Once upon a time, Georgi Guninski wrote AIX buffer overflows. Aleph One provided shellcodes. Now everyone hammers on Microsoft vulnerabilities and Bill Gates is retraining his employees for security awareness. That seems like a good idea as UNIX gopher servers could suddenly gain popularity again. Think your “internal” network is safe? Think again as one of your users might connect to a gopher site…oh, and all versions of IE are vulnerable. Go Minnesota!
Category Archives: Security
Would you like Web Services with that?
So let’s get one thing straight, the “web services” (WS) revolution is a new term for standards-based communication between networked applications. Does this change anything for anyone? Not really, not yet. An executive at a small software company asked me to help them decide what to do about WS, so it’s been on my mind lately. The rather sharp-witted Register points out a clear case where not even Microsoft or Sun can figure out how to turn the WS hype into real value for customers.
Packet Trap
There’s something really nice about a good pasta sauce. There are so many recipes on the web, it’s hard to know where to begin. My favorite, of course, is the easiest: a bit of your favorite oil, add some basil, pine nuts, and garlic in the blender. Just press a button and…pesto!
There’s something really suspicious about a product called the White Glove, but there’s no doubt that Fred Cohen has a unique view. In light of this, I think when I build a DMZ for a client tomorrow I will try to convince them to call it a “Packet Trap.”
The cost of VPN deployment
Had an interesting talk with some folks from Nortel and IBM this morning about managing VPNs. I was told that an insurance company in Northern CA recently spent $1.1 million, more than double their investment in hardware and software, installing remote VPN clients and pushing out updates.
The IBM rep also told a funny story. He said someone had to drive all the way to a branch office to receive the new VPN software. The person became very annoyed, however, when they found out they were expected to bring their PC with them for the update. Apparently they said “Someone should have told me I needed to bring my computer here to have the software installed!”
Push software was tried, but it was inconvenient to end users. Since many of them relied on v90 dial-up connections, they did not appreciate a 3MB push to their computer, especially when they were trying to upload files to meet critical deadlines. They also complained about having to leave their computers running overnight. Clearly any push solution that claims to be efficient, easy, and nonintrustive has to take into account the behavior of recipients, and not just the needs of IT management.
Also discovered that the W3C allows you to easily validate my cascading style sheets.