Archive for June, 2010


e-Banking Bandits Stole $465,000 From Calif. Escrow Firm — Krebs on Security.

Marisco said that a few days before the theft, she opened an e-mail informing her that a UPS package she had been sent was lost, and urging her to open the attached invoice. Nothing happened when she opened the attached file, so she forwarded it on to her assistant who also tried to view it. The invoice was in fact a Trojan horse program that let the thieves break in and set up shop and plant a password-stealing virus on both Marisco’s computer and the PC belonging to her assistant, the second person needed to approve transfers.

Whoopsie.  It looks like somebody forgot the basic tenants of Windows security:

http://www.emmanuelcomputerconsulting.com/the-basics-on-not-getting-infected

PERC S300 – can it be made to work?.

I saw this on the Dell Linux mailing list.  I did a bit of research and found this is a windows only FAKERAID product.  What I mean by FAKERAID is the card fakes like it is a raid card but all of the work is done on the cpu.  Because of this the driver is proprietary and in this case windows only.  If you want a RAID card make sure it is really a hardware raid card.  If you can’t spend that kind of money use the Linux built in RAID which is much more efficient than any FAKERAID.  Windows also has software raid that’s quite a bit more efficient than this FAKERAID.  If you read the pdf you’ll see that htis is actually a DESKTOP product(the h55 is a desktop chipset form Intel) so it really has no business in servers.  PDF detailing the S Series is here.

Intel will ship x86 android 2.2 this summer – The Inquirer.

Now this would be interesting.  If this is actually true then instead of me having to get a smartphone with the high price of the cell carriers scamming built in I can get a netbook running android….hrmmmm…I like this idea.  If it works out I might just leave the notebook at home when i go out.

Synchronizing Roaming Profiles Between a V1 & V2 Profile.

The news is..you can’t.  So if you want to move to server 2008 and keep your profiles you have to stick with either xp and below(not a good long term solution) or have all vista and above machines.  Users cannot roam between xp and vista/7 machines.  I guess MS REALLY wants you to upgrade to vista/7 when you change your server to 2k8.  ICK.  So the best migration is to manually grab the DATA(but not the config files) form the old profile..ahve the client log into the new machine and then dump the files into that…still an ick.  there are a FEW third party vendors that can migrate this via software but the costs could be substantial.

Office 2010 Licensing changes… – Untangle Forums.

This is interesting.  Keep watching MS they want their fingers in everything.

The author makes some great points here.  Take a gander.

Not using desktop Linux? You’re wasting your money | Linux – InfoWorld.

Right now cloud computing isn’t a security enhancement..it’s a security nightmare.  Most cloud apps actually require you to download and install an executable file that then connects to the cloud.  The operating system requirements are?  Windows…most of the time.  I would like to see the cloud vendors support a truly web-based experience..like Google.  Then you wouldn’t need windows..Linux would work.  Your costs go through the floor.  No high costs for server operating system software…no high costs for desktop operating system software.    There are a couple of gotchas.  One is most applications don’t yet run on a Linux desktop or a true cloud.  Secondly, disallowing access from outside your company.  This isn’t as easy to solve as it seems since it’s a web-based thing..considering the low costs though just get your company a static ip(s) and tell the cloud vendor only those ip(s) are allowed to access that app.  Then you have the best of both worlds..in a very brief nutshell.  If you are interested in more details let me know.  I might fire up the podcast machine..:)

Want to see those ink cartridges really disappear?  Buy one of these printers.  They’ll find your router..hook to the internet and then get “targeted” advertising sent to the printer which it will then print out.

HP’s ePrint printers, some of which will become available next month, are connected to the user’s home router, which means they will have an IP address. IP addresses can be used to identify an approximate area where the Web-connected device is located, opening the potential for targeted advertisements based on location.Ads can also be targeted based on a user’s behavior as well as the content, said Vyomesh Joshi, head of the HP’s Imaging and Printing Group. So if you visit a porn site we guess your printer will start spewing out hard copies for all to see.HP admits there needs to be rules on privacy. However there also needs to be rules for who pays for its expensive printer ink as it prints out adverts I don’t want on a printer I paid for. It is hard to see any company or individual going for this and we think that HP really needs its head examined.

via HP to turn your printer into an advertising machine – And you will pay for the expensive ink | TechEye.

Windows Server vs. Linux.

There are some serious errors in this..i’ll address them inline.

Text below:

Windows Server vs. Linux

June 8, 2010 —

Which is better? Microsoft Windows Server or open-source Linux?

This debate arouses vehement opinions, but according to one IT consultant who spends a lot of time with both Windows and Linux, it’s a matter of arguing which server OS is the most appropriate in the context of the job that needs to be done, based on factors such as cost, performance, security and application usage.

7 Open Source innovations

“With Linux, the operating system is effectively free,” says Phil Cox, principal consultant with SystemExperts. “With Microsoft, there are licensing fees for any version, so cost is a factor.” And relative to any physical hardware platform, Linux performance appears to be about 25% faster, Cox says.

That’s at a minimum.  It’s often much higher.  Windows server core is an attempt to regain some of that base speed by jettisoning the gui.

Combine that with the flexibility you have to make kernel modifications, something you can’t do with proprietary Windows, and there’s a lot to say about the benefits of open-source Linux. But that’s not the whole story, Cox points out, noting there are some strong arguments to be made on behalf of Windows, particularly for the enterprise.

For instance, because you can make kernel modifications to Linux, the downside of that is “you need a higher level of expertise to keep a production environment going,” Cox says, noting a lot of people build their own packages and since there are variations of Linux, such as SuSE or Debian, special expertise may be needed.

Windows offers appeal in that “it’s a stable platform, though not as flexible,” Cox says. When it comes to application integration, “Windows is easier,” he says.

Windows most assuredly is NOT easier.  by the time you get to managing patches, default configuration tweaking, the layers of security you have to pile on to have a prayer of a chance to NOT get compromised…Linux is MUCH easier.  I can turn up a Linux server from ground zero to the base install in under an hour WITHOUT USING AN IMAGE.  Updates?  One run and one reboot..Windows?  It’ll be multiples of each…it goes on and on and on.

Windows access control “blows Linux out of the water,” he claims. “In a Windows box, you can set access-control mechanisms without a software add-on.”

He apparently hasn’t heard of chmod and chown.  You can do everything you want right from the cli.  I tend to use a package called Webmin which is installed from the command line and run from a web browser…i don’t have to pay the Windows gui performance tax.

Patching is inevitable with either Windows or Linux, and in this arena, Cox says that it’s easier to patch Windows. Microsoft is the only source to issue Windows patches. With Linux, you have to decide whether to go to an open-source entity for patches, for instance the one for OpenSSH, or wait until a commercial Linux provider, such as Red Hat, provides a patch.

OR you can use a community variant called Centos(to reference Redhat) which is non-commercial…OR you can use the granddaddy of Linux distros, Debian, who has the basis of many many other distributions.  You don’t have to go to openssl because the distros are hooked right into the package vendors.  Here’s one point the author missed…speed of patches.  Microsoft WON’T patch until there’s an active exploit outside of it’s monthly cycle.  Most Linux distros patch within 24 hours of release..24 HOURS..not DAYS or MONTHS…HOURS.  Let’s see Microsoft do that…and do it reliably with hosing it’s users systems that have gotten infested due to their continued bad design choices.

Microsoft presents a monolithic single point of contact for business customers, whereas “In Linux, you need to know where to go for what,” which makes it more complicated, Cox says. “There’s no such thing as a TechNet for Linux,” he says. Linux users need to be enthusiastic participants in the sometimes clannish open-source community to get the optimum results.

Oh and Microsofties aren’t clannish?  LOL!  Let me tell you something..if you don’t drink the Microsoft Kool-aid totally you won’t be in the MS forums and MS evangelists sites..trust me I know about this.

These kind of arguments may indicate why Windows Server continues to have huge appeal in the enterprise setting, though some vertical industries, such as financial firms, have become big-time Linux users.

The only reason Windows keeps hanging around like a fungus is because the third party app vendors have not yet started coding for Linux in large numbers yet…that’s coming.  Once folks can see the advantages to Linux MS will have to tighten up their code or die.

Linux and open-source applications are popular in the Internet-facing extranet of the enterprise, Cox notes. And Linux has become a kind of industrial technology for vendors which use it in a wide range of products and services — for instance Amazon’s EC2 computing environment data centers rely on Xen-based Linux servers.

Know why?  Security is one, reliability is another, patching is stupid easy(run updates on live system. if no kernel updates no reboot needed..at all).  Windows hangs around right now because third party vendors aren’t coding…yet. MS right now does have it’s place and i will recommend windows on the back only when it’s truly necessary. The comments on this article do a far better job of eviscerating the author than I do..:)

The Iphone 4 is going to gobble video like there’s no tomorrow..AT&T’s response?  Let’s push everyone into high per/gigabyte overage buckets and rake in the cash.  My question is…how long until folks wise up to the scam and drop their iphone plans altogether?  We are going to see lots of stories about folks complaining..and not taking responsibility for their continuing to do business with AT&T…If you have the chance you have two choices….stay on your current 5 gig “unlimited” plan or you can get the new features and pay more than double.  Frankly?  I would would choose neither.  The cell carriers are only raping folks like they did with the landlines.  The only to reign them in is to not use these “smartphones”.  Right now the plans behind the phones are nothing but huge scams.

iPhone 4 Will Mercilously Obliterate Your AT&T Caps – Which is just the way AT&T wants it… – dslreports.com.