Chad’s News

For the purpose of this article, a web service is essentially an application that’s run over the internet via a browser. So, for example, Writely is a full-featured word processor accessible via the web. The advantage of Writely, as with all web services, is that you can use the program and access your data from anywhere in the world and on any computer.

An early type of web service was web-based email. Yahoo! Mail, MSN Hotmail, and GMail are examples. But recently we’ve seen the advent of full office suites. In addition to Writely there are Thinkfree, Zoho Writer, Google Spreadsheets, Picasa Photo Editor, Google Calendar, and Google Base (among others). Microsoft, obviously a bit worried about this competition, is planning to make their Works office suite available as a web service.

Web services are catching on—even in the Chad’s News household. I’ve switched mail programs from Outlook Express to Gmail. I did it for the spam filtering, but it’s also nice to be able to check email whenever I’m out of town. I also switched RSS readers from Habari Xenu to Bloglines.

One of the big negatives for web services is that you’re trusting precious data to a third party. Using Gmail, for example, I have no way of backing up my email data and I’m trusting Google to maintain it in perpetuity. I’m also trusting Google to not go out of business. (This can be a real issue. I have a friend who hosted digital photos in an online repository that went out of business with almost no notice. He happened to be offline for a few weeks, and by the time he got back online it was too late to retrieve his data.) There are also privacy concerns when using a web service for confidential data.

Another negative is that web services rarely have all of the features found in a dedicated program. For most people this will not be a issue, but power users may run into problems.

Web services are here to stay, and they’re gaining in popularity. Expect to see them used more frequently.

(Thanks to Josh for the idea behind this article.)
Copyright © 2006 by Chad Cloman

If you’ve been keeping up with the news lately, you may have heard about net neutrality. As it was first explained to me, telecom companies didn’t think it was fair that bandwidth-hogging, content-providing web sites (think Google) didn’t have to pay for their traffic that travels over the telco infrastructure. So I pay Qwest, for example, to access Google. Google serves up the content through their connection to the internet, whatever that is, and the data travels through the internet, eventually arriving at Qwest’s network and then my PC. This is net neutrality. Some of the more vocal telecom companies, however, want to also charge Google for sending the content over their network. In essence, double-charging and wringing every bit of money possible out of their network infrastructure. It’s no wonder, then, that companies such as Google and Amazon are firmly opposed to this and have been pressuring Congress to pass a net neutrality bill that outlaws it.

Since this original explanation, however, net neutrality has undergone a transformation. Without a net neutrality law in place, the internet would become a two-tier network, where content providers have to pay for preferential treatment. Thus Google, paying for this privilege, would find its content served up in much the same way it is today. While Chad’s News, which cannot afford such extravagant services, would be relegated to a “slower” internet. The best explanation of this is in the linked video of Comedy Central’s The Daily Show. From the video, “The point is that with net neutrality all internet packets - whether they come from a big company or a single citizen - are treated in the exact same way.” (Note that there is some off-color humor in the clip, and the real meat of the issue starts about halfway through.)

So the push is on in Congress. The current efforts to get net neutrality passed as law have failed, but we can expect to see it come up again later this year.

http://www.youtube.com/…
(via The Consumerist)

Keystroke logging has become more of a concern in recent years, as more and more spyware programs install a software-based logger and send the results back to the creator—who then takes advantage of the password, bank account, and credit card information that may have been captured. In addition, there’s the problem with loggers installed on public computers (never enter sensitive information on a public computer—you’ve been warned).

With all this emphasis on software, however, it’s easy to forget about the hardware-based loggers. ThinkGeek has one for sale, at a mere $99. Simply unplug the keyboard, attach the Key Katcher, and plug it back in. Remove it later and you can browse up to 130,000 keystrokes. Very useful for checking up on a potentially-cheating significant other, or monitoring a child’s internet use. Or, for the creative, posing as cleaning staff and installing them on a bank’s computers. (The bank in question now super-glues keyboard cables to the computer, although there are other, less-expensive solutions.)

The gist of it all is that physical security is just as important as firewalls, anti-virus/spyware software, and network/internet security. Did you know, for example, that it’s quite easy to reset Windows passwords provided you have physical access to the computer? (Via the Linux disk or the login.scr trick.) And you can usually access the files themselves just by moving the hard drive to another machine that already has Windows installed—which is why really sensitive files should be encrypted.

It’s a dangerous world out there, in the land of computers, but knowing the potential risks is the first line of defense. I’m sure I haven’t covered them all, so feel free to leave comments with any additional information.

For us netizens who reside in the United States, “use taxes” are starting to become an important topic. Essentially, a use tax is a sales tax on purchases for which you didn’t have to pay sales tax. I know that sounds confusing, so let me give an example:

I live in Denver, Colorado but travel to Oregon (which has no state sales tax) and purchase a car. When I return home, I am required to pay a use tax of 7.6%:

• Colorado state: 2.9%
• Denver city: 3.5%
• Regional Transportation District: 1.0%
• Scientific and Cultural Facilities District: 0.1%
• Metropolitan Football Stadium District: 0.1%

This happens to be exactly the same amount I’d pay in sales tax had I bought the car in Denver. If the car were to be delivered to my location in Denver, then the seller should collect the use tax. Otherwise, it is my responsibility to pay the taxes to the appropriate authorities.

So why is this important? It’s all about the internet. When I purchase a “tax-free” product online and don’t pay the appropriate use tax, I’m breaking the law. As internet sales have become more popular, the states have begun to realize they’re losing use-tax revenues—so they’re cracking down. Some states, Colorado not among them, have put a line on the state tax form for honest citizens to declare any use taxes they owe. As the linked article states:

“If you’ve written zero or left [the use tax entry] blank, during the audit we’re going to make you produce your financial records, bank statements, credit card statements,‘ said Michael Bucci, a spokesman for the New York Department of Taxation and Finance.

Over the past few years I’ve heard various mutterings about the collection of use taxes for internet purchases, and I expect it to become more of an issue as time progresses.

http://news.com.com/…

Paramount is suing Russell Lee for more than $100,000, alleging that he obtained an illegal copy of a movie and subsequently uploaded it to a filesharing network. In defense, Mr. Lee claims the real perpetrator hijacked his (then unsecured) wireless network. The evidence is weak, and while Mr. Lee will probably be exonerated he will still have to pay legal costs and deal with the stress of a court case. This just underscores why wireless security is so important.

If you have a wifi network, here are the basic things you should do to secure it:

• Change the router’s default admin password.
• Change the SSID and disable SSID broadcast.
• Enable WEP or WPA. If both are available, use WPA—in fact, if your router doesn’t support WPA then consider getting a newer model.
• Use MAC filtering.

These steps will not keep out a determined expert hacker, but the goal is to make it difficult enough that he/she will hijack someone else’s network.

Every so often the tech news community lights up about a gaffe related to document metadata. Some years ago Apple was running a fairly successful switch campaign where people gave testimonials about why they switched to a Mac. Microsoft responded with its own anti-switch campaign. The name of the person in the Microsoft testimonial was not given but was included in the document’s metadata. An AP reporter was able to track her down and discovered that, much to Microsoft’s embarrassment, she worked for a PR firm employed by Microsoft. To add further damage, the picture in the testimonial was a fake, taken from stock footage. Microsoft quickly pulled the ad from its site and pretty much abandoned the anti-switch campaign.

More recently, the United Nations prepared a report on the murder of Rafik Hariri, the former Lebanese Prime Minister. Some of the more damaging allegations were removed just prior to the report’s release, but they remained in the document as metadata. These politically-sensitive deleted portions were quickly discovered and publicized, to the UN’s embarrassment.

For most practical purposes, “metadata” refers to hidden information kept by Microsoft Word as part of a saved *.doc file. The most common type of metadata is information on the people who created/edited the document. Just pull up a Word document and go to File | Properties. You should be able to quickly find the name and company of the author. This is the type of metadata that caught Microsoft.

The UN situation was a bit different. They had enabled Word’s abililty to track revisions, because the document was being edited by multiple people. The author forgot to accept the changes, thus making the original draft and the full revision history available to those “in the know.”

Anyone in a business or professional environment needs to be aware of document metadata—the potential for damage is just too high. The following are some ways to properly deal with metadata:

• Use the Office add-in provided by Microsoft, or (recommended) purchase a commercial “scrubber”. There is also a free utility, Doc Scrubber™, that works pretty well.
• Save the file in the RTF format and then convert it to PDF for distribution. (You should be doing this anyway—distributing non-draft versions of *.doc files can bite you.) Be aware that Adobe Acrobat also retains some metadata, so just converting to PDF may not be enough.
• Turning off the “track changes” feature and/or selecting “accept changes” are not sufficient to remove your metadata.

Additional/Reference Links:

• http://www.denniskennedy.com/…
• http://www.lifehacker.com/…
• http://www.corante.com/…

For those who read my recent post on the perils of leaving an unpatched Windows computer connected to the internet, you may have noticed a slight problem. The typical home user would install Windows XP, then connect to the internet and run Windows Update to download/install Service Pack 2. In the time it takes to download the updates, however, your computer has a non-trivial chance of being compromised and turned into a zombie. So what’s the solution?

The first option would be to get a copy of SP2 on CD. Microsoft provides them for free (plus a shipping charge). But there is still a drawback. If you configure your network/internet as part of Windows setup, you could still be compromised in the time it takes to install SP2 from CD.

A better option is known as “slipstreaming.” If you have a Windows XP installation CD, you can combine it with Service Pack 2 to create an integrated installation. This, in turn, can be burned to disc—thus creating a Windows+SP2 installation CD. The slipstreaming process will also save the time required to install SP2 (and the required reboot).

The process is fairly straightforward and is described in detail at Tom’s Hardware. It does require you to download a very large (270+ MB) file from microsoft.com, so no dial-up allowed! The same file appears to be on the SP2 CD, however, so you could probably skip the download if you have the disc.

Copyright © 2005 by Chad Cloman

The bird flu has been in the news lately. I’ve been following it for nearly a year now (some of you may remember my mass email on the topic that I sent last February), and I’ve written an article discussing flu pandemics in general and the bird flu specifically. It contains important information that I think everyone should know, as well as the latest news on the subject. So check it out and let me know what you think.

http://www.sciscoop.com/…

I’ve been seeing a bunch of articles on a new type of spyware: keystroke loggers. A keystroke logging program will keep track of everything you type and then forward it to someone who will look for account numbers and passwords. This can be very bad when the information is for banking, credit cards, and such. A recent study found that 15% of all spyware is of the keystroke logging type.

Most of you reading this are quite tech savvy and know all about not opening attachments on incoming emails and not clicking through to web addresses given in emails (especially those purporting to be from eBay, your bank, or PayPal). But there are other ways to install malicious keystroke logging programs with which you may not be familiar.

Security Holes: Computer systems that don’t have the latest security updates are vulnerable for as long as they are connected to the internet. Malicious programs continuously scan the internet for computers with open ports to unpatched programs. Tests were run with a fresh installation of WinXP SP1, and it took approximately 4 minutes before the computer was compromised. The best way to protect against this type of attack is two-pronged: 1) Apply all patches and updates as soon as they are available, and 2) use a firewall.

Browser Vulnerabilities: Carefully crafted web pages or even web addresses can attain the ability to execute programs on your system. The best way to protect against this type of attack is to not use Internet Explorer. If you must, ensure that all of the latest patches are applied.

DNS Cache Poisoning: This is one of those cases where even if you do everything “right”, you can still be compromised. Essentially, a system that you use for DNS is given false DNS information and stores the data in its DNS cache. So when you type in www.paypal.com, for instance, you are redirected to a spoof site which gets your login/password information (and may also attempt to exploit browser vulnerabilities). The best way to protect against this type of attack is to minimize financial transactions online. In reality, you just have to trust that your ISP and upstream providers don’t let their systems get compromised—it’s really quite simple and comes down to having their DNS system correctly configured.

Internationalized Domain Names (IDN): IDN is a fairly new standard whereby non-Latin (non-English) character sets can be used in domain names. This is of greatest concern for Asian-language domains, but it was expanded to include all languages. It turns out that some languages have characters that are identical to the English language, but which are treated as different under IDN. This only works when you click through to a spoofed web site, via email or a link on another site. The best defense against an IDN attack is to use Internet Explorer 6, as it does not support the IDN standard. Other browsers, such as Firefox, have implemented security procedures to ensure the user is aware of IDN site names, but older versions do not have these measures in place and are vulnerable. More recently, researchers have found another IDN exploit in Mozilla/Firefox, and it seems like the best thing to do for now is to simply disable IDN.