David L. Farquhar, computer security professional, train hobbyist, and landlord
A friend bought a new computer this month. It arrived sooner than expected, and she called to ask what she should do. I said, among other things, to set it up and leave it powered on continuously for at least 24 hours.
A coworker who had never heard that advice asked why.
So Cablevision and News Corp are arguing about money, and the result is Fox is dark on cable in New York and Philly tonight, and for the foreseeable future.
Build an antenna. No, seriously, build an antenna.
Over-the-air HDTV looks better than cable, because they have to compress and recompress the signal in order to bring you those 432 channels nobody ever watches. And DTV reception isn’t like it was in the analog days. With a good antenna design, reception is much better than it was a few short years ago. Build a Gray-Hoverman antenna out of $10 worth of readily available materials, and you’ll never miss a local broadcast again. In fact, you’ll probably wonder what’s wrong with your cable provider.
And yes, Game 1 of the NLCS is a pretty good game so far. Definitely not worth paying to miss.
Rupert Murdoch delenda est.
When my accountant did my taxes this year (I almost always file Form 4868 to extend my due date, which is why I’m talking about taxes in October), he included a comparison sheet, comparing 2009 to my previous years.
One thing jumped out. I made almost 12% less in 2009 than I made in 2008. My salary for both years was supposed to be the same.
I worked for different companies, but had the same job title and comparable responsibilities. Once company was relatively generous with its benefits; the other extremely stingy.
When I worked for that company in 2009, it seemed like they were nickel and diming me on my benefits, but I never attached a number to it. He did. No wonder things seemed so tight that year.
I didn’t really negotiate the salary. The negotiation started with the hiring executive asking what I make. I told him. He asked if I could produce a couple of pay stubs. I did. And that was pretty much the end of it.
I should have asked more questions, like what the benefits were, and what they cost. Then I should have used those numbers to figure out how much I’d have to make in order to keep my take-home pay more or less constant, because I basically threw away four years’ worth of pay raises when I signed on the bottom line.
Of course, my fear at the time was that if I played hardball too much, they’d just hire someone willing to work for less. I’m not certain that fear was unfounded. And at the time, my phone wasn’t exactly ringing with job offers, even though I was looking aggressively.
So it’s hard to be too regretful. In effect, I took a pay cut. In 2009, so did a lot of people. When I was shopping for clothes for my interviews, I ran into a former classmate at Dillard’s. Working there, not shopping there. I took the job, waited for a better opportunity, and when that happened, I took it.
But when you get a job offer and the time comes to talk salary, it probably makes sense to ask more questions than I did.
I got a new book recently about saving energy. I’ve read several of those, but this one had two tips I’ve never seen anywhere else: caulking baseboards and putting child safety covers on electrical outlets.
It didn’t explain caulking the baseboards, but I will. Frequently there’s a gap in the wallboard where it would normally meet the floor. Maybe it’s laziness—it’ll be covered by the baseboard, after all—but that gap is also a handy place to do after-the-fact wiring, reducing the need to cut into walls and then patch and repaint. The gap makes the area prone to drafts, however. So caulking where the baseboard meets the wall, and where it meets the floor if it’s not over carpet, makes rooms less prone to drafts.
The child safety outlets make for another interesting trick. I’ve talked before about foam electrical outlet inserts and their companion for light switches. And I’ve wondered about putting a child safety plug in. But recently I bought child-resistant outlet covers, after seeing them on This Old House. They come in varieties that twist or slide. I like the sliding ones better, both from an insulating and usability standpoint. They’re convenient because you can just slide the cover out of place, rather than having to remove an insert. And these covers do two things: They put more material between you and the gap in the wall, and they cover the outlet plugs themselves, eliminating that last little source of drafts. And when you have small children like I do, they’re a necessity anyway.
I do insulate interior walls as well as those that face the outside. I didn’t used to bother. But this book mentioned that gaps in interior walls can cause them to act like chimneys, drawing heat out of the room. So I’ve changed my ways.
Both of these are inexpensive upgrades that don’t take long to accomplish. When you buy the switch covers in bulk, it gets even cheaper.
I get ridiculed sometimes for talking about saving energy so much, but think about it. Energy isn’t getting any cheaper. My local utilities ask for rate increases just as frequently as the law allows them to, and more often than not, the state grants an increase. Not always as much as they ask for, but something.
I’ve done a number of other things to help me save energy over the years. Most are pretty inexpensive. I installed thermal blinds and thermal curtains. Then I insulated my hot water pipes. And of course I use LED light bulbs.
My electric usage dropped 19 percent in 2011, so these things work.
I’m ashamed to say I own one Monster cable. Hopefully if I tell you I bought it at a garage sale for $2, I’ll regain your respect. But there’s an easier way to save money on cables than buying at garage sales.
Unless you need it immediately, there’s no reason whatsoever to buy Monster and other overpriced cables at big-box consumer electronics stores. Profit margins are really thin on most electronics, even the big-ticket items, and they use the cables to make up for that. That’s the reason nobody includes cables in the box.
I know your passwords are either written down or insecure. I know it just as surely as I know New Year’s Day is January 1.
I know because passwords have to be incredibly complex to be secure, and I know because the typical person has to juggle half a dozen of them, or more. Think about it. Your work account. Amazon. Ebay. Paypal. Facebook. Your bank. Your personal e-mail. Your credit card. Your online billpay service.
I know you’re not going to memorize a half dozen gibberish passwords that look like 5E%c2.3730pK$0/.
So you have them written down somewhere, which is OK, or you have them all set to the same thing (hopefully not “popcorn”), which isn’t OK. Even if you’re using 5E%c2.3730pK$0/ as your password.
A secured piece of paper works fine until you lose it, or you’re out somewhere and don’t have it.
The solution is a product called Lastpass. Software legend Steve Gibson talked about it at great length at http://www.grc.com/sn/sn-256.htm.
Basically it’s a program, which can run standalone or as a browser plug-in, that stores passwords securely. It mathematically slices and dices the data so that all that’s stored on LastPass’ servers is undecodable gibberish, but, given your e-mail address, your password, and a printable grid you can keep in your wallet, you can decode your password database from any computer, anywhere you happen to be.
There’s a lot of nasty math involved in cryptography, and I won’t pretend it’s my best subject. Gibson goes a lot further into the details than I want to get into. As someone who knows enough about cryptography to get CompTIA Security+ certification, and someone who’s read the official CISSP book chapter on cryptography twice, it sounds good to me.
An additional feature is the ability to store things you need rarely, but when you need them, you need them desperately. Things like your credit card numbers, driver’s license number, and your kids’ social security numbers.
There’s a free version of Lastpass, and a premium version that works on mobile phones and mobile software like Portable Firefox, which costs $12 per year.
The free version runs on Windows, Mac OS X, and Linux, which covers more than 99% of the computers out there today. And it runs in every major browser.
When you go to run Lastpass, it will import your stored passwords from your web browser(s). And it will give you a rating, based on how secure your passwords are and how often you re-use them. It will generate secure, random gibberish passwords for you and help you visit sites and change your passwords. Along the way it grades you, helping you to increase your security.
It can synchronize too. So if something happens and I have to change my Amazon password and I’m at work, my wife gets the changes, so if she needs to get into Amazon, she doesn’t have to do anything different.
It makes good security an awful lot less painful. I can pretty much say, without reservation, knowing nothing about you except that you use a computer, that you need this.
SSDs, like most disruptive technologies, face some questions and resistance. People will grasp at any straw to avoid adopting them. Thanks to this resistance, a number of SSD myths arose. Here are the myths I see repeated over and over again, and the truth, based on my experience actually using the things.
Note: I originally wrote this way back in 2010. The drive technologies I speak of as state of the art are rather aged now. But the principles still hold today, and will continue to do so. Hard drives have gotten better, but SSD have gotten better at a more rapid pace.
Every once in a while, when you push patches for a living, you come across a time when a Microsoft patch won’t install. This is one of those times, and what I did to fix it.
So, Microsoft KB947742, an old .NET 1.1 fix, refused to install on one of the servers at work. When I ran the executable, all it did was pop up the window showing the Windows Installer switches or parameters. Searching Google turned up a number of people having the problem, but no solutions that worked, although reinstalling the .NET 1.1 Framework and the latest version of the Windows Installer are always good ideas when you run into weird problems. .NET 1.1 is extremely fragile anyway, and reinstalling it along with all applicable hotfixes has worked for me in the past to resolve weird issues, such as permissions issues showing up in the security log. Or .NET applications just suddenly not running anymore, even though they ran just fine yesterday.
I tried everything I could think of and finally stumbled on a solution. I have absolutely no idea why this works. First, I opened a command line, changed into the directory where I had stored the patch, and I ran the following command:
NDP1.1sp1-kb947742-x86.exe /extract .\947742
This extracts the update to a directory called 947742. Inside that directory, I found a single file, named NDP1.1sp1-kb947742-x86.msp. When I double-clicked on the file from Windows Explorer, it installed.
I’ve applied this patch on more than 100 servers and I recall only having the problem on one of them. And, oddly, all other .NET patches and for that matter all other recent Microsoft updates apply to this machine just fine.
I suppose the same fix could work on other Windows updates that supply only a window full of switches instead of installing, or other weird installation issues. It’s worth a shot if nothing else works and you can’t (or would rather not) open a support case with Microsoft.
This is a strange case. If you’re running WSUS or (better yet) Shavlik Netchk and a patch refuses to install, try logging in, downloading and running the offending patch manually and note any error messages. Maybe, just maybe, this fix will help you. Or better yet, maybe the patch will tell you what you need to fix, but don’t count on it.
When absurdity strikes, try extracting the patch and poking around inside, like I did in this case.
It’s not enough to know what to look for in a router. I wanted to get some solid advice on wi-fi network security. Who better to give that advice than someone who built an airplane that hacks wi-fi? So I talked to WhiteQueen at http://rabbit-hole.org, the co-builder of a wi-fi hacking airplane that made waves at Defcon.
Hacker stereotypes aside, WhiteQueen was very forthcoming. He’s a white hat, and I found him eager to share what he knows.
I’ve only wanted tags for about 10 years. Tags are little keywords you can use to help categorize blog posts. And the first blog I ever saw use them used them liberally. You’d read a post, and at the bottom, there were links to similar posts.
I found a way to make WordPress automatically tag all 1800+ posts here. Many of the tags are nonsensical, but they seem to work. I’m finding all sorts of related content all of a sudden. Which makes sense, seeing as I tend to write about maybe 20 different things over and over. Due to the many migrations I’ve made with this blog, much of my content was never categorized, let alone anything else. Now it’s all cross-referenced. Finding related content is easy. Depending on the age of the related content, it’s not always enlightening, but often it is.
So I hope you like it. I know I do. Suddenly it’s far, far easier for me to find stuff on my own blog. And I wrote all this stuff. If I didn’t know it was all there, then how will anyone else?