Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
User Journal

Journal Journal: Best of Slashdot

From roystgnr:

"...there's obviously still a gap between the amount of passion you've spent learning about both subjects and the amount you spend speaking about them. Calm down, take a deep breath, and back slowly away from the Caps Lock key..."

User Journal

Journal Journal: Not your father's Republican Party

We need Republicans.

We need people who will tell business's side of the story, who will make us stop and think about radical social initiatives, people who will balance our national checkbook. That's what we need, that's what the Republican Party used to be about, but it's not what we've been getting for a generation.

Dwight Eisenhower was a great example of a traditional Republican. He believed in strong national defense but looked suspiciously at military adventures: he campaigned against Communism and also against intervention in the Korean War.

He also campaigned against corruption in government. He pushed for government money to be spent on projects with a real return, creating the Interstate Highway System, but still fought to contain the deficit as the Cold War expanded.

Republicans used to fight for their country. Bob Dole has spent sixty years in pain from an arm maimed in World War II. The first George Bush flew patrol torpedo bombers in combat, the most dangerous job in the Navy. He won the Distinguished Flying Cross for completing a mission before ejecting from a shot-up airplane. Nixon, a Quaker, could have been a conscientious objector but served in the South Pacific.

Republicanism used to mean conservatism, and one of the things it conserved was our nation's land and water. The Environmental Protection Agency was an initiative of Republican President Nixon (yes, that Nixon).

Republicans of history knew that they governed for all Americans and worked for the general welfare. Eisenhower presided over an increase in the minimum wage. Nixon tried to pass legislation for a guaranteed annual income.

Republicans were friends of business, but never captives of it. Eisenhower's cabinet was mostly millionaire businessmen, but he warned the country that someday we might be threatened by the corrupting influence of a "military-industrial complex" . He'd never heard of Halliburton but saw the risk.

Republicans then respected the law and the judiciary. When Little Rock's schools defied a court order to desegregate, Eisenhower reluctantly but firmly ordered in the Army to compel them at gunpoint.

Republicans then honored the Constitution and resisted tampering with it. One major conservative group was called Americans for Constitutional Action. In 1964 Republican presidential candidate Barry Goldwater declared "Extremism in defense of liberty is no vice" . Things have changed since then.

In 1999 Republican candidate George W. Bush said "There ought to be limits to freedom" . In 2001 his Attorney General told Congress that people who want to preserve liberty "only aid the terrorists".

Eisenhower would have led the charge to investigate Halliburton, but when a representative of the people questioned Halliburton's no-bid contracts in 2004 the Republican Vice President said, on the Senate floor, "Fuck yourself".

What happened to the Republican Party, and where are the real Republicans now that we need them?

Form has trampled and triumphed over substance since television entrenched itself in our lives during the 60s and 70s. That's hurt our politics. Before television, the Republicans ran a candidate who had led Allied forces to victory in World War II. In 1968 they could still field a man who was a Navy veteran and first in his high school class. By 1980 the Republican candidate was an actor.

Weakness attracts predators, and when a president is easy to manipulate then the manipulators flock in. Incurious minds are at the mercy of their inner circle of advisors. In the shadows, party bosses grow rich, and then make sure the party never endorses someone with the character to oppose them. A party containing brilliant and accomplished men pushes Dan Quayles to the top.

What happened to the real Republicans? They seem to be Democrats now. President Clinton's welfare reform bill was a lot like Nixon's, only stricter. Our last budget surplus was under a Democratic president. Returning Iraq vets who run for office almost always choose to run on the Democratic ticket.

Today's Republican Party, with its obsessive control and blatant corruption, has become more like Democratic Mayor Daley's Chicago of the 60s.

Maybe, though, the problem is simply that the Republican Party has had power for too long and only knows how to seek more power. Barry Goldwater warned about that, too. He said "Those who seek absolute power, even though they seek it to do what they regard as good, are simply demanding the right to enforce their own version of heaven on earth. And let me remind you, they are the very ones who always create the most hellish tyrannies. Absolute power does corrupt, and those who seek it must be suspect and must be opposed" .

User Journal

Journal Journal: Best of Slashdot -- code verification in real life

Yes, it works, but it's not easy
(Score:5, Interesting)
by Animats (122034) on Friday September 29, @11:50AM (#16249347)
(http://www.animats.com)

The main reason program verification didn't catch on was that it was hopeless for C and C++. The semantics of those languages were so messy that formalizing them was nearly hopeless.

Java and C#, however, are good enough. (So were Pascal, Modula, and Ada.)

Here's the manual for the Pascal-F verifier [animats.com], a system written by a team I headed back in the early 1980s. This was a proprietary system done internally for Ford Motor Company. Take a look at the example real time engine control program beginning on page 155. It was painfully slow back then; it took 45 minutes of VAX 11/780 time (1 MIPS) to verify that program from a cold start. Today, it would take about a second.

What's being proved in that example? First, that there are no subscripts out of range or arithmetic overflows. Second, that all loops terminate. (Yes, you can prove that for most useful programs; the halting problem applies only to pathological programs.) Third, that the following constraints hold:

        * fuelpumpon implies (tickssincespark (1000*ms)); if fuel pump is on, spark must occur within 1 sec.
        * (enginespeed rpm(1)) implies (not fuelpumpon); fuel pump must be disabled if the engine is not rotating
        * cylssincespark = 1; a spark must be issued for each cylinder pulse

Useful stuff, the conditions needed to keep the engine running.

This is "design by contract" with teeth. Each function is checked to insure that it always satisfies its exit conditions if its entry conditions are satisfied by the caller, and that the function doesn't overflow, subscript out of range, or fail to terminate. Each call is checked to insure that its entry conditions are always satisfied. The end result is a guarantee that those properties hold for the whole program.

This is a very valuable check. It insures that caller and callee are in agreement on how to call each function. That's the cause of a huge number of software bugs - the caller made some incorrect assumption about the function being called, or the function didn't check for something which it needed to check. Both of those can be statically machine checked.

It's not easy to get a program through formal verification with a verifier like that one. The verifier does almost all the work on easy sections of code, but where correctness depends on anything non-trivial, you have to work with the theorem prover to get the proofs through. This isn't easy. The DEC Java checker and Microsoft's Spec# checker aren't as hard-line.

User Journal

Journal Journal: Best of Slashdot

Not sure how much I agree, but this guy has his grip sunk into at least part of the truth.

Re:For those lawyers out there
(Score:5, Insightful)
by Shihar (153932) on Monday September 25, @10:51PM (#16195925)
>So this is why 2 american presidential candidates were arrested trying to gain entry to the 2004 debates?

The green and Badnark got arrested for trespassing. You can get yourself arrested too without much trouble; that doesn't make this Soviet America. You can't even put the US and a solid half of the world nations on the same scale when it comes to political freedom. Suggesting that you can simply shows deep ignorance about the state of the rest of the world.

>oh please!.. the 2 reigning parties have essentially made it impossible for new parties to form.

I don't disagree in the slightest. You miss the larger point though which we shall get to in just a moment.

ross perot had 2 billion dollars at his disposal. Unless everyone else has that kind of money no.. the system does not work, and how dare you try to pretend otherwise

Ahh, now we are getting closer to the "problem" with American politics...

>And this is why the majority of americans dont vote.. they know it's essentially communist china here with a little potpurri on the grungier and more totalitarian aspects.

And this is where the point flies right over your head. The Americans could have made Ross Perot president if they wanted to. Nazi storm troopers didn't drag Perot off in handcuffs. No evil corporate death squads showed up to prevent people from voting. Americans just didn't vote for him. They could have and they didn't. End of story.

Ask yourself why Ross Perot did so well. To give you a little history, this man for a brief time actually was LEADING in the polls. He only started to get trounced after his somewhat defective personality was brought to light by his public appearances. Ross Perot almost won because of marketing. Don't get me wrong, he had a message too, but what made him different from the Greens and Libertarians that loose each year is that not only was his message centrist enough to appeal (lets face it, the Greens and the Libertarians are extremist), but he had enough money drive his message like a spike through every single American's head.

This is the heart and the root of the problem with American democracy. Americans are too fucking lazy to learn about politics. You need to practically beat the American public in voting. You need to blast the airwaves and the TVs. You need to shove your message down their throat and send out armies of volunteers. The problem isn't that the poor oppressed masses of Americans don't have an alternative. They do have an alternative; they just either don't know about it because they don't bother to look. Even when they do have the alternative (as was the case with Perot), they further fail to not just vote for the alternative, but the majority simply fail to vote. The Americans are not the poor oppressed people whose will have been broken as you make them out to be. They are just flat out lazy and/or stupid. America's lack of choice is American's fault. Pure and simple.

If Americans were not so complicate and easily swayed by corporate sponsored political marketing campaigns, corporations would have no power. If Americans spent 5 minutes on the Internet, found an alternative, then voted for the alternative, the democins and republicrats would be out within a week. The Gestapo isn't going to stop them from voting or rig the election. No one is going to be sent to the Gulag for failing to vote for one of the two established parties. If they simply voted differently, the established parties would vanish.

Any political failures in the American political system are not the fault of evil corporations and politicians. The blame lies completely and ONLY on the shoulders of the voting (and more importantly) non-voting public. The failures of our political system stem directly from a failure to exercise the political power that all Americans over the age of 18 have.

So can it with the inane talk of revolutions and evil corporations. If you think the system is so corrupt, do this one simple thing and you don't need to bother with the guns, the mass protests, and the riots to change the system. Simply get 25% of all the Americans who can vote to vote for one "alternative" candidate. They don't need to arm themselves. They don't need to quit work. They don't need to risk their life and liberty in a peaceful or violently struggle. They need to take just one fucking hour out of their day every 2 years and vote. You don't even need to achieve a majority. Since less then 50% of Americans vote, you actually only need 25% of the voting population to agree. In fact, you need even less if you can leech from people who currently vote democrat and republican.

If you can't accomplish the simple feat of getting a quarter of the population to vote differently, then the problem isn't in the corrupt political system. The problem is SQUARLY on the shoulders of the American people. We let this political system get built and we could sweep it out by simply spending 1 hour every 2 years voting.

So, excuse me while I laugh my ass off at the idea of an American revolution. If you can't even a quarter of the people to waste a messily hour voting for one alternative candidate, you are fucking delusional if you think you are going to get people to roll up their polo shirt sleeves and start a revolution.

The only thing wrong with the American democracy is that it relies on Americans to run it.

User Journal

Journal Journal: Best of Slashdot

Re:Laptop?
(Score:5, Funny)
by OldManAndTheC++ (723450) Alter Relationship on Sunday September 24, @12:46AM (#16173087)

>they aren't designed to be used on laps or any other surface

Drat. Now I'll have to go shopping for a surface-less table. Perhaps "Klein Bottles-R-Us" has what I need...

User Journal

Journal Journal: Best of Slashdot

http://yro.slashdot.org/comments.pl?sid=196550&cid=16103988

Quote:

  by smilindog2000 (907665) on Thursday September 14, @07:01AM (#16103988)
(http://www.billrocks.org/)
We exported freedom during Bush Seniors term, and continued it through Clinton's term. The Berlin Wall fell during Bush Senior, and we ended the Cold War. Bloodless revolutions for freedom and democracy happened throughout the world.

This happened not because we rattled our sabers and conquered the oppressors. It happened because we made a shining example of what democracy can be, and because we convinced the world of our sincerity for a united world in peace. We earned the world's respect, and that made all the difference.

Bush Junior has destroyed all that. Now the world arms itself to defend against us. We are no longer trusted. We no longer exemplify freedom, democracy, and human rights. Hopefully the EU can continue the cause while we figure out how to fix our broken democracy. ...

User Journal

Journal Journal: High points of "How Would a Patriot Act"

A constitutional lawyer named Glenn Greenwald wrote a book which explains the legal and constitutional issues behind some Bush Administration policies.

He used to be apolitical, I mean really apolitical, to the point of not even voting. Then, over the last five years, he's been jolted into action by "theories of unlimited Presidential power which are wholly alien, and antithetical, to the core political values that have governed this country since its founding" (from the preface).

He was living and working in Manhattan on September 11 and eagerly backed the first initiatives against the terrorists. But then, "What first began to shake my faith in the administration was its conduct in the case of Jose Padilla ... The administration claimed that they could hold him indefinitely without charging him with a crime and while denying him access to counsel". He still didn't lose faith until many more abuses piled up.

HISTORY

Congress has cooperated with open requests for surveillance powers. The Combatting Terrorism Act passed without hearings or debate, allowing the FBI to tap Internet communications for 48 hours without a warrant. Congess amended the 1978 Foreign Intelligence Surveillance Act to give the executive branch more flexibility. That was part of USAPATRIOT, which many Congressmen voted for without reading it, trusting the administration to do the right thing in a national emergency. Bush said it was adequate: "This new law I sign today will allow surveillance of all communication used by terrorists". In the same month he ordered the NSA to begin violating the law by spying without even the minimal judicial oversight of the secret and pliable court that oversees FISA taps.

FISA, the 1978 act triggered by scandal after scandal, passed with Republican support including senators like Orrin Hatch. It worked throughout the Cold War, the first Gulf War, and many smaller conflicts. It has specific provisions for use in wartime which still require eventual judicial review.

THE ISSUE ABOUT WIRETAPPING

So why break the law? Greenwald points to the answer: "The only difference between obeying and violating FISA is that compliance with the law ensures that a court is aware of who is being eavesdropped on and how the eavesdropping is being conducted". In a March 2006 reply to Congressional questions the administration admitted that their purpose was to change who made the decisions about probable cause and to eliminate "layers" of review. Certainly the judges weren't getting in the way of normal or even questional eavesdropping: court intern Jonathan Turley said "I was shocked ... I was convinced that the judge would have signed anything that we put in front of him".

IS IT ABOUT MAKING US SAFER?

Yaser Esam Hamdi was a US citizen when he was thrown into solitary confinement for two years without being told what he was accused of. It could have been for life, given the likely duration of the "war on terror". The Supreme Court eventually gave the administration a put-up-or-shut-up order, with even Scalia chiming in with "The very core of liberty secured by our Anglo-Saxon system of separated powers has been freedom from indefinite detention at the will of the Executive". So what was done with this man who was allegedly too dangerous to be allowed to see a lawyer? He was released without charge and sent to Saudi Arabia.

Torture isn't making us safer either. Former CIA officer Bob Baer told reporters it's "bad interrogation, I mean you can get anyone to confess to anything if the torture's bad enough". Torture is where the "evidence" against Jose Padilla came from.

PRESIDENTIAL AUTHORITY

Is the President above the law? His legal adviser John Yoo says so. He told New Yorker report Jane Mayer that Congress "can't prevent the President from ordering torture".

The legal theorists who are defining what a Commander in Chief can do have set forth theories that recognize no limits at all. That's correct, unlimited power. That even includes using awesome war powers against US citizens on US soil.

IS THIS A LIBERAL THING?

It was Reagan's deputy Attorney General, Bruce Fein, who wrote for the Washington Times (December 28 2005) "Congress should insist the President cease the spying unless or until a proper statute is enacted or face impeachment".

Republicans on the Senate Intelligence Committee wanted to hold an investigation until pressured into changing their votes.

Republican James Sensenbrenner said "I think that ... is stonewalling".

BUT AREN'T WE IN DANGER NOW? ISN'T THIS PRE-9/11 THINKING?

We were in danger in 1789 when the mightiest nation on earth was our enemy. The Founders still put together a constitution in which the President doesn't get to interpret, or worse yet violate, the law.

Imprisoning people without charge, counsel, or opportunity to defend themselves is pre-Magna Carta thinking.

Greenwald puts into perspective the fear that the administration promotes by saying "one can protect against the threat of terrorism with courage, calm, and resolve".
 

User Journal

Journal Journal: Best of Slashdot

The insight
"Beating your competition is the side effect that you derive from pleasing customers. It is not the goal."
appears in Harmonious Botch's post http://it.slashdot.org/comments.pl?sid=195164&cid=15992079

User Journal

Journal Journal: Best of Slashdot

>The whole point of being a bully is to build up your own self-respect at the expense of someone else's, a kind of mental vampirism

From ScrewMaster in http://yro.slashdot.org/comments.pl?sid=190617&cid=15682919

User Journal

Journal Journal: Best of Slashdot

The subject was "Teaching Engineers to Write".

http://ask.slashdot.org/comments.pl?sid=185119&cid=15279646 had a superb answer.

Present writing as an engineering problem
(Score:5, Insightful)
by MarkusQ (450076) on Saturday May 06, @08:50PM (#15279646)
(Last Journal: Tuesday January 10, @02:50AM)

Present writing as an engineering problem. This is an accurate, if somewhat unconventional, way to look at it. When you write, you have a goal (communicate a certain set of ideas), some constraints (target length, assumed audience, etc.) and some criteria for ranking proposed solutions (shorter is better, linking ideas in multiple ways gives a more robust treatment, etc.)

This fits neatly into the mold of classic engineering problems. Presented this way, they should be able to (with only a little guidance) bring their full skill set to bear on the problem. For example:

        * Top down design Starting with an outline and working out the details is the normal way of tackling an engineering problem.
        * Checking your facts Engineers should be used to checking anything that is even remotely doubtful before committing to it. So should writers.
        * Failure mode analysis For each sentence ask yourself, could it be misread? How? What is the best way to fix it?
        * Dependency analysis Are the ideas presented in an order that assures that each point can be understood on the basis of the readers assumed knowledge and the information provided by preceding points?
        * Optimization Are there any unnecessary parts? Does the structure require the reader to remember to many details at once, before linking them?
        * Structured testing If you read what you have written assuming only the knowledge that the reader can be expected to have, does each part work the way you intended? If you read it aloud, does it sound the way you intended?

One of the biggest problems with teaching people to write is getting them to read what they have written, think about it, and rewrite it until it does what they wanted it to. Here, at least, engineers should have a head start over most students, insofar as they are used to the fact that your first stab at a design is almost never viable.

--MarkusQ
--
Impeachment: It's not just for blow jobs [thenation.com]

User Journal

Journal Journal: Best of Slashdot

Apple announced a display with image pickups built in between the pixels. Yes, just like 1984's "telescreen".

Richdun asked a logical question:

So if I throw a hammer at it...
(Score:5, Funny)
by richdun (672214) on Wednesday April 26, @01:46PM (#15207589) ...is that covered under the warranty?

User Journal

Journal Journal: Best of Slashdot

Luckily, the USSR always gave a 15-day warning!
(Score:5, Insightful)
by NMerriam (15122) on Saturday March 25, @04:38PM (#14995683)
(http://www.artboy.org/)
Making the meetings public would amount to "giving our nation's enemies information they could use to most effectively attack a particular infrastructure and cause cascading consequences across multiple infrastructures," another departmental advisory council warned in August.

As I recall, in 1972, we were in the midst of fighting a Cold War that had, as a very real possible consequence, the end of life on Earth as we know it. We were fighting against a highly organized and well-funded enemy that had thousands of spies at all levels of government and industry, sleeper agents ready to be called on when necessary, and military capabilities that made us legitimately doubt whether we would prevail in any conventional armed conflict. An attack from their formidable stockpiles of intercontinental ballistic missiles would give us less than an hour to pray to the God of our choice before the sun vanished and our component molecules were suddenly and violently redistributed into the ash that would, hopefully, someday support life again.

And yet, even with this Sword of Damocles hanging over our very survival, we had the conscience and foresight to realize that while we cannot control the behavior of those who would be our enemies, we can control ourselves, and refuse to sacrifice the ideals we believe more important than life in the vain hopes that by abdicating oversight of our government we will somehow gain immunity from outside aggressors.

I find it the greatest irony of all that those in power right now, who present themselves so vaingloriously, act with such great cowardice. Their willingness to preemptively sacrifice the ideals we hold dear is an insult to the oaths they took, and the people who trust them with their lives.

No bomb is capable of destroying the historical significance of the Constitution, the concept of modern representative democracy, religious freedom, free speech, or the notion that man has the right and responsibility to govern himself by reason. Yet we find ourselves in the peculiar position of surrendering these, our most valuable possessions, in the vain hope that they will purchase us safety, when we know with certainty that such safety is a chimera, that our lives will always be in danger so long as we espouse such dangerous ideas.

It does not take courage to hide in a shelter, to stifle dissent or cut yourself off from contrary opinions. It does not take courage to meet in secret, to persecute those who are different, to deny the humanity of those who oppose you.

What takes courage is knowing there are people in this world who hate you so much they will kill you, and to still get up in the morning and walk out the front door, refusing to change your life or your beliefs due to fear. We knew this after September 11th, we were even told this at the time by our leaders, but for some reason both they and we have lost sight of such a simple insight.

User Journal

Journal Journal: Best of Slashdot

http://hardware.slashdot.org/comments.pl?sid=180268&cid=14924013

Re:Not really...
(Score:5, Insightful)
by Daniel Dvorkin (106857) * on Wednesday March 15, @07:12AM (#14924013)
(http://www.sff.net/people/Daniel.Dvorkin)
>Besides, the average marine has about a high school education, no morals and a low threshold for the sanctity of life. They >might as well be robots anyways. :-)

>Sorry folks there ain't no draft and it isn't a mystery that the US war machine is a "tad" corrupt. you sign up for the >military because you want to profit from the misery of others. That is unless you sign up for the military to do something >outside of being a grunt [e.g. doctor, engineer, etc]. Then you're ok.

These people you so casually dismiss as "robots" sign up, generally speaking, when they're eighteen or nineteen years old; they believe, almost without exception, that they are doing so to serve their country, to protect the Constitution and the flag and Mom and apple pie. And you know what? At most times throughout our country's history, they've been right.

Just a few years later, if they're unlucky enough to have enlisted at a time like the current one, they're old men, scarred by things no human being should ever have to see. That's what war (any war, including the "good" ones) does to people. That doesn't happen to robots.

I started out as one of those nineteen-year-old grunts; a couple of years later, dimly sensing what was coming down the pike, I cross-trained as a medic, in which capacity I served in Desert Storm. I had no desire whatsoever to "profit from the misery of others" -- I wanted to serve, and I was, relatively speaking, one of the lucky ones. I don't have anyone's death on my conscience. I do have memories of things that will give me nightmares and flashbacks for the rest of my life ... and mine was a very, very short war. What those kids over there are going through now is so much worse I can't quite get my mind around it.

They're not robots. They're your son, your niece, your little brother, caught up in a horrible situation not of their own making. Don't take your anger out on them. Save it for the evil old men who never exposed themselves to that kind of horror, who would never allow their own children to go through it, who casually, thoughtlessly, cheerfully send other people's kids off to hell.

User Journal

Journal Journal: Best of Slashdot

http://science.slashdot.org/comments.pl?sid=177160&cid=14701902
Some things about Darwin
(Score:5, Insightful)
by plunge (27239) on Sunday February 12, @03:36PM (#14701902)
Many people don't really know anything about who he was or what he thought or how it applies to modern biology.

The guy was:
1) A careful and thoughtful scientist who spent countless hours studying tihngs most people would find incrediby boring. Darwin spent EIGHT YEARS studying BARNACLES.
2) Fairly shy.
3) A Christian for most of his life, and only an agnostic in later life (which had more to do historically with death in the family than with evolution, just ike Lincoln's rediscovering of Christianity)

The guy is/was NOT:
1) a guy who's ideas are a dogma. What Darwin thought is historically important in the development of evolution, but has no bearing on what and where that theory will lead.
2) 100% right about a LOT of things. He not only got the patterns of heredity completely wrong (he thought it was analog: by trait blending, when it was really digital), but was embarassingly forced to admit it when people with better arguments pointed out that blending was in contradiction with the evidence.
3) Someone that thought fossils had proved his case. To Darwin, fossils showed mainly the fact that past life was very different from present life: hence that most of species that existed in the past no longer existed in his day. This was one of the chief inspirations for his idea. The current creationist obsession with fossils overlooks the fact that Darwin put forward his theory, and was considered to be correct, long before we had anything like the fantastically rich fossil record of today. Darwin predicted that future fossils would all confirm his theory, but he NEVER expected that we'd find anywhere as many as we have, or that an entirely unimaginable field (genetics) would someday come to exist and provide an indepedent second check on the fossil record, allowing us to figure out actual lineages.

Darwin also didn't propose that the origins of life were part of evolution. The most he ever said on the subject was that maybe life had started in some warm little pool somewhere... in a private letter. He didn't publish this idea as scientific work.

There are so many misconceptions about the man that this otherwise fairly reserved guy is just buried under layers of legend. He was neither an exceptional genius and phropet, nor was he arrogant, careless about jumping to conclusions, or an atheist. He was a bright, studious man who worked hard, amassed tons of evidence, and hit upon a stunningly innovative realization about how evolution could have occured (one which was as much due to the new discoveries in geology and biology of his time as to his own thinking: as is obvious from the fact that no one in the history of earth had thought of it before... and then suddenly two guys did indepedently around the same time). He's worth remembering and learning about, not worshiping or demonizing.

User Journal

Journal Journal: Best of Slashdot:: computer security

This is one of the best pieces of writing I've ever seen about how design affects security. It's about a dangerous Windows vulnerability in which graphics files of type WMF (Windows MetaFile) could be booby-trapped to take over a computer.

Re:Over/Under
(Score:5, Interesting)
by Malor (3658) on Monday January 02, @07:41AM (#14378616)
It's probably a hard problem to patch. From what I've gathered, this is a feature of WMFs, not a bug. They were designed before people even knew what the Internet was. WMFs, apparently, have the ability to specify code to be run on a failure to render. So the bad guys give you a bad WMF file, cleverly renamed as JPG, and stick it in an ad banner. You browse a site (with any browser), Windows fails to render the WMF (which it will recognize even if the filename says JPG), runs the specified failure code, and you're hacked. That fast.

Changing code that's this deeply buried in Windows is risky. The interpreter for WMF is one of the remnants of code left over from single-user computers, and they'll have to test changes very thoroughly. They're GOING to break things with this patch, because they're removing a designed-in feature. They're probably working feverishly to figure out how to minimize the damage, but some damage is inevitable. And the problem could be far worse than it appears; that DLL could be riddled with problems. It may not have been audited in many years.

This is yet another example of how you can't retrofit security; the first Windows versions were designed when security wasn't even an issue, when the Internet was barely a twinkle in Al Gore's eye. There's a mountain of code that was written just to work, not to worry about being handed malicious data. If a user passed bad values to a system call and it crashed, oh well. It was their fault for doing it. It's not like they had anything to gain from it, after all. They owned the computer. Why on earth would the computer need to protect itself from its owner?

With the advent of the Net, Microsoft decided to both stay backward-compatible and extend what they had onto the Internet. And their focus for many years was on new features, not security. Essentially every security person at the time warned them -- stridently -- against the choices they were making. It was obviously going to be a trainwreck. This is just the latest in that ongoing collision between a single-user operating system and exposure to every computer in the world.

This particular exploit is BY FAR the worst one yet...even very competent administrators, doing everything exactly as they should, can get nailed by this one. As bad as this is, though, it's not like they're going to stop here.

Trying to retrofit security onto the Win3.1/Win95 model is like trying to use scotch tape to make cheesecloth waterproof. No matter how much tape you use, even if it's a lot more tape than cloth, it will ALWAYS leak. It might hold water for a bit, but leaks will constantly spring up. They've added tremendous functionality in the NT/2k/XP kernels which can limit what users can do and limit the possible scope of compromises, but many many programs (especially games) require administrator privs just to run. So most people run as Administrator even though they shouldn't. And that makes hacks like this one very easy and *extremely* damaging.

Hopefully Microsoft will get a patch out fast.... they certainly must understand how overwhelmingly bad this problem is. The fact that they're reacting slowly is likely an indication that it's hard to fix.
--
We were once willing to go nuclear to avoid secret prisons, torture, and indefinite detention. What happened?

Slashdot Top Deals

If you think the system is working, ask someone who's waiting for a prompt.

Working...