Lead vs Manage

A leader is judged on the performance of the team as he leads them. A manager judges himself on the performance of the team when he is not there to lead them. Prefer managers.

Spam Counter - 2008 December: 727

Still dropping. Maybe spammers take Christmas off. If the returns are as poor as we're told, that's not surprising.

MP3: All Right Now?

I had to draft one of my standard all-IT-staff circulars today. The removable media logs have started going to Risk and they read them with great delight, asking what Genesis\[album name]\[track name].mp3 could be. I think they know, really.

We don't block media types anywhere. Nothing says "*.mp3: DENY". There's plenty of business reasons to use media files. But it does mean the personal media files can flow through our systems.

It seems that Something must be Done. But the landscape has changed since the last time I sent out that note. It's possible, now, to be in possession of a legal MP3 of pretty much any track. I've been buying mine from Amazon. (And, yes, I checked, Genesis is on the list -- I just added Many too Many and Follow You Follow Me to my shopping basket.)

So why am I objecting? Personal use is legitimate, and these IT users have removable media access to do their jobs. I'm not entirely sure, but I think it's this:

• MP3s moving through work PCs raises the possibility of sharing. That's not OK, and it would be directors liability if it was happening.
• It's unnecessary. Decent media players are so cheap these days that if you can't work without music, you don't need to play it off your PC.
  
• And I just don't like to see IT types exploiting their extra privilege. We have rules about not using admin access for personal purposes, and while removable media doesn't directly arise from admin status, it's in the same sack as far as I'm concerned.

So I drafted something, but I haven't sent it out because there has been another change, and it's this. We've acquired some serious object access audit over the holiday, and one of the facilities is the file type search. This is my chance to locate the famous invisible media repository. Tomorrow I'm going to search for *.mp3 and we will see what we will see.

In the meantime, I see today that Apple are giving up on DRM, but the track price won't change. I couldn't help thinking of all the poor saps with their vast itunes collections of DRMed music suddenly devalued by Apple's Amazon-forced coup. Still, serves 'em right for buying overpriced music players that can't do .OGG....

Best Christmas Present

This is not a joke. It's as big as it looks, it locks and unlocks with the keys, and the flap swings to cover the keyhole. It was retrieved when the contents of a country house in the family were broken up many years ago and now I have it!

It's security theatre. It looks the business, but it fails against Kerckhoffs' principle-- offhand, in two ways: it's not convenient to use -- the keys would destroy my key-ring -- and of course that key is thoroughly guessable

Just for reference: this is the contents of the more mad son's Christmas list:
      December 25 2008 Thursday David's Christmas Presents
      Thomas the tank engine Percy and the Signal VHS
      Thomas the tank engine The Runaway VHS
      Thomas the tank engine Escape VHS
      Thomas the tank engine Thomas Gets Bumped Bumper Special VHS
      Thomas the tank engine Thomas's Christmas Party Bumper Special VHS
      Thomas the tank engine Rock n Roll VHS
      Thomas the tank engine Story and Song Collection VHS
      Thomas the tank engine Happy Holidays VHS
      Tots TV Bike Ride Bumper Special VHS
      Fun Song Factory 3 Party time at the Fun Song Factory VHS
      Fun Song Factory 2 VHS
      Tumble Tots Action Song Favourites [1996] VHS
      Tumble Tots The Action-Song Sing-A-Long VHS
      Tweenies Song Time Is Fab-A-Rooney [1999] VHS
      Maisy Maisy's ABC VHS
      Canon Digital Camcorder 35x and 1000x DVD Video
      Nikon Coolpix P50 Digital Camera 8.1 MP 3x optical zoom black (Upgrade with SD)
That's right. Fifteen videos (the "VHS" is not a misconception -- he wants tape cassettes) and two mid-range, top brand cameras.

We got him a Fuji S5700 which is cheap now and has quite a good video function (and is currently the best camera in the house), and Mrs U has had a trawl round the Maidstone charity shops for videos. We'll see how it goes.

Solstice

http://www.daylightmap.com

Spam Counter - 2008 December 13: 634

Can't put this on the graph, but one month on from McColo it's still falling.....

Spam Counter - 2008 November: 852

This month's drop is the the famous McColo effect. It'll be interesting to see how a whole month without McColo looks on 12/12.
The content seems the same as ever.
Two interesting papers about email-delivered nuisances: spam and phishing. Each offers methodologies which finally give realistic estimates for the return from penis spam and phishing. Both agree there's very little profit in it -- mugs and losers are, after all, a limited resource. Which is nice.

Chinese Hackers are Real, I Tell You...

... And they're planning to flood the world with cheap telephones.

Al sits close to the Head of IT -- a position that reflects his operational centrality, and the affection in which he is held. But he came to me with a puzzle about his Hotmail. It seemed that he'd managed to send himself, and all his contacts, an email advertising http://www.feixiangyu.com -- an electrical distributor.

Well, we looked at things like his spam folder, and whether it was just in fact a particularly artful non-delivery notice. But soon he had replies from his contacts congratulating him on his new business venture.....

Now the beauty of Hotmail is that it's easy to attribute. The X-Originating-IP header gives just that -- the IP address of the originating computer, which is the IP that Hotmail saw as the browser that "got" (GETed?) the send links. This one was 123.53.119.162 and Sam Spade plumps that in the middle of the Middle Kingdom. The ISP is Chinanet, and the PoP is Zhengzhou -- capital of Henan, a respectful distance from the Yellow River -- seven million people in a few square miles, and at least one dodgy marketing guy.

On the whole, I'd rather be hacked by Chinese shopkeepers than the Russian Mafia -- you're less likely to have your bank account emptied. I told Al to change his passwords, check his bank statement, and run an online AV check on his home PC. I sure hope that shows something, otherwise I'm going to have to wonder whether it happened on his office machine, and that's something I just don't want....

Microclimate (2)

A nice strong frosty morning. When the train went into Sevenoaks tunnel, the double-glazed windows were clear, but when it came out, they were obscured by condensation -- on the outside.

I guess it takes a while for the roots of the North Downs to cool.

Solving the Wrong Problem (a different one)

Now, listen. Encryption is probably not the solution to your problem. We hear a lot about encryption these days and it seems to be widely imagined as the solution to a problem, or a reason why it's not a problem: "it was encrypted", "we'd better encrypt that". Keep an ear cocked for that sort of thinking, because it is the sounds of someone making a mistake. Encryption doesn't solve any problem, not even access control problems. It replaces access control with a smaller, tougher issue: Key Management. Whether that helps at all depends on the situation. It's late and I'm tired so I'll cut through and state the facts. Encyption only helps when the key management problem can be solved, and the key management problem can only be solved in strict binary situations: When you can cast the problem in terms "everyone in this group gets full access without per-user auditing and no-one else gets anything" then maybe you could try encryption:

• Access for a single person against the whole world -- keeping personal secrets
• The same plan for a group small enough to maintain perfect mutual trust. Some of us feel that the maximum size for such a group is one.
• Shared channel against the world: the VPN and encrypted device

It's Us (or rather Me) and Them. If you have any other problem, don't bother with encryption.

Voter Insecurity

It hardly matters, but on the whole, and despite even Sarah Palin, I somewhat prefer the idea of President McCain. The other guy is just so -- well -- young. As well as being a lifetime politician.

If McCain loses, well, that's just what the polls were saying. It's easy to accept unsurprising results.

But if he wins, I won't know what to think. The trouble I have is that I just don't believe in the integrity of the US voting system. Why do you need a machine to vote with? It seems as though the sole purpose is to create opportunities to bugger it up, with ballot layouts designed to fit around punch cards, more-or-less functional touch screens and the Dear knows what else.

It seems that some counties actually have voting machines where the votes only exist as totals on a CF card. That's OK for money: You can audit against the books of first entry. But ballot papers -- the petty cash slips of the political world -- are just missing from conventional PC based voting machines.

So I'm hoping for a landslide, because I don't think the USA needs another argument about who truly won.

The Angry Cyberwarrior

All over the world, we are told, war departments cosset their lists of unpublished vulnerabilities, kept in reserve to get into enemy systems. If that's true, there must have been more than one outburst of tantrums and glum looks when MS published MS08-067. It's a splendid vulnerability and one that would have saved a lot of social engineering and spying.

Now it's worthless.

Spam Counter - 2008 October: 1387

No real change. Penis pills and Russian ladies: Olga and TatianaG want to meet me?

MS08-067

I think this is the second or third time MS have published an out of cycle patch, and it may be the first proper Windows (as opposed to IE or Office) vulnerability to get this treatment.

It probably deserves it. When I read the notice, my heart sank. I remember staying up thirty-six hours in August 2003 dealing with Nachi/Welchia running through our systems because we didn't suceed in patching MS03-026. It didn't help that I was pissed as a fart for the first six hours or so -- having been hauled out of the pub at 10PM by an aggrieved network engineer watching our traffic heading through the roof -- and my boss had to hide me in the machine room trying to figure out what was going on, while she explained to her boss that she'd sent me home. What did help was that it used ping to explore the network, and it dropped nice clear signature files. That night I experienced the sheer beauty of Cisco VACLs (level 2 filters) when I found we could use them to suppress ICMP, and that left the worm blind enough for us to clean up by hand, though I didn't dare turn it back on for a week, and we left the filter on the link to Group for years....

That vulnerability was in DCOM -- pretty important, but possibly fixable by switching off the service in the registry. This one is SMB, and there's no switching that off. You may as well shut down.  Oh, and a modern malware wouldn't make the same mistakes as nachi, or be so gentle to its hosts. So I was pretty uncompromising all Friday, and reading the increasingly nervy statements from MS, I really don't think I was too rough. We're inserting this patch as a special into the October/September patch cycle that was just starting its route to live on the Friday. We'll have to re-do all the test servers. I hope that's enough.