apple

My standard security lecture

Dave Farquhar Windows , , , , , , , , ,

Myth: Nobody wants to get into my computer because I don’t have anything important saved on it.

Fact: I don’t care who you are or what you do with your computer, security is important. Do you want the Russian Mafia using your computer? The North Korean military? Al Qaeda?

If you’re OK with that kind of vermin using your computer, then do whatever you want. I hope you don’t have problems sleeping at night. If you don’t want that kind of vermin using your computer, I suggest you read on.Odds are, the next 9/11 isn’t going to involve airplanes or even bombs. It’s more likely to be a computer attack of some sort.

Modern computer viruses generally join infected computers together into large networks, which then “phone home” for orders. They can sit dormant for a long time, or they can start carrying out orders immediately. Those orders could be sending out spam e-mail messages. Or those orders could be to conduct an attack on some other computer, perhaps a bank, or perhaps a government or military operation.

Imagine Al Qaeda building a network of a few million computers, then using that network to overwhelm an important computer. When Amazon or eBay have a bad day and you can’t get to them, it’s possible they’re being attacked and struggling to cope with it.

The same approach that crashes Amazon.com could theoretically be used to crash the stock market or the Space Shuttle. Fortunately, that kind of trick is nearly impossible. But not completely.

Building the network is the easy part. Locating a target to point it at is the hard part.

The network already exists. There was a virus expected to trigger on April 1 of this year. It didn’t, for whatever reason. But everything isn’t OK. The network still exists, it’s still growing, and nobody’s figured out yet who built it, what they intend to do with it, and how to get in and disable it. Believe me, there are experts around the world trying to figure it out.

Whoever or whatever is behind it, you don’t want your computer unwittingly participating in it.

Here’s to avoid inadvertently aiding and abetting criminals and terrorists with sloppy computer security practices.

1. Use antivirus software and keep it up to date. Many Internet providers will give you antivirus software for free these days. Call your provider and ask. If not, download Microsoft Security Essentials.

2. Configure Automatic Updates. This allows Microsoft to fix security vulnerabilities in your computer as they’re discovered. Macintosh users, don’t get smug. You need to configure Apple update too–Apple releases a dozen or so fixes every month to fix security issues on Macs too.

3. Don’t open unexpected e-mail attachments. It’s been 12 years since this has been safe to do, but people do it anyway. STOP. NOW. I don’t care how funny the joke is, or how cute or hot or whatever the picture is.

4. Don’t open unexpected e-mail, for that matter. Booby-trapping an e-mail message with a virus isn’t especially difficult to do. Frankly, if any e-mail message looks suspicious (a subject line like HOT HORNY SINGLES WANT TO TALK TO YOU NOW! is usually a giveaway), I just delete it.

5. And if you ignore steps 3 and 4, for Pete’s sake, don’t buy anything. Nearly 10% of people actually buy something based on spam e-mail messages. That just encourages all of this other activity.

6. Use web-based e-mail. Most web-based providers use good spam and virus filtering, giving you an extra layer of protection.

7. Use an alternative web browser and e-mail program. Internet Explorer is literally a superhighway for viruses and other malicious software to hook directly into the operating system. Use Firefox, Chrome, or Opera.

Have I scared the living daylights out of you? Good. If your computer is beyond help, get a reputable IT professional to clean it up. Then start doing these things. If your computer is OK right now, start doing these things.

And then stop aiding and abetting criminals and terrorists.

Happy Patch Tuesday

Dave Farquhar Software , , , , ,

Today was the first Patch Tuesday in nearly four years that I didn’t have to worry about professionally. Since Microsoft released 13 patches today and Adobe released two, my former coworkers might be wondering if I knew something. (I didn’t.)

But I still patched my machine at home, and I recommend you do too. Macintosh owners, you’re not immune, so I have some homework for you too.The Adobe patches apply to Acrobat and to the so-called Adobe Reader (which used to be called Acrobat Reader). I recommend you launch Adobe Reader, go to the Help menu, and select Check for Updates. Unless you’re reading this site on a Commodore 64, these updates apply to you.

Mac users tend to be awfully smug about security, and that myth really needs to stop. Apple hasn’t released any security fixes this month, but they did release 9 fixes last month. The biggest one fixes flaws in 16 different applications. Microsoft probably would have released 16 different patches instead of just one. I prefer the Microsoft approach–besides being a little more honest, it also results in smaller download packages if by some chance one or more of those 16 vulnerabilities happen to not apply to a particular machine.

And now, please excuse me for a moment while I recover from the shock of having used the word “honest” to describe Microsoft.

Just out of curiosity, I looked, and Apple has released security updates every month this year except for April. Unlike Microsoft, they don’t follow a set schedule, and the month isn’t over yet, so I wouldn’t be surprised to see something from them later this month.

I won’t bore you with the details, but basically, what it comes down to is this: If I really want into your computer, all I really have to do is booby-trap a file and get you to open it. It could be a PDF file, a movie, a music file, or something else. I can embed code into that file that gives me complete control of the computer. I just have to know whether your computer runs Mac OS or Windows. And how to write the code, of course. (I don’t know how to write the code and I don’t want control of your computer, so there’s no reason to be afraid of me.)

If you’ve been installing your patches, there’s little reason to be afraid of the guy who who DOES know how to write the code and DOES want control of your computer.

Your computer may update automatically. If you don’t know for certain whether it does, I suggest you find out. Now. No matter whose name is stamped on the case.

How to turn around an automaker

Dave Farquhar Saving money , , , , , ,

So if you’re a CEO of one of the Big Three automakers, you have to fly a private plane, as corporate policy, for safety reasons.

Congress suggested they save money by flying first class, or plane-pool at the very least.I guess the problem with flying first class is that they might run into some angry shareholders. And maybe one or more of those angry shareholders would recognize them and beat the snot out of them?

But that raises another question. Speaking as someone who lost a lot of money in Ford stock (but back in 2000 or so, so don’t cry too hard for me), how many of those shareholders would have enough money left to fly first class? The angry mob would have to be sitting in coach, right?

But seriously. There’s a lot wrong with the three domestic automakers and cutting the corporate jets isn’t going to fix the problem, at least not alone. But let me tell you a story.

In the mid 1990s, I was briefly the treasurer of a student organization while I was in college. My organization had a serious cashflow problem. At midyear, I estimated the remaining expenses for the year based on bills from the first half, and came to the conclusion that we were spending more money per member than we were taking in.

I made this startling discovery by dividing the amount of money we were spending by the number of members we had. It was a bigger number than the amount of money we charged to be a member of the group.

Sure, it’s sixth-grade math, but someone had to do it.

The problem was that I faced a room full of good-ol’-boy, stubborn German Lutherans, some of whom had difficulty doing sixth grade math, and I just couldn’t convince them what we needed to start charging more.

I couldn’t balance the budget by cutting things, but I figured being $100 short at the end of each month was better than being $200 short. And I knew it would get my point across. So I started slashing line items like the stingy Scottish miser I am (and was). Cable TV? Gone. Telephone service? Gone. But most importantly, everything related to parties and beer got cut. That sure got the good ol’ boys’ attention. After all, the only thing more important to a German Lutheran than stodgy hymnals and poorly maintained pipe organs is beer.

When I refused to sign any checks related in any way to the annual Super Bowl party, I got the changes I needed in the budget. They got a slightly cut-down party, and I got the bank account balance back up above zero. This was a compromise, because I wanted to have a surplus at the end of the year. You know, just in case anything broke sometime and needed to be fixed or replaced.

Sometimes you make cuts in the budget not because it’ll balance the budget, but because it sends a message.

If I were the CEO of an auto company, I’d get the rules changed so I could fly in commercial aircraft. I might even go so far as to fly coach. And I’d get rid of those planes.

I’d also get rid of the executive cafeteria. Bob Lutz argued in one of his books that the executive cafeteria isn’t just a perk, it’s a great place to get work done. The problem is the message it sends. I’m not an auto executive, but somehow I manage to get my fair share of work done over a microwaved lunch from Costco that I bring from home every day and eat at my desk.

Incidentally, my boss eats lunch at his desk too.

I don’t need to eat gourmet food provided by the company behind locked doors in a lavish room to be productive. And if you do, you’re not creative enough.

I’d go even further than that, though. I read that Rick Wagoner made $14 million last year. A $14 million salary suggests that you’re the executive of a successful and growing company. Rick Wagoner is not. Time for another story.

In 1997, there was a struggling computer company in Cupertino, California. This struggling company merged with another struggling company, one that specialized in trying to sell underperforming, overstyled computers that ran Unix. I say trying because nobody was buying.

It wasn’t long before the CEO of the struggling company departed, and the erstwhile CEO of the company he bought became interim CEO.

The interim CEO gave himself a base salary of $1. One lousy dollar. The bulk of his compensation came in bonuses and stock options. I don’t know exactly what his motivation was, but it tied his yearly compensation to performance.

It worked. Prior to his taking the helm, pundits had the company on a deathwatch. I don’t have to tell you how the company is doing today or how it got there. All I have to tell you is the name of the company was Apple, and the executive was Steve Jobs.

I don’t know if Apple would have turned around if Steve Jobs had taken a more traditional compensation package. But it’s safe to say that Jobs is highly motivated. And while I personally don’t care much for the products his company makes, he’s obviously successful.

Taking a page or two from Apple’s book seems like a good move for car companies, starting with executive compensation. How Apple manages to remain highly profitable and successful with a market share of around 10 percent would also be a good case study for U.S. automakers, since it’s clear they’re going to have to live with a smaller market share than they’ve been used to having, at least for a time.

Turning the Big Three around isn’t going to be an easy process, and it’s going to take a lot more than a $25 billion loan from the government to get it done. A true turnaround is going to require a change of culture, lots of shared sacrifice, and the motivation to think long term, far beyond the next quarterly report.

Changing things like corporate jets and corporate cafeterias won’t balance the budget, but it’ll help in the shared sacrifice and changing the corporate culture.

And in the long run, maybe some of those perks can come back some day. I don’t know this for certain, but I’d be willing to bet Steve Jobs doesn’t eat lunch at his desk.

My hot water heater: 1984-2008

Dave Farquhar General , , , , , , , , , , ,

I think my hot water heater died today. I thought my shower seemed colder than usual today, and in the late afternoon my wife reported no hot water in the kitchen.

It could be something simple, but even if it is, it’s time.Let’s consider this. In 1984, Ronald Reagan was president. The Kansas City Royals went to the playoffs. The big name in video games was Atari. People were predicting that video game consoles had no future. The big names in personal computers were (alphabetically) Apple, Commodore, IBM, and Radio Shack. Only one is still in that business. It was the year that Chrysler popularized the minivan. It was the year Apple introduced the Macintosh, popularizing the graphical interface and the mouse. Not only did MTV still play videos, but that was all they played. Not every home had a VCR. For that matter, not every home had a microwave. It cost 20 cents to mail a letter, and on average, a gallon of gas cost $1.21. (I remember it being a lot less than that in Missouri.)

The world that built that hot water heater is a lot different from the world we live in today.

About four years ago, a plumber came out to work on it. It was giving me problems then, but under the conditions of my home warranty, he had to bubblegum it back together. I asked how long it had. He said its realistic life expectancy was about 12 years, so it was about 8 years beyond that. It could last another six months, but it could last years.

So now the question is what to replace it with. The stingy Scottish miser in me sees tankless water heaters claiming to save you $150 a year and really likes that. I went to Lowe’s this evening and tried to buy one. There were several reasons why I don’t own one right now.

First, they don’t keep very many in stock. They had exactly one, even though their website said they had two of two different models. The one they had wasn’t the model I really wanted.

Two, they don’t install them. They’ll sell one to you, but then you have to find someone to install it on your own.

Three, they cost more to install than a conventional tank heater. Sometimes as much as the heater itself.

And then I found a controversial column that did the math, and said that a tankless heater might not actually save you any money anyway. I can’t find fault with his logic.

One thing I noticed is that the tankless heaters that the big-box stores sell are 85% efficient. The tank heaters are 76% efficient. The propaganda for the tankless heaters always assumes lower efficiency than that. As best I can tell, the heater I have is 67%, a little lower than the literature assumes.

So it seems to me that if a tankless heater that’s 18% more efficient than what I have now will save me $100-$150 a year, then a conventional heater that’s 76% efficient ought to save me $50-$75 per year, right?

The tank heaters sell for around $320, and installation is about $260. By the time you pay for taxes and the nickel-and-dime extras, it’s $600-$700.

Half the savings for 1/3 the price sounds pretty good. And I can buy one pretty much anywhere and have it installed tomorrow if I make the purchase before noon.

And it will pay for itself in 8-12 years. A tankless heater would pay for itself in about 13, if all the claims are true. If I make a mistake today, either way I go I’ll be likely to be revisiting it in about 12 years anyway. By then, tankless heaters will be more common and probably cost less than they do now (adjusting for inflation of course).

I’ll call the plumber who bubblegummed my old unit back together in the morning. Depending on what he says about the cost of installing a tankless heater, I’ll make a decision. But at this point, I think I’m leaning towards buying the most energy efficient conventional heater I can find.

Secret Service BBS raids from the other perspective

Dave Farquhar Retro Computing , , , , , , , , , ,

I’ve written in the past about the Feds busting people using BBSs for nefarious purposes in the early 1990s. But the only stories I’ve ever heard were from the perspective of the people who got busted, often second or third hand.

Here’s a story from the side of someone who helped the Secret Service for three days in the 1980s.

Read more

An insider’s view of the Atari ST

Dave Farquhar Retro Computing , , , , , , , , , , , , ,

I’m sure pretty much everyone who cares has already seen this on Slashdot or wherever, but I found this blog entry from Landon Dyer, one of the designers of the Atari ST, fascinating.

Read more

No reason for brand wars

Dave Farquhar General , , , , , , , , , , , ,

On one of the train forums I frequent, a legitimate question quickly degenerated into brand wars. And brand wars are one thing, but when people hold their preferred company to a different standard than the other company–in other words, one company is evil because it does something, but their preferred company does the same thing, it isn’t productive.

Actually, I see very little reason for brand loyalty as it is. I drive a Honda and I use a Compaq computer. Do either of those companies have any loyalty to me? No. To them, I’m just a source of income from yesterday.I don’t like the categorization of companies as "good" and "evil." Companies don’t exist to be good or evil. Companies exist for one reason: Make money. And one thing to remember is that companies will always do exactly what they think they can get away with.

In the case of the toy train wars, the two antagonists are Lionel and MTH. MTH is a scrappy underdog that got its start building trains as a subcontractor for Lionel. A business deal went bad–in short, Lionel left MTH high and dry on a multimillion dollar project, so MTH decided to go on its own and sell the product Lionel decided it didn’t want, but Lionel didn’t like the idea of one of its subcontractors competing with it while also making product for them, and understandably so.

MTH and Lionel have been mortal enemies ever since.

A few years ago, MTH accused Lionel of stealing trade secrets. The specifics are difficult to sort out, but someone with intimate knowledge of some of MTH’s products started designing equivalent products for Lionel. MTH sued and won, to the tune of $40 million. The case is now in appeal.

There’s no question that Lionel benefited from this contractor’s knowledge of the competing product. The question is who knew this was going on, who authorized it, and what an appropriate punishment would be. The only people who are questioning guilt have blinders on. There is no innocence here–just possible degrees of guilt. The other question is appropriateness. Lionel doesn’t have $40 million in the bank. Arguably the company isn’t worth a lot more than $40 million. So that $40 million judgment is essentially the corporate death penalty.

MTH is anything but perfect and holy, however. The thing that bothers me most about MTH is its attempt to patent elements of DCC (Digital Command Control), a method for automating train layouts. It’s an open industry standard, widely used by HO and N scale hobbyists. So MTH was seeking to collect royalties on something that’s supposed to be free for everyone to use. That’s a particular pet peeve of mine, and it’s the reason I haven’t bought any MTH products since 2003.

I came close to relenting this weekend though, when I saw some people bashing MTH while holding Lionel up as some kind of perfect, holy standard. It made me want to go buy a bunch of MTH gear, photograph myself with it, and post it on some forums so I could watch these guys have a stroke about it. Fortunately for them, I have better things to do with $200 right now. I also looked on my layout, and I don’t know where I could put the things I would have considered buying.

I’m more familiar with the computer industry than I am with anything else, and if you mention any computer company, I can probably think of something they did that would fit most people’s definition of evil. HP? Print cartridges that lie about being empty. Lexmark? Same thing, plus using the DMCA to keep you from refilling them. Dell? Nonstandard pinouts on power supplies that look standard, but blow up your motherboard if you try to use non-Dell equipment. IBM? Microchannel. Microsoft? Don’t get me started. Apple? Lying in ads.

As far as I’m concerned though, the most evil company of all is Disney. Disney, of all people? Yes. Disney is the main reason for the many complicated rewrites of copyright law that we’ve had in recent decades. Whenever something Disney values might fall into the public domain, Disney buys enough congressmen to get the laws changed. Never mind that early in its history, Disney exploited the public domain for its gain as much as anyone (which was its legal right), even to the point of waiting for The Jungle Book to fall into the public domain before making the movie, in order to avoid paying royalties to Rudyard Kipling. The problem is that now that Disney is the biggest kid on the block, it’s changing the rules it used to get there, so that nobody else can do it.

Unfortunately I’ve even seen not-for-profit corporations, companies that exist mostly to give away money, do dishonest things and essentially steal. If a charity can and will do these things, you can be certain that a for-profit corporation will.

So I don’t see any reason for brand loyalty, aside from liking a product. If you buy a company’s products and you like them, fine. Keep buying them. But that doesn’t make the people who prefer a competitor’s product evil. They didn’t sign off on the decisions, and your favorite company has done its own share of underhanded things too, whether you know it or not.

And there’s certainly no reason to go to war for your company of choice. It wouldn’t do the same for you.

Commodore’s founder comes out of hiding

Dave Farquhar Retro Computing , , , , , , , , , , , , , , , , , , , , ,
Commodore’s founder comes out of hiding

It’s been said that Ed Roberts of Altair fame was the last person to get the better of Bill Gates in a business deal.

But I’ll say it was Jack Tramiel.

Read more

Why I generally buy AMD

Dave Farquhar Hardware , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

I was talking to a new coworker today and of course the topic of our first PCs came up. It was Cyrix-based. I didn’t mention my first PC (it seems I’m about four years older–it was an Am486SX2/66).

With only a couple of exceptions, I’ve always bought non-Intel PCs. Most of the Intel PCs I have bought have been used. One boss once went so far as to call me anti-corporate.

I’m not so much anti-corporate as I am pro-competition.

Read more

My 2007 trip to Chicago

Dave Farquhar General , , ,

I just got back from Chicago. I used to go there a lot, but hadn’t been since high school. Consider this my travel diary. I don’t expect it to be interesting to most people, but maybe someone else will find it useful.Lodging

We stayed at a hotel in Rosemont. The rates are much better in the suburbs, but to get to the Museum of Science and Industry when it opened at 9:30, we had to leave at 7 am. That’s counting the shuttle ride to get us close to the El station, the trip in the El with a transfer to another line, and a transfer to the bus line. So we were spending roughly five hours of our day traveling to and from the hotel.

Transportation

We used public transportation because parking in Chicago is expensive and it’s difficult to drive there. We may reconsider that in the future. It’s also possible, though, that if we stayed downtown near the things we want to do, we still wouldn’t need a car. The trip to the airport would be longer, but we only make that trip twice.

The CTA tourist pass is a really good deal, and the more days you buy, the deeper the discount. And if you make a mistake and leave the station when you meant to change lines, the mistake won’t cost you any extra money if you have the pass. If you’re paying as you go, it will.

My sister and brother in law used a Water Taxi to go from the Field Museum to Navy Pier via Lake Michigan. That was after we had split up for the day, so we didn’t do the Water Taxi thing, but they said it was a fun experience.

We flew to Chicago. I love flying, or maybe I should say I used to. I’ve flown three round trips since Sept. 11–once to and from Dayton, once to and from Orlando, and once to and from Chicago. The “random” screenings are absolutely, positively not random. I’ve been flagged each and every time. I know why. My name sounds vaguely Middle Eastern (it isn’t–it’s Scottish). As I was being patted down yet again today, a thought occurred to me as well. Why would any Arab use the name “David?” That would be like a member of the Bush family using the name “Saddam.”

My bag set off alarms, so it must have tested positive for something. Other than shampoo or sunscreen I have no idea what, but they weren’t going to tell me what they thought it tested positive for. After all, with a name like Farquhar, I might be a terrorist. Can’t trust those bagpipe-toters.

I’m thinking the next time, we should consider Amtrak. Chicago is a 45-minute flight from St. Louis, but the TSA told us to get there 3 hours early because of security. Figure 3 hours sitting at the airport, whatever time the plane has to sit waiting to take off, the time in the air, and the drive to the airport, and you’re up over the 4-hour mark. Amtrak is about 5 1/2 hours. It’s longer, but it’s a lot cheaper (I found a rate of $88 for two adults round-trip) we won’t get as much guilty-until-proven-innocent treatment, we can carry more baggage, and as far as I can tell there are a lot fewer silly restrictions on what we can take. Since my wife is a diabetic, we have to keep some food with us at all times, which meant we had to buy a bunch of food at the only place within walking distance of the hotel. The quality of what we could get wasn’t very high, and the prices were double or triple what we would have paid close to home (think $5 for a box of Cheerios). And we had to throw away our leftovers since we couldn’t put them in our carry-on luggage. I guess there’s a bomb recipe somewhere that calls for Cheerios and apples. Oh, wait. No, bringing outside food in might hurt the airport’s profits. But we’ll call it “security” because that sounds better.

Driving is an option, of course, but I can’t drive to and from Chicago for $88 in a Honda Civic.

So I’m thinking Amtrak, and put the savings toward staying in a hotel in a less out-of-the-way place.

Things to do

As far as things to do, the City Pass is a good deal. For $50, you can go see the observatory, the Han*censored* Building viewing deck, the Shedd Aquarium, the Field Museum, and the Museum of Science and Industry. If you see four of those, you more than pay for the booklet. Plus you don’t have to wait in line. That can save you a couple of hours per attraction all alone.

We’d buy the City Pass again.

Where to eat

What’s the point of going to Chicago if you don’t get pizza, right?

We tried Gino’s East one night on a tip from a friend of my brother in law. Of course it’s good. The place has been around since 1966.

But we got to talking pizza with the bus driver as we were en route from the Museum of Science and Industry to the Han*censored* Building. He told us to try Giordano’s. As luck would have it, there was a Giordano’s within walking distance of the hotel.

Now that I’ve done some digging, I think Giordano’s was the place we tried back in 1989 on our second trip to Chicago.

I liked them both. They were both distinctive, and neither is something I should eat on a regular basis if I want to continue to weigh about 145 pounds. But on a future trip I wouldn’t mind eating dinner at one and then doing dinner the next night at the other.

I remember the very first time my family went to Chicago was in 1985. We wanted to get Chicago style pizza, and somehow or other we stumbled on this place called Perry’s. I have absolutely no idea where it was. I found a website for a place on Devon Avenue in Park Ridge by that name that’s been around since 1967, and the menu features the Gutbuster, which I vividly remember Dad pointing out to me on the menu in 1985. So it’s possible this was the place.

Being our first experience with Chicago-style pizza, Perry’s is now a family legend. And you know how legends go. They get bigger with each passing year. I think within a couple of months the pizza in our memory had become a foot thick, or at least six inches. And nothing we’d had before, and nothing we’ve had since was half as good.

Part of me would love to find Perry’s again, but part of me thinks it would be best to just let legends be legends.

For lunch, a good choice is the nearest hot-dog stand for a Chicago-style hot dog. Let me preface this by saying I normally do not eat hot dogs. I don’t care much for the taste, and I know they’re one of the least healthy things on the planet for you to eat. But I liked these. A traditional Chicago-style dog has onion, tomato, pepper, pickle relish, mustard, chile pepper, and celery salt served on a poppy seed bun. If you put ketchup on it (the person at the counter won’t), the ghost of Mike Royko will come haunt you, and he’ll undoubtedly have some other disgusting ideas for things you could have put on the hot dog instead.

I wouldn’t eat them on a daily basis due to health concerns, but I’ll eat one every time I go to Chicago from now on.

Shopping

There aren’t many places on the Magnificent Mile that I can afford to walk into, let alone shop at, and I’ve never been much for shopping anyway. I hear Chicago has lots of really great train stores. I stayed away from those, putting my short-term financial goals ahead of my hobby.

But if you like to shop, there are tons of places to do it.