a small amount of the program's own code has access to them. Then, as long as that code is secure, the program is secure, but even if it isn't, the worst it can do is abuse the capabilities you explicitly gave it.

    How does this relate to web browsers? Well, a web browser really only needs the capability to render to its GUI window, read its install files, and read/write its config and cache. So don't give it any capabilities beyond that. Voila, now it does not matter what malicious program takes over your web browser, because it can't do a thing to your system.

  8. Re:Why does anybody take this guy seriously anymor on McVoy Strikes Back · · Score: 1

    I think he's right, to some extent. Although I wouldn't say open source completely fails to innovate (you and I both have projects demonstrating otherwise), it seems that the projects which get the most support and popularity are the ones that set out to reproduce some functionality that has already been implemented in a proprietary way. I guess the problem is that it's much easier for the potential supporters to see the value in a product which already exists.

    For example, Linux is a Unix clone. Unix is not the pinnacle of OS design. There are tons of projects out there trying to create new, innovative OS's, but we never really hear about them, and so they don't get the attention they need to succeed as open source projects. And, so, we remain stuck with our Unix clone.

  9. Re:prey on Prey To Be Digitally Distributed · · Score: 1

    I think DNF originally was supposed to use the Prey engine. But, then they decided to switch to the Quake engine. The reason? Get this: the Prey engine was going to require a 3D accellerator card, and they didn't think there would be a market for such a game at the time they intended to release DNF.

    I even remember seeing a screenshot Prey with a comment about how nice 16-bit textures looked.

    There's just too many levels of irony here...

  10. Re:VI is still the best... on Final Fantasy Music on iTunes · · Score: 1

    IMO, 6-10 with the exception of 8 were all extremely good in their own ways. 8 was boring as hell. Only one in the series that I enjoyed less was 2 (not to be confused with FF4).

  11. Re:Rediculous pricing on Final Fantasy Music on iTunes · · Score: 1

    I have downloaded and listened to every single OC Remix. Some of them are some of my favorite music ever (Zeal Love by Unipulator!). However, they do not constitute a replacement for the original soundtracks.

  12. Re:Ocremix.org legal? on Final Fantasy Music on iTunes · · Score: 1

    The legality is gray-area, sure. However, given OCR's popularity, I doubt the major game companies are unaware of them. If they wanted to sue, they would have sued by now. I think they realize that OCR is actually a benefit to them: it's essentially free advertising, getting people interested in the original games and soundtracks. If the original copyright holders don't mind, then who cares if it is technically legal?

  13. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    And you go on to say a shorter time limit would not make much difference; but this does not follow from your points, nor is it the logical conclusion to make from them.

    I based it on the assumption that a copyright holder makes most of the money off of a particular piece of information within a few years of releasing it. After those few years, there is not as much left to gain. Maybe this assumption is false, in which case I do not support shorter time limits.

    I believe my earlier argument constitutes adequate proof that copyright is beneficial.

  14. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    If only your 3 points would matter, then there is no reason to set any time-limit on it.

    My three points were meant only to argue that copyright improves the quantity and quality of available information.

    A shorter time limit would probably not make much difference here, but it would increase user freedoms. I do believe such freedoms have value. So, it's a tradeoff between that freedom and having higher quantity and quality of information. I think that a time limit of a few years would fulfill the latter goal well enough, and then the former goal becomes more important.

    Government is all about trading small amounts of freedom for large gains. We give up our freedom to steal, for example, in order to allow a goods-based economy to function. We similarly must give up our freedom to copy information in order to allow an information-based economy to function.

    I believe this tradeoff is well worth it. You apparently don't. I guess that's what it comes down to.

  15. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    Then you shouldn't have used 'IP' in your first posts. 'Intellectual Property' encompasses ALL of the already mentionned subjects, such as copyright, trademark and patents.

    I have not used the term "IP" anywhere in this thread. Only "copyright". You were the one that introduced the term "IP".

    Just saying 'it is obvious' is not enough. It's not for me to demonstrate it is NOT stimulating creativity, since the very reason that it was allowed, was under the pretext that it did or would.

    This is the argument of someone who has no supporting evidence. Of course, if I wanted to use the same argument, I would argue that since you are the one advocating a major paradigm shift, you must demonstrate why it would be a good idea. The current system seems to be working acceptably, so it would be foolish to try undoing it without firm evidence that it will improve things.

    But I don't need to use that argument, because I've already given a good argument. My original 3-point argument still stands, except that I acknowledged that monopolies are a known exception to the rule.

    "OK, this is econ 101 here: Competition forces producers to do as much as they possibly can with the money they earn. If they do not, some other company will beat them. As long as competition exists, more money equates to greater quantity and better quality."

    Then monopolies must be the most inventive and novel producers of high-qualitative products.


    Please re-read what I said. I specifically said that competition must exist. By definition, monopolies have no competition, therefore monopolies are an exception. Again, if you disagree with this point, you are disagreeing with fundamental principles of economics which are taught as fact in any intro econ class (like the one I took in college).

    Standard Oil, AT&T and Microsoft... their huge amount of IP-revenue

    Microsoft is the only information-based company of these three. AT&T was a service company and Standard Oil a goods company. My point was that this problem is not unique to information-based monopolies. Therefore, getting rid of copyright is not the way to fix this apparent problem. (Stricter anti-trust laws are.)

    demonstrates that the supposed inherent logic and 'obviousness' that those who earn much, will work harder, is not correct.

    Again, only in the case of monopolies, which are the only exception to the rule. I support anti-trust laws.

  16. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    The main fallacy here is that because you earn more, you *are* going to work harder.

    OK, this is econ 101 here: Competition forces producers to do as much as they possibly can with the money they earn. If they do not, some other company will beat them. As long as competition exists, more money equates to greater quantity and better quality.

    There is plenty of competition in the software industry and other information-based industries. Your strange belief that holding a copyright is equivalent to being a monopoly is just plain false. Yes, Microsoft has shown how holding a monopoly on an OS or a web browser hurts the quality of these products in the long run, but so did companies like Standard Oil and AT&T. This is not copyright's fault. This is a case of Microsoft happening to gain a monopoly on a core piece of software, then abusing that monopoly power in order to actively thwart their competition.

    Now, it can easily be argued that patents constitute government-backed monopolies. I have serious reservations about patents. The difference with patents is that it is not always easy to produce competition to a patent. If someone patents an idea which is the obvious next step in some technology, they can use that to lock out their competitors. On the other hand, if I write a piece of software and copyright it, that does not in any way prevent others from writing their own software with equivalent functionality. Anyway, I am not arguing for or against patents here; only copyright.

    Looking at the "studies" you linked, I see a whole bunch of papers on patents (irrelevant to this debate) and one which claims that OSS and proprietary software complement each other. The latter is a perfectly reasonable position. I myself believe that some types of software -- particularly general-purpose frameworks and programming languages -- will provide a greater benefit to society if kept open-source. And, sure enough, the open source software products you use as examples (the Linux kernel (though FreeBSD and Darwin are better, from a technical standpoint), Apache, etc.) are such frameworks. Nevertheless, I believe this should be the author's choice, and I believe that many types of software products -- perhaps the extreme end of these being video games -- benefit greatly from copyright.

    Incidentally, I am all for fair use, and would probably support an effort to have copyright terms reduced substantially, to perhaps only a few years. Most copyrighted work makes most of its money in this time, and then once the time limit expires people could build on it as they please. I am not some sort of pro-copyright extremist, but I am also not about to delude myself into thinking that it hasn't brought us any benefit.

  17. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    Actually, ignore my other post. I have a more concise argument.

    You seem to think there is no evidence that copyright increases the quality and quantity of information available. Consider this argument:

    1. Information producers are able to make far more money with copyright than they could without it. (Obviously: All the things they could do without copyright could also be done in addition to selling their work with copyright.)
    2. Most people are willing to produce more and better products if the monetary rewards are greater (this is a fundamental assumption on which our entire economic system is based).
    3. Therefore, the presence of copyright greatly increases the quantity and quality of informational products.

    To argue this, you would have to either show that one of the first two assumptions is incorrect, or show that the conclusion doesn't follow. To me, both assumptions are obvious and the conclusion is just an applications of the transitivity of implication.

    Note that this does not constitute an argument that copyright is just. It is only an argument that copyright increases the quantity and quality of information.

  18. Re:the fallacies of IP on What Would You Ask For in Copyright Law? · · Score: 1

    Since you claim to be a coder, I'm rather amazed by the fact you seem to forget a lot of todays' earnings for software devls is because they make tailored software for specific needs.

    Arrgh! Of course I know that. But obviously not all software can be produced that way. Software which takes more investment to write than it has value for any one entity, but which is useful to a wide range of people (like, say, word processors), can't be written on such a model.

    SUSE and Red Hat clearly demonstrates just that, which you claim can not happen.

    I don't claim it doesn't happen. I claim that it accounts for only a very small amount of software. SuSE and Red Hat write very, very little software of their own, and only things that are critically important to them. You might see Red Hat funding development of Linux or GCC, but do you think they'd spend time working on an CD ripper or a video game?

    OSS, seen as part in the software market, is growing rapidly, and already passed the 1% long ago within the field of software.

    I am speaking in terms of total software produced, not usage. I strongly doubt that OSS accounts for more than 1%. But then, I have no more figures to back it up than you do.

    if we hadn't had IP, all inventions made today would be 100% of the part that were IP-free.

    I would argue that we'd have less that 1% of what we have. For every symphony composed in the renaissance we have many hundreds of albums today, many of them quite good, and covering far more diverse tastes.

    Studies that have been done about IP and innovation in a historical context, have shown that it is not the amount of innovation that lessens if there is no IP, but that it is the kind of innovations made that changes whether or not one has IP protection.

    I would like to see that study. Do you have a link?

    we now have the possibility of thousands of mecenas/fans donating small amounts of money.

    For the vast majority of projects, such a model will bring in far less money, because quite frankly the majority of people won't pay if they don't have to. Less money = less investment in creating the product = lower quality product.

    Freenet has been paying a coder full-time for the last 4 years, thanks to donations, for instance

    There are hundreds of OSS projects out there that deserve those donations far, far more than Freenet does, and yet people donate to Freenet because they're excited by the ability to get copyrighted material for free.

    That's for you to find out.

    Cop out. My whole point is that there is no way.

    If it was about you and your earnings, then one could as well argue that the GPL should be forbidden, because 'how are you going to make money from writing, say, a word processor' when OpenOffice already provides one for free?

    No, we couldn't. People can set any price they want for their products and services, including $0. In that case it's just too bad for the competitors. But that was not my point.

    Let me revise my statement: Without copyright, for the majority of software products, it is impossible to earn nearly as much money as could be earned with copyright. And that directly translates to less and lower-quality software.

    If there was a law, for instance, that gave a monopoly to a food-agency

    The monopoly analogy is FALSE. IP law is not backing a monopoly on word processors, or video games, or operating systems, or any other type of software. You are perfectly free to create your own competing products.

    The reason you can copy a piece of food is because the majority of the cost of producing food is in producting the physical product, not designing the product. You are unlikely to gain much from copying food because you still need the raw ingredients. With software, on the other hand, the majority of the cost of development is in creating information wh

  19. Re:Innocent Question on Darwin 8.0.1 Available · · Score: 3, Funny

    Well, it is a microkernel, if you're into that. It has kqueue() and AIO, which make it better than Linux (although Linux did finally get around to adding full AIO a couple months ago; slowpokes), though FreeBSD obviously has had both of those for a long time. Yeah, I guess it's basically a microkernel FreeBSD. You might---- er, excuse me, but there seems to be an angry mob of Linux users outside my door.

  20. Re:The only 'fair use' on What Would You Ask For in Copyright Law? · · Score: 1

    It's not a cop-out if I argue why it's not important, which I did.

  21. Re:AHEM, Well I would ask for Suicide on What Would You Ask For in Copyright Law? · · Score: 1

    No, try charging by the hour, try charging your fans for a concert. The notion that you need a federally backed copy monopoly is simply wrong.

    Charging who by the hour? Who is going to pay by the hour for me to create something which can then be freely redistributed by anyone who gets ahold of it?

    And obviously fans aren't going to pay to come watch me code. And even if I were a musician, what if I were no good at performing? I know some excellent musicians who aren't performers. Hell, some have nothing to perform in the first place, as they write sequenced music. And anyway, only pretty popular musicians can hope to have enough fans to support themselves through concerts.

    OK, I won't mention open source since that is such a sore point for you, but that is still way off. Nearly the entire renissance happened without copyright.

    Open source and the renaissance both fall under the other 1%. Most of the informational products of the renaissance were created by rich people or funded by rich people, just because they had nothing better to do with their money. Such a system could work today, but would only produce a small fraction (probably less than 1%) of the information available on the market.

    Open source is not solely the product of rich people. However, it seems like most open source software is just reproductions of closed source software. Not only has it taken much longer for open source software to reach the desktop, but it has done so largely by copying ideas researched and developed by software companies which wouldn't exist without copyright. And, again, I'm not anti-open-source. I write OSS. I'm just stating the facts.

    Then you deserve a thankyou, not a federally backed monopoly.

    Few people are willing to spend several man-years and millions of dollars for a "thank you". But, many very important software systems available today required that kind of investment to produce.

    That argument is terrible, it's like arguing "if you don't like slavery then don't own slaves"

    That's got to be one of the most ridiculous false analogies I've ever heard. What I said is much more similar to saying "If you don't like the price I put on my goods, don't buy them!". Surely you believe people have the right to sell physical goods at any price they choose?

    As I mentioned above, I'm sure you can find other ways to bill me for your services.

    Please, by all means, tell me how I can make money from writing, say, a word processor, without copyright. Don't say support, because my hypothetical word processor has such an intuitive GUI that support is unnecessary (and besides that, I have documented it thoroughly; and besides that, my talent is coding, not support, so no doubt someone else will set up a better support service for my software).

    FYI, free markets are about freedoms not about markets.

    Do you have the freedom to steal? Do you think you should?

    Free markets are NOT about absolute freedom and never were. They are about setting up a system of laws which harnesses the inherent greed of mankind and uses it to create the maximum good for all people.

    Look, this is very simple. With copyright, we have a market for information, and that marked drives the production of that information and improvements in it. Without copyright, we would have far less information and it would be of far lower quality. For the majority of people, the former world is much preferable to live in.

    If you choose to reply again, please include in your reply a few examples of information you produced and released into the public domain.

  22. Re:The only 'fair use' on What Would You Ask For in Copyright Law? · · Score: 1

    What's the logical difference between a perfect memory of a book and that same book stored in a computer file?

    Not important. The few people who have such memories (if any exist; it's debated) will just get to keep their perfect copies in their head. The law could perfectly well make an exception for copies stored in one's head, as long as those copies are not then reproduced physically. It's not perfect logic, but sometimes you need to make exceptions.

  23. Re:The only 'fair use' on What Would You Ask For in Copyright Law? · · Score: 1

    When we have technology that can replay my memory of a movie on a screen for other people to watch, *then* do we have to worry about this?

    Only if you are actually using that device to play copyrighted works to people.

    Hrm. As to whether or not you can play it back to yourself... that is an interesting question. I would like to say "yes", but that would mean the music industry would have to stop letting you hear music (on the radio and such) before you buy. And that would suck, because who wants to buy music if they don't know whether or not its good?

    In practice, the version in your head will probably not be entirely accurate, making you still want to buy an official copy.

  24. Re:AHEM, Well I would ask for Suicide on What Would You Ask For in Copyright Law? · · Score: 1

    Copyright is trivially easy to justify: People who create valuable information are performing a service for the rest of us. They deserve compensation for this service. Copyright encourages people with the talent to create these things to do so, whereas otherwise they'd need to spend most of their time doing other things to make money.

    Without copyright, 99% of the art, music, software, video games, etc. that we have today wouldn't exist. Don't start talking about open source; I have released well over fifty thousand lines of my own code under open source licenses. If I were paid for any of it, I could be producing much, much more. As it is, the only way I can support my work is by writing closed-source software for pay. If copyright didn't exist, I wouldn't be able to do that, and I would never have gone into programming in the first place because I wouldn't be able to make money off it.

    If I write some software, why should you have the right to distribute it without paying me? If it weren't for me creating it, you wouldn't have it in the first place. If you don't like the restrictions I put on it, then pretend I don't exist and find some other software to distribute. Or create your own. What's that? Creating your own is too hard? Well, there you go, then. I deserve compensation for assisting you.

    I am open to the idea that a better system that copyright might exist. However, simply repealing copyright without creating any sort of replacement law would be about the stupidest thing any capitalist nation could do right now.

  25. Re:AHEM, Well I would ask for Suicide on What Would You Ask For in Copyright Law? · · Score: 1

    The hell? Your post contains absolutely no argument or supporting points for your position that copyright is unjust.

    Copyright is not a monopoly. You are absolutely free to create your own competing products.