Toshiba to give up on HD DVD

According to a Source that Reuters has, HD-DVD is done.  

Money Quote: "TOKYO (Reuters) - Toshiba Corp is planning to give up on its HD DVD format for high definition DVDs, conceding defeat to the competing Blu-Ray technology backed by Sony Corp, a company source said on Saturday."

Glad I went the Blu-Ray route.

Google Calendar and iCal Syncing

Well, I wanted a way for my wife to be able to accept events on her iCal, have it sync, automatically to her Blackberry, and even more, sync automatically with my iCal.  So, I found a nifty Google app called Google Mobile Sync for the Blackberry that automatically syncs the Blackberry and Google Calendar.  Great.  That's what I needed.

So I made a calendar in Google Calendar under my wife's Google account and tied the Blackberry to that.

Now I had to get her iCal (where she presently has all her events) to be able to sync with her Google Calendar.  Here is the tricky part.  You can read and subscribe to a Google Calendar, even setting permissions, per user, but you can't write to a Google Calendar (you can't use webdav from iCal to publish to Google Calendar.  That sucks.  (Hey Google, fix this, I know a couple of you read this blog.  I have logs, I have logs...)

So I found this app called SpanningSync which syncs your Google Calendar and you iCal (both ways).  Which is essentially the solution.  Only problem with this solution that I see is that you have to pay for the app.   I mean, I don't mind paying for software, I think coders should get paid too, but 65 bucks?  It's a tad bit much.  If it were, say 29 bucks for lifetime usage, then that would be the way to go.  Anyway, I hope this helps you all.

Mossberg previews Lenovo's 'Air-killer' X300

I read this article about Lenovo's (Thinkpad) MacBook Air 'Killer' X300, and kinda threw up in my mouth a little bit.

So let's take a look. This thing has 3 USB ports (as opposed to the MacBook Air's 1), it has a DVD Drive, (Air doesn't), has Wifi, and an optional 3G or GPS receiver, a removable battery (air doesn't -- well, easily) and not one, but TWO mouse pointing devices.

So there are pros and cons.

Lenovo --
Has more USB, Apple could do with more USB devices.
DVD Drive, I think Apple did the right thing here and killed the DVD drive. In fact, I think that they will kill off the optical drive in all systems and start shipping their software on USB sticks. Think about how much THAT would save in shipping costs.
Removable Battery -- Okay, well, I'd like to have the ability to easily swap out the MacBook Air's battery. So I kinda have to agree with it.
The Lenovo is thicker, uglier, and really Lenovo, wtf is with TWO mice? The red stick and the trackpad? I have never met anyone, ever that likes the red stick. The trackpad has become the standard, please get with the program. I remember seeing a laptop not too long ago that had the stick, the trackpad, AND the damn trackball. 3 mice. Seriously. Knock it off. Go with the trackpad it seems to work.
Has a slot for a 3G card. Now THAT is what the Macbook Air is lacking. They need the express card slot.

MacBook Air --
Sexy. The Lenovo is the typical Thinkpad ugly ass computer.
Simple. It's a damn Mac!
Lacks more USB
Lacks Optical Drive (so what?)
Lacks Removable Battery

Bottom line, it depends on what you are looking for. Personally I'd like the MacBook Air, but there are too many drawbacks. However, I'd buy it simply because it's a Mac and I refuse to use anything else as my desktop (well, I'd use a bsd or a linux distro as well I guess, but given the option, I'd use a Mac 100%). But I have a Macbook pro. I love this computer, I am writing on it right now. I think the MacBook Pro has it going on.

There is a certain demographic that the MacBook Air is aimed towards, and I think it will sell well in that demographic.

In other news, the same website is reporting that Best Buy is out of the 15in MacBook Pro. Which usually means that Apple has a new one right around the corner. Thinner? Sleeker? Better?

Wordpress plugin exploit

Wordpress seems to be getting it's butt kicked lately with all the xploits that are coming out for it and it's plugins. In a new one just published to milw0rm today, this one deals with "Simple Forum". I guess there is no rest for the exploit writers out there, even if this one does seem rather weak. Especially when the tag line at the bottom of the exploit reads: "i AM NOT HACKER". Instead of the much better "I am not A hacker". It's all in the details.

The Difference between two operating systems

Often I am critized because I rave on and on about the Mac platform and constantly put down Microsoft without ever actually saying why I hate (MSFT) so much.

Its simply because its hard to explain. When you are using Microsoft Windows, let's say XP because that's what I am forced to use, you get the overwhelming sense of misplacement. Things don't function as they should, icons, toolbars, and menus feel out of place and not well constructed. The whole OS just feels like a kludge. Like it was designed by a commitee, on a white board, and no one in the room was told "no" to any idea.

Installing apps is insane. Next, next, next, agree, ok, next, done, reboot (sometimes). Now yes there are a bunch of mac programs that do the same thing, especially the ones from Apple itself but I think the apps that really get it right on the Mac platform are the ones that, when you download them, they automount and present you with two icons. The one for the program you just downloaded, and a shortcut icon for the Applications folder. All you have to do is a one second drag and drop from left to right. The program installs. Done.

That's the way it should be.

This article that I just read really hits the nail in the head. I enjoyed reading it it prompted many of the thoughts that I just wrote up there. So excuse if you read some redundancy.

Take a read. Its a great article.

Wordpress plugin exploit

Wordpress seems to be getting it's butt kicked lately with all the xploits that are coming out for it and it's plugins. In a new one just published to milw0rm today, this one deals with "Simple Forum". I guess there is no rest for the exploit writers out there, even if this one does seem rather weak. Especially when the tag line at the bottom of the exploit reads: "i AM NOT HACKER". Instead of the much better "I am not A hacker". It's all in the details.

The Difference between two operating systems

Often I am critized because I rave on and on about the Mac platform and constantly put down Microsoft without ever actually saying why I hate (MSFT) so much.

Its simply because its hard to explain. When you are using Microsoft Windows, let's say XP because that's what I am forced to use, you get the overwhelming sense of misplacement. Things don't function as they should, icons, toolbars, and menus feel out of place and not well constructed. The whole OS just feels like a kludge. Like it was designed by a commitee, on a white board, and no one in the room was told "no" to any idea.

Installing apps is insane. Next, next, next, agree, ok, next, done, reboot (sometimes). Now yes there are a bunch of mac programs that do the same thing, especially the ones from Apple itself but I think the apps that really get it right on the Mac platform are the ones that, when you download them, they automount and present you with two icons. The one for the program you just downloaded, and a shortcut icon for the Applications folder. All you have to do is a one second drag and drop from left to right. The program installs. Done.

That's the way it should be.

This article that I just read really hits the nail in the head. I enjoyed reading it it prompted many of the thoughts that I just wrote up there. So excuse if you read some redundancy.

Take a read. Its a great article.

Teen hax0rs iPhone. Again.

In the quest for people to keep hacking the iPhone (at least, I guess party until the SDK comes out), the Register is running an article about a teen that has re-hacked the iPhone on the new 1.1.3 firmware.  Except this time it wasn't like exploiting the tiff flaw.  This was much harder.

Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."

When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone.  However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.

>People want to be able to take their phones to other networks.  I have a buddy of mine that has his on T-Mobile.

But I know alot of people that have hacked their iPhones for the apps.  I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone.  That's all I wanted.  After I got that, there really wasn't any other apps I was interested in.

There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.

If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.

Teen hax0rs iPhone. Again.

In the quest for people to keep hacking the iPhone (at least, I guess party until the SDK comes out), the Register is running an article about a teen that has re-hacked the iPhone on the new 1.1.3 firmware.  Except this time it wasn't like exploiting the tiff flaw.  This was much harder.

Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."

When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone.  However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.

>People want to be able to take their phones to other networks.  I have a buddy of mine that has his on T-Mobile.

But I know alot of people that have hacked their iPhones for the apps.  I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone.  That's all I wanted.  After I got that, there really wasn't any other apps I was interested in.

There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.

If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.

Handler posting

I was the Handler of the Day today at the ISC.  I posted absolutely nothing.  I apologize to you all that were expecting me to write something.  I was very busy today with work related stuff, and to be honest, not much came into the ISC today that we haven't already seen or posted about.  I would say about 90% of the emails that came in today (100+) were about the Trend Micro whoopsie.  Out of the remaining 10%, I'd say a bunch were about the Adobe vulnerabilities.  Two things we have written about already, so, not much to say today.

I had to work with Snort, some rules, and a few pcaps today for a customer.  So I am tired ;)

In Apple's quest to update, um, pretty much every thing they have, Apple TV's update has hit the streets as well.  Apple is on a roll.

Apple releases Apple TV "Take 2" software update

Apple on Tuesday quietly released its much-anticipated Apple TV "Take 2" software update, which introduces a brand new on-sreen interface and allows users to rent high definition movies directly from their widescreen TVs. The update is available f...

URL: http://www.appleinsider.com/article.php?id=3740

iLife Support Update 8.2

Apple is cranking out the updates recently.  Wow!  This is probably the third or forth upgrade in the past week.  Go ahead Apple!

Apple describes this one as: "This update supports system software components shared by all iLife ’08 applications to improve their stability and performance. "

 Subscribe in a reader

In Apple's quest to update, um, pretty much every thing they have, Apple TV's update has hit the streets as well.  Apple is on a roll.

Apple releases Apple TV "Take 2" software update

Apple on Tuesday quietly released its much-anticipated Apple TV "Take 2" software update, which introduces a brand new on-sreen interface and allows users to rent high definition movies directly from their widescreen TVs. The update is available f...

URL: http://www.appleinsider.com/article.php?id=3740

Leopard Graphics Update

I received an email today at the ISC talking about the Quicktime update and I thought to myself "there is another one? Didn't we just get Quicktime 7.4.1?"  So I clicked on Software Update to see if there was, turns out, no, there wasn't a new Quicktime Update, but there is an update called "Leopard Graphics Update" which is downloading right now to my machine.

So, aside from the 10.5.2 that rolled out last night, there is also the Leopard Graphics Update.  So make sure you grab that one as well.

 Subscribe in a reader

SC Magazine Interview

I was contacted today by a writer for SC Magazine named Dan Kaplan.   He wanted me to shed some light on what I thought about the OSX update that just came out and specifically, if I thought that OSX would become increasingly a target for future vulnerabilities as Apple's Market Share continued to go up.

The article is live and you can get to it here.  Thanks Dan for putting in a few of my comments.  However, I wrote, practically a whole blog entry for him (overkill I guess ;), and thought that I should post what I wrote to him on the blog here.

Feel free to comment.

"The patches really strike me as Apple listening to it's users and really taking it's competition in the OS space to heart. Apple has always prided itself on being different yet being able to implement functionality in a coherent product. They have realized that it's not about the features of the OS, or trying to make it "pretty", it's about how the user approaches the product. How can they make it easier and make it an easy product to use and figure out.

Along the lines of listening to it's users -- a lot of people didn't like Stacks, (the fan), they liked the list format that was popular in Tiger. So Apple put that back in. Some people didn't like the translucent menu bar, so Apple gave you a way to turn it off. There was no obvious way to tell when a Time Machine backup last occurred without opening System Preferences and looking it up. Or there was no way to tell when a backup was taking place. So Apple put an icon in the menu bar to tell you. Taking it a step further, even allowing you to click on "Back Up Now", forcing the backup. Figuring out better interoperability with 3rd party routers with Back to My Mac and iChat. Figuring out how to make a consistent user experience. All of this to me shows that Apple is listening to their users, making features that users really like present in the product.

Apple furthermore having the Leopard Graphics Update come out really shows where Apple shines. Having the hardware and software coupled together allows Apple to maintain a better user experience for their customers. The ability to upgrade drivers through a patch, pushed down from the vendor, without the user having to go to 30 different sites to update their BIOS, their graphics drivers, their OS patches, etc... This really makes for a consistent user experience. The ability for Apple users to get ALL of their updates in the SAME place, just by going to Software Update. It's priceless in my opinion. I'd like to see more convergence in this space as well. The ability for a user to click on Software Update, and not only get patches for OSX, but also for third party applications, such as Firefox or Thunderbird even the Cisco VPN client. Having all these updates come from a single location would be ideal.

As for the security updates, of course, as OSX gains market share, it will become increasingly a target. That is inevitable. However, Apple has made the decision in the past to kill legacy hardware and software. They killed off an entire OS! (OS 9 -- Classic) Sometimes at the detriment of their users. However, they don't have to deal with driver issues and hardware/software issues that Windows has been plagued with for years. Windows has had to drag all this old code along in each of their OS updates, and while Microsoft has made a lot of progress in recent years with the security of it's platform, the same old Spyware, Malware, Trojans, Worms, and Viruses are still a problem. I believe that OSX increasingly will be in the crosshairs of the malware/spyware/trojans/worm/virus/exploit writers, and there is recent evidence of this when it comes to the Safari browser and Quicktime. Apple has been dealing a lot better with the community and those that find vulnerabilities in OSX, communicating better between researchers and the Product Security Department.

Apple also integrates alot of Open Source code into their Operating System, take a patch for Samba that just came out with the 10.5.2 (Security Update 2008-0001). Samba is a piece of Open Source code that allows for interoperability with Windows networks. While the vulnerability isn't one of Apple's, but that of Samba's. Apple integrates Samba's code, so Apple is also responsible for patching OSX as well. "

 Subscribe in a reader

iLife Support Update 8.2

Apple is cranking out the updates recently.  Wow!  This is probably the third or forth upgrade in the past week.  Go ahead Apple!

Apple describes this one as: "This update supports system software components shared by all iLife ’08 applications to improve their stability and performance. "

 Subscribe in a reader

Leopard Graphics Update

I received an email today at the ISC talking about the Quicktime update and I thought to myself "there is another one? Didn't we just get Quicktime 7.4.1?"  So I clicked on Software Update to see if there was, turns out, no, there wasn't a new Quicktime Update, but there is an update called "Leopard Graphics Update" which is downloading right now to my machine.

So, aside from the 10.5.2 that rolled out last night, there is also the Leopard Graphics Update.  So make sure you grab that one as well.

 Subscribe in a reader

Mac OSX 10.5.2 and Security Update 2008-0001 hit the streets

Listed below are all the updates for Leopard 10.5.2 and Security Update 2008-0001.  All in all, this is a much needed and timely update.  All in all, it looks to be huge.  (Downloading right now on my MacBook Pro, the size shows 180 Mb.

Active Directory

• Addresses issues which could hinder or prevent binding Mac OS X 10.5.x clients to Active Directory domains.

AirPort

• Improves connection reliability and stability
• Includes 802.1X improvements.
• Resolves certain kernel panics.

Back to my Mac

• Adds support for more third-party routers, as detailed in this article.

Dashboard

• Improves performance of certain Apple Dashboard widgets (such as Dictionary).
• Addresses an issue in which Dashboard widgets may no longer be accessible after switching to or from an account that has Parental Controls enabled.

Dock

• Updates Stacks with a List view option, a Folder view option, and an updated background for Grid view.

Desktop

• Addresses legibility issues with the menu bar with an option to turn off transparency in Desktop & Screen Saver preferences.
• Adjusts menus to be slightly-less translucent overall.

iCal

• Improves iCal so that it accurately reflects responses to recurring meetings.
• Addresses an issue in which a meeting may remain on the calendar after being cancelled.
• Addresses stability issues related to .Mac syncing of iCal calendars.
• Resolves an intermittent issue in which editing an event with attendees would cause the event to shrink and not register that the event was updated.

iChat

• Addresses an issue with simultaneously-logged in accounts in which iChat sounds generated from one account might be heard in another account.
• Fixes an issue in which iChat idle time is affected by Time Machine backups.
• Improves connectivity when running iChat behind a router that doesn’t preserve ports.
• Enables logged chats from previous versions of iChat to open faster and more reliably.
• Addresses an issue with text chats in which users may be unable to receive messages from the sender.
• Addresses an issue that may prevent rejoining an AIM chat room without reopening iChat.
• Addresses video chat compatibility issues with AIM 6 and third-party routers.
• Fixes an issue with case-sensitivity of AIM handles.

iSync

• Adds support for Samsung D600E and D900i phones.

Finder

• Addresses an issue in which Finder could unexpectedly quit when displaying folder contents in Column view.
• Addresses an issue in which Finder could unexpectedly quit when accessing Users and Groups in a Get Info pane.
• Resolves an issue that prevented setting permissions on a folder alias.
• Resolves an issue in which the Eject command could write to a disc in the optical drive.
• Fixes an issue in which the scroll bar might disappear when deleting a file within a folder that includes files that are out of view.
• Fixes an issue in the Sharing & Permissions section of Get Info windows, in which the gear icon appears to be gray/disabled after authentication.
• Addresses an issue in which the Show Icon Preview preference might not be not saved when turning it off.
• Fixes an issue that could occur when trying to print an image from the Finder. 

Mail

• Addresses an issue with Message menu's "Mark As Read" choice.
• Fixes an issue in which duplicate On My Mac folders may appear in the sidebar after upgrading to Leopard.
• Improves the accuracy of the Data Detectors feature.
• Resolves an issue with scrolling through a Note that is displayed using the split view in the message window.
• Fixes an issue with deleting messages located in the Drafts folder.
• Fixes an issue in which dragging the icon in the Safari URL field into a Mail message creates an attachment instead of a link.
• Addresses an issue found when opening a item in the Notes folder that is not a Note.
• Fixes an issue that may prevent RSS feeds from being delivered in Mail.
• Resolves an issue in which a selected message could "flash" from blue to gray when in Organize by Thread mode.
• Fixes an issue with scrolling between multiple To Dos in an email message.
• Fixes an issue in which the body of email messages with certain MIME structures may not be displayed.
• Improves performance with America Online (AOL) account-based messages in Mail.
• Addresses issues with some ISPs during automatic set-up in Mail.
• Addresses an issue in which Mail might not send mail on some networks to some SMTP servers.
• Mail now automatically disables the (unsupported) third-party plugin GrowlMail version 1.1.2 or earlier to avoid issues.
• Adds an option to view large icons in the Mailbox list.

Networking

• Addresses a hanging issue that may occur when connecting to an AFP network volume.

Parental Controls

• Improves stability when opening the Parental Controls System Preferences pane.
• Fixes an issue that may prevent changes to the email address for permission requests.
• Addresses an issue with printer administration for a guest account enabled with Parental Controls.
• Addresses an issue with setting printer administration privileges from another Mac on the local network.
• Fixes an issue that could prevent certain applications from being allowed.
• Addresses accuracy issues with the web content filter. 

Preview

• Improves stability when scrolling through a PDF document.
• Fixes an issue that prevents tabbing within a PDF document after clicking on the PDF.
• Improves the Mail Document feature so that email attachments are more reliably created from Print Preview. 

Printing

• Addresses an issue in which remote printers may be deleted when the computer is put to sleep.
• Improves printing performance when using some Microsoft Office applications.
• Resolves an issue with some printing options, such as landscape orientation, number of copies, two-sided printing, and so forth that may not have functioned with some printers shared by Microsoft Windows.
• Adds support for certain printers connected to the USB port of an AirPort Extreme or AirPort Express base station.
• Resolves a stalling issue that could occur when installing certain Canon printing software from a disc.

RAW Image

• Adds RAW image support for several cameras, as detailed in this article.

Safari

• Addresses issues with Safari reliably resolving certain domains.

Login and Setup Assistant

• Addresses an issue in which Setup Assistant could unexpectedly appear each time Mac OS X 10.5 starts up.
• Improves stability and performance during log in.

System

• Improves the accuracy of the grammar checker.
• The computer will now shut down if an automatic disk repair does not succeed during startup. 

Time Machine

• Adds a menu bar option for accessing Time Machine features (the menu extra can be enabled in Time Machine preferences).
• Improves backup reliability when computer name contains slash or non-ASCII characters.
• Fixes an issue in which the backup disk displayed in the Finder may be out of sync with the disk chosen for Time Machine.
• Addresses issues in which some external drives are not recognized by Time Machine.
• The status menu now appears by default.

Other

• Improves general stability when running third-party applications.
• Addresses an issue in which the incorrect search results may be displayed for certain Automator Find/Filter actions.
• Addresses an issue with the Latvian and Russian keyboard layouts.
• Addresses an issue in which the backlight could turn off before Energy Saver's backlight setting.

And as for Security Update 2008-0001

Mac OS X v10.5.2 / Security Update 2008-001

• Directory Services

  CVE-ID: CVE-2007-0355

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

  Impact: A local user may be able to execute arbitrary code with system privileges

  Description: A stack buffer overflow exists in the Service Location Protocol (SLP) daemon, which may allow a local user to execute arbitrary code with system privileges. This update addresses the issue through improved bounds checking. This has been described on the Month of Apple Bugs web site (MOAB-17-01-2007). This issue does not affect systems running Mac OS X v10.5 or later. Credit to Kevin Finisterre of Netragard for reporting this issue.

• Foundation

  CVE-ID: CVE-2008-0035

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Accessing a maliciously crafted URL may lead to an application termination or arbitrary code execution

  Description: A memory corruption issue exists in Safari's handling of URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.5.

• Launch Services

  CVE-ID: CVE-2008-0038

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: An application removed from the system may still be launched via the Time Machine backup

  Description: Launch Services is an API to open applications or their document files or URLs in a way similar to the Finder or the Dock. Users expect that uninstalling an application from their system will prevent it from being launched. However, when an application has been uninstalled from the system, Launch Services may allow it to be launched if it is present in a Time Machine backup. This update addresses the issue by not allowing applications to be launched directly from a Time Machine backup. This issue does not affect systems prior to Mac OS X v10.5. Credit to Steven Fisher of Discovery Software Ltd. and Ian Coutier for reporting this issue.

• Mail

  CVE-ID: CVE-2008-0039

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

  Impact: Accessing a URL in a message may lead to arbitrary code execution

  Description: An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This update addresses the issue by displaying the location of the file in Finder rather than launching it. This issue does not affect systems running Mac OS X v10.5 or later.

• NFS

  CVE-ID: CVE-2008-0040

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: If the system is being used as an NFS client or server, a remote attacker may cause an unexpected system shutdown or arbitrary code execution

  Description: A memory corruption issue exists in NFS's handling of mbuf chains. If the system is being used as an NFS client or server, a malicious NFS server or client may be able to cause an unexpected system shutdown or arbitrary code execution. This update addresses the issue through improved handling of mbuf chains. This issue does not affect systems prior to Mac OS X v10.5. Credit to Oleg Drokin of Sun Microsystems for reporting this issue.

• Open Directory

  Available for: Mac OS X v10.4.11, Mac OS X v10.4.11 Server

  Impact: NTLM authentication requests may always fail

  Description: This update addresses a non-security issue introduced in Mac OS X v10.4.11. An race condition in Open Directory's Active Directory plug-in may terminate the operation of winbindd, causing NTLM authentications to fail. This update addresses the issue by correcting the race condition that could terminate winbindd. This issue only affects Mac OS X v10.4.11 systems configured for use with Active Directory.

• Parental Controls

  CVE-ID: CVE-2008-0041

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Requesting to unblock a website leads to information disclosure

  Description: When set to manage web content, Parental Controls will inadvertently contact www.apple.com when a website is unblocked. This allows a remote user to detect the machines running Parental Controls. This update addresses the issue by removing the outgoing network traffic when a website is unblocked. This issue does not affect systems prior to Mac OS X v10.5. Credit to Jesse Pearson for reporting this issue.

• Samba

  CVE-ID: CVE-2007-6015

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution

  Description: A stack buffer overflow may occur in Samba when processing certain NetBIOS Name Service requests. If a system is explicitly configured to allow "domain logons", an unexpected application termination or arbitrary code execution could occur when processing a request. Mac OS X Server systems configured as domain controllers are also affected. This update addresses the issue by applying the Samba patch. Further information is available via the Samba web site at http://www.samba.org/samba/history/security.html Credit to Alin Rad Pop of Secunia Research for reporting this issue.

• Terminal

  CVE-ID: CVE-2008-0042

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution

  Description: An input validation issue exists in the processing of URL schemes handled by Terminal.app. By enticing a user to visit a maliciously crafted web page, an attacker may cause an application to be launched with controlled command line arguments, which may lead to arbitrary code execution. This update addresses the issue through improved validation of URLs. Credit to Olli Leppanen of Digital Film Finland and Brian Mastenbrook for reporting this issue.

• X11

  CVE-ID: CVE-2007-4568

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Multiple Vulnerabilities exist in X11 X Font Server (XFS) 1.0.4

  Description: Multiple vulnerabilities in X11 X Font Server (XFS), the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to version 1.0.5. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security

• X11

  CVE-ID: CVE-2008-0037

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Changing the settings in the Security Preferences Panel has no effect

  Description: The X11 server is not reading correctly its "Allow connections from network client" preference, which can cause the X11 server to allow connections from network clients, even when the preference is turned off. This update addresses the issue by ensuring the X11 server reads its preferences correctly. This issue does not affect systems prior to Mac OS X v10.5.

  
  

 Subscribe in a reader

Handler Shift on Wednesday

Looks like I am the Handler for the Internet Storm Center on Wednesday.  The day after 12 patches hit the intarwebz from (MSFT).   I don't do alot of postings (read: usually any) during the day when I am on shift, (because I am working!) and on Wednesdays there is usually so much email we have a hard time keeping up.  

Everyone writing in asking why the ISC rated something Critical, when it's not.  (BTW -- it takes alot for us to make a determination between Client and Server).  If you don't know what I am talking about, tune in tomorrow around noon EST.  You'll see.

 Subscribe in a reader

Mac OSX 10.5.2 and Security Update 2008-0001 hit the streets

Listed below are all the updates for Leopard 10.5.2 and Security Update 2008-0001.  All in all, this is a much needed and timely update.  All in all, it looks to be huge.  (Downloading right now on my MacBook Pro, the size shows 180 Mb.

Active Directory

• Addresses issues which could hinder or prevent binding Mac OS X 10.5.x clients to Active Directory domains.

AirPort

• Improves connection reliability and stability
• Includes 802.1X improvements.
• Resolves certain kernel panics.

Back to my Mac

• Adds support for more third-party routers, as detailed in this article.

Dashboard

• Improves performance of certain Apple Dashboard widgets (such as Dictionary).
• Addresses an issue in which Dashboard widgets may no longer be accessible after switching to or from an account that has Parental Controls enabled.

Dock

• Updates Stacks with a List view option, a Folder view option, and an updated background for Grid view.

Desktop

• Addresses legibility issues with the menu bar with an option to turn off transparency in Desktop & Screen Saver preferences.
• Adjusts menus to be slightly-less translucent overall.

iCal

• Improves iCal so that it accurately reflects responses to recurring meetings.
• Addresses an issue in which a meeting may remain on the calendar after being cancelled.
• Addresses stability issues related to .Mac syncing of iCal calendars.
• Resolves an intermittent issue in which editing an event with attendees would cause the event to shrink and not register that the event was updated.

iChat

• Addresses an issue with simultaneously-logged in accounts in which iChat sounds generated from one account might be heard in another account.
• Fixes an issue in which iChat idle time is affected by Time Machine backups.
• Improves connectivity when running iChat behind a router that doesn’t preserve ports.
• Enables logged chats from previous versions of iChat to open faster and more reliably.
• Addresses an issue with text chats in which users may be unable to receive messages from the sender.
• Addresses an issue that may prevent rejoining an AIM chat room without reopening iChat.
• Addresses video chat compatibility issues with AIM 6 and third-party routers.
• Fixes an issue with case-sensitivity of AIM handles.

iSync

• Adds support for Samsung D600E and D900i phones.

Finder

• Addresses an issue in which Finder could unexpectedly quit when displaying folder contents in Column view.
• Addresses an issue in which Finder could unexpectedly quit when accessing Users and Groups in a Get Info pane.
• Resolves an issue that prevented setting permissions on a folder alias.
• Resolves an issue in which the Eject command could write to a disc in the optical drive.
• Fixes an issue in which the scroll bar might disappear when deleting a file within a folder that includes files that are out of view.
• Fixes an issue in the Sharing & Permissions section of Get Info windows, in which the gear icon appears to be gray/disabled after authentication.
• Addresses an issue in which the Show Icon Preview preference might not be not saved when turning it off.
• Fixes an issue that could occur when trying to print an image from the Finder. 

Mail

• Addresses an issue with Message menu's "Mark As Read" choice.
• Fixes an issue in which duplicate On My Mac folders may appear in the sidebar after upgrading to Leopard.
• Improves the accuracy of the Data Detectors feature.
• Resolves an issue with scrolling through a Note that is displayed using the split view in the message window.
• Fixes an issue with deleting messages located in the Drafts folder.
• Fixes an issue in which dragging the icon in the Safari URL field into a Mail message creates an attachment instead of a link.
• Addresses an issue found when opening a item in the Notes folder that is not a Note.
• Fixes an issue that may prevent RSS feeds from being delivered in Mail.
• Resolves an issue in which a selected message could "flash" from blue to gray when in Organize by Thread mode.
• Fixes an issue with scrolling between multiple To Dos in an email message.
• Fixes an issue in which the body of email messages with certain MIME structures may not be displayed.
• Improves performance with America Online (AOL) account-based messages in Mail.
• Addresses issues with some ISPs during automatic set-up in Mail.
• Addresses an issue in which Mail might not send mail on some networks to some SMTP servers.
• Mail now automatically disables the (unsupported) third-party plugin GrowlMail version 1.1.2 or earlier to avoid issues.
• Adds an option to view large icons in the Mailbox list.

Networking

• Addresses a hanging issue that may occur when connecting to an AFP network volume.

Parental Controls

• Improves stability when opening the Parental Controls System Preferences pane.
• Fixes an issue that may prevent changes to the email address for permission requests.
• Addresses an issue with printer administration for a guest account enabled with Parental Controls.
• Addresses an issue with setting printer administration privileges from another Mac on the local network.
• Fixes an issue that could prevent certain applications from being allowed.
• Addresses accuracy issues with the web content filter. 

Preview

• Improves stability when scrolling through a PDF document.
• Fixes an issue that prevents tabbing within a PDF document after clicking on the PDF.
• Improves the Mail Document feature so that email attachments are more reliably created from Print Preview. 

Printing

• Addresses an issue in which remote printers may be deleted when the computer is put to sleep.
• Improves printing performance when using some Microsoft Office applications.
• Resolves an issue with some printing options, such as landscape orientation, number of copies, two-sided printing, and so forth that may not have functioned with some printers shared by Microsoft Windows.
• Adds support for certain printers connected to the USB port of an AirPort Extreme or AirPort Express base station.
• Resolves a stalling issue that could occur when installing certain Canon printing software from a disc.

RAW Image

• Adds RAW image support for several cameras, as detailed in this article.

Safari

• Addresses issues with Safari reliably resolving certain domains.

Login and Setup Assistant

• Addresses an issue in which Setup Assistant could unexpectedly appear each time Mac OS X 10.5 starts up.
• Improves stability and performance during log in.

System

• Improves the accuracy of the grammar checker.
• The computer will now shut down if an automatic disk repair does not succeed during startup. 

Time Machine

• Adds a menu bar option for accessing Time Machine features (the menu extra can be enabled in Time Machine preferences).
• Improves backup reliability when computer name contains slash or non-ASCII characters.
• Fixes an issue in which the backup disk displayed in the Finder may be out of sync with the disk chosen for Time Machine.
• Addresses issues in which some external drives are not recognized by Time Machine.
• The status menu now appears by default.

Other

• Improves general stability when running third-party applications.
• Addresses an issue in which the incorrect search results may be displayed for certain Automator Find/Filter actions.
• Addresses an issue with the Latvian and Russian keyboard layouts.
• Addresses an issue in which the backlight could turn off before Energy Saver's backlight setting.

And as for Security Update 2008-0001

Mac OS X v10.5.2 / Security Update 2008-001

• Directory Services

  CVE-ID: CVE-2007-0355

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

  Impact: A local user may be able to execute arbitrary code with system privileges

  Description: A stack buffer overflow exists in the Service Location Protocol (SLP) daemon, which may allow a local user to execute arbitrary code with system privileges. This update addresses the issue through improved bounds checking. This has been described on the Month of Apple Bugs web site (MOAB-17-01-2007). This issue does not affect systems running Mac OS X v10.5 or later. Credit to Kevin Finisterre of Netragard for reporting this issue.

• Foundation

  CVE-ID: CVE-2008-0035

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Accessing a maliciously crafted URL may lead to an application termination or arbitrary code execution

  Description: A memory corruption issue exists in Safari's handling of URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.5.

• Launch Services

  CVE-ID: CVE-2008-0038

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: An application removed from the system may still be launched via the Time Machine backup

  Description: Launch Services is an API to open applications or their document files or URLs in a way similar to the Finder or the Dock. Users expect that uninstalling an application from their system will prevent it from being launched. However, when an application has been uninstalled from the system, Launch Services may allow it to be launched if it is present in a Time Machine backup. This update addresses the issue by not allowing applications to be launched directly from a Time Machine backup. This issue does not affect systems prior to Mac OS X v10.5. Credit to Steven Fisher of Discovery Software Ltd. and Ian Coutier for reporting this issue.

• Mail

  CVE-ID: CVE-2008-0039

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

  Impact: Accessing a URL in a message may lead to arbitrary code execution

  Description: An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This update addresses the issue by displaying the location of the file in Finder rather than launching it. This issue does not affect systems running Mac OS X v10.5 or later.

• NFS

  CVE-ID: CVE-2008-0040

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: If the system is being used as an NFS client or server, a remote attacker may cause an unexpected system shutdown or arbitrary code execution

  Description: A memory corruption issue exists in NFS's handling of mbuf chains. If the system is being used as an NFS client or server, a malicious NFS server or client may be able to cause an unexpected system shutdown or arbitrary code execution. This update addresses the issue through improved handling of mbuf chains. This issue does not affect systems prior to Mac OS X v10.5. Credit to Oleg Drokin of Sun Microsystems for reporting this issue.

• Open Directory

  Available for: Mac OS X v10.4.11, Mac OS X v10.4.11 Server

  Impact: NTLM authentication requests may always fail

  Description: This update addresses a non-security issue introduced in Mac OS X v10.4.11. An race condition in Open Directory's Active Directory plug-in may terminate the operation of winbindd, causing NTLM authentications to fail. This update addresses the issue by correcting the race condition that could terminate winbindd. This issue only affects Mac OS X v10.4.11 systems configured for use with Active Directory.

• Parental Controls

  CVE-ID: CVE-2008-0041

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Requesting to unblock a website leads to information disclosure

  Description: When set to manage web content, Parental Controls will inadvertently contact www.apple.com when a website is unblocked. This allows a remote user to detect the machines running Parental Controls. This update addresses the issue by removing the outgoing network traffic when a website is unblocked. This issue does not affect systems prior to Mac OS X v10.5. Credit to Jesse Pearson for reporting this issue.

• Samba

  CVE-ID: CVE-2007-6015

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution

  Description: A stack buffer overflow may occur in Samba when processing certain NetBIOS Name Service requests. If a system is explicitly configured to allow "domain logons", an unexpected application termination or arbitrary code execution could occur when processing a request. Mac OS X Server systems configured as domain controllers are also affected. This update addresses the issue by applying the Samba patch. Further information is available via the Samba web site at http://www.samba.org/samba/history/security.html Credit to Alin Rad Pop of Secunia Research for reporting this issue.

• Terminal

  CVE-ID: CVE-2008-0042

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution

  Description: An input validation issue exists in the processing of URL schemes handled by Terminal.app. By enticing a user to visit a maliciously crafted web page, an attacker may cause an application to be launched with controlled command line arguments, which may lead to arbitrary code execution. This update addresses the issue through improved validation of URLs. Credit to Olli Leppanen of Digital Film Finland and Brian Mastenbrook for reporting this issue.

• X11

  CVE-ID: CVE-2007-4568

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Multiple Vulnerabilities exist in X11 X Font Server (XFS) 1.0.4

  Description: Multiple vulnerabilities in X11 X Font Server (XFS), the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to version 1.0.5. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security

• X11

  CVE-ID: CVE-2008-0037

  Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1

  Impact: Changing the settings in the Security Preferences Panel has no effect

  Description: The X11 server is not reading correctly its "Allow connections from network client" preference, which can cause the X11 server to allow connections from network clients, even when the preference is turned off. This update addresses the issue by ensuring the X11 server reads its preferences correctly. This issue does not affect systems prior to Mac OS X v10.5.

  
  

 Subscribe in a reader

YHOO says No to MSFT

Nothing to see here.  (YHOO) says "Nope" to (MSFT).  

Now, (MSFT) has a couple options here.  It can say "Hey, wait, how about some more money?"  Which they possibly could do, but they already borrowing money to buy (YHOO) at their present offered price. 

Or they could offer the proposal to (YHOO)'s stockholders and go that way, but then you'd have to oust the board at (YHOO).  The same board that just rejected the deal.  Good luck.

 Subscribe in a reader

Handler Shift on Wednesday

Looks like I am the Handler for the Internet Storm Center on Wednesday.  The day after 12 patches hit the intarwebz from (MSFT).   I don't do alot of postings (read: usually any) during the day when I am on shift, (because I am working!) and on Wednesdays there is usually so much email we have a hard time keeping up.  

Everyone writing in asking why the ISC rated something Critical, when it's not.  (BTW -- it takes alot for us to make a determination between Client and Server).  If you don't know what I am talking about, tune in tomorrow around noon EST.  You'll see.

 Subscribe in a reader

YHOO says No to MSFT

Nothing to see here.  (YHOO) says "Nope" to (MSFT).  

Now, (MSFT) has a couple options here.  It can say "Hey, wait, how about some more money?"  Which they possibly could do, but they already borrowing money to buy (YHOO) at their present offered price. 

Or they could offer the proposal to (YHOO)'s stockholders and go that way, but then you'd have to oust the board at (YHOO).  The same board that just rejected the deal.  Good luck.

 Subscribe in a reader

MSFT posts 3 part series on ActiveX killbits

Recently a few ActiveX exploits came out (and lots in the past) where the exploit could be mitigated by setting the "killbit" in your registry in Windows.   We've talked about it alot at the Internet Storm Center, the ability to possibly mitigate potential client side exploits by not allowed IE to process ActiveX controls.

There is alot of confusion about what this means on behalf of the user.  Well the (MSFT) Technet bloggers have put out a 3 part series about what this means.  It's worth a read.  Take a look here.

Or, don't use IE.  Probably safer that way.  I have an operating system I can suggest you switch to!

;)

 Subscribe in a reader

12 MSFT Bulletins next week

In what promises to be a long night for security researchers, next Tuesday, MSFT Tuesday (Black Tuesday -- the day before Reboot Wednesday), MSFT promises to have 12 (count em) security bulletins to put out.  7 of which are critical.  Looks 5 of the total 12 are for Office.  1 for Internet Explorer, and 2 for IIS.  (The IIS ones should be interesting).

I can't fault you (MSFT) guys though.  I've had 4 or 5 patches to install this week on my Mac machines (only 1 of which was a security update).

 Subscribe in a reader

Hot on the heels

On the heels of my discussion about why OS X and Linux are inherently more secure than Windows.   These guys over at Risesecurity.org have to go and root a Asus EEEPC.  Damn them.    

Running a vulnerable version of Samba.  Of course, it's easy to slam Asus and say "you should be patching your systems before you ship them".  Right?  Uh, right!  So wtf!?

 Subscribe in a reader

What are your distractions?

Part 3 of 3 of my self question series.  What are your distractions?

What makes your job harder?  Are you pressured to answer your Email as soon as you get it?  Are you pressured to complete a project given no milestones or end goal?  How many projects are you working on?  GTD says the most projects you can track in your head at a time is 7.  Do you have more than that?   Can you work on multiple projects at a time?  

Can you cut back anywhere?  Can you delegate any of your projects to other people?  Is it possible for you to get help on your projects from other people?  Why are you doing the project?  Because everyone else is incompetent?  Because it's your job?  Because you are being relied on more heavily then the other people in your department?

Can you focus on one thing at a time?  Is your mind Multithreaded or Single Threaded?

 Subscribe in a reader

12 MSFT Bulletins next week

In what promises to be a long night for security researchers, next Tuesday, MSFT Tuesday (Black Tuesday -- the day before Reboot Wednesday), MSFT promises to have 12 (count em) security bulletins to put out.  7 of which are critical.  Looks 5 of the total 12 are for Office.  1 for Internet Explorer, and 2 for IIS.  (The IIS ones should be interesting).

I can't fault you (MSFT) guys though.  I've had 4 or 5 patches to install this week on my Mac machines (only 1 of which was a security update).

 Subscribe in a reader

Hot on the heels

On the heels of my discussion about why OS X and Linux are inherently more secure than Windows.   These guys over at Risesecurity.org have to go and root a Asus EEEPC.  Damn them.    

Running a vulnerable version of Samba.  Of course, it's easy to slam Asus and say "you should be patching your systems before you ship them".  Right?  Uh, right!  So wtf!?

 Subscribe in a reader

Microsoft is Stupid, Apple is Not (I didn't make the title up)

Recently I read a story about how Mac users are stupid and that eventually viruses will kill us all and pillage our warez on the OS X platform.  

While there has been an increase of attacks on the mac platform, most still, are client side.  Attacks against Quicktime, attacks against Safari, Safari on the iPhone, etc..  But they are still client side.  Do I think this is any less of a threat?  No, because you will, no matter what, have dumb users that refuse to patch their machines, not-heed "workarounds" (like turning off rtsp for example), and what not. 

I read this article today entitled "Microsoft is Stupid, Apple is Not" about how Apple conscientiously made the decision awhile back to get rid of the Mac OS and switch to the Unix based (freebsd based for you purists, with a Mach kernel) OS X (or 10 if you like that) that we have now.  While in the meantime Windows has had to deal with legacy software and compatibility with old stuff.  I think it was a great decision, and that's what made me come back to the Mac platform (I used it when I was in high school, OS 7-8 timeframe.  My school was very Mac centric, except for Keyboarding class, and we all know, if you've read my blog for awhile, how keyboarding class turned out.)  I think both articles are worth a read.   I also think that Linux is in the same boat as OS X is in this case.  Security through obscurity?  Maybe.  But I tend to think that the OS itself is more secure.

What do I think?  I think eventually there will be a bigger threat against the Mac Platform, I think it will continue to be mostly client side, I think that occasionally there will be "remote server side" attacks (such as the mDNSResponder exploit against Bonjour), I don't think we'll ever have the big "worm" problems that Windows has been plagued with in the past with Blaster and Code Red and such.  I think Trojans will play a role.  I think Malware and Spyware MIGHT play a roll, but I doubt it.  

I think OS X is inherently "out of the box" more secure than Windows.  (What open ports are on OSX by default?  5353?)  I think OS X's bsd underpinnings will help keep the stack and the permissions of separate users, and the privilege separation that you must have in order to install or modify any "system" settings will keep alot of stuff at bay.  However, you must take into account the "stupid user" factor.  And unfortunately..  that can be high.

 Subscribe in a reader

QuickTime 7.4.1

From Apple's website:

"A heap buffer overflow exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. By enticing a user to visit a maliciously crafted webpage, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking."

It's about ~50 Mb.  I suggest you go ahead and update.  (This is in addition to the iLife and iWeb updates from this week.  Go ahead Apple, update away)

 Subscribe in a reader

QuickTime 7.4.1

From Apple's website:

"A heap buffer overflow exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. By enticing a user to visit a maliciously crafted webpage, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking."

It's about ~50 Mb.  I suggest you go ahead and update.  (This is in addition to the iLife and iWeb updates from this week.  Go ahead Apple, update away)

 Subscribe in a reader

Why were you hired?

In my recent quest to make all things more efficient, I ask the question in the topic.  Why were you hired?  Seriously, sit down, look at your job, look at your job description.  What are you supposed to be doing, now, take that, and compare it with what you are actually spending your time doing these days.

You were hired for a reason, let's remember what that reason was and focus on it.   Were you hired to sit on conference calls?  Were you hired to check your email every five minutes?  Can you get away with checking your email every 15 minutes?  How about 30.  How about twice a day?

How can you get further in your job?  What can you study that will make you better at it?  If you are an IDS analyst, have you studied perl?  TCP/IP?  Snort?  Intrusion theory, pen testing, exploits, reverse shells, shellcode, malware?  Think about these things.  What can you do as part of your daily job to make your job better and be better at it.  Are you inundated with stupid projects?

I just post this in hopes that you'll do a self reflection.  Everyone needs to do this every once in awhile.  Stop, and think about if you are still on task.

 Subscribe in a reader

Using your tools to focus

Recently I've put up a couple posts talking about refocusing on Getting things Done and making sure you are working as efficiently as you can in life.  I've focused on vim, mutt, and Mail.app.  

But what about the other apps?  Outlook being the primary one?  Basically my point in the posts was to get you thinking about what tools you use and what tools can make you more efficient in your life.  Are you using those tools to their fullest potential?  Are you using your to-do system in Outlook?  With yourself?  Are you using it with other people?  How about the calendar?  The Journal feature?  The Note system?  Are you using those?

How do you use your tools.  Can you use them better.  That's what I want to inspire you to think about.  Now, some of you will go, and you will say "hey, Joel has a thought here, let me try and use the to-do's"  But how many of you will reform the way you work around it?  

I challenge you to do so.

The other part of this post is a question for my readers.  Thunderbird.  By show of hands, how many of you use Thunderbird?  Probably alot of you judging by the statistics on my web page hits. (mostly firefox.)  Now, out of those people, how many of you use any GTD plugins for Thunderbird?  Care to share what they are?

 Subscribe in a reader

Apple to buy Yahoo?

According to this article, which, of course cites no sources..  states that Yahoo is comparing a few different offers.  Even admiring one from (aapl).

Money Quote:

"It is believed he would be particularly open to a rescue bid from Steve Jobs' Apple Corp, having openly expressed his admiration for the firm in the past. "

 Subscribe in a reader

Apple to buy Yahoo?

According to this article, which, of course cites no sources..  states that Yahoo is comparing a few different offers.  Even admiring one from (aapl).

Money Quote:

"It is believed he would be particularly open to a rescue bid from Steve Jobs' Apple Corp, having openly expressed his admiration for the firm in the past. "

 Subscribe in a reader

Mail.app in Leopard, GTD, and how I made things a bit more efficient.

I was using (and still do) use Mutt to read my email when I am remote and don't have access to a descent connection.  (Which seems to happen alot to me lately for some reason).  So what I do is ssh back home and run mutt in screen.  Great.  Works fine.  You also may remember from a previous post about how I keep my Next Actions list in Vim on a separate screen.

Welp, I found out two things:

1)  Mutt doesn't render images well, (read: at all) and it's a bit difficult to automate the opening of things via mailcap if you are remote.  Therefore, what good does it do me?  Well the advantage of mutt was the ability to use macros to automatically file things at a push of a button.  Mail.app doesn't have this functionality by default.  Then I watched Merlin Mann's presentation that I have posted on the blog as well, and he turned me onto a program called "Mail Act-On", a free plugin for Mail.app.

Essentially this program allows you to create "macros" for filing your email (or for doing ANYTHING to it, coloring it red, filing it in a folder, flagging it, whatever).  So, I said "hey, let's take a look at how we are doing things here".  Can we make this even more efficient, and better looking.  

I have been using Mail.app since I first started using a Mac and I love it.  It's a simple easy to use Mail client that did what I wanted it to do.  Just in Leopard, it got alot better.  The ability to have Notes and To-Do's, with the ability for To-Do's to sync with iCal was it for me.

So, I got rid of both Mutt (i'll still use it for the above purposes, like I said, but for everyday use, I am going to Mail.app) and my vim outliner next-action items list.

So what did I do?  Well, I created a Note in Notes for every context I have "@home", "@work", "@waiting", "@someday" you get the picture.  In each of these Notes in their appropriate context's I put my Projects.   But this time instead of indenting and using my "--", "?-" system, I just type what I need to do, highlight it, and click on "To-Do".  It makes a nice To-Do and I can set priorities, due dates, even drag these ToDo's into iCal for a specific date and time.

Seemless, much easier and less to maintain.  That's what it should be about.  Don't let your GTD solution run you, you need to be running it.

Bonus feature?  If an email comes in that needs a Todo created out of it, I highlight the text, click To-do, and it's in my system for tracking.  Very nice.

I did ask Apple for two things though their bug system tho.  The ability to Nest To-Do's, and the ability to sync Notes and To-Do's with my iPhone.

Now, alot of people ask me (I get alot of emails about my posts, I think people are afraid of using the comment system.  Which is fine, either way you want to do it, of course I encourage you to use the comment system so that everyone may benefit from your thoughts as well.  Plus it's a great place to put the URL of your blog) how I take my To-Do's with me.  Well, if I am going to the store, and I want the shopping list to go with me, I'll send an email to myself and let it sit in the inbox.  That way I just check my email on my iPhone and there's my list.  

This will all be fixed when Apple implements all the feature requests I have asked for. 

1. To-Do Syncing with Leopard and the iPhone 

2. Notes syncing with Leopard and the iPhone

3. To-Do, Contacts, and Calendar syncing with .Mac

4. Notes Syncing with Stickies (the other notes app in OSX)

5.  The ability to nest to-do's.  (arrange To-Do's by a project)

Hopefully Apple takes some ideas to heart and implements them.  However it won't be good until you can sync all that stuff OTA.  Wirelessly.  Even via Bluetooth would be awesome.  That way I don't have to find a cable, plug it in, yuck.  

I don't want to sync my songs that way, just my contacts, calendars, notes, and todo's!  It would take forever to sync songs and videos.  I don't care.  I just want the ability to be in my office (and my iPhone, which sits in the kitchen), and my wife and I are getting ready to walk out the door, and I can fire up iSync, click Sync, my iPhone syncs with my laptop, and I grab the thing and walk out the door.

 Subscribe in a reader

Getting Things Done (GTD), with David Allen himself.

In addition to my 43folders "Inbox Zero" post from earlier, I am going to post this video as well.  This is David Allen, the creator of GTD (Getting Things Done) of which Merlin Mann (43folders) based his work off of.  If you are interested in either, I suggest a look.

 Subscribe in a reader

Microsoft to buy Yahoo?

Apparently this morning all the news has been about (MSFT) proposing to buy (YHOO).  Seriously.  For 31 dollars a share.  Equally about 44 Billion.

What does this mean for (MSFT)?  Well the company will continue to get bigger and dominate the world.  What does it mean for the flailing (YHOO)?  Well, it means that the competition against (GOOG) just got stronger.  If you had to pick the biggest three search engines, it would be those three companies.  

Still no word on how (GOOG) is reacting to the news, that will be interesting if the deal even pans out.  Right now it's still a proposal.

 Subscribe in a reader

Microsoft to buy Yahoo?

Apparently this morning all the news has been about (MSFT) proposing to buy (YHOO).  Seriously.  For 31 dollars a share.  Equally about 44 Billion.

What does this mean for (MSFT)?  Well the company will continue to get bigger and dominate the world.  What does it mean for the flailing (YHOO)?  Well, it means that the competition against (GOOG) just got stronger.  If you had to pick the biggest three search engines, it would be those three companies.  

Still no word on how (GOOG) is reacting to the news, that will be interesting if the deal even pans out.  Right now it's still a proposal.

 Subscribe in a reader

Inbox Zero

Merlin Mann, who is the author of 43folders.com, presented this talk at Google about Inbox Zero.  Or processing your email.  I suggest a check out.

 Subscribe in a reader

AT&T Wireless Data Outage

Originally posted here.

Thanks all of you that have written in. We have seen the articles that say that AT&T is having a wireless data outage.

We have heard from multiple sources on the issue, and it seems to be limited to only certain regions of the US. (Central and South East primarily). I am currently in the NE section of the country, writing this entry on my AT&T 3G Wireless card. So I know it's working here (plus my iPhone and my wife's Blackberry work fine too).

We have also heard that this problem has been resolved. So everything should be back (if not already) to normal soon.

Subscribe in a reader

AT&T Wireless Data Outage

Originally posted here.

Thanks all of you that have written in. We have seen the articles that say that AT&T is having a wireless data outage.

We have heard from multiple sources on the issue, and it seems to be limited to only certain regions of the US. (Central and South East primarily). I am currently in the NE section of the country, writing this entry on my AT&T 3G Wireless card. So I know it's working here (plus my iPhone and my wife's Blackberry work fine too).

We have also heard that this problem has been resolved. So everything should be back (if not already) to normal soon.

Subscribe in a reader

So, you want RSS feeds in your inbox?

One thing I liked about the new Mail.app in Leopard was the ability to aggregate not only my email, but RSS feeds right into my inbox, so I could just scroll through and read all my feeds in line with my email.

Well, Mutt doesn't do it natively, and I couldn't find a patch in the 10 seconds I was Googling to perform this action.  However, I did find a nice tool called "rss2email".  A program written in python that takes the rss feeds that you give it, reads them, parses them into either plaintext or html, and then sends them to you via whatever smtp server you want.

It works great and I highly recommend it.  All you have to do to automate it is to cron it.  Done.

 Subscribe in a reader

So, you want RSS feeds in your inbox?

One thing I liked about the new Mail.app in Leopard was the ability to aggregate not only my email, but RSS feeds right into my inbox, so I could just scroll through and read all my feeds in line with my email.

Well, Mutt doesn't do it natively, and I couldn't find a patch in the 10 seconds I was Googling to perform this action.  However, I did find a nice tool called "rss2email".  A program written in python that takes the rss feeds that you give it, reads them, parses them into either plaintext or html, and then sends them to you via whatever smtp server you want.

It works great and I highly recommend it.  All you have to do to automate it is to cron it.  Done.

 Subscribe in a reader

Jobs named "most powerful person in business"

We all know by now that I admire Steve Jobs for his taste and vision.

This morning Fortune published an article (via cnn.com) that named Steve Jobs the most "powerful person in business"

Quote: "That's five industries that Jobs has upended - computers, Hollywood, music, retailing, and wireless phones. At this moment, no one has more influence over a broader swath of business than Jobs. "

Also there's a related article.  Expanding upon the point.

 Subscribe in a reader

Jobs named "most powerful person in business"

We all know by now that I admire Steve Jobs for his taste and vision.

This morning Fortune published an article (via cnn.com) that named Steve Jobs the most "powerful person in business"

Quote: "That's five industries that Jobs has upended - computers, Hollywood, music, retailing, and wireless phones. At this moment, no one has more influence over a broader swath of business than Jobs. "

Also there's a related article.  Expanding upon the point.

 Subscribe in a reader

Back to my Mac

I've posted on Back to my Mac before.  Basically the theory of "I think this will be cool, and I'll use it".  Turns out after I got it, I couldn't get it to work.  I had a Linksys router, nice one too, one of the top of the line B/G models (well, top of the line when it came out).   After I read lots of forums on Apple.com saying that you need to enable "UPnP" on the router, and this and that, and do you have portmapping for these ports?  Open this.  Poke a hole here.  Yuck.

Well, this past Friday I got rid of the Linksys router.  I called up my ISP, got some directions for how to switch routers (some ISP's basically have the equivalent of port security on, so you can't change your router.  My ISP in Georgia was like this).  Turns out all I had to do was either have them reset my modem on my end, or I could simply unplug the coax for about 10 minutes while the mac addresses cleared.  Faster to have them reset it, so the nice lady did.

I've had my Airport Wireless Extreme Base station for awhile now but only used it for my macs in order to get full speed to each other.  As I said in this post, I got rid of the Linksys as my gateway and just put the Apple Base station there instead.  (Technically the title of that article is wrong, as I didn't get a "new router".  I just moved it.)

Well, today, being my first day back to work, and more importantly the first time I thought about testing Back to my Mac from an external connection before.  Guess what.  

Plugged in my AT&T 3G wireless cell card today into my laptop when I got to work, and lo and behold -- Back to my Mac worked!  There were all my computers I have here at the house right on my "Sources" list in Finder.  I could connect to them remotely, get files off the disks, use Spotlight on their drives, and even grab ahold of the screen using "Share Screen" and control my Mac's remotely just as advertised!

The best part?  It was actually fast.  I did notice a bit of latency here and there, especially with complex animations (the dock magnification and such).  But otherwise the refresh and display of the apps remotely was fast, and even better, it was useable!

So, for those of you that have problems getting Back to My Mac to work, when it comes to 3rd party routers, I have no advice for you.  But my advice officially is... Buy an Apple Base Station to use as your gateway.   Better yet, wait for Time Capsule to come out that way you have a backup drive on your network.  Good luck!

 Subscribe in a reader