* Posts by h4rm0ny

4560 publicly visible posts • joined 26 Jul 2008

And the buggiest OS provider award goes to ... APPLE?

h4rm0ny

Re: Put up or shut up

>>"Where did you find any standards in Microsoft release process ??? Or did you mean the patch/update release process?"

I was talking about software vulnerabilities and fixes so I thought the context made it clear. Yes, I'm talking about Microsoft's more standardized release process for updates.

h4rm0ny

Re: Who has paid for the survey?

>>"Gentoo doesn't. Debian doesn't unless you install the desktop environment. Ubuntu doesn't unless you install the desktop environment. OpenWRT doesn't. Linux From Scratch doesn't.

And none of those are the distros listed in this report. I mean, Ubuntu is, for example, but not "Ubuntu without a DE". If they're separating out Windows 8 and 8.1 when they are certainly separating out Ubuntu and Ubuntu Server.

h4rm0ny

Re: Lies, damned lies...

>>"As the nitwit in question, I should maybe point out that language can be tricky too, especially if you ignore part of what's written."

Yes, I did. You put a minor get-out clause in there and then proceeded to roll forward with your conclusion anyway.

>>"There is no evidence in the article which enables anybody to say how many vulnerabilities in Win 8 also affect Win 8.1 (to use your example).

It doesn't need to be in the article. We can bring the context ourselves. Windows 8.1 and Windows 8 are overwhelmingly the same code base and this is trivial to check by inspection if you doubt it. 8.1. is mostly some GUI changes. One would have to be entirely ignorant of this fact to think summing the total of two different versions of Windows was a legitimate comparison to a single version of OSX.

>>"At least, that's all I can say - and that's all I did say."

That isn't all that you said. You titled your post "lies, damned lies and statistics", stated that it was comparing apples to oranges and declared Microsoft to be the "loser" with a small admission that it might not be true. When anyone with any context would rightfully throw out the idea of summing the bugs from 8 and 8.1 after a moment's thought. Your entire post is based on a premise that is trivial to show is wrong. That you acknowledge the premise doesn't mean it's not silly to hold it up as a reasonable possibility.

h4rm0ny

Re: This is not a football match. @h4rm0ny

There's not much I can argue against in that post. Seems to be (sadly) right on the money. Especially your summary of the main distros. I'm quite sure that Poettering probably would take it on - seeing as there's nothing he's encountered so far that he hasn't tried to vacuum into systemd. But like you, that's not a solution I look forward to seeing.

h4rm0ny

Re: Biased reporting

>>"If you combine all the Windows versions together (as has been done for OS X) then Windows has 248 vulns, that's 100 more than Apple."

Set theory is not your strong point. As pointed out elsewhere, nearly all of those vulnerabilities will be the same one present in multiple versions.

h4rm0ny

Re: Which begs the question

Ah, you're probably right. I don't use OSX so I can't really comment on that.

h4rm0ny

Re: Put up or shut up

>>"A methodology that generates a result that's so much at variance with common experience needs to come with an explanation. Or at least a theory."

Who says that it is at variance with common experience? I've generally found GNU/Linux and Windows to be comparable in security (assuming competent admin in both cases) with a slight practical edge to Windows because of their more standardized (imo) release process.

>>"Windows is difficult to make secure because of its structure and complexity, and all the wonderful "features" which seemed like a good idea (to Microsoft) but are now forgotten, but still available (to hackers)."

Like being able to pass in function definitions by text to Bash as an environment variable? Shame on you - this is the first out and out partisan post in this thread.

EDIT: What did I say in my first post here? We'll find out when it gets to lunch time? Lo and behold it hits 12:30 and we suddenly get our first two partisan shots. *sigh*

h4rm0ny

Re: Android

>>"By far the biggest issue Android has is that idiots will happily install every piece of malware they can find as long as it pretends to be a free fart app"

That's what I meant when I compared it to XP and how trying to educate users just didn't work for MS which was what they tried to do for a long time. Send an attachment saying "BritneySpearsNaked.exe" and half of my colleagues back then would cheerfully infect themselves. :( That's why pretty much every Windows system these days as anti-virus built in by default and tools like SmartScreen. Microsoft gave up waiting for the kids to grow up and just went back into parent mode (for better or worse).

You can't stop people being stupid, but there's definitely room for Google to work on the same problem with Android.

h4rm0ny

Re: This is not a football match. @h4rm0ny

>>"The former is unlikely to happen, as the distro specific sysadmin stuff is where people like RedHat and Canonical make some of their money. The latter cannot happen as there is no accepted Linux standard or even standardisation authority, and even if there were, it would be dominated by the commercial distro maintainers, because they are the only people who might have resources to invest in a standard, and then we are back to the former point."

That's a really interesting post, I've just snipped out part of it. It might be optimistic (or naïve according to view) but perhaps there is a third option. Linux grew out of a community of people collaborating voluntarily. Perhaps given there is an evident need, the same can happen again. It may seem unlikely, but then the entire Open Source movement was, and yet people made it happen.

h4rm0ny
Pint

Re: Which begs the question

>>You descriptivist!

The scientist knows something. The non-scientist does not know it. And between the two is the Engineer who actually gets stuff done. I will wear your slur with pride. ;) :p

h4rm0ny
Facepalm

Re: Lies, damned lies...

>>"The table shows that, if you combine all versions listed, Windows OS has 248 vulnerabilities, making Microsoft the clear winner/loser (always assuming that no nasty is double-counted)."

Do you really think that most of the vulnerabilities listed for "Windows 8.1" are not also vulnerabilities in "Windows 8"? That there isn't massive overlap between the different versions and you're not just counting the same vulnerability twice? Maybe we should add up all the different Linux distributions make Linux the worst OS instead of OSX? It's using the same logic you just have!

"Statistics can be tricky - but they're not that tricky."

Too tricky for you, nitwit.

h4rm0ny
Headmaster

Re: Which begs the question

I grew up in the UK hearing "begging the question" in the sense that something immediately demanded an obvious question be asked. So did most people grow up with that meaning around them. It's not like a word such as "whale" where it has a definition independent of common meaning and if someone calls a shark a whale you can correct them. It's a phrase. You have a different and far less intuitive understanding of the phrase which may or may not be older, but is not authoritative - because it's a phrase.

The only phrase that can be said to be inherently wrong is "I could care less" unless that's actually what someone intends to convey which it seldom is. Other than that I get tired of somebody popping up whenever other people are using a common phrase in the way both they and the listener are used to using it and attempting to tell them they're wrong and they should use the newcomer's definition. Really, such behaviour just begs the question of what they actually want by doing this, my answer to which is that they just like pretending they know more than other people.

TL;DR: Pedant Fail.

h4rm0ny

Re: This is not a football match.

>>"It has a LONG way to go on the usability front."

I actually find it fine to use, though I will concede I started out with HP UNIX and XWindows so I may not be fully calibrated to the average user. But still, I think Distros like Mint are out of the box pretty good. I agree it is light years ahead of where it was and I have many memories of hours spent editing xorg files trying to get it to work right.

The area that I personally think GNU/Linux might want to improve on a bit more, is enterprise tools. I'm happy to be corrected on this one if I'm wrong. I have programmed on GNU/Linux professionally and used to use Gentoo as my primary so I therefore have a reasonable understanding of the principles and how it is put together, but I have never administered a company's Linux systems so I may not have a solid feel for this - like I say, if I am wrong I am happy to be corrected. But last year I encountered puppet for the first time. I also have had to witness the painful, painful way in which user accounts are being managed across many Linux boxes / VMs. The sysadmins doing all this aren't idiots, they're smart people. So if this is really how things are done in the Linux enterprise environment then they are actually behind the tools that MS provide for this by a considerable margin. Given Linux's stronghold is backend enterprise, I think this is as important as UI refinements, imo.

Of course it's difficult to find people who are experienced sysadmins of both Windows AND Linux, so informed comparisons are hard to come by. Unlike most of my posts, I wont be arguing in defence of this one either way - these are just my impressions.

h4rm0ny
Thumb Up

Re: Comparing like with like ?

If you read the linked article, he actually breaks it down by GNU/Linux distribution (that's even referred to in El Reg's summary) and he also addresses break down of the vulnerabilities between OS and application. He's actually done an extremely good job here - I'm impressed.

h4rm0ny

Android

Android isn't in the list. I went back to the original article and found its entry:

6 total vulnerabilities 4 high severity 1 medium severity 1 low severity

This is really interesting. Why? Because the state of actual security of Android in the wild is atrocious. And yet in terms of vulnerabilities the OS itself is pretty low. Why the contradiction? Most people probably are already answering: OEMs. Regardless of whether it should be the OEMs stepping up or Google having set up a different model in the first place, the unpatched and out of date Android systems out in the world are innumerable. Vulnerability stats aren't the only key part of security - update model is a critical part so any discussion about relative security of different platforms needs to include this.

If Google genuinely thought that their 90 day policy improved security then where they should direct it, is against their own OEMs. Either Google is responsible for Android security or it is not. And if it is not (as is frequently stated by those who argue against critics of Android security), then Google should be treating the OEMs that same as it treats other companies such as Apple and Microsoft. Android is currently where Microsoft was in the XP era - fragmented updates across a userbase that is largely security-ignorant. And like Android, MS wasn't selling it directly in many of these cases, but leaving responsibility with the OEMs.

MS eventually realized two things: One, whether it was the OEMs fault or not, it was harming them. Two, educating users on security wasn't working. So they took back control and they started putting in their own security tools even though that upset their business partners who sold anti-virus software of their own. Google needs to look at doing the same thing even if it's painful or upsets their OEMs.

h4rm0ny

This is not a football match.

I have hope that this comments section will not become a sports match - all of the comments so far have been non-partisan. I guess we'll find out after lunch when the East Coast has woken up and seen this. ;)

Anyway, I don't think this shows a failure on GNU/Linux's part. I think instead it shows how far Windows has come. Go back to the Windows XP era and this situation was far reversed. XP had a poor security model and was riddled with problems. GNU/Linux has actually improved as well. It's just that Microsoft bit the bullet with Vista and went through the massive pain of re-doing much of their system from the ground up. We're now seeing the long-term benefits of that process.

And aside from changes to their security model and obvious improvements to their quality control, there's another thing MS addressed which isn't impacting those figures above but is impacting actual daily security a lot. And that is they took some of the responsibility for security back from the user and manage it themselves now. All Windows systems can have Windows Defender / SmartScreen / etc on and running and any that doesn't have Third Party anti-malware software running normally does. Windows Defender isn't fully as comprehensive as something like Trend Micro or Kapersky, but it does the job and has low-impact. The fact that modern Windows installs have proper anti-malware up to date by default now is making a big difference to the general state of end user security.

h4rm0ny

Re: Which begs the question

You haven't specified a subject but I'm going to assume that you are talking about GNU/Linux. There are two answers to your question (neither mutually exclusive). The first is that you're wrong - there actually aren't a "vanishingly small number of attempts to exploit them". Companies face active attempts to compromise their GNU/Linux systems daily. It is end users who don't see many attacks.

And that last part leads into the second answer which is regarding the disparity between attacks on GNU/Linux end users and those on Windows end users. The reasons are fairly elementary. If it takes the same amount of effort to craft an attack on either OS, are you going to direct your malware efforts at the OS that has a huge proportion of the total end users, or the one that has a small proportion. Furthermore, are you going to target the userbase that is a mix of technically competent and technically incompetent people, or the one that is stripped of the technically incompetent people?

Short version: For back-end systems, your question is actually wrong - both GNU/Linux servers and Windows servers are actively targeted because they have equal value. For end users, the reason for the huge disparity is that the two sections do not have equal value.

h4rm0ny

>>"These numbers prove that nothing is 100% secure and bug-free, despite certain sections of the IT community wearing rose-tinted spectacles."

Indeed. I've had numerous arguments with GNU/Linux zealots (note: zealot != user) on here. Say what you want about Windows but no-one has ever sat back and said: 'I don't need to worry about security, I use Windows".

Anything as sophisticated as an OS is going to have flaws. I think most actual GNU/Linux sysadmins are smart enough to know how seriously they have to take security, but there is a second tier of zealots who talk as if GNU/Linux is far ahead of Windows in security. That hasn't been true for quite a long time now, but I still see it routinely on these forums. There was a post here just the other day that said Windows had fewer vulnerabilities than Linux in the last year (as this report suggests) and it got downvoted to oblivion.

Google open-sources HTTP/2-based RPC framework

h4rm0ny

A critique of HTTP2.

I imagine several readers of this article would also be interested in this:

https://queue.acm.org/detail.cfm?id=2716278

It's a short critique of HTTP2 from an annoyed programmer. Am sharing for interest.

Churchill's blood valued at £560,000. Take that Stalin!

h4rm0ny
WTF?

Some people are weird...

(See title.)

Microsoft man: Internet Explorer had to go because it's garbage

h4rm0ny

Re: Easier to write it from scratch then use Webkit... Right...

Who cares about 32-bit?

h4rm0ny

Re: Here we go again

>>""I's too much trouble to fix, so let's throw it out and start over", is one of the biggest danger signs in programming, amirite Netscape, Longhorn?"

You're very right and it was what I came here to say when I read the article. I'll look at it fairly when it arrives, but this is a danger sign to me.

Still, I'm glad they didn't go the Webkit route. It would have been bad for them and it would have been bad for Firefox to be isolated like that.

h4rm0ny
Coat

Re: the hypocracy

"Shortage of government?"

Is there such a thing?

NO ONE is making money from YouTube, even Google – report

h4rm0ny
Paris Hilton

>>"So, when Apple decided to stick it to the entire music industry (including indies) all weenies cheered and life was good. Music became cheap. When Google does the same thing, weenies boo and hiss because "oh noes, poor artists are starving".

Apple let me buy the tracks I wanted as digital downloads which is how I listen to them. Google shoves ads in my face and tells artists that if they don't sign up to certain terms Google will continue to profit from their music and just not pay them any more.

I don't see the similarity, to be honest.

Flash flushed: Google's AdWords to convert ads to HTML5 automatically

h4rm0ny

I don't mind ads...

After all, a website's got to eat (or something). It's the tracking that bothers me.

.

Statement of the obvious: "don't mind ads" does not apply to ones that autoplay and start making sound. But everyone knows that.

'Utterly unusable' MS Word dumped by SciFi author Charles Stross

h4rm0ny

Re: Doubly unusable if he moved the document

>>"Unfortunately $EDITOR[1] edited the word doc with change tracking. Then $EDITOR[2] scribbled on a print-out with red ink. And they want me to make another pass through it and do some structural changes. So my workflow is:"

I'm unconvinced MS Word's inability to merge in one of your editor's hand-written amendments on hard-copy is a reason to call it "utterly unusable".

>>"I wrote the bloody thing in Scrivener (which is at heart an IDE for complex compound documents like, oh, trilogies), then generated a word document as output because my editors insist on working in Word because corporate IT at the big publishers thinks everyone uses it"

Again, not really a reason for attacking Word. You're basically damning it for being successful. If the situation were the other way around and they all insisted you submit your work in Scrivener format and you wanted to use Word, you would be in the same situation. Of course Scrivener will export to Word because Word is the common standard and so it needs to. If the situations were reversed Word would have export support for Scrivener for the same reasons. But you would still be in the same situation as minority user. You would, for example, lose all your change tracking in your Word document when it had to go into Scrivener and back again.

So again, this is an artefact of your choice in writing tool, not any indicator that Word is "utterly unusable".

>>"even though many deeply serious professional authors won't touch it with a barge-pole."

And plenty of other authors do use it fine. I'm not sure if they are deeply serious ones, or why seriousness is so highly regarded by you, but again, you're publically slagging off the work of some very talented programmers who have put years of work into the software for no good reason that I can see here. All of the items you list are more to do with you than with Word.

h4rm0ny

Re: British SciFi author Charles

Well yes, but when Douglas Adams was alive and writing, you're talking the era of Windows ME and 98. I think he just made it into the Windows XP era, pre SP1. So whilst his opinion is valid, it is hardly current. ;)

h4rm0ny

Re: I like MS Word...

>>"If he can't track changes, it is broken."

Actually, from the context of what was written, it seems moving things back and forth between LibreOffice and Word on a Mac platform is what messes up the change tracking. That hardly justifies statements that Word is "utterly unusable" or the general attacks on it as rubbish that some seem to be posting here.

h4rm0ny

I like MS Word...

It's good. Seriously, author with noted political stance on software has trouble with Word? This is a news story now? I helped someone who was saying almost exactly the same thing about Libre Office last week which I'd installed for them because they wouldn't pay for Word. They couldn't figure out how to change the line spacing. Is that Libre Office's fault that they couldn't figure it out and said the software was impossible to use? No, they're just technically inept and prone to hyperbole.

Samb-AAAHH! Scary remote execution vuln spotted in Windows-Linux interop code

h4rm0ny
Headmaster

Re: Some inane thoughts on the smaller points grammar...

>>Why do some people insist on capitalizing the first letter in each word of 'open source,' as in: "Open Source"? Did it become a brand name somewhere along the line? [...] Greets from the dirty pedant!

You don't get much more pedantic than I do. I capitalize Open Source because I am referring to a specific category of software known by that name. I.e. it is a proper noun, similarly to how in the same post I capitalized Libre rather than just saying "libre software" which could refer to things other than those I meant. I.e. Open Source is a proper noun in this context.

And to anticipate any extreme pedants about to claim that it is a proper name rather than a proper noun because it is more than one word, you are wrong. There is no good foundation for such an arbitrary rule and you are just attempting to sound clever.

EDIT: And to the AC I am replying to, you have used an icon that is incorrect by convention. It should be the icon you see in the top right of this post when attempting pedantry. ;)

h4rm0ny

Re: Another Open Source security problem

>>"You need a C compiler for that, right? So you better check your C compiler sources. They look fine, so you compile your C compiler. With a C compiler binary. What could possibly go wrong?"

Not this again. Yes, there can be exploits hidden in a compiler but again, you seem to be responding to my statement that it is very hard to hide such backdoors in Open Source software with examples of things that are (surprise!) very hard to pull off. You need a compiler from somewhere to get started on the process, even if you're then compiling your own compiler afterwards. So where does it come from - well, somewhere reputable. You can check the hash of the file. The hash of this file will be the same as the hash of the file for that same compiler in a lot of other places. You think someone wouldn't notice that a gcc binary was different on one set of servers to another, even though it was supposed to be the same? Of course that would be noticed. So now you're talking about having sneaked your backdoor code into all the places that distribute those binaries. Places that compile them independently from source!

Seriously, we are talking Moon Landing levels of Conspiracy to pull this off and to keep it hidden. You can pull it off maybe for very targeted attacks (still hard as any serious user is using an enterprise distribution and differences would stand out), but that does nothing to contradict my point about it being very hard to hide backdoors in Open Source software. Your link, btw, is to a proof of concept. Good luck actually getting that out there into general Open Source that people had on their computers. In contrast to proprietary where you only have to compromise the vendor.

I don't know why some people are so determined to turn everything into a My Team better than Your Team fight. In any two systems that are different, there are going to be advantages and disadvantages, otherwise they would not be different. It does no good to deny an advantage or disadvantage because it's not to one's liking. It doesn't mean one is utterly better than another in either direction, it's just called recognizing not everything is five-year-old simple.

h4rm0ny

Re: Another Open Source security problem

>>"If that's what you want to believe, you might want to read say:"

And if you think those contradict my post, you my want to read what I had to say: "it's very hard...".

In Closed Source code, you have to compromise the vendor and that is job done - yes, it possible that outside parties might find evidence of backdoors from decompiling, but it's difficult and time-consuming and, after all, we're talking about the ease of getting backdoors in there, not the relative merits of how hard they are to find (which OS also wins, btw). Whereas with Open Source, you have to camouflage your backdoor well enough to pass inspection by some very skilled people. Seriously - read your own link on the Dual Elliptic Curve Deterministic Random Bit Generator exploit and try and tell us again that this isn't far, far, far harder to pull off than a few IF statements.

h4rm0ny

>>"No that's not sensible - both for security and for resources. It should start a new thread and the thread should impersonate the user. This is how it is done in Windows."

That would still require the Samba daemon to run as root. Within the constraints of the UNIX security model I'd be interested to hear of any approach that could work without this. If you want to argue that the Windows security model (Vista onwards) is better than the UNIX model, I agree with you. But I don't see a fault here on the part of Samba's design.

Also, I'm not sure the resources criticism holds up. Why do you think it makes any relevant difference?

h4rm0ny

Re: Another Open Source security problem

Did anyone ever claim that Open Source was completely bug free? Is the claim that this bug would not have existed if this were closed source? That would obviously be a ridiculous claim, so what are you trying to say? As far as I can tell you're just creating a strawman to attack as no-ine here has claimed such a thing.

And if you're trying to argue that ability to review the Source Code doesn't help, that's plainly not true as Microsoft would not have been able to review the code, find this problem and submit a patch. Unless in your hypothetical universe of closed source Linux they were sending copies of their source to their chief competitor whilst hiding it from the public..."huh?"

The real unarguable benefit of Open Source is not that it will always have fewer vulnerabilities than closed source software, but that it protects against deliberate subversion. It may or may not have accidental flaws but it's very hard to put a statement in there saying "if blnNSA == True..." And that's important.

The other critical thing is that in most cases, open source software is also Libre software, which means people can build on it. I've been involved in Libre Software for over fifteen years and I never recall us ever arguing our code would be immaculate. Instead we argued "Free as in speech", "Usually free as in beer", but never that I can recall "Free as in free of all bugs".

Yes, there is an advantage to the "thousand eyes" principle for security - you're posting on a story about a patch that would have existed without that - but you're basically strawmanning against something no-one here has claimed.

h4rm0ny

It's because when you connect to a Samba server on GNU/Linux it forks a new process under the credentials that you're accessing with, which is sensible enough. But only root can fork processes as another user so the Samba daemon itself has to run as root.

I guess it's an artefact of grafting support for the MS protocols onto GNU/Linux rather than having a true remote login. You need to be able to act as different users without an actual direct login as them... so root it is.

h4rm0ny

Re: MIcorosft contributing security fixes to Samba

This also has only been publicized after a patch was available - Google take note of how things should be done. There's also an immediate workaround you can apply in the config file if you can't apply the patch immediately.

AMD's new Carrizo: The x86 notebook processor that thinks it's a GPU

h4rm0ny

>>"Has AMD caught up with Intel on single threaded desktop performance yet?"

Sadly not, though in absolute rather than relative terms, both Intel and AMD have long since passed "good enough" for most users.

Software has also finally caught up to some extent with parallel processing rather than cramming everything into a single thread. (With exceptions!).

h4rm0ny

Re: Interesting

"Yes, thats right. No two chips will run quite the same. This is a very clever idea by AMD. That's better than the previous approach used by AMD (and Intel) where no chip ever ran at its full potential; every die was graded at fixed speed bins and labelled at the one where it worked"

We used to have Socialist chips. Now we have Capitalist chips.

Lenovo shipped lappies with man-in-the-middle ad/mal/bloatware

h4rm0ny

Re: Criminal

>>"Why? If it's advertising related then volume counts over quality every time. And even ID theft is a game of volume over quality."

Because in the scenario I was evaluating. the purpose of this was spying on people and using advertising as a cover (which this flaw enables), the actors behind that would have to be state level players. (E.g. Chinese government, NSA, etc.). They wouldn't be interested in indiscriminate harvesting, but on targetting high level players.

One could make a case that mid-level people might have more valuable access as that is where most of the IT people with dangerous access live, but I don't think that would be the case.

Anyway, I think the probability is that this is [I]unwitting[/I] breakdown of security in the greed of Lenovo wanted a pittance of advertising revenue with each laptop sale (note to El. Reg: not "lappy"). But still, it makes you wonder.

h4rm0ny

Re: I'll give you three guesses

Composing a ballad on the subject of FinFET architecture?

h4rm0ny

Re: Criminal

"If Superfish were masquerading as other businesses via certificates issued under their root certificate "

They were, that's how this works. Pretty much everything you wrote is correct and would form a viable basis for legal action if someone / some group chose to pursue this.

I would like to know how high up the management chain actual understanding of how this worked went. At the top is there someone signing off on a deal that "shows some ads" or is there someone who knows that this is actually breaking a fundamental security component of the web and impersonating websites. It's not a silly question - someone in the chain must have known the implications of this so I wonder how high it got before someone decided to accept responsibility for the decision and chose to do this without flagging the implications higher. That person knowingly endangered their customer's security and I would imagine anyone making that decision wanting to be able to pass the responsibility upwards and say: "i raised it with my boss in this email and they said okay". So it could have risen pretty high indeed.

Which also raises the question of whether there was another motive for this. What this has meant is that the security of very many people has been compromised. It could be greed and incompetence but it also can be a way of spying on people. And if you get caught - it's adware, we didn't know better! There's no way with this installed you can know if you've been compromised or not.

I'm leaning to that not being the case simply because this isn't present on the highest end laptops which would obviously be the best targets. But still, it makes you wonder.

Linux kernel dev has gone well and truly corporate – report

h4rm0ny

Re: 16.4 per cent and 2.5 per cent leaves 81.1 per cent.

>>"...And that's the type of proposition open source fanatics don't want to see discussed openly, even though it's a reality. The NSA already has significant chunks of code in just about every major Linux distro going by the name of SELinux"

I have plenty of objections to the bundle of ad-hoc fixes that is SELinux, but oddly enough it being a ploy by the NSA is not one of them. And this is from someone who had an extended argument on these forums about Windows vs. Linux security models. All of the SELinux code is Open Source and it is scrutinized by some very smart people who have no affiliation with the NSA (and in some cases are pretty much enemies, such as the Chinese government). When it comes to security against third parties, both Open Source and Proprietary have advantages and disadvantages and neither is inherently more secure, imo. But when it comes to security against a subverted vendor, Open Source has a clear and demonstrable advantage - you can inspect what you're given.

There could be cleverly hidden flaws in GNU/Linux, but I think the main threats to any user are going to be accidental vulnerabilities or (from well-resourced enemies) firmware exploits. Sorry for the long post - I just don't think SELinux is subverted.

h4rm0ny

Re: Snowballing

>>"Rolling your own kernel used to be fairly easy, but it's a lot of work now."

I was a happy Gentoo user for several years, so I concede my perspective on this may not be that of the average inhabitant of this planet, but what is it you think has made it a lot of work these days, compared to how it used to be?

Microsoft's patchwork falls apart … AGAIN!

h4rm0ny

90 days!

And some people want to hold an axe to their head by threatening public disclosure of any vulnerabilities lasting 90 days!

Testing - it's not just for Michael Gove!

Now not even muggers want your iPhone

h4rm0ny

Re: urrr... they will still steal your device

>>"Yeah, because your average punk knows all about "Faraday bags". (Good grief!)"

Common misconception that the average street criminal is stupid or doesn't learn this stuff quickly. The last person I knew who stole things semi-regularly also used Tails for their OS because they'd heard it was good for stopping the police spying on you. You'd be surprised - plenty of people's lives go off the tracks for reasons other than not being smart.

Generally speaking someone who goes about stealing phones will have a lot better and more current knowledge about the security systems of phones than most people who own them. They may not know what a Faraday Cage is or how it works, but being told that putting a phone inside one of those bags you get with computer bits stops the kill switch being activated is exactly the sort of trick that gets passed around very quickly.

Not that I'm arguing these kill switches aren't very effective - they clearly are. I'm just pointing out that people can be a lot more informed than you think.

Microsoft makes 'business case' for marriage equality

h4rm0ny

Re: Final remark

>>Trevor's obnoxious post, which appears moreover to be a personal reflection on his own life, provides us with another look at the typical bullying and abusive format, which are excellent examples of what I call "destructive intelligence".

Trevor Potts is just like that. He has previously actively tried to track down people from El Reg. forums to find who they are in real life and has previously threatened to give me a kicking (accompanied by several assurances that he genuinely would like to and only the threat of getting caught stops him) for an argument over operating system UIs! And posts the same angry rhetoric at people who favour IPv6 as he does those who oppose gay marriage. He doesn't distinguish - just enjoys posting antagonistic and hateful posts to anyone who gives him an excuse to be "righteous". I would just ignore him like others do.

h4rm0ny

Re: MS going for the niche markets!

>>"Yes, you are probably correct that my arguments may are flawed and probably badly formulated. Unfortunately I was neither blessed with the gift of rhetoric nor that of public speaking so I have to make do with what I have."

I am not attacking you over style or presentation. My issue was that I pointed out basic flaws in your argument - logical flaws not ones of preference or belief - and you responded to my post calling it the usual think of the minorities diatribe. That I objected to. I'm quite happy to debate civilly with everyone but wont accept misrepresentation of what I say.

>>"In my mind the point of marriage is to begin the foundation for a familly. A family has figures; a mother, a father and eventually children ( 1..n). This is my conception of a familly, I am sure that many, if not most, share this conception."

See, now this to my mind is a far more cogent argument from you than your initial post. In your initial post you were attempting to find superficial reasons to support a pre-existing conclusion - that homosexual marriages should not exist. As is typical where the desired conclusion is placed ahead of arguments, there were logical flaws. The above however, is something that can more reasonably be debated. And indeed, with that specific point above I largely agree - children should have a stable and reassuring environment growing up hence the need for a solid commitment (typically called marriage). Without that need, two people might as well just live out their relationship's natural span based not on legal and social commitment, but based on respect for each other and desire to be together. I.e. no need for marriage (though some may still want).

conception of a familly, I am sure that many, if not most, share this conception.

>>Within a familly, I believe that for a child to grow within a healthy framework, he will need a father to be fatherely ( something a mother cannot provide) and a mother to be motherly( something that a Father cannot provide), The relationship that he will have with either parent will be different, often learning the same things but from different points of view

Here I somewhat disagree. I reject the idea that only a mother can be "motherly" or a father "fatherly". These are for the most part socially enforced roles, not intrinsic ones. There are plenty of fathers more tender and caring than many women are, and many women who are more... well I don't know what it is you think "fatherly" means, but lets go with protective, aggressive or whatever. It really doesn't matter - pick any trait and you'll find plenty of women who have it buckets more than most men and vice versa for men over women. We're people first, not a sex. That these cases are not uncommon should be demonstrable to anyone with a reasonable social life.

There was a study some time ago of lesbian couples that found a baby would start to put parents into a father & mother role whether the female-female parents wanted it to or not. The child would simply start to favour one over the other despite their best efforts. But I saw nothing in that study to show that a child is harmed by one of those roles being filled by a woman (or man), only that children were predisposed to do so.

The thing is, all else being equal it probably is better for a very young child to have one parent of each sex because that provides a greater breadth of role-models. But things never are "all else being equal". Rate parenting quality on some hypothetical and impossible to actually create scale of 1...100 and say you get +2 points for having role-models of both genders. How much does that compare to the +20 of having two parents who really love each other, or the -30 of having one of those parents be unfeeling and distant? It doesn't. And I could even make a case that same-sex couples can have hidden benefits such as not propagating unhealthy social expectations. I am a feminist. In any traditional couple you are likely to have slightly different domestic behaviour between the male and female parent. A female child will likely more identify with the female parent and thus gender-based roles are perpetuated. Whereas a female child with two male parents would not run that risk.

Of course there are some benefits to a male-female parent unit. It can be handy for a child to have someone of their own sex to talk to - especially when they hit puberty. But that doesn't mean that any given same-sex couple is going to be bad as parents. Or even that these problems are especially difficult to overcome!

Basically, your argument based on the idea of marriage being about children is a supportable position to some extent (imo), but not your corollary that only male-female can be good parents.

>>"Because of this thread I had a quick read up on homesexuality, "ephebic love", within the greek, Roman empires as I feel that they probably represent contemporary society better than any other. It seems as though once more history is repeating itself...."

This, I regard as just some bizarre perversion of an Appeal To Tradition fallacy. And no, I don't think we're going down the same path as the Romans because we're becoming more tolerant of homosexuality.

h4rm0ny

Re: MS going for the niche markets!

>>"Can you honestely admit to caring for all minorities ? Really ?"

I can't think of any particular minority off the top of my head that I am out and out against. I have a strong dislike of idiots but sadly I think minority doesn't apply.

Regardless, I pointed out all sorts of logic problems in your post and your response is to demand perfection from me as if that were a counter-argument. I'll add that to the list of fallacies, shall I?

>>"Proving my logic wrong does not remove the general idea behind the comment."

Well no, what it does is falsify reasons why your idea should be accepted as a good position. If you say you think X because of reason Y and Y is then shown to be wrong, it doesn't show that X is wrong, but it does show you need to come up with other reasons why we should share your prejudice or MS should not be in favour of gay marriage.

>>"No, I do not agree with the current public agenda of acceptance of gays and their particularities. Should I now be publically hung for saying that ?"

No, we're more civilized these days - we have Downvotes instead of hanging. You might have noticed those. Anyway, I don't think I said anything remotely violent to you. I tore your logic apart but nowhere did I advocate violence or aggression. That's your persecution complex, I think.

>>"What is it with this dictatorship that says that we must all agree with the current politically correct agenda. Why should people accept that which they do not agree with ? Who does it really satisfy, apart from the wolves ?"

I don't anything about any wolves but didn't this start with you objecting to MS not agreeing with your own agenda? You seem to be starting from an assumption that a current situation is inherently more valid than a future one unless someone can prove to you that improving the rights of gay people is worthwhile. I rather say that as improving gay rights is obviously good for many people it's up to you to prove why improving such rights would be a bad thing. Agree with it or not is up to you, but if you want to show that something is wrong you need reasons why.

>>"This current gay issue is yet another of those BiPolar causes whereby you are either for or against...."

I'm not sure there's a great deal of middle ground on whether gay marriage should be legal or not. I mean, it is or it isn't. But I don't think it's quite how you describe. For example some people believe churches / religions should be forced to recognize such unions and perform equivalent ceremonies whereas I believe it's really up to the religion. So yes, there is middle ground even on something as binary as this.

>>and when you are against it appears that you are now treated as a hater, a vile and wicked person..

Well the essential reason for this is no-one can see why it would inconvenience you for it to be legal. So opposing it makes it look like you're actively trying to make things bad for other people for no reason. If that is not the case, you need to show how gay marriage is bad.

>>"By concentrating on futile issues we become blind to the overwhelming ones"

Gay marriage isn't a futile issue - there is substantial progress made on it and continues to do so. I believe it will become normal and gain legal equivalence. I also reject the idea that my caring about it (or anyone else's), requires such concentration that I cannot also care about other issues also.

h4rm0ny

Re: Poly?

>>"Yes, I do know that any society is concerned about the future generation growing to become a valued member (hopefully), so that begs the question of why do childless couples get special treatment even before conception of a child, while single parents only get the child deductions but not half the marriage deductions? Homosexual and other alternative life-style individuals deserve equal treatment which seems to be where our Supreme Court is going. I still have lot's more questions but I'll stop there."

My position is that state benefits should be about children. I'm fine with that not applying to childless male-female couples just as much as male-male couples, and I'm similarly fine with the benefits applying to male-male or female-female couples that adopt just as they do for a male-female couple that has a child. So really, imo, this entire aspect should be separated from marriage.

But state benefits are only one aspect of the legal implications of marriage. Others include input into medical decisions when one party cannot consent, inheritance and matters of ownership when a long-term couple split up. These legal benefits and burdens should be extended to gay couples as well.

h4rm0ny

Re: MS going for the niche markets!

>>"This is exactly the type of comment that I presumed would be made. The usual diatribe about how important it is to take care of the minority."

Actually, whilst I would cheerfully make a case why minorities should be taken care of (we're all minorities by some measurement or the other), the three major problems I pointed out with your post were all fundamental flaws in your logic even accepting your starting position of not caring about gay rights. So no, I don't think that is the type of response you "presumed would be made".

>>"Yes, I know gay people, I have worked with 2 gay men for the last 6 years, they are not a couple ( both in their 40ish's). Do either of then want to get married, nope, and after speaking with them they honestly couldn't give a shit about those that do."

Why do you expect members of a demographic to speak for all of a demographic? That's right up there with "So, what do Black people think about this?" It's a fourth massive flaw in your reasoning to add to those in the original post. If you're now actually attempting to prove that gay people don't want marriage equality do you not think it is more scientifically valid to look at the many who are campaigning for their right to marry rather than the two you have worked with?

Honestly, I haven't even addressed your deplorable lack of caring for "minorities", your posts are riddled with reasoning errors so don't pretend my response was just "usual diatribe about how important it is to take care of the minority"