Author: Dave Farquhar

Linux is unrelated to extremism

Dave Farquhar Linux , , , , , , , ,

The NSA’s spying on Linux Journal readers is precisely what’s wrong with NSA spying. Why? It paints with an overly broad brush.

Eric Raymond’s views on many things are on the fringes of what’s considered mainstream, but he’s not the kind of person who blows up buildings to try to get his point across.

And here’s the other problem. Does Eric Raymond even represent the typical Linux Journal reader? Odds are a sizable percentage of Linux Journal readers are system administrators making $50,000-ish a year, or aspiring system administrators who want to make $50,000-ish a year, who see knowing Linux as a means to that end.

It’s no different from targeting Popular Mechanics readers because someone could use information it publishes in ways you don’t agree with. Read more

Why you can’t get a $50 replacement sound/control board for your modern Lionel train

Dave Farquhar Toy trains , , , ,

Every so often, some people start raging on the train forums, or even in the pages of the magazines, about modern electronics in modern O gauge trains. The modern electronics make the model trains sound just like real trains, but eventually heat and power surges take their toll, the board goes poof, and now that $2,000 toy train doesn’t work anymore and needs a $300 replacement circuit board.

And by the time that happens, that $300 replacement circuit board might be out of production, and no longer available at any price.

Which has led to countless calls for some enterprising hobbyist to become a multimillionaire by inventing a $50 replacement board that works on every train.

There are several reasons for the situation. Read more

Be careful about cheap phone/tablet chargers

Dave Farquhar Uncategorized

Consumerist has a sad story about a woman who was electrocuted by a cheap USB charger. The danger seems greater in countries that use 230 volts around that house rather than 115 like the United States, but even 115 volts can be dangerous if it crosses a vital organ.

A charger’s job is to take the higher AC voltage that comes from the wall and convert it to 5 volts DC to power the phone or tablet plugged into it. Poor design or poor manufacturing can cause the wall voltage to go where the converted voltage is supposed to. Literally, getting the wires crossed in this situation is very dangerous.

The solution is to be careful where you’re buying your chargers. Don’t buy them out of the back of a van, and don’t buy them from the dollar store. Get a charger made by a company you’ve heard of, and look for a regulatory logo on it. Approved products sold in the United States generally will bear a UL (Underwriter Laboratories) logo on them, while approved produces for the European Union will bear a CE (Conformité Européenne–European Conformity) logo.

I agree that many chargers are greatly overpriced, but there are reasonably priced, safe third-party chargers available too, such as the Amazon Basics USB charger, which costs around $9. Some stores have their own house brand that are similarly priced. Even at $9, there’s a comfortable profit margin for the retailer.

The difference an SSD makes

Dave Farquhar Hardware , , , , ,

Back in the spring I bought a used computer. My wife wanted one, and while I probably could have cobbled something together for her, I didn’t have any extra Windows 7 licenses. So I bought a home-built Pentium D-based machine with Windows 7 on it from an estate sale for $70. The Windows license is worth that, so it was like getting the hardware for free.

When I got the hardware home to really examine it, it turned out not to be quite as nice as I initially thought. It was a fairly early Socket 775 board, so it used DDR RAM and had an AGP slot, limiting its upgrade options. The system ran OK, but not great, and it was loud.

The hard drive was a 160 GB Western Digital IDE drive built in 2003. That’s an impressive run, but a drive that old isn’t a good choice for everyday use. It’s at the end of its life expectancy and it’s not going to be fast. This weekend I got around to replacing it with an SSD. Read more

The Moto E, two weeks later

Dave Farquhar Android , ,

I’ve been using my Moto E for a couple of weeks now, and sometimes impressions over time are much better, or at least more useful in the long run, than initial impressions.

I still like the phone, but I’ve discovered a few things, mostly good.

Read more

Rick Broida thinks he doesn’t use antivirus software

Dave Farquhar security , , , ,

C’mon. You knew I’d get around to writing a response to Rick Broida’s claim that he doesn’t use antivirus software.

Actually, he’s not nuts. But he’s also mistaken if he thinks he doesn’t use antivirus software. His editorial is kind of like saying, “I don’t use a web browser. I use Internet Explorer.”

Although he’s mistaken that he doesn’t use antivirus software, and not all of his advice is spot-on, you can do a lot worse than follow his advice.

Read more

How to measure the effectiveness of a security program

Dave Farquhar security , ,

On a recent episode of Down the Rabbit Hole, Rafal Los and James Jardine asked CISO-turned-CIO Joe Riesberg how he measures the effectiveness of a security program. He came up with five things, which are pretty much how we measure our effectiveness where I work too. That’s a pretty good indicator. Read more

How to do one-off patches without an Internet connection

Dave Farquhar security, Windows

If you need to patch a small quantity of Windows servers or desktop PCs and don’t want to download four gigabytes of updates, or, worse yet, can’t download updates, WSUS Offline Update is your buddy. Don’t let its name fool you–it doesn’t require a Microsoft WSUS server in order to operate. But if you have a local WSUS server, you can point it at that to download updates, which is faster than downloading from Microsoft.

It’s a script that can download all existing updates for a given operating system, and then, you can run it off a network drive or removable media on individual systems to install missing patches and service packs. It’s a reliable way to quickly patch a small number of systems. I’ve had to use it a few times in my career and it’s worked well for me.

Patching hundreds of systems with it isn’t something I recommend–if you have a lot of machines, you need to stand up an enterprise patching solution–but this tool definitely has its uses, especially in small environments, or even for one-offs in large environments.

I can think of another good use for it: If you have a development network that doesn’t have an Internet connection, this will let you download and apply updates to it so your development network matches production, which is critical for a properly-working environment.

In the bad old days I used to use batch files to apply updates. This is better, because it will apply only the missing updates, and it does a reasonably good job of applying the updates in the proper order. Using batch files, sometimes I would have to run the file, reboot, and repeat a half dozen times to end up with a clean system, which didn’t make the security team happy. When I started using the predecessor to this tool, my security team and boss were a lot happier.

XP may not be as bad as it sounds

Dave Farquhar security, Windows ,

Patrick Gray and Darren Pauli of The Register blasted the continued use of XP on Risky Business last week.

But I think their criticism is based on an assumption that may not be correct. Read more

Don’t run unknown executables for a dollar. And PLEASE don’t for a penny!

Dave Farquhar security , , ,

I can’t bribe my preschooler with a penny anymore, but, sadly, a consortium of Carnegie Mellon University, NIST and Penn State University found that 22% of respondents through Amazon’s Mechanical Turk were willing to run a dodgy unknown executable in return for a penny. Fifty-eight percent would do it for 50 cents, and 64 percent would do it for a dollar.

I’ve been telling people for 17 years not to take executable files from strangers. I know the percentage of people who will bend down to pick up a penny off the ground when they see one is less than 22%, so this saddens me. Read more