Slashback: Quiesence, Jazz, RAND

Welcome to Slashback for 20011018 -- read below for an update on Code Red (is Red Dead?), RAND patents in Web standards (some semi-good news on that front), the sad death of some MIDI software, and an upgrade for Thailand.

Please write your elected W3C representative. haplo21112 writes "The W3C has posted a next-steps comment on the mailing list for the Patent Policy Frame Work proposal.

It announces among other things that two Open Source People have been added to the working group as Invited experts, Eben Moglen (General Counsel, Free Software Foundation) and Bruce Perens (Co-Founder of the Open Source Initiative). They have also announced a home page for the Working Group at: http://www.w3.org/2001/ppwg/

Especially interesting is the Second Objection noted on the page from IBM, where basically they are revealed as one of the drivers of the proposal. They grumble about RF and pretty much say they would vastly prefer RAND."

You'd like to think so, eh? ColaMan writes: "Is CodeRed finally dead? I've had a counter on my webserver (yay apache!) that tracks attempts, but since the start of the month only 1 lone attempt has been logged on our permanent IP dialup connection (and that was just overnight). This compares to 2490 attempts for August and 931 for September. Nimda still seems to be plodding along though - I've had 159 unique ip's so far this month and 466 for September. Knowing that my IP address is in some bandwidth-forsaken backwater of the internet, I was wondering how things were going CodeRed-wise in the Real Internet?"

I forget -- does the M stand for "Microsoft," or "Macintosh"? An Anonymous Coward writes: "Remember this story from last Tuesday asking about audio applications on linux? Today the Jazz++ mailinglist declared jazz++ dead (find the message here). While not the perfect midi sequencer, jazz++ is robust and GPL'd. Since jazz++ only appeared twice in the postings (each moderated at +1 ...) related to the earlier story, it would seem this fine product has low visibility among the /. crowd. The only viable GNU/Linux midi solution died the same week ./ had a call for audio solutions on Linux. Gotta love irony..."

From Bundesrat to Bangkok Germany may be considering it, but Thailand is doing them one better. TheMMaster writes "According to this article on newsbytes, the Thai government will switch to open-source software, linux on the desktop, StarOffice. This is a nice example of OSS, and probably why a lot of people contribute, to help people (OK and for fun)"

As usual, the actual developers float high above the flames on their behalf. Yep, KDE is 5 years old -- and fm6 writes: "A nice contrast to the usual GNOME-versus-KDE flamage: the users of news.gnome.org wish KDE a happy 5th birthday." Remember, the flame wars you see about these two projects have little to do with the fact that both have already created killer desktops, and are continuing to do so faster than human beings should be allowed to travel.

my nimda stats

[cr@ckwhore]

I've got a small apache server running on the "dirty front lines" of the internet... right in the middle of the 2nd largest cable network in the US, where every tom, dick and harry goes nuts with p2p, porn, spam, and of course, IIS without having a clue about anything significant.

Anyway, my current NIMDA stats: 55,522 hits in the access_log, and they've only slowed down noticeably within the past week. 196 so far today, and today isn't over yet.

I've successfully been able to shut down some of these machines remotely by randomly picking IPs from the log, checking for either open SMB shares or win2k remote administration. With either of those, especially since these sysops are usually the height of insecurity, its been quite easy to contribute my part of NIMDA disinfection.

All I can say is "thank you"

[trilucid]

to those on the Gnome side who were gracious enough to be this polite regarding KDE's birthday :). We've all seen a lot of battle damage on both "sides of the fence" when it comes to the desktop wars, and I for one am glad to see (maybe just momentary) a truce.

It kinda makes one wonder, though, how much energy and how many good ideas are wasted by all the lobbing of insults in the general community. This is a fact of life when it comes to closed-source applications apparently, but in the world of open source it's just dumb. Elitism and smugness hinder progress.

Now, if only the database trolls could take a lesson on this one... sometimes the wars between the various open source factions (mySQL, PostgreSQL, etc) can be worse than anything seen between KDE/Gnome (at least in my opinion).

As to what's better, all I can say is that I use *both* Gnome and KDE (well, KDE a bit more than Gnome these days), and *both* mySQL and PostgreSQL personally (more mySQL than the others, blah blah).

It's all progress, folks. Let's keep it that way :).

Confessions of a Gnome and KDE dual user

[mr_don't]

Happy Birthday KDE, from a GNOME User...

I am one of those people - and there are probably way more of us than not - who (although it does eat up quite a bit of drive space) has both QT and GTK+ libraries and associated files on the computer. Although I always use GNOME (and i think KDE is a bit, well, ugly) I am happy that:

• I am not forced into one window manager or desktop environment (yeah free software!
• and that both GNOME and KDE have taskbar tabs that let you easily find the other's apps (set as default on many distro's - great for newbies...)

Re:die MIDI die

[AirLace]

The article was referring to MIDI used in the context of an intermediary protocol between music hardware and sequencing software. It's the only open and documented interface for musical information interchange between devices and so should be promoted by the community, before the proprietary formats manage to get a foothold. I sympathise with what you say about MIDI songs being played on computers, but you should recognise that that's not what MIDI is all about.

Code Red is not dying, it's Self-Terminating

[Cryptimus]

Code Red deliberately self terminates on October 1st 2001.

There's a check inside the code that essentially sends the server into an endless reboot loop if the month is greater than 9 or the year is greater than 2001.

This pretty much ensures you either fix your server or stay offline.

I guess even a worm writer wants to use the 'Net. Building self-termination into a worm seems like an oddly moral thing to do, however closer examination will probably reveal the author was concerned about the worm making the net completely unusable.

And that would never do.

My cable modem lights don't say so...

[hyrdra]

The activity light is still on rock solid, and there's nothing wrong with the modem. No, I don't have any of the worms because I'm using a broadband firewall.

At my last count, I receive around 500 attempts by these worms each day, usually by other cable users. Before I got a firewall, loading up my Apache log file crashed notepad. My favorite past time has become tracerouting the IPs to see what nearby city they're in. I live in Columbus, Ohio and can easily discern those from nearby towns and locations throughout the city (e.g. pos1-2-colswest or pos4-0-dublin).

I then like to load up Telnet and go searching for root.exe on these computers. When dumped into a root cmd, a carefully placed command copies a file from a share on my computer to the other machine. The file, of course, is an MS update patch or lately one of the clean utilities posted around the net. Another command runs the program and when finished the system is reboot and no longer bothers me.

Now there's an idea...fixing worm systems through their own security holes. I even wrote a little script to automatically attempt to 'fix' an attacking system. Don't just bitch when the same IP keeps pounding you...do something about it!! There's plenty of info out there, and you can get most of the info from the attacking HTTP GET strings.

Or?

[blang]

I guess even a worm writer wants to use the 'Net. Building self-termination into a worm seems like an oddly moral thing to do, however closer
examination will probably reveal the author was concerned about the worm making the net completely unusable.

Or as someone else pointed out, it's to stop the infected host from broadcasting "My owner is a moron, please FIX ME!". If the worm writers main goal was to gather an arsenal of computer slaves, then a wormicide would be the thing to do. When the worm stops spreading the security gurus go away, the press stops spreading panic, and the script kiddies can quietly move in and gorge themself on an unprecedented number of slaves. Now why they'd want to run their advanced skript-kiddie-software on such a lame OS beats me, but then again, I probably don't like their music either.

Re:Recording Industry go Linux?

[Anonymous Coward]

There was /. article months ago about how computer graphics for movies were being moved to Linux render farms. This meant that Hollywood was going Linux. Well, why can't the same thing happen for recording industry

The OS of renderfarm computers isn't so important as renderfarm computers aren't used by people, Hollywood artists work on whatever computer runs the best application of the day and the data from that application is then farmed out to the number crunching machines which the artists never need to see or touch.

I assume (I don't know, but with DSPs and audio being such a small amount of data it seems logical) the recording industry has people actually operating the computers it uses, and doesn't have any need for distributed batch processing. This makes the criterior for the recording industry choosing an OS not really comparable to that of the Movie Industry choosing a render farm OS.

Re:My cable modem lights don't say so...

[Anonymous Coward]

don't do it.
as much as you may be in the right, all it takes is one honeypot for you to get busted.
there is no "Good Samaritan" law for the net.
you're asking to get busted for criminal trespass.

If you do feel obligated to "clean" infected hosts, do it from an infected host - not your machine.

Re:Code Red

[flonker]

I coded up a quick & simple project for Win32 [theperlguru.com] that listens on port 80 for signs of Code Red 1 & 2, and Nimda. In the two weeks I was running it, I got one CR2 unique IP, and hundreds Nimda unique IPs on a DSL line. Most recently, on a T1, I saw the count go down from 30 to 20 Unique IPs for Nimda overnight, but I didn't see *any* CR2 hits.

(As a side note, I wasn't using the warn feature on the T1, but on DSL, about 50% of those warned, fixed their systems.)

Oh yeah, source code is included, but little to no documentation.

Re:jazz++ dead?

[suitti]

The Demudi Linux (Debian) based music distribution is just getting going. Judging by the mailing list, it appears that there are enough people to get the project to move forward. MIDI won't be the first priority for the group (though, an individual might have that priority, who knows?), but it will be a priority soon. This isn't the commercial world. Projects with essentially zero overhead can survive hibernation.

In the early 80's, I asked around if anyone needed certain types of graphic support. One guy said, "Don't bother with it, no one is doing it." My attitude at the time was that no one was doing it because they couldn't. When I provided support, it became extremely popular.

At the moment, I don't know anyone doing MIDI stuff on Linux. When it becomes easier, as I expect with Demudi, it will be much more common.