Holland Bans AMD's 'Virus Protection' Campaign 330
Hack Jandy writes "For those of you who didn't see this coming, AMD's Advanced Virus Protection campaign has been banned in Holland since the technology does (almost) nothing to stop viruses! If you recall, AMD's NX bit attempts to stop the processor from executing pages on the stack that have been written to. Does NX even solve more problems than it causes?"
How do you explain it to Joe Sixpack? (Score:5, Informative)
Of course, AMD's problem is finding a way to try to communicate that concept to the average user. Joe Sixpack doesn't even know what buffer overflow problem is, so they don't understand why they need a solution to that problem. AMD is trying to use the concept of "virus prevention" instead, but apparently they've gone too far in implying that the NX bit eliminates the need for conventional anti-virus methods, which it most certainly does not.
This is an extra set of suspenders, not a new belt.
Re:How do you explain it to Joe Sixpack? (Score:5, Informative)
Re:How do you explain it to Joe Sixpack? (Score:2)
Re:How do you explain it to Joe Sixpack? (Score:2)
Re:How do you explain it to Joe Sixpack? (Score:4, Informative)
Apparently, code loaders such as DLL loaders and JITs have to explicitly go through a syscall to copy from writable memory to executable memory.
Re:How do you explain it to Joe Sixpack? (Score:4, Interesting)
Re:How do you explain it to Joe Sixpack? (Score:4, Informative)
Re:How do you explain it to Joe Sixpack? (Score:2)
Apparently it doesn't break much on UNIX because many platforms are quite lax about caching policies on executable code. If the OS doesn't flush the cache, code may break, and mprotect is used to take an opportunity to flush the cache.
Or something like that. I forget the details of what Theo said in the talk.
Re:Self-modifying code? (Score:5, Informative)
Re:Self-modifying code? (Score:3, Interesting)
Simply allocating it initially as both writable and executable needlessly opens your JIT to the possibility of exploits.
Re:Self-modifying code? (Score:5, Interesting)
Re:Self-modifying code? (Score:2)
This is just plain not true. In Linux gcc uses a flag in the ELF headders to indicate NX friendly code. This is *not* flagged on old binaries and code that self modifies flags as non NX. So nothing actually breaks.
Re:How do you explain it to Joe Sixpack? (Score:4, Interesting)
Re:How do you explain it to Joe Sixpack? (Score:2)
I'm not sure whether you intended to suggest that OpenBSD led the way on marked pages, but even if you did not someone else might read it that way. This kind of feature is much older. One of the comp.risks posts [ncl.ac.uk] sums it up:
Re:How do you explain it to Joe Sixpack? (Score:5, Insightful)
If I'm overflowing a stack buffer, I'll just write the address of system() over EIP and the address of a string I control after that. Then when the function returns, it will execute system("/whatever/program/i/want").
Maybe not quite as convenient as shellcode for crackers, but virus writers will adapt and NX will mean nothing.
Re:How do you explain it to Joe Sixpack? (Score:4, Interesting)
A software stack check will already catch that. (a random number stuck under the stack frame, checked before returning. You could overflow the buffer, but you can't know what random number to write because it changes each time -> failed exploit.)
IBM did some work to put a similar feature into GCC:
http://www.research.ibm.com/trl/projects/securi
Re:Its only part of the solution. (Score:5, Insightful)
Re:Its only part of the solution. (Score:3, Informative)
--------->
(gdb) break main
Breakpoint 1 at 0x8048d77: file nasm.c, line 150.
(gdb) run
Starting program:
Breakpoint 1, main (argc=1, argv=0xbffffa04) at nasm.c:150
150 pass0 = 1;
(gdb) print system
$1 = {<text variable, no debug info>} 0x410598a0 <system>
(gdb)
---
Re:How do you explain it to Joe Sixpack? (Score:5, Insightful)
And since this is only a minor improvement (if an improvement at all) in the Athlon64 I wonder why they didn't think of something else to use to promote the CPU... Surely saying that the thing is 64-bit must impress some Joe Sixpacks.
Re:How do you explain it to Joe Sixpack? (Score:5, Insightful)
Thats why. They don't have to explain what being a 64bit processor means and why they need it, because most people don't, but everyone need virus protection and for the most part they already know that.
I have yet to see a good reason why I should get an A64, beyond the 'dude holy shit its faster then last months model.'
Re:How do you explain it to Joe Sixpack? (Score:2)
disclaimer: Santa brought me a lovely AMD63 3500+ to plug into my Asus A8N-SLI motherboard - yum!
Re:How do you explain it to Joe Sixpack? (Score:3)
Nope; Gates never said that. If you wish to disagree, please cite the original source.
Re:How do you explain it to Joe Sixpack? (Score:2)
Re:How do you explain it to Joe Sixpack? (Score:2)
In that case, I presume you would never upgrade as your current box is fast enough.
Re:How do you explain it to Joe Sixpack? (Score:2, Insightful)
I have to call you on this one. It's only a "pretty nice thing" in theory, since the option has to be enabled during the compilation of the binary. In Windows (even XPsp2), this is only enabled for certain MS-created services that listen on ports. It has to run in PAE mode. Not every application is protected. Significantly, the user-space apps are not protected. You have to specify
Re:How do you explain it to Joe Sixpack? (Score:5, Insightful)
Sorry, but this isn't true - NX protection has nothing to do with compiling binaries. It is runtime protection.
In Windows (even XPsp2), this is only enabled for certain MS-created services that listen on ports. It has to run in PAE mode. Not every application is protected. Significantly, the user-space apps are not protected. You have to specify
This is unfortunate but true, the default for processors that support it really should have been to turn it on for all apps. As it is, you have to go into Control Panel->System->Advanced->Performance->Data Exec Protection and enable it for all apps yourself. It does work quite exactly how it should when you do, tho - warning you and shutting down apps that attempt to execute data as code.
So, moderators. How does the original post deserve such a high ranking? It's factually incorrect on a few points, and just makes general statements about "safety is good". The trend appears to be that early posters get points, and everyone else carps and trolls. What a shit hole slashdot has become. (I can recall when a 90-post story was big news, and most of the posts were useful... but don't get me started.)
So, moderators, how does an AC who posts factually incorrect statements also get a +4 Insightful? Is it just because he said "So, moderators"?
Re:How do you explain it to Joe Sixpack? (Score:2)
I'm not qualified to say whether it's true or not that on this platform, processes with dynamically-checked non-executable memory pages need to be compiled for that purpose (doesn't sound, from an OS theory pov, necessary - sounds more like you're looking for static checks with such an option), but what I can say is that the link you provided does not di
Virus/worm distinction is growing less important (Score:3, Insightful)
This is a distinction which Joe Sixpack has a terrible time grasping. Telling someone "Your computer's got worms!" is less likely to be comprehend tha
Re:How do you explain it to Joe Sixpack? (Score:2, Insightful)
Re:How do you explain it to Joe Sixpack? (Score:3, Interesting)
Umm.. Java programs don't get buffer overflows. C++ programs that use bound-checked containers and no pointer arithmetics are reasonably safe. Perl and Python are all right. So are we only talking about old-style C code then?
Re:How do you explain it to Joe Sixpack? (Score:2)
like magic that is.
of course, it's NOT TRUE, so the adverts got banned.
a car company can't claim that their car is deathproof(when it isnt)..
Re:How do you explain it to Joe Sixpack? (Score:2)
AMD does certainly not have to explain such concepts to Joe Sixpack. Joe anyway doesn't have the foggiest clue what AMD is about. His only potential encounter with AMD is when he buys a computer and then he probably couldn't care less.
Who AMD must convince as their primary target is OEMs and most of them (hopefully) know their shit and can be bothered with technical whitepapers.
Now if AMD wants to launch an
Re:How do you explain it to Joe Sixpack? (Score:2)
Eh, whatever. (Score:4, Insightful)
I think it would have made sense to put it as a nice side feature so that geeks see the technology and how it prevents buffer overflows, but they probably already know about it.
Re:Eh, whatever. (Score:3, Informative)
Servers, P2P programs, messaging programs, ... email (Outlook?), web browser (IE? Even Firefox had one not too long ago, didn't it?), or pretty much any software that reads data from an untrusted source.
By the way - that includes things like word processors. A malicious attacker overflowing the buffer of Word via some viral Word doc spread via email - NX bit can help here, too. By "untrusted source" - that means pretty much any program.
Re:Eh, whatever. (Score:5, Funny)
Fluffy bunny code is untrusted, continue to install?
No.
You won't be able to see the fluffy bunnies if you don't install. Continue install?
No.
You don't want to not install?
No.
Installing Fluffy Bunny.
HULK SMASH!
Re:Eh, whatever. (Score:2)
Re:Eh, whatever. (Score:2, Funny)
In order to use fluffy bunnies type this command
rm
# rm
Re:Eh, whatever. (Score:2)
So what do you care about? Your operating system, which can easily be installed from a CD anyway? Or your personal files, that you spend a lot of time creating?
But I forget. Everyone keeps perfect backups, so this is not an issue...
Not just for servers (Score:5, Informative)
Buffer overflow exploits arent just for servers either, the RPC/DCOM exploit was one. So was the previous big worm, err blaster? I don't quite remember.
This is tech for the desktop, really. Modern computers run a slew of services.
Does it rely... (Score:5, Funny)
Re:Does it rely... (Score:5, Informative)
Re:Does it rely... (Score:2, Informative)
Re:Does it rely... (Score:2)
Re:Does it rely... (Score:2)
some clarification would be helpful, as i plan to implement this in a library i'm writing.
What is a "virus" to most people (Score:5, Insightful)
And if the NX bit were used for more than the stack, then it could protect against a lot of (non-trojan) viral activity too.
Lets face it most viruses today aren't even viruses. They are trojans, worms, and human-engeneering exploits. How often do you see an actual virus? You know a program that writes its code into another program. It's actually getting kind of rare. Now days it is whole applications delivering themselves to your computer through email and exploiting the existing code of crap like IE and Outlook by just telling those programs to run the evil code. Most exploits today are applets and packages.
All But Gone are the days of rewritten exe headers wiht appended code fragments, and programs appending themselves to other programs in memory.
Quite frankly if all the non-code memory regions in my computer were non-execute down to the very last GDI region and printer buffer, the classic virus would be dead. The IE hacks and the trojans and the worms would still be here because certian stupid programs will do arbitrarily complex things at the behest of remote entities, but that isn't a virus. Thats bad design comming home to roost.
Re:What is a "virus" to most people (Score:2)
How do you figure? The classic virus modified EXEs on disk, but didn't need to modify executable code in memory.
Re:What is a "virus" to most people (Score:2)
You are absolutely right. And that is why NX doesn't help preventing vira. It may prevent most classical worms though. Whether worms will find a way arround the protection is an open question. In theory the bugs may still be exploitable, but hopefully it will take longer time to write exploit code, so there will at least be time to patch your system. Protecting against vira modifying executables is easy, and it d
What will JITs do with NX ? (Score:2)
So would all the JITs that everyone's built so far .. Remember that not all code blocks are loaded as readonly off the disk. I had to go through a couple of hoops to get portable.net [dotgnu.org] to work on OpenBSD..
In short they would have to provide a way to mark a write-able buffer as executable - and I suppose you'd call it the next design mistake ?.
Read about PAE and JITs [microsoft.com] (hint: dotne
Re:What will JITs do with NX ? (Score:2)
Every single OS that supports a no-execute bit provides this (including Windows), otherwise things like dynamically-loaded libraries wouldn't work too well. JITs that run on these OSes are, of course, coded to call this when necessary. It's not really a big deal.
Remember that even though NX is The Next Big Thing in the x86 world, rationally-designed CPU architectures have had no-execute bits in their MMUs for a long, long
Re:What will JITs do with NX ? (Score:2)
I'm talking about userland tools which do something like -
They preferably mmap space offRe:What will JITs do with NX ? (Score:2)
Finally someone cracks down on stupid marketing (Score:2, Informative)
Almost all CPU advertising is misleading, first of all because it has to paint with such a broad brush. The NX bit plays only a tiny role in virus prevention. The much-hyped Hyperthreading was only of questionable benefit and certainly not worth paying extra license costs for most people. Dual cores may be a m
Re: (Score:2, Insightful)
Hum. (Score:5, Interesting)
...then I actually RTFA.So it appears that the complaint wasn't against the claim NX "protects against viruses", the complaint was that the advertisements did not make necessary disclaimers like "requires special operating system support". This seems definitely reasonable on the regulators' part.
This said, I have heard it claimed that NX technology is rediculously easy to circumvent. Specifically, I saw a long post by Linus Tourvalds somewhere in which he noted that NX provided protection against some classes of buffer overflow attacks, but not all, and then outlined various ways in which someone attempting a buffer overflow under Linux could potentially simply structure their buffer overflow so as to circumvent the protections NX offers. The post was very technical and I could not tell if the statements were general or just byproducts of the way Linux handles stack and such. Does WinXP suffer from these same problems with regard to the efficacy of an NX bit?
Re:Hum. (Score:4, Informative)
A well crafted buffer-overflow attack that overwrites the return instruction pointer on the stack to point to existing code elsewhere will not be caught by NX. NX catches *execution* of code
from non-allowed pages as pre-determined by the OS; but it does not block data writes.
Stack smashing for fun and profit....... (Score:2)
Re:Hum. (Score:2, Interesting)
I'll try to sketch a radio-commercial:
Voice of teenage girl: "Hi, I'm susan. When I come home from school Í like to chat with my girlfriends for an hour or so. If that darn brother of mine isn't gaming or doing something silly on our computer.
***But thank god that I don't have to worry about
For now, it creates more problems than it solves. (Score:4, Informative)
In a recent cluster installation, we noticed that any tool (IBM's RAID console and the PolyServe cluster files system managment console) involving Java aborted with SIGSEGV errors. This was a Redhat ES 3.0 u3 installation on IBM e336 (dual Xeon 3.06 GHz) systems. Run the tools, immediate BOOM!
Noting that the problem was the JRE blowing itself out of the water with SIGSEGV (and talking to friends that had installed the same OS and same software on different hardware) led me to do some more research. "strace" can indeed be your friend. It seems that AFAICT the NX feature was added to the Xeon processor versions (stepping) that were in our machines. There was no way to disable the feature in the BIOS. There is a little, er, confusion in the various documentation about the kernel's behavior, but "noexec=on" is the default as far as I can tell.
So, what (apparently) happened here?
[personal opinion] Intel, rushing to counter the AMD marketing blitz about the wonders of "no execute", put the feature into their newest Xeon CPUs, possibly before the BIOS functionality caught up. The Linux kernel's choice of defaulting the new feature to "on" (theoretically the best choice) unfortunately resulted in numerous "issues", particularly in applications (simulators, virtual machines, etc.) that commonly execute things within the stack segment. This is done all the time in this class of application. The software development community hadn't caught up to the new feature, either. It seems that there are linker attributes that can disable the behavior (still researching this). [/personal opinion]
If you Google for this issue you will find that virtually (pun intended) anyone that relies on a JRE on Linux (Oracle, IBM, etc.) was affected iff the hardware did the NX bit. Our solution was to download the latest JRE from a source on the Web (Sun in this case) and hope that we did not run into Java compatibility issues or that the JRE versions in the software packages were not bolted in.
We squeaked by with our solution, but it only cost about a whole day figuring it out. Time is cheap. Technical problems are fun, especially with a customer watching all of the game over your shoulder. "You have done this before, right?"
Re:For now, it creates more problems than it solve (Score:2)
Of course since you had the Linux source code you could have fixed the problem yourself.
Re:For now, it creates more problems than it solve (Score:2)
seems I was really being accurate even without knowing why.
Interesting that this should happen (Score:5, Insightful)
It's a shame that they couldn't come up with a better way to market this
Re:Interesting that this should happen (Score:2, Funny)
Re:Interesting that this should happen (Score:2)
blue men? p4 brings multimedia (like, others can't)?
intel has been the master of lying and deceit in their commercials for years. its about time AMD steps up to the plate and fights fire with fire.
Re:Interesting that this should happen (Score:2)
Re:Interesting that this should happen (Score:2)
you think it was a pentium 4?
Can understand.. (Score:2, Informative)
Re:Can understand.. (Score:2)
Oh it can put down in a simplistic and correct way.
There have been several examples in Dutch advertising that should have led AMD to statements like "Can help in stopping virusses" instead of there present "Will stop virusses".
How to stop Buffer overflow . (Score:2)
Why don't the people at Monopolysoft start using more secure libraries with visual c/c++ ?
Performance hits are worth it.
Buffer overflows not the issue on Windows (Score:4, Interesting)
Ohh Cmon (Score:5, Interesting)
Still it really does provide some virus protection which is alot more than can be said about most commercials. I mean is the 'lemon strength cleanser' actually a better cleanser because of the lemon. Is 'oxygenation' or whatever really important for skin care.
Maybe they manage to stop all these types of advertising exageration over there, and if so my hat is off to them. At least if they can really manage to do it objectively. Often these sorts of rules aren't applied evenly, letting false but dear cultural assumptions slide by but blocking correct but disconerting claims. For instance I have no doubt that if we had these sort of tight 'truth in advertising' laws in the US we would find condom ads forced to produce 3 peer-reviewed studies for every claim they make while gun ads would be allow to imply or outright say that carrying a gun makes you safer. But maybe other countries can pull this off, after all I'm always amazed the U.K. can function so well without an explicit constitution so who knows. If they can do it objectively my hats off to them.
Re:Ohh Cmon (Score:2)
OpenBSD [openbsd.org] uses the NX bit to implement a memory policy forcing a page to be either writable or executable, but not both. This will make your
The simple, but misleading explanations (Score:2)
Re:The simple, but misleading explanations (Score:2)
Probably in other countries you would have to use the legal system, and nobody would bother.
Nobody has pointed out (Score:2, Interesting)
The AMD NX feature is a long, long overdue feature that processors have been missing for quite some time, and it can prevent a LOT of misuse. I
"Pointer in memory protection" (Score:5, Interesting)
Every time when the processor writes an address into memory (for example, return addresses stored in stack memory by subroutine calls) the memory location is marked as containing a valid address by using a "shadowed" flag, a 65th bit (one bit of ECC memory is used, so the machine does not need special memory modules, just standard ECC memory modules). If that memory location is overwritten with data, the CPU automatically clears the "shadowed" flag. If the CPU tries to use a pointer as a memory address, that was overwritten with data before, it automatically generates an interrupt.
This feature was originally not designed to be a buffer overflow protection, but it was neccessary, because the AS/400 uses a so-called "single level storage", where all applications use the same address space. Therefore, the machine needed some method to prevent applications from writing to arbitrary locations in memory, and that's why pointer-in-memory-protection was invented.
Actually, the memory is also segmented, one segment for every "object" created by a program. Most buffer overflows can not even overwrite an address, because a character array will have its own object boundary.
For example, the following code will typically not generate a buffer overflow on an AS/400:
int main(void)
{
char space_a[20];
char space_b[20];
int i;
for (i = 0; i < 100; i++)
{
space_a[i] = 'A';
}
for (i = 0; i < 100; i++)
{
space_b[i] = 'B';
}
}
Just try it out, it should not even crash.
I tried a lot of things like these on an AS/400 Mod. 170 running V5R2 using IBM ILE C compiler.
I think, pointer protection using shadow flags is the right way to prevent execution of code inserted by exploiting buffer overflows, because all other protection methods can't prevent return-into-libc exploits, but the pointer-in-memory-protection can, so IMHO it is the only *real* protection.
Further reading: "The inside story of the IBM iSeries" by Frank Soltis (a book about the architecture of the iSeries and the POWER processors)
Re:"Pointer in memory protection" (Score:3, Interesting)
With 3 bits you can also tag a word to contain instructions, and the type of data (integer, float etc).
AMD64 Adverts Suspect Too (Score:2, Interesting)
Re:AMD64 Adverts Suspect Too (Score:2)
'Artist'? You sure it wasn't just an instance of the rare 'geek-ned' putting their socially destructive tendencies to more profitable use?
Fortunately they did not ban PaX! (Score:3, Interesting)
NX is just one method to protect the integrity of the memory. What it basically does is that it allows an OS to implement separation between data and code in the memory of a running process. Many overflow and other attacks depend on writing data in the process memory and then executing it as if it was code. A virus or a trojan is usually a program. It depends on being run, not on memory corruption. Therefore protection against memory corruption brings you literally nothing.
NX in itself stops exploit writers for aproximately 15 minutes, which is the time it takes for them to adjust most of their overflows to make them work with NX. Only a hand full of attacks cannot be adjusted. So NX in itself doesn't bring you much, despite what the marketing departments of companies like AMD and Red Hat tell you.
The trick to provide good memory protection is not to only use NX, but to combine it with other protection methods. This is the approach taken by the PaX project http://pax.grsecurity.net/ [grsecurity.net].
However, there are also some PaX imitations which, unfortunately, do not implement all of the PaX technology (even though some of them claim they do or claim to be even better). Examples are: MS-Windows SP2, Red-Hat's Exec-shield and OpenBSD's W^X.
Anyways, back from the technical intermezzo to AMD marketing. These guys have the same problem which people from the PaX project, exec-shield, OpenBSD and others who produce stuff like this have: Try to explain why this stuff is useful. If clever people like Linus don't get it, then how is one going to explain it to John Doe or the PHB's of this world? ``Memory corruption? Exploits? Buffer overflows?'' ``Woah! Brain overload!'' At least they have heard the word ``virus'' a few times and have learned that ``virus = bad''. So ``NX = good'', which cannot be explained to lusers, became ``NX = anti-virus = good''. Even if it is disabled by default, if you cannot motivate people to try to look for it, they never will.
Oh yes, these patches break things. Most programmers are spoiled. They think it is normal to mess around with memory in any way they like. Few of them understand that what is convenient for them, is also convenient for exploit writers. It's like MS-DOS programmers complaining about the file permissions on UNIX.
I hope AMD takes the challenge to produce better marketing, so more people start using this technology. Even though it is badly implemented in MS-Windows, it is a small step in the right direction.
This just in (Score:3, Funny)
AMD's idea is actually quite usefull.... (Score:2, Informative)
In fact I think Dutch courts took it to far, or at least farther than they would have for other pruduct that mislead the public through advertising.
Don't get me wrong, I'm all for truth in advertising, but this is selective justice.
I have yet to see one laundry detergent that fail to get your cum stains out of your mothers favorite sweater to actually get banned for false advertising.
It Breaks Down Like This (Score:4, Funny)
Yeah, it's legal, but is ain't a
hundred percent legal. I mean you
can't walk into a restaurant, open
up a laptop, and start settin' NX bits.
You're only supposed to hack in
your home or certain designated places.
JULES
Those are internet cafes?
VINCENT
Yeah, it breaks down like this:
it's legal to buy it, it's legal to
own it and, if you're the
proprietor of an internet cafe, it's
legal to sell it. It's legal to
carry it, which doesn't really
matter 'cause -- get a load of this
-- if the cops stop you, it's
illegal for this to search you.
Searching you is a right that the
cops in Amsterdam don't have.
HW protection long time ago implemented on SPARC (Score:2)
At first this flag was disabled by default because it was not comply
Re:HW protection long time ago implemented on SPAR (Score:2)
And the cute thing is the advert - it has a G4 (Score:2)
In the print versions sold locally (e..g in the HCC magazine) it is even more obvious as you see the whole machine.
Dw.
The actual reason (Score:2)
Which we all know, isn't true.
By the way: Holland ins't the same as The Netherlands. Holland is just a small part in the west of The Netherlands. To make it more confusing: Zeeland and Friesland are also part of The Netherlands
Re:Holland or the Netherlands? (Score:2, Redundant)
The X-bit article body says Netherlands, but the title says Holland. Holland is a sub-region of Netherlands. Maybe it really doesn't matter all that much to me, but there is a difference, and some people get picky about what their country is called, and this is a common mistake for Americans to make.
Re:Holland or the Netherlands? (Score:2, Insightful)
Re:Holland or the Netherlands? (Score:3, Informative)
Friesland, Groningen, Brabant, Limburg,
Drente, Overijssel, Gelderland, Utrecht
and Flevoland.
Re:Holland or the Netherlands? (Score:2, Informative)
There are 12 provinces. Holland as such simply does not exist.
And to you moderators who think this is redundant, maybe it would be if for once the editors would get it right. So far they never do, so the information is not redundant.
Re:Holland or the Netherlands? (Score:2, Informative)
Re:Holland or the Netherlands? (Score:2, Funny)
Re:Holland or the Netherlands? (Score:3, Funny)
Re:Holland or the Netherlands? (Score:2)
Moll.
Re:Holland or the Netherlands? (Score:3, Interesting)
Heck, most languages call other countries (and/or their native languages) by names that frequently have little relation to their native name. People in Byelorus even complain that germans call their country "white russia" instead of "byelorus", even though they call the German language "nyemetski" instead of
Re:Holland or the Netherlands? Wanna know ? (Score:2, Informative)
The Netherlands means what it says; compared to sea level countries like belgium, holland and luxemburg lie very low (not sure if 'lie very low' is the correct way to say it but you catch what I mean
Who cares? (Score:4, Interesting)
Of course, the whole mess doesn't exist in the Dutch language anyway. We live in Nederland, we speak Nederlands, and we call ourselves Nederlanders - all perfectly regular. If I called myself a "Hollander" in Dutch, I would be indicating I was from either South Holland or North Holland. If I do the same in English people understand I'm from the Netherlands.
Oh, and if the audience is American, they know I'm from the capital of a country known as Kopenhagen ;-) Sorry about that, but you must understand that American tourists who are not only lost, but in fact at least two entire countries removed from where they think they are, are the stuff of legend in Europe ;-)
Re:I thought NX was... (Score:2)
Re:Honest Answer (Score:2)
Gives you a place to rest your middle finger when it is being shaken at the screen.