Email Address Password
Remember Me

Or Create a (Free) Account.
2004JanFebMarAprMayJunJul Aug Sep Oct Nov Dec
2005 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
2006 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Oct Oct
2007JanFebMarAprMayJunJulAugSepOctNovDec2007
2008JanFebMarAprMayJunJulAugSepOctNovDec2008
2009JanFebMarAprMayJunJulAugSepOctNovDec2009
2010JanFebMarAprMayJunJulAugSepOctNovDec2010
2011JanFebMarAprMayJunJulAugSepOctNovDec2011
2012JanFebMarAprMayJunJulAugSepOctNovDec2012
2013JanFebMarAprMayJunJulAugSepOctNovDec2013

Wed 30th Sep 2009 @ 01:13 2009: Proving security?

A customer of mine requires Windows XP/Vista to access the VPN; once this has been accepted, a list of acceptable Anti-Virus software vendors is checked for. I now have to install one of these onto my Windows machine, because simply installing Windows is not sufficient.

In typical download-stuff-for-Windows-from-the-internet, I get this vague information, so I have no idea whether my 3g limit could be exceeded just by downloading the installer (and we all know that installers then tend to get online to grab newer versions, or whatever).


No indication of how large the download is, no offers to check the validity of the downloaded file.

After that, I am told that it is unsigned; do I want to run it or not? I choose "Run", but am then told that it is not a valid executable.

This is just the first step in my attempt to get into a customer's network via the internet.

Why do I suspect that I could find lots of other ways to get into the network without jumping through all the hoops?

This feels like a set of security procedures put in place to ensure that valid users access the network in a secure manner, but does not address the main "back-door" access techniques at all.

All the time, I'm using an OS which is currently susceptible to no known wild viruses, but I can not get on to the network, because I can't show that I am running a certain Windows version with certain antivirus software installed. The fact that the required AV software can be downloaded from an untrusted third-party website with no signature or validation, is apparently not a problem.

Grr.

Post a Comment               

Wed 30th Sep 2009 @ 00:21 2009: Bin

bin

Good advice, I'm sure, and thanks for providing it... but I just don't find the litter bin anywhere near as efficient at blocking the toilet as the other devices mentioned.

Post a Comment               

Wed 16th Sep 2009 @ 20:50 2009: ready.gov - Preparing your pets for emergencies makes sense

ready.govI just saw this advert on a website; it really is for the US Govt's ready.gov site, which under get a kit says "Pet food and extra water for your pet". I'm not sure that that really counts as "preparing your pets" though - shouldn't we be talking to them about the rendezvous point and contact numbers?

The other suggestions are to make a plan and be informed. You can even determine your Readiness Quotient, without even needing to know what it is that you are getting ready for. My RQ is 0/10, apparently.

Amazing.

PS. In doing the RQ test, I had to complete this captcha - bit of a challenge to answer in two words! 33ish

Post a Comment               

Wed 16th Sep 2009 @ 00:27 2009: Microsoft Stores

Microsoft are going to open "Microsoft Stores" along the lines of an "Apple Store". What are they going to sell? Zunes, keyboards and mice?

Penny Arcade - Welcome to retail oblivion
http://www.penny-arcade.com/comic/2009/7/20/welcome-retail-oblivion/

I guess that living in a UNIX/Linux world, even though the x86 architecture is unavoidable, at least one is spared the Orwellian choice of Eurasia or Eastasia. Long live Oceania!

Post a Comment               

Fri 11th Sep 2009 @ 23:18 2009: Cool interactive [Non]Deterministic Finite State Machine

If you have never needed to know what a Finite State Machine is, this will probably not be very interesting (though it might be).

reAnimator

Post a Comment               

Fri 11th Sep 2009 @ 09:13 2009: Apology for Turing at last

PM apology after Turing petition - now have a word with the Queen and sort out the posthumous knightood!

Post a Comment               

Wed 9th Sep 2009 @ 23:48 2009: Priorities (agendas?)

Due to yet another glitch in Planet Debian, I saw this today.

(relatively) famously, Bug #1 for Ubuntu is titled "Microsoft has a majority market share"
Bug #1 for gNewSense is titled "Not all software is Free"

In the FLOSS ecosystem, there are many players, each with their own priorities (though maybe the word "agendas" would be more appropriate).

Ubuntu's starting point was a rallying-call, and a stated priority - it defined the "problem", and suggested the means to fix that percieved issue.
gNewSense, a Ubuntu-without-non-free-blobs distribution, has a different agenda; it makes use of the popular Ubuntu distribution, but removes any non-free (by its own, stricter-than-Debian definition of Freedom) elements.

I am simply observing this fact; whilst the pragmatic approach often makes sense, it is historically shown that it is only because of the idealists (eg Debian) sticking to Freedom principles that pragmatists (eg Ubuntu) have been able to make progress.

Ditching the principles would mean the loss of those principles, and eventually degenerate into the current status-quo, where closed-source software and NDAs are commonplace.

On the other hand, sticking religiously to the principles can be very costly; apparently Richard Stallman uses one GNU/Linux distribution (utoto?) because it is the only one he has found which truly honours the Free Software principles.

The variety from Utoto to gNewSense Debian to Ubuntu to embedded NetGear kit using Linux is a real strength for GNU/Linux overall though. Lots of interested parties have an interest in making sure that the central software works for them.

Post a Comment               

Tue 8th Sep 2009 @ 01:01 2009: The Maggie Sort Algorithm

Awesome - http://www.youtube.com/watch?v=Zybl598sK24

Post a Comment               

Fri 4th Sep 2009 @ 00:15 2009: Twitterers

Bit.ly, twitpic and the rest might be really useful for the twitterati, but for the rest of us, it's just a pain.

For example - I subscribe to the RSS feed of Gareth Jones' tweets, so when he posts @profbriancox http://twitpic.com/gb1k8 - Rhyl beach surely?, I have to find the URL in the content, paste it into a browser, just to find if I am interested in the content (usually with no indication as to what the content might be).

140 characters should be enough to include a summary too, surely? If not, why not try doing something new like - oh, I dunno, blogging? Will we eventually go back to web pages containing articles of actual content? Or is it too late for such an ideal to survive?

Post a Comment               

Thu 3rd Sep 2009 @ 22:17 2009: Ealing lost £500,000 due to one Windows virus infection

virusForget Swine Flu, Ealing Council got a virus from a staff-member inserting an infected USB stick into a PC, which cost them £500,000, according to this Guardian report. The London Evening Standard reports that "all terminals had to be rebuilt or replaced." and that "the final cost could top £1.1m if a new computer security system is needed"

I'm not a Wintel engineer, but I'm sure that there's a Registry switch to disable USB drives completely, and another to disable autorun. That shouldn't cost more than £1,100 to implement, let alone £1,100,000

TCO figures for MS Windows and alternatives need to figure in such real-life scenarios.

Post a Comment               

Wed 2nd Sep 2009 @ 21:31 2009: Do I wear contact lenses?

I got some eyedrops today. Reading the information page, I found this vital piece of advice:
if you are not sure

Take special care with Brolene Eye Drops if:

* You wear contact lenses. You should not wear contact lenses while using these drops.

If you are not sure if the above apply to you, talk to your doctor or pharmacist before using Brolene Eye Drops.


That is the only item in the list. If you don't know whether or not you wear contact lenses, you have bigger problems to deal with first!

Post a Comment               

Tue 1st Sep 2009 @ 23:50 2009: Google adverts - Privacy Policy

This website's Privacy Policy includes this text:

Update March 2009: This website currently displays Google adverts. Those adverts will (if your browser settings permit) install a cookie on your browser, which is used to further target their advertising. Google wrote about it here, I wrote about it here.


I have been getting very little revenue from Google adverts recently, so it makes sense to show fewer adverts, if I get very little from showing them at all (especially at the start of the academic year, when the site usually gets a slight increase in traffic).

So it is interesting that this item is shown when I log in to my Google account - I have not noticed it before, but isn't a "Update your policy by April 2009" a bit late to be shown as "NEW" in September 2009?

8 April 2009

Post a Comment               

Tue 1st Sep 2009 @ 23:14 2009: Ah, fresh fanboiism

It's always nice to get a nice fresh fanboi naively parroting something so close to the truth that it's almost there, other than the "oh, but Microsoft wrote this code" part. Spider took the BSD code, and Microsoft bought it from Spider. (Original URL: http://www.kuro5hin.org/story/2001/6/19/05641/7357)

So it makes me smile when sites like http://weblog.cynosura.eu/post/2009/03/02/Sockets-and-C.aspx say:

The Berke­ley Sockets In­ter­face is cur­rent­ly the de-​fac­to stan­dard network Ap­pli­ca­tion Pro­gram­ming In­ter­face (API) for in­ter-​pro­cess and net­work-​bound com­mu­ni­ca­tion between com­put­ers. The name was derived from the origins of the API in V4.2 of the Berke­ley Stan­dard Dis­tri­bu­tion (BSD) of the UNIX op­er­at­ing system.

The Mi­crosoft tech­ni­cal spec­i­fi­ca­tion which defines how Windows soft­ware ac­cess­es and exposes in­for­ma­tion on the In­ter­net is called the Windows Socket API, or Winsock for short (doc­u­men­ta­tion here). Version 1 of the spec­i­fi­ca­tion, in­tro­duced in 1992, was based upon the paradigm of the socket pop­u­larised by the Berke­ley Sockets API. Winsock 2 (the current version) is ac­tu­al­ly a very close fea­ture-​for-​fea­ture im­ple­men­ta­tion of the entire Berke­ley sockets API. The .NET im­ple­men­ta­tion of Winsock — en­cap­su­lat­ed by the System.Net.Sockets names­pace — pro­vides a fully managed im­ple­men­ta­tion of Winsock for .Net de­vel­op­ers (The im­ple­men­ta­tion is in fact mostly a wrapper for the Win32 im­ple­men­ta­tion.)


Aww, bless. Yes, it's all about writing .NET for Windows. He goes on to explain netstat as well as the whole UNIX Sockets interface, inelegantly dumped onto the Windows API, as a Microsoft specification. Sweet.

Now - let's be perfectly clear about this - the BSD license is absolutely fine with this reuse of code (some versions of the license have an "advertising" clause that requires acknowledgement to the Regents of UCB, but nothing more). It's just not accurate to describe this as a Microsoft specification.

Post a Comment               

Steve's urandom blog
Share on Twitter Share on Facebook Share on LinkedIn Share on Identi.ca Share on StumbleUpon
My Shell Scripting Book:
    Shell Scripting, Expert Recipes for Linux, Bash and more
is available online and from all good booksellers:


DefectiveByDesign.org