-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ethan Dicks wrote: Get off my graphics display.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 John Floren wrote: It might seem odd, but I don't know how to use 'ed'. I kinda know 'ex' due to the fact 'vi' is 'ex' turned from a line editor to a screen editor. Most of what I know about computers from way back is mostly limited to UNIX (and that's only because UNIX didn't die like the other OSes.)

Kirn Gill wrote: I hate statements like this. Died like what OSes? MVS? VM? VSE? There are a bunch of OSes from back then which are still around. Peace... Sridhar

On Wed, Jun 10, 2009 at 8:55 AM, Dave McGuire<mcguire at neurotica.com> wrote: Anything without pipes makes me choke and condemn it to a rightful and speedy death. I like my 30 year old OSes to at least include my favorite 40 year old innovation ;) John -- "I've tried programming Ruby on Rails, following TechCrunch in my RSS reader, and drinking absinthe. It doesn't work. I'm going back to C, Hunter S. Thompson, and cheap whiskey." -- Ted Dziuba

On Wed, 10 Jun 2009, Dave McGuire wrote: I agree with this statement, and out side of this audience how many people even know anything besides Windows exists? There are a lot of people that think all computers run Windows. As for people thinking certain OS's are dead, I just want to say that I continue to be amazed that GCOS-8 is still alive. Though having worked as a Systems Analyist on a DPS-8 running GCOS-8, I suspect the problem is the difficulty people have getting off of it, coupled with the fact Group Bull seems to have the brains to keep supporting it. I shudder to think what it must cost a site to run a GCOS-8 system! I would also be interested in knowing just how large of a user base there is. Zane

I am not sure if I need to change the topic header ... Just out of curiosity Will, is OS/2200 the follow-up of EXEC on the Sperry1100? I worked on those machines, using EXEC1100 39R5 in 1985-1990. In the end I worked for the company helping another company setting up a 2200 system. The modern follow-up of the 1100, but then the OS was still EXEC1100. I did the EXEC internals course, and was able (then) to read and process a panic dump printout and find the culprit that caused the (very stable) OS to crash. Fond memories of that time ... loved PLUS and MASM1100. Does some EXEC 1100 simulation exist? Not the real hardware, but if I could enter @ASG,T and @USE would be cool! Coding in MASM1100 would be fun to relive! thanks, - Henk.

Yes, they are all simulated now TTBOMK. -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- Time makes more converts than reason. -- Thomas Payne ----------------------

On Wed, 10 Jun 2009, Dave McGuire wrote: Of course this isn't the only group of technical people. The disturbing thing is, there are a sizable group of "technical" people who thing Windows is all there is, and either don't realize anything else exists, or that anything else still exists. These are the people that really scare me. Zane

2009/6/10 Dave McGuire <mcguire at neurotica.com>: I reckon Zane is bang on the nail, actually. *Most* "techies" now know nothing except the x86-32 PC and Windows. DOS is a forgotten mystery; Windows 9x is historical and unknown. PCs have always been 32-bit and the 64-bit transition scares them. They have never seen or used any networking protocol other than TCP/IP (and that is a mystery except to specialists). They don't know how to use the command prompt and increasingly they have never used floppy disks. And yet, these are the "technical experts" who are building the systems upon which we all rely. These people think it's efficient to run a copy of Windows 2003 on a server (which needs a couple of gig of RAM to work well) and then run multiple VMs on that containing copies of Windows 2003 or other flavours of Windows. They think virtualisation is new and clever and it doesn't occur to them that not only is this wasteful of resources, but it's a nightmare to keep all those copies patched and current. They think that encapsulating SCSI over TCP/IP is an efficient way to connect servers to disk farms. They think that a full-screen GUI session at 1024x768 in 16,385 colours, carried over 100Mbit Ethernet, is an efficient way to remote-control a server. They can just about stand to use such a session carried over an 8Mbit ADSL connection, but they'll whinge about it. And these people build the systems that keep us alive in hospital, that contain and manage our money and taxes, that schedule and control our planes and trains. I find it terrifying, myself. -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

Pontus Pihlgren wrote: VM, of course. (And CP-67, if you want to go way back...) Peace... Sridhar

On Thu, Jun 11, 2009 at 3:51 PM, Kirn Gill<segin2005 at gmail.com> wrote: Years and years ago, when simh first broke onto the scene, my "fast" machine was a SPARC1 (20Mhz/12 MIPS) w/64MB of memory. One of the first things I loaded up, since I had real tapes on hand, was 2.9BSD. It was quite a bit slower than a real PDP-11, but I didn't have any real PDP-11 disks over 10MB, so the virtual environment was "better" because I could allocate 40MB of my 1.8GB disk to hold the guest OS. Fortunately, when I was debugging a problem with the RP module, I had moved up to a SPARC5 which ran a virtual PDP-11 faster than the real thing. Given how many times I rebooted the virtual PDP-11, I was very happy to be doing this on a faster platform. Speed isn't everything, but it sure is nice when you can get it. -ethan

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Eric Smith wrote: And that's why I say "usually".

But wouldn't this be more of an emulator than a virtualization? I'll buy SheepShaver on BeOS, since the code runs "native" on the 603s, but these x86_PC-on-PPC_Mac packages I would place under emulation since the actual object code never gets to directly touch the cores (only a translation). -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- Advertising is the banging of a stick in a swillbucket. -- George Orwell ---

I agree, but then there's also the dividing line between a VM and virtualization. Actually, I'm not surprised to hear that some emulation had to be done for x86 originally -- the ISA certainly doesn't lend itself well to virtualizing out of the box ;-) FWIW, a small correction: Alpha Micro's 68K emulator actually runs at a somewhat higher level than the others. While it is analogous to the Power Mac 68K emulator in what it does, it runs more at the AMOS equivalent of userland, in implementation thus more like Apple Rosetta/QuickTransit. -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- The only abnormality is the inability to love. -- Anais Nin ----------------

2009/6/12 Pontus Pihlgren <pontus at update.uu.se>: As far as I know, VMware still doesn't use the hardware emulation in modern Intel & AMD chips. They firmly believe that their own approach is more powerful and offers better performance. I believe VirtualBox also has its own, different approach to x86 virtualisation, involving forcing Ring 0 code in guests into the seldom-used-on-x86 Ring 1, whereas user code normally runs in Ring 3 or something. I am not an expert in the minutiae of this stuff, I'm afraid. (Although when I interrogated Connectix about VirtualPC about 10y back (with my journalist hat on) they were so thrown by my deep-tech questions that they flew Jon Garber, the Connectix founder and chief scientist, over the Britain to talk to me. That was fun and very interesting indeed.) -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

Liam Proven wrote: Well, there is one feature that VM has that I've not seen in many other situations. VM can run as a guest under VM. Peace... Sridhar

Sridhar Ayengar wrote: I asked engineers at VMware why their products won't do this, expecting that it would be due to some limitation in their virtualization technology. I was dumbfounded when they explained that they deliberately prevent it in order to avoid confusing their users. :-( If that's the real reason, they should have a way for a sophisticated user to set something in a .vmx file to enable it. Eric

2009/6/12 Sridhar Ayengar <ploopster at gmail.com>: My guess would be that this is a little protective colouring of the truth. A VMware guest only delivers about 80% of the performance of the raw hardware, because all the kernel code - all the core OS itself, all device drivers etc. - are running in a software emulator. And on a PC, this is a lot more critical than on a mainframe, because PC software is far more CPU (and graphics) intensive. Run a VM under a VM, this would be even slower - you'd only get about 64% of the performance and my guess is that if it worked at all, VMware feel it would make their product look bad. -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

2009/6/13 Ray Arachelian <ray at arachelian.com>: It does, but it's something of a con. It's not a bare-metal hypervisor, it's a very-cut-down copy of Linux with some proprietary VMware kernel modules that do the virtualising. There is an ongoing argument with WMware that this means they're linking to GPL code and must release the source to the actual hypervisor, which of course they won't do. The company adamantly maintains that Linux is used as nothing more than a bootstap loader, like MS-DOS was for Netware 3, but they can't prove it without publishing code and they won't do that. That's not a very significant part of the overhead - it's the actual software emulation that saps 20% of the performance. It still does that. The VMware tools provide cut & paste, filesystem access, a free-tracking mouse pointer and so on, but the ring-0 CPU, motherboard chipset, NIC, graphics card etc. are all still emulated. The big-iron server editions of VMware do allow things like actual physical hardware NICs and SCSI adaptors to be dedicated to VMs, and then you'll get near-native performance on I/O, but the 80%-of-native-performance figure is a best-case /with/ all the tools and extensions installed. Swings and roundabouts. Some things are faster, some slower. The AMD "Pacifica" virtualisation extensions are more capable than Intel's, and include hardware remapping of page tables for virtual memory, but there's still some stuff that VMware's decade-old, highly-optimised code does better. Myself, I prefer the architectural elegance of the hardware solution, which also means much smaller, simpler hypervisors. The KV hypervisor is a small Linux kernel module that does everything in one small binary, for instance. Built by using bits of QEMU for VM setup and config and so on, it's pretty simple. Oh, yes, indeed. -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

2009/6/12 Pontus Pihlgren <pontus at update.uu.se>: True. Good point! Even so, it's more efficient with OS-level virtualisation. The only case I can see for full-function OSs running on top of other full-function OSs is, for example, if you want 1 host to run several different OSs - e.g., a VM with NT4 Server, a VM with Linux and a VM with Solaris, or some random combination such as that. However, I fear that the most common reason will be that all the techies know is Windows Server, so they just run lots of instances of that and waste masses of resources. Even if you have the resources to burn, waste is bad. Waste is always bad, I feel. Several. Solaris with Containers and Zones & FreeBSD with Jails are the 2 best-known. AIX has WPARs, which I believe are similar. Linux doesn't have anything built into the kernel, but there are a number of 3rd party additions: FreeVPS, Linux VServers & OpenVZ. Virtuozzo is a commercial product for doing much the same and is available on Linux and Windows. I think it's easier when it's built into the OS than to add it on later. I hadn't read this when I wrote the earlier part of my message, honest! :?) Oh, it certainly has its uses, and on VMware's ESX server, tools like VMotion and VirtualCentre are a massive boon for manageability, albeit at a small but significant price in terms of performance. But performance is rarely a problem these days. It just bothers my sense of systems elegance to see big full-function OSs running on top of other big full-function OSs. I really deeply dislike that sort of kludge, and my suspicion tends to be that an inelegant solution is a flawed solution and that those flaws will eventually come back to bite you. -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

On Thu, 11 Jun 2009, Josh Dersch wrote: Lucky B******! :-) Even more lucky since that indicates they've never used cassette tapes as a storage medium for computer data! The problem is summed up by the following, "those how forget history are doomed to repeat it". I forget who said that, and it is a very rough paraprase, but the meaning is clear. Businesses seem to favor the kids fresh out of College with the "bright new ideas". This needs to be balanced by people with a historical perspective. A prime example is a meeting we had at work on Monday, when we came to realize that a performace issue we're fighting is the exact same issue we had 8 years ago. The solution that solved the problem 8 years ago now suffers from the same exact problem due to the advances of testing. Those of us with a historical perspective were able to quickly explain why various "fixes" won't work. What really irritates me is all these "new" technoligies that Microsoft has "invented" that have been around for decades. Some aren't even new to the PC world. Zane

2009/6/11 Josh Dersch <derschjo at mail.msu.edu>: Well, fair point... But is there a previous time when there was quite such a single-vendor monoculture as there is now? Because /that/ is what I find the really scary bit. It's not that I hate Windows. I hate all OSs - it is, of course, axiomatic that they all suck. I actually make most of my living from Windows, I just happen to mostly run Linux at home, and that's because my Mac's dead. The thing that worries me is the uniform uninterrupted Windows monoculture that MS has managed to create. I really do feel that that is very unhealthy. You can't make an informed decision about the best platform for the job - *any* job - when you only *know* one platform. And there still are other viable, valid platforms out there. SPARC and POWER are healthy, as are AIX and Solaris. IBM System i (the former OS/400) is also in reasonable fettle and can run on pretty much all the modern POWER machines - the only difference now between IBM POWER servers is the OS they run. The old RS/6000 and AS/400 lines have merged. I'd say HP/UX was fine, except it is stuck on Itanium, which isn't much cop. VMS could be a contented if HP pushed it, but it too is stuck on IA64. On the desktop, Mac OS X is a good solid system and it's a capable server as well. Both IBM and Unisys are still making new mainframes - there may be others, too, that I don't know about. The architectural horrors of 8086, 80286 and x86-32 are lessened by x86-64, which is ubiquitous now. Things are not quite a *complete* monoculture, but everything that isn't Windows is 5% of the market, and the non-x86 stuff is probably only a tenth of that, in terms of machines. That's not a good balance. Oh yes. ARM is selling billions of chips a year - many times more than all the x86 chips from all vendors put together. But almost all is in little battery-powered gadgets. -- Liam Proven ? Profile: http://www.linkedin.com/in/liamproven Email: lproven at cix.co.uk ? GMail/GoogleTalk/Orkut: lproven at gmail.com Tel: +44 20-8685-0498 ? Cell: +44 7939-087884 ? Fax: + 44 870-9151419 AOL/AIM/iChat/Yahoo/Skype: liamproven ? LiveJournal/Twitter: lproven MSN: lproven at hotmail.com ? ICQ: 73187508

Once upon a time, when I worked for a large software company, my recruiting team and I would sit down each Friday with a huge stack of resumes. I would skim them and sort them into plausible and you've-got-to-be-kidding, occasionally pulling one out and saying, "I want to see this person next week." The recruiters used this as training input, to help them understand our needs. They'd also ask for updates on the project, so they could further understand just what we were looking for - in fact, one of them got so good at it she eventually joined a product team. Of course, this was too good to last. By the time I left, Recruiting was a 'virtual' organization, and you never knew who would be answering your emails. (I never met my actual 'assigned' recruiter in person.) Before that, they'd assigned recruiters to candidates rather than teams, based on the candidate's last name (now that's relevant criteria). In either model, there was no opportunity for the recruiter to grow to understand our team's needs - or to bond with us, becoming part of our success and feeling accountability for it. (In the old days, we invited our recruiters to ship parties and such.) Candidate selection was based on wordsearch for buzzwords - I was actually required to provide a list of three to five 'key words' for each open position. I think they called this 'progress.' -- Ian ________________________________________ From: cctalk-bounces at classiccmp.org [cctalk-bounces at classiccmp.org] On Behalf Of blstuart at bellsouth.net [blstuart at bellsouth.net] Sent: Thursday, June 11, 2009 9:23 AM To: cctalk at classiccmp.org Subject: Re: UNIX V7 And of course, I'm aware that you can't really describe in a job posting that kind of person. But the checklist is not the answer. Making sure the resumes are reviewed by someone who knows what they're looking at is. I'd much rather have 200 resumes put on my desk than to have 5 candidates vetted by HR and sent to me on the basis of their depth of knowledge of a specific language because they attended a 2-day training session on it. BLS

On Thu, Jun 11, 2009 at 3:20 PM, Kirn Gill<segin2005 at gmail.com> wrote: This is starting to sound like those endless lists of "things today's high school graduates have always/never seen". I'm not really arguing with the above, but it's just an observation that as we all get older, the sort of tech we grew up on, no matter when we got started or how old we were then, eventually becomes lost to history and newer stuff comes along. In my case, I started with 1970s microcomputers when Bill Gates was still selling papertape and quickly moved on to 16-bit and 32-bit minicomputers for a living. That is more exposure than most of the people I work with every day... it's a mostly Java operation here, with lots of .NET, and there are two of us in the building who have ever done any development or system adminstration on anything older than a few years ago. In our case, it's multiple VMs running Linux, but for at least one corner of the room, the rest applies. It's no different to patch 10 virtuals than 10 physical boxes. I agree that there is some efficiency lost with the current approach to servers, but since present day OSes and applications are mostly terrible at sharing CPUs when you start to have 4 or 8 or 16 CPUs per box, I'd argue that you get more efficient CPU utilization by breaking up the CPUs into several smaller chunks. I/O bandwidth is another thing entirely (as is off-cache memory bandwidth), but if you have one large server and you try to double the RAM and double the CPU, you won't get close to double the amount of work done. You underestimate how quickly badly-written applications grab RAM as they fail to scale up gracefully. _Should_? Yes. _Is enough_? Not hardly. Programming resources are so expensive compared to hardware that if someone says it will take 10 hours to change the software, test and deploy it to make it more memory efficient, I can just about guarantee that the manager will approve doubling the memory in the machine before approving the labor to make the memory upgrade unnecessary. There's nothing new in this over the past several decades. Only the details of how many dollars buy how many units of memory changes. -ethan

Zane - Although I primarily lurk here, one of the reasons I really like reading this list is the feeling that the older stuff is being kept alive. As one of those techies who did development work on early voicemail (on UNIX platforms even), much of the older systems seemed "dead" to my colleagues. At one point when I started my own company I used to buy old disk drives, etc off back docks to sell to legacy system operators (insurance companies, old financial houses, etc) that couldn't find old disk drives, etc to keep their systems running. Kept us alive until we had positive cashflow ourselves. Much like antiques, it feels good to in some small way support the maintenance of these systems. Thanks to all who do, and keep posting! It's great fun to read...one day with sufficient funds (and SPACE and time) I'll do some salvaging myself... John Zane H. Healy wrote: -- Kuenzig Books, ABAA PO Box 452, Topsfield, MA 01983 978-887-4053 9am-7pm Eastern Standard Time 866-512-3053 tollfree 9am-7pm EST inquiries at kuenzigbooks.com Important Books in Science, Technology and Engineering Secure ordering at http://www.kuenzigbooks.com Save time, money and earn other exclusive benefits. Members of: ABAA http://www.abaa.org MARIAB http://www.mariab.org ESA http://www.ephemerasociety.org Buying 18th-21st century books, manuscripts, ephemera, scientific instruments, artifacts, and related material as well as quality books and manuscripts in many fields.

On Wed, Jun 10, 2009 at 10:02 AM, William Donzelli<wdonzelli at gmail.com> wrote: At this point, Multics does not run anywhere in the world and, to my knowledge, nobody even has the hardware to run it... well, CHM has DOCKMASTER, but can that still run? John -- "I've tried programming Ruby on Rails, following TechCrunch in my RSS reader, and drinking absinthe. It doesn't work. I'm going back to C, Hunter S. Thompson, and cheap whiskey." -- Ted Dziuba

On Wed, 10 Jun 2009, Ian King wrote: What kind of hardware are you talking here? Looking at http://www.multicians.org/site-dockmaster.html I assume you're talking about the "4 MW paging device (bulk store)", though the same page mentions that CHM didn't recieve the disks. Are the drives all the removable diskpack type? We used mainly fixed disks, but had a few removable packs. Does anyone know what it takes to connect IBM DASD to a DPS-8, and if Multic's would support it? I know that it is possible with GCOS-8, but I do not know what model, or how it would be connected. As *INSANE* as it sounds, someone dropped one of the two DASD units for the site I worked at off the back of the truck, and it wasn't replaced (not sure why), as a result we were unable to bring the IBM DASD online. As of this last weekend my Honeywell manuals are out of storage, and at home. I'm just not sure where they are in the garage, though I've a pretty good idea. It will be interesting to see just what I have manuals for as it has been years since I've seen them. I'm sure I don't have anything on Mulitics, as I worked at a GCOS-8 site. I'm not sure what I might have on hardware. I do know that when I can find the time, I want to go through and refresh my memory on GCOS-8. I haven't touched it in nearly 16 years. Zane

On Wed, 10 Jun 2009, Rich Alderson wrote: I was wondering about this, due to where the machine came from it seemed unlikely that any HD's or media would have escaped distruction. I'm not familiar with the RP07's, but the look close. There is a good chance I have details on the models. That is good to know. I don't doubt that. I'd love to see a emulator capable of running Multic's and DPS-8, but at the same time, I have doubts Group Bull would let copies of GCOS-8 out into the wild. Zane

On Wed, Jun 10, 2009 at 11:35 AM, Ethan Dicks<ethan.dicks at gmail.com> wrote: If "The Cuckoo's Egg" is about the NSA, then probably yes? -- "I've tried programming Ruby on Rails, following TechCrunch in my RSS reader, and drinking absinthe. It doesn't work. I'm going back to C, Hunter S. Thompson, and cheap whiskey." -- Ted Dziuba

Yes. For the gent who followed up asking about _The Cuckoo's Egg_, it's the story of a Berkeley astronomy geek tracking down a KGB cracker working out of East Germany. some of the systems at Stanford were part of the compromised network. Rich Alderson Vintage Computing Server Engineer Vulcan, Inc. 505 5th Avenue S, Suite 900 Seattle, WA 98104 mailto:RichA at vulcan.com (206) 342-2239 (206) 465-2916 cell http://www.pdpplanet.org/

On Wed, Jun 10, 2009 at 1:02 PM, William Donzelli<wdonzelli at gmail.com> wrote: You did. And it is (and I have made a lot of money on the ride down). I saw that start in the late 1980s when DEC was at the "top of its game"... we sold our products to DEC's customers, and when their userbase stopped growing at the rate it had been at, our potential market pool stopped growing, too. DEC kept making more money and newer and faster boxes, but they were mostly selling them to their existing customers as upgrades. Sure, folks were adding capacity all over the place, but the number of physical installations essentially stopped expanding 20 years ago, long before it obviously began to shrink. New in 2009? I have no candidates (and the number does not go up for 'new since 1999'). I love VMS, but I don't see it as a growth industry. It's not dead-and-gone, but neither is it thriving nor has it for a very long time. -ethan

On Wed, Jun 10, 2009 at 11:55 AM, Dave McGuire<mcguire at neurotica.com> wrote: Common indeed - an example from just this week: I was volunteering at FreeGeek Columbus, sifting through a pile of donated 2U servers, when one of the other volunteers _who uses Linux_ asked me what they were (because he honestly didn't recognize a boxy slab as a computer). Upon hearing the answer, he asked what a server does and where you'd use one. It's a bit tough to explain to someone the difference between a rackable server-class machine and a desktop machine when there's little common conceptual ground or vocabulary. I don't know how much of I was saying was starting to make sense because the last question was, "I'm thinking of starting a business with some friends. Do we need a server?" Besides the cop-out answer of "probably, at some point", I really didn't have a good answer for him. It's a good thing I'm not in Sales. -ethan

On Jun 11, 2009, at 4:17 PM, Kirn Gill wrote: It's more a matter of "computer" hardware being specialized to be an effective workstation or an effective server. There are big differences, despite many people very commonly using workstations as servers. RAID array is quite a common "standard" disk configuration on servers. I don't think I've seen a server in the past ten years that didn't have an optical drive, though. Graphics hardware has *no* place on a server. The fact that many servers have graphics hardware doesn't change this. Though admittedly it is somewhat of a matter of opinion, I have damn good reasons for my opinion. -Dave -- Dave McGuire Port Charlotte, FL

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patrick Finnegan wrote: Yes, but having the hardware is one thing. Having it as part of a local console (and for a PC, or other x86 server, a "local console" to me is an attached monitor, keyboard, and mouse.) is another.

On Thursday 11 June 2009, Dave McGuire wrote: I'm not sure how a cluster of rack-mount headless machines that use the video card's GPU as a co-processor is a collection of workstations, and not a collection of servers. GPUs can do a lot of math, very quickly (though aren't necessarily as accurate as general purpose processors). Otoh, I prefer serial consoles on servers to video consoles, even if my coworkers tend to disagree. Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dave McGuire wrote: Graphics hardware on a server becomes useful if the server needs to be fixed. Though my idea of "graphics hardware" is a cheap VGA monitor and VESA text mode. Some of those VESA advanced text modes are nice. 132x60 is nice on a 21" display. It's also good for debugging. Otherwise, servers need no display, and should have no display.

Dave McGuire wrote: Even today, one of my favorite diagnostic tools is the two-digit display on the front of RS/6000s. Peace... Sridhar

On Thu, 11 Jun 2009, Chuck Guzis wrote: Ditto, or if I feel a need to occasionally have a GUI, I'm likely to use Motif as the Window Manager, as somewhere in the past, it became light weight (which just boggles the mind). Zane

On 11 Jun 2009 at 22:19, Eric Smith wrote: Sigh--there goes the neighborhood. I guess I can see their point about not wanting to maintain two very different installers when it's only we knuckle-dragging neanderthals who stick with text mode. --Chuck

On Jun 12, 2009, at 2:52 AM, bfranchuk at jetnet.ab.ca wrote: Actually they're *not* all mixed together. That's why different distributions ("distros" for the prepubescent) exist. -Dave -- Dave McGuire Port Charlotte, FL

Gordon JC Pearce wrote: Some of us have more complicated configurations, and it's significantly more difficult to get them set up without the installer having support for them. But LVM is only one of many things they're dropping installer support for. In general, text-mode install looks like it is on the way out, and I'm complaining much more about that than about specific support for LVM.

On Thu, Jun 11, 2009 at 4:52 PM, Kirn Gill<segin2005 at gmail.com> wrote: None of my SPARCservers have graphics hardware, but it's trivial to diagnose and repair them using the console serial port. Same goes for my VAXen. So is a VT100. An LA120 is better (by creating a literal paper trail). We ran printing consoles on our major machines at work through the end of the 80s. After that, the cost of the paper outweighed the value of what was printed, so we switched to dumb terminals. There was one time, though, when the paper console logs were useful - we came back to work after a weekend to find that someone had spent the entire weekend banging out dictionary attacks on our 11/24 RSTS/E accounting machine. ISTR they did eventually get in (hundreds of pages of printout later). Fortunately for us, it was a quad-RL02 machine and trivial to remove from service and restore. No extra configuration or effort required to save the information - just attach a printing or non-printing terminal to the console port and walk away. -ethan

Let's also give credit where credit is due - there are huge numbers of *nix guys that are as bad as the Windows guys. The penguin crowd are the worst offenders. -- Will

Cameron Kaiser wrote: But let's be realistic -- probably the vast majority of people using the "other" O/Ss also use either a Windows machine, a Linux machine, or a Mac, or some combination. I'm okay using quite a few different computers in quite a few O/S environments, but nothing beats having a machine for which new and useful programs are being written every day. The user base drives software development. And, for smart purchasers, software development drives hardware purchase choices. That being said, I am constantly amazed at how many IBM IMS database applications I see running in a week - more than ANY other older system. It's also amazing to see how little the system has changed since I was using it on a daily basis about 25 years ago. That was some freaky cool software for its time. Very functional and intuitive, at the application level. Warren

On Wed, 2009-06-10 at 15:14 -0400, Dave McGuire wrote: As one of the Penguin Crowd, I agree. The local linux user's group seems to be filled with people more interested in flashy gui stuff than understanding how the system works. Asking any kind of technical question of them usually meets with silence. I guess if I asked about configuring compiz or upping my FPS I'd get a lot of answers. Brian

I can tell you've been using Commodores too long ;-) -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- there's a dance or two in the old dame yet. -- mehitabel -------------------

Ok, gotta throw my 2 cents in here... :) On Wed, Jun 10, 2009 at 2:16 PM, Zane H. Healy<healyzh at aracnet.com> wrote: No kidding. I remember booting the Linux kernel on floppies (I think it was v0.99 or something like that), and I also remember the joy I felt when I booted Yggdrasil Linux and saw X come up. Before that, I had to use either SCO Open Desktop or Interactive ix/386 (both of which were horribly expensive) on my Northgate 386. I also can agree about RMS... I find him somewhat irritating, but I have to give the guy credit for sticking to his principles. He really believes what he says. The attitude of the community can be horrible. Oh, if I could, I'd haul one of my HP PA-RISC boxes down to work and use that, but I work for McAfee and security about hardware here is incredibly tight. I could easily bring it in here, but it would be a major pain to get it back out of the building. Agreed. I'm no fan of MS and I do have quite a bit of experience with Windows. I spent 13 years writing code for Win16 and Win32, and when they put their minds to it they can produce some cool stuff. Yow. Vista. True, but what a development framework! :) The community wants to be on top but all the infighting is killing that. No comment. :) Yes, but at least you can get a decent semi-free license for it. I'd love to see this continue... OpenSolaris can be a lot of fun. Damn... you hit that one on the head. Mark

On Jun 11, 2009, at 1:04 AM, Zane H. Healy wrote: Auspex!! What awesome machines they are. For years I ran an NS-6000 and two NS-7000s at work. -Dave -- Dave McGuire Port Charlotte, FL

Cameron Kaiser wrote: I don't like AIX. I love it. Peace... Sridhar

On Jun 11, 2009, at 7:51 AM, Zane H. Healy wrote: What you have to understand is that in the case of the kernel, AIX is and internal IBM control program with Unix semantics "spray painted" over it. All of the AIX commands were written from scratch to match the Unix commands. In some cases with "improvements". In reality, AIX is the ultimate Unix clone since it's one of the few Unix-like OS' that is actually be branded as Unix(tm) by X/Open. Linux is a Unix-like OS and can't use the Unix(tm) because it can't pass the X/Open conformance tests which is a requirement for being able to use the Unix trademark. And for extra credit, what Unix(tm) is the highest volume Unix? TTFN - Guy

On Jun 11, 2009, at 10:00 AM, Liam Proven wrote: It depends upon which variation of AIX you're talking about. I've dealt with AIX/370, AIX PS/2, AIX RT, AIX V3.x and later. With the exception of AIX/370 & AIX PS/2, they all used completely different code bases. What I was referring to (because that's what most people consider these days) is AIX V3.x and later. Those versions only ran (runs) on RS/6000 and later Power machines. The code base for AIX V3.x and later started out as some derivative of the AT&T code but the base kernel never was (except possibly some of the subsystems). The control program itself was completely alien to the AT&T code base. The entire structure was based upon (at the time) the Power's nearly unlimited virtual address space (52 bits). The 64- bit version has an 80 bit virtual address space. So the way the kernel was organized was to assume that address space was free. Need an array, allocate the address space for it statically and let the VM fault in physical memory as it's needed (which is also alien to most Unix implementations). The AIX control program was mainly written by 2 folks from Watson Research. TTFN - Guy

On Jun 12, 2009, at 7:22 AM, Liam Proven wrote: Yea, I wish they'd kept AIX PS/2 going too. I had a lot of time and effort invested in it (I did all of the SCSI support for it). As far as Workplace went, that was a damn shame. I was one of the original 6 people on the project. It was killed off for political reasons. Some of the concepts (and people but sadly no code) are in OS X. TTFN - Guy

On Thursday 11 June 2009, Zane H. Healy wrote: AIX seems a lot nice when you stop trying to think of it as UNIX. AIX Isn't uniX. ;) Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

Augh! Sridhar, how did I forget you in that list! *ashamed* -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- "Kirk to Enterprise: beam down yeoman Rand and a six-pack." ----------------

On Jun 11, 2009, at 8:44 AM, Cameron Kaiser wrote: I like it ok. It's a little weird around the edges, but I like the fact that it's rock-solid and doesn't throw me too many surprises. I do some AIX work around town occasionally and I have a '397 here hosting a P/390. -Dave -- Dave McGuire Port Charlotte, FL

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mark Davidson wrote: Yeah, but you have to use that horrid mess called Objective-C to use said framework. Which, all-in-all, makes said framework useless crap. I want to shoot the people responsible for Objective-C.

On Thu, Jun 11, 2009 at 5:11 PM, Josh Dersch<derschjo at mail.msu.edu> wrote: *nods* I just went to a lunch-time presentation about developing an iPhone app. The only real problem I had was that the presenter really only knew Java (self-admitted), and any aspect of Objective C that wasn't Java-like confused him (he really did ask the audience if ".h" include files were part of C or not because he did *not* know the difference between C and Objective C). I guess it must be a whiz-bang development environment if someone who just doesn't know the language can write apps in it that are available for sale right now. He did say one thing that illuminated much for me - how many things are labelled "NS" because they came from NeXTStep. The rest of the room remained in the dark, but the light came on over my head. It makes me want to go home and fire up my NeXT cube. -ethan

On Jun 11, 2009, at 1:58 PM, Kirn Gill wrote: Funny, I know more people who want to shoot the people responsible for C++. -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

On Jun 11, 2009, at 2:33 PM, Sridhar Ayengar wrote: Yes, but he had enablers. -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

At 04:37 PM 6/11/2009, Dave McGuire wrote: And here I thought you were putting stuff in square brackets just to make fun of Objective C. It had been about a decade since I'd looked at Mac development environments. Like others, I thought writing iPhone apps might be fun and profitable. Looking at sample code made my head hurt in the same way that looking at C++ code a decade ago made my head hurt. ("You think the computer will always give you more memory when you want it, and you're not coding for the exception?") I guess I'd need to read a few books before it would start to make sense. - John

On Thu, 11 Jun 2009, Christian Kennedy wrote: *raises his hand* Delphi Forever! *ahem* g. -- Proud owner of F-15C 80-0007 http://www.f15sim.com - The only one of its kind. ScarletDME - The red hot Data Management Environment A Multi-Value database for the masses, not the classes. http://www.scarletdme.org - Get it _today_!

On Wed, 2009-06-10 at 14:16 -0700, Zane H. Healy wrote: One of the problems I ran into with a couple of packages I wrote was Debian "maintainers" buggering about with stuff to get it to compile on all supported platforms and not passing changes back to me. I wouldn't have minded so much, but the software was *specifically* only intended for use on a PC or (at a pinch) a Mac with a serious audio card. Why they were bitching about it being able to compile on S390 or MIPSEL, I really don't know. It hasn't a hope in hell of being useful on anything other than a PC. Gordon

DEBIAN PROJECT KNOWS BEST. YOU WILL NOT QUESTION DEBIAN PROJECT! My favorite so far is how Debian Project disables encryption in a certain RADIUS package because Debian Project disagrees with the license of the encryption library the programmer used. You have to go out of your way to build a local version and NOT have Debian overwrite your local version with their lobotomized version on every upgrade. If you ask about this you are informed that you should pick another RADIUS package because the programmer is "an asshole" who "won't compromise" over a "simple change". The stupid part is that the part that Debian thinks they should be exempt from is a provision of the crypto library requiring the programmer to acknowledge use of the library in promotional materials, which they say is against the GPL. (After all, you should be working for THE COMMUNITY and not looking for personal credit for your work!) There's also the stupid new provision in the installer that you MUST create a local non-root user to install the system. But Debian Project, what if I use LDAP and Kerberos to provide users on my system? The answer is "You aren't supposed to do that!" The workaround is to install the system without a root password. DEBIAN PROJECT KNOWS BEST. YOU WILL NOT QUESTION DEBIAN PROJECT! (But isn't this the same kind of behavior I was bitching about coming On Jun 10, 2009, at 4:56 PM, Gordon JC Pearce wrote:

Ethan Dicks wrote: Well what I liked about Debain many years ago was that I could install the system via a dial up modem. Now days if I want linux I go to - cheap bytes - .

On Thu, 2009-06-11 at 07:47 -0500, Daniel Seagraves wrote: Although this is offtopic for other reasons, it's probably been about 10 years since I had a usable root account on any system I've installed. These days you should be using sudo. Gordon

On Thursday 11 June 2009, Daniel Seagraves wrote: I haven't seen Debian's installer require you to do this, ever, even on Debian/Lenny. Perhaps booting with DEBCONF_PRIORITY=low or setting that option in the installer fixes this problem. FWIW, sometimes the "it has to be free" attitude of Debian gets annoying or in the way, but when they have their shit together, they seem to make a damn fine OS. Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

On Thu, Jun 11, 2009 at 2:05 PM, Kirn Gill<segin2005 at gmail.com> wrote: Every single mail message does not necessarily require a response. John -- "I've tried programming Ruby on Rails, following TechCrunch in my RSS reader, and drinking absinthe. It doesn't work. I'm going back to C, Hunter S. Thompson, and cheap whiskey." -- Ted Dziuba

On Thu, 2009-06-11 at 11:39 -0500, Daniel Seagraves wrote: If you're rolling out *that* many boxes that use some sort of common auth system, you might be better creating a suitably tweaked installer. That way you have a common image that you push to the box, maybe even netbooting it, and you don't have to worry about footering around with the config after - you can even include the packages you want that aren't installed by default. As someone said once before, the sequence goes "repetition, boredom, complacency, horrible accident, 'Jeeez I wish I was still bored'..." Gordon

At 6:17 PM -0500 6/11/09, Daniel Seagraves wrote: Depending on what this business does and what regulations it has to follow, this could be a serious issue. Zane -- | Zane H. Healy | UNIX Systems Administrator | | healyzh at aracnet.com (primary) | OpenVMS Enthusiast | | MONK::HEALYZH (DECnet) | Classic Computer Collector | +----------------------------------+----------------------------+ | Empire of the Petal Throne and Traveller Role Playing, | | PDP-10 Emulation and Zane's Computer Museum. | | http://www.aracnet.com/~healyzh/ |

Daniel Seagraves wrote: In my opinion, having a password expiration policy with such a short period is counterproductive. It will cause the users to be more sloppy with their passwords in various ways, including leaving the passwords written down in places they can easily be found. It will also make users favor weaker, more easily guessed passwords, even if the system sets minimum requirements; users are more willing to memorize a stronger password if they're going to use it for a fairly long time. Eric

or cycling through a list of completely insecure passwords if its 10, go through the same 10 over and over, or 5 like you said, add a number to the end any expiry policy will cause this. if you use hardened passwords that are easy to type (but not remember) those work the best, so far that I've found. I even wrote a program to generate these (probably a number of them around). they are not based on keyboard patterns my latest one is designed around how people type left hand, then right, then left, a certain number each, they can type them, but never remember what they are. Dan. _________________________________________________________________ Create a cool, new character for your Windows Live? Messenger. http://go.microsoft.com/?linkid=9656621

On Fri, 2009-06-12 at 13:26 -0700, Eric Smith wrote: When I worked at IBM a couple of years ago (doing rather dull tech support stuff) I worked out that the password rules (something like "eight to ten characters, two to four upper-case letters and two to four digits not in the first, second, second-to-last or last position") yielded about 1000 valid passwords... Gordon

On Mon, 15 Jun 2009, Sridhar Ayengar wrote: For the systems that don't have short password fields, would'nt pass phrases be more secure? g. -- Proud owner of F-15C 80-0007 http://www.f15sim.com - The only one of its kind. ScarletDME - The red hot Data Management Environment A Multi-Value database for the masses, not the classes. http://www.scarletdme.org - Get it _today_!

On Mon, 15 Jun 2009, Sridhar Ayengar wrote: I wonder why more people don't advocate for that. Remembering something like "Molly slings the booze." would be a damn sight easier than "1dGhs!z2". g. -- Proud owner of F-15C 80-0007 http://www.f15sim.com - The only one of its kind. ScarletDME - The red hot Data Management Environment A Multi-Value database for the masses, not the classes. http://www.scarletdme.org - Get it _today_!

On Jun 15, 2009, at 10:13 AM, Dan Gahlinger wrote: Which, of course, is why you omit the spaces and run the words together, making dictionary attacks even more difficult. Let's see how a dictionary attack does with "mytestesare2infestedwithflamingspriochetes4you", shall we? Gene's original posting was restricted to systems that don't have short password fields; in such systems long passphrases of vaguely (or patently) offensive words are both easier to remember and harder to crack than shorter passwords of random characters. Even with its restriction of what? 128 characters? Windows would allow for the use of such constructs. -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

On Jun 15, 2009, at 12:09 PM, Dan Gahlinger wrote: The definition of "hard password" is generally one that is resistant to dictionary or social attack. By that definition you've failed to demonstrate that the passphrase I supplied in my previous example is any more vulnerable that "C0pp3rB0tt0m" or "i013ac$Z". In the absence of the ability to conduct a successful dictionary attack the difficulty of brute-forcing a passsphrase is a direct function of the length of the passphrase and the character space from which the passphrase is chosen. In such a context passphrases have a clear advantage, as it's easier for humans to remember sequences of words as opposed to semi-random collections of characters, thus encouraging a much longer length while discouraging the tendency to write down passwords that are difficult to remember. FWIW, you're the one who introduced Windows into this discussion; Gene's original comment had precisely nothing to do with Windows and while your comments are valid relative to Windows that's not the context for the conversation. You seem to be confusing a bad implementation of the translation of plaintext to cryptotext and the poor storage of said cryptotext with the relative security of passphrases vs. passwords. The two are utterly distinct. In order to produce a partial password the program in question must either have access to the resulting cryptotext for the password in question or have the Great Karnack module installed which allows it to know things without having any way to know them. For the purposes of the point that Gene raised getting hung up on Windows (or, for that matter, Unix v7 or anything else that makes encrypted authentication information visible) as a counterexample is useless. Any authentication system designed in the past decade by anyone with intelligence exceeding that of a pine martin is going to employ a relatively sophisticated transform (i.e., not crypt() and not an MD5sum) and isn't going to allow you to see the stored cryptotext, meaning that you're actually going to have to submit each password to the system for authentication rather than have some program magically spew it out to you. -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

On Jun 17, 2009, at 9:00 PM, Dan Gahlinger wrote: I include "patently obvious" and "only chosen by idiots" in the category of "social attack". If you have no access to the cryptotext then you are forced to submit each candidate password to the system for validation. Weakness in the cryptosystem is irrelevant if you never have access to the cryptotext; in fact if one assumes perfect physical security, a security policy created by someone with something greater than a room temperature IQ and correct software implementation then storing passwords in plaintext would be as strong as storing them in cryptotext. The original argument had nothing to do with Windows. The fact that Windows is brain-dead in this regard is irrelevant to the discussion of whether passphrases have strengths that in some cases make them superior to passwords. For passwords we want something that is easy to remember but hard to guess and which has a high degree of entropy from the set of valid passwords (it is entropy, not length, which is relevant to the strength of a password). Humans do poorly at remembering random vectors of characters of length much longer than seven but do reasonably well at remembering higher-order grouping, which is the mental crutch that passphrases provide. While longer is not inherently better, the increased entropy of true passphrases helps defeat probabilistic attacks and collapses the problem again down to something that is largely brute force. I doubt you're seriously advancing the notion that in the case of brute force attacks that longer is not generally better. There are 94 symbols on the standard PC keyboard; at eight characters there are 6,161,234,432,566,330 possible passwords, at 14 (the length of my current passphrase) there are 4,250,449,449,028,840,000,000,000,000 possible passwords. Using reasonable entropy assumptions (2^ bits of entropy based on password length) there are 8,589,934,592 "likely" passwords out of the total number of purely random passwords. Assuming that I change passphrases every 90 days I'll need to do around 33,140 probes/sec in order to compromise the 14 character passphrase vs 64.7/sec for an eight character password. Both are perfectly tractable if there is access to the cryptotext to test against; both are intractable if it's not (since in the latter case you'd have to be feeding them to the OS to test) , which is why systems that expose cryptotext or hashed passwords are really inexcusable. If I really cared about this I'd use the SHA1 of my passphrase as my "password" and use an SHA1 app on a PDA to compute the SHA1. As it turns out, I don't; the combination of the math and the fact that I don't use systems that expose cryptotext passwords coupled with a weak crytopsystem is enough for me to not care (and if I did I'd be using two or three factor authentication rather than passphrases). That's brilliant. Tell me, how does that work when I go from a machine with a QERTY keyboard to a dvorak keyboard? When using flying thumbs of fury with a Blackberry? When doing the painful one-finger hunt-and-peck with an iPhone? Biometric authenticaion of users based on keyboard behavior dates back to *at least* 1984 (that's when I was researching it), but it proved unacceptable due to things like changing keyboards, having multiple workstations of different manufacture, sporting injuries, being sick and being hung-over (yes, we sampled them all). You really should tell Bruce Schneier about this scheme of yours. I bet he'd tell the world all about it. See above; unless you're dumb enough to expose the stored passwords the strength of the cryptosystem is irrelevant save for failures of implementation or physical security. Not me; the only operating system I've mentioned has been Windows, and that in response to your holding it up as some sort of universal counterexample. Please get your attributions right. I said nothing of the system in question. I said that you were confusing two things that are distinct. Gene's original posting was not relevant to a given system, it was relevant to passphrases vs. passwords in general. If you want to recast the discussion to be "On Windows random garbage passwords are inherently superior to passphrases", fine, but that's not the conversation we're having. This is news? That's why (like the rest of us) you encrypt your boot volumes and all storage devices, both fixed and removable, right? No one is talking about the system, we were talking about passphrases vs. passwords in the abstract, which is a perfectly reasonable conversation to have. You do inadvertently bring up a good point; you'll note that brute force attacks against ATM machines are virtually nonexistent despite having "passwords" that are usually chosen from a universe of four to eight *digits*. Why is this? Oh, right -- there's no way to play 20 questions with the underlying system to test candidate passwords, leading us back to the same point: a well designed system should require that candidate authentication information be presented to the system itself, rather than allowing a circa-1976 dictionary attack. ObClassicCmp: Does anyone recall when AT&T and BSD Unix outgrew this? I didn't say cleartext, I said *cryptotext*. If you have access to the cryptotext and if the underlying cryptosystem is weak then you can trivially discover passwords without having to play 20 questions with the operating system and without leaving an audit trail behind you. If you do not have access to the cryptotext you have nothing to test your trial passwords against; if you have access to cryptotext and the cryptosystem is not brain dead you won't be able to extract partial matches. The fact that you can on Windows simply says that in this specific case Windows is brain dead. Perhaps you mean "md5 summaries of passwords"? md5 is known to produce collisions and thus is defective as a secure hash but it's not so defective as to allow the sort of behavior you've described. Who cares? Again, the question was regarding passphrases vs, password in an abstract sense, not in the case of Windows or any other system, past, present or future.. If you can't have a conversation regarding the relative strengths of passwords vs. passphrases without having to reference a specific platform then you've missed the point. -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

On Thu, 18 Jun 2009, Dan Gahlinger wrote: Be careful, Dan. There is a subtle, but significant difference between somebody not knowing what they are talking about V talking about a different subject. Please don't be offended by the following oversimplifications: Ophcrack cracks WINDOZE passwords. In order to do so, it takes advantage of the fact that it is almost trivial to find and read the "encrypted" hashed storage in Windoze. ophcrack reads the hashed storage of the password from Windoze, and then can generate a password that will hash to that and work. In theory, a hash function is "one way", that there is no possible way to compute the source string from the stored destination value. That, of course, is wrong. In theory, theory and practice are the same. In practice, theory and practice are quite different. If somebody is familiar with what algorithm is used, there is always the possibility that they might figure out a way to reverse the function. If you figure out a better way to factor large numbers into their prime factors, send a credible description to the personnel department at the NSA, and they will send a black helicopter to pick you up. Actually, you don't even need to contact them, just talk about it on a phone line or email that passes between Washington and Baltimore. If you have access to the hashed value, which is what ophcrack needs, then it IS possible to generate a string that will hash to the right value. Whether that is FEASABLE, or worth the effort, depends on whether the algorithm is well known, OR how much entropy there is in the storage. For example, AND BRINGING THIS BACK ON TOPIC, the passwords used by TRS-DOS are hashed and stored as a 16 bit value. We can see the hash, but not the original string of characters. OK, let's try AAAAAAAA and see what the hash value comes out to be. In the unlikely event 2^-16 that that hash was the one that we were looking for, then we now know that AAAAAAAA will work as the password, even if that was NOT the original one! Then try AAAAAAAB. write down your results in a flat file with fields in each record of "string tried", and "hash value". Although we are iterating the "string tried" for each new one, sort the file in sequence by "hash value". Eventually, that brute force technique will yield a string that will match the hash that we are looking for. But, even though THIS project is completed, keep going. Eventually, probably after a lot more than 65536 iterations, you will have a list of 65536 different strings, and can look up a string that will work for any hash value you need, even though there are gazillions of possible passwords. That one was easy, because Randy Cook only stored 16 bits of entropy. Even if we don't have access to the stored hash value, that 16 bit entropy means that we never have to try more than 65536 different "test" passwords. Ophcrack uses tables of precomputed hashes created with knowledge of the algorithm that was used, and taking advantage of the fact that MICROS~1 didn't even hash the entire password. Instead, any password longer than 7 characters is broken up into 7 character chunks, and each of those is hashed separately. That makes it possible to "unhash" one piece at a time. Remember WOPR? That means that a 14 character password is only twice as much work to crack as a 7 character one, instead of squaring the amount of work! None of that applies if we can't get access to the stored hash, although knowledge of the algorithm used might reveal some potential shortcuts. In the case of the Thinkpad that is being discussed, IBM claims that is "uncrackable". However, Wizard jpero at sympatico.ca sent a URL to instructions for SOME Thinkpads for trivial hardware to be able to read the UNENCRYPTED password straight from the memory of the "security" chip: http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/ So, the entropy of the password system IS how much work it is going to take, UNLESS you have access to bypass parts of the system, as Ophcrack has with Windoze. -- Grumpy Ol' Fred cisin at xenosoft.com

Fred Cisin wrote: Indeed. <chuckling> Hey, you don't even need to do that. I was hanging around the computer building in college, and gave a whoop of triumph when I discovered that the encryption method I had been developing actually did provide (mathematically proven) unbreakable code. Within 24 hours, I was talking to a couple gentlemen from an unnamed security agency, who advised me to avoid publishing my work. I told them that before I'd consign my work to the trashcan, I'd need a good reason. They provided one. Warren

John Floren wrote: Ha! Well played. But, who's to say that isn't the PRIMARY interpretation? (in yours, I picture the Guinness "Brilliant" animation commercials.) Crap, I'm still laughing.... Thanks! Warren

On Jun 18, 2009, at 3:07 PM, Dan Gahlinger wrote: Why? I already know that Windows is broken, I don't need Windows- specific tools to demonstrate that fact to me. Now, just as soon as you can offer up a tool that performs similar magic on a platform that doesn't expose its encrypted authentication information I'll start listening to you again, but until then I'm writing you off as one of those people who have been alive for less time than I've been worrying ITSEC problems. *plonk* -- Chris Kennedy chris at mainecoon.com AF6AP http://www.mainecoon.com PGP KeyID 108DAB97 PGP fingerprint: 4E99 10B6 7253 B048 6685 6CBC 55E1 20A3 108D AB97 "Mr. McKittrick, after careful consideration..."

On Thursday 18 June 2009, Fred Cisin wrote: I believe that was "1234" ;) I think that a side-thread about Spaceballs would be more useful and accurate than some people are being on this thread on password security. :( Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

Patrick Finnegan wrote: "12345", actually. Peace... Sridhar

On Thursday 18 June 2009, Dan Gahlinger wrote: If that's the case, I don't see how the randomness of a password matters in your ability to crack it. Re: passwords vs passphrases... I don't see how you can claim that a password is more secure than a passphrase. Using some basic combinatorics, you can calculate the strength of each, based on the possible combinations. A low estimate of the number of words in the English language is 500,000. If you use 4 words, and only 1/5 of the possible English words makes grammatical sense in each position, that gives you 100,000^4 possible passwords, so 10^20 total possible passwords. Using an eight charactor password, with any possible combination of generally valid characters (we'll call that ASCII chars 32-127, to make the math easier, or 96 possibilities), that gives you 96^8 possible passwords. If we call that 100^8 to make the math easier, that's 10^16 passwords. So, a conservative estimate for the number of possible passphrases vs an overestimate of the number of possible passwords leaves passphrases winning 10,000 to 1. Really? I doubt this applies outside of home environments. I know that the account/password distribution system we have at Purdue doesn't distribute anything but a password hash, and pretty much nothing uses LANMAN encrypted passwords anymore. In any case, I doubt that most important passwords (by percentage of passwords to systems) are (1) login passwords on Windows systems or (2) handled by a Windows system outside of the client's web browser (if even there). Huh? If they're "next to impossible to remember" then someone is more likely to write them down than a short phrase that they can both remember and type easily. The strength of a password storage system has nothing to do with the security of the passwords you are storing in it. If you're storing passwords in plaintext in a world-readable file or using a trivial crypt() function, it doesn't matter how secure your passwords are. If you're storing passwords securely (like a MD5 hash, with a reasonably sized salt), then the strength of the password/passphrase matters. So, which of these is it? And, where did you see it? What version of the OS, in what program, etc? I can't check this, as I don't have anything that runs Windows anymore to check this on. You can't decrypt an MD5 hash. You can potentially find collisions, but it's still not a trivial proposition, and you definately can't do it in parts. Also, it still doesn't necessarily give you the actual password, or something with characters in a set that you can enter into the password entry field. I don't think that the security of the password that people use to log into the home system (if they even have a password set for that) is a valid measure of security of anything except for what's stored on their home PC. Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

On Jun 11, 2009, at 11:35 AM, Gordon JC Pearce wrote: That's a pretty big sweeping assertion, one with which I wholeheartedly disagree. Sudo has been around for a very long time, and while it makes great sense for newbies, it gets in the way when people who know what they're doing are trying to manage a system. Use it if you like, but keep it the hell away from the systems I'm responsible for. -Dave -- Dave McGuire Port Charlotte, FL

On Thu, 2009-06-11 at 10:00 -0700, Zane H. Healy wrote: I can't remember the last time I used sudo and the argument _wasn't_ a shell. I guess it defeats the purpose, but I'm the admin so I can su if I wanted to anyway. :)

Zane H. Healy wrote: Same here, except that I use a real shell. :-) Eric

On Thu, 11 Jun 2009, Eric Smith wrote: Not to start a shell war, but because I'm curious, what is the shell? Zane

On Thu, Jun 11, 2009 at 6:20 PM, Zane H. Healy<healyzh at aracnet.com> wrote: The worst thing about the UNIX Wars was the constant shelling. -ethan

Ethan Dicks wrote: I'm not sure I can take this much pun-ishment. Doc

Zane H. Healy wrote: What I normally choose is bash, but I try to write scripts that will work with just about any sh. Back when I was using BSD on VAXen from 1983-1986 or so, everyone around me thought csh was the greatest thing since sliced bread (though I don't personally think that sliced bread is such a great invention). Every time they had to edit a shell script they had trouble because they had wired their brains for csh. I didn't want to learn two incompatible shell syntaxes, especially since at that time csh didn't support some of the sh features I tended to use a lot, such as some of the less common I/O redirections. (I assume that csh has gained support for those since then.) I used ksh starting around 1987. Sometime around 1989 or 1990 I switched to bash. People have tried to convince me that I'd be happier with zsh, and I'll admit that it has some cool features, but nothing sufficient to lure me away from bash. I've used csh enough that I can live with it if I'm forced to do so. Several companies I've worked for have set csh as the default shell and made it difficult to change, apparently thinking that this will somehow reduce the workload of their IT support staff. Eric

Zane H. Healy wrote: I went from csh -> tcsh -> zsh. I always script in either sh (actually mostly ash probably) or ksh. Peace... Sridhar

% man tcsh | grep Alderson Richard M. Alderson III, for writing the `T in tcsh' section -- ------------------------------------ personal: http://www.cameronkaiser.com/ -- Cameron Kaiser * Floodgap Systems * www.floodgap.com * ckaiser at floodgap.com -- Marry me and I'll never look at another horse! -- Groucho Marx -------------

On Jun 11, 2009, at 1:25 PM, Gene Buckle wrote: I just use "su". -Dave -- Dave McGuire Port Charlotte, FL

On Jun 11, 2009, at 2:26 PM, Chuck Guzis wrote: Well there you go. :) -Dave -- Dave McGuire Port Charlotte, FL

On Thu, Jun 11, 2009 at 10:25:52AM -0700, Gene Buckle wrote: How does it differ from 'sudo su'? That's what I usually do. Cheers, ?ngel

On Tue, June 30, 2009 8:44 am, Cameron Kaiser wrote: I just use "su". -Dave -- Dave McGuire Port Charlotte, FL

Gordon JC Pearce wrote: Funny, I was going to say exactly the opposite. I use sudo when I need to execute one command as root, ot maybe a few, but any time I need to do some heavy-duty administration I use "sudo bash", su, or just log in as root. Eric

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Zane H. Healy wrote: I'm a Linux user, and would rather use Linux than Windows, my problem is that I was born far too late and have been "spoiled" (more like "corrupted") by "modern computing" (also known as MySpace and the Pretty Picture Generators of Windows Aero and Compiz). Of course, what passes for "modern computing" for the majority of the population can easily be performed on an iPhone without anything really missing. (In fact, most people could trade in their PCs for iPhones and lose nothing) Haiku is the name you're looking for. I always wanted to get a SGI box and try to run IRIX on it.

Brian Wheeler ????????: And the flash has overtaken function. Witness KDE4 vs KDE3.5 and the primitive 3D Compiz. What use is a flashy gui that does whatever the hell it wants and sucks up CPU and memory? == When I was a boy I was told that anybody could become President. Now I'm beginning to believe it. -- Clarence Darrow -- jd

On Wednesday 10 June 2009, William Donzelli wrote: Really? I assumed that you were saying that Linux was (dead|a sinking ship) because it wasn't Windows. Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

On Wednesday 10 June 2009, William Donzelli wrote: I wasn't saying that they were equivalent, just that it was one or the other. Pat -- Purdue University Research Computing --- http://www.rcac.purdue.edu/ The Computer Refuge --- http://computer-refuge.org

On Thu, 11 Jun 2009, Liam Proven wrote: I would agree with this. I was wondering about this, but haven't had time to try OpenSolaris, and the last version of Solaris I tried on x86 was Solaris 7. If Linux only has 1% of the desktop PC market, it is a *LONG* way behind Mac OS X which has been increasing its market share at a nice pace. BeOS ran for a number of years on x86. If Amiga wanted Amiga OS to survive, they'd port it to x86. Thanks for mentioning Haiku, I couldn't remember what the name changed to, and haven't had time to google it. What is its current state? Do you happen to have any idea which is closer to a V1.0 release, AROS or Haiku? It has been way to long since I've had time to follow such things. Zane

On Thu, 11 Jun 2009, Liam Proven wrote: Mac OS X hit 9.63% in December. It hasn't been as low as 4-5% for some time now. You've been keeping up better than I have. It's been at least a couple years since I was able to follow this soap opera. I see they have a new update. USB support isn't quite there, but I believe The new browser is good news. It sounds as if while it's not really "there", it is *VERY* close! Which makes me happy. Haiku has had a fraction of the time AROS has had to get to where it is. BTW, AROS can now build itself as well, which is another of its recent developements. There are some tiny handfull of PPC based "Amiga" systems such as the AmigaOne which can run AmigaOS 4.x. They're insanely high priced for what they are. They were when they were brand new, and I imagine due to their rarity, it has only gotten worse. I wanted a PPC board for my Amiga 3000, but couldn't justify the cost. Agreed. This would not surprise me, but I have my doubts that it will ever have a userbase to match Linux. Of course when I started out with Linux, I didn't think it would ever have the level of acceptance it has now. Zane