[ 
- David L Norris
- Indianapolis, Indiana, United States
Semi-topical babble about Radio, Computers, Linux, Life, the Universe, and Everything.
Search in Posts
Previous Posts
Archived Posts
2006-05-03
Have you ever wondered why there are so many security bugs and viruses on Windows? Let me posit for a moment that it's because people who write software for Windows are swimming in a sea of incomprehensibility. Microsoft often apologizes with "Windows is more flexible than UNIX" when they compare the two. Right, it's more flexible. Of course it is. If by some chance you can actually understand how any of it works.
There are generally two ways to do everything in the modern programming world: Microsoft's Way or Everyone Else's Way. Everyone Else generally falls under the umbrella of UNIX. Back in the 1980s Microsoft abandoned UNIX and decided that they would create their own beautiful yet incomprehensible way of doing everything. Everyone else stuck with the UNIX way of doing things. Why? UNIX systems represent everything in a relatively simple and well understood manner which hasn't changed much since hippies roamed the Earth.
I think even the non-programmers will see what I mean when I say that UNIX is easier to understand. Here are two examples of the same functionality from Microsoft's UNIX Application Migration Guide
Notice how the Windows code needed a million comments to explain what in the world all that nonsense jargon was doing? (Comments are everything after a // in the above code.) The UNIX code was simply "mkfifo", a filename and some easily learnable security bits (0777). Simple enough that it needs no explanation.
Also telling is that Microsoft's UNIX example used 0777. 0777 disables all security allowing anything to access the fifo. This is just stupid. However it is understandable for a Windows programmer to do this out of habit. Windows programming interfaces don't have standardized security methods. Nearly every function has its own unique way of dealing with security. So you can't easily remember how security works in any given situation. So it's just easier to disable security and hope everything works out.
UNIX is a trademark of The Open Group. Linux is a trademark of Linus Torvalds. Mac is a trademark of Apple. Somehow, Windows is a trademark of Microsoft. Trademark is a trademark of trademark. And so on.
Wait, what is UNIX?
To be clear, UNIX was originally an operating system developed by AT&T primarily in the 1960s-1970s. Today UNIX is a blueprint for how to create an operating system. There are many operating systems based on the UNIX System in wide spread use. UNIX Systems run a majority of the Internet, for example. The most popular systems are Linux, Apple Mac, and Sun Solaris. These systems are all very similar to each other. You can take a program written for one of them and use it on the others typically without any modifications.There are generally two ways to do everything in the modern programming world: Microsoft's Way or Everyone Else's Way. Everyone Else generally falls under the umbrella of UNIX. Back in the 1980s Microsoft abandoned UNIX and decided that they would create their own beautiful yet incomprehensible way of doing everything. Everyone else stuck with the UNIX way of doing things. Why? UNIX systems represent everything in a relatively simple and well understood manner which hasn't changed much since hippies roamed the Earth.
Creating a Pipe
Let's take the example of a simple pipe. For the non-programmers out there a pipe is exactly what it sounds like: it's a pipe. To simplify, if you shove the text "Hello over there!" in one end of the pipe it comes out the other end. A pipe enables two separate computer programs to talk to each other.I think even the non-programmers will see what I mean when I say that UNIX is easier to understand. Here are two examples of the same functionality from Microsoft's UNIX Application Migration Guide
UNIX Pipe
int main()
{
int res = mkfifo("/tmp/my_fifo", 0777);
if (res == 0)
printf("FIFO created\n");
exit(EXIT_SUCCESS);
}
Windows Pipe
int main()
{
BOOL fConnected;
DWORD dwThreadId;
HANDLE hPipe, hThread;
LPTSTR lpszPipename = "\\\\.\\pipe\\mynamedpipe";
// The following is an approximation of the mode bits used
// in the UNIX example. Will suffice until verified. 0777
hPipe = CreateNamedPipe(
lpszPipename, // pipe name
PIPE_ACCESS_DUPLEX, // read/write access
PIPE_TYPE_MESSAGE | // message type pipe
PIPE_READMODE_MESSAGE | // message-read mode
PIPE_WAIT, // blocking mode
PIPE_UNLIMITED_INSTANCES, // max. instances
BUFSIZE, // output buffer size
BUFSIZE, // input buffer size
PIPE_TIMEOUT, // client time-out
NULL); // no security attribute
if (hPipe != INVALID_HANDLE_VALUE)
printf("FIFO created\n");
exit(EXIT_SUCCESS);
}
Notice how the Windows code needed a million comments to explain what in the world all that nonsense jargon was doing? (Comments are everything after a // in the above code.) The UNIX code was simply "mkfifo", a filename and some easily learnable security bits (0777). Simple enough that it needs no explanation.
Also telling is that Microsoft's UNIX example used 0777. 0777 disables all security allowing anything to access the fifo. This is just stupid. However it is understandable for a Windows programmer to do this out of habit. Windows programming interfaces don't have standardized security methods. Nearly every function has its own unique way of dealing with security. So you can't easily remember how security works in any given situation. So it's just easier to disable security and hope everything works out.
UNIX is a trademark of The Open Group. Linux is a trademark of Linus Torvalds. Mac is a trademark of Apple. Somehow, Windows is a trademark of Microsoft. Trademark is a trademark of trademark. And so on.
2006-02-17
Anti-virus software and Anti-spyware software vendors frequently issue so-called press releases which proclaim imminent doom to all computers in the entire universe if people don't pay them lots of money. The so-called press releases proclaim, "Pledge allegance to XYZ Brand Antivirus Pro 9 and your computers will be completely invincible!"
Nearly every Microsoft Windows based computer I have ever encountered is filled with malware (viruses, trojans, worms, spyware, and other undesirable software). Especially those Windows computers with anti-virus software installed on them. Anti-virus software often proclaims "Your Computer is Now Clean" at the conclusion of its run. But upon closer inspection it is almost always wrong. Often it takes 4 or 5 separate programs from different vendors to remove all of the malware. There are very few exceptions to this. And most exceptions are because of the people using and maintaining those computers: not anti-virus software.
The other day I read about an oh-so-terrible "virus threat" to Macintosh Computers that will leave Macintosh owners "shellshocked". So the story goes, no instance of malware has ever caused significant damage to more than a few Macintosh computers. The anti-virus software vendors would have you believe that Macintosh computers aren't worth attacking...yet. They claim, "Any day all Macintosh computers in the world will be obliterated...unless everyone purchases XYZ Brand Anti-virus." Of course the anti-virus vendors are going to tell everyone to buy anti-virus software. That's their job.
Any reasonable person knows malware exists for Macintosh, Linux, and UNIX systems. The reason malware doesn't spread very widely on Mac, Linux and UNIX systems is because software applications on those systems are very diverse, well designed, updated immediately after a flaw is discovered and the users of those systems are attentive to potential threats. Users of Mac, Linux and UNIX systems aren't brainwashed into thinking that they are invincible by anti-virus corporations whose only concern is the bottom line. It is infinitely more likely that an actual person will infiltrate a Mac, Linux, and UNIX system because of a bad password or loose lips than malware would successfully attack it.
True computer security only comes with properly written software and well-informed computer users. No amount of anti-virus software will ever protect a computer system from attack by malicious people who wants access. However, properly written (operating system, email, web, instant messenger, office, etc) applications and sufficiently skeptical users will protect a computer system every time.
I would argue that anti-virus software leads to complacency. People who use antivirus software tell you, "I'm protected! I have XYZ Brand Anti-virus! They promised me a pony if I subscribed!" You might even find yourself explaining to them that their anti-virus software isn't even running or their subscription has never been renewed. Worse, those people fail to recognize real security threats because they are under the false impression that anti-virus software protects them. The true believers in antivirus feverishly update their software many times a day and verbally attack anyone who suggest it is a waste of time. Often the anti-virus users themselves run and spread viruses and trojan programs which they have acquired via instant messages, emails, and random websites. Their infected messages are followed with "I ran XYZ Brand Antivirus on it so I know it's clean!"
Anyone who knowingly uses a computer without antivirus software will do so with a healthy amount of skepticism. And they will be all the better for it.
Am I saying to stop using anti-virus software? No, not really. Use it if you want. Do you need anti-virus software? No, of course you don't. But it can be a useful supplement to your security. Anti-virus is not a substitute for making good decisions about where you get your software and how you use it. I am saying that if you implicitly trust anti-virus software to protect your computers then you are selling yourself short.
Stop using poorly written software and start using common sense.
A good starting point is to order free copies of Ubuntu Linux for you, your family and friends.
Nearly every Microsoft Windows based computer I have ever encountered is filled with malware (viruses, trojans, worms, spyware, and other undesirable software). Especially those Windows computers with anti-virus software installed on them. Anti-virus software often proclaims "Your Computer is Now Clean" at the conclusion of its run. But upon closer inspection it is almost always wrong. Often it takes 4 or 5 separate programs from different vendors to remove all of the malware. There are very few exceptions to this. And most exceptions are because of the people using and maintaining those computers: not anti-virus software.
The other day I read about an oh-so-terrible "virus threat" to Macintosh Computers that will leave Macintosh owners "shellshocked". So the story goes, no instance of malware has ever caused significant damage to more than a few Macintosh computers. The anti-virus software vendors would have you believe that Macintosh computers aren't worth attacking...yet. They claim, "Any day all Macintosh computers in the world will be obliterated...unless everyone purchases XYZ Brand Anti-virus." Of course the anti-virus vendors are going to tell everyone to buy anti-virus software. That's their job.
Any reasonable person knows malware exists for Macintosh, Linux, and UNIX systems. The reason malware doesn't spread very widely on Mac, Linux and UNIX systems is because software applications on those systems are very diverse, well designed, updated immediately after a flaw is discovered and the users of those systems are attentive to potential threats. Users of Mac, Linux and UNIX systems aren't brainwashed into thinking that they are invincible by anti-virus corporations whose only concern is the bottom line. It is infinitely more likely that an actual person will infiltrate a Mac, Linux, and UNIX system because of a bad password or loose lips than malware would successfully attack it.
True computer security only comes with properly written software and well-informed computer users. No amount of anti-virus software will ever protect a computer system from attack by malicious people who wants access. However, properly written (operating system, email, web, instant messenger, office, etc) applications and sufficiently skeptical users will protect a computer system every time.
I would argue that anti-virus software leads to complacency. People who use antivirus software tell you, "I'm protected! I have XYZ Brand Anti-virus! They promised me a pony if I subscribed!" You might even find yourself explaining to them that their anti-virus software isn't even running or their subscription has never been renewed. Worse, those people fail to recognize real security threats because they are under the false impression that anti-virus software protects them. The true believers in antivirus feverishly update their software many times a day and verbally attack anyone who suggest it is a waste of time. Often the anti-virus users themselves run and spread viruses and trojan programs which they have acquired via instant messages, emails, and random websites. Their infected messages are followed with "I ran XYZ Brand Antivirus on it so I know it's clean!"
Anyone who knowingly uses a computer without antivirus software will do so with a healthy amount of skepticism. And they will be all the better for it.
Am I saying to stop using anti-virus software? No, not really. Use it if you want. Do you need anti-virus software? No, of course you don't. But it can be a useful supplement to your security. Anti-virus is not a substitute for making good decisions about where you get your software and how you use it. I am saying that if you implicitly trust anti-virus software to protect your computers then you are selling yourself short.
Stop using poorly written software and start using common sense.
A good starting point is to order free copies of Ubuntu Linux for you, your family and friends.
2006-02-07
I finally bought a new wifi card for my laptop. I needed one that would work with the Ubuntu Linux operating system, obviously. I did not want a card that relied on Windows XP drivers because the Windows drivers only offer limited features. For example, Windows XP wifi drivers can't automatically discover nearby access points by themselves. So I found some information at tuxmobil.org which suggested most Atheros-based wifi cards work perfectly with Linux systems. While browsing the aisles at Best Buy I noticed that the Atheros-based wifi cards prominently state "Atheros" on the box in a huge logo.
I purchased a Netgear WG511T. I inserted the card, installed NetworkManager and ran "nm-applet" which, as you can see to the right, added a handy signal meter and wifi network list to my my menu bar. Very cool. It conveniently stores the wifi network keys in my keyring along with all of my other system passwords. If I plug in an Ethernet cable it automatically switches to the "Wired Network" and disables wifi.
2006-01-22
Pandora™ is a free music service that learns what type of music you like. You tell it a few songs or artists you like and begins playing similar songs. Specifying about a dozen song titles, rather than artists, allows you to narrow the music selection really well. To refine it to your tastes you can rate each song you like with a thumbs up and songs you don't like with a thumbs down. After about an hour of learning it does a spectacular job of choosing music you'll like.
You can also share your taste in music with others. For example, I've created Augur Radio on Pandora. Have a listen...if you dare.
If you're using the Mozilla Firefox web browser then drag this Pandora™ Mini link to your toolbar to create a button that will popup the Pandora player in a small floating window.
You can also share your taste in music with others. For example, I've created Augur Radio on Pandora. Have a listen...if you dare.
If you're using the Mozilla Firefox web browser then drag this Pandora™ Mini link to your toolbar to create a button that will popup the Pandora player in a small floating window.
2005-12-03
The new Gateway FPD2185W is a really nice 21" widescreen (16:10 ratio) high definition HDTV/computer monitor with a retail price of $599.99. It allows one to connect up to 5 video sources at once and switch between them; it has one each of DVI/HDCP, VGA, Component Video (YCbCr/YPbPr), Composite RCA, and S-Video ports. The monitor allows picture in picture between any two of the ports.
I quickly discovered one important thing about this monitor. You really need to have a video card that supports the monitor's native 1680x1050 resolution or one of the other resolutions listed in the manual (1680x1050, 1440x900, 1152x864, etc). Something like a cheap nVidia GeForce4 MX400 works fine. The monitor seems to automatically scale the image to fit the screen. At lower resolutions the auto-scaling in the monitor causes irritating color bleeding and smudging of the picture. Interestingly, I've noticed that my HDTV box runs the monitor at 1920x540 at 60 Hz (with the 1080i HDTV setting).
The monitor also has proprietary Windows-only software which claims to rotate the desktop when the monitor is rotated from landscape into the portrait configuration. It would be really nice if one could read the rotation sensor and do the same on Linux using xrandr (X resize and rotate). I was unable to find any sensors listed on the USB port. So maybe the signal is sent down the cable via the DDC line? I haven't a clue.
The monitor even supports the insane, pointless, trivially defeatable, extraordinarily inconvenient, and surprisingly expensive HDCP copy-prevention specification required by certain high definition video equipment and future PCs that will be running Microsoft's Windows Vista operating system.
2005-11-14
It turns out that for the last year or so Sony-BMG has been shipping
rather dangerous Windows software on many of its music CDs. When the
music CD is inserted into a Windows PC it displays a message informing
you that it wants to install a music player so you can listen to this
wonderfully exciting new form of music CD. And if accepted it installs
a "rootkit" which secretly hijacks some parts of Windows without
informing you.
Firstly, the automatic installation of this Sony software can be avoided
to some extent by disabling auto-run:
http://www.annoyances.org/exec/show/article03-018
Some less technical information on the Sony rootkit from CNet:
http://www.cnet.com/4520-6033_1-6376177.html
EFF's growing list of CDs known to contain the rootkit:
http://www.eff.org/deeplinks/archives/004144.php
EFF breakdown of the legal restrictions Sony imposes on people who
choose to install this software by agreeing to the EULA license:
http://www.eff.org/deeplinks/archives/004145.php
NPR Audio with clips from SysInternals (who discovered the threat) and
Sony BMG President. There is a lovely audio clip of Sony-BMG president
saying that rootkits aren't a threat to anyone because, get this, and I
quote, "most people don't even know what a rootkit is":
http://www.npr.org/templates/story/story.php?storyId=4989260
aren't subject to this sort of insanity because of a very long list of
reasons based on decades of experience and sound judgment on the part of
their respective developers. And, also a note that ordering a stack of
Ubuntu Linux CDs costs precisely $0, postage is even free:
Order free Ubuntu Linux CDs:
https://shipit.ubuntu.com/
Ubuntu Linux:
http://ubuntu.com/
rather dangerous Windows software on many of its music CDs. When the
music CD is inserted into a Windows PC it displays a message informing
you that it wants to install a music player so you can listen to this
wonderfully exciting new form of music CD. And if accepted it installs
a "rootkit" which secretly hijacks some parts of Windows without
informing you.
Firstly, the automatic installation of this Sony software can be avoided
to some extent by disabling auto-run:
http://www.annoyances.org/exec/show/article03-018
Some less technical information on the Sony rootkit from CNet:
http://www.cnet.com/4520-6033_1-6376177.html
EFF's growing list of CDs known to contain the rootkit:
http://www.eff.org/deeplinks/archives/004144.php
EFF breakdown of the legal restrictions Sony imposes on people who
choose to install this software by agreeing to the EULA license:
http://www.eff.org/deeplinks/archives/004145.php
NPR Audio with clips from SysInternals (who discovered the threat) and
Sony BMG President. There is a lovely audio clip of Sony-BMG president
saying that rootkits aren't a threat to anyone because, get this, and I
quote, "most people don't even know what a rootkit is":
http://www.npr.org/templates/story/story.php?storyId=4989260
What the Sony rootkit does
- Installs a windows kernel patch that allows arbitrary files to be hidden even from Windows itself.
- Replaces the CD drivers with ones that prevents listening to or copying audio CDs. Any program which attempts to access the protected music CD is immediately terminated without prompting or authorization. It maintains an internal list of programs which are commonly used to copy CDs.
- Installs a music player program which is allowed to listen to the audio CD and make up to three MP3 files from tracks on the CD. It also allows Windows Media 9 to generate encrypted music files for use with Sony, and a few other, encrypted portable music players.
- The music player, somewhat covertly, sends a transmission back to Sony-owned servers each time a a music CD is inserted requesting album art for that specific CD.
Why this is bad and may even be illegal
- Sony doesn't explain what the software they install is doing to Windows. In many countries it is a serious crime to modify a computer system without the full consent of the owner. That means fully disclosing to the owner what will be done to the computer system. Instead, the EULA basically states that Sony can do anything they want to your computer and you need to install the software in order to listen to this perfectly normal audio CD. Which simply isn't true. The CD plays fine until after their software is installed. That aside, it isn't within Sony's legal rights to prevent you from listening or in any way using a music CD that you have legally purchased. But it may be within their rights if you were to agree to their EULA license because that may be a binding contract.
- The rootkit's kernel patch hides files with names beginning in $sys$. Viruses have already incorporated the Sony rootkit into them. The rootkit makes it impossible for anything to even detect let alone remove a virus using Sony's rootkit. Virus scanners are totally useless against any virus incorporating this technology.
- The software installed by the CD is invisible and there's no way to uninstall it. Attempting to do so will damage Windows. Sony's recently announced uninstall procedure is almost impossible to complete and possibly dangerous to even attempt. Some virus scanners (F-Secure, Symantec, Microsoft, et al) are issuing updates which supposedly detect and safely remove the rootkit. In the case of Microsoft, and probably some others, it appears that they may have to rewrite parts of their virus scanners to accomplish this. (ie. This scenario wasn't anticipated by most existing virus scanners.)
- The rootkit intercepts low level Windows kernel functions. Unlike the original kernel functions it does not validate any information being passed to it. Therefore, it is extremely easy to cause windows to crash with a blue screen. Meaning, it makes Windows infinitely more fragile than it normally is... Normally, the Windows NT kernel protects the system from crashing but the Sony rootkit is poorly written and bypasses Windows' built-in protections.
- Removing the kernel patch itself using normal means either makes Windows totally unable to boot or corrupts the CD-ROM driver so the drive doesn't work any longer.
- The music player software appears to incorporate the LAME MP3 encoder in some way. In any case, there's strong evidence to suggest it is built into at least some versions go.exe on the CD. The LAME software is licensed under the LGPL license. If that is true then Sony is not fulfilling the LGPL license requirements in any way. Therefore, they may be violating numerous other people's copyrights in order to supposedly enforce their own copyright. And in doing so they would be breaking federal law in many countries including the US.
Long, technical details (listed in cronological order)
- http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
- http://www.sysinternals.com/blog/2005/11/more-on-sony-dangerous-decloaking.html
- http://www.sysinternals.com/blog/2005/11/sonys-rootkit-first-4-internet.html
- http://www.sysinternals.com/blog/2005/11/sony-you-dont-reeeeaaaally-want-to_09.html
Alternatives
And the obligatory note that Linux, Macintosh, and other UNIX systemsaren't subject to this sort of insanity because of a very long list of
reasons based on decades of experience and sound judgment on the part of
their respective developers. And, also a note that ordering a stack of
Ubuntu Linux CDs costs precisely $0, postage is even free:
Order free Ubuntu Linux CDs:
https://shipit.ubuntu.com/
Ubuntu Linux:
http://ubuntu.com/
2005-11-12
So, it's 4:30 in the morning and I'm wide awake listening to Radio Paradise. Great music. Dreadful hour. My back hurts. My brain is fried. All is not lost for I have chocolate.
Ya know, I've never really liked keyboard shelves under the desk. But I'm beginning to think that the cause of my back pain has been from leaning to type. This started about the time I replaced my desk. (And nearly killed myself crawling around on the floor running wires behind the desk.) Bad posture may be aggravating things since I spend like 16 hours a day typing. So, yesterday I installed the keyboard shelf that came with my desk. I think it has made a big difference. Still some aching but nothing like it has been. And it seems to be slowly improving. I guess I'll know after a few days.
Visitors
In other news, I was visited briefly by a very pregnant Mantis:
Most importantly, this wouldn't require any changes to the way you create a form. You could take an existing form and simply attach the class initializer to the window.onload event. The form is created using perfectly normal HTML. The class rewrites the appearance of the form using javascript to manipulate CSS and HTML. There are numerous disconnected examples of this already. I modified an existing example of a form select for my proof of concept HTML form themes. It's really pretty ugly at the moment. But it's given me some confidence that a class library is feasible.
Less importantly, HTML forms look horrible on paper. So I'd also like to have a print function which takes the editable form from the web page, reformats it and makes a nice printed document. This is something that comes up more often than you'd think. Often people will print a form just before they submit it so they have their own record.
Ya know, I've never really liked keyboard shelves under the desk. But I'm beginning to think that the cause of my back pain has been from leaning to type. This started about the time I replaced my desk. (And nearly killed myself crawling around on the floor running wires behind the desk.) Bad posture may be aggravating things since I spend like 16 hours a day typing. So, yesterday I installed the keyboard shelf that came with my desk. I think it has made a big difference. Still some aching but nothing like it has been. And it seems to be slowly improving. I guess I'll know after a few days.
Visitors
In other news, I was visited briefly by a very pregnant Mantis:Shapeshifting Forms
I keep running into major annoyances when writing complex web forms. The appearance is always ugly and varies wildly based on browser and operating system. It's a real problem in situations where you need the form to look precisely one way no matter how it is viewed. So, I've been contemplating writing a comprehensive javascript class which allows you to customize a form so it looks consistent across all operating systems and browsers.Most importantly, this wouldn't require any changes to the way you create a form. You could take an existing form and simply attach the class initializer to the window.onload event. The form is created using perfectly normal HTML. The class rewrites the appearance of the form using javascript to manipulate CSS and HTML. There are numerous disconnected examples of this already. I modified an existing example of a form select for my proof of concept HTML form themes. It's really pretty ugly at the moment. But it's given me some confidence that a class library is feasible.
Less importantly, HTML forms look horrible on paper. So I'd also like to have a print function which takes the editable form from the web page, reformats it and makes a nice printed document. This is something that comes up more often than you'd think. Often people will print a form just before they submit it so they have their own record.