| Tuesday, May
8, 2001
And no sooner said than done:
Jerry, by now you've probably got a million
responses to Steve Hastings 'wish' for virus scanning under Linux and
other platforms.
He (and you) only have to look at Trend Micro at
http://www.antivirus.com
Trend is quietly taking loads of business away from
Norton/Symantec and McAfee/Solomon with their (in mine and many others
opinion) superior product.
take care
Chuck Kuhlman
Thanks!
Talin on
Internet Security Hardware:
Hardware Review: SMC Barricade 10/100Mbps Broadband
Router, SMC7004BR
Last week I was tasked with hooking up a home
network for one of our artists. This is a long time friend who is working
with me - she has four machines (two Macs and two Wintel boxes) that she
uses to do various kinds of 2D and 3D art. She also has DSL. Up to this
point she had only been using the DSL with one of the machines, and had
asked my help in setting up a hub so that she could share files among all
the machines.
I was also concerned about network security. I know
that a lot of DSL users are opting for the "security through
obscurity", in the hopes that they won't be noticed by the script
kiddies, but I prefer not to depend on that assumption if possible. I had
thought about configuring a Linux box as a firewall, but the headache of
system administration (having to check logs regularly, etc.) was enough to
put a serious damper on that idea. I had thought about hardware firewall
solutions before, but I had rejected them on the theory that hardware
firewalls were expensive, specialized pieces of hardware. That turned out
to be stale knowledge - apparently, they have become quite commodities.
We picked up the SMC Barricade at CompUSA for $159.
(Although I see it can be got cheaper online.) It's a tiny little thing,
about as larger as a thick paperback book (not including power supply) but
has pretty much every feature we needed for setting up a home network:
o A four-port Ethernet hub (not including the
incoming WAN connection) o Network Address Translation (NAT) allowing you
to hook up to 254 computers to a single DSL line and make them all appear
to be a single machine from the outside world. o Configurable Firewall
software with "Virtual Servers". o Windows print server o DHCP
service for easily connecting PCs and laptops. o Easy to use web-based
configuration. o Modem port for dial-up connections.
This was exactly what I wanted - we could network
all four machines safely behind a firewall, and give every one of them
full internet access.
The box was incredibly easy to set up, and the
instructions were short but relatively easy to follow. The router includes
a simple HTTP server for configuration, so to set up the box, I simply
needed to point a web browser to the IP address given in the manual. At
this point, I was invited to log in using the default password (which we
changed immediately). I went to the appropriate configuration page and
typed in the IP address, net mask, gateway and DNS address for her DSL
connection. Pressing the submit button showed the "status" page
which reported an error in contacting the gateway - turns out that I had
made a typo in the gateway address. What was nice was that it told me
exactly what the problem was. After fixing the typo, the status page
showed everything working OK, so I proceeded to the next step which was to
configure all of the PCs and Macs for DHCP. (This step isn't really
necessary - you can use fixed addresses if you want - but I figured that
this would be easier to maintain.)
I did have a bit of a problem getting the Windows
2000 machine to release the Ethernet interface so that I could configure
it for DHCP - it turned out that the "Local Area Connection" had
been set up improperly on that box, and I ended up deleting the connection
and re-creating it anew. Once that had been done, I could then (following
the instructions in the Barricade manual) tell it to get a new DHCP lease.
Once I had got the PC configured, I tried a simple
browser test to the outside world, and was immediately rewarded by seeing
the Google.com search page (my standard test page, because it's fast and
simple).
There's a serial port on the box that goes to a
printer, but I didn't have time to experiment with that.
We also bought a copy of DAVE - the file sharing
software that allows your Mac to be able to see files on your Windows
machines. The setup was fairly straightforward, however we had a lot of
problems setting the permissions and access controls on the various
Windows boxes. At this point there are still quite a lot of access control
issues to be debugged, and I'm not enough of a Windows guru to be able to
figure all of them out quickly. In particular, my friend wants to have
minimal internal security and maximum convenience, and convincing Win98,
Win2000, and Mac/Dave to be able to talk to each other in this way is a
bit of a struggle for me.
-- Talin
"I am life's flame, respect my name,
Explorati,
Inc.
my fire is red, my heart is gold.
Thy dreams can be, believe in me,
if you will let my wings unfold!"
- Heather Alexander
http://www.explorati.com
http://www.sylvantech.com/
We had a similar experience with
wiring Niven up. thanks. It sounds like the solution to some of my
internal problems too. And on
the security score:
A local systems guru, Ed Sawicki www.alcpress.com
turned up the NTFS file stream http://is-it-true.org/nt/atips/atips226.shtml
vulnerability a few years ago, and it was one of those things where,
after discussing it with Norton's folks in Eugene, I decided to keep
quiet, lest once of the card-carrying members of the Junior Hackers of
America would document it and start writing viruses for it. Well, someone
did last year..
http://www.theregister.co.uk/content/1/13046.html
and I can't see any cure has arisen in the past year.
A search on your site showed no discussion on NTFS
streams.
As for me, I'm abandoning NTFS and going to FAT32 as
rapidly as feasable.
-- See the (unofficial) PalmOS Wireless FAQ at http://palmwireless.cjb.net
adfree spamfree plaintext but for counter &; webring link mostly
harmless
John Bartley
Thanks. You may be safer but surely
that's a drastic solution? And
now something else to worry about:
Jerry,
In anticipation of your entry into the scary world
of DSL, here's an excellent resource page relating to your provider. Good
luck.
http://www.backward.com/pbi
Brian Fumo
Aaaarghhh! But I think I have
no choices. PacBell is the only one offering. Now see below
for some useful advice...
The "You've go to see this, it's really
cool" message with a .VBS attachment is definitely a virus.
www.sarc.com has named it VBS.VBSWG2.D@mm. We got a couple here, but our
virus filter trapped them. (No .VBS permitted! Ever!)
Talin's experience with the itty bitty firewall
boxes matches mine. I've got Earthlink DSL, which forces me to use PPPoE
to log in, and require installing some software to do that and the PPPoE
protocol. I picked up a little Linksys DSL router at Fry's ($60 on sale)
which does the PPPoE protocol and login for me on demand, is a firewall, a
DHCP server, does NAT to share the internet connection with multiple PCs,
and does IPSec passthrough so I can connect to work. I plugged the Linksys
between my DSL modem and hub, uninstalled the PPPoE software on my PC, and
just do plain ethernet to the Internet with all the PCs in the house. (And
its logs of the IP address and port of connection attempts to my PC has
been ... amusing reading.)
-- Mike Van Pelt mvp@calweb.com
Subj: Early space tourism
Dr. Pournelle,
Maybe you have a good answer to this question and
time to read my little rant...
Once it became clear that Mr. Tito was going to go
into space regardless of their objections, why couldn't NASA give in and
even come up with something for him to do during his time in space? At the
very least, they could have hooked him up to some bio monitoring gadgets
or given him a mouse to feed. Instead, NASA passed up an opportunity to
let their researches play with a (nearly) captive civilian for over a week
and got nothing but bad PR out of the whole deal.
Talk about wasted resources, all because of some
stiff necked opposition. If they were worried about liability, write the
mother of all waivers. People pay all sorts of money to volunteer for
archeology expeditions, so why couldn't that model have been applied to
our first space tourist? There's been a change in what kinds of people get
to go into space, and NASA needs to embrace it or lose out entirely on any
future progress in this area.
I have an enormous amount of respect for Senator
Glenn, but I think his comments concerning Mr. Tito show that he's holding
on too tightly to the past. We're already in the next stage of human
presence in space, but NASA and Senator Glenn won't admit it and that will
only hurt US space progress because "everyone else" seems to
have figured it out already.
Sean Long
NASA is beyond incompetence.
Remember this useful phrase. You will find you need it again and
again. Glenn sold his
soul in the hearings for his ride in space; he could have been more
gracious with Tito. Tito only paid money. Glenn paid a lot more than money
for his second trip. Ask Senator Thompson.
With regards to the claims regarding NTFS streams
virii in the Register UK article, NAI claims that the NTFS streams
infection method described by John Bartley (http://www.jerrypournelle.com/mail/currentmail.html#Tuesday)
can be handled by their current virus scanning engines. Admittedly, the
article in question appears to be a year old and the related FAQ (http://www.heysoft.de/index.htm)
is dated 3/21/2000.
See: http://vil.nai.com/vil/virusSummary.asp?virus_k=98803
Chris Pierik
CTP@Ballpeen.com
It turns out that the subject has
been well covered. Including here in earlier mail. It is nothing to worry
about. The fact that I could not remember we had been through this before,
perhaps thqt is worth worrying about.
I can't speak to the other imported items in your
mail last week, but I do know something about TVs, as I've been working at
Thomson multimedia (the RCA and GE consumer electronics company) for 10
years. The bulk of the wages paid to those who create RCA and GE
televisions are paid to the headquarters personnel here in Indianapolis,
IN, as Thomson (and RCA before GE bought RCA and sold the consumer
electronics business to Thomson) have long had a set of the most automated
factories in the consumer electronics business (and maybe the world). The
factories are now located in Mexico because land was cheap -- Thomson
hires the same kinds of professional and skilled positions for the
factories that Thomson would if the factories were in the U.S. There is
basically no call for "grunt" assembly-line workers in the
Thomson factories, as it is very cost-ineffective to hand-assemble TVs
because of the thin profit margins in the industry (profit margins ranging
from 0.5-1.5%).
As an aside, a study I've read (Wall Street
Journal?) showed that factory workers in underdeveloped/Third World areas
only add the value of their wage into the product -- it is not generally
the case that a $0.30/hour worker is adding $3.00/hour of value to the
product, much less $30.00/hour. American workers are capable of
significantly more skilled operations than underdeveloped/Third World
factory workers due to the greater educational advantages of living in the
U.S. From what I understand, underdeveloped/Third World factory workers
generally have had little to no schooling, which makes them unsuited for
any position requiring literacy -- which is many (if not most) positions
in consumer electronics factories today.
IMHO, the great difficulty facing society (factory
workers and professional alike) is the necessity of lifelong learning --
it is no longer possible to learn your profession in high school or
college, then never turn to the books, magazines, professional societies,
etc. again. Again IMHO I think our society can weather this change, but it
will represent a period of disruption in society, just as the Industrial
Revolution was a period of disruption.
=============================================== Mark
Leighton Fisher fisherm@tce.com Thomson Consumer Electronics Indianapolis
IN "Display some adaptability." -- Doug Shaftoe, _Cryptonomicon_
I can very much hope you are
right. A republic is a
state ruled by its middle class. The middle class are those who possess
the goods of fortune in moderation. This is Aristotle, but it has not been
improved on. For a while we were making middle class out of our workers. I
wonder if we are still doing that.
Hello Jerry,
A friend of mine created a patch for removing the
attachment security from Outlook 2000, SP1 / SP2.
It might be of use, http://members.tripodnet.nl/lcroft/
kind regards,
Jan Jaap van der Hart (The Netherlands)
Thanks.
From: Stephen M. St. Onge saintonge@hotmail.com
Subject: The Linux Community vs. Microsoft, again
Dear Jerry:
BORING!
I mean really guys, how often do you insist on
saying the same things? Microsoft says Linux ain't what it's cracked up to
be, the Linuxen yell "More FUD!" I say, lotsa small egos on
parade.
Instead of endlessly repeating this nonsense, how
about some good software you just hit install, open, and use without
problems?
Don't hold your breath.
Best, Stephen
Dr. Pournelle,
On an entirely non-technical note, I was wondering
what you thought about the Federalist Society ( http://www.fed-soc.org/
). It seems to me that they are fighting an uphill battle trying to turn
the system around to convince present and prospective lawyers and judges
that they should interpret and not make law. Still, it's a noble cause.
Argue the moral merits of cases like Roe v Wade as
you will, but it is clear that the Supreme Court at the time
"discovered" a right that is not in the Constitution. If there
was indeed a need to come up with a federal law on this issue the Court
should have punted it back to the Congress, painful as it might have been.
On a broader note, I wonder if the need for groups
like the Federalist Society is a consequence of the fact that legislative
bodies all across this country have been so willing to give up their power
to make the law.
On the federal level, look at the feeble response to
judicial activism, the creation of the EPA which takes personal property
(see the Klamath valley news reports), and the overall delegation of
legislative power to the executive which resulted in President Clinton's
final proclamations setting national policies which had the force of law.
On the local level, we have the California
initiative process. In recent years it seems like the legislature has
dumped every difficult decision onto the voters: school bonds, gay rights,
bilingual education, etc. I'd almost be willing to place a bet right now
that their solution to our current energy crisis will involve yet another
voter intiative.
As I see it, rather than making laws and doing the
best for their country and constituents, the sole credo of our elected
representatives now appears to be to get themselves re-elected (see the
size of our Gov Davis's warchest as an example).
I can only hope against hope that at least in my
son's future he will be able to vote for a candidate that holds principle
above power, which I think is the true measure of a republic.
Ken Jancaitis
I do not know that organization but
I once seriously discussed founding one with that name and those goals,
assuming they are genuine. I believe federalism as opposed to unitary
government (with imposed 'diversity') to be the only hope we have of
avoiding empire. I also think it is probably too late. But perhaps
not. But as we impose more
restrictions and burdens on the police we will find that we can recruit
only a few of the saints required. Yet we will need police. The next step
is generally predictable. Of
course the only concern of the modern politician is to be elected. The days
of men like Washington are gone and past gone. We can still limit the harm
they can do but to do that we must limit the power of government to Do
Good as well. And that will always fail. Cut taxes? You stop the
redistribution of the wealth. You must not do that...
TOP |
CLICK HERE for
a Special Request. 
