Just Read This a Minute Ago

It's no big secret that my favorite musical artist is John Mayer, and I don't mean to get off my tech-babbling here, but John's blog is a place I visit at least once a week and his writing never ceases to inspire me to think:

CHANGE

I've been thinking about something lately.

Imagine this:

You're on an airplane, sleeping with your head against the window, your heart set on being home this time three hours from now. All of a sudden, something goes very wrong. The plane stops moving across the air and instead starts falling through it. The lights are flickering and the movie is skipping. The plane dips hundreds of feet in seconds, and the yellow cups fall from the ceiling. They're a brighter shade of yellow than you remember, because unlike the demonstration, these cups have never been handled before. "Flight attendants take your seats now", you hear, the pilot's voice trembling over a cacophony of alert tones. You get that smell in the bridge of your nose like you've just been hit with a football. That's what the fear smells like. The plane is going down.

Four more drastic drops in under a minute. People are crying. For all the folklore about how your life flashes before your eyes, you're remarkably fixed on one vision - your parents. They're sleeping at this very moment, in a bedroom so quiet they can hear the clock in the kitchen. And you can see them, clear as can be. You wish you could see a playground or a first kiss, but all you can see is your parents sleeping. Huh. Well, that's that.

Several long minutes go by. Then, all at once, the lights come back on and the plane somehow rights itself. Some people cheer, but most people cry harder. The plane lands about an hour later, and as soon as you feel that touch down - hell, even when you were within 50 feet of the ground and could still technically survive a fall - you realize that however you brokered the deal between you and God worked; you've just been granted life in overtime.

Here's the question: what do you change? Whom do you call that you haven't spoken to in years? Whom do you realize has been toxic to your heart and drop with surprising ease? What trips do you cancel, and what trips do you book? What can't you be bothered with anymore? What's the new you like?


Think about that, and then ask one more question. Why not just change it all right now?

(Working on it...)

POSTED BY JOHN MAYER AT 04:48 AM FROM SYDNEY, AUSTRALIA

This will stay here until I get a nasty letter from John or his people regarding copyright issues. The link to his post is here. I take no credit in writing that and feel that my own readers may enjoy it.

Even though he's quite a wealthy man, he still is pretty damn down-to-earth. He's an exceptionally talented person and still gives credit where credit is due (and does so publicly). That is admirable even in the smallest and most critical of eyes.

Pulling the Shades

I was reading a security blog today and came across an issue that I have always been on one side of until now. Now (I think) I get Microsoft's manner of operating. It's an issue about access to the Windows kernel (the core of the operating system) and how Microsoft doesn't want to let anyone see it, not even McAfee or Symantec to help protect it. I can somewhat agree with Microsoft now. That post actually had a point. It's just that Microsoft never presented it that way because it would make them look like less of a team player. Note to vendors: they never really cared anyway.

I don't have all the technical or legal expertise to go into this, but one trivial thought helped everything make sense: if the kernel is locked down, why would you need security programs to get inside it to protect it from malware when the malware has become less of a problem by locking down the kernel? Now I'm confused - did that make sense? Is that a derivative of a Catch-22?

If that theory holds true, Windows could become as seemingly secure as the Mac OS just by becoming proprietary (so to speak). It's all relative, though.

I must say, however, that I hate Vista so far, and it has a lot to do with HP.

Perfect Situation Required

Network World reported yesterday that a new Windows XP attack has been proven to disable Windows Firewall. More details are here. Very interesting - how do they do that? Isn't Windows Firewall fairly robust, just as powerful as Symantec's and McAfee's software firewalls?
Actually it pretty much is, especially since you don't have to pay for it. Now let me get a show of hands:

1. How many of you know what ICS is as it relates to Microsoft Windows?

2. How many of you even knew that Windows could share its Internet connection with other computers directly?

3. How many of you actually use Internet Connection Sharing in your home or small office?

The vulnerability is in Internet Connection Sharing, wherein a bad packet sent to the target can "trip-up" ICS (svchost.exe) which is tied to Windows Firewall. When svchost.exe is halted, the firewall goes down. I expect to hear about an update in the near future from Microsoft correcting this issue.

This attack requires the attacker to be on the same network with the target machine. It also requires that the computer under attack have ICS enabled, not have any other software firewall running, and it is not behind a NAT router. If this is you, please call me for a consultation immediately and have your checkbook at the ready.

My point is that almost no one is vulnerable to this new attack that brings down Windows firewall, and those who are indeed vulnerable probably don't have any information on their system worth stealing. Most computer-savvy users are usually behind a router of some sort, especially if they use a wireless router at home. As cheap as they are, I might just give a few away at my debut Internet security course. No one should be without at least some sort of security hardware these days.

Yes, There Were Issues

The last post (October 30) was actually written on the 28th. I just couldn't publish it. I kept getting "There were errors," and the errors varied from an unresolvable host (benrehberg.com) to session timeouts while talking to my servers.

There is a special way to handle yourself at these times: you wait. There is nothing else you can do, so you just save that text and try again later - usually the next day everything is fine.

We had problems all week. For a couple of days I couldn't publish.

Last night, though, everything seemed even faster than before, and publishing went very well (you may have noticed). Above my Gmail list this morning I saw a headline titled "About those Blogger Outages..." and I knew there had to be trouble. I clicked and read. Turns out that Blogger isn't fully Google-ized yet, but when they get there we Blogger users can all enjoy the same flawless operation we experience nearly everywhere else on Google. I can't wait.

Loving It

I am really digging Firefox 2.0. The power in South Georgia blinks at least once per week, at which point my computer shuts down without my knowledge. I hate that. I always have at least five programs running and five tabs open in Firefox, and I can't ever remember what the hell I was looking at when the power turned off.

But when I got up this morning, I reset the clock on the microwave, prepared a cup of coffee, and stormed into my office. I'd been working on a website and had all the needed files open as I was crafting my latest (which, by the way, is not working in IE), and now there was silence. No computer fans running; just my two monitors sitting there with orange lights, as if to tell me it wasn't their fault. I shrugged my shoulders and pressed the power button on my PC.

Windows XP Pro booted fine, just like it always does. Network drives mounted, Folding@Home started to run, the FTP server started, and the system settled in. I started Firefox to check Gmail - this is what I always do - but a box appeared:



I couldn't believe it! I never would have thought to have a browser automatically save the open tabs for this purpose! I simply clicked "Restore Session" and the browser opened up with exactly what I had open last night when I went to bed. I must say that this is wonderful. I have a home page with many useful links on it (accessible here), but there are many sites I was visiting at the time which I don't believe I would have found again.

I highly recommend Firefox for anyone.

One Benefit of Ignoring Spell Check

Yes, folks, that's right. I have found one benefit of a person ignoring spell check. Take the following spam message:

Subject: Enquiry

It gives me a great deal of pleasure to write you this mail and even when it might come to you as a surprise.I hope you find it of interest.

Let me first introduce myself. My name is Magnus Denis and I am a staff of an Auditing and Risk Management Firm, here in Spain, I should like to usethis means to ask your assistance in moving some fund over to your country.I have, in the course of my duties come in contact with a good amount of money that have been inactive for some years now and careful investigation proved the original depositor of the fund had died some years back and all attempts to reach the supposed beneficiary of the deposit were fruitless and before it is forfeited to the state, I decided to move it.

After legal consultation, I have concretized modalities for a secured way that would guarantee a perfect transaction. But be most assured that for your help and partnership you will get a good percentage of the total sum. It is important to let you know that fifty percent of the rest will be invested over there under your anagement. For a negotiable period of time and we will open a fruitful dialog to that effect.

I look forward to our working closely in practically seeing this transaction come to a perfect and successful end. For effective communication, please kindly include in your reply, your complete Names, Address, Occupation, Age and most especially your contact number and I will contact you as soon as I get your reply.

I look forward to hearing from you and I express my gratitude for your patience.

Kindly reply to:magnus_denis@k.ro

Magnus Denis

Right off the bat we know it's spam, simply because someone with this much money would absolutely have to know how to spell "inquiry," or at least be doubtful about its spelling. This is a scam related to another, much older scam that had something to do with a fellow in Nigeria. If you get this message in your e-mail, please delete it without getting greedy and losing your retirement.

Busy Day

No questions, please - this is what I do.

Reverse Broadband

I got curious today about the upload/download speed here at the office because I heard that the new Internet Security Routers (ISR) were slowing down traffic at all of the sites.



Too bad I didn't run a speed test before they installed it today. This is interesting, though. I have never seen the upload speed at ten times the download speed.

There is really no way to be accurate here, though. We have around 100-120 machines on the network, and probably several users streaming audio from some website. We also have many computers using a terminal emulator connected to a mainframe in Atlanta, querying data constantly.

But I applaud the I.T. folks for finally going to private addressing. Up until last month, every computer in every office that was connected to the network had a publicly-routable IP address. Very dangerous if you ask me. We're busting at the seams with sensitive data; there is a constant high probability that we could have a very similar incident the VA had earlier this year, or a network break-in like NASA had several years ago.

Of course, everyone is subject to the vulnerabilities of social engineering. I encourage everyone to read the interesting (if not also true) stories in Kevin Mitnick's The Art of Deception: Controlling the Human Element of Security. I wonder if our Information Security Manager has read it.

Firefox 2.0 Released Tomorrow

An exciting day tomorrow as Mozilla announces Firefox 2.0. Just a week after the release of IE7, Firefox's latest hits the streets and offers much the same protection as Microsoft's browser. I highly recommend Mozilla products because they work and they're free.

If you're a PocketPC user, try Minimo, a Mozilla browser for the Windows Mobile platform.

If you're on the go, try Mobile Firefox, a browser designed to run directly from a flash drive and save all your history and temporary files to that same removable disk, enhancing your privacy on the road. That one's also handy for browsing on a friend's laptop or home computer for a few minutes to check on the daily porn.

Then, for a real challenge, find a version of IE that you can carry in your pocket.

If you're reading this on or after October 24, 2006, get Firefox 2.0 here.

Richard Stallman and GPLv3

I'd heard of Richard Stallman before, but never really looked into it. Seems that he's stirring up some really good stew lately.

For those of you who don't know, Stallman is the founder of the Free Software Foundation (FSF). This group oversees the General Public License under which most free software is distributed. If you need to know more about Dick, consult Wikipedia.

A little trivia: the TiVo runs Linux. The source code to the TiVo software, in accordance with the GPL, is available free of charge, but TiVo says it's illegal to alter the code and then run it on their hardware. Perfectly fine. The license only covers the software. Stallman's GPL, version 3, suggests that anyone should be able to do anything they want with the TiVo, and other devices which depend on Linux and other open-source code. Therein lies the problem. If the GPL makes the hardware basically open-source, who's gonna buy another TiVo when the kid down the street can build you one in 30 minutes out of spare parts?

This would drive TiVo and the others to move to a closed-source structure, slamming the door in nerds' faces. It will also cost many companies a lot of money, namely Red Hat, TiVo, and Novell. You might ask: “Why do you care?”

I care because, well, I don't know. This just struck me as a bit weird. Daniel Lyons in this Forbes article was pretty hard on Stallman, making several references to radical behavior and likening the FSF to jihadists. I think Lyons and Stallman are having issues, though. Who knows? The public may not see a thing. It just may be slightly more expensive or a bit longer wait to get Grandma using Linux. That's what bites.

Microsoft Streets & Trips

I got the very latest version of Microsoft Streets & Trips yesterday and installed it. Everything went fine and it doesn't look too much different from S&T 2006; we just assume that everything is more up-to-date. There were no major updates; still no voice interaction.

I went to put the box on the shelf next to the others when I happened to notice the points of interest (and the number of them) listed on the box. I made the comparison. So I decided to use Google Documents & Spreadsheets to collaborate with my colleague and compare the difference between the versions. From the 2005 to 2007 versions, there are 88,998 fewer restaurants listed. I think that is significant in some way. It may just be more accurate (that would be significantly better), or it could just be that places have closed or no one's interested in listing themselves with whatever service Microsoft uses to get them into the program (which would be - you guessed it - significantly worse).

So here's a link to the spreadsheet (publicly viewable). At the time of writing we didn't have the data in for the 2006 version, but my colleague is probably looking for the box.

And yes, I realize that this post has a very limited audience.

You Get a LInE, I'll 6et a PoLe, We'll Go D0wn to the Phishin' Hol3

I was taking a look at my spam this evening when I noticed a mail from Bank of America. Hmmm... I thought. What possibly could make Gmail think that this was spam?

The first line gave it away:

Your Online Banking is Blocked

---

We recently reviewed your account, and suspect that your Bank of America account may have been accessed by an unauthorized third party. Protecting the security of your account is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features.

To restore your account access, we need you to confirm your identity, to do so we need you to follow the link below and proceed to confirm your information:

http://sitekey.bankofamerica.com.signon.do.onlinesecureserver.us

Tank you for your patience as we work together to protect your account.

Sincerely,
Bank of America Customer Service

*Important*
Please update your records on or before 48 hours, a failure to update your records will result in a temporal hold on your funds.

---

Bank of America, N.A. Member FDIC. Equal Housing Lender
© 2006 Bank of America Corporation. All rights reserved.

These people are very stupid, and yet I'm sure that there were some people today who were dumb enough to click on that link and enter their account information. Two things:

Bank of America (or any banking institution) no longer puts direct links to the signon page in their e-mails to customers, or anyone. They all tell you to go to the site and sign in, manual-like.

Professional correspondence from a company that does billions of dollars worth of business will not replace the word "temporary" with "temporal," or say "Tank you for your patience...."

Okay, three things. I just noticed that it was not even sent to the e-mail address I have on file with the bank.

Please be careful with e-mail messages. If you have any sort of question about a peice of correspondence telling you that there's trouble with your account and your identity needs to be verified, just pick up the phone or go to the bank yourself. Those are the only ways to be sure.

Sweep the leg, people.

How to do the signature thingy:

I use the Blogger engine for publishing. That interface has a "template" feature where I can put in crap that shows up in every post without me having to explicitly place it there. So I decided to put my little signature at the bottom of every post.

That signature is only a .jpg image I created with my tablet PC and Windows Journal. I just wrote my name, copied the handwriting as an image, and saved it. It now sits on my web server and every blog post simply calls that image with the <img> tag.

You don't have to have a tablet or a digitizer. I did a signature for e-mails when I used Outlook at my last job. I signed my name on a peice of super-bright paper and scanned it in. Easy as pie.

Just get the image and put it at the bottom of every post. The only problem you'll have is matching the background at your blog.

He's a Star Now

How much did he get paid for this?

The $53 Camera is Fantastic

Walking the Dog

Oct 8, 2006 - 42 Photos

We went for a walk today and I made sure to take the camera along. It was a nice cool day and we all enjoyed ourselves for the majority of it.

Ffocee

Anika tries her best to say the word "coffee," but it just won't come out right. The result is hilarious, but can prove dangerous come Monday morning at daycare.

Goodbye

My grandmother died last night. She was 86. Lovely woman she was; raising 12 children on $2 a day makes a very patient person.

Now comes the time to make preparations for three generations to gather and say their goodbyes. No doubt the place will be filled with old children concerned, young children oblivious, and everyone else in between. Grandma no longer has worries about another stroke, nor is she concerned about the unsteady hand of those with Parkinson's. She lived a full life and devoted much of it to her children and grandchildren. She had a wonderful sense of humor all the way through and will certainly surface time and time again in many joyful conversations for the rest of many lives. She will be missed.

Mission Impossible

Hi, and welcome to benrehberg.com. I have had this Internet presence for about three years now, and am enjoying having my own name out there.

I got this domain for one real reason - at the time I was changing ISPs pretty often, and had to change my e-mail address at the same time. I wanted one mailbox, no matter where I was or who my provider should be. benrehberg.com was the solution. I had my own name and e-mail: ben@benrehberg.com. Then I screwed up.

I was going to see what the "Free iPod" was all about, and what I had to do to get it. I used my own e-mail address that day. Two years later, that address gets about 80 spam e-mails every 24 hours.

So now I'm on a mission to clear that address, and we'll see how we do. I am going to "unsubscribe" from every spam message I get, and we'll see how that works.