(malware) why you should avoid Windows formats

There's a new virus out that "searches for MP3s, transcodes them to WMA format, wraps them in an ASF container, and adds links to further copies of the malware, all without modifying the .MP3 extension": http://it.slashdot.org/article.pl?sid=08/07/18/145223&from=rss

The real insight here is at http://it.slashdot.org/comments.pl?sid=618545&cid=24242285 , which explains why ASF is like the ActiveX of multimedia! It's a very short comment, so I'll take the liberty of reproducing it here:

For those of you who think this is just a troll, or are just unfamiliar with ASF:

Advanced Systems Format is a Microsoft-defined container format for audio and video streams that can also hold arbitrary content such as images or links to Web resources.

If a user plays an infected music file, it will launch Internet Explorer and load a malicious Web page which asks the user to download a codec, a well-known trick to get someone to download malware.

It's like the ActiveX of multimedia wrapper files. A security nightmare? You bet. Does it still depend on user stupidity? Well, yes.

(criminal,malware) hitting people below the belt

...from a company which is pretty famous for such behavior anyway.

I did not realise that the borg had stooped to vilifying IIT Mumbai and similar organisations and their employees/representatives in their mala-fide efforts to get OOXML ratified as an ISO standard. The fact that they tried to paint it as being in India's best interests is fine, but they seem to have well and truly crossed the line into saying that anyone who opposes it is therefore anti-India !!!!

The opening para of his open letter is itself pretty damning, and this long, (albeit sometimes a little dramatic), letter deserves wide dissemination among our peer groups.

With reference to the recent happenings in connection with the ISO standardization process of OOXML, actions by or on behalf of Microsoft have caused me deep pain and hurt. Apart from the personal anguish, these actions have tarnished the name of my Institute along with that of several other organizations represented on our committee. In my opinion, these actions go well beyond the behavioral boundaries for a commercial entity. some of these amount to interference with the governance process of a sovereign country. Luckily, wiser and experienced people are in-charge of governance of the nation. However, as a humble teacher and a proud Indian, I wish to register a strong and visible protest.

http://deepakphatak.blogspot.com/2008/05/this-is.html

(criminal) MediaDefender, MediaOffender, what's the difference...?

Hired gun blamed for business outage ( http://www.securityfocus.com/news/11521 )

First it was MediaSentry in the news for illegal investigations into piracy, now it's MediaDefender running a Denial of Service attack against a legitimate website that was hosting their own torrents.

Too bad it looks as if no one will get arrested for this due to some technicality of "knowingly" done or not. Anyone who thinks they did not "knowingly" do it probably also believes in the tooth fairy, but it's hard to prove it, so they get off scot-free.

(funny,process) you MUST follow the process...

http://thedailywtf.com/Articles/Stupid-Secretary-WTF.aspx

:-)

Soaps...

The nice thing about people who watch soaps is that you no longer have
to worry about what they think of you or anything you do or say.
Ever.

(funny) why they don't annoy me...

A recent gallery article on TechRepublic called the 10 most annoying programs on the Internet, talked about how annoying most software is. It's a very funny article (some excerpts below), but surprisingly, except Flash, none of those annoyances affect me at all, because I use free alternatives!

Read it for the funny comments (especially the one on Java)...!

(wow) distributed bug tracking

http://lwn.net/SubscriberLink/281849/99727b3d5ac9fc97/

Very lucid and readable article, as usual, from Jon Corbet, LWN editor.
Lots of food for thought in there...

(FOSS) why do people still take the GPL so casually?

http://www.groklaw.net/article.php?story=20080508212535665

Their actual GPL violation was, to my mind, quite small and not worth all this fight -- it would have been far cheaper for them to do that one extra thing that the GPL demanded, since they were doing most of it already.

But for some unknown reason they decided to dig their heels in! The moron who was arguing for them even tried to say that the GPL violates anti-trust laws!

There is a saying I often use: never ascribe to malice what can be explained by stupidity.

So, how stupid do you have to be to accuse the GPL of the kind of stuff that only entities like AT&T and IBM (in the old days) and Microsoft (recently) have been convicted of?

Or is it perhaps malice this time, not stupidity?

excellent article on reiser's conviction

Some of you may know that Hans Reiser, creator and lead developer of the
ReiserFS file system, has recently been convicted of murdering his
estranged wife. Publications like Wired went into CNN mode, treating it
as a scandal and playing on the human interest angle, and I believe
there are others playing up FUD-dy angles and demeaning open source itself.

Here then, is the absolute best article on the subject, for anyone who
cares about the **technical** impact of this conviction.

http://lwn.net/SubscriberLink/280228/b4f43fc3966cbaac/

reiserfs used to be a serious contender at one time...

but I stopped using it after a couple of problems I blamed on my ignorance and didn't bother investigating. Looks like those may not have been my fault :-)

...from http://hardware.slashdot.org/comments.pl?sid=538036&cid=23241212 :

----------

ReiserFS isn't even a has-been file system, it's an almost-was, and was never a real contender for a top filesystem, no matter how much some users loved it.

Why wasn't it taken seriously by everyone?
- When it encountered problems, it crashed spectacularly. You didn't just lose a file or a block of a file, you lost entire trees and could get metadata instead of file data and vice versa.
- It lacked basic tools, like "dump"/"restore" or "freeze".
- The fsck rebuild process was a security nightmare. A user could craft a file with data that would appear to the fsck process to be metadata, and take over the system after a reboot. In typical arrogance, the solution was "don't reboot, then".
- It didn't support streams or compatible metadata, thus no Mac sharing or SELinux. SELinux in particular is a requirement for many big corporations right now, and not supporting it means no buy.

And, yes, the arrogance of the maintainer played a part too. But even with a much nicer guy running the show, it would not have been a serious contender for the throne.