Safari wins for the first time today.

I took a look at my Google.com/analytics stats for joelesler.net today. Looks like Safari won for the first time today. So that either means that I am either getting more popular with OSX crowd, or it means that Apple is getting more prominent.

I am guessing the first.

Pastor: Cop told fourth wife he killed third wife

So, the pastor of the 4th wife of Drew Peterson told the news that Drew had confessed to her (then then her to the pastor) that Mr. Peterson had killed his 3rd wife.

Well, it really _is_ he said, she said in this example.  But, I think the moral of this story for women is:  Be cautious when marrying anyone with the last name of Peterson.  Seems you wind up "not-healthy"..

Need I remind you, said 4th Wife is now missing?

Pastor: Cop told fourth wife he killed third wife

So, the pastor of the 4th wife of Drew Peterson told the news that Drew had confessed to her (then then her to the pastor) that Mr. Peterson had killed his 3rd wife.

Well, it really _is_ he said, she said in this example.  But, I think the moral of this story for women is:  Be cautious when marrying anyone with the last name of Peterson.  Seems you wind up "not-healthy"..

Need I remind you, said 4th Wife is now missing?

Steve Jobs wore a tie.

Those of us that remember back in the pre-Steve-return-to-apple days have seen him in a Suit and Tie. But in recent years, I haven't seen him wear anything but a black mock turtleneck, jeans, and sneakers.  Original Article here.

So it's quite interesting to see him in a suit and tie.




If it were anyone else, it wouldn't be news.  This was to see Al Gore receive his Nobel Peace Prize.

Steve, you're the man.  Wear what you want big guy.

UPDATE:  Found this picture of him in full dress.

Subscribe here:

Steve Jobs wore a tie.

Those of us that remember back in the pre-Steve-return-to-apple days have seen him in a Suit and Tie. But in recent years, I haven't seen him wear anything but a black mock turtleneck, jeans, and sneakers.  Original Article here.

So it's quite interesting to see him in a suit and tie.




If it were anyone else, it wouldn't be news.  This was to see Al Gore receive his Nobel Peace Prize.

Steve, you're the man.  Wear what you want big guy.

UPDATE:  Found this picture of him in full dress.

Subscribe here:

PaulDotCom Security Weekly

Episode 91 is live!  Go have a listen.  I sound a bit clogged up (nasal), and nervous at the beginning, but after I get into it, it went well!

CompUSA is done.

Compusa is done.  

This brings up several points.   I remember the fond days of CompUSA where you used to be able to go into the store and get random computer parts.  The problem is, there are SO many places to do this now, CompUSA never did anything to differentiate itself from the competition.  The only thing that CompUSA ever had that was different was the Mini-Apple Stores inside them.  Well, then Apple started their own stores, effectively killing the function of the Mini-Stores, so I am sure that didn't help.

Second, CompUSA's in general do not have the expertise that other stores do.  Now, in CompUSA's defense, they always tended to have more of a variety of products then the other guys, take keyboards for example.  CompUSA always had like 30 keyboards to pick from, while the other guys would not even have a third of that.  Especially not in a display where you could physically touch them and see how they felt underneath your fingers.

Apple must have saw this coming and that's why Apple started reselling their stuff through Best Buy as well.  I mean, everyone sells iPods, but not everyone sells the desktops and notebooks.  Best Buy does.  CompUSA does (or did).

The only thing that CompUSA really did that was over the competition is that they sold individual parts.  All kinds of Graphic Cards, power supplies, computer shells, and the like.  Best Buy doesn't break it down to this degree, however, most people that buy these individual parts can get them for a better deal online.

That's where CompUSA is getting their butt kicked.  People can order stuff online and have it shipped next day for free from some sites.

So, hasta la vista CompUSA.  You will be missed.  However, now that I am a mac guy, and I have an Apple Store that is closer to my house then your nearest store, I really don't care.

However, where am I going to take my certification tests?

Classic Vista Error

Saw this on Gizmodo.

Classic.

MSFT convinces you to buy crap

MSFT apparently isn't getting the sales of Vista that it wishes it had. So it's written an article on how to convince your managers that you need to upgrade.

By and large I have to deal with tons of Windows users on a daily basis. I've met two, seriously, two that are on Vista. The rest are on XP.

Hate to say it MSFT, but XPSP2 is the new 98SE. It is stable. Leave it alone. Why dump more shit on top of a already big pile of shit? Oh, to try and compete, that's right. Anyway. (*rolls eyes*)

So let's hit the bold points on the list (click on blog post heading for link).

"Security is the message"

"...management may not be aware that the most compelling reason to migrate to a newer operating system, such as Windows Vista, is to take advantage of the latest security features..."

MSFT, absolutely nothing about Vista that I have seen so far makes it less of a target. I have seen a bunch of upgrades for Vista, even updates that came out for Vista before it was even released!

"The challenges"
"Johnson said upgrades can be challenging for IT as well. It requires the team to be a lot more involved in the installation and testing of the individual machines, because users are typically not going to be the administrators. Users may also be resistant to this idea at first, because they can no longer download all those fun, quirky applications that may, inadvertently, make their machines vulnerable."

So, make like every other operating system, only execute things in the user space, get rid of the registry, and stop requiring "Administrator" access for every little thing!

"The hidden cost of vulnerability"

"What management may not realize, however, is that they are already paying a hefty hidden cost by having outdated systems in place, “because you are paying for an administrator’s time to deal with these issues,” Johnson said. The trick is to show management this in a way that translates into dollars saved."

Is that the trick? Nice word. "The trick." So we are now using the sys admin's of the networks to try and sell management on a piece of crap? Oh wait, did I say sell? I meant trick.

"Make a list"

"...itemize the work that they do in several categories: improved productivity, security breaches, recovering from problems..."

How do fancy graphics, Aqua Aero, and widgets gadgets make productivity higher? There are these fancy things in OSX, but they are just a nicety on top of an OS that makes things easier to operate, and you can get your work done. Vista has centered its whole idea around this graphical interface. Stop copying MSFT!

"Save me the money"

"So how do you convince management to buy new machines, or upgrade the RAM and get the latest OS, if what they are doing right now seems to work OK?"

Yes, MSFT, how do you do that?

"Proactive versus reactive"

"The best thing about the upgrades, once they are done, is that administrators will have more time to devote to preventing problems before they happen, Johnson said."

The only proactive thing I see about Vista is "Hey Boss, we need to upgrade to Vista, not for any other reason than, eventually... MSFT will stop supporting XP!!"

Not because it works better.

CompUSA is done.

Compusa is done.  

This brings up several points.   I remember the fond days of CompUSA where you used to be able to go into the store and get random computer parts.  The problem is, there are SO many places to do this now, CompUSA never did anything to differentiate itself from the competition.  The only thing that CompUSA ever had that was different was the Mini-Apple Stores inside them.  Well, then Apple started their own stores, effectively killing the function of the Mini-Stores, so I am sure that didn't help.

Second, CompUSA's in general do not have the expertise that other stores do.  Now, in CompUSA's defense, they always tended to have more of a variety of products then the other guys, take keyboards for example.  CompUSA always had like 30 keyboards to pick from, while the other guys would not even have a third of that.  Especially not in a display where you could physically touch them and see how they felt underneath your fingers.

Apple must have saw this coming and that's why Apple started reselling their stuff through Best Buy as well.  I mean, everyone sells iPods, but not everyone sells the desktops and notebooks.  Best Buy does.  CompUSA does (or did).

The only thing that CompUSA really did that was over the competition is that they sold individual parts.  All kinds of Graphic Cards, power supplies, computer shells, and the like.  Best Buy doesn't break it down to this degree, however, most people that buy these individual parts can get them for a better deal online.

That's where CompUSA is getting their butt kicked.  People can order stuff online and have it shipped next day for free from some sites.

So, hasta la vista CompUSA.  You will be missed.  However, now that I am a mac guy, and I have an Apple Store that is closer to my house then your nearest store, I really don't care.

However, where am I going to take my certification tests?

Classic Vista Error

Saw this on Gizmodo.

Classic.

Certification Litmus Test

Click on image to make it bigger. Go ahead. Then hit the back button.

Back now? Okay. There's the thread for the discussion on the DShield list about the SANS change for certifications. Notice the ads on the right of the screen? THAT'S MY PROBLEM.  See how commercialized the CISSP is now?  Ads for bootcamps.  Even though the thread thoroughly discusses GIAC certs, you see no ads for GIAC testing centers or bootcamps in there.

What is to say that it won't become that?

My whole point in this discussion is to not let the GIAC certifications (no matter how much you don't or do respect certifications, I don't really care for them one way or the other, I have a couple) go to the dirt.  So many "CERTS" have went downhill it's horrible.

I understand why this is taking place.  I just don't agree with it.  I understand that standards and that kind of thing are good.   The exams and the practical are hard. (I don't really care for the Silver GIAC cert.  I am a Gold kinda guy, I really like the practical.  That's why I like grading them.  If it were up to me, I'd reinstate the practical for everyone.)

Daughter is fine

I have had a couple people ask me about the condition of my daughter, who had some minor surgery this week.

She is totally fine.  Little blood and pus still coming out of the ears, but it is MUCH less, and we are applying drops.

Thank you all for your concern!  I appreciate it.

Snort question from the Mailbag

I got this email today in the mailbag:

"i have configure and running snort for NIDS (network intrusion detecting system), when i make DDOS attack simulations the snort can be detect the attack and rise alert. in another side there is gateway who contain general firewall. my purpose is when snort rise alert this is can make gateway computer applied the firewall, would you like to give me solutions for that.
thanks you very much."

What I think this person is asking is, "How can I get Snort to automatically update my firewall based on it's alerts."

Well, there are several answers to the question, the most reliable answer being: "Buy a Sourcefire 3D system"  Not only do you get the ability to do that, but you get SO much more.

The second answer to the question is, "Use SnortSAM".  SnortSAM is a project started (I believe) by Frank Knobbe.  

I've never used SnortSAM, so I can't say good or bad about it, but YMMV.

PaulDotCom Security Weekly

Referring back to my Podcast 101 story.

I was on PaulDotCom Security Weekly, the podcast last night as a Guest Host.   We had a good time talking about all the weekly security stories.

It was a good time, I communicated the whole time from my office in my house via Skype.  Can't complain about that.  It took about an hour and a half to do the whole thing, from setup to end of podcast.  All in all, a great time.  

Thanks go to Larry and Paul for having me on.

Certification Litmus Test

Click on image to make it bigger. Go ahead. Then hit the back button.

Back now? Okay. There's the thread for the discussion on the DShield list about the SANS change for certifications. Notice the ads on the right of the screen? THAT'S MY PROBLEM.  See how commercialized the CISSP is now?  Ads for bootcamps.  Even though the thread thoroughly discusses GIAC certs, you see no ads for GIAC testing centers or bootcamps in there.

What is to say that it won't become that?

My whole point in this discussion is to not let the GIAC certifications (no matter how much you don't or do respect certifications, I don't really care for them one way or the other, I have a couple) go to the dirt.  So many "CERTS" have went downhill it's horrible.

I understand why this is taking place.  I just don't agree with it.  I understand that standards and that kind of thing are good.   The exams and the practical are hard. (I don't really care for the Silver GIAC cert.  I am a Gold kinda guy, I really like the practical.  That's why I like grading them.  If it were up to me, I'd reinstate the practical for everyone.)

Daughter is fine

I have had a couple people ask me about the condition of my daughter, who had some minor surgery this week.

She is totally fine.  Little blood and pus still coming out of the ears, but it is MUCH less, and we are applying drops.

Thank you all for your concern!  I appreciate it.

PaulDotCom Security Weekly

Referring back to my Podcast 101 story.

I was on PaulDotCom Security Weekly, the podcast last night as a Guest Host.   We had a good time talking about all the weekly security stories.

It was a good time, I communicated the whole time from my office in my house via Skype.  Can't complain about that.  It took about an hour and a half to do the whole thing, from setup to end of podcast.  All in all, a great time.  

Thanks go to Larry and Paul for having me on.

SANS proctorization part two

I just talked to someone from SANS.  Appparently the reason for the change is because GIAC has be ANSI certified.

Why you ask?

DOD Directive 8570.

DoD Directive 8570.1 was approved in December 2005 and requires DoD IA workers to obtain a commercial certification accredited under ISO/IEC standard 17024. ISACA's Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) certifications, accredited by the American National Standards Institute (ANSI), are among only 13 certifications approved by the DoD.

Apparently SANS has to meet this mark by the end of 2007.

I still don't agree with it.  It sounds like SANS is really making it difficult for the non-.gov/.mil folks.  

In the interest of full disclosure though, I did get my cert while I was .mil.  However, now I am not.  It still sucks.

RSS Feed, now at full throttle

I moved the RSS feed back to full.  Now that I have a descent count.  

I appreciate all the people that clicked through, either on the short rss article, or on others, it gives me a better count.  I think the bandwidth that I have is sufficient since I removed the bigger video files and what not from the site.  We should be good now.

All SANS exams to be proctored?

What kind of crap is this?

"Effective December 1st, 2007, all new GIAC certification attempts and
re-certification attempts are required to be proctored. The price of a
GIAC certification attempt in conjunction with SANS training is $499,
the challenge price remains $899. The price of a recertification
attempt is $325."

This is why people like the SANS certification.  Not only is it hard, (the test and the courses speak for themselves), but you get to take them in the comfort of your own home, on your own computer, in your own web browser.  This is one of the huge selling points of the GIAC certifications, and one that I have personally pushed.  No one wants to go take time out of their week to go to a testing center!  People want to be at home, late at night with the lights turned off, (insert whatever analogy you want here), and take the exams where they have no distractions.  I really don't agree with this.

"If you started your GIAC Silver Certification attempt and received
access to your exams before December 1st, 2007 your certification
requirements will remain unchanged."

Good.  I took mine several years ago.  Does this mean that re-certs will have to go to a testing center?  Will we have access to Google and other materials in order to take our tests?

"GIAC has selected Kryterion as our partner to deliver proctored exams
through their network of host locations. Kryterion has nearly complete
coverage in the USA and many testing centers throughout the world. In
addition, Kryterion has been very responsive to adding GIAC proctored
testing centers in locations where we need them. The list of Kryterion
test center locations posted on the GIAC website,
http://www.giac.org/proctor/kryterion.php. If you will be taking a GIAC
proctored exam in the future and do not see a site near you, please fill
out the form provided with your location specifics, so that we can work
to get a site added near you:
http://www.giac.org/proctor/kryterion.php#form"

Okay, so looking at this site, the nearest one to me is in Wilmington, at a CompUSA.  What is that?  50 miles from my house?  One direction?  So not only do we have to pay for the course, and the exam, but now, i have to get off my ass, and pay for the gas on my car to drive 100 miles to take a damn exam, which I used to take in my house!  Also, Kryterion has alot of CompUSA locations.  Okay, that's interesting, however, if BGR's rumor is true, that might be shortlived.  Then I have to drive God knows how far?

"All GIAC certification attempts purchased after December 1st, 2007 will
be comprised of one single exam that covers all the certification
objectives. This new exam format is four or five hours in length,
depending on the specific certification."

Okay, so not only get to sit in CompUSA for 4 to 5 hours, but then I have to take the exams all at once!  Not allowing for a nice break in between the TCP test and the class test like it used to be?  Bullshit.

"All GIAC certification attempts purchased after December 1st, 2007 are
open book format, but not open internet or open computer."

That sucks.  Really Really sucks.

"Candidates will be allowed to bring one back pack or briefcase of course books,
reference material, printed notes, printed spreadsheets, etc., but no
electronic devices such as extra computers, CD-ROM or USB flash drives."

Again, stupid, and it sucks.  But they didn't state the size of backpack or briefcase.  So if I can get my duffle back on my back?  Is that okay?

Dear SANS,

This is the stupidest thing you have ever done.  Far stupider then your practical drop that you did. (Which you fixed with the Silver/Gold program.)  I do not agree with it, and I think you will lose a very large majority of your certification base with this.  Why are you doing it?

"GIAC will soon be ANSI/ISO certified as a certification..."

What does that mean for me?  An extra cookie?  Does that get me hired, uh, less?  Does that give me more money in my bottom line if you get ISO certified?  No.  

Some of you are sitting there and saying "holy crap Joel, all you have to do is drive to a testing facility".  Yes.  That is the point.  You just lost the most motivating factor of your certification.  Me.  Being at home.  The world is moving to telecommuting and the ability to do anything from anywhere.  Hell, before now, I could have taken the SANS test on my iPhone!

Seems like SANS is going backwards.

RSS Feed, now at full throttle

I moved the RSS feed back to full.  Now that I have a descent count.  

I appreciate all the people that clicked through, either on the short rss article, or on others, it gives me a better count.  I think the bandwidth that I have is sufficient since I removed the bigger video files and what not from the site.  We should be good now.

Still a Quicktime ZeroDay out there!

WabiSabiLabi is reporting that the Quicktime vulnerability that I wrote about last week is NOT the one in their "for sale" repository.  

Now, the way I look at this is that WabiSabiLabi is not doing the responsible thing and disclosing it to the vendor.  They are selling it.  Basically trying to blackmail or hold the vulnerability for ransom.  

I'm not of the opinion that everything needs to be disclosed to the public, but it should at least be disclosed to the vendor.  If there is an exploit, and it's not being reported to the vendor, then it's irresponsible in my opinion.  

WabiSabiLabi says this is their philosophy: "Wabi-sabi nurtures all that is authentic by acknowledging three simple realities: nothing lasts, nothing is finished, and nothing is perfect."  

I can understand people trying to get paid for their research, but there is a certain line.  They should apply for a job at the vendor or something.  I don't know what the proper procedure is, but holding the vulnerability for ransom isn't fair.

If you are going to have a vulnerability, try to get the vendor to pay you for it.  Or keep it to your damn self.

If you are interesting in paying into WabiSabi's coffers: 442.62 will get you a Quicktime exploit for Windows XP.

A small price to pay for Apple to ensure the security of it's customers.

Two new Mac Exploits

I just saw that two new Mac Exploits have hit the streets.  Both are Denial of Service exploits.

The first one is an exploit against vpnd, version Leopard 10.5.0.  

The second is against xnu, 10.4, 10.5.1 (i386), and 10.5.1 (ppc).

Both are from digit-labs.org.

And we all know that a DoS is one step away from a remote exploit.

Podcast 101?

I've been invited to participate in a Podcast this week.  This will be my first "official" podcast.  I've been in other podcasts before, but just because I was present.  But this will be the first time I've been a panel member.  

Should be cool.

I don't actually know if I will be on the podcast yet, as my daughter is having some extremely minor surgery tomorrow.  If I am going to be on the podcast, I will let you know via a post here, with a link to the site.

Microsoft reopens WPAD Vulnerability from 1999.

Apparently MSFT hasn't had enough vulns lately.  They decided to reintroduce one (or never fix it in the first place).

From 1999.

Reported last week at a "ethical hacker conference" in New Zealand by Beau Butler, the WPAD vulnerability allows you to perform a man-in-the-middle attack for hostnames that do not have a FQDN.    Essentially, what happened is Microsoft fixed it back in 1999, and it's taken this long to figure out that they only fixed it for ".com".  Other extensions weren't fixed at all ".au", ".nz" for example.

Some blogs have picked this up and said "Zero Day!!!"  But it's not.  It's the same one from 1999.

Here is a link to the Microsoft Security Advisory posted yesterday.

It lists several mitigating factors.
• Customers who do not have a primary DNS suffix configured on their system are not affected by this vulnerability. In most cases, home users that are not members of a domain have no primary DNS suffix configured. Connection-specific DNS suffixes may be provided by some Internet Service Providers (ISPs), and these configurations are not affected by this vulnerability.
• Customers whose DNS domain name is registered as a second-level domain (SLD) below a top-level domain (TLD) are not affected by this vulnerability. Customers whose DNS suffixes reflect this registration would not be affected by this vulnerability. An example of a customer who is not affected is contoso.com or fabrikam.gov, where “contoso” and “fabrikam” are customer registered SLDs under their respective “.com” and “.gov” TLDs.
• Customers who have specified a proxy server via DHCP server settings or DNS are not affected by this vulnerability.
• Customers who have a trusted WPAD server in their organization are not affected by this vulnerability. (See the Workaround section for specific steps in creating a WPAD.DAT file on a WPAD server.)
• Customers who have manually specified a proxy server in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.
• Customers who have disabled 'Automatically Detect Settings' in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.

In my opinion, this is weak.  That's apparently Secunia's opinion as well.  As they rated it "less critical".

My question is, did MSFT re-introduce this vulnerability?  Or did they just half ass fix it in `99?

The following OS'es are affected:
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Vista
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

Two new Mac Exploits

I just saw that two new Mac Exploits have hit the streets.  Both are Denial of Service exploits.

The first one is an exploit against vpnd, version Leopard 10.5.0.  

The second is against xnu, 10.4, 10.5.1 (i386), and 10.5.1 (ppc).

Both are from digit-labs.org.

And we all know that a DoS is one step away from a remote exploit.

Podcast 101?

I've been invited to participate in a Podcast this week.  This will be my first "official" podcast.  I've been in other podcasts before, but just because I was present.  But this will be the first time I've been a panel member.  

Should be cool.

I don't actually know if I will be on the podcast yet, as my daughter is having some extremely minor surgery tomorrow.  If I am going to be on the podcast, I will let you know via a post here, with a link to the site.

Microsoft reopens WPAD Vulnerability from 1999.

Apparently MSFT hasn't had enough vulns lately.  They decided to reintroduce one (or never fix it in the first place).

From 1999.

Reported last week at a "ethical hacker conference" in New Zealand by Beau Butler, the WPAD vulnerability allows you to perform a man-in-the-middle attack for hostnames that do not have a FQDN.    Essentially, what happened is Microsoft fixed it back in 1999, and it's taken this long to figure out that they only fixed it for ".com".  Other extensions weren't fixed at all ".au", ".nz" for example.

Some blogs have picked this up and said "Zero Day!!!"  But it's not.  It's the same one from 1999.

Here is a link to the Microsoft Security Advisory posted yesterday.

It lists several mitigating factors.
• Customers who do not have a primary DNS suffix configured on their system are not affected by this vulnerability. In most cases, home users that are not members of a domain have no primary DNS suffix configured. Connection-specific DNS suffixes may be provided by some Internet Service Providers (ISPs), and these configurations are not affected by this vulnerability.
• Customers whose DNS domain name is registered as a second-level domain (SLD) below a top-level domain (TLD) are not affected by this vulnerability. Customers whose DNS suffixes reflect this registration would not be affected by this vulnerability. An example of a customer who is not affected is contoso.com or fabrikam.gov, where “contoso” and “fabrikam” are customer registered SLDs under their respective “.com” and “.gov” TLDs.
• Customers who have specified a proxy server via DHCP server settings or DNS are not affected by this vulnerability.
• Customers who have a trusted WPAD server in their organization are not affected by this vulnerability. (See the Workaround section for specific steps in creating a WPAD.DAT file on a WPAD server.)
• Customers who have manually specified a proxy server in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.
• Customers who have disabled 'Automatically Detect Settings' in Internet Explorer are not at risk from this vulnerability when using Internet Explorer.

In my opinion, this is weak.  That's apparently Secunia's opinion as well.  As they rated it "less critical".

My question is, did MSFT re-introduce this vulnerability?  Or did they just half ass fix it in `99?

The following OS'es are affected:
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows Vista
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

Short rss feeds

I've shortened my RSS feeds, please click on the link to get the full article, you'll see why below... with that said...

Ever since I moved the blog back from web.mac.com to my own servers, as I have said before, I am receiving alot more traffic than before.  At present I am getting about 4000-4500 hits a day, which isn't much in the grand scheme of things, but when you go from getting 1000 hits a day, to 4x that a day, it really makes a difference in servers, server load, and ability to serve content to readers to keep it interesting.

So, I'm trying to get an accurate metric of how many people read the blog.  Problem is, I have tons of people that read me through rss and atom feeds (btw -- the atom feed is being kept alive manually, I'll stop doing this shortly.  Please subscribe to the rss feed. http://www.joelesler.net/rss.xml).  

Most blog aggregation services will tell you in the "GET" request how many people they are aggregating for.  Google does this, Newslines does this, and Bloglines does this.  So thanks to them for that.  But these obscure blog readers; and individual blog readers that read in Safari, or Mail.app, or NetNewsWire, there is no good way to get a count from them.  You've got people coming from different IP's.  You have people coming from multiple IP's (do i count them as two?)  So it's tricky.

So what I did was, shortened the rss.xml feed.  That way, in hopes that you guys click into the site and read the full post, so I can get an accurate count.

I have every intention of making the rss feed full length again, let's say I'll do it next week.  So don't worry, you'll get your full feeds.   But for now, I am just trying to get an accurate count.

I've also posted some convenient "subscribe here" buttons on the right --------->

so if you read from one of those readers, feel free to add me there.  Notice that I've added the ones that give me counts :)

Thanks for your patience while I get this stuff done.  

/usr/ports update

I updated my port tree (and all the ports underneath it) using portupgrade tonight.  Then bash stopped working.

Crap.

Found this article, (click on title of blog entry to go to the website).   Good thing I did too.

"...After this I was able to start X and continue on with my work. Though this worked, the above is not the correct way to fix the “shared object ‘libintl.so.6′ not found” error. Reading /usr/ports/UPDATING revealed I needed to do:

portupgrade -rf gettext

The above is required if you upgraded to: gettext-0.16.1. /usr/ports/UPDATING shows:

20070318:
AFFECTS: users of devel/gettext (ie: YOU)
AUTHOR: ade@FreeBSD.org

As a result of the upgrade to gettext-0.16.1, the shared library version
of libintl has changed, so you will need to rebuild all ports that
depend on gettext (ie: most of them, sorry):

portupgrade -rf gettext"

/usr/ports update

I updated my port tree (and all the ports underneath it) using portupgrade tonight.  Then bash stopped working.

Crap.

Found this article, (click on title of blog entry to go to the website).   Good thing I did too.

"...After this I was able to start X and continue on with my work. Though this worked, the above is not the correct way to fix the “shared object ‘libintl.so.6′ not found” error. Reading /usr/ports/UPDATING revealed I needed to do:

portupgrade -rf gettext

The above is required if you upgraded to: gettext-0.16.1. /usr/ports/UPDATING shows:

20070318:
AFFECTS: users of devel/gettext (ie: YOU)
AUTHOR: ade@FreeBSD.org

As a result of the upgrade to gettext-0.16.1, the shared library version
of libintl has changed, so you will need to rebuild all ports that
depend on gettext (ie: most of them, sorry):

portupgrade -rf gettext"

Now, that's a nice User-Agent

I was looking through my httpd-access.log today for something, and ran across this, (Yes, I have removed the IP):

"[29/Nov/2007:17:18:18 -0500] "GET /uploaded_images/questionmark-785318.jpg HTTP/1.1" 200 6203 "http://www.bloglines.com/myblogs_display?sub=44519724&site=8488306" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Internet Explorer'); DROP TABLE browsers;--"

 

Little injection attempt there?  Trying to drop the ol' browser table in some kind of stats db.  

So who cares.  Well it made me think of something.  If this person can obviously alter his/her User-Agent to do that, what is to make you think that the rest of the Agent string is valid?  How do we know that his person is really using "Internet Explorer"?

At what point does the trust break.  I've often gone with the adage of "don't trust anything", not a single packet.   What if you use p0f to passively fingerprint the OS'es of the machines attempting to access your network, okay, and I go in, compile my own kernel on my Linux box, and set my IP and TCP attributes such that it will appear to be Windows when I communicate with your network?

What can you trust on your own network?  If someone hacks into your web server, is there any merit in seeing what they did once they got on the machine?  You no longer can trust a single thing on the box, and definitely anything coming out of the box!   It has to be rebuilt.

Mod_security did not catch the above attempt btw.  (It will now)

Facebook

I've been hearing alot recently about the new way to communicate with the world, via social networks.  MySpace, FaceBook, Pownce and the like.  I've had a couple people encourage me to do it.  So I decided I'd at least join one.

So I grabbed a FaceBook account and requested a Pownce account.  I have my principles against joining MySpace.  (Which in my opinion is truly the biggest waste of bandwidth on the internet.)

So, if you want, hit me up on FaceBook.  See you there.

Update:  I now have a Pownce account.  Hit me up there too.  Username = joelesler

Facebook

I've been hearing alot recently about the new way to communicate with the world, via social networks.  MySpace, FaceBook, Pownce and the like.  I've had a couple people encourage me to do it.  So I decided I'd at least join one.

So I grabbed a FaceBook account and requested a Pownce account.  I have my principles against joining MySpace.  (Which in my opinion is truly the biggest waste of bandwidth on the internet.)

So, if you want, hit me up on FaceBook.  See you there.

Update:  I now have a Pownce account.  Hit me up there too.  Username = joelesler

Rebuilt Website

The machine I was running this website on wasn't handling the load too well.  Had to rebuild.  I had a server sitting around here, so I loaded it with freebsd, and put www.joelesler.net on it.  

Now it works much better.  Had to place it in the basement of the house though, it was kinda loud with all those fans running.  Had to drill a hole in the floor of my office to get the Cat 6 cable through the floor, but all is well now.

Okay Apple. Are you awake?

Friend of mine pointed this out to me. http://nvd.nist.gov/nvd.cfm?cvename=CVE-2002-0252
This vulnerability from 2002 appears to be the same vulnerability that was just found in 7.2 and 7.3 in Quicktime!

Except that the 2002 vulnerability was found in a piece of software called... Quicktime. Uh? And I thought Microsoft was the only company that re-introduced old vulnerabilities.

Come on Apple, I hold you to a higher standard than that! Let's go.

You get the moron label on this post.

UPDATE: The original vulnerability was for the Japanese version of Quicktime. You would think that Apple would update all their code.

Okay Apple. Are you awake?

Friend of mine pointed this out to me. http://nvd.nist.gov/nvd.cfm?cvename=CVE-2002-0252
This vulnerability from 2002 appears to be the same vulnerability that was just found in 7.2 and 7.3 in Quicktime!

Except that the 2002 vulnerability was found in a piece of software called... Quicktime. Uh? And I thought Microsoft was the only company that re-introduced old vulnerabilities.

Come on Apple, I hold you to a higher standard than that! Let's go.

You get the moron label on this post.

UPDATE: The original vulnerability was for the Japanese version of Quicktime. You would think that Apple would update all their code.

Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit

For those of you that have not seen it this morning, (actually, it was last week, but who cares), there is a PoC (and actual exploit code out for XP and Vista -- I have not seen any for OSX, just the PoC), for Apple Quicktime 7.3.  

While we are waiting for Apple to post a patch, please, please go here: http://zapatopi.net/afdb/build.html. And affix to head.

Secunia gives us advice:

"Do not browse untrusted websites, follow untrusted links, nor open untrusted QTL files."

Uhhh thanks?  

Stupid advertising mistakes

W00t! I am Paypal, and I am going to give you 20% cashback, on all your purchases from all these fine retailers!!

Except we didn't have enough retailers to fill our graphic, so we took the same ones on the top, moved them around, and put them on the bottom too!  Look!  We have twice as many now!

Why do retailers feel the need to over inflate?  Sorry, I just needed to vent this morning.  Thanks.

Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit

For those of you that have not seen it this morning, (actually, it was last week, but who cares), there is a PoC (and actual exploit code out for XP and Vista -- I have not seen any for OSX, just the PoC), for Apple Quicktime 7.3.  

While we are waiting for Apple to post a patch, please, please go here: http://zapatopi.net/afdb/build.html. And affix to head.

Secunia gives us advice:

"Do not browse untrusted websites, follow untrusted links, nor open untrusted QTL files."

Uhhh thanks?  

Stupid advertising mistakes

W00t! I am Paypal, and I am going to give you 20% cashback, on all your purchases from all these fine retailers!!

Except we didn't have enough retailers to fill our graphic, so we took the same ones on the top, moved them around, and put them on the bottom too!  Look!  We have twice as many now!

Why do retailers feel the need to over inflate?  Sorry, I just needed to vent this morning.  Thanks.

joelesler.net

I decided I should go ahead and actually get a primary domain, instead of surfing off of esler.is-a-geek.net (which is a dynamic dns freebie domain (is-a-geek.net), and bought joelesler.net. I couldn't get joelesler.com, my long lost twin in Australia owns that one, and I am not a .org, so I didn't get that one. esler.org and esler.net were also taken, or I would have grabbed those as well. That way I could set up fun email address for the whole family.

The only one that was available is esler.com, but they want 2500 bucks for that one. I'm not going to pay 2500 bucks for my own damn last name. But esler.com used to be a website for an airport in Alexandria, Louisiana, (seriously! Esler airpark!), so someone has it parked, and has the stranglehold on that one currently. I actually landed at the airpark once when I was in the military. We were going to Fort Polk, and that's the airport we landed in. Of course I didn't know it until later.

I have email here, all the DNS zones I can handle, and loads of other goodies that you can do with your own domain. So I have changed my email on the right of page to reflect my new domain.

Esler.is-a-geek.net will still work for now, it's free! But eventually, when I get tired of renewing it every 90 days, I'll ditch it.

M/S Explorer is sinking

No really.  The M/S Explorer has crashed, and is sinking.

"More than 150 passengers and crew have been rescued from a stricken tourist ship after it hit ice off Antarctica.  The M/S Explorer is now lying on its side close to the South Shetland Islands, in the Antarctic Ocean."

Okay, so it was a cheap poke designed to get you laughing.  As long as it worked then I am fine.

All passengers and crew were evacuated, so we can laugh.

(That was a Microsoft Explorer joke..)

joelesler.net

I decided I should go ahead and actually get a primary domain, instead of surfing off of esler.is-a-geek.net (which is a dynamic dns freebie domain (is-a-geek.net), and bought joelesler.net. I couldn't get joelesler.com, my long lost twin in Australia owns that one, and I am not a .org, so I didn't get that one. esler.org and esler.net were also taken, or I would have grabbed those as well. That way I could set up fun email address for the whole family.

The only one that was available is esler.com, but they want 2500 bucks for that one. I'm not going to pay 2500 bucks for my own damn last name. But esler.com used to be a website for an airport in Alexandria, Louisiana, (seriously! Esler airpark!), so someone has it parked, and has the stranglehold on that one currently. I actually landed at the airpark once when I was in the military. We were going to Fort Polk, and that's the airport we landed in. Of course I didn't know it until later.

I have email here, all the DNS zones I can handle, and loads of other goodies that you can do with your own domain. So I have changed my email on the right of page to reflect my new domain.

Esler.is-a-geek.net will still work for now, it's free! But eventually, when I get tired of renewing it every 90 days, I'll ditch it.

M/S Explorer is sinking

No really.  The M/S Explorer has crashed, and is sinking.

"More than 150 passengers and crew have been rescued from a stricken tourist ship after it hit ice off Antarctica.  The M/S Explorer is now lying on its side close to the South Shetland Islands, in the Antarctic Ocean."

Okay, so it was a cheap poke designed to get you laughing.  As long as it worked then I am fine.

All passengers and crew were evacuated, so we can laugh.

(That was a Microsoft Explorer joke..)

Thank you for watching

For those of you who read my next post and then took the URL in the log that I posted, and copies and pasted that into the address bar of your browser, and read the Microsoft label page, you are missing the point. 

-- Thank you for reading, but that's not what I am asking. --

Look at the log entry.  If you have access to apache logs yourself, go look at yours, or find some on the internet, then come back and tell me what is wrong with that log entry.

(BTW -- Those of you that cut and pasted, about 20 of you did it, so don't feel bad, you are not alone.)

Why would a browser do this?

First of all, tell me what's wrong with this picture, then explain to my why a browser would do this?

[21/Nov/2007:16:36:05 --0500] "GET http://esler.is-a-geek.net/labels/Microsoft.html HTTP/1.1" 406 340 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)" - "-"

Maxthon is the name of the browser.

iChat Screen Names For Over 30 Apple Stores

Digg - iChat Screen Names For Over 30 Apple Stores:

I never even thought of doing this with all the Apple Stores that I have been to. Get the screen names for all the iChat's for the machines in the store? Someone add these all to your iChat buddy list and send me a screen shot. That would be hilarious.

iChat Screen Names For Over 30 Apple Stores

Digg - iChat Screen Names For Over 30 Apple Stores:

I never even thought of doing this with all the Apple Stores that I have been to. Get the screen names for all the iChat's for the machines in the store? Someone add these all to your iChat buddy list and send me a screen shot. That would be hilarious.

Gas is stupid expensive, and Security 2.0

Yeah, I get it. If oil prices go up for this reason or that reason, gas prices are soon to follow. But costing me 60.00 to fill up the tank?

Come on. Is that truly necessary? There is nothing that can be done
about that at all?

On another note--

I've thinking about writing a blog entry about the state of modern security in computer networks. Does it work? Where are we at?  Are all the extremely restrictive policies in your corporate work environment working?  What can be relaxed?  Why?

Like to hear your thoughts. What does "security 2.0" mean to you?  

Gas is stupid expensive, and Security 2.0

Yeah, I get it. If oil prices go up for this reason or that reason, gas prices are soon to follow. But costing me 60.00 to fill up the tank?

Come on. Is that truly necessary? There is nothing that can be done
about that at all?

On another note--

I've thinking about writing a blog entry about the state of modern security in computer networks. Does it work? Where are we at?  Are all the extremely restrictive policies in your corporate work environment working?  What can be relaxed?  Why?

Like to hear your thoughts. What does "security 2.0" mean to you?  

Cabling

I have no idea where this picture came from, (well, the site I got it from is here, but I don't know what the picture is of) but I thought it was great.

Think you have issues with cabling in your network?

Think again.

Cabling

I have no idea where this picture came from, (well, the site I got it from is here, but I don't know what the picture is of) but I thought it was great.

Think you have issues with cabling in your network?

Think again.

Love it when I am right

I love it when I am right.

Remember this post?  I said that Apple and Starbucks should partner.  Imagine the possibilities.

800 posts, and mod_security blocking

Took a look at my mod_security logs tonight.  Apparently, if you use Google's Reader to my rss feed, then actually try to go to my website via the link in the RSS..  trying to do all this when you are behind a Bluecoat Proxy server on your internal network...

You get blocked.  The bluecoat proxy forwards your "X-forwarded for" header to the Google Reader, then, finally when you click on the link to come to my website, Google forwards your internal IP.

Which mod_security didn't like:

"!^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-
9][0-9]?)|)|unknown)$" at HEADER("X-FORWARDED-FOR")

It doesn't like you.   I commented out the rule, so everything should be fine now.

Love it when I am right

I love it when I am right.

Remember this post?  I said that Apple and Starbucks should partner.  Imagine the possibilities.

800 posts, and mod_security blocking

Took a look at my mod_security logs tonight.  Apparently, if you use Google's Reader to my rss feed, then actually try to go to my website via the link in the RSS..  trying to do all this when you are behind a Bluecoat Proxy server on your internal network...

You get blocked.  The bluecoat proxy forwards your "X-forwarded for" header to the Google Reader, then, finally when you click on the link to come to my website, Google forwards your internal IP.

Which mod_security didn't like:

"!^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-
9][0-9]?)|)|unknown)$" at HEADER("X-FORWARDED-FOR")

It doesn't like you.   I commented out the rule, so everything should be fine now.

MacBook Pro Goodness

I bit the bullet.

I went out this weekend and purchased my first Intel based Mac. I didn't buy the first gen (or the second gen for that matter) MacBook Pro (MBP), simply because, usually, it's a bad thing to buy Apple hardware in it's first gen. (Except for the iPhone currently)

But the MBP is excellent. It's not hot, it runs fast (even with it's stock 2 Gigs of RAM), and works flawlessly. The MBP had Tiger on it when I bought it, but came with a Leopard install disk, which is nice.

The only thing that I had problems with was, my old wireless card from AT*T was PCMCIA. The new MBP's have Express card slots. So, I had to get a new card. Which the guy at the store, let me tell you, was a prick. Dude, obviously, if I come in, ask for an exact model number for a laptop card, tell you I already have an account (which he had to verify, because he didn't believe I already had a SIM card), I have obviously already looked to see if my computer supports it.

He insisted that OSX was not supported and the card wouldn't work. Well uh, no, it's not supported by AT*T that doesn't mean that it's not supported by the card manufacturer. (Option) What a tool, anyway...

I get the card home, plug it in, and wtf. The lights are flashing.. huh? What did I do wrong? Oh, I had the SIM card inserted backwards. My bad.

Flipped it around, and it worked fine. In fact, not only did it work fine, but Leopard has NATIVE DRIVER SUPPORT for it. No loading 3rd party software, no wierd communications spyware... err.. manager i mean... It just works. Nice little toolbar access to the card. Very nice.

Anyway, I gotta go order my other two Gigs of RAM for this thing, so I can love on it some more.

MacBook Pro Goodness

I bit the bullet.

I went out this weekend and purchased my first Intel based Mac. I didn't buy the first gen (or the second gen for that matter) MacBook Pro (MBP), simply because, usually, it's a bad thing to buy Apple hardware in it's first gen. (Except for the iPhone currently)

But the MBP is excellent. It's not hot, it runs fast (even with it's stock 2 Gigs of RAM), and works flawlessly. The MBP had Tiger on it when I bought it, but came with a Leopard install disk, which is nice.

The only thing that I had problems with was, my old wireless card from AT*T was PCMCIA. The new MBP's have Express card slots. So, I had to get a new card. Which the guy at the store, let me tell you, was a prick. Dude, obviously, if I come in, ask for an exact model number for a laptop card, tell you I already have an account (which he had to verify, because he didn't believe I already had a SIM card), I have obviously already looked to see if my computer supports it.

He insisted that OSX was not supported and the card wouldn't work. Well uh, no, it's not supported by AT*T that doesn't mean that it's not supported by the card manufacturer. (Option) What a tool, anyway...

I get the card home, plug it in, and wtf. The lights are flashing.. huh? What did I do wrong? Oh, I had the SIM card inserted backwards. My bad.

Flipped it around, and it worked fine. In fact, not only did it work fine, but Leopard has NATIVE DRIVER SUPPORT for it. No loading 3rd party software, no wierd communications spyware... err.. manager i mean... It just works. Nice little toolbar access to the card. Very nice.

Anyway, I gotta go order my other two Gigs of RAM for this thing, so I can love on it some more.

Welcome back

iWeb is a great program, makes nice webpages, the problem is, it stores the entire website in one huge file called "Domain". So, I have taken the time to transition everything back to here.

Essentially, because iWeb keeps everything in that one file, I couldn't edit the webpage on multiple computers, nor could I edit it from the road. I used to keep the Domain file on my iDisk, so I could sync it between machines... Which was fine... except when it got to be like 250 Mb's. It was alot to sync. So, I decided to move everything back to my Linux server.

I'll probably lose some people in the transition between the iWeb domain, and bringing it back to my server, but hopefully they find me again.

Welcome back

iWeb is a great program, makes nice webpages, the problem is, it stores the entire website in one huge file called "Domain". So, I have taken the time to transition everything back to here.

Essentially, because iWeb keeps everything in that one file, I couldn't edit the webpage on multiple computers, nor could I edit it from the road. I used to keep the Domain file on my iDisk, so I could sync it between machines... Which was fine... except when it got to be like 250 Mb's. It was alot to sync. So, I decided to move everything back to my Linux server.

I'll probably lose some people in the transition between the iWeb domain, and bringing it back to my server, but hopefully they find me again.

TWiT -- This Week in Tech

This week I started listening to TWiT, otherwise known as This Week in Tech. With Leo Laporte and John Dvorak.

First of all, little bit of background, I listen to two (now three) podcasts. I listen to Diggnation (which is what got me started listening to Podcasts), and the Totally Rad Show. Both have Alex Albrecht in them, (he’s pretty funny), and the former has Kevin Rose, founder of Digg.com and both are from the TechTV show The Screen Savers. Which was a show ‘back in the day’ before G4 bought the channel and ruined it. Anyway...

I started listening to TWiT (Leo Laporte was also a host of The Screen Savers) today and kinda like it. There are just a couple things about it that I am not in total agreement with. First of all, it’s press and media ish people. There are no real real real geeks on the show. (Alex and Kevin have even lost a bit of touch.) Hello? There are geeks out there people that have the ability to talk to the public as well! (Uh, me?) People can joke and be knowledgeable at the same time.

Second, one of things I found interesting in the TWiT podcast was John Dvorak. Now we all know Dvorak as the guy who is really big into bashing all things everything. Apple, Microsoft, etc. He’s got something to say. Most of which I agree with (when it comes to Microsoft being an evil corporation), but some of it I do not. (Like his famed Apple punditry). But it was interesting to hear him (in TWiT episode 119) say basically, look people Microsoft is done. Buy a Mac. It’s over for MSFT. Something I have been saying for awhile, because I pretty much dislike anything MSFT. But it was interesting to hear Dvorak say that.

Third, Leo doesn’t read his email. (He said this on Episode 119) I don’t know how you can survive without reading or writing email, since that is the mainstream form of communication now adays. But anyway, to each his own.

On the email note, I recently received an email chastising me about not writing on the blog anymore. Truth is, I’ve been very busy and haven’t had time to do a proper review of any tech stuff, and I’ve been up to my eyeballs in packets. (which I suppose I could write about).

Thanks to the couple hundred readers that I do have, I’ll have to get back on the blogging wagon. I always think that no one reads this thing until I start getting emails asking me to “write something new!” “Haven’t heard from you in awhile!”

Back to podcasts --

I was actually asked to start a podcast on general tech/security stuff, but I declined. First of all, who has the time? I wouldn’t do it alone, and the people I would want to do a podcast with would probably make fun of me for asking them to do it. (Although, if they did, it would be the funniest podcast out there, bar none.)

If you have any podcasts out there that you think I should be listening to, please let me know!

Google Phone, Apple Stock, and other Random Blatherings

Today’s news has just been a buzz with Google’s announcement of their “gphone”. Wait...

Google’s phone is NOT a PHONE! It’s Open Software, FOR phones. Google isn’t making a phone (yet), and no products have been announced. So at this point, this is ‘releaseware’. Other phone companies (Motorola, Sony, Nokia, and the like) have to want to put Google’s software on their phones. Will they do that? When they have a significant investment in their own OS’es on their phones now? Time will tell.

Apple’s Stock Price --

I can’t complain. Everytime Apple’s stock price levels out and doesn’t go anywhere for awhile, they introduce something new. iPhone, iPod Nano, iPod Touch, 3rd Quarter earnings, new laptops... just keep on going Apple, keep on going.

Trolls--
I’ve noticed as of late alot of trolls in some IRC channels that I am in. Why would you come into a product channel and say “your product sucks because ”? Do I jump into the #windows channel and say “Control Panel sucks, therefore the whole OS sucks!” No!, because that’s called “Trolling”! Why would you pop in one of my channels, where clearly, there are alot of people that know more about the product then you and say something insane like.. “You can’t achieve >1 Gig speeds with your product!”.

Sorry, just needed to vent.

For those reading this blog looking for leopard feedback, here you go. I like it. There are only a couple things I can’t get to work. Back to my Mac for one (probably because of some firewall setting I have), local lan browsing always doesn’t work, and my laptop battery power really really sucks now. I can drain my whole laptop battery in about 10 minutes. Something isn’t right.

I really like Time machine, it’s great. I like alot of their new features, even though, I admit, leopard could have used a bit more testing before release.

Hopefully they release a fix-it pack soon. But I still like it!

Quick Story

This comic was on xkcd the other day. Reminded me of my high school days.

I was in computer class one day (I think it was called Keyboarding 1 or something). Our computers were locked down to the point where you could only run like two programs. One was WordPerfect [was it WordPerfect?](remember that? The Blue screen with the white letters?), the other was some typing speed tester. Well, they neglected to think about the security aspect, and that anyone would be able to use WordPerfect to navigate throughout the school’s networks.

Guess what?

Change directory... What directory would you like to change to? How about ../../../../../../../.? Well... the details of how I exactly did it are lost to time right now, but basically, lame directory transversal. Was able to navigate to the teachers computer where her name was “Sysop”. (Imagine that?)

Well, she maintained the usernames and passwords for all of the users on the networks, all of which were editable using WordPerfect. Very Nice.

Anyway. I never did anything malicious, let me just say that right now, before anyone jumps to conclusions. But the kid sitting behind me did. (No really, he really did) His name was Shawn. I don’t remember his last name, but I know he got kicked out of school a year or two later.

The teacher didn’t really know what we were doing (she was across the room) but she could tell we were in the file navigator. So consequently by the next day, my parents and I were in the Principles office. The teacher claimed I hacked her Sysop password (not true). They wanted me to tell them what the new one was, I had no idea. I didn’t do it!

I was suspended at the end. My Dad was pissed.

I say all that to say this, which brings me back to the comic.

Years later after I left home, joined the military, and blew some stuff up... Dad and I were sharing a beer going over all the funny crap I did as a kid when we came upon this moment in time.

Dad admitted to me that at the time he had to act mad, but he told me that he actually was very proud of me at that moment. He said that I always knew what I was going to do for a living from the age of 14. I just had no idea how to get there.

Famous quote by Steve Jobs, (of course!):
“Of course it was impossible to connect the dots looking forward .... But it was very, very clear looking backwards ten years later.”

Quick Story

This comic was on xkcd the other day. Reminded me of my high school days.

I was in computer class one day (I think it was called Keyboarding 1 or something). Our computers were locked down to the point where you could only run like two programs. One was WordPerfect [was it WordPerfect?](remember that? The Blue screen with the white letters?), the other was some typing speed tester. Well, they neglected to think about the security aspect, and that anyone would be able to use WordPerfect to navigate throughout the school’s networks.

Guess what?

Change directory... What directory would you like to change to? How about ../../../../../../../.? Well... the details of how I exactly did it are lost to time right now, but basically, lame directory transversal. Was able to navigate to the teachers computer where her name was “Sysop”. (Imagine that?)

Well, she maintained the usernames and passwords for all of the users on the networks, all of which were editable using WordPerfect. Very Nice.

Anyway. I never did anything malicious, let me just say that right now, before anyone jumps to conclusions. But the kid sitting behind me did. (No really, he really did) His name was Shawn. I don’t remember his last name, but I know he got kicked out of school a year or two later.

The teacher didn’t really know what we were doing (she was across the room) but she could tell we were in the file navigator. So consequently by the next day, my parents and I were in the Principles office. The teacher claimed I hacked her Sysop password (not true). They wanted me to tell them what the new one was, I had no idea. I didn’t do it!

I was suspended at the end. My Dad was pissed.

I say all that to say this, which brings me back to the comic.

Years later after I left home, joined the military, and blew some stuff up... Dad and I were sharing a beer going over all the funny crap I did as a kid when we came upon this moment in time.

Dad admitted to me that at the time he had to act mad, but he told me that he actually was very proud of me at that moment. He said that I always knew what I was going to do for a living from the age of 14. I just had no idea how to get there.

Famous quote by Steve Jobs, (of course!):
“Of course it was impossible to connect the dots looking forward .... But it was very, very clear looking backwards ten years later.”

Manifold

I didn’t do it!

Wish I could take credit for this one, it’s genius.

Friend of mine named Joel Esler (same exact name, even middle) made a flash based game called Manifold. It’s not me :)

Joel and I met almost 10 years ago now, online, and have kept in touch ever since. We have the same first, middle, and last names. He lives in Australia and is a graphic artist. (And apparently makes really good flash games too!)

So I just wanted to clear that up, it’s not me, it’s him, go support him!

Good job Joel!

Outlook and Mail.app

At the client I am working at, they actually use the Outlook calendar how it is supposed to be used. Scheduling appointments, conference calls, and inviting people to them, using the Accept, Decline..etc buttons within Outlook to actually schedule conference calls.

I am baffled by the use of this technology, since most offices that I’ve worked at don’t use Calendars on their computers as they are supposed to. I have no idea why this is so hard for people to grasp.

Anyway, I have noticed that when people send me an invite in Outlook and I receive it in Mail.app, it basically looks like this:

When: Wednesday, September 26, 2007 7:30 PM-9:00 PM (GMT-05:00) Eastern Time (US & Canada).
*~*~*~*~*~*~*~*~*~*
Which, is annoying. I want it to look like an iCal icon, allowing me to click on it (or even do what it’s supposed to and automatically import into iCal) and add it into iCal. Well I Googled.

Found these two: OMiC and MailTags, but I didn’t want to install an app. Why should I have to install a third party app!? i don’t want to do that. So I started looking some more, and decided I should poke around the menus. After looking for a bit I found that by hitting the “Command-[“ key combination Mail.app would switch the format of the mail around and I got what I wanted. No third party app.

Why isn’t it ALL that easy?

Manifold

I didn’t do it!

Wish I could take credit for this one, it’s genius.

Friend of mine named Joel Esler (same exact name, even middle) made a flash based game called Manifold. It’s not me :)

Joel and I met almost 10 years ago now, online, and have kept in touch ever since. We have the same first, middle, and last names. He lives in Australia and is a graphic artist. (And apparently makes really good flash games too!)

So I just wanted to clear that up, it’s not me, it’s him, go support him!

Good job Joel!

Outlook and Mail.app

At the client I am working at, they actually use the Outlook calendar how it is supposed to be used. Scheduling appointments, conference calls, and inviting people to them, using the Accept, Decline..etc buttons within Outlook to actually schedule conference calls.

I am baffled by the use of this technology, since most offices that I’ve worked at don’t use Calendars on their computers as they are supposed to. I have no idea why this is so hard for people to grasp.

Anyway, I have noticed that when people send me an invite in Outlook and I receive it in Mail.app, it basically looks like this:

When: Wednesday, September 26, 2007 7:30 PM-9:00 PM (GMT-05:00) Eastern Time (US & Canada).
*~*~*~*~*~*~*~*~*~*
Which, is annoying. I want it to look like an iCal icon, allowing me to click on it (or even do what it’s supposed to and automatically import into iCal) and add it into iCal. Well I Googled.

Found these two: OMiC and MailTags, but I didn’t want to install an app. Why should I have to install a third party app!? i don’t want to do that. So I started looking some more, and decided I should poke around the menus. After looking for a bit I found that by hitting the “Command-[“ key combination Mail.app would switch the format of the mail around and I got what I wanted. No third party app.

Why isn’t it ALL that easy?

Review of the Snort book

Friend of mine Richard Bejtlich posted his review of the Snort Book that I had a hand in writing. I just wanted to say that I agree with every word he had to say. He did make some nice comments (and some bad comments -- citing the publisher at fault -- which is true) about my chapter, can’t fault him for that!

Thanks Richard for posting the review. I totally agree!

Full Disclosure

In the interest of Full-Disclosure for this blog and everything I’ll let you know where I stand.

-- I love Macs and everything Apple. Don’t care what you think, it all works for me. Don’t have any problems admitting it, even if one of my best friends thinks I am a tool because of it. (WuTang)
-- My first OS was DOS, first computer was a Tandy 1000 SX bought from Radio Shack. My OS progression has been:
DOS
Windows 3.1
Windows 95
Windows 98
Windows ME + NT
Windows XP + 2000
Redhat Linux
Mandrake Linux
Slackware
SuSE
OSX

That’s not all the OS’es I know, that’s just the ones I’ve personally had loaded on my systems.
-- I have an iPhone, iSight, Mac keyboards, docs, Mice..
-- I have a 3G iPod
-- I have a PowerBook G4
-- I have a PowerMac Dual G5 2.0
-- My wife has a MacBook Black
-- I work for Sourcefire, we make Snort, it’s the best company I’ve ever worked for, and I love it. I believe in our products and our philosophy of customer service. I work in the Professional Services department. Which means I am half sales, half technical, and another half jack-of-all-trades. (Which is 3 halves for you doing the math) It’s a great job, I have great management. I travel ALOT and actually, as I said in this post I am off the road for a year to work with one customer.
-- In my spare time I grade GIAC Gold papers for GIAC.org which is affiliated with SANS.
-- In my other spare time I am a handler with the Internet Storm Center. It takes a lot of time, and we get a lot of email.
-- I wrote a chapter of a book. I edited a another chapter, but my edits weren’t included in neither my bio or the other chapter (even though I was paid to do the edits).
-- The book sucked. Even my chapter had errors in it. (TCP Conversations do NOT start with a “FIN” wtf!) The publisher took the rough draft (read: not the final edits) of all the authors and published the rough drafts, this is because the publisher for the book quit in the middle of the process, plus Syngress (the publishing company) was bought out, so I am sure there were some things lost.. There are a couple chapters in the book that are excellent, and it’s worth the purchase. But on a elementary grading scale of the book, I give it a C-.

Anything I forgot? Leave a comment. If you are going to write about me in your blog, leave a comment on my blog pointing to your post!

Stoned.Angelina makes its way back..

Does anyone remember this boot sector virus? Stoned.Angelina? no? It’s only 13 years old.

Apparently a bunch of laptops pre-installed with Windows Vista Home Premium (wtf ever that means) was found to be infected with this 13 year old virus.

What happened to that MSFT anti-virus?

The Register has the story. Albeit funny though.

It is “an unfortunate” mistake for the company that put it on there “Bullguard”.

Bullheaded move is more like it.

Update: Apparently this dude over at computerdefense.org didn’t really like my post. First of all, it’s meant to relay information and yet, be funny at the same time.

So, #1 -- This is Bullguard’s fault. If you couldn’t read into that in the above post, well I am sorry.
#2 -- This is not Vista’s fault. Just MSFT being a victim of circumstance. This shouldn’t happen to an Apple computer because they control the manufacturing process of the hardware and the software. MSFT doesn’t. They just make the software, so they are at the hardware manufacturers mercy.
#3 -- I was definitely making fun of Vista’s naming structure. “Vista Home Premium” What does that mean? My question for Microsoft is, why couldn’t there just be ONE version of Vista. OSX does it! Linux does it! (yes they have versions like “Advanced Server” -- or whatever it’s called now..)
#4 -- I was poking fun at MSFT’s anti-virus service.

However, the dude that calls me everything but the kitchen sink over on his blog, says “I’ve actually had AV Vendors tell me that they pull old and out-dated virus signatures…” How is that responsible? So all I have to do if I want to infect computers is to introduce a really old virus? What kind of liability issues does that raise?

Further down in the posts in his blog he says “Now, I’m often accused of being a Microsoft Zealot...” Well, at least he admits it. He’s on the MSFT side of the fence, I am on the Apple/Linux side of the fence. At least now, I know where we all stand.

If you are going to write about me in your blog, leave a comment on my blog pointing to your post!

Waiting in Line (or, how humans are lemmings)

I live near this small town in Delaware named “Middletown”.

At the intersection of 71 and 299, there is a single stop light, 4 way (with turn lanes) stop in the middle of town. Everyday I drive North on Route 1 to get to work and South on Route 1 to come home. The closest exit to where I live is the 299 exit off of Route 1. So, I would be approaching town from the right (headed West). Now, since the overwhelming majority of people that live in Middletown and Townsend work in either Dover or Wilmington, most people use Route 1 or 13 for the commute. (If you use 13, you just don’t want to pay the toll and are a cheapskate).

Anyway. Everyday, when I get off the exit headed towards Middletown, there is a line... A LONG LINE of people waiting at the light at 299/71. Like, a mile long... Now, as you can see from the above map, Middletown was built with the logical “Block” concept where the roads are in squares surrounding the main intersection. One way streets and everything. Aside from Lake street, which is not really the best street, the rest of the streets are normal small town neighborhood streets. Why oh Why do all these people wait at the light like 1984 zombies waiting for the light to change? Why doesn’t anyone go down the side blocks? Wouldn’t that make life so much easier? Or, perhaps, spend the 2 miles it takes to learn the shortcuts to avoid the intersection in the middle of town all-together and save alot less stress.

It makes me sad to make the turn to avoid the intersection, like I do everyday, and see the long line of people waiting... So sad.

Waiting in Line (or, how humans are lemmings)

I live near this small town in Delaware named “Middletown”.

At the intersection of 71 and 299, there is a single stop light, 4 way (with turn lanes) stop in the middle of town. Everyday I drive North on Route 1 to get to work and South on Route 1 to come home. The closest exit to where I live is the 299 exit off of Route 1. So, I would be approaching town from the right (headed West). Now, since the overwhelming majority of people that live in Middletown and Townsend work in either Dover or Wilmington, most people use Route 1 or 13 for the commute. (If you use 13, you just don’t want to pay the toll and are a cheapskate).

Anyway. Everyday, when I get off the exit headed towards Middletown, there is a line... A LONG LINE of people waiting at the light at 299/71. Like, a mile long... Now, as you can see from the above map, Middletown was built with the logical “Block” concept where the roads are in squares surrounding the main intersection. One way streets and everything. Aside from Lake street, which is not really the best street, the rest of the streets are normal small town neighborhood streets. Why oh Why do all these people wait at the light like 1984 zombies waiting for the light to change? Why doesn’t anyone go down the side blocks? Wouldn’t that make life so much easier? Or, perhaps, spend the 2 miles it takes to learn the shortcuts to avoid the intersection in the middle of town all-together and save alot less stress.

It makes me sad to make the turn to avoid the intersection, like I do everyday, and see the long line of people waiting... So sad.

New Apple Keyboard review

Okay, so I went to the Apple store the other day (the Christiana Mall one is about 2 miles from work), just to see if I liked the new Apple Keyboard that they released at the same time as the new iMac.

Surprisingly, I did like it. I was impressed. I think I like it better than my old white Mac keyboard because the keys don’t travel as far. It’s more like a laptop keyboard (which I prefer), and the keys don’t depress as far as a regular keyboard does, but it has a nice ‘tactile’ feedback.

So, now it sits @ home. I really like it.

In fact, while using it the first day, I mentioned to my wife ‘hey, I think I type faster on this thing’. Of course, she rolled her eyes at me, but I had to test it.

I went to www.typingtest.com where you can take a non-scientific measurement of your typing speed, and with my Powerbook keyboard I can crank out 92 WPM (tested twice), with the new Mac Keyboard I can crank out 90 WPM, but with my old white mac keyboard, for some reason (maybe mental block), I can only get about 84 WPM.

So, like I said, non-scientific. But very interesting. To each his own, but I like it.

New Apple Keyboard review

Okay, so I went to the Apple store the other day (the Christiana Mall one is about 2 miles from work), just to see if I liked the new Apple Keyboard that they released at the same time as the new iMac.

Surprisingly, I did like it. I was impressed. I think I like it better than my old white Mac keyboard because the keys don’t travel as far. It’s more like a laptop keyboard (which I prefer), and the keys don’t depress as far as a regular keyboard does, but it has a nice ‘tactile’ feedback.

So, now it sits @ home. I really like it.

In fact, while using it the first day, I mentioned to my wife ‘hey, I think I type faster on this thing’. Of course, she rolled her eyes at me, but I had to test it.

I went to www.typingtest.com where you can take a non-scientific measurement of your typing speed, and with my Powerbook keyboard I can crank out 92 WPM (tested twice), with the new Mac Keyboard I can crank out 90 WPM, but with my old white mac keyboard, for some reason (maybe mental block), I can only get about 84 WPM.

So, like I said, non-scientific. But very interesting. To each his own, but I like it.

A year log endeavor

For those of you that haven’t heard, I’m off the road for the next year. One of our clients has bought a year’s worth of my services to be at their office helping them configure their IDS’s, and generally help out their Incident Analysis team. Apparently this company (who I am not mentioning) had an Incident analysis team, but it had been downsized, several different managers...etc.. Therefore, they have hired me for a year in order to help them implement our product, and work in their team, since I have a bit of experience in Computer Response Teams, having worked for one for 4 years.

I’ll be able to get back to posting information and analysis again.

A year log endeavor

For those of you that haven’t heard, I’m off the road for the next year. One of our clients has bought a year’s worth of my services to be at their office helping them configure their IDS’s, and generally help out their Incident Analysis team. Apparently this company (who I am not mentioning) had an Incident analysis team, but it had been downsized, several different managers...etc.. Therefore, they have hired me for a year in order to help them implement our product, and work in their team, since I have a bit of experience in Computer Response Teams, having worked for one for 4 years.

I’ll be able to get back to posting information and analysis again.