Slashdot Mirror


User: Temporal

Temporal's activity in the archive.

Stories
0
Comments
1,094
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,094

  1. Re:As long as there is C... on Analyzing Binaries For Security Problems · · Score: 1

    Sorry, I'm not used to the old C commands. It's still a lot more code, though, when you have to do lots of those operations. And, of course, we're ignoring the problems of checking if malloc returns NULL or who frees the string when it's no longer needed (things which are handled automatically in many other languages).

  2. Re:And what's inside 'class String'? on Analyzing Binaries For Security Problems · · Score: 1

    None of this has anything to do with what I was saying. You're talking about problems with specific implementations of C++, whereas I was talking about fundamental problems in the C language.

  3. Re:As long as there is C... on Analyzing Binaries For Security Problems · · Score: 1
    And some other points... (why do I bother?)

    Let's say you have a function which takes a string as a parameter and copies it into a global variable. Here's the "correct" C:
    char* global = NULL;

    void function(char* str)
    {
    if(global == NULL)
    {
    global = malloc(strlen(str) + 1);
    if(global == NULL)
    {
    fprintf(stderr, "Out of memory\n");
    exit(EXIT_FAILURE);
    }
    }

    strcpy(global, str);
    }
    That's a pain to type all the time. Thus, C programmers will usually be lazy and do this instead:
    char global[50]; /* should be big enough */

    void function(char* str)
    {
    strcpy(global, str);
    }
    Ahh, much easier, right? But, woops, that code has a security flaw!

    In other languages (C++ or Java or whatever) the correct code would look like this:
    String global;

    void function(String str)
    {
    global = str;
    }
    No security flaws here. Also, note that the memory check is unnecessary since C++ and Java throw exceptions when they run out of memory.

    I think I've proven my point now.
  4. Re:As long as there is C... on Analyzing Binaries For Security Problems · · Score: 1

    The point of OSS is that *more* people actually *do* look at the source than with a closed environment, not that *everybody* does.

    That is NOT TRUE. That's exactly my point. Most software companies do code reviews, regression testing, etc. Most open source projects are something whipped up by one or two guys in their spare time. The only testing usually done is actual usage testing, and it's not normally very extensive. Most open source programs are NOT reviewed by anyone other than author. Again, some of the big-name projects might be exceptions, but big-name commercial products also undergo more testing.

    There's just no reason to say that one method or the other results in fewer bugs.

  5. Re:"Amazingly hard"? on Analyzing Binaries For Security Problems · · Score: 1

    It's a whole lot harder then using a simple String class in C++ or Java -- especially when you have to do hundreds of these operations.

    By "amazingly hard", I didn't mean that it's that difficult, but that it's much more difficult than it should be.

  6. Re:As long as there is C... on Analyzing Binaries For Security Problems · · Score: 1
    *sigh* I'm trying to talk about the real world here.

    A string concatination in C:
    char* a = "Hello ";
    char* b = "World!";

    char* c = malloc(strlen(a) + strlen(b) + 1);
    memcpy(c, a, strlen(a));
    memcpy(c + strlen(a), b, strlen(b));
    c[strlen(a) + strlen(b)] = '\0';
    A string concatination in most other languages:
    String a = "Hello ";
    String b = "World!";

    String c = a + b;
    Anyway, if you're trying to tell me that C programmers never use static-sized strings when it's not safe to do so... then I assert that you aren't really a programmer.
  7. As long as there is C... on Analyzing Binaries For Security Problems · · Score: 4, Interesting

    What does this have to do with open source vs. closed? Sure, in theory, every single person who downloads an open source program will review the code themselves to make sure there are no buffer overruns. If they find any, they will of course report them back to the maintainer, who will then fix the bug.

    In practice, this doesn't really happen.

    As an open source developer, I can assure you that very few people are interested in reviewing other people's code for free. I'm sure the bigger projects, like Apache and Linux, manage to get a good amount of code review -- but then, big closed source projects usually do ample code review, too. As for little open source projects, like the ones I run, you're lucky if people even take a peek at the source. Really, no one is interested. I do not believe that open source projects are any more (or any less) likely to have security issues than typical closed source ones (Microsoft aside).

    As long as people are using C, there will always be buffer overruns. C is just that kind of language -- it makes it so amazingly difficult to do simple things (like allocate space for a character string) that programmers naturally take shortcuts (giving the string a static length) without taking the proper precautions (bounds checking). We can't make programmers not be lazy, so the only real solution is to move on to a better language.

  8. Re:another retarded patent suit.... on Yahoo! Settles Patent Dispute · · Score: 2, Insightful

    Not that I support NCR or anything, but in fairness, "computer system for management of resources" is just a title, not the complete invention. At least, my understanding is that the actual invention is far more specific, including specific methods for managing resources or whatever. The patent doesn't cover all computer systems which manage resources, just ones that do it in a certain way which they claim to have invented. This is why patent names always sound absurd -- people for some reason think that the name is the invention, when it's really just an abstract phrase that says something about what the invention does.

    Again, I do NOT support NCR, nor do I believe that their patents are valid, so please don't flame me. I'm just trying to clarify.

  9. Re:Sheeple swallow the hardware dependence line on Technical Glitches Plague BuyMusic.com · · Score: 1

    She meant when iTunes is released for the PC, not the song. Also, I take offense to your implication that work done to create information is of no value.

  10. Re:That Can't Be True! on Gates Provides Windows Crash Statistic · · Score: 1

    Your installation is screwed up and/or your display drivers are wacked. I'd suggest a fresh install.

    I could easily call up a dozen instances when I found myself with a Linux installation that was completely hosed. It's not just Windows.

  11. Re:Win2K on Gates Provides Windows Crash Statistic · · Score: 1

    Err... specifically, I meant to say that the problems are likely the fault of the drivers for your hardware, not the kernel. I suppose you could argue that Linux drivers tend to be more stable, but that's not completely fair since Microsoft doesn't write most Win2k drivers. ::shrug::

  12. Re:Win2K on Gates Provides Windows Crash Statistic · · Score: 1

    Any stability problems you are having with Win2k are certainly issues with your specific hardware or configuration, not general Win2k problems. Not that that is an excuse, but personally I never lock up, and I have my computer running litterally for months at a time. UT2k3 in particular runs perfectly. (More info in my journal.)

    I do like FreeBSD a lot, though. In fact, I convinced the game company I work for to let me do a native FreeBSD release of the game we're working on (simultaneous with the Windows, OSX, and Linux releases). Mmmm... kqueues....

  13. Re:Win2K on Gates Provides Windows Crash Statistic · · Score: 1

    Oi. I must remind myself not to post on slashdot. I make a comment that hardly even goes against what you said, and you take it as a personal attack. Also, ":P" can generally be assumed to mean "this is a joke".

    Anyway, not all desktop systems sit idle all day. Games create quite a bit of this abstract concept called "load". Not the same kind of load, but load nonetheless, and load that relies heavily on technologies like 3D graphics hardware that are changing constantly. As a game developer I typically have some 20 programs open doing various things and a flaky game screwing with my hardware at any particular time, and I have yet to see Win2k "crash".

    Anyway, I don't dispute the fact that unix is better for servers, which seems to be all you're arguing about.

  14. Re:Win2K on Gates Provides Windows Crash Statistic · · Score: 1

    Depends on what you're doing. For servers, yes, Unix is probably more stable. But the instant you throw X into the mix, unix takes a nose dive. In my experience (used Linux exclusively on my desktop for a couple years, now use Win2k exclusively), both systems are quite stable, but there is certainly no clear winner.

    BTW, how did you manage to rack up 20+ years of experience with Win2k so quickly? :P

  15. Re:That Can't Be True! on Gates Provides Windows Crash Statistic · · Score: 1

    Those 5% obviously run Win9x. I don't think anyone claims that Win9x is a stable OS. Win2k, on the other hand, is. I'm not a fanboy. Just stating the facts.

  16. Re:This is absurd on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Selling downloads is almost pure profit. And on those terms people WILL pay for it. You can in fact beat P2P (free) if you provide a usefull and cheap service.

    I completely agree. I would love to be able to buy music directly from artists' web pages and skip the RIAA. And, yes, the RIAA may be a menace to society. But that doesn't make this plan reasonable. If you don't like the RIAA, don't listen to the music they sell. What's so hard about that? There's lots of great music out there that doesn't come from them. Why do you have to pirate their stuff? Just don't listen to it.

    If the music is good enough that someone is willing to pay the RIAA's inflated prices to get it, then they might as well do so. That's how capitalism works. If bands can make a whole lot more money by selling music directly over the net, then they will. It may take a bit of time to transition, but it will happen. There's no need to use vigilante methods to kill the RIAA prematurely.

  17. Re:Economics... on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Sure. In my ideal world, artists would sell their music directly to consumers via the internet. But, that's beside the point.

  18. Re:Economics? Please.... on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Well, great. Then, I say that copyright is a good thing to have. Copyright allows free market economics to apply to information, which obviously leads to more and better information being available, just as it does with goods and services. Without copyright, there is no comparably good way (that I know of) to produce these effects.

    BTW, the defition of a "free market" that I learned in economics specifically stated that there must not be any monopolies. So, anti-trust laws don't seem to be "against strict definitions of a free market".

  19. Re:This is sure absurd on Cringely Proposes a Music Sharing Alternative · · Score: 1

    And I'm not a classical music snob - I merely prefer to listen to properly crafted music played by musicians who have a love of what they do, rather than mechanically generated studio pap.

    You're a snob. Just because YOU don't like some sort of music doesn't mean it is bad. It only means that it doesn't meet your particular tastes. If it was actually crap, people wouldn't buy it. That's how the "free market" works.

    But for a situation to arise where people are forced to pay where a free alternative is available is totally illiberal and against all rational concepts of a free market.

    That's exactly why the free alternative is ILLEGAL. Otherwise, the market for information would not exist!

    Patronage can produce some art, but not much. It certainly will not produce the variety or the quantity that we have today. This is exactly the sort of thing that free markets are meant for -- producing the things people, as a whole, want, rather than just what a few rich snots like. Obviously, the best music will be produced if it is produced using capitalism, but that is only possible if copyright is enforced.

  20. Re:Economics? Please.... on Cringely Proposes a Music Sharing Alternative · · Score: 1

    If people wish to distort free markets by making laws

    I'm confused. Are you suggesting that a free market could work without laws?

  21. Re:This is absurd on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Your examples all sound silly because they are contrived. No, it doesn't make sense to copyright (or patent -- you seem to be confusing the two) a single sentance. Let's take a real-world example, shall we?

    Say I spend four years developing a new programming language. Say this new language allows software to be developed in a mere fraction of the time it would take to write in C, while at the same time making the software more efficient and robust. Such a thing would be an incredible help to our society, obviously. Better software improves just about every industry in existence, which in turn leads to more money and better living standards for just about everyone. We want this, right?

    Now, say that, in order to produce the language, not only did I have to pay for my own livelihood (and, perhaps, that of my wife and children, if I had any), but I had to pay for computer equipment, as well as pay salaries for several full-time assistants. The total cost could easily be over a million dollars.

    You think that people should be entitled to use this language without giving me anything?

    Well, ok, let's just pretend for a minute that your position doesn't sound silly. Now, say I'm this guy, I have the idea for this programming language, but I'm living in a society without copyright. I know that it will take a million dollars to develop, and that I'm unlikely to be able to make any money off of it. Since it is completely impossible for me to fund development, it remains a mere idea. Society loses out on a wonderful invention.

    How can you think that things would be better that way?

    Information has value. If you create something of value, you should be able to make money off of it. As a matter of fact, in order for a capitalist economy to work, you must be able to make money when you create value. Otherwise, people won't create value. Copyright makes it possible to make money off of information -- when that information has value.

    Don't give me shit about "people will do it anyway if they enjoy their work". This may be true in a few cases, but most people don't have that kind of free time -- they have to make money in order to eat. If not for copyright, there would be far fewer programmers and artists, and they would produce far less software, music, movies, or whatever. If you think life would be better that way... well, you're dillusional.

    As for your comment on simply not releasing my work... I fail to see how that helps anything. So, then I have spent a million dollars producing a language and not only do I not get paid for it, but no one uses it either? Huh?

  22. Re:Economics... on Cringely Proposes a Music Sharing Alternative · · Score: 1

    You assume perhaps that without effectively eternal copyright protection, music would never be made.

    No I don't.

    You assume that without the the major labels, nobody would pay musicians... you assume that musicians would starve!

    Err... no... no I don't.

    You may assume that without the RIAA members, nobody would ever "make it big"!

    Umm... actually... no... no I do not.

    Why is it that so often on Slashdot, when people disagree with me, they feel the need to put words in my mouth? Is it really that hard to argue with the points I actually made?

    In my ideal world, artists would sell their music directly to consumers via the internet. No, I certainly don't think we need the RIAA. Does that mean that we should be using methods that are clearly wrong to eliminate the RIAA? If you don't like the RIAA, don't listen to the music they sell. If you can't stand to be without their music, then you should pay for it. It's that simple.

    Your original post sure made it sound like you thought copyright should be eliminated altogether. I'm glad you don't actually think that, because such an idea is absurd. I'll agree that it is not a very elegant system, but I haven't heard nor thought of anything better yet.

  23. Re:This is absurd on Cringely Proposes a Music Sharing Alternative · · Score: 1

    And your point is...?

  24. Re:Economics? Please.... on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Sure, the artist put a lot of effort into making the song, but effort alone doesn't entitle you to compensation.

    If that effort produces utility for other people then, yes, the artist does deserve to be compensated.

    I can spend all day digging holes in my lawn or hauling 40lb sacks of concrete from one end of my house to the other, both of which are far more strenuous than singing a song, but nobody is going to give me money for either.

    Obviously, that effort doesn't produce any utility for anyone, hence you don't deserve to be paid for it.

  25. Re:This is sure absurd on Cringely Proposes a Music Sharing Alternative · · Score: 1

    Hello? Good quality music equipment and recording studios are quite expensive. Furthermore, creating good quality music takes time. People need money to eat and pay rent. Yes, musicians eat too. Before copyright, only those who were already rich or who had rich friends could spend their time on such things. Are you saying that's the way it should be?