Posts by Vic

MySQL price hikes reveal depth of Oracle's wallet love

Derivatives...

> This is an absolutely massive difference for a database product.

I think you're drawing a distinction that was neither stated nor implied...

The definition of "derivative work" is laid down in copyright legislation. If you think my description does not mesh with that definition, then feel free to substitute the one from CDPA88, since that was my meaning.

Nevertheless, the point I was making is that the GPL does *not* prevent you making commercial applications. It does not care what you want to do with the code - indeed, distributors are explicitly prohibited from making any prohibitions according to intent. GPL code is Free to use - even for stuff I don't want you to use it for...

Vic.

Clearly :-)

> But only if you redistribute it. Otherwise you are quite free to keep

> any changes you make close to your chest*

That's a somewhat moot point; you only need to distribute source for any program you might distribute (N.B.: all the source, not just changes). Nevertheless, the code is still covered by GPL if you don't redistribute - it just doesn't mean you have to do anything to comply.

> So purchasing the commercial licence gets you what exactly?

The right to redistribute without complying with the GPL.

> Or are you saying that if you purchase a commercial licence you can

> modify the code and redistribute it as a closed source product?

Yes.

> I don't see how that can work.

You don't need to.

But if you were a closed-source vendor that wanted database functionality in your product, you might have bought a commercial licence from MySQL. They have customers...

Vic.

Re: "MySQL price"?

> Oh, you're talking about support from Oracle?

No. MySQL is dual-licenced: you either accept the GPL, or you have to pay money to use it in a non-GPL context.

Vic.

Re: Postgres

Postgres needs to think about version migration before it will get the adoption of MySQL.

I understand the reason for being cautious with opening older DBs, but for those of us that use postgres packaged by our distros, this can lead to the situation where a database is completely unavailable because the package has been up-issued. Fixing that is a headache we could all do without.

Vic.

Re: Copyright?

> How much of my code is in their code base?

That depends. On how much of your code have you given them the copyright? That will set the maximum limit.

MySQL has long had a requirement on contributions for copyright to be handed to them. If they don't get those rights, the code doesn't go in. This has allowed them to continue the dual-licencing model.

This is a double-edged sword; should one of the GPL forks become dominant, it could have features not in the "official" Oracle release - and Oracle cannot just import that code into their own codebase without entirely deswtroying their ability to sell commercial licences...

> I think I still have the right to revoke that.

No, you don't.

> Anyone got a contact to send Oracle's ISP a DMCA shutdown notice?

That would be unwise.

Vic.

Not really...

> I'm sure that I remember that MySQL is under a dual license

It is. MySQL can be had under GPL for no money, or under a commercial licence for lots.

> where the applicable license depends on what you want to do with it.

What you want to do with it makes no difference - what matters is whether or not you want the GPL version.

If you do, your derviative work (i.e. what you build with it) must also be GPL. Some people don't want that - so they have to pay Oracle a few first-born children instead.

Vic.

Grocery terminals slurped payment card data

Sure about that?

> Pin pads, those customer operated devices, use DES encryption

*Legitimate* ones do. What about tampered ones?

The biggest flaw in this security model is that it requires the pin pad to be a trusted item. If that trust is broken, there is no more security...

> Sure sounds like an inside job!

Sounds like a crime committed by someone with physical access to the devices. Once again, impersonating a service engineer is the way to break in :-(

Vic.

Hackers hijack internet voting system in Washington DC

Nope.

> So basically you say exactly the same thing as I did

No - I'm saying the exact opposite of what you said.

You said none of the open-source elements was cracked.

I said that one of them was.

I am disagreeing with you.

That's why I responded to your question of "right?" with the answer "wrong".

Vic.

I don't think I am.

> That's why we should be glad that the system never went live, I guess.

But it did go live. It might not have been actually counting votes - but it is still a live application exposed to users. And it wasn't even close to being ready for that.

> flaws of this magnitude should not even have reached the testing level

Exactly. This project is broken by design.

> but chill dude, it never went live fo' realz.

Well, that rather depends on what you mean by "live fo' realz". That this story is being used in an attempt to discredit the open-source development model is plenty live enough for me.

> the project is only a few weeks old

That's what I get from the github graphs. I don't find this the easiest tool for such things - but it is rather popular at present :-(

But that doesn't excuse the fact that something as important as e-voting was entrusted to a bunch of neophytes so incompetent as to have included such trivially-avoidable beginner errors in their code. Nor does it excuse the fact that this was not picked up in code review - so that review is either very faulty or very absent.

This application had no business being presented as part of Officialdom. If it had been three skiddies playing at coding, we'd just have had a laugh. But this is a Governmental system; it provides negative publicity for Government procurement, for e-voting, for FLOSS, and for computing systems in general. And that's not good for any of us.

Vic.

Good grief, no

> the Enlightened people use Ada, where you can have

> built-in bounds checking of many kinds.

Note that in Ada you *can* have built-in bounds-checking; that doesn't mean you *do* have it.

The upshot of this is that some programmers stop coding defensively, because they expect the compiler to do the work. They don't worry about designing array indices not to overflow any more.

This work fine until someone switches off the auto-checking, believing it to be an overhead they can't accept any more. I've seen this happen in many projects.

In fact, wasn't that a large part of the reason for the Ariane 501 accident?

Vic.

How clear?

> None of the open source components were hacked, right?

Wrong. The application was hacked.

None of the platform was broken - but the designers had seen fit to give enough privilege to the the process running the application to do silly things. And the application was so poorly-written that that privilege was easily taken by anybody who wanted it.

Vic.

Credentials

> "Why is is a "Shocker" that a web application would

> have the username and password of the database

> into which it is inserting data?"

> Because it shouldn't.

I don't have aproblem with the app having *a* username/password. The problem, AISI, is that the phrase "the username and password" has any meaning...

ACL is known technology. There is no reason to give your web application any more privilege than it needs :-(

Vic.

Some misunderstandings...

> The philosophy of FLOSS is that given enough people and enough

> time to review, things will get fixed.

> Great as far as it goes - because it doesn't specify WHEN.

No. That's not what FLOSS is about.

The advantage of open-source is that your bugs get found. There are far more people looking at the code, so it gets far more testing by people who have a good idea how to stress the code in question.

This says nothing whatsoever about how you go about *fixing* those bugs - it just provides a mechanism for discovering them.

> But what about projects and software that ABSOLUTELY

> have to go live in a short amount of time?

You pay someone to debug the code - just as you would in a closed-source application. Being open-source does not hamper this development flow at all - it just provides additional volunteer testing resources.

> When is there the time for FLOSS to be reviewed, discovered, and fixed?

> And then those fixes themselves reviewed and tested?

Being FLOSS does not preclude exactly the same reviewing and testing that closed-source would require - so the same job can be done. Being FLOSS does get extra testing for free.

The only thing that FLOSS precludes is security through obscurity. For a voting system in particular, that is a very god thing to prevent...

> But let's at least examine when it MIGHT have limitations

Sure. This is not one of them.

> such as short time-frame deliverables on systems that have to be verified.

Short-time deliverables is when I absolutely would want to go open very early - get people on-board and helping out.

You appear to be describing FLOSS as projects with no paid, fuill-time staff. This is not even close to the truth. FLOSS has the same development resources available as closed-source - but it *also* has unpaid volunteers looking over the code to help find bugs. This is additional resource, not alternative.

Vic.

Not open source?

> The voting software which contained the flaw was

> NOT open source so therefore it was NOT examined.

http://github.com/trustthevote/DCdigitalVBM

Vic.

This is simply unbelievable.

Judging by the github graphs, this project is only a few weeks old. It absolutely beggars belief that this could be used on a live voting system. This is unbelievable mismanagement.

Failing to catch the sort of injection attacks outlined in the article is just beginner stuff. That the code went to production in such a state says bad things about the whole of the project's management. It might be the case that this project is permanently stigmatised - to have launched such poor quality code into a live application implies that the leadership wouldn't know security if it slapped them with a wet fish.

I remain unconvinced that Ruby on Rails was a good choice for the project, but that seems to be a near-irrelevancy; this code is clearly so badly-written that no language would have been appropriate. It's just lucky that the code is open-source - that means the testers can do white-box testing, and tailor their stimuli to what they can see in the code.

Mind you, the chances are that this sort of thing would have been caught by black-box testing without much more effort - flaws of this scale will always be exploited if they are present, and should be absent by design.

Vic.

Youth jailed for not handing over encryption password

Not Missing the Point

> People here seem to be missing the point

No, they aren't.

> What's the difference? Both are demanding information

> in exchange for not doing something unpleasant.

The difference is that RIPA2000 is enacted legislation. It is entirely lawful for the authorities to send you down for a long time because you refuse to hand over your decryption keys.

This should not be the case. It is awful legislation. But it is the law. It protects us all from Terrrrrists, apparently.

> So, an encrypted file is basically the same thing, yet they can force decryption.

Yes, they can.

And the only way we're going to get out from the stranglehold that the last bunch of oppressors put us in is to get our elected representatives to repeal this law - or at least parts of it. A fragile coalition is a good target for pressure from the electorate...

Vic.

Freedom of Speech?

> I still don't see how this doesn't fall completely under freedom of speech.

*What* freedom of speech?

We have no Bill of Rights in the UK. We have convention, which permits freedom of speech, but precious little legislation to back that up.

> I would suggest that using coercion to force us

> to reveal our conversation is an infringement our

> freedom of speech.

I would suggest that the freedom you espouse is illusory.

However, the Police have no specific authority to force you to decode your made-up, verbal language, so you could do this (and this is, apparently, the source of Cockney Rhyming Slang).

In the case of digitally-encrypted data, though, there is a significant difference: RIPA 2000 is enacted legislation that grants certain people the authority to require you to hand over your decryption keys. Failure to do so is a criminal offence.

> The medium is irrelevant, as is the reason they don't understand it.

This is not true (even if it ought to be).

Vic.

@AC

> If the Police have a warrant to search your computer

What about when they don't have a warrant to search your computer?

None is required for a Section 49 notice :-(

Vic.

Not Double Jeopardy

> Double Jeopardy.

This is incorrect.

> He's refusing to give the password for the same encrypted volume he refused to before.

Doesn't matter. He's guilty of failing to comply with a section 49 notice. He's not been charged with respect to the curernt notice before, so there is no "double jeopardy" involved.

Claiming that this is the same offence is like claiming that a recidivist burglar shouldn't be tried for subsequent burglaries, because he's already served time for it. That was a different burglary. That was a different Section 49 notice.

> Worst that can happen here is being found in contempt of court

No, the worst that can happen is that he can be sent down for another 5 years (if they mention "national security" often enough) *and* face a large fine.

> and being returned to jail every time he refuses to give the password, but that's not within the

> remit of s49

It's within the remit of a new Section 49 notice. There is no stated limit to the number of successive notices that can be issued - only that the issuer must have "reasonable grounds" to believe that the defendant has the decryption keys sought.

Vic.

Perhaps

> Can the ask him again, treat it as a separate offence and charge him with it?

The issuance of a Section 49 notice does require that the issuer has "reasonable grounds" to believe that the victim[1] has the encryption keys being sought. If the poor sod has already done time for failing to cough up the keys, there is eventually going to be some room to claim that those grounds are unreasonable, and thus that the notice is unlawful.

But that won't necessarily stop second and subsequent notices from being issued - it just gives some sort of defence in court.

Vic.

No safeguards

> Do the police have to obtain a search warrant for your computer

No.

A Section 49 notice can be issued by a number of Authorised Persons. Many of these are not in the judiciary.

There is no legal oversight. There should be.

Vic.

Another title

> If you couldn't recall a password for an encrypted file and pleaded that

> you had forgotten it, then it would be up to the prosection to prove

> beyond reasonable doubt that this was not the case.

That is not the case.

RIPA 2000 makes it a criminal offence to fail to supply a password in response to a Section 49 notice. This notice may be issued by a number of "authorised" persons (many of whom are not judiciary) if that authorised person believes that there is encrypted info in your possession. It is not even a defence to claim that the alleged encrypted dump is nothing of the sort - a court could still send you inside for up to 5 years.

It's one of the worst laws we have on the books. I hope this example might get someone in authority to repeal such draconian nonsense - but I doubt anyone will :-(

Vic.

Opensourcer targets Windows Phone 7 hopefuls

McObject don't know what they're doing

It took a while to get hold of the "GPL" versions of the code, but I got there eventually.

Looking through the code, I found the licence. If claims to be GPLv2 - and then it puts in this little gem :

"This General Public License does NOT permit incorporating this software into proprietary or commercial programs. "

...Which is cobblers. It is entirely possible to build commercial apps with GPL code. You just need to distribute them under GPL.

So - is this code really GPL? Are McObject improperly making claims about their licence? Or do they just not understand the licence?

This doesn't bode well...

Vic.

Google spits back at Oracle's Android suit

Coding for Andriod

> When you write for Android, are you writing in Java or a close approximation of?

There are several source languages that can be used to code for Android. Java is one of them.

However - and this is the important bit, IMO - *no* Java goes onto the Android platform, nor does any Java bytecode. There is no Java in Android.

Vic.

Title

> What on earth has that to do with patent infringment?

It's called the "unclean hands" defence. It's a back-stop position in case the court finds any merit in Oracle's claims - if they are found to have a point, they might still be unable to extract any penalty if they have been found to be acting in bad faith.

I doubt it will be important if this should ever come to trial, but it's good lawyering to get all your defences in place while you still have the option to do so...

Vic.

Net TV to consign Net Neutrality debate to dustbin of history. Why?

Double-dipping

> The economics challenge is content providers generally pay your ISP nothing for delivery

Doesn't matter. *I've* already paid my ISP for delivering the data of my choosing to my router.

The problem is that the ISPs won't make a profit if they have to supply what they promised for the prices they charged. That might, in the long term, be a good thing - there might be more honesty in how broadband is marketed.

And, if consumers have to pay higher fees to get TV on their confusers, perhaps someone might re-think the viability of using unicast delivery for broadcast content...

Vic.

The BSA's fading twentieth-century piracy fight

Is it?

> Not so long ago if you Googled Open Office the first link (a sponsored one) was to a third party

> company selling OpenOffice discs.

That is perfectly permissible - in fact, it's encouraged.

All you need do to remain legitimate is to comply with the licence - that means keeping attributions and notices intact, and providing source code either with the binaries, or on demand.

> The site looked pretty much the same as OO's.

As long as they weren't infringing Sun/Oracle's trademarks, that's perfectly legitimate.

Vic.

Don't confuse "open source" with "public domain"

> How is this even possible, as by definition open-source software is free to copy or modify to your

> heart's content?

No it isn't.

It is copyrighted code. And rights to copy or redistribute are dependent on the terms of the licence being followed.

This is usually quite easy, but several companies have managed to fail to do so. Microsoft is one such infringer.

Vic.

VoIP hacker sentenced to 10 years

Bollocks

> These large corporations have been ripping off people in a number of ways for many years.

This article is about some guy ripping off VoIP providers.

Most such providers aren't big faceless corporations - they're small companies trying to make a living by undercutting the telecoms profiteers.

Vic.

MS pitches Windows 7 at biz world ahead of Chrome OS release

BeOS

...is now called "Haiku".

http://www.haiku-os.org/

It's quite pretty. I am sure many people will like it. It's not for me, though.

Vic.

Microsoft takes Oracle side in Google Java-phone attack

Well, I'm shocked. Shocked, I tell you.

A company standing to make money by you not buying its competitors products says its competitors products are bad for you.

*shakes head in disbelief*

Vic.

Do the Webminimum

That's quite easy to fix

You're right that distros are tending towards bloat - that, I'm afraid, is a the result of all the "Linux is too hard" moaning. It's unfortunate, but it's the way things seem to be heading.

> server installs are mandated to come direct from the DVD, with a couple of key components

> enabled, rather than templates or custom installs. So almost every server has everything from

> torrent clients to games to sql servers, necessary or not

With Fedora (and other RH-type distributions), that's pretty easy to fix - set up the installation as you want it (with system-config-kickstart) and build your own installation media with livecd-creator. You can make bootable USB versions as well, if you want.

I haven't tried that approach with Suse. I suspect it would work without too much effort if Suse doesn't have a similar tool

Vic.

@Trevor

> It's a simple front-end to use SpamAssassin to filter for exchange.

Yes. I've run out many MTAs - I recommend one to pretty much all my customers. I still don't really get why you think I should be reading your blog post...

>it has in the past caused me more problems than the minor % of spam that gets through without it

Then you have misunderstood SPF. It is *NOT* an anti-spam tool. It is an anti-forgery tool.

> The point was that you can get away with not needing anything but Webmin to manage Sendmail

Yes you can. But care needs to be taken if you are going to use any other tools as well, because Webmin does not keep the .mc and .cf files synchronised.

> but I think it's a pretty exceptional scenario (clustering of Sendmail perhaps) where this might be an issue.

Absolute rubbish.

Try using any of the basic setup tools in Webmin - say, "sendmail options" (the very first entry on the page in my version). Make some changes there.

Now do something that needs the .mc file to be edited - say, add a milter with the "sendmail M4 configuration" tool. Rebuild the config with the button on that page.

Oh look - all those changes you made beforehand have disappeared.

This isn't rocket science - it just needs a little caution. Endless responses about how you don't think it's a problem just show that you aren't taking this in. I find it worrying that you set yourself up as an authority on this topic without understanding the propensity for this to go very wrong indeed; your advice so far is likely to leave anyone following it with a configuration they don't understand, and which is likely to roll back their changes without warning. This is not a responsible position to take.

> Small enoguh at least ot make it a very viable tool for single servers and small businesses without any of the fancier config tools.

Yes, and I've said all along that I am a fan of Webmin, and I use it on almost every machine I build. But, as I said at the very beginning, it has a few foibles that need to be treated very carefully. Its manner of dealing with the sendmail config files is one of those foibles.

Vic.

No thank you.

> Hey Vic, wanna join a LUG?

No thanks.

> At the moment the membership is me.

Depending on how long you continue your head-in-the-sand approach to issues laid out to you, I suspect it might continue at that level.

> The local LUG and I didn't get along all to well

I can see their point.

> but I don't mind any but the worst of the Reg commenters...so why not a Reg LUG? We can argue amidst threads just like we always have…

And is this going to be a group set up to try to advance its members'[1] knowledge of Linux, or is it a grandstanding and point-scoring exercise? The latter is unlikely to last long.

Vic.

[1] I decided to be charitable and not spell that "member's".

Hmmm.

> Why do I have to recompile a kernel to get some stuff installed?

You don't. That's very old, very stinky bait.

> Why do I *have* to upgrade the OS to get recent builds of software installed?

Some authors require certain underlying suppprt code. That is true on many OSes.

> However I was unable to install an upgrade because more recent versions of Clam require an OS upgrade.

Hardy has a version of ClamAV that will work just fine. There are a variety of reasons why you might not have it - but they all boil down to you not installing updates in a timely fashion.

> SO Hardy was what, 2007 and it's effectively dead already.

No. Hardy was an LTS release, so it will have desktop support for 3 years - that takes you to next April.

> Not because Canonical don't support it but because software suppliers are not minded to look after backwards compatibility.

ClamAV had good reason to change the way they do things. I'd have preferred a slightly less catastrophic failure mechanism - but then every problem installation had been flagging the problem for about a year before they did this, so a "soft" fail would probably have been ignored.

The distributions I use all had packages ready to roll for the new ClamAV engine. That you didn't get it installed would appear to be a local administration problem, because the repos had the code you needed.

> Of course the seasoned Linuxer will comment that I've done it all wrong.

Yes, I'm afraid so.

> There's great comfort in being reasonably sure the OS will be around for a few years and that

> vendors software will probably run on it.

There are flavours of Linux around that provide a very stable platform - I'm using one right now. But you chose a distribution that has a stated policy of bringing out a new OS every six months.

Vic.

@Trevor

> M4 Config is your friend

It certainly is.

But that doesn't address the point I made - it is important to be careful when using Webmin with sendmail because most of the options on the page do not change the sendmail.mc file, they change the sendmail.cf file. This leads to inconsistencies - the .mc file gets out of date, and using it to make subsequent changes will over-write changes to the .cf file, removing all the work you've done beforehand.

I'm not claiming Webmin cannot be used - I use it myself.

I am saying that there is a pitfall here, and the unwary can be caught out.

> Oh, and a nugget of fun for you

Errr - what am I looking for? It's a mail server setup. And you haven't included an SPF milter.

Vic.

LUGs

> Maybe otehr LUGs are less elitist

As with any self-ortganising group of people, the quality of LUGs varies dramatically.

I've joined two. One was awful - one of the members started putting conditions on reading his posts on the mailing list, FFS. I flounced out - there was no way I was going to remain part of that lot.

The other one[1] is truly excellent. There are some odd-bods in there, and there is the occasionaly "difference of opinion", but by and large, everyone works towards helping each other out. It's great.

Vic.

[1] I suspect this might be the same LUG as Jacqui belongs to...

Bah.

> but if you've used sendmail for anything that is controlled by sendmail.cf, your files are now out of sync.

That should, of course, have read "but if you've used Webmin for anything that is controlled by sendmail.cf, your files are now out of sync."

Vic.

@HolyMackerelBatman

> Thing is I didn't know what apt-get is

Did you try to find out?

Very few fora care about people being ignorant - we all were at some time. What annoys people is when new users assiduously refuse to try to help themselves. You'll see 1000-word flames from people who won't even put the term they don't understand into a search engine.

>,it's not easy to find if you've never heard of it before.

On the contrary. Google is my search engine of choice - typing "apt-get" into the search box gives me lots of results pertaining to apt-get - just as it would had I searched on some other term I don't understand.

Now occasionally, you might be so stumped by something as not even to know where to start searching. That's a perfectly reasonable thing to post to a forum - someone will respond with some appropriate search terms, at the very least. What they're unlikely to do is to do all your research for you...

Vic.

There are lots of clueless idiots

> The Internet respondeth (paraphrased): “zomfgwtf are you doing using such a pathetic distro,

You encountered a cock. There are lots of them in most fora - Windows, Linux, you name it. Please don't judge the entire community by the bottom-quartile twats.

If you are having problems with a RH-based distro (such as is CentOS), you could do worse than to grab the Red Hat Deployment Guide. It's available online, but install it on your machine as well - it's invaluable. I don't know if CentOS have it in the repository - if they don't, grab the SRPM from Red Hat and rebuild[1].

Vic.

[1] If you don't know how to rebuild SRPMs from RedHat - learn! it's a singularly vital skill. Just download the SRPM from RH's FTP site & type "rpmbuild --rebuild wotijustdownloaded.src.rpm".

Be careful with Webmin

I'm a big fan of Webmin - I install it on pretty much every machine I build.

But it is not without issues. Here are the two foremost in my mind :-

- Beware having multiple users. User separation is decidedly dodgy in Webmin - it just affects which Webmin modules you can use. All operations are actually performed by the root user. So if you give someone access to file upload/download, he can modify /etc/shadow. Instant root access...

- Be very careful administering sendmail with Webmin, if you ever plan on administering it in any other way. Webmin modifies the sendmail.cf file directly - which is near-unintelligible to humans. We mere mortals generall modify sendmail.mc, and convert that to sendmail.cf with the m4 tool - but if you've used sendmail for anything that is controlled by sendmail.cf, your files are now out of sync.

Aside from those two irks, itis a fabulous tool.

Vic.

Novell breakup and sale imminent, says report

That's a big risk...

>> "There is no part of Unix unlawfully put into Linux"

>

> You know that, beyond a doubt?

Yes.

> Every line of code in the Linux kernel has been compared against every line of code in Unix to verify this?

There are two primary sources of Unix :-

- BSD

- AT&T

The BSD code is licenced under the BSD licence. There is quite a bit of BSD code in Linux - and it all has the necessary attributions and disclaimers to satisfy the licence conditions.

SCO's complaint was over code allegedly from the AT&T->USL->Novell chain of ownership. Besides the fact that they failed to show any such code in Linux, it wouldn't matter if they had - Novell, not SCO, owns any copyrights to that tree, and Novell has, for some years, been a Linux distributor. Thus, even if there were any AT&T-derived Unix code in Linux, Novell have been licencing it under GPL or BSD licences for some years, so we're all allowed to use it.

But, as I've said, SCO singularly failed to find any such code anyway. If you look through the purportedly sealed exhibits that Kevin McBride (yes, Darl's brother) posted on his blog a few weeks back, you'll see that SCO's "evidence" (and I use the term quite wrongly) did not involve AT&T-derived Unix (but there was quite a bit of BSD there). That dump appears to have disappeared now - but I've got a mirror just in case it's ever needed...

Vic.

You need to read the court judgements more carefully...

> As has (largely) been established, Novell still own Unix IP

No, that has *not* been established.

What the Court ruled was that Novell did not transfer its Unix copyrights to SCO.

What the Court did not addresss - because there was no need to, if for no other reason - was what Unix copyrights Novell owned in the first place.

The USL vs BDSi settlement shows us that quite a few of the copyrights weren't owned by AT&T in the first place, and never went into USL.

This is part of why Darl McBride's attempts to convince the world of the strength of SCO's claims was so comical - he kept pulling up examples of BSD-owned code, which were never owned by AT&T, USL, Novell or SCO.

Vic.

Linux is not Unix

It doesn't matter who own Unix - not that this purported sale would havemuch effect on that anyway.

There is no part of Unix unlawfully put into Linux. Any commonality there might be is under a BSD licence or similar, and so it is perfectly permissible to incopropate it.

So whilst we can't stop the trolls from filing specioius lawsuits, we can stop them from winning. And, given the recent changes to US court procedure, the SCO nonsense can't be repeated; new plaintiffs will have to show some sort of case before they're allowed to proceed.

Vic.

UK plans increased spending on cyber-security

Title

> Would it be cheaper to bulk buy a whole set of VPN's instead of virus scanners, if no one in the

> Defence department knows how to use the Linux VPN or SSH

Yes.

HTH

Vic.

Voice of America chap ejaculates over Paris Hilton

Our fiends across the pond...

> I thought we were known for Democracy, Science, Industry, and Agriculture

Well, you're known for Science, Industry, and Agriculture...

Vic.

Google's antitrust probe spin answered

I'd never heard of Foundem before this suit came to light.

I went and had a look at their site.

It is shit.

Google are doing exactly the right thing in this circumstance - Foundem needs to be pushed a *long* way down the results.

Gordon Brown joins World Wide Web Foundation

Be fair - he did deliver on one of those.

> "No more boom and bust"

He delivered on that. There is no more boom and bust.

We won't see another boom in a very long time - which is exactly what he promised us...

Microsoft releases FixIt for critical flaw in 100 apps

Yes, it is.

You miss the point.

You don't *have* to run code from a borked site to hit this one - just do anything that changes the current directory to a compromised one.

The exploit isn't in the icon you click on, it's the fact that your OS loads libraries from the current directory - wherever that might physically reside - in preference to the known, trusted ones you've installed on your machine. So the icon you click doesn't even need to be executable; you just pick up compromised libraries for apps that are already running on your machine, and your machine is pwned.

SCO gets sale approval

No.

> Anyway, isn't this a little bit like being on a sinking fishing boat in some cold,

> unforgiving place and being told that the survival suits and life raft have

> been auctioned off to raise money for some buckets to bail water out

> of the boat with?

Not even close.

It's like being on a sinking fishing boat in some cold, unforgiving place, and being told that the survival suits and life raft have been auctioned off to raise money to pay for some "consultants" to come and tell you you need to bail the water out...