Joseph Gwinn wrote:

In article ,
"Pete C." wrote:

Joseph Gwinn wrote:


It works pretty well in many countries, those with real governments. We
are fortunate to live in such a country, despite all our complaints
about that government getting too big for its britches.

It works in those countries only because the vast majority of the
population agrees with the system. The examples we have seen however
make one wonder what would happen if even a few hundred people in on of
the "working" countries began actively attacking the police and
military. Not a pretty picture...

It happens from time to time. They are crushed.

I haven't seen instances that met the full scale guerilla war criteria
in one of the "working" countries. I suspect that those conditions would
cause a sizable reduction in the ranks of the regular police and the
military would have great difficulty operating among civilian
population. This fits what we have been seeing in Iraq and one of the
modern "working" countries would present an even greater challenge.


"Apple Mac OS X v10.3.6 and Mac OS X Server v10.3.6 provides a moderate
level of independently assured security in a conventional TOE and is
suitable for a cooperative non-hostile environment." rather says it all,
it does ok in a non-hostile environment. That's pretty much what I've
said, it does ok because it isn't attacked often.

Standard posterior-protection boilerplate. But they did pass the CAPP
certification. That said, CAPP (and Orange book before it) is silent on
network security issues.

So basically all it's saying is that MacOS provides moderate protection
against a casual walk-up intrusion i.e. login username and password,
something that Windoze also provides.


The point is that while everything made by man can be undone by man, not
all things are equally easy to undo. And the greater the required
skill, the fewer the people that can participate. This is universally
true.

Bad analogy, skill is not a requirement in the computer attack world as
evidenced by the script kiddies. Unlike the physical skill required to
pick that Medeco lock, the tools required to attack a computer can be
readily transferred to non-skilled users. One skilled user is all that
is required to identify a vulnerability and then disseminate the code to
exploit it to the script kiddies.

The same is true of mechanical locks, if the attack is really that
simple. Try googling on the exploit to open a kryptonite bike lock
using a bic pen barrel.

Still doesn't really compare to the ease of transfer to script kiddies
to launch large scale automated attacks.

It is invalid because it is very often biased. We all know of their
rigged rollover "test", they may have escaped liability for that mostly
on first amendment grounds, but that in no way exonerated them. They are
frauds and I stand by that.

The first amendment? What does that have to do with it? The first
amendment does not protect one from a libel suit by an aggrieved
billion-dollar manufacturer, with a building full of lawyers to press
their case.

Then how did they get off the hook? It was 100% clear that CR had rigged
the test to parameters outside real world conditions.

How can you be so sure that the allegation was true?

I watched their video of their tests and it was pretty obvious. One of
the CR spokespeople also made a passing semi admission that their test
was pretty extreme if I recall.


The first amendment governs only the US Government, not ordinary
citizens and companies. And it confers zero protection against a libel
suit.

I think CR escaped liability by the thinnest of hairs due to the fact
that while their test was extreme and not really representative of real
world conditions, it was not physically rigged like the infamous gas
tank video from another source.

Extreme steering input by a professional driver, specifically designed
to roll the vehicle may be outside the region of what would reasonably
be expected in the real world from an average driver, but it is
theoretically possible I guess.


And still unanswered is what source you would instead recommend.

I'm afraid I don't recommend any source other than personal research
which is the only thing that can be relied on to be objective and if
biased, biased in a way that is acceptable.

Acceptable bias is only that which parallels one's own bias?

Yes. When assessing products yourself, the only bias that can enter is
your own which is inherently acceptable to you.

Um. I would hope for better, to learn things I wasn't born just
*knowing*.

And that is what you'd get if your research skills are decent. The main
thing is that you will not fall victim to the biases of others in an
case.


They may or may not have lied, however their sample, while relatively
large only represents the responses of their readers which is not a
valid sampling of the computer user population as a whole. Not seeing
the report I also don't know if it made any attempt to validate actual
hardware problems vs. user error.

So, go see the report. It would take quite the conspiracy for all those
people to have told the same lie.

Different groups of people can and do have different experiences than
those of a truly random sampling of the population. It's not a lie, it's
simply a function of a non-random sample and a sample consisting only of
CR subscribers who took the time to respond is not a random sample.


NeXT the company took the BSD core (which is open source) and added the
stuff (GUI, OO development system, etc) needed to make an operating
system for general use. The unexpected thing was that a major market
for NeXT was the Financial world, where people used NeXT machines to
develop and run complex financial models.

Dunno, I've been at a large bank the last 7+ years and I've not seen a
trace of anything NeXT, or anything Apple for that matter. Our server
counts are in the tens of thousands BTW.

Finance is not the same thing as banking. Think Wall Street and rocket
scientists.

A large bank includes those areas, retail, commercial, investment, high
value, trading, etc.

I don't claim to be a Windoze guru, I simply use it as a tool like
everything else. In Windoze, even during significant changes like NT -
95 - 2K - XP I never had a problem finding the settings I was looking
for within 1 minute. The few times I've worked on a Mac I've dug for
tens of minutes and still not found the proper settings.

I couldn't find them in tens of minutes either, when I first started.

Which confirms that the Mac UI is deficient. Even when the Windoze UI
changed from NT to 2K I still found the settings I wanted in seconds.

Not exactly. You have proven only that you don't realize how much you
know. And I have to ask the gurus where to find various Windows
controls.

I perhaps don't realize how much I know, I seem to have a defective ego.
The point though is still that when the Windoze UI changed significantly
I still found what I needed quickly where I was not able to find what I
need quickly under the Mac UI.

No, people who do much of this will be very happy with a CLI. To a tech,
a GUI is largely a hindrance, a CLI is fast, efficient and direct.

A CLI (command line interface) works best with config files that are
plain ascii, while the config files in MacOS 9 and before are binary.

Not at all, CLI utilities manipulate config files (binary or ascii) just
fine $ ucx set config name_service /server=xxx.xxx.xxx.xxx
/domain=xxxx.xxx for example.

In UNIX, the standard approach is for config files to be plain ascii,
which one manipulates using a standard text editor.

That example was a reference to the VMS TCP/IP services package, which
derived from the Unix (Tru64) side of the house. Many of the config
files are text and readily editable, but the CLI utilities make it a bit
easier and in some cases one CLI command will update more than one file.


MacOS 10 and later follow the UNIX rule, so CLI is back.

Indeed, but MaxOS 10 and later *are* UNIX, with just a Mac UI shell, so
you may as well just run any of the UNIX variants with any of the
various shells, and save the cost of proprietary hardware.

If you like that rough a ride, yes.

I don't find the CDE shell or any of the others I've tried to be "rough"
by any means. The Mac UI is a little more cosmetically polished than
most, but not all of the shells, but I don't count cutsy stylized icons
as a feature that in any way improves function, any more than a cutsy
stylized case for the machine improves function.


No, microcode is at a deeper hardware level than machine code, although
many people use the term microcode loosely. Microcode is one way one
can design the CPU, and direct wiring is another. In both cases, the
CPU executes the machine code generated by the assembler and/or compiler.

It's also a way to emulate opcodes the hardware itself doesn't handle
directly. RISC opcodes execute directly and CISC opcodes call microcode
to do the actual RISC opcodes to get the task done.

Not necessarily, but books are written on this.

I've got a couple of those Alpha architecture books somewhere. Somewhere
I ended up with "Writing OpenVMS Alpha device drivers in C" which sounds
pretty scary.


PC maintenance in a corporate environment and in a home environment are
vastly different. Don't get misguided trying to make the comparison as
there is none.

The difference is that at work, they have an entire IT department full
of full-time experts. At home, it's just me, myself, and I.

They also have a company full of users trying to find the latest way to
screw up a machine. If they had a company full of Macs they would still
have the same headaches. It takes a dedicated IT dept to maintain a few
thousand desktop computers regardless of OS. It was only different in
the days of the "dumb" terminal.

Possibly, but what has this to do with the original question?

Dunno, it went a bit sideways, but the point still is that it is just
not possible to draw a comparison between the support needs of a
corporate environment and a home environment.


Actually, PICs are different from embedded CPUs like 8051 and 68040.
But yes, these appear only buried in disk drives and the like on the
computers of interest here.

Only marginally different, PICs have internal memory and peripherals
while CPUs like the 8051 and 68040 require separate memory and
peripherals. PICs are just more efficient for small apps.

Well, the ColdFire et al do have onboard memory, et al. As I recall,
the PICs had a sharply limited instruction set, to simplify programming,
as the theory went.

PICs have a RISC instruction set, not a limited one. One unique feature
the do have (or did have, haven't looked at the latest PICs) is single
word opcodes where the instruction word and instruction memory were 12
or 14 bits wide and the entire opcode and parameter if needed was a
single word. This along with no interrupts on the earlier PICs made the
instruction timing very predictable. It didn't really have anything to
do with simplifying programming.



AUI has rather gone the way of the Dodo. With 10/100/1000 Ethernet
ports, an external fiber converter is about the only thing you might
want to add.

It's true that AUI ports are yesterday's story, but we were discussing
yesterday.

Well, the Mac in question did not have an AUI connection as standard and
required an expensive Ethernet card to get it networked. This was in I
think about '97 or so, I don't recall the Mac details, but it was
probably only a couple years old at most.

Well, I missed that phase.

Lucky you. Not having followed Macs closely since I never liked the UI,
I don't know how long that phase lasted, only that it did exist.


Huh? Apple never had an open architecture to abandon back then. It was
all closed; that was the complaint. Now, with MacOS 10, it is mostly
open, being based on BSD UNIX. The BSD core of MacOS 10 (called darwin)
is open source.

Um, what about the then very popular II+? People built I/O cards for the
II+ and wrote assembler to control what they built. Apple abandoned the
open architecture with the Lisa and then Mac and to some extent the IIc.

People could build for the nubus too. The interface was fully
documented; I had the specs. Not many did, though. Probably because the
nubus was too complex for small companies and homebrew folk to handle.

Probably because the tech world abandoned the Mac well before nubus came
along and didn't look back. Homebrew folks are doing PCI these days
which is at least as complicated as nubus was.


Macs may have had some form of networking, but few people could afford
more than one making it largely irrelevant.

Oh, I don't know about that. My friend up the street had everything
networked. He is not a techie, but had no problem getting it all to
work. I never had to help him, and I lived about 0.5 miles down the
road.

What does that have to do with affording multiple expensive Macs?

My friend up the street isn't wealthy, and yet he managed. He was
running a business, and it made business sense to him. There is more to
the cost of something than its price. He didn't want to have to become
an IT guy - no value added for him, it's pure overhead.

Ok, so it was a business even if it was home based, which puts in in a
different realm. In those days few non-business home users could afford
more than one machine, be it PC or Mac.


At that point the whole
concept of why you might want more than one machine and a network
connection was still in it's infancy. Oddly enough, pre-PC I was
RS232ing stuff between a Vic20 and a C64.

Networking was happening in mainframes, but was pretty expensive. A few
companies developed low-cost but useful versions.

And DEC was developing Ethernet along with who was it? They were also
developing DSSI which became SCSI and oddly enough came full circle with
SCSIs return to differential connections like DSSI had to begin with.

Xerox and Intel, if memory serves. Didn't realize that SCSI came from
DEC, though. They did their level best to cripple it in their own
computer line, mainly because it threatened their control of disks on
VAX systems. DEC disks cost twice the market price.

Not sure about that last part, the DEC disk controllers (HSD/HSJ/HSG)
have uses SCSI disks for quite a while. The direct DSSI disks and the
SDI stuff was quite a ways back. There was good reason for not using
SCSI directly for quite a while until SCSI came back around to a
differential bus. Any of the non-desktop machines really need the bus
length afforded by the differential DSSI or other busses like CI in
order to connect to their storage and storage controllers.

Like anecdotal reports of Macs that aren't being attacked not being
compromised? Or PCs requiring superhuman efforts to make secure?

One person's personal experience is anecdotal, as no single person can
see that much of the whole. The aggregated reports from many people can
achieve statistical significance, if there are enough people involved.

They can, but it takes more than just volume. A large sample from one
specific population only shows their impressions and may not reflect the
truth.

Well, when one gets to 80,000 people, it gets pretty close to truth, as
close as one can get.

Only with a random sample. Sample size alone does not guarantee an
unbiased result. Ask 80,000 people of religion X if they believe in god
X and you'll get a 100% positive response. Ask 80,000 people sampled at
random from the worlds population if they believe in god X and you'll
get perhaps a 20% positive response.


In the Microsoft antitrust case, the Federal Appeals Court specifically
found that Microsoft was a monopoly, in law and in fact. This was an
explicit finding, not a passing inference.

Well, I disagree with them and as I've noted courts are not as much
about finding the truth as they are about finding what is acceptable in
the political climate. It is my belief and contention that there can be
no monopoly when there are alternatives.

Ah, well, they don't care - they are the law.

Still doesn't make them correct. I recall American Express complaining
that the big M/C / Visa monopoly was shutting them out, this at a time
when AmEx didn't even offer a comparable product. How the hell can a
monopoly be shutting you out of a market when you don't even offer a
product for that market?

Pete C.