2009-07-17

why basic infrastructure components should never be closed source...

...or at least, when they are not open source, you should treat them as hostile and malicious.

http://www.securityfocus.com/news/11555?ref=rss

excerpts:

An update pushed out to BlackBerry users on the Etisalat network in the United Arab Emirates appears to contain remotely-triggered spyware that allows the interception of messages and emails, as well as crippling battery life.

Interestingly, it seems it was the battery life that drew attention and investigation. This was a minor design error, easily fixed, and then no one would have noticed this application!

2009-07-14

Pinching myself and checking what year it is...

So I got an invite to join some call from a vendor trying to sell us something (I can't name names, and in this case they're irrelevant). They chose to send us an invite which included this:

https://www2.gotomeeting.com/join/[somelongnumber]

So I go there, and I see:

To join the Meeting, please use one of the following supported operating systems:
• Windows® 2000, XP Pro, XP Home, 2003 Server, Vista
• Mac OS® X, Panther® 10.3.9, Tiger™ 10.4.5 or higher

OK, I've seen this sort of crap before, and can often get around it using UA switcher or something, so I try that next.

Guess what? They want you to download and install an actual EXE!

So now this is like a flashback to at least 4 years ago. I hope webex, which now works pretty damn well inside FF on Linux, is eating their lunch!

Anyway, after a bit of searching I found a "support" url with a feedback form of some sort, so I sent them this:

I was supposed to join a call starting shortly, and find I cannot, because you don't support Linux. How quaint...

Well it's 8:30pm in India, where I am, so thanks for letting me off the hook on that call and really enjoying dinner with my family.

:-)

2009-07-05

EVMs again, in a real democracy...

http://www.greatandhra.com/ganews/viewnews.php?id=14612&cat=&scat=16

Not sure how terribly accurate that virtually unknown newpaper is, but a shorter version is at http://timesofindia.indiatimes.com/India/EVMs-can-be-easily-tweaked-Expert/articleshow/4739375.cms -- presumably an NYTimes style pay site or the dead-tree version would have the extra details that the greatandhra site shows.

The summary: some of the other political parties have been complaining that the EVMs can indeed be tampered with, and the EC (Election Commission) is looking into it very seriously, calling for meetings with officials of the two "public sector" companies (that's a phrase that basically means "majority owned by the government", although they do also trade on the stock markets like any other company), etc.

Even with no details of the "exploit", I feel very good about this.  Look at how they're handling it, compared to the Diebold situation in the US.  What I said in http://www.schneier.com/crypto-gram-0412.html#11 still stands -- the entities are public sector companies, and the EC is quite independent.  (Hopefully even with the current Election Commissioner, Naveen Chawla, being a corrupt Sonia Gandhi/Congress party lackey)

In the US, as far as I recall, things had to go to court before anyone could see how the damn things worked.

And even then, it wasn't the political parties who went to court (again, as far as I remember, please correct me in comments if I'm wrong) it was the EFF or something like that.  Another sign that an essentially 2-party system is not quite democratic enough.

Yes, a true multi-party system is much more chaotic, but as a friend of mine said, maybe it is easier to "fix" things when the number of players is small.

And oh by the way, a "true multi party system" is a common enough state of affairs in the open source world too.  Coincidence?  I think not!

(criminal) get paid for screwing up

wow... I must have been asleep under a rock these last few days.  I did not know this till today:

http://www.itwire.com/content/view/26018/1090/

Apparently an attack by the Conficker worm has cost the Manchester Council in England around £1.5 million - and Microsoft experts were among the consultants called in and paid some of that swag.

Nice job, guys.  Great business model.

Oh and for people who think this is not MS's fault, follow at least this link in the article... (ignore the comments, they're mostly crap.  Even in the article, there are only facts or questions, so you can certainly draw your own conclusions, don't go by his).

And what really, really, REALLY, pisses me off is that no mainstream news media reporting this will use the words "Microsoft" or "Windows" when describing the problem, leaving ordinary (non-IT) folks with the impression that this happens to all "computers".  Other people far more qualified than I have also noticed and ranted about this, but it makes no difference.  Damn...

2009-06-29

who's to blame?

http://thedailywtf.com/Articles/Death-by-Delete.aspx

interesting story.  I don't know how many readers I have (or still have, after that article on MBAs and ethics ;-) but I'm torn as to whom to blame for this.

Opinions?

2009-06-28

what are they all mourning?

I find it hard to digest all this mourning for Michael Jackson.  The "King of Pop" with the pulse-pounding beats and act died long ago; the person who died on Friday was no more than a shadow of his former self, and a dark, dangerous, shadow at that.  Mentally unstable, physically ravaged, and accused of probably the worst sort of crimes that a parent can imagine, I am so happy that my two children hardly know who he is.

Humans tend to hang on to their idols long after the idols have been found wanting.  Until we stop doing that, celebrities will continue to get away with murder, at least figuratively, if not literally.

2009-06-19

Re your column on "Courtesy crisis at workplace"

Dear Mr Banerjee,

I read your column in today's DC, Hyderabad edition.  I normally don't bother writing letters to editors or columnists, but there are some things I have strong feelings about, and then I have to.  I have no idea if there is any scope in your column for you to print your reader's comments, but that is upto you.

Linking the failure of Lehman or AIG with the informal culture of a US company, and conversely the success of the Tatas and Birlas with the opposite, is naive, to say the least.  Correlation does not, as they say, imply causation.

The correct causation for your examples is simple: all the failed companies you mention have ethics problems at the top.  All of them are run by MBAs who have been taught a badly skewed value system, one which maximises either their own, or their company's, worth in purely monetary terms.  I do not believe MBAs are even taught the basics of ethics or morality.  It's just not one of their priorities.  How else can we explain the dean of ISB brazenly voting for something that an average man on the street could easily see was unethical!

[You may wish to read http://www.timesonline.co.uk/tol/news/uk/education/article5821706.ece -- though it is directed at Harvard, I suspect most B-schools are the same anyway]

In contrast, if you take the people you've named (Tatas, Birlas, etc)., they all have a highly developed sense of ethics at the top levels, even a sense of "ownership".  Perhaps it comes from the fact that the firm carries their name!  Similarly, the old guard at Lehman would have had the same values too.  But they have long since given way, (due to pressures on the "Street" perhaps?) to the MBA crowd.  With the results we all see today.

Of course, it is certainly true that "old guard" people also tend to be more formal, that is quite a different matter entirely.

Warm regards,

Sitaram

PS: I work for a large IT company, I have nearly 23 years of experience, and I insist that everyone, even the freshers, call me Sita or Sitaram.  And I don't like people who insist on being called "Sir" or "Mr ..." or whatever.  It means their notion of "respect" is very shallow, and (often enough), also that they lack the ability to actually earn my respect anyway.

Of course, this means I have to work a little harder to uphold my dignity and authority.  Once in a while someone will mistake my attitude for weakness and take liberties, or cross some other invisible line, and will need to be pushed back firmly.  I have to be constantly on the watch for such issues.

Why then do I do this?  Would it not be better to "act my age"?  After all, some of my team members are barely a few years older than my son!

Because it helps them open up.  Even in a formal meeting, being able to call me Sita gives them just that extra bit of confidence to tell me what they really think of something I am proposing, or seconding.  It helps them say "Sita, I don't think that would work".  It gets them asking just that one extra question that tells me something is wrong, or has been misunderstood, or points to a problem the project will have way down the line.  In short, it gets me feedback I'd never have got otherwise, or would have to guess at from other signals or behaviour.

And yes, I have gone drinking with people who report to me and are very junior to me.  It's not that difficult to be one of the lads without all the negative fallout you seem to impute to it.  You just have to be fair, honest, and firm.

2009-06-11

Malware Steals ATM Data

...all you Linux people think you're safe from us?

MUA-HA-HA-HA!

via Schneier on Security by schneier on 6/10/09

One of the risks of using a commercial OS for embedded systems like ATM machines: it's easier to write malware against it:

The report does not detail how the ATMs are infected, but it seems likely that the malware is encoded on a card that can be inserted in an ATM card reader to mount a buffer overflow attack. The machine is compromised by replacing the isadmin.exe file to infect the system.

The malicious isadmin.exe program then uses the Windows API to install the functional attack code by replacing a system file called lsass.exe in the C:\WINDOWS directory.

Once the malicious lsass.exe program is installed, it collects users account numbers and PIN codes and waits for a human controller to insert a specially crafted control card to take over the ATM.

After the ATM is put under control of a human attacker, they can perform various functions, including harvesting the purloined data or even ejecting the cash box.

2009-06-09

alright, if you HAVE TO use it, go ahead...

but at least do these things:

http://www.mechbgon.com/build/security2.html

2009-05-23

(malware) walk too loudly...

Well there you have it, straight from the horse's mouth :-)

http://www.infoworld.com/d/windows/your-companys-apps-incompatible-windows-7-shim-them-says-microsoft-394

Microsoft has long created its own shims rather than making laborious bug fixes to Windows' oft-brittle code.

"If you walk too loudly down the hall near the [Windows] kernel developers, you'll break 20 to 30 apps," Jackson joked.