Smalltalk Tidbits, Industry Rants http://www.cincomsmalltalk.com/blog/blogView Cincom Product Manager jrobertson@cincom.com Thu, 27 Mar 2008 19:44:39 EST http://www.cincomsmalltalk.com/images/cst_small.jpg Smalltalk Tidbits, Industry Rants http://www.cincomsmalltalk.com/blog/blogView 50 81 en-us James A. Robertson Copyright 2007 Cincom Systems, Inc. 2008-03-27T19:44:39-05:00 39.214103 -76.878807 Lame Answers Department http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 security Thu, 13 Mar 2008 12:41:51 EST

The TSA (which to its credit, has a blog) explains the MacBook Air fiasco from their perspective:

One thing is for sure though. This was just a case of diligent TSOs paying special attention to something that caught their eye. Exactly what they are trained to do.

Ok, here's my question: if it's your job to recognize potential security risks, isn't it also part of your job to recognize existing technology? If they can't recognize existing technology, then I rather suspect that they wouldn't recognize an actual security risk until it landed on them...

Technorati Tags: ,

]]> 3382864911 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3382864911 http://www.cincomsmalltalk.com/blog/blogView?guid=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 Charles Miller 2008-03-13T16:45:50-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>I'm no fan of the TSA (last time I was in the States I found myself on some list that got me searched wherever I went, probably because I share a name with a Columbian hit-man), but I thought the TSA acquitted themselves quite well over this one.</p> <p>Screeners can't be expected to keep up with every advance in technology. It would be nice, but it's not practical. So they are taught heuristics to recognise if some device is "right" or not. The MacBook turns out to be one of the rare devices that forces a change to these heuristics, something the TSA says it's working on.</p> <p>If you've ever seen a MacBook Air taken apart, it looks like the insides are mostly taken up by the battery. Throw in a solid-state drive and you've got something that under an X-ray looks like it's 2/3 unidentifiable solid chemical mass, 1/3 electronics, with none of the recogniseable parts (HDD, optical drive) you would normally see in a laptop.&nbsp;</p> <p>If someone wanted to pack a bomb into a laptop case, I dare say that's what it would look like.</p> </div> blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 <a href="http://www.cincomsmalltalk.com/userblogs/troy/blogView">Troy Brumley</a> 2008-03-13T17:01:35-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by <a href="http://www.cincomsmalltalk.com/userblogs/troy/blogView">Troy Brumley</a></p> <p> <p>Disregarding issues of pay, training, and working for the govt, where cya is often a normal mode of operation, think this through. When in doubt, err on the side of caution. We've already seen 3 plans crash into buildings and 1 into a field, dude.</p> </p> </div> yup blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 James Robertson 2008-03-13T17:59:54-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by James Robertson</p> <p> <p>Those planes were crashed by people wielding box cutters. If security staff worried half as much about the people employed at airports (you know, the ones who walk in and out of secure areas) as they do about me, I'd cut them some slack. As it is, they're chowder-heads putting on a show for the public that does not secure anything.</p> </p> </div> Re: Lame Answers Department blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 W^L+ 2008-03-13T20:34:06-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>I'm glad that they did recognize the MB Air was different, but that still does not fix the fact that they are mostly defending against yesterday's threats. Every time we hear about an incident, it is something we've never seen before, so the TSA needs to back off the regimentation and instead train its employees to have broad knowledge in many areas and give them the discretion and authority to use it. That, plus better pay and thinning out petty dictator types would go a long way.</p> <p>There will never be a perfect safety system, and we wouldn't want to live under it if it existed, but if we are going to obsess over one day's events, we might as well actually do something that works, unlike the "<a href="http://www.dhs.gov/xinfoshare/programs/Copy_of_press_release_0046.shtm">rainbow of doom</a>".</p> </div> Some Good, But Big Problems Remain blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 blogView?showComments=true&printTitle=Lame_Answers_Department&entry=3382864911 Rich Demers 2008-03-13T21:38:12-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by Rich Demers</p> <p> <p>The whole TSA approach is to my way of thinking wrong headed. It focuses too many assets on only one mode of transportation and does so in a way that is inherently open to creative acts of terrorism. Further, it does nothing about the real problems of border security -- for both undesirable individuals and dangerous cargo. Wouldn't it have been better to beef up border security, enhance foreign intelligence assets, and find a better way to deal with domestic crazies. If they had taken that approach, our air transportation system could be as free and open as it was in the 1980's.</p> </p> </div> Re: Lame Answers Department http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3382864911 I feel more secure http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=I_feel_more_secure&entry=3382606274 security Mon, 10 Mar 2008 12:51:14 EST

Oh boy - this is just too funny a story (unless you happen to be the one who gets delayed): The TSA stopped a guy with a MacBook Air because - without a hard drive - it must be some kind of faux device.

Insert some snorting here :/

Technorati Tags: , ,

]]> 3382606274 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3382606274 http://www.cincomsmalltalk.com/blog/blogView?guid=3382606274 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3382606274 This explains all the Russian Spam http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 security Sat, 23 Feb 2008 13:22:37 EST

I've been wondering about the veritable flood of Russian language spam; I guess this explains the volume:

Russia now occupies number one spot on this ranking with 27.4 percent of malware, slightly ahead of China on 27 percent. Both leave the U.S. trailing in third with 10.1 percent, Brazil on 6.6 percent, and the U.K. with 5.32 percent.

Of course, I have to wonder about the intelligence behind this. Sure, there are lots and lots of Chinese speakers around, both inside China and out. But Russian? Just how effective do they think that is?

Technorati Tags: ,

]]> 3381225757 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3381225757 http://www.cincomsmalltalk.com/blog/blogView?guid=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 Janko Mivšek 2008-02-23T14:16:28-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>I need to say that I&#39;m quite angry on such misleading statistics, which shows only technical origin of spam, while it is quite obvious from content that orders for most of spam came from US. </p><p>Ranking of spam is therefore obvious: US on the first place! </p> </div> Spam origin is US blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 James Robertson 2008-02-23T14:53:44-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by James Robertson</p> <p> <p>Janko, I seriously doubt that US entities are generating Russian language spam...</p> </p> </div> Re: This explains all the Russian Spam blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 2008-02-23T15:10:39-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Jim, don&#39;t play silly, you know very well what I&#39;m talking about. Because you provided stats for all and not only spam in russian language. </p></div> blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 James Robertson 2008-02-23T16:46:14-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by James Robertson</p> <p> <p>I'm just combining my anecdotal evidence with the report. Throw rocks at the report, not at my anecdotes :)</p> </p> </div> Re: This explains all the Russian Spam blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 Janko Mivšek 2008-02-23T17:06:21-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>It&#39;s true, even that report says it is about RELAYING the spam, it is (as usually for such US based reports) just silent about who is actually behind that spam. Who is paying for that relaying of spam, that is. And payer is just obvious from content of spam!</p><p>End result of such reports is obviously the perception that spam comes from Russia etc, but it actually comes from US. And Jim, you extended that lie to your case. Or you didn&#39;t read report well, or you just don&#39;t have a feeling anymore, what a lie is. </p><p>Sorry for that, but that&#39;s obviously very frequent &quot;problem&quot; on your part of the world recently, so I can somehow understand. But I will never accept!<br /></p><p>&nbsp;</p> </div> Spam origin is US blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 blogView?showComments=true&printTitle=This_explains_all_the_Russian_Spam&entry=3381225757 Troy Brumley 2008-02-23T19:45:16-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>When in doubt, blame Canada! :)</p><p>But seriously, I&#39;ve noticed that the Cyrillic spam only hits my office email account.&nbsp; My spam in gmail is predominately in English, I get very little on the Mac, but I see waves of Cyrillic looking spam at the office.&nbsp; I&#39;ve not done any serious looking at headers to try to trace any of this back to an origin IP.</p><p>My work email address is visible on a lot of web sites for crawling, fwiw.</p><p>Just noting trends here, not trying to get into a statistics war with anyone.&nbsp;</p> </div> so why would us firms be selling candadian drugs? http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3381225757 Phishers Found http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Phishers_Found&entry=3362201632 security Wed, 18 Jul 2007 08:53:52 EDT

About a week ago, we had some phishing files uploaded to the Wiki - which caused us a bit of grief. Today, I see that the Italian police have found the people behind the scam:

The Guardia di Finanza (Military Financial Police) cuffed 18 Italian citizens and eight Eastern Europeans as part of "Phish and Chip", an operation aimed at dismantling a gang targeting users of Poste Italiane's home banking services.

I'll have to keep monitoring the Wiki though - it's not like these are the only bad actors out there.

Technorati Tags:

]]> 3362201632 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3362201632 http://www.cincomsmalltalk.com/blog/blogView?guid=3362201632 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3362201632 Brilliant Filters at the Airport http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Brilliant_Filters_at_the_Airport&entry=3362148550 security Tue, 17 Jul 2007 18:09:10 EDT

You have to love this - I'm in Dayton, waiting for Arden to arrive, and I decided to refresh my Facebook page. Here's what I got:

That's "Web Marshal", which has apparently classified Facebook at Porn. It also calls a bunch of blogs I read that way. All I can say is... lol.

Update: Click through for a larger image

]]> 3362148550 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3362148550 http://www.cincomsmalltalk.com/blog/blogView?guid=3362148550 blogView?showComments=true&printTitle=Brilliant_Filters_at_the_Airport&entry=3362148550 blogView?showComments=true&printTitle=Brilliant_Filters_at_the_Airport&entry=3362148550 <a href="http://www.cincomsmalltalk.com/userblogs/troy/blogView">Troy Brumley</a> 2007-07-17T20:02:32-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by <a href="http://www.cincomsmalltalk.com/userblogs/troy/blogView">Troy Brumley</a></p> <p> <p>That's a bit small, and I can't make out the text even after zooming with IE7. Still, I get the point. What blogs are classed as pr0n?</p> </p> </div> damn hard to read blogView?showComments=true&printTitle=Brilliant_Filters_at_the_Airport&entry=3362148550 blogView?showComments=true&printTitle=Brilliant_Filters_at_the_Airport&entry=3362148550 Tom K 2007-07-17T20:12:32-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>We recently had some fun around the office in a similar vein. Folks were checking The Weather Network web site because of impending severe thunderstorms, and clicking on the "Severe Weather Warning" link popped a dialog box warning that the site was considered pornographic, access was blocked, and recorded.</p> </div> Not So Bad http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3362148550 Security By Stupidity, Part Duh http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Security_By_Stupidity,_Part_Duh&entry=3355041185 security Thu, 26 Apr 2007 11:53:05 EDT

Here's a security tale that will either make you laugh out loud, or pull your hair out (depending on whether you live in Europe and whether you care about Windows *cough* security *cough*). If you have Windows Vista installed in Europe, you can't lock out USB devices unless you install Windows Media Player. Why?

The ability to block read/write access to removable storage devices via Group Policy depends on the presence of the Portable Device Enumerator Service, which is not installed by default in the Vista Business N edition. We discovered this because we accidentally installed this version of the operating system on our test machines. Vista Business N is a Europe-only edition that complies with the EU mandate that Windows Media Player be decoupled from the operating system.
Unfortunately, the Portable Device Enumerator Service comes with Windows Media Player rather than with the base Vista operating system, so the N versions of Vista won't get the feature without installing the Windows Media Player or kludging together a different workaround.

Some people are going to sniff an evil plan from MS here, but I seriously doubt it. I'll echo something I heard Doc Searls say on last week's TwIT podcast - "Never ascribe to malice what can be explained by incompetence".

Technorati Tags:

]]> 3355041185 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3355041185 http://www.cincomsmalltalk.com/blog/blogView?guid=3355041185 blogView?showComments=true&printTitle=Security_By_Stupidity,_Part_Duh&entry=3355041185 blogView?showComments=true&printTitle=Security_By_Stupidity,_Part_Duh&entry=3355041185 W^L+ 2007-04-26T13:41:40-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>This might not be stupidity after all.&nbsp; MSFT&#39;s goal in Europe is to make the regulators look like extremists who don&#39;t care about their own citizens&#39; preferences. </p><p>I think that there are three levels to look at in the situation:</p><ol><li>&quot;I didn&#39;t know any better.&quot; : We call this <em>ignorance</em>, and we excuse a mistake made in ignorance.</li><li>&quot;I should have known better, but I didn&#39;t.&quot; : We call this <em>stupidity</em>.</li><li>&quot;I knew better and did it anyway.&quot; : We use terms like <em>intentional</em> or <em>malice</em> to describe this. <br /></li></ol><p>I would argue that it was the third situation with MSFT vs. Europe.&nbsp; Not that anyone would willingly take Real&#39;s media player over Microsoft&#39;s media player, but this is meant (in my opinion) to make Windows less convenient without Microsoft&#39;s own player software.</p><p>This is along the lines of seeing a news story on MSNBC and clicking the video link to find that you need to install IE and WMP in order to view their videos. Could they make them work easily with alternate software? Of course.&nbsp; They don&#39;t do so, because they want to make it inconvenient for people to use other software.&nbsp;</p><p>&nbsp;</p> </div> Maybe Not Stupid http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3355041185 About that Installer Issue in Vista http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=About_that_Installer_Issue_in_Vista&entry=3354823923 security Mon, 23 Apr 2007 23:32:03 EDT

I wrote about the silliness of the way Vista handles Installers awhile ago; they run with admin rights. Now, it turns out that it's even stupider than I thought:

"If Vista sees that you have created a Microsoft Visual C++ project with install in the project name, then that .exe will automatically require Admin Rights to run. Create exactly the same project, but call it, say, Fred, and the problem disappears," he explained. "Vista's security isn't just concerned with what an .exe is doing to your PC, but what it's actually called."

I think I'll call that security via stupidity.

Technorati Tags:

]]> 3354823923 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3354823923 http://www.cincomsmalltalk.com/blog/blogView?guid=3354823923 blogView?showComments=true&printTitle=About_that_Installer_Issue_in_Vista&entry=3354823923 blogView?showComments=true&printTitle=About_that_Installer_Issue_in_Vista&entry=3354823923 Sriram Krishnan 2007-04-24T03:51:51-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>I thought of it as weird the first time I heard of this several months back. But I&#39;ve seen explanations internally and I&#39;m convinced that this is actually a decent idea which covers most cases.</p><p>&nbsp;</p><p>Here&#39;s why *I* think it&#39;s a good idea. I don&#39;t work for the team that did this so this is just guesswork on my part (though educated).</p><p>&nbsp;</p><p>It comes down to knowing whether an app is allowed to write to protected locations like &#39;Program Files&#39; and so on. Setup programs obviously should - while programs like Notepad obviously shouldn&#39;t.&nbsp; Now, let&#39;s say Notepad wants to write to C:\Program Files\Notepad for some reason. It shouldn&#39;t be writing there - but there are tons of these apps which write to protected locations since XP was usually run by a user with admin priveleges.&nbsp;</p><p>Vista could just throw up its hands, throw up a UAC prompt and say &quot;You gotta elevate&quot;. However, doing this would mean that a normal user would keep responding to UAC prompts inside the application. Not only would this annoy the user to no end, it would also mean that we&#39;re right back to the XP model of apps writing wherever they wanted to.</p><p>&nbsp;</p><p>Instead, Windows Vista hooks the call so that while the apps thinks it is writing to Program Files, in reality it is writing to some location under the user&#39;s directory. This, IMHO, is a beautiful solution as it keeps applications working without UAC prompts and without compromising on security.</p><p>&nbsp;</p><p>You might be wondering what this explanation has to do with installers. You see - installers are a special case - they are applications that are *supposed* to write to the Program Files folder. Hooking them and making them write to the user&#39;s directory would be a disaster. Telling users &quot;You have to right-click on this installer and run elevated&quot; wouldn&#39;t work.&nbsp; Windows Vista needs a way for detecting whether an application is a setup installer and then elevating right at the beginning. That&#39;s where the installer detection heuristics come in. These heuristics are not limited to just the filename - they look at various other factors as well (entire list at http://msdn2.microsoft.com/en-us/library/aa905330.aspx).</p><p>These heuristics let Windows Vista say &quot;Oh - there&#39;s a real good chance of this being an installer so let me elevate up front&quot;. </p><p>&nbsp;</p><p>I&#39;ve been using Windows Vista for over a year and every setup program I&#39;ve used has elevated right up front, thanks to this detection. As with all heuristics, there are chances for false positives (which the article found). What the article didnt mention is that &#39;Fred&#39; just needs to add one entry to his process manifest and that would tell Windows Vista &quot;I don&#39;t need to be elevated. Ignore my name, will ya?&quot;</p><p>&nbsp;</p><p>-Sriram</p><p>www.sriramkrishnan.com&nbsp;</p><p>&nbsp;</p> </div> http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3354823923 Unimpressive Security Response http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Unimpressive_Security_Response&entry=3352996414 security Mon, 02 Apr 2007 19:53:34 EDT

Chris Petrilli is unimpressed with Microsoft's ability to issue security updates in a timely fashion

Technorati Tags:

]]> 3352996414 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3352996414 http://www.cincomsmalltalk.com/blog/blogView?guid=3352996414 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3352996414