Let's be productive by minimizing clutter Part deux

As usual, when you start dealing with one thing in your life, you tend to narrow in and focus on it. Which is great, however, what if you have several things to do in your life, as most of us do, how do we manage creativity and productivity?

I find myself always on the quest for better productivity and better ways to perform things.

One thing that I find to increase productivity and generally lower stress is to clear. I didn’t say Clean, I said clear.

One of the basic things that is taught, on like Step 1, of Getting Things Done (GTD for those of you that love abbreviations) is to clear and empty. Take everything off your desk, empty your inbox, etc, and then perform actions on everything. Recently I wrote a blog post issuing my New Year’s Challenge to everyone about clearing off your desk and reducing clutter, paper, and digitizing everything you can. Because, you know, how easy is it for you to perform Boolean searches for post it notes?

So here comes the second part of my challenge, assuming you have performed challenge one, clearing off of your desk and surrounding area, hopefully putting things away and digitizing as much as you can, step two has to do with your computer.

Step Two:

Desktop. Your Desktop. I want you to perform this in two steps. First step, is to change your desktop background. Your kids and dog will understand I am sure. Get rid of anything busy, photos, etc. What I want you to start off with is a black background. You can make one in Paint if you are using Windows, if you are using a Mac, I’ll let you get away with Grey just to make life simple. (There is a grey solid color background built into OSX.  Linux users, since you have to compile your own fonts, I think you can figure out how to make your desktop black. BSD users too, since you guys actually have to build your keyboards out of small pieces of a scrabble board and a leftover IBM keyboard without scissor keys....

Rid your desktop of all icons. Okay, I’ll let you have one or two, maybe the trash can, and the Harddrive icon. For Windows users I’ll allow you, say the Recycle Bin, and My Computer, or whatever is on the Windows Desktop nowadays.

Get rid of all your shortcuts (put them in the dock, or the quick launch section of your Task Bar), put your Shortcuts in a stack or something. Better yet, learn to use Butler or Quicksilver and do away with your Shortcuts all together.

Take all your pictures on your desktop and put them in the Pictures folder

Take all your Documents and put them in the Documents folder.

No excuses. Black Background, no icons.

Now, auto hide your Dock, or your Task bar. Get rid of it. You should have One icon maybe two, and no TaskBar/Dock.

For extra credit, you mac users, feel free to use MenuShade to get rid of the Apple Menu (unless you actually use it for things like Google Notifier like I said in a previous post.)

Okay, so now, I want you to work that way for a minimum of two weeks. Nothing on your Desk, Nothing on your Desktop. If you have things like Firefox that dumps your downloads on your Desktop, Create you a “Downloads” folder in your user profile and point Firefox there. Same thing with IE or whatever. OSX already has a downloads folder, tell Firefox to go there.

Two weeks. Make a conscience effort to keep things off your Desk and your Desktop for two weeks. Until it becomes natural. Then give me feed back on how it’s working for you by posting in the comments.

Yes. I do this.

BTW -- This methodology of working does really well with an app like Spirited Away, which auto hides apps.

I’ll explain why you are doing these exercises after my third and final exercise that I ask you to do. But for now, conduct one and two, and work with that for awhile.

To be successful with the “clear Desk” thing, you have to have someplace for people to put things instead of “on your desk”. Try an inbox or a special place on your desk to set things, then train your co-workers, spouse, secretary, and dog to place things in this space.

iWork 2009 Trojan

As I wrote on the Internet Storm Center:

It's already pretty widely reported in the media, take for instance here and here.

First reported by Intego, this trojan apparently is distributed by downloading Bittorrented copies of iWork 2009 from the Internet and installing them. The Trojan is installed as part of the software package, by, yup, you guessed it, you giving the software permissions to install by giving it your password.

Apparently this backdoor opens a hole on your computer, reporting back to a central server in order to allow the attacker to connect and issue commands to your system.

So, what can we learn from this?

1) If you Bittorrent software you are supposed to buy, and break the law in doing so... you have to deal with the ramifications...

2) Hey, you can download the Trial from Apple.com, and then buy it, and they give you a serial number! You don't even have to go to the store to get a boxed copy! You already spent the money and bought a mac, you cheepskate, now if you want iWork, spend the 79 bucks and buy it like you are supposed to.

iWork 2009 Trojan

As I wrote on the Internet Storm Center:

It's already pretty widely reported in the media, take for instance here and here.

First reported by Intego, this trojan apparently is distributed by downloading Bittorrented copies of iWork 2009 from the Internet and installing them. The Trojan is installed as part of the software package, by, yup, you guessed it, you giving the software permissions to install by giving it your password.

Apparently this backdoor opens a hole on your computer, reporting back to a central server in order to allow the attacker to connect and issue commands to your system.

So, what can we learn from this?

1) If you Bittorrent software you are supposed to buy, and break the law in doing so... you have to deal with the ramifications...

2) Hey, you can download the Trial from Apple.com, and then buy it, and they give you a serial number! You don't even have to go to the store to get a boxed copy! You already spent the money and bought a mac, you cheepskate, now if you want iWork, spend the 79 bucks and buy it like you are supposed to.

Snort is up and running, now what?

I’m often asked to write a document about the after effects, the post marital bliss, as it were, of going through the steps of installing Snort as your IDS, and what to do next. So I’ve decided, at great request, to sit down and write a blog entry about the “next steps”.

Now, let me be clear, any security device, yes, ALL of them, require tuning. If someone is out there saying “my device doesn’t require tuning”, not only are they wrong, but it’s an absolute falsehood. I don’t care if your system is being automatically tuned, its still being tuned. One device is not the end all-be all of security devices. Of course there are default settings that take into account the majority of networks out there, and yes, Snort is one of those. But each device you put on your network requires a small bit of tuning at least to adapt to your environment.

So what do I like to do first?

1. Variables -- Tune those variables. How you tune your Snort variables is up to you, but I always say at the very least, start off by tuning your HOME_NET variable. Punch into this variable that network ranges you’d like to protect. How you tune the rest of the variables is up to you, but a good place to start is with EXTERNAL_NET. How you tune this variable, I have a talk on that, I am sure I will be giving soon, so stay tuned. I don’t want to put my bullet points out there before I start talking. By default EXTERNAL_NET is set to any, which is a fine start.
2. Rulesets -- If you don’t have the awesome luxury of dealing with a Sourcefire device, which will give you the recommendations for your rules based upon what is actually on your network (We call this “RNA recommended rulesets”), you will have to do this manually. Sit down, simply at first, with the category names of the rules that you download from Snort.org and take inventory of your network from a Software and service based perspective. Are you running IMAP as a service on your network? No? Then shut the whole rule category off. Rinse and Repeat.
3. Preprocessors -- Now, for proper elimination of alerts and tuning, these will take time, however, at the beginning, ask yourself two questions: 1) What is the majority operating system on my network, and 2) What is the majority webserver on my network. Take the answers to these two questions and tune things like your frag3, stream5, and http_inspect_server preprocessors.
4. Restart Snort -- In the present version of Snort (2.x.x) you have to restart Snort for changes to take effect. After you have done all of the above steps, restart Snort.
5. Suppression and Thresholding -- Now, for the lather rinse and repeat steps. Look at your alerts -- Do I need this alert? How is this alert going to help me to do my job? Do I have any actionable information from this alert. I mean -- So you are getting SNMP alerts, so what? Do you care? ICMP alerts, do you care? What does someone on your network pinging do for your security. In some environments it might, in most, no. So your Solarwinds server is pinging lots of hosts on the network. So? That’s what it’s supposed to do, so take that IP and suppress alerts. That’s what suppression is. Don’t want something to alert at all going to a particular host? That’s a suppression. Don’t want something to alert “as much”? That’s a threshold. Set the ones you need. Restart Snort.

This is not intended to replace any tuning steps you’ve already done, this is not intended to be the end all-be all. This is intended to get you going after your install.

For those of you using Sourcefire product, these steps are either non-existent or considerably easier for you. Some vendors will try and position their product against Snort (read: not Sourcefire) and call the comparison fair. Snort is an open source project, while many companies use Snort as the basis for their product, Sourcefire owns the technology and makes it considerably easy to use. That’s why Sourcefire was started. Marty had a vision of being able to make a complex engine like Snort, very easy to configure, so he started Sourcefire -- and viola.

For further tuning steps (and there can be a lot of them, depending on your network), we have consulting services available. I can’t give all the answers away! ;)

Desk Clearing Challenge

Okay, here’s my Challenge for you all.

Take your desk. Work, home, wherever it is.

Take everything off it. Everything except your computer. (Mouse, Keyboard, Monitor, iPod/iPhone dock, maybe some speakers too can stay). Everything else comes off. Put it on a pile on the floor or in your inbox or something. Not even Post it Notes. If you one of those people that puts Post It Notes on your Monitor or Desk or something like that, take those off. Clean, use the picture attached to this post for reference of what it should look like.

Now, let’s go through this stuff.

Pile of stuff. Go piece by piece. Do you need to file it? Go file it, matter of fact, would you best be served by scanning whatever the piece of paper is, and put it into your computer?

What do you take notes on? Paper? How about you try taking all your notes digitally. Use something like Evernote, or Notepad, or Wordpad. Doesn’t matter what it is, just get your notes digital. If you are using Mail.app, use the Notes. If you can use Evernote, use Evernote. Do you use Outlook? It has a notes feature as well. Give it a shot.

All those Post It Notes. Are they reminders? “Shut off the lights”. Try putting stuff like this on your calendar. “New Event -- Shut off the lights, set reminder, everyday M-F 5 pm”. Are they phone numbers for people? Put them in your Address Book in your computer. In Outlook or whatever you use to manage your contacts. Are they serial numbers or helpful little jotdowns? Put them in a note, title it appropriately so you can find it again.

What is left? Catalogues? Do you need them? Do you need all of them? Can you reduce costs by going with one vendor for your office supplies? Throw out the ones you don’t need/want anymore, then put the ones you want to keep on a bookshelf, or in a desk drawer. Better yet -- Can you throw them all away and manage the account online, ordering and everything? Try recycling those inch thick catalogues.

For those of you that have a laptop as your desktop machine, you have it ideally. You can take your desktop with you, all your notes, everything. Awesome. How can you make this work for you? Taking your laptop to meetings? Can you take notes your phone/mobile device and then email the notes to yourself?

If you have your own printer in your office, and you make it a bad habit of printing out lots of stuff, try shutting off the printer. Unplug it. Create it a chore for yourself to print something out. Avoid printing as much as you can.

At the end of this exercise, your desk should look like the picture above, and you should have nothing on the floor.

Are you one of those people that one of those big flat desk calendars? Or a piece of glass where you store business cards underneath? Take those business cards, and put them in your address book/contact list. How about that Desk Calendar? Can you use the calendar in your computer? In Outlook? iCal? Lightning? Google Calendar?

Digitize yourself. Use things like Dropbox, LiveMesh, or iDisk to be able to get at all your things wherever you are.

For the next step, get really down and dirty and do the same thing through your desk drawers. Good Luck. Let me know your results.

By the way, yes, I’ve done this.

Immaculate Collection

(Preface: I wrote this around January of 2007 and simply forgot about it. I wrote it around the time that Marty was writing these posts: here. Also when Richard was writing these posts here.)

I started playing with Sguil again recently, and for the benefit of those that don’t know, Sguil is a Snort based “NSM” system. It uses Snort and some other tools brought together in one interface to provide better analysis and results. The main factor of Sguil is that it runs something like Tcpdump, Snort, or Daemonlogger in order to dump ALL traffic to disk.

I bought my good friend Richard Bejtlich’s “The Tao of Network Security Monitoring” book earlier this year.

Richard has the theory of: “collect all packets, because without all packets the total picture isn’t seen”. In principle, I agree. I used to use this methodology heavily in my last job, and it worked quite well at the time.

While he also goes on to say that IDS “alerting” has its place, without “context” (the surrounding traffic on the network) the alert will make no sense. I don’t know if I rightly agree with that statement as a whole. Let me explain my difference in “context”.

At my company, Sourcefire, we make a product called “RNA” which stands for “Real-Time Network Awareness”. This product coupled with our IPS’s and Defense Center make an extremely powerful tool for analyzing “alert traffic”. Let me give you an example.

Simple Example:

Hacker attacks your network with an exploit against IIS servers. If any of you have ever seen something like this before in your analyst lives, you probably know that they will either 1) Prescan your network for open http ports, or 2) just automate the attack so no prescan takes place, just the attack, very quickly.

If you have plain vanilla Snort, you will get an alert for every one of these attempts. Using the “Collection” theory, we would also collect all traffic for these connections and we are able to see which attacks got through the firewall, not which ones didn’t. You can even take it this a step further and rebuild the session to see what took place (if anything). This is a lot of data. We’re talking a pcap file that is containing not only all these hundreds of potential connections, but every other connection that is taking place on the network at the same time.

Now, there is nothing wrong with that if:

A) You have the hard drive space.

B) You have the time.

1. Your machines doing the sniffing can keep up.
2. You have the personnel to manage all the time, data, and storage.

The problem with it is, at modern network speeds, and the speed at which a program would have to write this stuff to disk, something would give. Now I am not talking at your 500 Mbit/s speeds. I’m talking about the majority of the networks that I deal with that are >1 Gig/s. Whether it be the hard drive, memory, or whatever, but something would buffer somewhere, and more than likely you are going to drop packets. Again, I’m not saying that this is totally a bad idea, I’m just bringing up cons to the pros.

But lets look at it a different way. RNA profiles the hosts on your network, both pre-attack and during, in real-time. RNA knows which machines are running IIS (if any) and which ones aren’t. So it already knows if you will be affected by the IIS exploit attempt.

When these alerts come back to the DC (Defense Center), the DC correlates the RNA event with the Intrusion Sensor alert and the “fat rises to the top” as it were. The DC knows to say “Hey, this attack affects IIS version 5, and only version 5, on Windows...etc..” This is technology that Sourcefire has invented and patented.

So instead of you now having to analyze 100’s of alerts and 1000’s of packets, hey, I only have “these two machines” over here running IIS, and the DC told me that I need to look at these alerts first. Are the other alerts still recorded? Yes, but now I know through the correlation which machines will receive a greater IMPACT from the attack. The two IIS machines. My other Apache boxes aren’t affected at all, so who really cares.

Lets take it a step further. Say the exploit was against IIS 5.0. Well, our two machines are running IIS 6.0. (I’m inferring patch level with this example)

So do we really care? Well, we might like to know, hey, there was an attempt, that’s great, but it doesn’t affect us, we’re not vulnerable to it, lower the IMPACT, and lets move on to the next alert.

If you were collecting packets using the “Immaculate Collection” theory, you’d have to analyze all these streams to make sure that each IIS/Apache/etc.. box returned 404 and whatever else error codes.

Could we do that with Snort? Yes, of course we could. But if RNA knows our network already, then is it important to us? Or is it just informational at this point?

Take it a step further. Think about the exploits that affect browsers, Mail Clients, versions of SSH, telnet, snmp, etc.. RNA already knows these services and applications on your network. Before the attack even takes place.

Single glances allow us to look at these 1000’s of alerts, and say hey, these 2 machines are running IIS, but we’re not vulnerable to the attack. In a matter of seconds.

If you’ve ever heard Marty Roesch speak, you’ll know that it is his belief that “Humans” basically can’t make the decisions for the IDS. Why don’t we let RNA tune it directly? But that’s for a totally different post, one that Marty has covered on his blog as well.

Of course there are strong points to both sides of the discussion. Share your thoughts in the comments.

® Snort, Daemonlogger, RNA, Defense Center, and Sourcefire are all registered trademarks of Sourcefire, Inc.

10 things I hate about Outlook, and you should too

Okay, so, it should be strikingly obvious that I probably hate Outlook. I stopped using Outlook in 2001, had to use it for a customer for awhile, and my love for it hasn’t gotten any fonder.

1. Non-Standards compliant. Really Microsoft? You didn’t like how all the other email programs that have been around for years have been doing it? You had to go create that MIME format crap that not only isn’t standards compliant, but that every other email program has issues with.
2. Calendar invites. Seriously? Why are Outlook’s Calendar invites so screwed up when sending them to people not on the same Exchange server as you? CALDAV anyone?
3. Exchange? Didn’t like the standards based email servers that were out there? Had to go create one? “But there wasn’t one that did all these “X” features on one server” Wa. Cry me a river. Apple did it. Yeah so what they had to invent a couple open standards and submit them.
4. Top-Posting by default?! Seriously? Lotus Notes you are guilty too, don’t think I am letting you off the hook. Although I will give you credit, Microsoft, for finally building in bottom posting into “Windows Mail”. How many years did it take you? And then, it’s only in Windows Mail!? Why not Outlook! Oh and Google, Gmail top posting? You should be ashamed. Going totally against an RFC! Mail.app for OSX. GUILTY.
5. Tasks. Really? I can drag an email to the bottom left and make a task, I can even drag an email over to the right and make it a task. I can FLAG an email and it will make it a task, but if I move the email out of the Inbox, the task goes away. Awesome job there.
6. PST -- Yet another “our own special standard” email thing from Microsoft. Good job! How about you store things in mbox? How about it? Did you know you can define a PST size up to 33TB? Are you serious? I’d love for the IT department to try and backup someone’s 33TB PST. That’s awesome!
7. Inline Picture attachments. God forbid you should actually display these inline like I told you to. Oh, and I can’t drag the picture to where it should be in the email? I have to go to Insert and do 3 menu calls? Seriously? If I drag it into the email, it places a picture as an attachment? What if I am trying to explain to someone which screen to click on, and you don’t format my email correctly.
8. No real-time Spellcheck? Seriously? You do it in Word! That means I have to select Word as my email editor? I have to launch a separate application to write an email!?
9. Contact suggestion. There is a whole painful hurt of explanation I can do about this section here... not suggesting a contact if it’s in my address book? Not knowing which people I email the most? Which email address am I sending to if my contact has multiple email addresses?
10. Spam Filter. Does one even exist? Does it work? Thunderbird’s Spam filtering kicks ASS compared to Outlooks.

Basically, if you are using Outlook, and you aren’t on an Exchange server, why are you using Outlook? Use something else. God I hate Outlook.

10 things I hate about Outlook, and you should too

Okay, so, it should be strikingly obvious that I probably hate Outlook. I stopped using Outlook in 2001, had to use it for a customer for awhile, and my love for it hasn’t gotten any fonder.

1. Non-Standards compliant. Really Microsoft? You didn’t like how all the other email programs that have been around for years have been doing it? You had to go create that MIME format crap that not only isn’t standards compliant, but that every other email program has issues with.
2. Calendar invites. Seriously? Why are Outlook’s Calendar invites so screwed up when sending them to people not on the same Exchange server as you? CALDAV anyone?
3. Exchange? Didn’t like the standards based email servers that were out there? Had to go create one? “But there wasn’t one that did all these “X” features on one server” Wa. Cry me a river. Apple did it. Yeah so what they had to invent a couple open standards and submit them.
4. Top-Posting by default?! Seriously? Lotus Notes you are guilty too, don’t think I am letting you off the hook. Although I will give you credit, Microsoft, for finally building in bottom posting into “Windows Mail”. How many years did it take you? And then, it’s only in Windows Mail!? Why not Outlook! Oh and Google, Gmail top posting? You should be ashamed. Going totally against an RFC! Mail.app for OSX. GUILTY.
5. Tasks. Really? I can drag an email to the bottom left and make a task, I can even drag an email over to the right and make it a task. I can FLAG an email and it will make it a task, but if I move the email out of the Inbox, the task goes away. Awesome job there.
6. PST -- Yet another “our own special standard” email thing from Microsoft. Good job! How about you store things in mbox? How about it? Did you know you can define a PST size up to 33TB? Are you serious? I’d love for the IT department to try and backup someone’s 33TB PST. That’s awesome!
7. Inline Picture attachments. God forbid you should actually display these inline like I told you to. Oh, and I can’t drag the picture to where it should be in the email? I have to go to Insert and do 3 menu calls? Seriously? If I drag it into the email, it places a picture as an attachment? What if I am trying to explain to someone which screen to click on, and you don’t format my email correctly.
8. No real-time Spellcheck? Seriously? You do it in Word! That means I have to select Word as my email editor? I have to launch a separate application to write an email!?
9. Contact suggestion. There is a whole painful hurt of explanation I can do about this section here... not suggesting a contact if it’s in my address book? Not knowing which people I email the most? Which email address am I sending to if my contact has multiple email addresses?
10. Spam Filter. Does one even exist? Does it work? Thunderbird’s Spam filtering kicks ASS compared to Outlooks.

Basically, if you are using Outlook, and you aren’t on an Exchange server, why are you using Outlook? Use something else. God I hate Outlook.

Why is your Blog named Finshake?

Someone wrote in and asked me why I named my blog “Finshake”. Well..

Finshake is an internal joke between me and the guys in VRT at Sourcefire. A while ago, I was an author on the “Snort IDS and IPS toolkit” book from Syngress. Well, with the rush to deadlines and things, there are several mistakes in the book. Okay, so there are alot of mistakes made in the book...

Well, one of the biggest mistakes in the book, actually happened in my chapter. (Chapter 6). I was talking about TCP Session initiation and TCP Session tear down and how Snort interprets those. In the final book, I wanted pictures of the TCP Handshake for session initiation, and the TCP exchange for session tear down.

In my copy of the manuscript I simply indicated where the pictures should go:

I didn’t actually draw the pictures. I knew Syngress had the pictures from the 2.1 book, and I just asked them to use those.

So in my final proofread of the pdf that I got from the publisher:

The place holder was there, but no picture. Oh well.

The picture was inserted later, and no one ever checked to see if the picture was right. 

So it’s become such a funny joke around the VRT, someone made the suggestion that I should rename my blog “Finshake”. (Since obviously, Session initiation does NOT take place with a “FIN” packet!?)

Research

Okay, so MS08-067 Worm(s). I got some intel from some various listservers that I belong to about a new worm (or worms) that were starting to be seen in the wild. So I got a few url’s to play with and started poking around. Note, these are not all the url’s that I tried to get the exploit/worm from. They are not all of the same worm, and they may or not be related... BTW -- I am not a very good malware analyzer, Just an FYI.

It appears, one of the variants of this worm that I am looking at attempts to spread, not only though network vulnerabilities (08-067), but also through P2P networks like Emule.

So, I tried to get one of the files, named 6767.exe in this case. This EXE file does several things, some of which are very unclear as to the reason... as I said, I’m not a malware guy...

This exe downloads, and upon execution (again, in my particular sample, I am sure it will change), from a network perspective, on MY machine, it didn’t do anything. I have read several write ups of the 6767.exe variant, and I saw what it was “supposed” to do. But in my particular example, it didn’t do anything. I don’t know if it some kind of virtual machine detection in it, and that’s why it didn’t execute? I don’t know. Just throwing that out there. Maybe it has some kind of sleep function so that it won’t execute right away.. making reverse engineering difficult. (boring!) For a list of what it does to a machine, take a look here. At this point I am more interested in how it spreads, not really what it does to the machine.

So, I downloaded a second sample “10wrjcenew.exe”, and executed it.

It tried to download two files, the first was “mimi.1268772” from ls.lenovowireless.net, and the second was pp.av from “218.4.137.213”. After this pp.av file was downloaded, the malware then attempted to register my computer on ce.10wrj.com. With this string:

This connection succeeded, but was immediately terminated. Since this particular HTTP connection was tried over and over again to register, and since the mac address is a vmware mac address, I can only guess that the machine receiving the Client Registration knows which mac addresses are vmware and doesn’t attempt to infect those? Just a theory. I found some interesting information about this here.

The two files were saved, actually on the desktop (because the malware I had executed was sitting on the Desktop), and were named svchost.exe and winlogon.exe.

So, you can tell that this is a completely different worm from the first one I tried.

Then, after that, scanning commenced on port 139 to try and find other hosts. Now I have a double NAT going on here, (172.16 addresses (vmware) are being bridged out to 192.168 (home network) addresses, then translated to the internet.. I didn’t notice it, but the worm must have looked up my ‘external’ address at some point because the malware never did scan my local subnet, it only scanned the public address scheme of my local subnet. Upon further review of the malware through other websites, I also found this to be the case.

After successfully connecting (which didn’t happen in my case) on port 139, it then exploits the other machine on port 445. Which is detected by Snort through rules:

[1:7224:8] NETBIOS SMB-DS srvsvc NetrPathCanonicalize unicode little endian overflow attempt

[3:14817:1] NETBIOS SMB srvsvc NetrpPathCononicalize unicode little endian path cononicalization stack overflow attempt

[3:14783:1] NETBIOS DCERPC NCACN-IP-TCP srvsvc NetrpPathCononicalize little endian path cononicalization stack overflow attempt

So I suggest you check out the newest subscription ruleset through Sourcefire at www.snort.org. Like I said, I am not a malware guy, I just did some clicking around to see what was out there and what it did. I haven’t reversed a binary in almost 4 years. Who has the time!? ;)

Subscribe in a reader

Apple Store Photos

I moved my Gallery of Apple Store Photos to MobileMe. I travel to an Apple Store if I am in the city with one. Check out the gallery over there on the right, or click right here.

Thanks.

Subscribe in a reader

Apple Store Photos

I moved my Gallery of Apple Store Photos to MobileMe. I travel to an Apple Store if I am in the city with one. Check out the gallery over there on the right, or click right here.

Thanks.

Subscribe in a reader

ISC Podcast Episode Eleven Posted

Hey everyone, sorry it has taken so long to get around to recording another podcast episode. Travel schedules have been very crazy between us lately. Anyway, enough excuses, here is episode eleven. Thanks for all the emails asking me where it is! :) It helps to remind me....

All the podcasts
Just this podcast
Podcast through iTunes

Subscribe in a reader

CRCError

Recorded CRCError podcast last night, I've edited some of it, but I thought I would post something about the website on here. Well.. it's down. So wtf right?

Well something about the hosting company where the server is hosted is retarded or something, I don't know the whole drama or the issue, but we're working to get the server back up, and then punch the hosting provider in the face.

Subscribe in a reader

ISC Podcast Episode Eleven Posted

Hey everyone, sorry it has taken so long to get around to recording another podcast episode. Travel schedules have been very crazy between us lately. Anyway, enough excuses, here is episode eleven. Thanks for all the emails asking me where it is! :) It helps to remind me....

All the podcasts
Just this podcast
Podcast through iTunes

Subscribe in a reader

CRCError

Recorded CRCError podcast last night, I've edited some of it, but I thought I would post something about the website on here. Well.. it's down. So wtf right?

Well something about the hosting company where the server is hosted is retarded or something, I don't know the whole drama or the issue, but we're working to get the server back up, and then punch the hosting provider in the face.

Subscribe in a reader

Mark Wahlberg Talks to Animals

This has been cracking me up for like the past 3 days. I love it.

Of course it has a sequel as well:

Subscribe in a reader

Mark Wahlberg Talks to Animals

This has been cracking me up for like the past 3 days. I love it.

Of course it has a sequel as well:

Subscribe in a reader

Google Calendar Syncing, MobileMe, and iCal

Recently I've had to start keeping my Calendar on Google Calendar. (For a really good reason, and, it's not the free version of Google Calendar either.) However, I didn't know how I was going to get my iCal to publish to Google Calendar, AND sync with MobileMe at the same time.

Well I started trying to connect iCal to Google Calendar via CalDAV, which I wrote about in an earlier post. However, Google's implementation of CalDAV is still kinda broke. You can't really schedule people's time, you can't see their availability, you can't call people up from the address book, and you can't have To-Do's on the calendar that you are syncing, so that breaks a bunch of stuff for me.

So I was going to try and just keep my calendar on iCal, and have it publish to Google Calendar, well, that wasn't going to work either for a couple reasons. I actually can't remember all the reasons right now, but it had to be something really big for me to abandon it right away.

So I started looking into Apps that would sync my calendars for me. So I came up with BusySync.

So I took the following steps, since my calendar was maintained in iCal, YMMV, but good luck:

1. I exported my iCal calendar and put it on my desktop.

2. Logged into Google Calendar and imported my iCal calendar into Google Calendar (took a few seconds, I have a rather large calendar).

3. Deleted my local calendar in iCal.

4. Fired up BusySync and told BusySync to Sync my Google Calendar to local iCal.

5. Viola.

Since BusySync syncs a calendar to a "local" calendar (as opposed to a "subscribed" calendar) everything works fine, in fact, MobileMe will sync your calendar right down to your iPhone.

Problem Solved.

Subscribe in a reader