I really can’t believe this story.

In a particularly pointless and shameless security “exercise” by yet another UK Government Quango (seemingly sponsored by Microsoft) they show how easy it is to hack into a PC running Windows XP service pack 1 with no firewall, filtering or other security techniques employed… Big deal…

A Microsoft executive calls the ease with which two British e-crime specialists managed to hack into a Windows XP computer as both “enlightening and frightening.”

Oh good grief…

Nick McGrath, head of platform strategy for Microsoft U.K., was surprised by the incident.

“In the demonstration we saw, it was both enlightening and frightening to witness the seeming ease of the attack on the (Windows) computer,” said McGrath. “But the computer was new, not updated, and not patched.”

McGrath also said that Service Pack 2 for XP had a firewall and that Vista was not as “accessible to the average hacker” due to “operating system components.”

What complete bollocks. I’m sorry but this smacks of using FUD to try and get naive and scared companies to migrate from XP. Why would they want to otherwise?

Just go and get Ubuntu. It works, is very secure and its FREE.

Tell Someone Else!

Now the time is getting closer for the BRM, the noise level is starting to grow too! Lots of positioning, posturing, PR and lobbying is going to go on between now and next February.

This story caught my eye today:

PHILIPPINES–Microsoft and industry body Computing Technology Industry Association (CompTIA) have teamed up to drive the adoption of Office Open XML in the Philippines.

According to Dave Walsh, Microsoft’s senior standard program manager, the Philippines was one of the countries which voted “no” on the use of OOXML.

“The country voted ‘no’ with clarifications. This means the panel voting on the standard still needs more information about Open XML,” Walsh said at the briefing last week.

Well now. Let’s have a look at this in a bit more detail… In the vote in September, the following countries (in that part of the world) voted with comments as follows:

Japan: 81, New Zealand: 54, Australia: 30, Korea: 25, Malaysia: 23, Philippines: 7, China: 1, Thailand: 1.

You can see the nature of the comments by the Philippines here, and, as a matter of fact, you can see the comments left by all of the voting members. www.dis29500.org is hosted by us as an Open endeavour to enable anyone to assist with the monumental task of identifying duplicates, comments that can be easily dealt with and comments of real substance that must be addressed.

But what about the two voting members who only made one comment? Here’s China’s

China National Body have been paid special attention to the ISO/IEC DIS 29500 ballot. Great work have been done and during the process we found it is a very complex technology which needs further more time to establish testing environment for thoroughly and deeply evaluation. We think the fast-track procedure is not suitable for this DIS.
We requested an extension to the ballot period for the DIS29500 for another 6 months in the letter to ISO/IEC JTC1 secretariat as well as ITTF. We still keep to our position that more time is necessary and essential to conduct a credible and responsible evaluation.

And here’s what Thailand though of ECMA-376

We disapprove the draft ISO/IEC 29500 for the reason that the time given by the fast-track processing is not enough for consideration of this important draft.

Ahhhh, now I can see why Microsoft are courting the Philippines. In the UK we like to call this “low hanging fruit”… But even here, their final comment is common with many others:

As well as other sub-sections within this level make references to proprietary applications whose behaviors are undefined in the standard. For example, autospaceLike Word95 specifies that implementations should autospace like Word95 but exactly how Word 95 autospaces is a Microsoft Company secret.

Precisely. How can something like “autospaceLikeWord95″ be in an ISO specification? Not very “OPEN” is it?

I wonder how Microsoft are helping CompTIA? Free Training perhaps, low cost licenses, gold-partner upgrades????

Tell Someone Else!

Here’s a quick tip…

I was trying to get a Firefox session running over an SSH connection between my desktop PC (Ubuntu 7.10) and the little server I’m building. The strange thing was, every time I typed firefox & at the command line prompt, it started Firefox all right; but it started a local (Ubuntu) instance of it with my local profile settings! One of the reasons I wanted to run a remote browser was so I could download files directly to that machine and so I could access some html docs on that box; as it is now headless.

A bit of Googling led me here, where the author used this command ( export MOZ_NO_REMOTE=1; firefox -profilemanager ) &. After a bit of experimentation, and more Googling, for my purposes it can be simplified to this:

firefox -no-remote &

This assumes Firefox version 2 and that your SSH connection was made using ssh -X uname@host

Hope this helps someone else. It got me foxed for ages initially…

Tell Someone Else!

If you’ve been following the story so far you’ll now where I am. If you haven’t, please go back to Part 1 and read from there. Alternatively if you click on the Untangle tag in the tag cloud then you should get all of the posts so far.

Hi all,

I’ve not yet got any further with the Untangle portion, but pretty much everything else is now in place and working

Last night I built and installed the few remaining applications that are necessary to support my objectives:

• MySQL (I need this for Joomla! and vtiger)
• Postgresql (I need this for untangle)
• Apache
• PHP (and some associated libraries for added functionality, i.e. HTML-Tidy, mm, libmcrypt, mhash…)

I have also been thinking about what it is actually I am trying to achieve. I find a picture really helps so here’s a block diagram of the applications I want and how they should interface to the outside world…

This was a good exercise that helped me to understand the flow of traffic and what needs to be prevented from passing through the server. The dotted line from Apache to the Internet is because I’m not sure yet whether I’ll actually provide any sort of public web presence from this box or not. I doubt it somehow but you never know…

If anyone has any comments or suggestions for improvements I’d be happy to hear them. I made the original diagram in OOo draw. Here’s the original file if you want to use it or alter it. As with all other stuff on here, its CC licensed.

Tell Someone Else!