Thornton 2 Library : List of Journal Entries

Belen woman cited for driving too SLOW

Fri, 20 Aug 2010 20:34:57 -0700

A woman in Belen, NM, was cited for driving too slow. You read that right.

http://www.koat.com/news/24702883/detail.html

She was driving on Reinken Road, Belen's main east-west street, when a New Mexico State Police trooper pulled her over. The speed limit in that section of road is 40 MPH; she was cited for driving 34, six miles per hour under the limit.

Now, she has to fight a $70 citation for what most people, including the State Police in their safety presentations, call careful driving. By the way, this was after 10:00 at night, when there are barely any cars out, so it's not like she was impeding the flow of traffic.

So I guess that's why everyone in Valencia County treats every street as a raceway, including residential streets with children playing. They'll get stopped and fined if they don't.

By:

ArielMT
Tags:
WTF

add/edit

Belen woman cited for driving too SLOW+discussion

If You Live in the UK, Read This: Tech Support Phone Scam

Tue, 06 Jul 2010 13:47:03 -0700

If you live in England, Scotland, Wales, or Northern Ireland, you will want to read this.

There's apparently a scam going around where people are getting called out of the blue from "support technicians" who claim that the victim's PC has viruses on it (or that Microsoft have told them their PC has a virus), and they will clean up the problem if only the victim will let the "technician" caller walk them through installing all manner of backdoor programs, and for a £185 fee that the hidden fine print says can't be charged back.

Quite obviously, they target the elderly and the computer illiterate.

The article: http://www.pcpro.co.uk/news/security/359233/the-unstoppable-tech-support-scam

By:

ArielMT
Tags: Add +tags

If You Live in the UK, Read This: Tech Support Phone Scam+discussion

Symantec have a very enlightening write-up on how this scam works, as well as an educational YouTube video of this scam in operation.

http://www.symantec.com/connect/blogs/technical-support-phone-scams

http://www.youtube.com/watch?v=pXdFRzkIypI

--ArielMT.....Wed Jul 07 20:17:48 -0700 2010

Pirate Party to Run Pirate Bay from Swedish Parliament

Fri, 02 Jul 2010 18:32:02 -0700

This is amazing.

After their former hosting provider received an injunction telling it to stop providing bandwidth to The Pirate Bay, the worlds most resilient BitTorrent site switched to a new ISP. That host, the Swedish Pirate Party, made a stand on principle. Now they aim to take things further by running the site from inside the Swedish Parliament.

Because of this, the Pirate Bay will gain the immunity from the RIAA/MPAA (collectively known as MAFIAA) that's afforded to everything in Parliament by the Swedish Constitution.

By:

ArielMT
Tags:
Pirate Party

The Pirate Bay

Yarr

add/edit

Pirate Party to Run Pirate Bay from Swedish Parliament+discussion

The Fall of Dell

Fri, 02 Jul 2010 18:21:19 -0700

Oh, how the mighty have fallen.

Dell, once the leader in OEM Personal Computers, will never recover their former glory, now that the open secret the world knew has been confirmed.

Dell sold faulty PCs for years, and they knew it.

Dell were among the many victims of the capacitor plague in the opening decade, but unlike many others, Dell went out of their way to hide it. Quoting Bill Snyder:

Stuff happens. People and companies make mistakes. If you've had a long-term relationship with a vendor, reaching for the divorce papers too quickly can be the wrong move.

But what we've learned about Dell recently doesn't qualify as an understandable mistake. Only a rotten company sells defective computers and lies about it. How could anyone in IT or anyone buying a computer for personal use ever trust that company again?

Off topic, the same could be said for Apple regarding their handling of the iPhone 4 Grip Of Death, which was revealed by customers on launch day.

The problem is what thousands upon thousands of irate Dell customers have claimed all along: Dell have cut so many corners that they finally cut their bottom line.

Enjoy your future, Mr. Dell. Enjoy being as forgotten as Compaq, Packard Bell, Digital Equipment Corporation, Sperry, and Remington-Rand. At best a faded memory, and welcomed to the trash-heap of history.

If you are remembered, Mr. Dell, you'll be remembered as fondly as... Well fancy that, I'm drawing a blank on companies killed by their own greed.

By:

ArielMT
Tags: Add +tags

The Fall of Dell+discussion

Legal Action over Unicorn Meat

Fri, 02 Jul 2010 17:43:44 -0700

What?

Yes, ThinkGeek got a cease and desist letter from the National Pork Board because they were afraid that their slogan, "The Other White Meat," would be confused with a ThinkGeek joke, canned unicorn meat.

"Unicorn: the new white meat."

ThinkGeek's parent company, Geeknet, issued an apology for the confusion between pork and unicorn diets. Unlike the meat itself, this is no joke.

What has our world come to?

By:

ArielMT
Tags:
You Can t Fix Stupid

add/edit

Legal Action over Unicorn Meat+discussion

Best Buy Will Fire a Formerly Pseudonymous YouTuber over a Funny Viral Video

Fri, 02 Jul 2010 17:13:10 -0700

An employee at Best Buy is probably going to lose his job because of a video he posted to YouTube.

Be warned that it's laced with foul language, but it's still pretty funny:

Now here's the kicker. No one would have ever known the video's author was at all related to Best Buy, had it not been for Best Buy themselves. The author isn't named in the video, Best Buy weren't calling themselves "Phone Mart" last time I checked, and no mention of Best Buy or any of their brands is mentioned anywhere. So how do we know? Well, Best Buy put the author, Brian Maupin, on suspension, and they're trying to fire him.

Seriously? Seriously.

The Lockergnome summed it up in his post:

...Best Buy is right… there may be people turned off of Best Buy Mobile as a result of this video. HOWEVER, it will be because of their pathetic reaction to it, and their treatment of Brian… NOT due to the video itself.

Once again, Best Buy show why they're not the best buy.

Oh, and the iPhone isn't the only target. He made an equally funny rebuttal video:

Best Buy Trying to Fire Employee who Created Viral HTC EVO vs iPhone 4 Video - Chris Pirillo (The Lockergnome), no date given.
Best Buy Trying To Fire Employee Over Those Hilarious EVO Versus iPhone Videos - MG Siegler, TechCrunch, 2010-07-01.

By:

ArielMT
Tags: Add +tags

Best Buy Will Fire a Formerly Pseudonymous YouTuber over a Funny Viral Video+discussion

Rock on, Tavis Ormandy

Wed, 30 Jun 2010 19:22:19 -0700

Rock on.

In the computer security community, there is an everlasting debate between "responsible disclosure" and "full disclosure" when reporting security vulnerabilities. "Responsible disclosure" is the name given to the method of disclosure favored by most software vendors: vulnerabilities are disclosed only to the vendor of the affected software code, theoretically allowing the vendor to fix the code and distribute the patch. "Full disclosure" is the name given to the other method: vulnerabilities are disclosed to all, so that everyone affected by the vulnerabilities can take action to protect their systems until the vendor releases a patch.

Microsoft's products are still widely used, making them very lucrative targets to the lawless variety of Internet hackers. The more clever among them have unknown vulnerabilities in Microsoft's products hidden away, with the next one ready to deploy once those known to the public are effectively patched. This, however, is information that can only be anecdotally verified due to its very nature. It can't be verified to an extent that would satisfy a major software vendor like Microsoft.

This leaves law-abiding Internet hackers and security researchers in a very difficult position when they discover unpatched vulnerabilities.

Advocates of "responsible disclosure" assume that Internet criminals haven't discovered the vulnerability that needs to be disclosed, so the best approach is to report the vulnerability to the vendor privately, then leave it to the vendor to write, test, and deploy a patch. They argue that disclosing a previously undisclosed vulnerability to the public would place all the information needed to exploit that vulnerability in the hands of criminals, who will then go on to do just that until system administrators can install a patch when the vendor releases one. And this argument is, on the surface, correct.

Advocates of "full disclosure" assume that Internet criminals are just as likely, if not moreso, to discover a previously undisclosed vulnerability as law-abiding Internet researchers. This is correct, for there are a large number of highly intelligent people on both sides of the law, and greed and fear are both powerful motivators for those on the wrong side of the law. These two motivators together drive the lawless not only to craft ways to exploit vulnerabilities in ways that make detection difficult, but to bide their time and wait until the right moment to deploy or strike.

Advocates of "full disclosure" also counter the "responsible disclosure" point with the fact that software vendors are not motivated to patch vulnerabilities unless their bottom line is immediately threatened by the vulnerability. Vendors, including Microsoft, have been known to sit on "responsibly disclosed" vulnerabilities for years without patching them, only to be caught with their virtual pants down when criminals decide to exploit those vulnerabilities in ways that attract media attention. Microsoft have even sat on a fully disclosed vulnerability for eight years before it finally gained enough media attention for them to patch it. If they're that slow to move on fully disclosed vulnerabilities, then how much more slowly do they move on "responsibly disclosed" vulnerabilities that never see the light of day?

They always seem to patch vulnerabilities quickly, within a few days (or even hours) of the embarrassment, coming to the rescue of their customers like a knight in shining armor with a brilliant new lance to slay the Internet dragon.

But the one among the law-abiding credited with discovering the vulnerability is often slain in the press as a witch alongside the dragon that is the vulnerability reported, as if he summoned the dragon terrorizing the Internet into existence himself.

Today's witch being slain in the press is a Google employee named Tavis Ormandy. He is the law-abiding hacker who discovered the bug in the Help and Support Center allowing remote code execution that Microsoft finally acknowledged on June 10. He is being vilified because he disclosed the vulnerability in a post to the Full Disclosure mailing list.

In that post, he went into detail about the exact nature of the vulnerability. For that, he's been attacked in the media.

In that post, he went on to give detailed instructions on how to mitigate this vulnerability, how to render it null and void, and he even supplied a patch easy for programmers to understand.

For that post, he's being criticized as an example of why "full disclosure" is wrong. But full disclosure is not wrong. Full disclosure was the only option left to him in getting Microsoft to move against this pretty large, fundamental, and surprisingly easy to patch hole. He's being blasted for not following the principles of "responsible disclosure" by giving Microsoft "only" five days to react.

Only?

Microsoft were awful quick to move against the vulnerability once it hit the fan, posting a detailed advisory the very same day.

It hit the fan because many, many days after full disclosure, malicious exploits against this vulnerability showed up in the wild. It took five days, the same length of time he gave Microsoft, meaning ten full days after he reported it to Microsoft initially.

And what happened during the five-day window he gave Microsoft in his act of "responsible disclosure"? Well... "Those five days were spent trying to negotiate a fix within 60 days." Sixty days. Two entire months, in which this vulnerability's existence went from maybe known to known. (Only a naive fool would think vulnerabilities in popular software products are ever completely unknown to anyone.) That, to many security researchers on both sides of the full disclosure debate, is unacceptable.

But for those who subscribe to "responsible disclosure," that unacceptable non-solution is what they get, far more often than not.

Those who subscribe to "full disclosure" don't take as an answer being told, as W. C. Fields might put it, "Go away, kid, you bother me."

They bother software vendors for a very important reason: It's the only way they seem to listen to what matters.

Keep on making our software safer, Full Disclosure. Thanks for doing the right thing, even when it's extremely unpopular.

Rock on.

Critical and unpatched, Windows XP bug is under attack - The Register, 2010-06-15.
Researcher burned at the stake for vulnerability disclosure - The Tech Herald, 2010-06-16.
Responsible disclosure and its irresponsible advocates - IT Security, TechRepublic, 2010-06-23.
Microsoft finally catches the eight year bug - IT Security, TechRepublic, 2008-11-13.
Microsoft confirms 17-year-old Windows Bug - Computerworld, 2010-01-21.
Re: Hyenas of the Security Industry - Marsh Ray replying to Brad Spengler on comp.security.misc, via DailyDave, via Gmane, 2010-06-21.

By:

ArielMT
Tags: Add +tags

Rock on, Tavis Ormandy+discussion

Whoops. Looks like Microsoft have a problem beyond "full disclosure" to contend with. How about "no disclosure"?

French security services provider VUPEN claims to have discovered two critical security vulnerabilities in the recently released Office 2010 – but has passed information on the vulnerabilities and advice on mitigation to its own customers only. For now, the company does not intend to fill Microsoft in on the details, as they consider the quid pro quo – a mention in the credits in the security bulletin – inadequate.

--ArielMT.....Wed Jul 07 11:14:27 -0700 2010

Windows 7 Never Connects to Preferred Wireless Networks If a Program Tries To Access the Internet First

Sat, 26 Jun 2010 22:53:32 -0700

http://social.answers.microsoft.com/Forums/en-US/w7network/thread/040d0b12-795c-478e-b697-e3056f5875e4

This is a bug report for two problems. First, Microsoft appear to have a primitive to nonexistent mechanism for end-user bug reporting for Windows 7. As best I was able to find, the only ways for end users to report bugs are to pay a non-trivial fee for incident support or to register on a support forum that is only trivially monitored by the product's vendor. By comparison, open-source projects of all sizes, ranging from only two or three active programmers to hundreds of active developers, tend to have better bug reporting mechanisms for their end users.

While Windows 7 does appear to have the ability to discover and report problems automatically, neither Windows 7 nor Microsoft.com present a viable means for their users to report problems that the software is not able to discover on its own.

I humbly request that Microsoft take this first problem as constructive criticism and correct this problem.

-----

Second, and more urgently, Windows 7 appears to have a wireless connection bug.

Platform: eMachines eM250 netbook preinstalled with Windows 7 Starter, with all current vendor and Microsoft updates applied as of 2010-06-26. The security applications supplied by eMachines (trial versions of Norton/Symantec products) were successfully uninstalled, and they have been replaced with Microsoft Security Essentials, which is running and up-to-date.

This PC connects to wireless access points manufactured by Cisco (Linksys and Aeronet brands), Netgear, Belkin, and others, using no security, WEP, WPA, and WPA2, and many of these are saved as preferred networks. I am able to view and manage these preferred network connections via: Start -> Control Panel -> Network and Internet -> Network and Sharing Center -> Manage wireless networks.

This problem manifests whether starting up, resuming from hibernation, or just moving into range of a preferred network.

If Windows is left alone (no Internet-aware applications running), and if Windows is not already connected to a network, then it connects automatically to the preferred wireless network that is in range. This is the expected behavior.

However, if Windows is not yet connected to a network, if an Internet application is started before Windows connects to a preferred wireless network, and if that application attempts to use the Internet, then Windows will never connect to a preferred wireless network automatically. The Network Connection icon in the System Tray must be opened, the preferred network manually selected, and the "Connect" button that appears on selection must be manually clicked. This is not the expected behavior.

It does not matter whether the Internet application is a Microsoft application, such as Internet Explorer and Windows Live Mail, or a third-party application, such as Mozilla Firefox and Mozilla Thunderbird.

The expected behavior is that, if Windows is not connected to a network, if wireless networks are available, and if one of those wireless networks is a preferred network, then Windows should connect to it automatically regardless of whether or not any running applications are trying to access the Internet.

Please advise, and please correct this bug.

Thank you.

Windows Genuine Advantage disadvantaged my genuine Windows. Posted from genuine Ubuntu.

Two problems, and no easy solution to either one. I'm expecting that my thread over on Microsoft Answers will be deleted, then an update will be pushed through Windows Update fixing the problem.

My Microsoft Answers forum signature dates from the WGA failure of August 2007, and Microsoft's failure to react to the incident properly (even though they did react to it promptly). I haven't yet figured out how to change it to something more timely, though it's hard to be more appropriate.

I really don't care if my thread is deleted or not; I care whether or not Microsoft choose to address the more urgent problem at all. It would be a step to winning a former Microsoft customer back, to say nothing of all the Microsoft customers made former customers by the failure that is Windows Vista.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Microsoft Windows

Microsoft Windows 7

add/edit

Windows 7 Never Connects to Preferred Wireless Networks If a Program Tries To Access the Internet First+discussion

Quick and Easy Internet Parental Control

Thu, 24 Jun 2010 17:21:45 -0700

I stumbled across something neat for parents who want their children accessing the Internet safely.

Parental controls are nothing new, but the problem has always been how to run a Web blocker that was convenient for parents, difficult for children to bypass (especially by accident while tinkering), and reasonably effective. Blockers running on the PC suffer from the problem of not blocking everything or being easy to bypass.

But the OpenDNS folks launched a new, cross-platform service that makes that simple. And installing it is as simple as configuring static DNS settings: a piece of cake for even budding network administrators. Removing it is just as simple.

The way FamilyShield works is by performing DNS resolution for you and your children. When you type in an address containing a domain name or click on a link containing a domain name, that name is translated into an IP address, which your computer then makes contact with in order to show you and your children that site's content. If FamilyShield blocks that site, the IP address returned is the IP address of the FamilyShield service instead of the actual site, and you see a notice that the site was blocked instead of the actual site.

However, like any parental control software system, it's not a be-all and end-all solution. Your children will be exposed to objectionable material, both in the real world and on the Internet, eventually, no matter what you as a parent do. To be truly effective, a parental control system should buy the time needed to raise children into adults capable of making independent and well-reasoned decisions about right and wrong, good and bad, and the whys of each. To be truly effective, a parental control system needs to be backed up by plain old good parenting.

This looks like it'll help.

FamilyShield by OpenDNS.
Set-up instructions for popular routers and popular computer systems.
OpenDNS Launches FamilyShield, Free Parental Controls Service for Web - ReadWriteWeb [RWW].

DNS settings for FamilyShield:

Primary DNS: 208.67.222.123
Secondary DNS: 208.67.220.123

This is similar to their addresses for their general DNS resolution service:

Primary DNS: 208.67.222.222
Secondary DNS: 208.67.220.220

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
OpenDNS

DNS

Internet

add/edit

Quick and Easy Internet Parental Control+discussion

Microsoft Security Essentials - A Review

Thu, 27 May 2010 11:27:21 -0700

Hello, Microsoft.

I downloaded and installed Microsoft's latest foray into trying to protect their home users from their own poorly thought out legacy decisions, Microsoft Security Essentials, and I'm in the midst of trying it out on Firestorm, the Windows XP-powered Averatec 3200 I bought as what's still the single worst purchase decision I ever made.

So far, it works, but it has one bug and one showstopping problem on some systems, and Firestorm was one of them.

The bug is that, on login, Windows Security Center reports that Microsoft Security Essentials is turned off. MSE reports the same, according to the user interface, because the Microsoft Security Essentials service isn't running. The service starts shortly after login, but a security application needs to start at start-up, before a user is permitted to log in. MSE's service starts so late that most other start-up items (including uTorrent, AVG Link Scanner, and Windows Desktop Search) are already fully operational before MSE's service starts.

The showstopper, however, is that Microsoft Security Essentials can get stuck in an endless loop, consuming every available CPU cycle, as the processes msseces.exe and explorer.exe spin around. The entire system lags, there's often no MSE icon in the system tray, and when started from the desktop icon or Start Menu, MSE's user interface never displays.

You know about this, Microsoft, and the problem is more widespread than you want to realize.

You know about this showstopping bug, and you haven't released a fix for it yet. You haven't even offered a workaround for it.

Well, I have a workaround for you, besides the obvious answer of not using Microsoft products.

The workaround is to do things the Microsoft way instead of the sensible way. The workaround is to uninstall MSE, reboot, reinstall MSE, reboot again, and pray it works. If it doesn't, then lather, rinse, and repeat.

It shouldn't have to be this way, but then, the Microsoft way of doing things is often a synonym for the wrong way of doing things.

All the best,

ArielMT.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Microsoft

Microsoft Security Essentials

Microsoft Windows

add/edit

Microsoft Security Essentials - A Review+discussion

Not even reinstalling MSE worked on Firestorm. MSE and Explorer still did the dance of death, and far more frequently than before.

I wound up ditching MSE completely in favor of another AV solution because this showstopper still had no solution or workaround.

--ArielMT.....Thu Jun 24 16:32:52 -0700 2010

IBM's malware oops, and more Linux stuff

Tue, 25 May 2010 18:39:14 -0700

IBM was represented at AusCERT this year, and they gave away complimentary USB flash drives at their booth. However, IBM released pre-installed malware on their flash drives by accident at the conference. That's an amazing achievement right there, accidentally setting malware free at a computer security conference. Whoops.

The Mozilla folks have a Plugin Check service, to make sure your Web browser plug-ins are up to date. Although designed for the Mozilla family of browsers (Firefox, Seamonkey, and Camino), rumor has it that it works on Opera, Safari, Chrome, and even IE 8.

Following up on the Useful UNIX-Linux Commands journal I wrote a while ago, I found lists of 10 mistakes Linux newbies make and 10 mistakes new Linux sysadmins make. They are:

Mistakes Linux newbies make:

Assuming Linux is Windows, just because it has a mouse-driven desktop. The driving philosophies are very different, and it shows if you try to do things the Windows way on Linux or vice versa.
Trying to run Windows EXE files on Linux. You can't, unless you install either Wine or a virtual machine first, and even then it's not the same or may not work at all. Windows and Linux are very different operating systems, and programs compiled for one operating system is lucky if another operating system can make heads or tails of them.
Choosing the wrong distro. Linux isn't a system per se, but a family of exceedingly diverse systems using the Linux kernel. Choose wisely according to your needs, or you'll only disappoint yourself.
Not finding software. There's plenty of Linux software to be had, dozens of thousands of programs, but they're not distributed in Windows-style download-and-run programs. Nearly everything you'll ever need as far as Linux software goes is managed by the system's package manager, so that everything's kept neat, tidy, and (most of all) up to date. No hunting for downloads, no fuss, no mess.
Sending OpenOffice.org documents to Microsoft Office users. Microsoft still won't play nice with others, and users of Microsoft Office still can't read OpenOffice.org documents. (Heck, Microsoft don't even play nice with themselves, as any Microsoft Office 2003 user receiving a Microsoft Office 2007 document quickly finds out.) If you still need to deal with Microsoft Office users, save your documents as Microsoft Office documents.
Avoiding the command line. Linux shells aren't wimpy MS-DOS prompts, and they're not as hard to use. The Linux command line isn't as necessary as it once was, and on some distros it's not even necessary at all, but it's still an incredibly powerful time-saving tool.
Giving up too quickly. Not all change is good, yes, but not all change is bad, either. Certainly not just because it's different.
Thinking in Windows drive hierarchies instead of the Linux filesystem hierarchy. Windows inherits the old CP/M legacy of everything being stored on cryptic and inflexible drive letters. Linux inherits the UNIX legacy of everything being ordered into sensible directory structures. Your home directory is "/home/your-user-name/", not "C:\Documents and Settings\Valued OEM System Owner\My Documents\", and your documents aren't scattered all over the place or poured out all over your desktop in a huge cluster.
Skipping updates. Don't. The updates are for everything you use, not just the core OS, and they're bug fixes and feature enhancements as well as security updates.
Logging in as root. Don't. Ever. Ever! Everything you'll ever need to do that needs superuser privileges can be done from the safety and convenience of your ordinary user account, thanks to su, sudo, gksu, and kdesu. Unlike Windows, where you practically have to run as an administrator all the time, you never need to log in as root, and you can expect a very stern lecture if you do so even once.
Losing windows in the pager. Most Linux desktops (those based on the X Window System) use virtual desktops which you can select with a pager. That way, you can organize your open windows into desktops, each dedicated to what you want to do, and not have to have everything cluttered on the same screen. Such things are branded as a geek's power toys in Windows but come standard in Linux.
Ignoring security. Linux is not secure. Linux is more secure than Windows, but that's it. More doesn't mean totally. And Linux is a target. Don't neglect security just because it's Linux.

Mistakes new Linux sysadmins make:

Installing packages from radically different sources. If your distro has a package manager, use it. If the package you need isn't in the repository, learn how to add it properly. Don't mix and match sources, or you'll risk your package manager breaking the packages it doesn't know about. It's not a matter of if, but when.
Neglecting updates. Sure, you need to run updates through more scrutiny on server and workstation systems than you do on home systems, but that's not an excuse for letting your systems get out of date. Don't rush headlong into untested updates, but don't neglect them, either, lest you make your systems the targets of exploits everyone has patched but you.
Choosing a bad password for root. The superuser password is the master key to the kingdom. Root login should be disabled completely on sensibly-configured systems, and root's password should be so strong that no one can guess it. Learn what makes a good, strong password, write it down on its own card, and file that card away in a secure vault. On systems with sudoers configured, not even the most senior sysadmin ever needs to have access to the root password, so make sure no one else can find it by making the mistake of setting a bad password.
Avoiding the command line. Few sysadmins ever need to memorize more than a small handful of commands, and the system makes finding commands reasonably easy. GUI tools are okay, but relying on GUI tools is the Windows way, not the Linux way.
Excessive kernels. Any Linux system needs only the two or so newest working kernels installed, not a dozen.
Not backing up critical configuration files. Always make a backup before editing configuration files, and always keep regular backup copies just in case updates trash them.
Booting a server to X. No server needs the overhead of the X Window System without a very good reason. If you can't find a good enough reason, make sure the server boots to a runlevel not booting to X.
Logging in as root. Any sysadmin who does needs a very good reason and a very clear understanding of the risks. Any sysadmin who does as a matter of course should be publicly flogged.
Ignoring log files. They're all kept in /var/log for easy finding and reading. They're the first things to turn to when anything unusual happens, or when anything that should happen doesn't.

So how do you create good, strong passwords? You could use a password generator such as GRC's password generator. The longer and more random it is, the more secure it tends to be. But random passwords aren't memorable, so how do you check the strength of your passwords? Microsoft have a password checker that can report the general strength of your password as you type.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
IBM

Linux

Malware

Microsoft Windows

Computer Security

Oops

add/edit

IBM's malware oops, and more Linux stuff+discussion

Make an amazing magic ball

Tue, 11 May 2010 17:37:22 -0700

I spotted this on YouTube. It really is an amazing (and amazingly simple) trick.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags: Add +tags

Make an amazing magic ball+discussion

Some Internet-related news

Tue, 04 May 2010 17:18:25 -0700

First, Verizon stiffed a family with a surprise $18,000 bill because they thought they still had an unlimited access plan. Boston Globe and CNet News stories.

Next, Internet Explorer has the lowest market share it's ever had since overtaking Netscape Navigator all those years ago. PC World. Yeah, I know, it's PC World, not a real computer site.

But most interestingly, Mozilla Firefox can be broken by a setting buried in Microsoft Internet Explorer on Windows XP Service Pack 3.

Interesting stuff.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags: Add +tags

Some Internet-related news+discussion

Tips for Creating the Perfect Profile Picture

Tue, 13 Apr 2010 11:36:24 -0700

http://mashable.com/2010/04/12/profile-picture-tips/

And other fun stuff. I wasted a bit of time at Photofunia as well.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags: Add +tags

Tips for Creating the Perfect Profile Picture+discussion

Useful UNIX-Linux Commands

Tue, 06 Apr 2010 18:09:20 -0700

20 Linux System Monitoring Tools Every SysAdmin Should Know

My 10 UNIX Command Line Mistakes

Both from NixCraft. I found these while searching for how to install Perl modules in CentOS.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Linux

CentOS

add/edit

Useful UNIX-Linux Commands+discussion

A New Commodore?

Wed, 24 Mar 2010 18:04:49 -0700

A new Commodore computer, in a very 64-like form factor? Perhaps.

Commodore USA announced a PC in a keyboard form factor, one instantly recognized by C64, C16, Amiga 600, and Amiga 1200 users, going on sale in June of this year: the Commodore Phoenix.

To be fair, it's Intel-based and doesn't resemble its noble predecessor in more than superficial appearance, but it will run one of a variety of operating systems apparently out of the box: Ubuntu 9.10, Windows 7, AmigaOS through the Amiga Forever emulator, Mac OS X (definitely not preinstalled), and AROS.

News sources:

SANS ISC (in an off-topic update), ZDNet Blogs, Kotaku, Gizmodo, Tom's Hardware, TG Daily, Drivers HQ, Google News.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Commodore

Commodore 64

Amiga

add/edit

A New Commodore?+discussion

Which Disney princess are YOU?

Wed, 24 Mar 2010 13:36:46 -0700

Interesting stuff from the SANS InfoSec Reading Room.

https://www.sans.org/reading_room/whitepapers/engineering/which_disneyandcopy_princess_are_you_33328 [PDF] - Author: Joshua Brower

Social engineering takes many forms; some obvious, some not so obvious. One not so obvious form is that of questionnaires -- be it a knock on the door to answer a survey for a "census" worker, or a "harmless" quiz found on a social networking site. Depending upon their content, they can serve as a very powerful means of capturing and correlating information for nefarious purposes.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
InfoSec

add/edit

Which Disney princess are YOU?+discussion

AT LAST! SCO Fired Dalek McBride!

Mon, 19 Oct 2009 09:50:18 -0700

What a news story to start off the week with! SCO CEO Darl McBride has been fired!

http://slashdot.org/story/09/10/19/162240/SCO-Terminates-Darl-McBride

http://www.linuxtoday.com/infrastructure/2009101901635NWCD

http://ir.sco.com/secfiling.cfm?filingID=1144204-09-53428

Quoting SCO's SEC Form 8-K filing, "On October 14, 2009, The SCO Group, Inc., (“SCO”, “us”, “we”or the “Company”) announced that the Company has eliminated the Chief Executive Officer and President positions and consequently terminated Darl McBride."

The long Unix nightmare is at last over!

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Linux

Unix

SCO

Pink Fairies

add/edit

AT LAST! SCO Fired Dalek McBride!+discussion

Small Brewery vs. Giant Energy Drink Corp. - Get the Word Out

Thu, 15 Oct 2009 18:10:17 -0700

Monster vs. Vermonster: The Vermont microbrewer Rock Art Brewery has been given a cease and desist order from Hansen Beverage Company, manufacturers of Monster Energy drinks. Trademarked energy drink vs. trademarked beer, and both marks are registered.

There's no likelihood of confusing Monster Energy with Vermonster the beer, as they're both in different markets, in the same way no one mistakes Delta Air Lines for Delta Faucets. Nevertheless, Hansen apparently plan on entering the beer market and see the established name as an impediment to their goal.

The brewery's not taking this idly and not going away quietly. Hansen Beverage Company have the deeper pockets, so there's no way the brewery can win even though every lawyer is telling them there's no case.

It's way past time to send a message to corporations that the law cannot be abused to sue the just and law-abiding out of business. It's way past time to tell them this with the only voice to which they'll listen. The only thing they listen to is money changing hands. It's time to let them hear the sound of your money changing into hands other than theirs.

It's time to boycott Monster Energy and every brand of drink sold by Hansen Beverage Company.

Get the word out.

Small Brewery vs. Giant Energy Drink Corp. - Get the Word Out+contents+Matt and The Monster

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Trade Mark

Injustice

add/edit

Small Brewery vs. Giant Energy Drink Corp. - Get the Word Out+discussion

Cracking into Furcadia

Sun, 04 Oct 2009 10:22:31 -0700

On Saturday, October 3, between 9:00 AM and 12:00 PM FST, a cracker broke into Furcadia and went in-game as a staffer. This user then broadcast usernames and passwords on the news channel. Fel posted a news article on the forum outlining Furc's official account of events and naming the users whose passwords were compromised.

http://forums.furcadia.com/index.php?furcadia_session_id=12546-nqqw-rzr&showtopic=63072

If your main or any of your alts is on that list, then follow the link to change your password.

If your password on Furc is similar to any password you use anywhere else, it's time to change not just that password but your password practices as well. Use a different password for everything, because if your password on one site gets compromised and the attacker knows you have accounts elsewhere, he's going to try that same password elsewhere. Use a different password, and if you have to write them all down somewhere, use a small pad or small book, and guard it as closely as you guard your checkbook and cards.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Furries

Furcadia

Internet Security

add/edit

Cracking into Furcadia+discussion

Well, that's really not many. But, I am glad that my Furcadia profile isn't on there! Wonder why someone would hack Furcadia... it's not like there is any money to be made by doing so.

--tbohn (Not signed in).....Tue Oct 06 10:28:34 -0700 2009

Actually, there is: alt and digo theft. Some people will pay real money (in both senses) for the right name or expensive items. All the more reason to use a strong password on sites you use, and to scramble the passwords of any sites you leave.

--ArielMT.....Wed Oct 07 16:15:19 -0700 2009

Partial Apology to ChewFox

Thu, 17 Sep 2009 23:36:24 -0700

After reviewing the video and reactions, I've come to a conclusion about who's to blame for the representation ChewFox gave of the furry fandom on the Tyra Banks Show yesterday.

I'm sorry for painting ChewFox as entirely to blame. Events unfolded in a matter of hours, even minutes, thanks to the airing of her appearance.

Most of the blame belongs to Tyra, for she is the one who initially painted furries as sex-crazed, fursuit-owning perverts. She's the one who decided that the episode should be entirely about sex, and she's the one who had her guests dressed in identical pajamas and sitting on beds instead of chairs.

Tyra is also the one who basically failed to give ChewFox the opportunity to tell her she was entirely wrong in her conclusion, and by allowing that to persist, the fact that ChewFox likes to have sex in-suit thanks to "strategically placed holes" (commonly abbreviated SPH) was presented as an image representative of the entire furry fandom. This image is what has the fandom up in arms and just about ready to lynch ChewFox.

This image is wrong, and the blame for the image being presented at all belongs to Tyra.

But this does not absolve ChewFox of blame. What she did wrong was appear on a trash-talk TV show specifically as a furry. She should have known that no one who appears on the Tyra Banks Show, or on any Springer-like show like hers, is ever portrayed fairly or accurately as representing any particular group of people. She should have known that she would've been painted as a pervert, whether she actually is one or not, with no opportunity at all to defend herself or the image she appeared to represent.

ChewFox should've known that she would not have been able to represent the fandom at all on such a show; she should've known that the reason she was selected was because they were going to play her like a piano, to be sensationalized for Tyra's benefit and at ChewFox's expense. The fact that they paid her to be a guest should've been a clue.

What I blame ChewFox for is choosing to go on the show anyway, claiming to be example furries (and kinks aside, maybe she is, we don't know), and believing that the result would be anything other than what it is.

Fur Affinity Forums has a thread in which the majority of the rage was contained: Tyra Banks Show, and a thread of advice for any furries considering following in ChewFox's steps and trying to do what she couldn't: How many times furries have told other furries this.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Furries

WTF

ChewFox

add/edit

Partial Apology to ChewFox+discussion

My Little Superhero Ponies

Wed, 16 Sep 2009 23:17:49 -0700

The 21 Awsomest Superhero Mods for My Little Pony

These are awesomely cute.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Awesome

Cute

My Little Pony

add/edit

My Little Superhero Ponies+discussion

Thanks, ChewFox

Wed, 16 Sep 2009 20:57:22 -0700

Thanks for misrepresenting the furry fandom, ChewFox. Thanks for appearing on a trash-talk TV show and portraying all furries as sex-crazed perverts.

Truthfully, our saving graces are that it was trash TV that you appeared on and that the furry fandom is incredibly divided on what being a furry means..

Also, thanks for breaking Fur Affinity with the drama you created then denied blame for.

Sincerely,

A furry who's straight-up normal and Einsteinian compared to you.

Edit: A Fur Affinity admin banned ChewFox shortly after this was written with the following reason: "User has brought shame to the entire fandom for their own personal self gain." She and her mate received money to appear on the show. It was assumed to be Dragoneer, but this has not been confirmed. The reason was removed after an hour, but the user remained banned for 23 more hours, after which the ban itself was lifted.

Major edit: Dragoneer made a post about ChewFox: http://www.furaffinity.net/journal/945722/

There's no doubt that this incident had impact felt across the world by everyone connected to the furry fandom, and when it happens in the span of just a few hours, extreme reactions by all sides are to be expected.

Last edit: The follow-up journal entry, Partial Apology to ChewFox.

Edit again: A Note about Chewfox and Public Relations posted by Hali on Fur Affinity.

Thanks, ChewFox+contents+A Note about Chewfox and Public Relations

Reposted by permission:

I hate the fact that every time I introduce myself as a Christian I have to immediately append "but no, I'm not that kind of Christian." It's a shame that a small number of idiots who think they're doing the right thing can ruin something for so many people.

It's all about the image you portray to the public. We all have two sides- every person, company, organization, even our pets. You have the public face and the private face. The reason we keep the two separate is not because it's dirty or reprehensible, it's because the private does not necessarily reflect the interests of the entire group.

Our military kills people, but they don't show that in the commercials.

Our mothers and fathers spank their children, but they don't announce it to people they meet for the first time. "Hi there! I whipped my boy's butt last night!"

Public relations is all about putting your best foot forward and, when you know you're already fighting an uphill battle, everything you say and do in front of people (fuck the cameras, in front of everyone) speaks to the conduct of all involved.

The line between public and private is not about morality, it's about public relations. Now those of us that are trying so hard to make our fandom publicly acceptable are back at the bottom of the hill.

Edit: In response to a message I got, feel free to re-blog this on FA or anywhere.

Another edit: The assumption is that she deleted her latest journal before going back and deleting them all. This is not true. The admins deleted them because they were breaking the site with the sheer number of comments they amassed.

Clip: Warning, this is a clip of the Tyra Banks show that's very painful to watch.

Thanks, ChewFox+contents+tyrabanksclip

a request of a friend from Bird Word on Vimeo.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Furries

WTF

ChewFox

add/edit

Thanks, ChewFox+discussion

NM Man Arrested for 22nd DUI

Wed, 26 Aug 2009 20:44:50 -0700

No, that's not a typo. This time I got the title right. A New Mexico man was arrested on his twenty-second drunk driving offense.

And New Mexico's politicians tell us that we have the strictest DUI laws on the books. We do, but those laws are not enforced enough. Our legislators and governors (current and past) enact laws with ever stiffer penalties, and our law enforcement works overtime to catch and prosecute drunk drivers, but our judges over and over again see fit to turn drunk drivers -- repeat drunk drivers, mind you -- back loose to drink and drive again.

Delano T. Vigil of Guadalupita, NM, was arrested Monday, August 24, near Espanola, KOAT reported. State police said the 51-year-old man was so drunk, he had to be taken by ambulance to Christus St. Vincent hospital in Santa Fe.

He blew a 0.393 on the blood-alcohol test; the state limit for being legally intoxicated is 0.080 percent. Yes, he was five-fold past drunk when he was arrested.

According to NM state police, records showed Vigil has been arrested five times in New Mexico for driving drunk and at least 16 times elsewhere. At the time of his arrest, he was driving on a revoked driver's license, and he had three outstanding warrants for his arrest, one each in Bernalillo, Sandoval, and San Miguel Counties, and all three DUI-related.

Twenty two drunk driving arrests. Why was this man behind the wheel instead of behind bars? It's New Mexico, drunk driving capitol of the world, that's why, and our courts seem content to keep it that way.

This despite widespread news that New Mexico's drunk driving fatality rate is actually going down. This year alone, New Mexico has had two high-profile crashes in which the innocent were killed and the drunk, driving the wrong way and repeat offenders, survived. It won't be good enough until the people who choose again and again to get drunk and drive are locked away.

It won't be good enough until they're locked away for good.

Sources:

NM Man Arrested For 22nd Drunken Driving Offense: Blood Alcohol Level Tested At .393 Percent - KOAT TV 7, Albuquerque.
Man arrested for 22nd drunken driving offense - KOB TV 4, Albuquerque.
Video shows man's 22nd DUI arrest - KOB TV 4, Albuquerque.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
DUI

add/edit

NM Man Arrested for 22nd DUI+discussion

Microsoft KB937879 Problems on HP Pavilion DV7

Wed, 26 Aug 2009 10:23:24 -0700

Microsoft pushed four updates to Windows Vista x64 systems yesterday, and one of them is causing problems for some people.

Microsoft KB Article 973879 was released on August 25, 2009. It is supposed to resolve a problem on Windows Vista x64 (based on Intel 64-bit CPUs) in which a BSOD happens when installing Windows Vista SP2.

However, on Hewlett-Packard Pavilion DV7 notebooks, installing this update, which is supposed to prevent Windows Vista from crashing, is rumored to actually cause Windows Vista to crash.

(The article author initially didn't know precisely which update was causing the crash.)

My office has confirmed that this update does indeed crash Windows Vista on an HP Pavilion DV7, although the type of failure was a snow crash. The computer froze and became completely unresponsive at the instant of the crash: the arrow did not move or animate, and all the off-screen indicator lights froze in the state they had (on or off) at the instant of the crash, including the hard drive activity light.

There are two workarounds, both of which are essentially to rip the update out of Windows Vista. Start the computer in Safe Mode by mashing the F8 key just as the HP logo vanishes, then using the arrow and enter keys to choose "Safe Mode."

If you have a restore point for it, choose Start -> All Programs -> Accessories -> System Tools -> System Restore, and choose the Windows Update event that installed the update.

Otherwise, instead of using System Restore, choose Start -> Control Panel -> Programs and Features -> KB937879 -> Remove. You may have to hit the "Show Installed Updates" link in the left column to make KB937879 visible.

Reboot your computer, then do not let Windows Update install the update again.

By:

Oops! I tried more than the maximum number of times to render ArielMT, but then stopped, fearing infinity.
Tags:
Microsoft

Microsoft Windows

Windows Vista

Windows Update

KB937879

add/edit

Microsoft KB937879 Problems on HP Pavilion DV7+discussion

The card's name is typoed, I know, but a bug in the version I'm using is preventing me from changing the name. I plan to upgrade very soon.

--ArielMT.....Wed Aug 26 20:09:16 -0700 2009