Interesting links and notes on updates to my main website.



[to search, use Blogger search in top bar]

A Home User's Security Checklist for Windows covers pretty much everything. Via GS. posted by Richard at 23:05 / permalink (post) | permalink (numeric)

Go hard and back up. Or something to that effect.

Some external hard drive options.
I recommend FireWire but you may prefer (ewww) USB 2.0
Avoid the tiny ultra-portable ones unless you actually need them to be... tiny and ultra-portable. They're much more expensive. You could consider the iPod to be in this category.

Maxtor OneTouch
Western Digital External HDs

WD makes this weird thing they call the Media Center which appears to be a combination of a 250GB hard drive, a flash card reader, and a USB hub.

My current external HD is a 30GB WD Firewire drive. Has worked well for me on Mac and PC.

LaCie makes shiny external hard drives including the remarkable 1 Terabyte Bigger Disk.

NCIX.com sells the Bigger Disk for C$1668.

Of course you can also always get an enclosure and build your own. posted by Richard at 18:30 / permalink (post) | permalink (numeric)

This is perhaps a good time to remind that I reported on November 21, 2003 that CA is offering its Windows eTrust EZ Armor Security Suite including antivirus and firewall for free for one year. (Also a note that marketing people should never be allowed near product names.) posted by Richard at 18:18 / permalink (post) | permalink (numeric)

It seems that after a bunch of relatively harmless computer malware, we started to forget that once someone or something is on your Windows computer, they can do pretty much anything, including deleting all your files.

MyDoom.F was apparently a wake-up call to some.

Searches the folders on drives C to Z for files with certain extensions.
If the drive is a hard drive, remote drive, or RAM drive, the worm randomly deletes the files it finds with the following probability:

.mdb - 98% [apparently it has a particular hate on for MS Access database files]
.doc - 40%
.xls - 60%
.sav - 95%
.jpg - 8%
.avi - 10%
.bmp - 15%

In today's Ottawa Citizen, Glen McGregor makes it real by telling the tale of his Doomsday.

virtually every digital photo I had ever taken had been purged from the drive: The bleary-eyed snaps from last Christmas morning, all erased. Pictures of an anniversary trip to New York City, disappeared. Pictures of my youngest daughter, taken in China moments after her adoption, all irretrievably wiped. Yes... I should have backed up my data more carefully.

I think he may be able to undelete some of the files unless the virus was particularly sophisticated. But nevertheless it is a reminder:
- back up all your important data files to CD or DVD
- get an external hard drive and backup to there too
- run anti-virus software with the latest updates
- be careful with your email and with ANY files that you run

Not that I'm a Cassandra or anything, but you can read my previous postings about MyDoom and its variants:
It all started on January 26, 2004
In case you're wondering, the final count of MyDoom virus emails I got is about 33.
This makes it by far the biggest and fastest single outbreak I recall.
January 27, 2004
January 28, 2004
January 29, 2004 (MyDoom.B)
February 2, 2004
February 3, 2004
February 10, 2004 (summary, plus delicious DoomJuice)
And our star prize... February 24, 2004 (MyDoom.F)
February 26, 2004 posted by Richard at 17:40 / permalink (post) | permalink (numeric)

computers - Dimension 8200 reborn

Got a motherboard from eBay.
Despite what they may say online, the 7G535 motherboard is the original 850 chipset one that supports the 400MHz Front-Side Bus (FSB).

New motherboard with old gear still didn't work.

Got a Celeron 2.7GHz from PCcyber.ca and it works fine, my computer is alive again.

Lessons learned: If the CPU is dead, the Dell motherboard won't light up ANY of the ABCD LEDs. It would be nice if it would light up one to say "motherboard OK, CPU dead".

I still don't know if it was just my old CPU, or the old CPU *and* the old motherboard that were dead. I don't want to try any tests with the old motherboard just in case it shorted out in some interesting way that will kill any CPU I put in it.

You may want to get at least a three-year warranty with any new computers.
I had a one year and it expired just a few months before my computer did
(I think it was a power surge that did in my Pentium, and yes, I have in fact a very fancy APC UPS that's supposed to protect me from surges.)

In order to get help, I posted a message Dimension 8200 motherboard? in the Dell Support Forums online. I got quite a few useful response.

The oddly-named SpongeBob Upgrade site is very helpful if you're looking for Dimension 8200 upgrade information. It told me enough so that I knew it was probably safe to get a Celeron to replace my dead P4. posted by Richard at 16:30 / permalink (post) | permalink (numeric)

Our latest viral visitor is W32.Beagle.C@mm.
Symantec is only rating it a 2 (they have a scale from 1-minor to 5-major).
Symantec reports opens a backdoor on TCP port 2745. posted by Richard at 09:14 / permalink (post) | permalink (numeric)

Slashdot reports
U.S. is World Leader in Spam.
You can also see the list of top spamming countries at Spamhaus (bottom left corner of the page).

This is because
- Americans are rich
- Americans have lots of computers
- Americans can't be bothered to secure their computers
- Americans are greedy
- Americans are foolish

Most spam has the goal of transferring money from foolish Americans to greedy Americans.
As I have said before, this idea of vast international spam conspiracies is ridiculous.
The spammers are in the US, wanting US dollars so they can buy big US houses at which to park their big US cars.

These characteristics of course also apply to other countries, but not to such extremes.

There is also lots of spam sent by compromised Canadian computers on broadband.

If only someone had mentioned this issue before
2003-11-26 19:47:57 US is biggest source and sink for spam (articles,spam) (rejected) posted by Richard at 09:08 / permalink (post) | permalink (numeric)

CBC Radio 1 The House will be covering the AG's report, including not only the sponsorship scandal (of course) but also the chapter 1 concerns about the GoL system that I mentioned before.

The radio news reports "Secure Channel hasn't been working well".

UPDATE: The report is 36:27 into the show (you can listen to it online in RealAudio). posted by Richard at 09:01 / permalink (post) | permalink (numeric)

Winning spams are a toss-up between
"escapee robbins puppet gregory aztec emitter"
"homeland mezzanine small smother prosaic sparky"
and
"small pen is?" posted by Richard at 08:58 / permalink (post) | permalink (numeric)

Black Box Notes has a good posting on felony disenfranchisement.

Meanwhile in Canada, AFAIK inmates have right to vote.

I think after you have served your time your slate is clean. That's the whole point. At that point you should have all the normal citizen's rights. However, I don't think inmates should have the right to vote. posted by Richard at 08:49 / permalink (post) | permalink (numeric)

Ed Broadbent for Ottawa Centre
Yes, he has a blog.

Via Media Dystopia. posted by Richard at 08:43 / permalink (post) | permalink (numeric)

CBC Radio news reports stories but then they aren't on the cbc.ca/news site

This annoys me. posted by Richard at 08:41 / permalink (post) | permalink (numeric)

The McWetlog reports In 1912, an amendment to the U.S. Constitution was introduced that would ban interracial marriage. posted by Richard at 20:33 / permalink (post) | permalink (numeric)

Netcraft security news has some good reports on priority problems, seems to have a particular focus on phishing (about which more later). posted by Richard at 13:38 / permalink (post) | permalink (numeric)

Phone number and info that was here moved to my telemarketers page. posted by Richard at 13:28 / permalink (post) | permalink (numeric)

IT World Canada (site requires registration)
Ballmer addresses [security] issues with Canadian developers

Identifying security as the number one threat against Microsoft Corp., as well as the IT industry as a whole, Steve Ballmer, CEO of the Redmond, Wash.-based software giant, told a room of Canadian software developers that security continues to be a central issue at Microsoft — especially as the company moves toward the release of Longhorn.

...

"It's a world of threat," he said.

The Microsoft approach to security right now is focused around technical and social issues, with attention being given to quality, resiliency, education and awareness. For example, Ballmer said there is a range of things that need to be addressed, such as the resiliency of having application-aware firewalls. These smarter firewalls that live on the edge of not only a network but also every computer will push intelligence forward, as will intrusion prevention technology, he said.

...

Meanwhile, in a presentation at the RSA Conference in San Francisco on Tuesday, Microsoft announced that it is working on security technologies for the upcoming Longhorn release of Windows that will protect users against security threats by monitoring system and network behaviour as well as the security patches that Microsoft has issued.

The new technologies will allow Windows to detect irregular system behaviour — in terms of network traffic, memory usage and system calls, for example — and respond to them automatically, Bill Gates, Microsoft chairman and chief software architect said during the presentation. The result of the development effort, which Microsoft refers to as "active protection technologies," should protect systems from worms and viruses by preventing and containing attacks, according to Microsoft.

A component of the protection system, dubbed "dynamic system protection," will track which security patches users have installed. The component will make changes to the Windows firewall to fend off any attacks that appear to take advantage of a security flaw that users have not yet patched themselves against. For example, if Microsoft has provided a patch for a flaw involving ActiveX controls, dynamic system protection will block ActiveX controls from running on a Windows system until that patch is installed, Microsoft said.

Other parts of the active protection effort include reducing the likelihood of a successful attack by automatically adapting the security settings to the type of network connection, for example when a notebook computer is moved from a corporate network to a public wireless LAN, said Microsoft product manager Jon Murchinson.

posted by Richard at 11:34 / permalink (post) | permalink (numeric)

Local PC component stores recommended to me:

PC Cyber
OEM Express

I just got a 2.7 GHz Celeron from PC Cyber. posted by Richard at 10:03 / permalink (post) | permalink (numeric)

Microsoft is offering online scan and repair for MyDoom from their What You Should Know About the Mydoom and Doomjuice Worm Variants page.

Just click the button under "Automatically Check Your PC for Infection".

They are getting quite serious about security. posted by Richard at 22:55 / permalink (post) | permalink (numeric)

Slashdot reports: Verisign Sues ICANN Over SiteFinder.

In my dream world, Verisign, the RIAA, the CRIA and SCO all sue one another and leave the rest of us alone. posted by Richard at 21:32 / permalink (post) | permalink (numeric)

HP Labs

In the news today because of some novel security technology presented at RSA 2004.
A Bio Approach to Network Security. posted by Richard at 12:44 / permalink (post) | permalink (numeric)

Info on Microsoft's lamely-named "Caller ID for email" and how it relates to SPF.

Microsoft Releases 'Caller-ID For Email' Specs posted by Richard at 12:35 / permalink (post) | permalink (numeric)

The money situation.
There hasn't been an MS Money Deluxe Canadian version since 2000.
(I run Money 2000 Deluxe Canadian as my main financial program.)

Quicken is not particularly an option as they are evil.
They have set up this scheme of making you pay for online access.

I think the latest versions of Money are now doing the "expiring online access" deal too.

Now, I wouldn't actually mind access fees and upgrade fees,
if they actually upgraded the product.
But what they seem to do every year is add/change the GUI, and slap on some new stuff, introducing new bugs. They seem to have the most enthusiasm for making the interface very busy and filled with ads and irrelevant Internet links.

To me, particularly for a financial app
- the core should change very slowly
- the database should be, or at least every year progress to becoming, 100% stable, indestructable and robust

My main Money 2000 complaint is that the database has some stability problems.

Now, there's also the venerable GnuCash
and lately MoneyDance is getting some attention.

Are there any viable alternatives to Money/Quicken for moderately complex Canadian home finances? (multiple bank accounts, multiple currencies, multiple RRSPs, mortgage, investments etc. I like the ability to automatically download stock and mutual fund quotes online.)

There's one called Kapital but it looks like it is KDE/Linux specific.

In case you're not aware, there are some nuances between US and Canadian finance. For example, Canadian mortgages are calculated differently from US. posted by Richard at 12:12 / permalink (post) | permalink (numeric)

Lorelai's mother is totally going to be involved with the new Inn.
Will give her something more worthwhile to do than shopping I suppose.

L and R are total homewreckers.
Luke? Dean?
So much for your marriages.
No one can resist the vow-breaking power of the Gilmores.

Rory needs new boyfriends.
Yale boys? Hello. Get with the program.

I liked the ep.
But once again: Lorelai has no money but she has an HP laptop?
And wasn't Rory's iBook orange? Because it seems to be blue now.
Doesn't Lorelai have any equity in her house?
I thought double triple mortgages was a time-honored way for Americans to raise cash.

Angel seems rather lame.
Yet Another Evil God Taking Human Bodyform.
Hmm, hasn't that been done to death?
I think Angel is on Space tomorrow again.
Err accoding to http://www.spacecast.com/shows/firstRun/Angel.asp it's on Mondays at 10 PM. So I guess I can catch up on March 1.

I think I need some new shows.
Or a life. posted by Richard at 01:41 / permalink (post) | permalink (numeric)

Curse you NewRO!
Gilmore Girls and Angel are in parallel again (both at 9 PM). posted by Richard at 16:51 / permalink (post) | permalink (numeric)

I liked Information security is about people. From GlobeTechnology.

This one is also interesting: Is security getting any easier?
It presents the remarkable assertion:

Invariably, individuals will inadvertently open dangerous files or fall for cleverly deceptive spoofs. Even technically sophisticated users will make mistakes, according to Paul Kocher, president of Cryptography Research.

"We simply aren't smart enough as a species to handle this," Mr. Kocher said.

Which given the recent rounds of email worms... maybe he's on to something.
The conference they're reporting about is the 2004 RSA Conference. posted by Richard at 12:02 / permalink (post) | permalink (numeric)

A fairly general Mac OS X Security Primer. Via Macintouch. posted by Richard at 11:55 / permalink (post) | permalink (numeric)

Want to go googlin somewhere else?

http://search.yahoo.com/ (Note: Yahoo.ca appears to still be using Google.)
Teoma
All the Web

Want to see Google and Yahoo results side-by-side?
http://www.googleguy.de/google-yahoo/

This is spurred by a Slashdot thread, which also says
someone said that Google ranks W3-compliant pages higher than non-W3 compliant pages

I don't know if it's true, but it's one of those good memes.
That is, even if it isn't true, maybe it will lead to more compliant web pages.
I need to make my pages XHTML compliant me thinks. posted by Richard at 11:40 / permalink (post) | permalink (numeric)

I don't know how much value there is in checking out beta software, but it may be helpful for planning purposes.

Kicking the Tires of XP Service Pack 2, Part 1
Kicking the Tires of XP Service Pack 2, Part 2 posted by Richard at 07:46 / permalink (post) | permalink (numeric)

You know the world has taken a sad turn when, if there's no spam email when you check your account in the morning, you wonder if the email system is down. posted by Richard at 07:29 / permalink (post) | permalink (numeric)

Careers at Export Development Canada posted by Richard at 07:24 / permalink (post) | permalink (numeric)

Slashdot reports that XP SP2 will include a virus scanner. This is in addition to previously reported functionality of advanced (ZoneAlarm-like) firewall and popup blocking.

If MS does this right, it could be very good. posted by Richard at 20:25 / permalink (post) | permalink (numeric)

It seems to me that Google is doing some weird stuff with blogspot blogs.
Or it's jiggering rankings or something.

I found this amusing (it's a direct capture from my screen)



I will also put it up on Paper Vote Canada which has gone from the third page of Google results to... not in the index at all. posted by Richard at 19:49 / permalink (post) | permalink (numeric)

The latest malware variant to show up is MyDoom.F. It opens a backdoor listening on TCP port 1080.

You're already blocking 1080 on your firewall, right?
See my list of ports in the news. posted by Richard at 07:23 / permalink (post) | permalink (numeric)

Just a reminder: Blogger supports SFTP (secure FTP). You should use it if it's available to you on your server.

You're already using SSH for all your command-line connections to servers, right? posted by Richard at 07:19 / permalink (post) | permalink (numeric)

Went to see Ladysmith Black Mambazo, presented by the Ottawa Jazz Festival.

It was very good. Wonderful sound.
There was a lot more dancing than I expected. It would have been nice if the stage had been a bit higher to see the dancing. But they certainly got their legs up high enough to see.
The concert was sold out; the church was packed. posted by Richard at 07:16 / permalink (post) | permalink (numeric)

Canadian Intellectual Property Office (CIPO)
Patent Examiner Recruitment

2003/04 Hiring Targets

Masters Degree/ PhD in Biochemistry or Molecular Biology
(Not hiring in this fiscal year)

Honours degree in Chemistry
(January 2004) 10

Degree in Chemical Engineering
(January 2004) 10

Degree in Mechanical Engineering
(September 2003) 15
(March 2004) 15

Degree in Electrical Engineering/Computer Engineering
(June 2003) 16

Honours Degree in Physics
(Not hiring in this fiscal year)

And remember: Einstein started out in the Patent Office. posted by Richard at 15:51 / permalink (post) | permalink (numeric)

This site will be unavailable this evening (Monday February 23 2004) as there will be maintenance to the hardware it lives on. posted by Richard at 13:26 / permalink (post) | permalink (numeric)

Doonesbury will give $10,000 to the USO if someone will step forward and prove they

personally witnessed George W. Bush reporting for drills at Dannelly Air National Guard Base between the months of May and November of 1972

Via SE. posted by Richard at 13:11 / permalink (post) | permalink (numeric)

Today on Hot Type, CBC Newsworld, 15:30 Eastern

Author: Noam Chomsky
Book Title: "Hegemony or Survival: America's Quest for Global Dominance"

You can also read the full transcript. posted by Richard at 12:49 / permalink (post) | permalink (numeric)

Boogieplay is cool, but it does not play nice with browsers, Mac ones anyway. It's a shame because the info is good and the search works well.

Safari
- blog summaries do not display below the headlines
- crashes when you close the weird inside-wiindow thing that comes up when you select a headline

IE
- blog summaries show up on top of inside-window thing, making it impossible to read

Mozilla/Camino/Firefox/iCab
- inside-window thing doesn't come up at all

Opera
- summaries display only partially
- inside-window thing doesn't come up at all

The closest to usable is to use IE, and then select "Open Frame in New Window" when the inside-window (a frame apparently) comes up in the middle of the page. posted by Richard at 07:32 / permalink (post) | permalink (numeric)