"If you had to explain the Nazis to someone who had never heard of WWII but was an Oracle customer, there's a very good chance that you'd end up using an Oracle allegory. "
Thanks for going through the trouble of explaining the bug but as I already stated I know that it is unrelated to the way they manage memory in openssl.
I was replying to your assertion that openssl was allocating memory properly, but mishandling it in this case.
They are NOT allocating it properly. They may decide to borrow some of OpenBSD's stuff - it is a security library, after all - or they may not.
But what they are doing currently with respect to memory management is not a-ok.
Calling malloc() and getting back the exact same contents as the previously freed buffer is not properly allocating memory.
Why not? I mean the memory was "free" at that point right?
Well, it's because you come to rely on that assumption. Assuming you got the same content back is also not properly handling said memory. Notice how one bad behavior encourages another?
This particular bug may still stand, but how many others may still be out there because of the above assumption?
Also, they didn't need to use OpenBSD's stuff - any standard malloc would have caused OpenSSL to abort the connection in this case, as Ted shows in his blog post.
If you absolutely need (and can afford) to roll your own, sure, no problem.
But I'd say you need to make sure that you do "at least as good" of a job as the standard stuff, in the areas that are relevant to your software.
In this case since you are writing a security library, you can't really ignore security additions to malloc etc. as irrelevant.
You may want to either test on those specific platforms, or incorporate those additions into your custom built stuff. Because, again, you are writing a security library that's used by half the web.
If you don't have the time and / or manpower for that, then essentially you are choosing between performance and security - and you are doing security so the choice should be obvious.
The second argument is the rather obvious fact (by now) that memory management has had a significant impact in the general security (or lack thereof) of software. So you can't just dismiss it on the grounds that "it's just memory allocation" because it's not.
You're missing the point. Nobody is saying we should stop using base-2 in computing, on the contrary.
Just that we should stop calling 1024 bytes a "kilobyte" and so on.
Grocery shopping is a chore for me (well, most shopping is), but making sure I'm getting fresh and tasty stuff is worth the two hours I put in it every two weeks.
What are Microsoft going to do now? Revoke the key they used to sign drivers with? How many copies of Vista wich verify drivers with the now-revoked pubkey have already been sold?
I was under the impression that each certified vendor was issued their own driver signing certificate, issued by the trusted CA. Thus, all MS has to do is revoke that specific certificate, and notify everyone via automatic update. I am not very familiar with Vista so I might be wrong though.
Making poor imitations of crappy ideas isn't clear indication of talent; quite the opposite, in fact.
I for one don't agree with "poor" nor "crappy". Lots of people (myself included) use (and like).NET and C#, and Mono is starting to become quite good IMO.
You forgot "want" before "believe", and we all know the result of introducing yet another nonstandard web extension is. I mean, it's worked so well for Microsoft in the past: proprietary JavaScript extensions, HTML extensions, ActiveX. It's just brought the web together into a nice, unified platform, so you never have to worry about how every different browser handles your website. Oh wait, no it hasn't: just the opposite.
If I understand correctly, Silverlight is something like Flash; that is, there is/will be a "player" (running managed code) for every OS rather than an implementation in every browser (please correct me if I'm wrong). Less things to go wrong in my opinion. And it's not like Flash is a "standard web extension" or has any real good (as in latest features) "player" implementations outside the proprietary one; however, it seems to be doing fine for itself.
How about: d) Proactively discourage its use; build, distribute, and support and alternative framework that is not under the control of a corporation known for breaking compatibility regularly to discourage competition. Get this into Firefox and build an IE plugin to support it.
Well, the Java applet has been out there for a long time, go use / improve it instead of complaining.:) Or use something else. But I still don't see the answer as to why should we "proactively discourage" Silverlight - is it JUST 'cause it's from MS? Even if it may be good? That sounds a bit like fanboy-ism to me.
And why exactly would I care about your pet project?
I think you just asked the question that so many others are asking about Mono.
I think that's a bit unfair. Miguel is not pushing Mono in your face; instead he says he will add functionality to it - not actively requiring your support - and your reply is "why should we care"? If you don't care then why are you replying to him?
"What's "crap" to you doesn't seem like crap to others."
True, but nevertheless it can not be denied that there *is* crap. It can't be denied that there is crap TO YOU. People buying it do not find it crap, and as such, it is NOT crap in an absolute sense. Conversely, they might think what you entertain yourself with is crap, but of course, it is not. Not everybody thinks like you and likes what you like:)
Thus, the only thing remaining is to ask oneself if, on average, films that are made purely for the money are more often than not crap compared to films that are made as an art form. I would claim it is, and I'm not exactly the only one to think so, if I may be so bold. See above. You're not exactly in the majority either, if we are to believe the sales numbers.
Which is another way of saying that "voting with their wallets" isn't really a good measurement of the quality of a film. In fact, if you would put all my money I spend on movies together, I think the majority of it will have gone to commercial films as well...but as I said, that doesn't mean I don't realise that the quality of those films is often less than some EU-movies I've seen who weren't box-ofice successes. See above and above-above. Seriously dude, nobody put you in charge of judging quality for us all. Let us choose.
I'd rather go with critical acclaim then by pure wallet-voting I'd rather go with the latter. See,we think differently:). What do we do, take a vote I guess.
I'm not sure; I don't know how much the movie-industry contributes to the GDP or overall taxes of the USA. I doubt it's anything compared with, say, a war in Iraq. As for the EU; there it would be completely negligable.
Way to own the discussion with an Iraq reference. It has absolutely no relevance on this topic.
Also, one of my complaints was the lack of hard data and abundance of speculation by all people pushing this (piratpartiet.se etc.) How do you know it would be negligagle? What is the general estimate on spending for this?
"The annual budgets generally get spent and then some (deficits anyone?) on things like health care, education, and yes, culture. Where is all that extra money going to come from?"
From taxes. I'm not sure what you're getting at. Budgets are never fixed completely; they always differ from year to year. It's true all want a part of it, education as well as defence...but you seem to think it would amount to double digits of the GDP, while even with a huge boost it wouldn't go beyond a single digit. In the past, governments have always shifted money to diferent departments, including an extra 3 billion a month for wars, or to reform eucation, or, indeed art. It's nothing beyond the impossible to do it when the movies needs to be extra subsidised.
Like I said, data please, no speculation. Do you have an estimated tax increase (just for, say, movies & co, without counting the pharmaceutical patent reform discussed elsewhere in this thread?) If not, are you prepared to push this with "we'll figure the cost later"? I'm not.
"As for new forms of philanthropy, it's just speculation at the moment. People generally have been known to look after their own interest first."
Heh.There we go again, with the typical self-centered explanation. I think people have been reading too much 'the selfish gene' and not realised it's been long shown to be flawed. In reality, people do not 'generally' look after their own interest at all. I must be living on another planet then:)
In this context, it means "if people have a choice between paying and not paying for something, generally they'll choose the latter". Let's just leave it at that.
There is no real gain in being eternally conservative. Societies change; they always have and they always will. I don't really have fear of a changing society, but perhaps that is different for people who mistrust any big change. Change can be good, or it can be bad. I support good change, I just don't think this proposal is it.
I'm not dictating anything. I'm offering what I think are helpful suggestions.
However, copyright is dictating that I may not, for non-commercial purposes, use one of the most basic features of digital media -- to duplicate it freely. I for one don't want people dictating to me what I may or may not do with digital media.
If that digital content is not created by you then I think you should not be allowed to copy and use it without the creator's consent, regardless of how easy it is to do. You don't HAVE to do it; this isn't food and water we're talking about.
Once you get that consent, sure, private copy all you like. I think we just see things differently on this topic.
[...]I don't know if *everything* would be replaced to the same amount, true, but then again, if it means less crap, I wouldn't mind too much.[...] What's "crap" to you doesn't seem like crap to others. Nobody pays for what they deem to be crap. Personally I like a system where people vote with their wallets what they like... Anyway, it seems you agree with my first argument - that less will be produced.
But your basic mistake is, that you seem to think it's something static; that, if copyrights were gone, no other mechanism would pop up to at least compensate for a large part.
I, however, I'm quite sure the government would fill in the gap, as well as new forms of philantrophism. [...] The government only has so much money. If I wanted to nitpick I could say it will have even less, as a few industries will all but disappear, and you don't tax donations (am I wrong here?). The annual budgets generally get spent and then some (deficits anyone?) on things like health care, education, and yes, culture. Where is all that extra money going to come from?
As for new forms of philanthropy, it's just speculation at the moment. People generally have been known to look after their own interest first.
Of course, in a certain sense, we can both speculate as much as we want. But wouldn't you think it would be interesting to actually try it out? Sure, knock yourself out, just not where I live:) It just seems to me like there are a lot of things that weren't totally thought out in this rush to "legal file sharing"... Lots of loose ends, lots of speculation.
You can't make a DVD-RIP (or HD-DVD rip or Blu-Ray rip) if no DVD, HD-DVD or Blu-Ray is out on the market.
What market? As soon as somebody gets it and torrents it, it's out there for everyone. It's happening today.
The advent of HDTV is going to spoil people quality wise even more, making them demand higher-quality copies.
Distributing high-quality video on peer to peer is possible, but slow and rather complicated. Yeah, just like the vast majority of people are spoiled by MP3 and are screaming for vinyl-quality digital music. And distributing video is somewhat slow, but not for long. What then?
You see? Nothing really changes, you just replaced a chance to get funded by the government or philantropists with those by (movie)companies. Yes, in the first case, the appreciation is not (or at least less) based on the question how big the profits will be from the movie... but is that really a bad thing?
It's not a bad thing at all, but even today the first case happens a lot less than the second one. There are only so many philanthropists and public money out there; there's a lot more "venture capital". I hope you get my point... If today you can't convince anybody (for whatever reason) to fund your project, good luck doing that when the for-profit companies will get out of the game. The sources of money won't get replaced, just a lot more scarce.
No, change the distribution but keep the copyright so the authors get paid, regardless of type of use (commercial or otherwise). I for one would like more culture to be available for a price, than less for free. But that's just me.
Slashdot Mirror
https://www.youtube.com/watch?...
"If you had to explain the Nazis to someone who had never heard of WWII but was an Oracle customer, there's a very good chance that you'd end up using an Oracle allegory. "
I’m harvesting credit card numbers and passwords from your site. Here’s how.
... are more realistic:
"Ethereum isn't safe or scalable. It is immature experimental tech. Don't rely on it for mission critical apps unless absolutely necessary!"
https://medium.com/@Vlad_Zamfi...
Q. How many gears does an Italian tank have?
A. Six. One forward and five reverse.
Q. Why do Italian tanks have such large mirrors?
A. So the tank commander doesn't miss any part of the action.
etc.
Also, he was using Arabic numerals... I mean, how many more red flags do you need??
Thanks for going through the trouble of explaining the bug but as I already stated I know that it is unrelated to the way they manage memory in openssl. I was replying to your assertion that openssl was allocating memory properly, but mishandling it in this case. They are NOT allocating it properly. They may decide to borrow some of OpenBSD's stuff - it is a security library, after all - or they may not. But what they are doing currently with respect to memory management is not a-ok.
Calling malloc() and getting back the exact same contents as the previously freed buffer is not properly allocating memory. Why not? I mean the memory was "free" at that point right? Well, it's because you come to rely on that assumption. Assuming you got the same content back is also not properly handling said memory. Notice how one bad behavior encourages another? This particular bug may still stand, but how many others may still be out there because of the above assumption?
Also, they didn't need to use OpenBSD's stuff - any standard malloc would have caused OpenSSL to abort the connection in this case, as Ted shows in his blog post.
If you absolutely need (and can afford) to roll your own, sure, no problem. But I'd say you need to make sure that you do "at least as good" of a job as the standard stuff, in the areas that are relevant to your software. In this case since you are writing a security library, you can't really ignore security additions to malloc etc. as irrelevant. You may want to either test on those specific platforms, or incorporate those additions into your custom built stuff. Because, again, you are writing a security library that's used by half the web. If you don't have the time and / or manpower for that, then essentially you are choosing between performance and security - and you are doing security so the choice should be obvious. The second argument is the rather obvious fact (by now) that memory management has had a significant impact in the general security (or lack thereof) of software. So you can't just dismiss it on the grounds that "it's just memory allocation" because it's not.
You're missing the point. Nobody is saying we should stop using base-2 in computing, on the contrary. Just that we should stop calling 1024 bytes a "kilobyte" and so on.
You are confusing Open Source with Free Software.
PA works just great on my machine, but make sure you have a recent version - anything before 0.9.15 had quite a few annoying bugs.
My password is just the letter 'a'. Like in 'apple'. No luck for me then.
Grocery shopping is a chore for me (well, most shopping is), but making sure I'm getting fresh and tasty stuff is worth the two hours I put in it every two weeks.
This was in the 2.0 betas too. I've annoyed many a friend with it ;)
Making poor imitations of crappy ideas isn't clear indication of talent; quite the opposite, in fact.
I for one don't agree with "poor" nor "crappy". Lots of people (myself included) use (and like)You forgot "want" before "believe", and we all know the result of introducing yet another nonstandard web extension is. I mean, it's worked so well for Microsoft in the past: proprietary JavaScript extensions, HTML extensions, ActiveX. It's just brought the web together into a nice, unified platform, so you never have to worry about how every different browser handles your website. Oh wait, no it hasn't: just the opposite.
If I understand correctly, Silverlight is something like Flash; that is, there is/will be a "player" (running managed code) for every OS rather than an implementation in every browser (please correct me if I'm wrong). Less things to go wrong in my opinion. And it's not like Flash is a "standard web extension" or has any real good (as in latest features) "player" implementations outside the proprietary one; however, it seems to be doing fine for itself.How about: d) Proactively discourage its use; build, distribute, and support and alternative framework that is not under the control of a corporation known for breaking compatibility regularly to discourage competition. Get this into Firefox and build an IE plugin to support it.
Well, the Java applet has been out there for a long time, go use / improve it instead of complaining.But I still don't see the answer as to why should we "proactively discourage" Silverlight - is it JUST 'cause it's from MS? Even if it may be good? That sounds a bit like fanboy-ism to me. And why exactly would I care about your pet project?
I think you just asked the question that so many others are asking about Mono.
I think that's a bit unfair. Miguel is not pushing Mono in your face; instead he says he will add functionality to it - not actively requiring your support - and your reply is "why should we care"? If you don't care then why are you replying to him?True, but nevertheless it can not be denied that there *is* crap. It can't be denied that there is crap TO YOU. People buying it do not find it crap, and as such, it is NOT crap in an absolute sense. Conversely, they might think what you entertain yourself with is crap, but of course, it is not. Not everybody thinks like you and likes what you like
Way to own the discussion with an Iraq reference. It has absolutely no relevance on this topic.
Also, one of my complaints was the lack of hard data and abundance of speculation by all people pushing this (piratpartiet.se etc.) How do you know it would be negligagle? What is the general estimate on spending for this? "The annual budgets generally get spent and then some (deficits anyone?) on things like health care, education, and yes, culture. Where is all that extra money going to come from?"
From taxes. I'm not sure what you're getting at. Budgets are never fixed completely; they always differ from year to year. It's true all want a part of it, education as well as defence...but you seem to think it would amount to double digits of the GDP, while even with a huge boost it wouldn't go beyond a single digit. In the past, governments have always shifted money to diferent departments, including an extra 3 billion a month for wars, or to reform eucation, or, indeed art. It's nothing beyond the impossible to do it when the movies needs to be extra subsidised.
Like I said, data please, no speculation. Do you have an estimated tax increase (just for, say, movies & co, without counting the pharmaceutical patent reform discussed elsewhere in this thread?) If not, are you prepared to push this with "we'll figure the cost later"? I'm not. "As for new forms of philanthropy, it's just speculation at the moment. People generally have been known to look after their own interest first."
Heh.There we go again, with the typical self-centered explanation. I think people have been reading too much 'the selfish gene' and not realised it's been long shown to be flawed. In reality, people do not 'generally' look after their own interest at all. I must be living on another planet then
In this context, it means "if people have a choice between paying and not paying for something, generally they'll choose the latter". Let's just leave it at that. There is no real gain in being eternally conservative. Societies change; they always have and they always will. I don't really have fear of a changing society, but perhaps that is different for people who mistrust any big change. Change can be good, or it can be bad. I support good change, I just don't think this proposal is it.
Install both versions of the runtime (or demand their presence if you have no control over deployment).
And I have yet to come across C# v1 code which doesn't compile / run in 2.0, but I'd be interested in an example.
If THIS is meant by 'backwards compatible' then someone needs to check their facts. I mean the 'unlike C#' part.
However, copyright is dictating that I may not, for non-commercial purposes, use one of the most basic features of digital media -- to duplicate it freely. I for one don't want people dictating to me what I may or may not do with digital media.
If that digital content is not created by you then I think you should not be allowed to copy and use it without the creator's consent, regardless of how easy it is to do. You don't HAVE to do it; this isn't food and water we're talking about.
Once you get that consent, sure, private copy all you like. I think we just see things differently on this topic.
I, however, I'm quite sure the government would fill in the gap, as well as new forms of philantrophism. [...] The government only has so much money. If I wanted to nitpick I could say it will have even less, as a few industries will all but disappear, and you don't tax donations (am I wrong here?). The annual budgets generally get spent and then some (deficits anyone?) on things like health care, education, and yes, culture. Where is all that extra money going to come from?
As for new forms of philanthropy, it's just speculation at the moment. People generally have been known to look after their own interest first. Of course, in a certain sense, we can both speculate as much as we want. But wouldn't you think it would be interesting to actually try it out? Sure, knock yourself out, just not where I live
What market? As soon as somebody gets it and torrents it, it's out there for everyone. It's happening today.
The advent of HDTV is going to spoil people quality wise even more, making them demand higher-quality copies.Distributing high-quality video on peer to peer is possible, but slow and rather complicated. Yeah, just like the vast majority of people are spoiled by MP3 and are screaming for vinyl-quality digital music. And distributing video is somewhat slow, but not for long. What then?
Respectfully, would you like me dictating to you the way you will market the stuff you create?
It's not a bad thing at all, but even today the first case happens a lot less than the second one. There are only so many philanthropists and public money out there; there's a lot more "venture capital". I hope you get my point... If today you can't convince anybody (for whatever reason) to fund your project, good luck doing that when the for-profit companies will get out of the game. The sources of money won't get replaced, just a lot more scarce.
No, change the distribution but keep the copyright so the authors get paid, regardless of type of use (commercial or otherwise). I for one would like more culture to be available for a price, than less for free. But that's just me.