• Ken Thompson Recalls =?UTF-8?B?VW5peOKAmXM=?= Rowdy, Lock-PickingOrigins

    From rbowman@bowman@montana.com to comp.os.linux.misc on Tue Oct 28 20:03:06 2025
    From Newsgroup: comp.os.linux.misc

    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/


    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Bobbie Sellers@bliss-sf4ever@dslextreme.com to comp.os.linux.misc on Tue Oct 28 14:10:52 2025
    From Newsgroup: comp.os.linux.misc



    On 10/28/25 13:03, rbowman wrote:
    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking- origins/


    404 found!

    bliss
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Allodoxaphobia@trepidation@example.net to comp.os.linux.misc on Tue Oct 28 22:43:28 2025
    From Newsgroup: comp.os.linux.misc

    On Tue, 28 Oct 2025 14:10:52 -0700, Bobbie Sellers wrote:


    On 10/28/25 13:03, rbowman wrote:
    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/

    404 found!
    bliss

    Works here. Fix the obvious line break snafu.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Lawrence =?iso-8859-13?q?D=FFOliveiro?=@ldo@nz.invalid to comp.os.linux.misc on Tue Oct 28 22:59:36 2025
    From Newsgroup: comp.os.linux.misc

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-origins/>

    MULTICS didn’t die. Bell Labs pulled out, but the project continued,
    and did finally reach production, obviously too late to satisfy some
    parties. GE sold its hardware business (along with their rights to
    MULTICS) to Honeywell who didn’t know what to do with that weird OS.
    They charged an arm and a leg for it, but that didn’t seem to deter a
    small cohort of loyal customers.

    There are some documents at Bitsavers -- look at the brochure here <https://bitsavers.trailing-edge.com/pdf/honeywell/large_systems/multics/>,
    for example, and see how advanced the capabilities were that it
    offered, compared to any other early-1980s large-system OS.

    By the way, Thompson doesn’t use Unix any more. He gave up on Apple a
    couple of years ago, and uses Linux now <https://forums.freebsd.org/threads/unix-pioneer-ken-thompson-announces-hes-switching-from-mac-to-linux.88451/>.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Wed Oct 29 01:45:17 2025
    From Newsgroup: comp.os.linux.misc

    On 28 Oct 2025 22:43:28 GMT, Allodoxaphobia wrote:

    On Tue, 28 Oct 2025 14:10:52 -0700, Bobbie Sellers wrote:


    On 10/28/25 13:03, rbowman wrote:
    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/

    404 found!
    bliss

    Works here. Fix the obvious line break snafu.

    I've got to figure that out. Pan either wraps or it doesn't.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Lawrence =?iso-8859-13?q?D=FFOliveiro?=@ldo@nz.invalid to comp.os.linux.misc on Wed Oct 29 02:54:59 2025
    From Newsgroup: comp.os.linux.misc

    By the way, “Unix” is supposed to be a trademark. That means you use it as an adjective, not a noun.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Bobbie Sellers@bliss-sf4ever@dslextreme.com to comp.os.linux.misc on Tue Oct 28 20:45:45 2025
    From Newsgroup: comp.os.linux.misc



    On 10/28/25 18:45, rbowman wrote:
    On 28 Oct 2025 22:43:28 GMT, Allodoxaphobia wrote:

    On Tue, 28 Oct 2025 14:10:52 -0700, Bobbie Sellers wrote:


    On 10/28/25 13:03, rbowman wrote:
    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/

    404 found!
    bliss

    Works here. Fix the obvious line break snafu.

    I've got to figure that out. Pan either wraps or it doesn't.

    Copied to my clipboard then used the editor to correct the line break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.


    bliss- Dell Precision 7730- PCLOS 2025.10 Linux 6.12.55-pclos1- KDE
    Plasma 6.5.0
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From The Natural Philosopher@tnp@invalid.invalid to comp.os.linux.misc on Wed Oct 29 11:22:29 2025
    From Newsgroup: comp.os.linux.misc

    On 28/10/2025 21:10, Bobbie Sellers wrote:


    On 10/28/25 13:03, rbowman wrote:
    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/


        404 found!

        bliss
    Try without the wrap

    https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-origins/ --
    The biggest threat to humanity comes from socialism, which has utterly diverted our attention away from what really matters to our existential survival, to indulging in navel gazing and faux moral investigations
    into what the world ought to be, whilst we fail utterly to deal with
    what it actually is.


    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Wed Oct 29 17:32:47 2025
    From Newsgroup: comp.os.linux.misc

    On Wed, 29 Oct 2025 02:54:59 -0000 (UTC), Lawrence D’Oliveiro wrote:

    By the way, “Unix” is supposed to be a trademark. That means you use it as an adjective, not a noun.

    Trying to be more pedantic than thou, UNIX is the trademark, not Unix.

    https://unix.org/trademark.html

    Unlike most of the Microsoft world, case matters.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Wed Oct 29 17:43:55 2025
    From Newsgroup: comp.os.linux.misc

    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open source philosophy. “But Unix had a bit of that.” Maybe it grew out of what Dennis Ritchie was remembering, that fellowship that formed around Unix. “For some reason, and I think it’s just because of me and Dennis, everything was open…”

    It was just the way they operated. “We had protection on files — if you didn’t want somebody to read it, you could set some bits and then nobody could read them, right? But nobody set those permissions on anything … All of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Chris Ahlstrom@OFeem1987@teleworm.us to comp.os.linux.misc on Wed Oct 29 14:01:31 2025
    From Newsgroup: comp.os.linux.misc

    rbowman wrote this post by blinking in Morse code:

    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-origins/>

    <snip>

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    I dunno, any programmer who types enough code to get RSI
    (repetitive stress injury) gets cut some slack from me.

    I've been lucky to have only minor hand issues, but I've also
    tried a large number of different keyboards, mice, trackballs,
    desk arrangements, and posture, to mitigate the issues.
    --
    No discipline is ever requisite to force attendance upon lectures which are really worth the attending.
    -- Adam Smith, "The Wealth of Nations"
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Wed Oct 29 22:00:40 2025
    From Newsgroup: comp.os.linux.misc

    On 10/29/25 13:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix. “For some reason, and I think it’s just because of me and Dennis, everything was open…”

    It was just the way they operated. “We had protection on files — if you didn’t want somebody to read it, you could set some bits and then nobody could read them, right? But nobody set those permissions on anything … All of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    Yep, that's how it was. Even in DOS *nobody* used
    the 'protection' bits.

    Of course tangible THREATS were a LOT fewer back
    then, just 'theoretical' if you weren't a spook ...

    How times have changed ! Even my old company backups
    were hard-encrypted before I sent them to The Cloud.
    Fishermen everywhere.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Thu Oct 30 02:45:27 2025
    From Newsgroup: comp.os.linux.misc

    On Wed, 29 Oct 2025 14:01:31 -0400, Chris Ahlstrom wrote:

    I dunno, any programmer who types enough code to get RSI (repetitive
    stress injury) gets cut some slack from me.

    I've been lucky to have only minor hand issues, but I've also tried a
    large number of different keyboards, mice, trackballs,
    desk arrangements, and posture, to mitigate the issues.

    I had a minor problem way back while editing a graphic pixel by pixel. I forget what or why I was doing it but I didn't enjoy it.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Thu Oct 30 03:00:58 2025
    From Newsgroup: comp.os.linux.misc

    On Wed, 29 Oct 2025 22:00:40 -0400, c186282 wrote:

    Yep, that's how it was. Even in DOS *nobody* used the 'protection'
    bits.

    IBM distributed a RPG wannbe called BRADS with the 5120 system that had a
    byte set on the floppy. The system also came with a low level debugger
    that was handy for examining the disk. Compare an unlocked file with a
    locked one, notice the difference, and fix the locked one.

    Back when all the AIX and Linux boxes in our shop had the same root
    password and most used the same scheme for an easily guessed user
    password. Add in the interesting client/server model of X11 and you might
    find it suddenly snowing on your display.

    The SMTP server was wide open and wound up being a spammer's paradise one weekend. Fixed that pronto. Then there was the IT guy who was a bit shady. There were changes after his ass was fired to close the back doors he
    built.

    As the years went by it became harder and harder to do stuff and you had
    to change your password every three months. I'd had the same one for 21
    years so that was a PITA. 2FA, Windows Authenticator, all that shit.

    There is interesting new stuff but all-in-all people have gotten more
    serious and adult. No fun.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Thu Oct 30 01:29:14 2025
    From Newsgroup: comp.os.linux.misc

    On 10/28/25 18:59, Lawrence D’Oliveiro wrote:
    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-origins/>

    MULTICS didn’t die. Bell Labs pulled out, but the project continued,
    and did finally reach production, obviously too late to satisfy some
    parties. GE sold its hardware business (along with their rights to
    MULTICS) to Honeywell who didn’t know what to do with that weird OS.
    They charged an arm and a leg for it, but that didn’t seem to deter a
    small cohort of loyal customers.

    There are some documents at Bitsavers -- look at the brochure here <https://bitsavers.trailing-edge.com/pdf/honeywell/large_systems/multics/>, for example, and see how advanced the capabilities were that it
    offered, compared to any other early-1980s large-system OS.

    By the way, Thompson doesn’t use Unix any more. He gave up on Apple a couple of years ago, and uses Linux now <https://forums.freebsd.org/threads/unix-pioneer-ken-thompson-announces-hes-switching-from-mac-to-linux.88451/>.

    I remember just a little about MULTICS ... basically
    a 'high-concept' project that became a total cluster-fuck
    when implementation was attempted.

    UNIX was much better, more 'organic'. Get enough of
    the right people together and great things happen.

    Nothing really wrong with modern UNIX implementations,
    but Linux IS easier all-around.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Thu Oct 30 06:25:11 2025
    From Newsgroup: comp.os.linux.misc

    On Thu, 30 Oct 2025 01:29:14 -0400, c186282 wrote:

    I remember just a little about MULTICS ... basically
    a 'high-concept' project that became a total cluster-fuck when
    implementation was attempted.

    I was never exposed to MULTICS. I first ran into *nix on a PDP-11. I
    forget what it was called but it was in the era when Bell couldn't really
    sell Unix because of the monopoly considerations. Being Boston Unix like software had a way of falling off the back of a truck.

    Nothing really wrong with modern UNIX implementations, but Linux IS
    easier all-around.

    AIX wasn't bad. Its problem was it ran on RS6000 systems. They weren't bad either as long as you had deep pockets. Our source tree compiled on either with a few flags for AIX or Linux. The biggest problem was the db_Vista geodata had to have its ends swapped.


    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From The Natural Philosopher@tnp@invalid.invalid to comp.os.linux.misc on Thu Oct 30 06:59:06 2025
    From Newsgroup: comp.os.linux.misc

    On 30/10/2025 05:29, c186282 wrote:
    I remember just a little about MULTICS ... basically
      a 'high-concept' project that became a total cluster-fuck
      when implementation was attempted.

      UNIX was much better, more 'organic'. Get enough of
      the right people together and great things happen.

    Computer scientists add in all the features anyone could need whilst
    engineers build in only the ones that *are* needed...

      Nothing really wrong with modern UNIX implementations,
      but Linux IS easier all-around.

    Just more people know it and document it...
    --
    “I know that most men, including those at ease with problems of the greatest complexity, can seldom accept even the simplest and most
    obvious truth if it be such as would oblige them to admit the falsity of conclusions which they have delighted in explaining to colleagues, which
    they have proudly taught to others, and which they have woven, thread by thread, into the fabric of their lives.”

    ― Leo Tolstoy

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From John Ames@commodorejohn@gmail.com to comp.os.linux.misc on Thu Oct 30 08:12:32 2025
    From Newsgroup: comp.os.linux.misc

    On 30 Oct 2025 03:00:58 GMT
    rbowman <bowman@montana.com> wrote:

    As the years went by it became harder and harder to do stuff and you
    had to change your password every three months. I'd had the same one
    for 21 years so that was a PITA. 2FA, Windows Authenticator, all that
    shit.

    At my previous job, we had Best Practices (bow, scrape, chant liturgy) requiring us to change our passwords every ninety gorram days. After my
    first couple months on the job, it dawned on me that *A.* we didn't
    have a dedicated sysadmin minding the store, *B.* all of us techs had
    access to the domain admin credentials since stuff needed to get done,
    and *C.* password expiry is a per-account flag in WinNT and wasn't even
    being enforced by Group Policy (which could still have been exempted.)

    Needless to say, word quickly got around, and after that the only
    people who had to reset their passwords were our CEO and accountant.

    (I bought a little Android netbook for 2FA purposes when Management
    wouldn't budge on that during the hiring process. Never ended up using
    it, as I just installed WinAuth on my workstation.)

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Thu Oct 30 20:19:02 2025
    From Newsgroup: comp.os.linux.misc

    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:

    Needless to say, word quickly got around, and after that the only people
    who had to reset their passwords were our CEO and accountant.

    I change it but each evolution is very similar to the last, maybe with the
    'a' turning into a '@' etc. In the long run that isn't that great an idea since it probably would be easier to remember something completely
    different. In the best tradition, the current version is on a PostIt.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Lawrence =?iso-8859-13?q?D=FFOliveiro?=@ldo@nz.invalid to comp.os.linux.misc on Thu Oct 30 22:45:52 2025
    From Newsgroup: comp.os.linux.misc

    Speaking of lock-picking, I believe Ken Thompson also had a role in the
    Great 202 Printer Jailbreak of 1979, according to Prof David Brailsford <https://www.youtube.com/watch?v=CVxeuwlvf8w>.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Robert Riches@spamtrap42@jacob21819.net to comp.os.linux.misc on Fri Oct 31 03:00:19 2025
    From Newsgroup: comp.os.linux.misc

    On 2025-10-30, rbowman <bowman@montana.com> wrote:
    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:

    Needless to say, word quickly got around, and after that the only people
    who had to reset their passwords were our CEO and accountant.

    I change it but each evolution is very similar to the last, maybe with the 'a' turning into a '@' etc. In the long run that isn't that great an idea since it probably would be easier to remember something completely different. In the best tradition, the current version is on a PostIt.

    During New Employee Orientation at an earlier employer about a
    decade and a half ago, the _presenter_ stated his preferred
    solution to required password changes was to have one good base
    password, then append a digit, then rotate the digit when
    required.
    --
    Robert Riches
    spamtrap42@jacob21819.net
    (Yes, that is one of my email addresses.)
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Thu Oct 30 23:48:26 2025
    From Newsgroup: comp.os.linux.misc

    On 10/30/25 23:00, Robert Riches wrote:
    On 2025-10-30, rbowman <bowman@montana.com> wrote:
    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:

    Needless to say, word quickly got around, and after that the only people >>> who had to reset their passwords were our CEO and accountant.

    I change it but each evolution is very similar to the last, maybe with the >> 'a' turning into a '@' etc. In the long run that isn't that great an idea
    since it probably would be easier to remember something completely
    different. In the best tradition, the current version is on a PostIt.

    During New Employee Orientation at an earlier employer about a
    decade and a half ago, the _presenter_ stated his preferred
    solution to required password changes was to have one good base
    password, then append a digit, then rotate the digit when
    required.

    Eh ... good enough for most "corporate" stuff
    except maybe payroll/accounting ........

    People are just not going to be able to deal
    with passwords of 18 random characters. That's
    just how it is. They can't, they won't.

    OR they'll write it on a post-it and stick it
    to their keyboard :-)

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Lawrence =?iso-8859-13?q?D=FFOliveiro?=@ldo@nz.invalid to comp.os.linux.misc on Fri Oct 31 04:43:09 2025
    From Newsgroup: comp.os.linux.misc

    On 31 Oct 2025 03:00:19 GMT, Robert Riches wrote:

    On 2025-10-30, rbowman <bowman@montana.com> wrote:

    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:

    Needless to say, word quickly got around, and after that the only
    people who had to reset their passwords were our CEO and
    accountant.

    I change it but each evolution is very similar to the last, maybe
    with the 'a' turning into a '@' etc. In the long run that isn't
    that great an idea since it probably would be easier to remember
    something completely different. In the best tradition, the current
    version is on a PostIt.

    During New Employee Orientation at an earlier employer about a
    decade and a half ago, the _presenter_ stated his preferred solution
    to required password changes was to have one good base password,
    then append a digit, then rotate the digit when required.

    Required periodic password changes have long been considered a bloody
    stupid idea <https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-most-nonsensical-password-rules/>.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From The Natural Philosopher@tnp@invalid.invalid to comp.os.linux.misc on Fri Oct 31 08:33:12 2025
    From Newsgroup: comp.os.linux.misc

    On 31/10/2025 03:48, c186282 wrote:
    On 10/30/25 23:00, Robert Riches wrote:
    On 2025-10-30, rbowman <bowman@montana.com> wrote:
    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:

    Needless to say, word quickly got around, and after that the only
    people
    who had to reset their passwords were our CEO and accountant.

    I change it but each evolution is very similar to the last, maybe
    with the
    'a' turning into a '@' etc. In the long run that isn't that great an
    idea
    since it probably would be easier to remember something completely
    different. In the best tradition, the current version is on a PostIt.

    During New Employee Orientation at an earlier employer about a
    decade and a half ago, the _presenter_ stated his preferred
    solution to required password changes was to have one good base
    password, then append a digit, then rotate the digit when
    required.

      Eh ... good enough for most "corporate" stuff
      except maybe payroll/accounting ........

      People are just not going to be able to deal
      with passwords of 18 random characters. That's
      just how it is. They can't, they won't.

    If its your password, they are not random.
    But whilst you might remember HorseWhistler.General12 it's an unlikely
    thing to guess.

      OR they'll write it on a post-it and stick it
      to their keyboard  :-)

    Better still is all the root passwords typed out and left behind the receptionist.
    --
    “when things get difficult you just have to lie”

    ― Jean Claud Jüncker

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Richard Kettlewell@invalid@invalid.invalid to comp.os.linux.misc on Fri Oct 31 09:02:37 2025
    From Newsgroup: comp.os.linux.misc

    Robert Riches <spamtrap42@jacob21819.net> writes:
    On 2025-10-30, rbowman <bowman@montana.com> wrote:
    On Thu, 30 Oct 2025 08:12:32 -0700, John Ames wrote:
    Needless to say, word quickly got around, and after that the only
    people who had to reset their passwords were our CEO and accountant.

    I change it but each evolution is very similar to the last, maybe
    with the 'a' turning into a '@' etc. In the long run that isn't that
    great an idea since it probably would be easier to remember something
    completely different. In the best tradition, the current version is
    on a PostIt.

    During New Employee Orientation at an earlier employer about a
    decade and a half ago, the _presenter_ stated his preferred
    solution to required password changes was to have one good base
    password, then append a digit, then rotate the digit when
    required.

    Standard-setters realized this was a terrible idea some years ago.

    https://doi.org/10.6028/NIST.SP.800-63b-4 3.1.1.2 #6 “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically”,
    reinforced in s8.1.2.1. Technically only requirement for USG systems but
    NIST rules are widely followed by other organizations.

    https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
    “Don’t enforce regular password expiry”.

    https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2025/250131_Passwortwechsel_next-level.html
    (My German is far too weak for this one but machine translation shows it communicates similar advice.)

    IT and contracts departments haven’t all got the message yet.


    Other thoughts on passwords:

    * The only password a user should ever have to remember is their primary
    login (meaning their domain password, in most corporate
    environments).

    * Everything else should be automatic: integrate with corporate SSO,
    stored in a password manager, a pass key, a client certificate,
    anything that doesn’t require the user to remember something else.

    * The minimum password length depends on the password hashing algorithm
    and the state of the art in exhaustive search. scrypt will let you get
    away with shorter passwords than MD4, for example.

    * Password complexity rules are often rather dubious, “aqbvystmzrvs” is
    a much better password than “aaaaaaaaaaaA1” but also much more likely
    to fall foul of common complexity requirements.

    But, at scale, I think you do need _something_ more than just a
    minimum length: if you let users enter a password of aaaaaaaaaaaaaaa
    then a distressingly large number of them will do exactly that. The
    rules should be designed by expert specialists, not random software
    developers or IT staff.

    * Lists of thousands of already-cracked passwords are readily available,
    all candidate passwords should be checked against them.

    If you don’t then the attackers will check for you.

    * Long passwords are often mis-typed, so rules like “lock account after
    three consecutive failed logins” are a DoS risk, not a security
    policy. In fact they always were and I’m surprised this isn’t
    exploited more often, but now they’re a DoS risk even in
    non-adverserial scenarios.

    If you really think an attacker could guess a password in just four
    tries then you’re letting your users pick ridiculously weak passwords
    and urgently need to fix that.
    --
    https://www.greenend.org.uk/rjk/
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Carlos E.R.@robin_listas@es.invalid to comp.os.linux.misc on Fri Oct 31 14:33:46 2025
    From Newsgroup: comp.os.linux.misc

    On 2025-10-29 18:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix. “For some reason, and I think it’s just because of me and Dennis, everything was open…”

    It was just the way they operated. “We had protection on files — if you didn’t want somebody to read it, you could set some bits and then nobody could read them, right? But nobody set those permissions on anything … All of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.


    I just read the article, and I have to say that it happened because of
    the culture in Bell Labs, and that money was not a problem. And they had
    that money because the Bell company had that monopoly on phone service
    and charged what they charged.

    Unix had that open mind because Bell Lab worked with an open mind. Other
    teams there invented things that later the entire world benefited from,
    like the transistor or the chip. Bell had some limitation about not
    patenting and withholding things they could not directly use on phones.
    --
    Cheers, Carlos.
    ES🇪🇸, EU🇪🇺;
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From John Ames@commodorejohn@gmail.com to comp.os.linux.misc on Fri Oct 31 08:59:11 2025
    From Newsgroup: comp.os.linux.misc

    On Fri, 31 Oct 2025 09:02:37 +0000
    Richard Kettlewell <invalid@invalid.invalid> wrote:
    Standard-setters realized this was a terrible idea some years ago.

    IT and contracts departments haven’t all got the message yet.
    It's a bit "haven't gotten the message" and much more "better standards
    mean less busywork," I'm afraid. I used to work for an MSP; the entire
    industry is based around the principle of maintaining a revenue stream
    by creating work for itself :/
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Fri Oct 31 20:24:44 2025
    From Newsgroup: comp.os.linux.misc

    On Fri, 31 Oct 2025 09:02:37 +0000, Richard Kettlewell wrote:

    * The only password a user should ever have to remember is their primary
    login (meaning their domain password, in most corporate environments).

    Nice thought. My primary login does work for many things however the code
    base is on a Linux box and to mount the directory I have to ssh in and
    change the samba password to match along with the user password. Payroll
    is handled by a third party so I have to change that also.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Lawrence =?iso-8859-13?q?D=FFOliveiro?=@ldo@nz.invalid to comp.os.linux.misc on Fri Oct 31 23:16:04 2025
    From Newsgroup: comp.os.linux.misc

    On Fri, 31 Oct 2025 14:33:46 +0100, Carlos E.R. wrote:

    I just read the article, and I have to say that it happened because of
    the culture in Bell Labs, and that money was not a problem. And they had
    that money because the Bell company had that monopoly on phone service
    and charged what they charged.

    It is interesting to compare Bell Labs at AT&T, with PARC (the Palo Alto Research Center) at Xerox. The former was the birthplace of information theory, and Unix, among other things; the latter was the birthplace of the GUI, and Smalltalk, and Ethernet, among other things.

    Both were essentially research playgrounds for bright people to try out
    risky new ideas, run at the expense of a vast parent corporation that made huge profits from a Government-granted monopoly (the US phone monopoly in
    the case of AT&T, patents on photocopiers in the case of Xerox).

    And once the parent company lost that monopoly (the AT&T breakup, the
    expiry of those photocopier patents), the glory days at the research playground were over.
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Rich@rich@example.invalid to comp.os.linux.misc on Sat Nov 1 03:40:34 2025
    From Newsgroup: comp.os.linux.misc

    c186282 <c186282@nnada.net> wrote:
    On 10/29/25 13:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open
    source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix.
    “For some reason, and I think it’s just because of me and Dennis,
    everything was open…”

    It was just the way they operated. “We had protection on files — if you >> didn’t want somebody to read it, you could set some bits and then nobody >> could read them, right? But nobody set those permissions on anything … All >> of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    Yep, that's how it was. Even in DOS *nobody* used
    the 'protection' bits.

    DOS had no protection bits on its files in its filesystem.

    Of course tangible THREATS were a LOT fewer back
    then, just 'theoretical' if you weren't a spook ...

    With DOS they were almost non-existant. Single user, single tasking.
    As long as you didn't insert every disk you found lying around and run
    every program thereupon willy-nilly, you'd also be safe from the
    eventual viruses that arose.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Sat Nov 1 00:45:01 2025
    From Newsgroup: comp.os.linux.misc

    On 10/31/25 23:40, Rich wrote:
    c186282 <c186282@nnada.net> wrote:
    On 10/29/25 13:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line
    break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking-
    origins/>

    Old eyes at least in this person sometimes miss such subleties
    in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open >>> source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix. >>> “For some reason, and I think it’s just because of me and Dennis,
    everything was open…”

    It was just the way they operated. “We had protection on files — if you >>> didn’t want somebody to read it, you could set some bits and then nobody >>> could read them, right? But nobody set those permissions on anything … All
    of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    Yep, that's how it was. Even in DOS *nobody* used
    the 'protection' bits.

    DOS had no protection bits on its files in its filesystem.


    Um ... you could mark 'read only' as I remember (been
    awhile). As for real 'protection' ... no. Nobody had
    the idea for something as simple as DOS and how they
    envisioned it being used. No user names/IDs/groups.
    Not sure ANY of that came in before Win-3.11.

    Central archives/backups ... for THAT you used something
    UNIX/VMS/etc.

    Of course tangible THREATS were a LOT fewer back
    then, just 'theoretical' if you weren't a spook ...

    With DOS they were almost non-existant. Single user, single tasking.
    As long as you didn't insert every disk you found lying around and run
    every program thereupon willy-nilly, you'd also be safe from the
    eventual viruses that arose.

    Took a little while, but I do remember the "Pakistani
    Brain Virus" that lived in the boot records of floppies.

    But MOST users ... no ... no worries.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Sat Nov 1 05:41:53 2025
    From Newsgroup: comp.os.linux.misc

    On Fri, 31 Oct 2025 23:16:04 -0000 (UTC), Lawrence D’Oliveiro wrote:

    Both were essentially research playgrounds for bright people to try out
    risky new ideas, run at the expense of a vast parent corporation that
    made huge profits from a Government-granted monopoly (the US phone
    monopoly in the case of AT&T, patents on photocopiers in the case of
    Xerox).

    IBM had their little skunk works too. In the early days of Java they
    released a compiler that was a lot better than the official and had some
    other neat tools. Some middle manager may have said 'Take a look at that
    Java stuff' and they grabbed it and ran.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Sat Nov 1 02:18:30 2025
    From Newsgroup: comp.os.linux.misc

    On 11/1/25 01:41, rbowman wrote:
    On Fri, 31 Oct 2025 23:16:04 -0000 (UTC), Lawrence D’Oliveiro wrote:

    Both were essentially research playgrounds for bright people to try out
    risky new ideas, run at the expense of a vast parent corporation that
    made huge profits from a Government-granted monopoly (the US phone
    monopoly in the case of AT&T, patents on photocopiers in the case of
    Xerox).

    IBM had their little skunk works too. In the early days of Java they
    released a compiler that was a lot better than the official and had some other neat tools. Some middle manager may have said 'Take a look at that
    Java stuff' and they grabbed it and ran.

    A lot of good stuff did - and still does - come out
    of Big Blue. You don't HEAR about it much anymore
    however, but they're still into *everything*. They
    are not a leading chips name, but their research
    goes into all the new chips. They are not the center
    of the net, but a lot of their stuff goes into the net.
    They are not a leading "AI" company, but their stuff
    is deeply entwined in "AI".

    And they still sell Big Iron for Big Projects/corps.

    IMHO, they have positioned themselves perfectly for
    the early 21st century. Being just off the radar scope
    by and large they will make their money yet not be
    subject to the storms of the more popular tech stocks.
    WHEN "AI" mostly crashes, IBM will still be there.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From vallor@vallor@vallor.earth to comp.os.linux.misc on Sat Nov 1 07:06:16 2025
    From Newsgroup: comp.os.linux.misc

    At Sat, 1 Nov 2025 02:18:30 -0400, c186282 <c186282@nnada.net> wrote:

    On 11/1/25 01:41, rbowman wrote:
    On Fri, 31 Oct 2025 23:16:04 -0000 (UTC), Lawrence D’Oliveiro wrote:

    Both were essentially research playgrounds for bright people to try out
    risky new ideas, run at the expense of a vast parent corporation that
    made huge profits from a Government-granted monopoly (the US phone
    monopoly in the case of AT&T, patents on photocopiers in the case of
    Xerox).

    IBM had their little skunk works too. In the early days of Java they released a compiler that was a lot better than the official and had some other neat tools. Some middle manager may have said 'Take a look at that Java stuff' and they grabbed it and ran.

    A lot of good stuff did - and still does - come out
    of Big Blue. You don't HEAR about it much anymore
    however, but they're still into *everything*. They
    are not a leading chips name, but their research
    goes into all the new chips. They are not the center
    of the net, but a lot of their stuff goes into the net.
    They are not a leading "AI" company, but their stuff
    is deeply entwined in "AI".

    And they still sell Big Iron for Big Projects/corps.

    IMHO, they have positioned themselves perfectly for
    the early 21st century. Being just off the radar scope
    by and large they will make their money yet not be
    subject to the storms of the more popular tech stocks.
    WHEN "AI" mostly crashes, IBM will still be there.

    "Where would I be without IBM?"

    https://www.youtube.com/watch?v=D04TRaXFuVU

    (Information Society)
    --
    -v System76 Thelio Mega v1.1 x86_64 NVIDIA RTX 3090Ti 24G
    OS: Linux 6.17.6 D: Mint 22.2 DE: Xfce 4.18
    NVIDIA: 580.95.05 Mem: 258G
    "Oxymoron: Subsequent Initiatives."
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Nuno Silva@nunojsilva@invalid.invalid to comp.os.linux.misc on Sat Nov 1 10:30:47 2025
    From Newsgroup: comp.os.linux.misc

    On 2025-10-29, rbowman wrote:

    On Wed, 29 Oct 2025 02:54:59 -0000 (UTC), Lawrence D’Oliveiro wrote:

    By the way, “Unix” is supposed to be a trademark. That means you use it >> as an adjective, not a noun.

    I'd suggest not being so Adobe about it, to use another adjective :-P

    Trying to be more pedantic than thou, UNIX is the trademark, not Unix.

    https://unix.org/trademark.html

    Unlike most of the Microsoft world, case matters.

    Heh. Also, I think you have made a mistake, you surely meant to type
    "[...] of the MICROS~1 world, [...]"?
    --
    Nuno Silva
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Carlos E.R.@robin_listas@es.invalid to comp.os.linux.misc on Sat Nov 1 14:50:19 2025
    From Newsgroup: comp.os.linux.misc

    On 2025-11-01 00:16, Lawrence D’Oliveiro wrote:
    On Fri, 31 Oct 2025 14:33:46 +0100, Carlos E.R. wrote:

    I just read the article, and I have to say that it happened because of
    the culture in Bell Labs, and that money was not a problem. And they had
    that money because the Bell company had that monopoly on phone service
    and charged what they charged.

    It is interesting to compare Bell Labs at AT&T, with PARC (the Palo Alto Research Center) at Xerox. The former was the birthplace of information theory, and Unix, among other things; the latter was the birthplace of the GUI, and Smalltalk, and Ethernet, among other things.

    Both were essentially research playgrounds for bright people to try out
    risky new ideas, run at the expense of a vast parent corporation that made huge profits from a Government-granted monopoly (the US phone monopoly in
    the case of AT&T, patents on photocopiers in the case of Xerox).

    And once the parent company lost that monopoly (the AT&T breakup, the
    expiry of those photocopier patents), the glory days at the research playground were over.

    Exactly.

    Bell Labs survived for a while after the AT&T breakup, but the coup de
    grâce came with the crash of Lucent in 2000.
    --
    Cheers, Carlos.
    ES🇪🇸, EU🇪🇺;
    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Sun Nov 2 01:34:10 2025
    From Newsgroup: comp.os.linux.misc

    On Sat, 1 Nov 2025 02:18:30 -0400, c186282 wrote:

    They
    are not a leading chips name, but their research goes into all the
    new chips.

    I haven't followed the latest episodes in the drama, but IBM sold off
    their fabs.

    https://en.wikipedia.org/wiki/IBM_Microelectronics

    A friend interned with IBM in college and went on to work for them all his life. Fortunately he was of retirement age when they pulled the plug on
    Essex Junction. Many people weren't that lucky. According to Wiki IBM and Global Foundries have settled their suits and countersuits.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From rbowman@bowman@montana.com to comp.os.linux.misc on Sun Nov 2 01:44:46 2025
    From Newsgroup: comp.os.linux.misc

    On Sat, 01 Nov 2025 07:06:16 +0000, vallor wrote:

    "Where would I be without IBM?"

    Comfortably at home... We used to say IBM stood for 'I've Been Moved'.
    One of my cousins cycled through New Jersey, New York, Vermont, and
    Arizona.

    The Vermont one was the best. IBM was short of space and had leased an old grocery store. It was low key with no big signs on the front so people
    would wander in looking for bananas.

    I know the feeling. Where I work had the same approach, just a street
    number on the building. There was a state office plaza down the street so people would wander in looking for the DMV, VA, and other random stuff. We started locking the doors as telecommuting meant not many people
    physically on site and the homeless perceived that as an invitation.


    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From Rich@rich@example.invalid to comp.os.linux.misc on Sun Nov 2 03:15:07 2025
    From Newsgroup: comp.os.linux.misc

    c186282 <c186282@nnada.net> wrote:
    On 10/31/25 23:40, Rich wrote:
    c186282 <c186282@nnada.net> wrote:
    On 10/29/25 13:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line >>>> break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking- >>>> origins/>

    Old eyes at least in this person sometimes miss such subleties >>>>> in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open >>>> source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix. >>>> “For some reason, and I think it’s just because of me and Dennis,
    everything was open…”

    It was just the way they operated. “We had protection on files — if you
    didn’t want somebody to read it, you could set some bits and then nobody >>>> could read them, right? But nobody set those permissions on anything … All
    of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    Yep, that's how it was. Even in DOS *nobody* used
    the 'protection' bits.

    DOS had no protection bits on its files in its filesystem.


    Um ... you could mark 'read only' as I remember (been
    awhile).

    Not a "protection" in the context of what Ritchie was discussing. He
    was refering to the fact that files can be owned by users/groups and
    marked to only be read or written by those users/groups.

    DOS's 'read only' bit was actually a "do not overwrite" bit. The only
    user was handed an error message instead of being allowed to overwrite
    the file contents. Of course nothing stopped that same single user
    from flipping the 'read only' bit off and then overwiting the file
    contents.

    As for real 'protection' ... no. Nobody had the idea for
    something as simple as DOS and how they envisioned it being used.
    No user names/IDs/groups. Not sure ANY of that came in before
    Win-3.11.

    Unix had all that long before DOS ever existed. The concept of more
    than one user and "file ownership" did not appear in the windows world
    until NT arrived. And even then, the portion exposed by the win APIs
    was a far cry from what Unix had years before DOS existed.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From c186282@c186282@nnada.net to comp.os.linux.misc on Sat Nov 1 23:35:19 2025
    From Newsgroup: comp.os.linux.misc

    On 11/1/25 23:15, Rich wrote:
    c186282 <c186282@nnada.net> wrote:
    On 10/31/25 23:40, Rich wrote:
    c186282 <c186282@nnada.net> wrote:
    On 10/29/25 13:43, rbowman wrote:
    On Tue, 28 Oct 2025 20:45:45 -0700, Bobbie Sellers wrote:

    Copied to my clipboard then used the editor to correct the line >>>>> break.

    <https://thenewstack.io/ken-thompson-recalls-unixs-rowdy-lock-picking- >>>>> origins/>

    Old eyes at least in this person sometimes miss such subleties >>>>>> in small print.
    That is an interesting article by the way.

    Yeah, those were the days.

    "Thompson credits Richard Stallman with developing much more of the open >>>>> source philosophy. “But Unix had a bit of that.” Maybe it grew out of what
    Dennis Ritchie was remembering, that fellowship that formed around Unix. >>>>> “For some reason, and I think it’s just because of me and Dennis, >>>>> everything was open…”

    It was just the way they operated. “We had protection on files — if you
    didn’t want somebody to read it, you could set some bits and then nobody
    could read them, right? But nobody set those permissions on anything … All
    of the source was writable, by anybody! It was just open …"

    While I appreciate some of the work of the FSF Stallman's talmudic
    legalisms rub me the wrong way. I remember when 'it was just open'.

    Yep, that's how it was. Even in DOS *nobody* used
    the 'protection' bits.

    DOS had no protection bits on its files in its filesystem.


    Um ... you could mark 'read only' as I remember (been
    awhile).

    Not a "protection" in the context of what Ritchie was discussing. He
    was refering to the fact that files can be owned by users/groups and
    marked to only be read or written by those users/groups.

    DOS's 'read only' bit was actually a "do not overwrite" bit. The only
    user was handed an error message instead of being allowed to overwrite
    the file contents. Of course nothing stopped that same single user
    from flipping the 'read only' bit off and then overwiting the file
    contents.

    As for real 'protection' ... no. Nobody had the idea for
    something as simple as DOS and how they envisioned it being used.
    No user names/IDs/groups. Not sure ANY of that came in before
    Win-3.11.

    Unix had all that long before DOS ever existed. The concept of more
    than one user and "file ownership" did not appear in the windows world
    until NT arrived. And even then, the portion exposed by the win APIs
    was a far cry from what Unix had years before DOS existed.

    Which was a big reason I switched to Linux file servers
    as soon as practical. Did my best to make it all transparent
    to the office users.

    'Reliability' was another biggie.

    UNIX ... sorry, we didn't have the cash for that.

    --- Synchronet 3.21a-Linux NewsLink 1.2
  • From The Natural Philosopher@tnp@invalid.invalid to comp.os.linux.misc on Sun Nov 2 11:25:37 2025
    From Newsgroup: comp.os.linux.misc

    On 02/11/2025 03:15, Rich wrote:
    DOS's 'read only' bit was actually a "do not overwrite" bit. The only
    user was handed an error message instead of being allowed to overwrite
    the file contents. Of course nothing stopped that same single user
    from flipping the 'read only' bit off and then overwiting the file
    contents.

    You don't need a condom to have sex with yourself.
    --
    Climate is what you expect but weather is what you get.
    Mark Twain

    --- Synchronet 3.21a-Linux NewsLink 1.2