Wordyard

Hand-forged posts since 2002

Archives

About

Greatest hits

Blaster on stun

by

Done patching your Windows system against the Blaster worm? Then you’ll have the time to read this piece from CSO Online: “Patch and Pray.” It uses the saga of the Microsoft SQL Server “Slammer” worm from last winter to explore why and how the whole patching process has gone astray.

  As the volume and complexity of software increases, so does the volume and complexity of patches. The problem with this, says SEI’s Hernan, is that there’s nothing standard about the patch infrastructure or managing the onslaught of patches…

There are two emerging and opposite patch philosophies: Either patch more, or patch less.

Vendors in the Patch More school have, almost overnight, created an entirely new class of software called patch management software. The term means different things to different people (already one vendor has concocted a spinoff, “virtual patch management”), but in general, PM automates the process of finding, downloading and applying patches. Patch More adherents believe patching isn’t the problem, but that manual patching is….

The Patch Less constituency is best represented by Peter Tippett, vice chairman and CTO of TruSecure. Tippett is fanatical about patching’s failure. Based on 12 years of actuarial data, he says that only about 2 percent of vulnerabilities result in attacks. Therefore, most patches aren’t worth applying. In risk management terms, they’re at best superfluous and, at worst, a significant additional risk.

Oh yes, this is the year after Bill Gates declared the crash “Trustworthy Computing” initative.

Wired’s big push

by

In its heyday, Wired magazine gave the entire technology and Internet press a steady stream of wacky, outrageous material to react to. On the blog he has created to accompany his new history of Wired, “Wired: A Romance” (Andrew Leonard’s Salon review is here), Gary Wolf is posting some reminiscences and other Wired miscellany.

I have to agree with his judgment that Wired’s worst story ever was the “Push” cover story he was credited as co-author of. Wolf’s recollections of how that absurd piece of puffery came into existence is illuminating and worth reading; Wired, it seems, was even more seat-of-the-pants in its editorial process than those of us on the outside could tell. I’ll stand by my assessment of February, 1997, that the story wounded the publication’s credibility. But reading Wolf’s account, you can’t help feeling a little more charitable toward the people responsible for the open-ended, improvisatory provocation that was the Wired game. Viewed as a moment rather than a movement, it all seems a little funnier and less heinous. After all, the next three years would see far vaster corporate scams unfold — and ones with far less style.

Also, don’t miss Wolf’s riff on the hapless San Francisco Chronicle, whose book reviewer made a big fuss about Wolf’s single misspelling of a single name — only to wind up with his own review sitting under a misspelled headline.

Slate goes bicolumnar

by

I am a proud reader of Slate. So what if Salon and Slate have had their spats through the years? Any publication that offers both David Edelstein’s movie reviews and Steven Johnson’s technology commentaries — along with lots of other fine reading — is going to be a permanent bookmark of mine.

But may I humbly suggest to the good people at Slate that they have taken a big step backward in their recent home page redesign? (And yes, I’m well aware that there are plenty of things about Salon’s own site organization that could be improved.)

For many years now Slate has had a highly sensible home page design, one that paralleled the essential good sense of blog organization: Newly posted articles appeared at the top of a long scrolling list, and older articles sank to the bottom. Subheaders divided this list by day. Like a blog, Slate’s design let you load up the page and scroll down steadily, picking what to read, until you started recognizing stuff that you’d already seen on your last visit. And a big “display block” at the top of the page allowed Slate’s editors to call out the articles they thought were hottest or best or most deserving of our attention.

For reasons that I cannot fathom, Slate has now changed over to a two-column format. The list is substantially similar (though harder to read thanks to some font tweaks), but it wraps down one column and then starts over at the top again. This is an incredible pain; you scroll down and scan headlines, then you have to scroll back up and then scroll back down… There’s no scarcity of vertical space in a browser, the way there is on a paper page. A two-column format only makes sense if you are making editorial choices about what to put at the top of each column, so that you crowd more of the stuff you think is important onto the “top screen.” What point is a two-column format when the list is still ordered chronologically?

In other changes, Slate now lets you click on linked days of the week to see what the previous days’ “display blocks” looked like. That’s a nice touch.

Distrusted computing

by

Superb John Markoff article in this morning’s Times explores why the Microsoft/Intel “trusted computing” initiative should probably be named, as one source suggests to Markoff, “Don’t Trust You computing.”

Steve Jobs argues that hardware-based security is unlikely to achieve its goal, and Mitch Kapor points out that Microsoft can’t really be trusted when it promises that the non-encrypted, non-DRM-laden “open” part of the operating system will always be an option.

This is an important piece on a big subject. Plans for this closed-computing model — formerly known as Palladium — are rolling down the tracks already. If you cherish the open model of computing, in which you decide what happens on your computer and you control your own data, then “trusted computing” is something to worry about.

Linux: Cheap, reliable, but fast?

by

Paul Boutin (who has written for Wired, for Salon, and now for Slate) generally knows what he’s talking about, but I think he got one thing wrong in his otherwise smart analysis of a report that Linux will soon overtake Apple’s Macintosh system, measuring by number of desktops in use.

  Linux is fast, cheap, and reliable, in defiance of the old engineer’s adage that you can only have two out of three.

That sounds good. And yes, Linux is a fast operating system. But the way I’ve always heard this adage applied, “fast” meant how quickly a piece of software can be developed, not how speedily it ran. (I was first introduced to this saying years ago by Dan Shafer, Salon’s first webmaster.)

And Linux, in truth, has not been “fast” in that sense: Like most good software, it has taken years to grow and evolve and build its strength, from the early ’90s, when Linus Torvalds wrote the earliest versions, to the late ’90s, when it became the cheap Web server of choice (and Salon moved its entire server platform to it), to the present, when the desktop-user side of things is just beginning to come together. One constant theme of Andrew Leonard’s superb coverage of the open source/free software movement for Salon since 1997 has been this: that its developers, whether of Linux or Apache or Mozilla, take their time; they’re not rushing to market to meet a corporate deadline. They’re iterating, as programmers like to say — putting some code out, weeding out the bugs, building some more code on top, and gradually assembling something great. Cheap and reliable, yes, but hardly fast.

On the larger Linux vs. Apple point: Yeah, I imagine Linux will surpass Macintosh in sheer numbers of installed desktops at some point. As Boutin says, free is hard to fight. What I find interesting — and what Boutin doesn’t really acknowledge or deal with in his article — is how effectively Apple has rekindled developers’ interest.

At geek conclaves like the O’Reilly Emerging Tech conference, where once you’d see Macs only in the hands of the occasional journalist or graphic designer, it’s the programmers who are now sporting PowerBooks and showing off their tricks on Apple machines. By rebuilding the MacOS on a Unix base, Jobs managed to stoke some serious geek energy. For the first time in years, there are interesting new applications — media tools, outliners, odd little programs — coming out for Macs that Windows users can’t get. That’s an amazing comeback, whatever the consulting firms say about desktop market share.

Windows Media circus

by

The Digital Storytelling Festival was a blast — more on it later this week. But here’s a sad little technical sidelight.

I wanted to view the little video snippets that Don Wrege had posted, in which he interviewed various presenters at the festival. (In the still on that page you can see just how little sleep I was getting last week.) The clips didn’t work using my normal browser (Opera 7) so I tried IE. No go, either. Then I saw his note that you needed Windows Media Player 9. OK, sooner or later I’d need to upgrade anyway. I don’t like Windows Media Player — I prefer using MusicMatch for my music and Quicktime for my videos — but one needs all these players these days.
So whatever; over to Microsoft, time to download.

Weirdly, Windows Media 9 would not — and still will not — install on my Win2K box. First time the installer actually hard-crashed my system — no warning, no system shutdown routine, just black screen, reboot. I’ve had better luck with Win2K than with any other Microsoft OS I’ve ever used; this was really bizarre behavior, the sort of thing I’d expect from some renegade plug-in provider, not MSFT itself.

OK, I thought, maybe it’s because I need to patch my Win2K up to date with all of those endless Windows Update downloads that I have avoided because I remain a firm believer in “If it ain’t broke, don’t fix it,” and because we have a pretty good firewall. So a half-hour later I’ve installed the Service Pack 3, the Security Bundle, and more, a total of 30 megabytes worth of patches. My operating system has now been patched within an inch of Bill Gates’ scalp; surely Windows Media will now be a happy camper and I can install it and watch my videos.

No way! As of this writing, all attempts to install Windows Media 9 (and yes, I downloaded the version specifically tagged for Win2K, not the one offered for WinXP) have failed. I get a variety of error messages. (I finally saw the videos on my laptop, which has Windows XP.)

It’s funny. You think, hey, computing has come a long way, Microsoft has cleaned up its act, things really do work better these days — and then an experience like this conks you on the head and reminds you how bad it still is out there.

Microsoft, we’re told, is counting on Windows Media to be its wedge into the digital-home-entertainment future. All I can say is, my stereo doesn’t act like this, my TV doesn’t act like this, and we shouldn’t accept our software working like this, either.

Those Linux cavaliers

by

As far as I’ve been able to tell, the SCO suit against IBM — claiming that Linux is somehow tainted by code that SCO owns the rights to — is an absurd joke, a last-ditch effort on the part of a failing company to somehow extort some money on the basis of its copyrights and patents. Farhad Manjoo wrote a definitive piece on the subject last week in Salon.

Yet listen to this “analyst”, as quoted in a Steve Lohr column in today’s New York Times:

  “It’s a real problem for the future,” said George Weiss, an analyst at Gartner. “The open-source community has been pretty cavalier about this. You’ve got to respect intellectual property.”

“Cavalier,” dictionary.com says, is defined as “(1) showing arrogant or offhand disregard; dismissive… (2) Carefree and nonchalant; jaunty.”

I can’t think of a stupider statement on this subject. If you know anything at all about the history of Linux and the open source movement, you know that it is precisely the opposite of cavalier on this issue.

What we call Linux today is an assemblage of parts — including building-block components created by Richard Stallman and cohorts at the Free Software Foundation, and the kernel first written by Linus Torvalds — put together, with great care and effort, across nearly two decades of development. Each part has been written from the ground up and protected by open-source licensing.

The GPL (GNU Public License) has its devotees and its detractors — and there are competing models within the open-source world. But that just shows how much thought and, indeed, respect these programmers pay to thinking through the complex aspects of intellectual property as they relate to ownership of software code.

Linux’s architects have been the opposite of “dismissive” or “carefree” on these issues. Their whole project is a thoughtful, careful, “slow and steady wins the race” approach to creating a new model for the intellectual-property basis of software. To call this effort “cavalier” is just stunningly wrong.

Sure, that new model may not be to the liking of many in the commercial-software world. But it “respects” traditional notions of intellectual property even as it tries to reshape them — and that’s one reason it’s proven so enduring and effective, and why Linux will continue to prosper while SCO is likely to end up as a footnote.

Cleaning up behind the bleeding edge

by

“Bleeding edge” is the label for people (“early adopters”) who buy new technologies so early that they have to deal with all the bugs and problems that the technologies’ creators failed to solve in their rush to market.

I have always tried to avoid the bleeding edge, but I’m also interested enough in new technologies that I itch to toy with them. Usually, I grab semi-new technologies a generation or two after their introduction, once there’s been a little time to iron out the glitches and bring the prices down. (On the same theory, I will never buy a computer with the fastest processor — you can always save money buying one two or three notches slower than the fastest around, and you’ll never notice the difference.) I think this puts me at the trailing edge of the bleeding edge — the scabby edge, perhaps.

So it is that, a year or two after the 802.11b/WiFi revolution took all geekdom by storm, I have finally joined the bandwagon — with a little help from a book I’m happy to recommend, Adam Engst and Glenn Fleishman’s “Wireless Networking Starter Kit.” (Engst’s “Internet Starter Kit” was the book I used to put my Macintosh on the Net back in 1994, so this all felt right.)

What has amazed me, as I added wireless to my existing home network with its DSL connection, is how absurdly cheap the hardware is. I got a perfectly good Netgear wireless router box for $70 with a $20 rebate (and I see that in the two weeks since I bought it its price has gone down another $10); the PC card for my laptop was even cheaper — $80 but with a $50 rebate. OK, I know all this 802.11b gear is being dumped because a new generation of faster, backwards-compatible 802.11g wireless equipment is coming on the market and the manufacturers are unloading the less desirable old stock. I don’t know how any of these companies are making money, but in the meantime, there are tons of amazing bargains out there. The wireless equipment doesn’t cost much more than the ethernet cabling and hub you’d use to build a wired equivalent.

Itunes, have you met Emusic?

by

Haven’t had time to test drive the new Apple music store. I’m glad that Jobs & co. seem to have broken the logjam in getting the big labels to find a reasonable way to distribute their music online.

The one drawback of the Apple service many users have complained about is the absence of a wide selection of independent and alternative music. I can imagine the organizational explanations for why this is, and I’m sure it’s not Apple’s preference — after all, in the world of mainstream personal computing Apple has always been an “alternative.”

Still, it underscores how happy I continue to be with the Emusic service, which I’ve now had for a good year and a half. $10 a month; unlimited downloads without annoying DRM mechanisms. Since in any month I find at least a half-dozen CDs I want, that’s a bargain; plus I get to sample lots of artists without having to negotiate stupid streaming-only limitations. If your musical taste runs to obscurities anyway, this is one of the best bargains on the Net.