> "The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
That should read "The Washington Post cites this incident as a reminder that advertising has become an Internet security menace."
Adblock+ -- part of a sensible security policy.
Why are all the insightful posts in this thread being modded "funny"?
C++ is *way* too big a language already. It's got the PL/1 problem (yeah, get off my lawn) -- when everyone only understands 0.8 of your language (or some amount under 1.0) it winds up being a different 0.8 for everyone. And this means that virtually any programmer will write code that is unreadable to another. (and if there is one thing that over 25 years of programming has taught me is that code readability trumps almost everything else).
Interestingly enough, IBM created PL.8 (an 80% subset of PL/1) for internal use. The original XL compiler back-end for RS6000/PPC was written in PL.8
/ Really -- my lawn -- get off of it!
An excellent question -- and not one I have an answer to.
I think that perhaps they should get Bruce Schneier to help design their systems for them.
| They should also assume that some of their own employees are moles.
I mention that they should assume that.
They aren't getting *nearly* paranoid enough. They should be encrypting the data on disk, on network connections between machines in the *same* data center, not just between centers. In fact the data should remain encrypted at all times unless absolutely necessary to have in clear-text to process it -- and that should never leave the CPU. It should remain clear-text only for the absolutely minimum time required.
They should assume that hostile agencies (foreign *and* domestic) have tapped every last network link they own. As well as most routers and processing machines. They should also assume that some small percentage of their workforce are working on behalf of one of these adversaries. Given these assumptions they should design a system that can remain as secure as possible given these circumstances.
Merely encrypting the network links between their data centers is not nearly enough to thwart the likes of the NSA, CSEC, GCHQ or other nameless agencies.
The problem with this is that it sounds like raving paranoia. And if it is paranoia and untrue, technically it's just a software update away from being true. And as a theory, it's not really falsifiable.
I certainly won't be buying one of these things.
How about comparing on the most recently available hardware...
My point is that, while open source drivers are a good thing, they are of limited usefulness unless they are competitive with closed source ones for performance, stability and completeness of functionality.