Windows XP gets its first forever-day

Dave Farquhar security, Windows ,

This week Microsoft disclosed a critical 0-day flaw in Internet Explorer. Microsoft is considering an out-of-band patch, but regardless of when the patch gets released, no Windows XP patch will be coming, except for the companies and governments who are paying a large fee for end-of-life support.

This was about 20 days later than some people estimated, but now it’s happened. The mitigation is to run EMET. But in the long term, getting to a new version of Windows is the only viable option. You can do this on the cheap if you need to.

While we’re talking about browsers, Chrome has the most CVEs associated with it, making it numerically the least secure of the browsers, but they have the fastest time to patch, by far, so the numbers are very deceiving. So using Chrome isn’t a bad choice, especially on XP where Internet Explorer is out of date and forever EOL.

The Warhol Amiga discovery in context

Dave Farquhar Retro Computing , , , ,
The Warhol Amiga discovery in context

A team of digital archaeologists recovered a series of images off floppy disks from Andy Warhol’s estate, including a number of experimental images created by Warhol himself. Judging from the comments in the various places that covered the discovery, the Internet is unimpressed.

Yes, these images appear to be the result of Warhol messing around. In many ways, they’re not all that different from what anyone might produce today messing around with a digital camera and a simple paint program with a fill pattern.

I’m not sure how many of the critics realize Warhol created this stuff in 1985 or perhaps even late 1984, using preproduction, prerelease hardware and software. All of it was likely buggy. And, as much as I like the Amiga, none of it was anywhere near today’s standards at that point. The stuff he had to work with was nowhere near 1989 standards–the Amiga in its early days was notoriously finicky.

Read more

IT security vs. the construction industry

Dave Farquhar security , , ,

On the Risky Business podcast last week, Andrew Wilson, the CEO of Australian cryptography gear maker Senetas, stated that many businesses see the bad things that happen from poor IT security as just a cost of doing business.

Nothing revolutionary there. We’ve all seen it. Target is paying a steep price right now, but what about Michaels and Nieman Marcus? They got breached at the same time as Target, and nobody’s talking about them. Maybe Target thinks the cost of doing business got too high, and they’ve hired a CISO and I hear they’re hiring lots of new security personnel–I have coworkers and former coworkers in the Minneapolis area who tell me as much–but for Michaels and Nieman Marcus, the cost, at least so far, appears to have been manageable.

But Wilson added something that I hadn’t heard anywhere else before. Fifty years ago, he said, construction workers dying while building a large building was considered a cost of doing business. Fifty years ago that was normal. Today it’s unacceptable.

Read more

Training future cassanovas

Dave Farquhar Uncategorized

Last week, a coworker and I had dinner with three representatives from a potential vendor. One said he was planning to celebrate his one-year anniversary with his girlfriend in Paris and Italy. It was going to be a really good time, he promised, and he was excited about it.

My coworker and I, both married, looked at each other. We were about to deflate the air from his balloon, but we had to do it.

“Are you planning to propose to her there?” my coworker asked. Read more

Bethlehem Lutheran Church sacrificed its sanctuary for a greater good

Dave Farquhar Christianity, St. Louis

If all (or even a slim majority of) Lutheran churches were like Bethlehem Lutheran Church, I would still be Lutheran. Since they aren’t, I’m not.

But I’ve gotten ahead of myself, and made this way too much about me.

Late last week, there was a big boom at the corner of Salisbury and North Florissant in the north St. Louis neighborhood of Hyde Park. It sounded like a truck wreck, but it turned out to be the wall and roof of a 120-year-old sanctuary crashing to the ground. Read more

Password advice in the wake of Heartbleed

Dave Farquhar security , , ,

I’ve seen a lot of bad password advice lately. Guessing passwords is just too easy for a computer to do, especially as they get more and more powerful.

Formulas are bad, but unavoidable, so here’s what I recommend if you’re not going to use a password manager creating completely random passwords: Unverifiable (or difficult to verify) facts. Things like what house you lived in in 2001 and what you paid for it. Better yet, your favorite baseball card and what you paid for it. Or maybe the address and phone number of your favorite long-gone pizza or BBQ joint. Think along those lines.

T206Wagner$0.50 was a reasonably good password before I published it here (you paid 50 cents for one at a garage sale! Right?) only because it contains an unverifiable fact. I guarantee T206Wagner$1M (the value of the most valuable baseball card in existence) is in all the password lists these days.

This isn’t especially great advice, but it’s something that there’s half a chance people will be willing to follow, and it pretty much forces passwords to have a nice mix of character types and to be at least 12-16 characters long. I don’t think it forces enough non-alphanumeric characters, or a wide enough variety of them, but left to choice most people won’t put any of them in. It would become lousy advice if very many people chose to follow it, but I know few will, and most people will continue to use the weakest passwords a site allows, so it’s adequate for a while.

The most important thing is to make it personal. What I paid for favorite baseball cards is easy for me to remember. If you never collected baseball cards, think of something along those lines that’s easy for you to remember, with a spin that’s hard for someone else, computer or otherwise, to guess.

How to light the underside of your train table

Dave Farquhar model railroading, Toy trains , , , ,

There are few things worse than fumbling around in the dark under a train layout. So I mounted a ceiling-mount light socket underneath my train table to create a work light so that I could see when I’m working on my wiring. It’s another one of my 15-minute projects, one that pays dividends by making future 15-minute sessions more productive.

I did most of the work with stuff I had on hand. If you want to duplicate my project, you’ll be able to get everything you need at your nearest hardware or home improvement store, and the materials will cost less than $10. I provided Amazon links for everything, so you can see what these items are. Some people know what a wire nut is before they know how to read, and some people may be well into adulthood before they undertake any kind of electrical project. Yes, this is an electrical project. As long as you check and double-check all your connections and don’t plug it into an outlet until after it’s done, it’s safe. Respect electricity, and you’ll find there’s less reason to be afraid of it.

Read more