musings on security and other topics
topics
archives←February→
| Sun |
Mon |
Tue |
Wed |
Thu |
Fri |
Sat |
| |
|
|
|
|
1 |
2 |
| 3 |
4 |
5 |
6 |
7 |
8 |
9 |
| 10 |
11 |
12 |
13 |
14 |
15 |
16 |
| 17 |
18 |
19 |
20 |
21 |
22 |
23 |
| 24 |
25 |
26 |
27 |
28 |
29 |
|
most recent headlines
other links, other blogs
|
Skype with Video for Mac
In my blog
Time to try SightSpeed, I wrote, "When Skype comes out with
video conferencing for Mac, I'll try that also."
There is a version of Skype for Mac with video
conferencing.
My Skype id is fmavolio.
I'm still happy and willing to talk via SightSpeed, as I mention in the above
cited blog entry. My SightSpeed id is fred@avolio.com. If you try
either one and I do not respond, please leave a message or send me email.
Skype with Video for Mac
is available at
www.skype.com,
I had good success with my friend,
Michael.
PGP and Leopard
I've been a fairly happy PGP Desktop User. I used it
on Windows and when I moved to a Mac. Even though few of my correspondents
use it (as I mention in
this earlier blog) I like to have the option. And, I do have
some PGP-encrypted e-mail that I keep encrypted.
Before Leopard, PGP Desktop came with a "Mail Bundle" for Mac. It's
an extension that adds "decrypt/verify" and "encrypt/sign" buttons to the
Mail windows (where appropriate). PGP Corporation prefers users
to use the proxy, an application running in the backgroud and automatically
decrypting (it is secure; it asks for your passphrase) and encrypting if it
can. I wanted more control over what I send encrypted. (Just because my friend
Davecan read PGP-encrypted e-mail, does not mean I always want
to encrypt email to him. A topic for another blog, perhaps.)
The Mail Bundle in Leopard broke this.
I found a fix at the site of someone who is really made at PGP
and thinks
PGP Sucks. (I don't think it does. I think it needs a small sub-group
that handles retail customers.) He also pointed me to the solution.
Sen:te's GPGMail. It is not a final release, but
is working fine for me. (I have the GPGMail_d51_Leopard distribution.)
It requires Gnu Privacy Guard, which I got from Sourceforge's
Mac GNU Privacy Guard site. (You will have to use Terminal
to import your key files.)
It works fine, just as I want it. I moved the not-working PGP Mail
Bundle out and moved in the GPGMail bundle.
Here are some screen shots.
-
An encrypted message:
-
Decrypting it:
-
Creating a new message:
The Mail/Preferences window is straightforward.
For more and earlier discussions on secure email, check
out my
secure e-mail collection.
Leopard Installed!
As I mentioned
earlier, I put off installing Leopard until 10.5.2 came out. The reason was, while I knew friends who had a smooth installation, I worried about the]
hassles I read about from others. The things I read seemed... well not very
"Mac-ish" and more "Vista-ish." (Kind of like what Apple says in their ad
Party is Over and
PR Lady, which mentions people downgrading to XP from Vista). So, I bravely waited. (☺)
I did install it and have Leopard up and running just fine on my PowerBook G4. (The Intel MacBook Pro I use at APL will be upgraded when IT tests all Lab-required applications.) The short version is:
-
It was not without problems. I.e., it was not painless.
- But, it wasn't that painful either.
- Some applications needed tweaking when I was finally done.
- I was/wam very glad for my
back-up
procedure. It made some of the restarts I had painless.
In the next week, I will blog on the following:
- The installation. The steps I went through. What failed. The easy and simple fix.
- Problems I had, in particular with iCal, iChat, AddressBook, and Mail, and how I fixed them.
- The good stuff. Cool things, things I don't yet use, good surprises.
Look for these in the next week or so.
Freeing Up Space
I needed to free up space on my 12" PowerBook G4 today. I noticed a
sluggishness. Then I got an error in iPhoto as I was modifying a photo.
(I had
previously downloaded some Christmas photos and before that downloaded
new music I received for Christmas.) It told me I was low on space.
Using I checked the "info" about my Macintosh HD.
Sure enough, it was nearly completely full.
First, I deleted the GarageBand application and associated files.
I had never uninstalled it although I meant to. I don't use it,
nor can I imagine ever using it.
I also deleted the Macintosh HD/Library/Application Support/Garageband directory as well as the Macintosh HD/Users/Shared/GarageBand Demo Songs folder.
Using "du" in a Terminal window, I found that my iTunes and Pictures folder were (as I figured) quite large. Using a program called
WhatSize, I dug around and basically confirmed
that my photos, though taking up a lot of space, were not the big user. iTunes was.
And given that there are convenient ways to move my music to another
drive, that is what I decided to do.
First, I tried to follow the instructions for
How To: Back up your music using iTunes 7. I could not use iTunes back-up facility though because I did not want to burn my music to CDRs and my
PowerBook does not have a DVD burner! No worries. I back up my system regularly (as I mentioned in my discussion of
System Back-ups. I have 2 copies of my music library already.
I followed most of the instructions in
How To: keep your iTunes library on an external hard drive.
Make sure you read "The Gotchas."
Really, the only downsize is that if I forget to fire up the external drive, iTunes eventually complains.
All told, I cleared up 25G.
Another Expensive Loss, This Time Due to Email
The headline said
Lilly's $1 Billion E-Mailstrom.
Katherine Eban opened with, "A secret memo meant for a colleague lands in a Times reporter's in-box."
The short version is that typing in a recipient's last name first expanded
in the sender's email client (it could have been any email client)
to a Times reporter with the same last name instead of the sender's
co-counsel. That should never happen. But, it happens all the time. It usually has benign results.
Why, just the other day I sent a short email message to a friend, I'll call him Andy Jones. I typed in his email address from memory: ajones@example.com.
Except that wasn't his address. I did not get a reply, I knew he usually
replied quickly, and I saw by his IM screen name that he was on and active.
So, I looked up his email address to be sure. I had left out a letter. He used
his middle name: abjones@example.com. Bummer. But, no harm done. It was short, nothing-secret-about-it kind of note. But, this story and my example,
reminded me of something from a past company.
Up in the UNIX support group at Digital Equipment Corporation (DEC), in the
olden days, everyone there used the same VAX computer, decvax. It was a major
UUCP gateway (look it up—it's part of your history!).
On this central
computer, there was a mail aliases file. Usually, such a file is used for
mailing list support.
For example, ultrix-engineers might expand to the email
addresses of the entire group of software engineers. That's a good use for
distribution lists. One day a product manager sent a note out to internal folks about what she was working on, DECWindows. She sent it to what she thought was internal folks... not even a distribution list. She sent email
to—and I am making up these names now: joe, mary, ken, tom, and jane.
The next day, she got a note from Ken Thompson at Bell Labs saying, basically,
I don't think this was meant for me. See the developer she wanted to send to,
Ken Smith, used his initials for his mailbox, kts. The mailbox "ken" ... well
you see where it went to. It could have been worse. In that same file there
was a mailbox "bill" which went to Bill Shannon and "joy" that did not go to
Joy Dormat, but rather to Bill Joy. Shannon, formerly an employee of DEC
UEG and Joy, formerly at UC Berkeley—which expains the "why?" of their
emails being in the DEC aliases file—both had moved to Sun Microsystems,
a major DEC competitor.
Now, that wasn't the same problem as what happened to Lilly. Back then,
email clients did not auto-complete addresses. It is a worse problem today. One types and the email client fills in a name, we hit and go on to
typing the next name, and so on. It is a problem with some technical solutions,
but solutions that we mostly ignore because "it just won't happen to us, and
even if it did, what could happen?" There are solutions out there. I bet that
Ely Lilly's outside law firm gets an email firewall.
(In the past, I've written about, lectured about, and reviewed products, and
recommended policies, that mitigate risks like this. It really is old stuff,
that has already been managed. We just don't bother. See my
Secure E-mail Collection.)
Potentially Expensive Laptop Loss
For the one who lost it, that is. The AP headline on the Fox News website
said "Best Buy Sued for $54M Over Lost Laptop." The woman who is suing wants
to make a point and doesn't expect all that much. Read about it at
foxnews.com.
But, she doesn't seem to be remorseful about not encrypting her data. Most of
us don't do it, do we? I'm not in the survey business, but I wish I knew
how many businesses encrypt their computers. We've talked about it for
years.
In 2006, it was
More on Stolen Notebook* PCs.
And I wrote at least two columns for WatchGuard on the subject.
PC Disk Encryption: A Lesson Learned and Recommendations
and
Deploying Crypto, What Are You Waiting For?.
Leopard
I've been trying to think up a reason to upgrade to Apple's new OS. I read David
Taylor's blog entry,
I'm now running Leopard on my MacBook Pro and Mac Mini!
and was convinced by the reported faster performance (not that I have a
problem with that) and the $109 price tag. (See David's blog.)
I found his list of "the applications [he] needed to install to be fully
functional" interesting and gave me a few to check out. I made a similar list
when I first was looking to switch from Windows. (See
After Windows,
What?.)
Who's Your Daddy?
Yesterday, I spoke with Kelly Jackson Higgins, Senior Editor at
Dark Reading.
Check out what we talked about in
Who Invented the Firewall?
(No, it wasn't me.)
It is interesting to me to see who claims what.
Someone claims to have developed the technology used in all firewalls today.
(That would be... what? Boolean Algebra? Sorry, man. That was George
Boole!) And someone else is the father of the
"first commercially successful firewall." Quick! Who is the father (sorry, or
mother) of the first firewall that "struck back?" How about the
father of the firewall with the most vowels in its name? The father of
the first firewall built on marketing hype?
Don't worry. There's room for everyone.
|
Recently, I recommended this to someone on one of the Apple discussion groups. The title was "The Grandparents weep for joy, then frustration." His final reply from the Apple discussion: