vogonj

Now you know more than you ever wanted to about blue screens. :)

validating your updates via asymmetric crypto can be mildly expensive (http://www.verisign.com/code-signing/content-signing-certifi... lists Windows Authenticode certificates at $400/yr) but is within the realm of a small company.

setting up a Google-scale CDN and writing a reliable push update framework? that's the hard part.

now at least they expose only the most useful information to the user ("you need to restart", "here's a thing you can search for to find more information") instead of crazy stuff like "beginning physical memory dump" and STOP codes.

this is probably the funniest sentence I have ever read.

giving Dropbox some guff for it is completely reasonable.

May 2010?

and as for your reply downthread about Google Instant being a hit, how much of Google Instant being a hit is due to it being the default behavior of Google now, and would anyone actually miss it if it were gone?

"the impact [is] negligible as long as you follow basic security practices and can recognize when something looks out of place" is a worthless statement, because the majority of users have repeatedly proven to be unable to do that (hence MacDefender, hence the largest families of malware on Windows being fake AV.)

it also makes it too easy to hand-wave away security threats. you got a trojan on your MacBook? you obviously weren't following basic security practices.

that said, Steve Jobs seems (at least from external appearances) to have far more thorough top-down control over the company's engineering efforts than Steve Ballmer does; the highest I ever see engineering efforts come down from is our division director.

http://news.softpedia.com/news/Steve-Jobs-Not-Shy-of-Using-t...

we can both play this game all day.

user experience is indeed a part of good engineering, but it's not the be-all and end-all, and eventually you will /always/ run into a place where you must compromise between a system which is well-engineered and one that behaves in accordance with user expectation.

this is why OS X doesn't have full ASLR and DEP, because it can cause applications to start crashing at random because they were poorly written in a way that used to be invisible.

this is why UAC on Windows Vista is a terrible experience, because even trusted applications need to prompt the user to make sure they approve of them executing on an administrator token.

this is why our operating systems still have to reboot while applying security updates, because long-running services and the kernel have to be replaced and there's no good way to do it seamlessly yet.

anyway, hope you figure out the problem. :)

No piece of software is synonymous with insecurity -- except, perhaps, Sendmail. ;)

If you look at the numbers for OS X as opposed to Windows XP, OS X has 1,544 vulnerabilities in 153 advisories (~10.1 vulns/advisory) and Windows has 472 vulnerabilities in 358 advisories (~1.31 vulns/advisory).

Unless you have a good reason to believe that bugs in Windows are nearly eight times "more unique" than bugs in OS X, please don't compare advisories.

That two-person startup consists of two hackers who eat, sleep, and fucking breathe Web technologies. They have bookmarklets for six different sets of Web documentation, and they can quote chapter and verse from any of them. They work 18-hour days because they love their job.

The giant corporation's line-of-business app team consists of an IT guy, an accountant who owns a couple of dogeared books on JavaScript, and maybe a couple of contractors. They work 8-hour days, only half of which is actually devoted to the application they're working on, and they don't care about standards as long as they can finish writing that Web app and get back to their actual job.

I'm certainly exaggerating a bit, but the reason is because that giant corporation's business is almost certainly not writing Web apps for a living.