Scott Dier

Considering a Move...

2011-06-20T19:40:00.000-07:00

...unless we can get the smokers at our apartment (11 Dolores St, San Francisco, CA) to stop smoking on the fire escape and lighting incense all the time. I think they use the incense thinking it will make us not notice the copious amounts of pot they're busy smoking, too. Not excited to move, but having to close all the windows when its 70F out is crazy.

Personal Internet Security

2011-06-16T00:27:00.003-07:00

Tonight I had read an article on Internet Security pitched towards common Internet users. The idea is that most people have a bank account, an email account, a couple social networking accounts, an investment account, etc. Defense usually concerns loss of account credentials (username and password) and general safety on purchasing products online. I'm not excited about the articles I've read so far because I think they miss tactics that would help avoid incidents. Heres a few ideas that I'd consider 'Extra Credit' but make it a lot harder for attackers:

Use a different strong password for every account. Just do it. Painfully hard, but a lot less is lost if one credential is taken, but the others are fine. Federated login (logging into TripIt with the Facebook button, for instance) can help reduce the number of times a password needs to be typed. This is fine as long as the federation makes sense, that the use of the 'master' account is as safe as the other use is. (ie: using a social network login to access your bank account -- might have no problem putting that password into your phone but may be hard pressed to store the password to bank accounts, transfers, billpay on a phone) Feel free to write these down and keep them with in a wallet or use password management software such as 1Password. Be weary of services like LastPass, which will happily let you recover all the passwords through email. Consider this article on writing secure passwords or trust a password management tool to do it for you.

Consider enhanced login services. Some services offer two factor or text-to-your-phone codes to help prove that you're actually who you say you are through a username and password. Some are as simple as asking personal questions if using an unknown computer. The former is better -- it usually requires an attacker to be operating in 'real time' and raises the difficulty considerably as the combination of username, password, and code is valid for a much shorter time than username and password alone without a second factor system.

Use a secure Internet browser. Not all browsers are maintained the same. Take a look at Pwn 2 Own, a conference event at CanSecWest that features major browsers and devices with prizes for those who break a given system. Firefox and Chrome did well this year (2011). Both of these browsers also offer independent researchers bounties for turning in serious bugs.

Buy stuff online via major retailers or use payment systems with smaller trusted retailers. Lots of major retailers preemptively match prices online, and some larger Internet-only resellers can be trusted to handle credit cards correctly. However, that cool custom made gadget may only be available from a smaller retailer that you trust to send the new toy, but you don't necessarily trust their online store to keep your credit card information. No worries, most of these companies realize this and offer payment via PayPal, Amazon, and Google Checkout (and others, but I don't know them all offhand, and those are the ones I can easily trust). Some of these payment systems offer seller guarantees based on reputation. Amazon even fulfills some of the products from these smaller firms so they arrive faster too.

Things you should already be doing, usually covered in articles like this. Antivirus, even on Mac. (No, I'm serious this time) Automatic updates. Watching for odd activity on accounts, taking action when you notice it. Don't trust emails from anyone claiming to want personal or financial information. When your computer suddenly acts weird, get someone to check it out.

And for gods sake, stop installing video codecs.

Noble P&R, Brooklyn Park, MN

2011-02-20T01:55:00.000-08:00

Sometime after I moved the city decided that Noble P&R needs to be upgraded. Turns out, that instead of 'high density' residential across the street a larger parking lot will be constructed. Originally this was to be a set of apartment buildings but the not-in-my-school-back-yard folks were able to block it.

Instead, they're going to have ~1,000 cars/day stream in and out of a parking lot and some fast food put in next door. This seems like more of a risk than some apartments would be.

Heh

2011-02-20T01:47:00.001-08:00

Absolutely no new posts, but I redid the fonts again. Sigh.

Redesign

2010-03-17T16:58:00.002-07:00

Saw someone using typekit on another site today and decided to try it out. Its nifty!

Drobo!

2010-03-03T11:50:00.000-08:00

Picked up a Drobo recently due to a complete fail with a macally firewire enclosure. (it would keep going to sleep and not coming back on my mac mini at home) Seems to be working well, setup was easy (shove drives in) and it pretty much works. Its slow. 30 MB/sec writes is all I've seen. Dunno about reads, haven't tested yet. Get a more expensive drobo if you need high peformance, mine is more of a place to stick huge amounts of data I don't need very quickly.

Note: I would still back up any data on the drobo to another disk -- raid is not a backup.

OSX, Snow Leopard, a2dp

2009-10-07T11:39:00.003-07:00

So you'd figure with Snow Leopard that sound quality with some a2dp headsets would be better -- turns out it isn't. I was able to 'fix' my sound quality with a Motorola S9 by going to Bluetooth Explorer (option-click on bluetooth to find it) and going into Utilities->Special Options. I changed the bitpool minimum to 40 and the sound quality is MUCH better. Sounds like its a problem with negotiation between this headset and OSX. If you set the value too high OSX will let you know that the headset rejected the codec settings. I'd figure that 40 is ok for me, but might not be ok for others -- use this at your own risk.

Yahoo pipes are fun!

2009-06-27T22:35:00.003-07:00

Got an idea from Ben the other night to turn the MPX HWO product into a little feed with Yahoo Pipes. He had already done it and made a google gadget for it, but I thought I'd take a crack at it too. The pipe can be found on the right side of this page, even.

Minnesota OET Transparency Fail

2009-05-06T19:11:00.002-07:00

PIM was able to get information about why OET can't just provide some sort of public data warehouse for citizens and groups to get data from, its just too hard. Instead of a how-can-we attitude, we've got a nice document of why we can't. The bill is pretty straightforward, instead of the horrible difficult-to-query system that doesn't let you do things easily (like select multiple vendors, etc) and does not seem to work with modern browsers. (I can't see any output in Safari 4.0)

Why would it be so hard to run a nightly query of information and transfer it to a data warehouse? This is done in many private and public sector entities and in this case a filter could be applied to filter out protected data. I did a quick search for 'public data warehouse' and found an impressive District of Columbia site that is likely closer to what people expect from our government. They've got a live feed of purchase orders, even. A citizen or entity could grab this data and reproduce it in a form more relevant to other citizens.

Speaking as a computer security professional, I do not appreciate the 'security' hammer used as a reason for government to avoid transparency. This can obviously be supplied in a secure manner by other governments, why not ours?

Wow, that was fast.

2009-03-26T16:12:00.000-07:00

Complained to the power company that my meter wasn't working right, I was getting 200kwh bills (!), and while I wasn't minding how cheap it was I was minding the huge bill I'd get someday instead. So I called them this week and they came out today (!) and changed the meter!

Looks like its a new snazzy fully digital one, with a whole 9kwh over about 6 hours of service.

Helix no longer free

2009-03-23T06:46:00.001-07:00

For those of us who just used helix as a boot-disk that happened to have some free tools on it, this is a completely insane idea. It will backfire on them. I have no doubt that people who wrote this free software will protest the idea of profit on the backs of their work.

Now, helix does have a bit of non-free stuff, but I didn't generally use it. I can understand there is a cost to that part of the CD.

In the meantime, its quite easy to make your own Ubuntu boot cd. Some care is needed to disable mounting of disks and swap. Otherwise, some packages that you might be looking for can be found here in my PPA.

The directions Ubuntu provides covers most of the process.

I happen to place an ssh server and public keys on ours so we can access machines remotely.

Feel free to comment if you've got any questions about how to make your own CD -- its worth it not only for the remote forensics capability, but also because you'll learn how to be self-reliant using free software.

Hello World

2009-03-12T11:47:00.001-07:00

Yay, new blog!