"Nice idea, but what do you do when a worm alters your dns settings?"
Use an OS with security policies that only allow specific software that shipped with the OS to modify those settings? Honestly, I do not understand why Microsoft does not at least ship that as a default policy, especially since Windows can also check program hashes and thus prevent tampering (in theory; I guess "mitigate" is a better way to describe it).
Perhaps you would be interested in looking up the EAL certifications for RHEL, SLES, and Windows Server 2k3 (hint: all three products are certified at EAL 4). NIST/NSA certifications are the closest thing you can get to a nonpartisan, non-politically driven evaluation of security...
What is most interesting about this study is that it lacks any sort of control group. They never evaluated any proprietary solutions. I see a bunch of numbers, and JBoss seems to have the lowest error rates in its class, and hibernate in its class, but there is no way to tell what that means -- how do proprietary application servers and ORMs compare with these? The study is also very misleading; both JBoss and Hibernate are owned by Red Hat, and therefore receive the benefits of a paid security team, yet this is not mentioned anywhere in the study.
So, as we all concluded as soon as we saw this, it is FUD from a Microsoft partner.
"The Dynamic Popup Generator can create pressure pop-ups, unblockable DHTML pop-ups, PictoPop-ups, conditional popups, instant opt-in pop-ups, and rotating pop-ups"."
Wait, I have the answer...keep Javascript disabled for websites that do not really need it! Right now, I have Javascript enabled for...3 websites, all of which are trusted sites from either my job or my school. Popup free browsing, and incidentally, pages use less CPU time.
Seriously, why do we need Javascript to read articles or blogs? If your web apps are abusing Javascript to display ads, maybe it is time to consider not using web apps, or finding "friendlier" companies.
"Your complaints above are not about the licensing, but the cost (albeit in an indirect fashion). If you are prepared to pay for an appropriate Windows license, all of your complaints are addressed."
Which is a licensing issue. You need to pay Microsoft to get a license to use the same software in a different way. In the case of free software, that is not true -- you get a license, and from there, you can do what you wish with the software.
Also, the OP was trying to make the point that Ubuntu costs nothing. I was pointing out that, in fact, there are cases where Windows costs nothing, and that the real issue is the license: the costs may be equal, but the issue boils down to licenses.
The fact that you can download Ubuntu without paying a single cent for it is not a very compelling argument for Ubuntu. Case in point: at my university, we have subscriptions to the "MSDN Academic Alliance" which grants us no-cost downloads of various Microsoft products.
Instead, one should focus on the legal restrictions on that software. MSDNAA lets me get gratis copies of Windows, sure, but reviewing the license reveals some interesting terms; for example, upon graduation, I am supposed to remove the software from my computer. With Fedora (likewise Ubuntu), there is no such restriction: I am free to use the software for any length of time, regardless of my status as a student or my employment. MSDNAA also forbids the use of the software for any use that is not personal or academic; once more, Fedora (etc.) comes with no such restriction.
Purchasing a copy of Windows in order to gain the right to use the software indefinitely only partially addresses that issue. I cannot modify Windows in such a way that allows me to access it remotely while someone else is accessing it (multi-user access). Again, in Fedora, there is no such restriction.
I do not agree with everything RMS/FSF has to say, but in terms of proprietary versus free-libre licensing, they are spot on.
"Be very very careful of what you write! If Linux on the desktop were to get the kind of attraction that Windows or more recently OSX does we would be seeing very different pictures."
*cough* SELinux *cough*
Seriously, Windows security policies out of the box are...effectively nonexistent. Fedora's SELinux policies are in place, enough to prevent the most common attack vectors while managing to not get in the way (at least if you are an end user; if you are advanced enough to have it get in the way, you know how to put SELinux in permissive mode as needed or better yet, to edit your policy). Should Fedora become as popular as OS X, virus writers would need to either hack their way around SELinux or convince victims to disable SELinux (the latter is probably easier, although it could be remedied by the addition of a very prominent warning message whenever SELinux is about to be disabled).
Seriously, with IP, the US would not be relevant in the global economy. IP is a major export from the US, and without it, we could not possibly sustain an economy based on producing goods in other countries.
What is ridiculous is the tolerance the government seems to have for IP abuse.
Ogg will live as long as the MPEG patents live. If Ogg can succeed before the MPEG patents are done, then it will be in the same position PNG is in now: just another format people can choose, with some minor technical advantages.
"That *even* if it is a 'business' person that has an idea, without available competent, perhaps desperate tech workers, the idea may not have the required resources to get it off the ground."
Except that most of the successful companies founded in the past decade were founded either before or after the last recession. It is not easy to get VC money during a recession, especially for an entirely new type of business.
"If the big companies never laid off, they'd retain all the talent and the industry would stagnate."
Why would anything stagnate if big companies never laid employees off? Aside from the fact that new workers are constantly entering the market, one only needs to examine the history of the computing industry to see that innovations can come from big companies:
GUI -- Xerox
Virtualization -- IBM
Cell phones -- Bell labs
Cellular web access -- Nokia
Transistors -- Bell labs
Integrated circuits -- Texas Instruments
Flash memory -- Toshiba
CDs -- Sony and Phillips
Feistel ciphers -- IBM
And so forth. Large companies produce innovations all the time. Why would you assume that without VC backed startups, there would be stagnation?
"I suspect they benefited greatly from the deluge of willing workers out there."
Google -- existed since the mid nineties, and had its growth stunted somewhat by the dot com burst, bloomed most after the end of that recession.
YouTube -- founded after the recession (in 2005)
MySpace -- created deliberately to compete with friendster and capitalize on the voluntary disclosure of marketing-related information by teenagers, who were an elusive advertising audience throughout the 70s, 80s, and 90s (and earlier).
Facebook -- founded after the recession with a business plan involving the sale of market data, voluntarily disclosed by college students, to advertisers by a group business majors, not tech workers.
It is VERY rare that a group of tech workers gets together and creates the "next big thing." Google and Apple were not even original concepts; Google was modeled on similar indexing services from Gopherspace (and intended as an improvement over other attempts at web crawlers), and the Jobs and Wozniak just wanted to make a PC that was easy to assemble and use. Google's advertising capabilities (highly targeted ads) were an afterthought anyway, the original project was more of a web crawler.
Having a lot of unemployed tech workers sitting around does not do anything for the US, those people still have to pay the bills and if they cannot find tech jobs, they just go and work in other industries. It is not easy to convince a venture capitalists to pour money into some nerd's idea during a recession, and without some sort of funding, these projects do not get off the ground.
Right back at you: he was a business major (if you'll grant me the stretch for "businessmen"), not a skilled tech employee, and his associates at the time were graduates with business degrees. There were no tech workers involved in the concept behind Facebook, just a few required for the implementation. The concept that Facebook was a college project to connect some friends together is flawed also: it was create for the purpose of advertising, the business plan was to collect market data in a difficult to target group (college and later high school students) by having them voluntarily submit it. Facebook's creation was not in any way related to tech layoffs.
You are wrong for two reasons: first of all, social networking websites were getting started during the height of the dot-com bubble, and second of all, the two mostly wildly successful social networking sites, MySpace and Facebook, were started by managers, businessmen, and advertisers, not by highly skilled tech workers (although they certainly employed such people).
"A million unemployed but well-educated nerds will probably lead to the next google, Apple or whatever."
Funny, thousands of highly skilled nerds lost their jobs in 2001, yet...the next Google did not form. Neither did the next Apple. The unemployed nerds just found new employment.
We are in the midst of a major economic crisis, and the more Americans who lose their jobs, the worse it is going to get. If a foreign national loses his job and goes back to his country, then his country will take care of him. The US government needs to focus on the US and US citizens right now, and not allow the needs of H1B guests to trump the needs of Americans.
Sounds like a lazy teacher to me. I had a class which had the same project year by year, but the teacher just retained a copy of the final report. Every year, someone thought they could cheat, but the teacher recognized copies of previous years' work (or the teacher's computer did). Why do teachers think that burning notes is a good thing to do?
The topic starter at least understood that this is wrong, and took the initiative to ask for advice on what to do. Sounds like the kind of person who will at least make a stand and say. Frankly, the teacher is being lazy: they should prepare new tests each year if cheating is a problem, not demand that students abandon their notes, and certainly not forcibly remove the notebooks from their backpacks. I would, at the very least, report this to the principal (this is a high school, or so someone else said) and include the phrases "petty theft" and "intellectual property" in that complaint (assuming it is not high school, I would go to the provost with the same complaint).
Or maybe it is just not that important to them? Not everyone spends most of their time online. Some people really only use their computer once in a while and do not see a point in paying more than $10/mo. for something they use for maybe 30 minutes per day.
"Do you not understand the point I was making? The "bypass" is that the malware author needs to add "| cat -" on to the end of a "protected"" command."
Not sure which distro you are using, but on my Fedora 10 system, I got identical denials with or without your "workaround."
Do you understand what you are talking about?
"The fact that I, as a non-root user, can bypass even one SELinux "protection" without having elevated privileges means it isn't "mandatory"."
Except as we have just seen, your workaround does not work. How about you first find something that actually works?
"If by "social engineering", you mean "convincing someone to in some way download your malware", then you are correct. But, that's pretty much a given for any malware, so I don't see what extra effort is required by the malware author to infect an SELinux system."
How about the part where the user needs to edit their SELinux policy, put SELinux in permissive mode, or disable SELinux for certain attacks to be successful? Like I said, find a way to quietly walk around SELinux, then we'll talk.
"If Dan Walsh is responsible for the useless policies installed by default in Fedora 10, then your definition of "decent" is far different from mine. All they do is annoy users, while any malware writer will be able to come up with workarounds that allow install of the malware with no red flags being raised."
Yes, trolls come on to our mailing list (fedora-devel-list) all the time trying to make this point. You can read the flamewars in our archive if you are interested. Like I said, come up with a workaround that actually works its way around SELinux, then we'll talk.
Yeah I did not know about that change until...just now. Pretty much solves 95% of the issues I had with their choice of YouTube for these videos; wish they offered non-encumbered formats (OGG, etc.) but that is really a minor issue, especially since it is not even clear whether or not MPEG codecs violate any laws.
I did not know that this had occurred. Pretty much puts me in the same position: most of my opposition to the use of YouTube centered around the ability to save copies of the videos on my hard drive. Unfortunate that they chose MPEG and not OGG, but I can sooner deal with that than having no option to save copies of government videos.
/me looks for the retract button for some other posted comments...
"I would MUCH rather they used YouTube for their videos"
Good for you. I would rather be able to save the videos on my hard drive without violating some corporate website's TOS. Why not just offer a torrent? That would save bandwidth and allow for higher quality video postings, AND people would be able to maintain a local copy if they want to.
Slashdot Mirror
"Nice idea, but what do you do when a worm alters your dns settings?"
Use an OS with security policies that only allow specific software that shipped with the OS to modify those settings? Honestly, I do not understand why Microsoft does not at least ship that as a default policy, especially since Windows can also check program hashes and thus prevent tampering (in theory; I guess "mitigate" is a better way to describe it).
Perhaps you would be interested in looking up the EAL certifications for RHEL, SLES, and Windows Server 2k3 (hint: all three products are certified at EAL 4). NIST/NSA certifications are the closest thing you can get to a nonpartisan, non-politically driven evaluation of security...
What is most interesting about this study is that it lacks any sort of control group. They never evaluated any proprietary solutions. I see a bunch of numbers, and JBoss seems to have the lowest error rates in its class, and hibernate in its class, but there is no way to tell what that means -- how do proprietary application servers and ORMs compare with these? The study is also very misleading; both JBoss and Hibernate are owned by Red Hat, and therefore receive the benefits of a paid security team, yet this is not mentioned anywhere in the study.
So, as we all concluded as soon as we saw this, it is FUD from a Microsoft partner.
"or a multi billion dollar company with resources to get you out of the shit?"
Oh, you mean like Red Hat? Or maybe Novell? Or any of the other dozens of billion dollar companies that sell open source software/support?
The thing about Microsoft propaganda is that they always leave out key facts and details.
"The Dynamic Popup Generator can create pressure pop-ups, unblockable DHTML pop-ups, PictoPop-ups, conditional popups, instant opt-in pop-ups, and rotating pop-ups"."
Wait, I have the answer...keep Javascript disabled for websites that do not really need it! Right now, I have Javascript enabled for...3 websites, all of which are trusted sites from either my job or my school. Popup free browsing, and incidentally, pages use less CPU time.
Seriously, why do we need Javascript to read articles or blogs? If your web apps are abusing Javascript to display ads, maybe it is time to consider not using web apps, or finding "friendlier" companies.
Personally, I prefer to name my servers after women I have been...involved...with. This easily covers hundreds of systems.
"Your complaints above are not about the licensing, but the cost (albeit in an indirect fashion). If you are prepared to pay for an appropriate Windows license, all of your complaints are addressed."
Which is a licensing issue. You need to pay Microsoft to get a license to use the same software in a different way. In the case of free software, that is not true -- you get a license, and from there, you can do what you wish with the software.
Also, the OP was trying to make the point that Ubuntu costs nothing. I was pointing out that, in fact, there are cases where Windows costs nothing, and that the real issue is the license: the costs may be equal, but the issue boils down to licenses.
The fact that you can download Ubuntu without paying a single cent for it is not a very compelling argument for Ubuntu. Case in point: at my university, we have subscriptions to the "MSDN Academic Alliance" which grants us no-cost downloads of various Microsoft products.
Instead, one should focus on the legal restrictions on that software. MSDNAA lets me get gratis copies of Windows, sure, but reviewing the license reveals some interesting terms; for example, upon graduation, I am supposed to remove the software from my computer. With Fedora (likewise Ubuntu), there is no such restriction: I am free to use the software for any length of time, regardless of my status as a student or my employment. MSDNAA also forbids the use of the software for any use that is not personal or academic; once more, Fedora (etc.) comes with no such restriction.
Purchasing a copy of Windows in order to gain the right to use the software indefinitely only partially addresses that issue. I cannot modify Windows in such a way that allows me to access it remotely while someone else is accessing it (multi-user access). Again, in Fedora, there is no such restriction.
I do not agree with everything RMS/FSF has to say, but in terms of proprietary versus free-libre licensing, they are spot on.
"Be very very careful of what you write! If Linux on the desktop were to get the kind of attraction that Windows or more recently OSX does we would be seeing very different pictures."
*cough* SELinux *cough*
Seriously, Windows security policies out of the box are...effectively nonexistent. Fedora's SELinux policies are in place, enough to prevent the most common attack vectors while managing to not get in the way (at least if you are an end user; if you are advanced enough to have it get in the way, you know how to put SELinux in permissive mode as needed or better yet, to edit your policy). Should Fedora become as popular as OS X, virus writers would need to either hack their way around SELinux or convince victims to disable SELinux (the latter is probably easier, although it could be remedied by the addition of a very prominent warning message whenever SELinux is about to be disabled).
IP laws are the reason the GPL works.
Seriously, with IP, the US would not be relevant in the global economy. IP is a major export from the US, and without it, we could not possibly sustain an economy based on producing goods in other countries.
What is ridiculous is the tolerance the government seems to have for IP abuse.
Ogg will live as long as the MPEG patents live. If Ogg can succeed before the MPEG patents are done, then it will be in the same position PNG is in now: just another format people can choose, with some minor technical advantages.
Except that most of the successful companies founded in the past decade were founded either before or after the last recession. It is not easy to get VC money during a recession, especially for an entirely new type of business.
"If the big companies never laid off, they'd retain all the talent and the industry would stagnate."
Why would anything stagnate if big companies never laid employees off? Aside from the fact that new workers are constantly entering the market, one only needs to examine the history of the computing industry to see that innovations can come from big companies:
And so forth. Large companies produce innovations all the time. Why would you assume that without VC backed startups, there would be stagnation?
It is VERY rare that a group of tech workers gets together and creates the "next big thing." Google and Apple were not even original concepts; Google was modeled on similar indexing services from Gopherspace (and intended as an improvement over other attempts at web crawlers), and the Jobs and Wozniak just wanted to make a PC that was easy to assemble and use. Google's advertising capabilities (highly targeted ads) were an afterthought anyway, the original project was more of a web crawler.
Having a lot of unemployed tech workers sitting around does not do anything for the US, those people still have to pay the bills and if they cannot find tech jobs, they just go and work in other industries. It is not easy to convince a venture capitalists to pour money into some nerd's idea during a recession, and without some sort of funding, these projects do not get off the ground.
Right back at you: he was a business major (if you'll grant me the stretch for "businessmen"), not a skilled tech employee, and his associates at the time were graduates with business degrees. There were no tech workers involved in the concept behind Facebook, just a few required for the implementation. The concept that Facebook was a college project to connect some friends together is flawed also: it was create for the purpose of advertising, the business plan was to collect market data in a difficult to target group (college and later high school students) by having them voluntarily submit it. Facebook's creation was not in any way related to tech layoffs.
You are wrong for two reasons: first of all, social networking websites were getting started during the height of the dot-com bubble, and second of all, the two mostly wildly successful social networking sites, MySpace and Facebook, were started by managers, businessmen, and advertisers, not by highly skilled tech workers (although they certainly employed such people).
Why not? Maybe that would be a problem to store electronically 18 years ago, but in this day and age?
"A million unemployed but well-educated nerds will probably lead to the next google, Apple or whatever."
Funny, thousands of highly skilled nerds lost their jobs in 2001, yet...the next Google did not form. Neither did the next Apple. The unemployed nerds just found new employment.
We are in the midst of a major economic crisis, and the more Americans who lose their jobs, the worse it is going to get. If a foreign national loses his job and goes back to his country, then his country will take care of him. The US government needs to focus on the US and US citizens right now, and not allow the needs of H1B guests to trump the needs of Americans.
Sounds like a lazy teacher to me. I had a class which had the same project year by year, but the teacher just retained a copy of the final report. Every year, someone thought they could cheat, but the teacher recognized copies of previous years' work (or the teacher's computer did). Why do teachers think that burning notes is a good thing to do?
The topic starter at least understood that this is wrong, and took the initiative to ask for advice on what to do. Sounds like the kind of person who will at least make a stand and say. Frankly, the teacher is being lazy: they should prepare new tests each year if cheating is a problem, not demand that students abandon their notes, and certainly not forcibly remove the notebooks from their backpacks. I would, at the very least, report this to the principal (this is a high school, or so someone else said) and include the phrases "petty theft" and "intellectual property" in that complaint (assuming it is not high school, I would go to the provost with the same complaint).
Or maybe it is just not that important to them? Not everyone spends most of their time online. Some people really only use their computer once in a while and do not see a point in paying more than $10/mo. for something they use for maybe 30 minutes per day.
"Do you not understand the point I was making? The "bypass" is that the malware author needs to add "| cat -" on to the end of a "protected"" command."
Not sure which distro you are using, but on my Fedora 10 system, I got identical denials with or without your "workaround." Do you understand what you are talking about?
"The fact that I, as a non-root user, can bypass even one SELinux "protection" without having elevated privileges means it isn't "mandatory"."
Except as we have just seen, your workaround does not work. How about you first find something that actually works?
"If by "social engineering", you mean "convincing someone to in some way download your malware", then you are correct. But, that's pretty much a given for any malware, so I don't see what extra effort is required by the malware author to infect an SELinux system."
How about the part where the user needs to edit their SELinux policy, put SELinux in permissive mode, or disable SELinux for certain attacks to be successful? Like I said, find a way to quietly walk around SELinux, then we'll talk.
"If Dan Walsh is responsible for the useless policies installed by default in Fedora 10, then your definition of "decent" is far different from mine. All they do is annoy users, while any malware writer will be able to come up with workarounds that allow install of the malware with no red flags being raised."
Yes, trolls come on to our mailing list (fedora-devel-list) all the time trying to make this point. You can read the flamewars in our archive if you are interested. Like I said, come up with a workaround that actually works its way around SELinux, then we'll talk.
Yeah I did not know about that change until...just now. Pretty much solves 95% of the issues I had with their choice of YouTube for these videos; wish they offered non-encumbered formats (OGG, etc.) but that is really a minor issue, especially since it is not even clear whether or not MPEG codecs violate any laws.
Thanks for the tip!
I did not know that this had occurred. Pretty much puts me in the same position: most of my opposition to the use of YouTube centered around the ability to save copies of the videos on my hard drive. Unfortunate that they chose MPEG and not OGG, but I can sooner deal with that than having no option to save copies of government videos.
/me looks for the retract button for some other posted comments...
"I would MUCH rather they used YouTube for their videos"
Good for you. I would rather be able to save the videos on my hard drive without violating some corporate website's TOS. Why not just offer a torrent? That would save bandwidth and allow for higher quality video postings, AND people would be able to maintain a local copy if they want to.