John Sage ♦ Simple IT

Why Email Scams Won't Go Away

2014-05-19T10:25:00.001-07:00

Depressingly accurate.

Heartbleed: What You Need To Do

2014-04-16T11:35:00.002-07:00

Most of us have heard the news about the "Heartbleed" vulnerability, which possibly allows hackers to retrieve your login password or other personal information from many popular web sites. So what's it all about?

"Heartbleed" refers to a vulnerability in an encryption library that's used by many different web servers. The library is called "OpenSSL," and it's what's used to make online commerce, banking and other activities secure. OpenSSL is not the only encryption library available, but it's one of the most popular.

So what do you need to do? Just to be safe, change your online passwords. If you have a lot of them, that's a hassle. And if you use the same password for many different web sites, that's just plain risky - even without the Heartbleed vulnerability. First things first, go to this web site to find out if any of your online services are affected by Heartbleed. If you don't see one of your favorite web sites on the list, then you can type in its address here to check if it's vulnerable.

Second, start using "two-factor" authentication. What's that? Well, it's "something you have" combined with "something you know." Both "somethings" are required to login to a web site. A password is "something you know," so just using two passwords isn't really two-factor authentication. What if you wrote them both down on the same piece of paper and someone else found it? One the other hand, "something you have" can be something that you always have with you, like your cellphone.

When you enable two-factor authentication for Google or Dropbox, for instance, as soon as you type in your password (something you know) then the web site sends a text message to your phone (something you have) containing a one-time, temporary code. Type that temporary code into the web site and you're authenticated! Now if you lose the piece of paper on which you unwisely wrote your password, your online account is still safe. Here are two lists of web sites that use two-factor authentication.

Finally, start using a password manager, such as Lastpass. It makes keeping track of all your various online passwords very simple, on pretty much any computer or device that you use.

For more information on Heartbleed, you can go here or here. Have fun!

SSL Vulnerability Closed in OS X Update

2014-02-26T12:20:00.001-08:00

Apple released Security Update 2014-001 yesterday, which closes the vulnerability discussed in my last post. Mountain Lion and Mavericks users should install this update ASAP. Note, if you are a Mountain Lion user and do not wish to update to Mavericks at this time (completely understandable, but fixable), then do not install the OS X 10.9.2 update. Select just the Software Update that includes Security Update 2014-001 as shown in the screenshot below.

The vulnerability allows your secure traffic to services such as iCloud, Gmail, and others to be intercepted. For specific details of this vulnerability, please consult the excellent writeups in ArsTechnica, The Safe Mac and Threatpost. If you haven't updated your iPhone or iPad to iOS 7.0.6, please do so now to fix the same vulnerability in iOS.

Public Service Announcement for iOS and OS X users

2014-02-24T08:45:00.000-08:00

On Friday, Apple released version 7.0.6 for iOS (iPhone / iPad) users. Go to Settings on your iOS device and install this update now.

What's the deal? A very serious vulnerability that exposes the secure communication link between your device and any services that you use (Gmail, Facebook, Dropbox, online banking, etc).

The exploit package is already being circulated on the Internet. This vulnerability affects not only iOS, but also OS X. Apple has not patched OS X yet, so stay tuned here. I'll post when Apple releases the update for your Mac.

If you'd like to read the technical details of this vulnerability, read this and this. But first, please update your devices!

Cloud for Small Business - Hot or Not? Redux (UPDATE 2/24/14)

2013-07-09T21:00:00.001-07:00

Google Apps. Microsoft Office 365. What are they and why do we care?

Interesting questions. What does every modern office need? A productivity suite to create and edit documents, spreadsheets and presentations. A messaging system, for sending email and enabling chat. A calendaring system, to facilitate time management and shared scheduling. A collaboration system, to corral projects, tasks, data and team members.

The classic solutions consists of the Microsoft Office productivity suite, Exchange Server for email and calendaring, and Sharepoint Server for collaboration. Why would we consider anything else?

Well, cost is one good reason. Let's take Microsoft's recommended small business scenario and add Sharepoint 2013 and Office Professional 2013. Windows Server, Exchange and Sharepoint are going to cost us $7,905. Per-user licenses are an additional $191. Office 2013 Pro will cost $367 per user. Assuming we have twenty-five users, our software costs are $21,855.

Now let's add a decent Dell server to the mix, say a T420 with 32GB RAM (for the Exchange and Sharepoint virtual servers), a pair of mirrored 500GB drives for the server OS and four 500GB drives in a RAID array for data. With a support contract it will cost us just under $5,000. This setup will last about five years, so let's add it all up and divide by five, and then again by the number of users. That works out to just under $215 per user, per year.

So where would Google Apps or Microsofot Office 365 fit in our modern office scenario? They're both "cloud" application suites. In other words, they live in someone else's data center and we don't have to worry about the where, what or how. We don't need to buy a server and software and worry about maintenance or downtime; instead we pay an annual per-user fee for our document, email, calendaring and collaboration needs. Just to give us a rough idea of cost, let's pencil out the same basic features as above, again for twenty-five users.

Google Apps for Business includes a productivity suite, messaging, calendaring and collaboration. The productivity suite provides documents, spreadsheets, presentations, drawings & charts and fillable, shareable & routable forms. For messaging it provides email and text, voice & video chat. User & resource calendaring and shared scheduling are there. Collaboration includes real-time multi-user document editing and project centralization for documents, team communication & task management. 30GB of syncable, shareable online document + email storage space per user. Oh yes, and user-to-user(s) screen sharing. Google Apps is a flat $50 per user, per year.

Let's take a comparable Microsoft Office 365 plan, Office 365 Enterprise E1. Does it match Google Apps feature-for-feature? Yes, for the most part. Some minor differences, such as 25GB per user for email and 7GB per user of syncable, shareable online document storage. The E1 plan will cost us $96 per user, per year.

So how does that work out over five years? The onsite solution will cost us $26,855. Microsoft Office 365 (Enterprise E1) will cost us $12,000. Google Apps will cost us $6,250. Are there important differences? Yes, there sure are. Are any of them show-stoppers? Most likely not. Can we run our modern office on either of these cloud platforms? Unequivocally, yes. And we'll save some cash by doing so.

UPDATE Feb 24, 2014: It's been a while, I know. Sorry for the long delay, there've been a few storms and a few changes since the summer. I'm looking forward to some un-dramatic calm for the next few months. In the meantime, Microsoft has re-released their online offering and has chosen the sensible name "Office Online." Some new features, some new subscription plans. Unfortunately I won't be doing the in-depth review that I promised; that ground has been well-trodden in the last few months.

"Badges? We don't need no steenking badges!"

2013-04-04T13:51:00.001-07:00

All too often I've encountered a certain type of person in an enterprise, business or personal setting who questions the need for a secure network environment. Actually the word "questions" is too weak; this type of person actively opposes network security measures. And very often they're in a decision-making position for their organization. One otherwise intelligent manager that I once worked with recommended that we discontinue our enterprise antivirus and disconnect our firewalls.

What reasons are given for their opposition? "Security is too inconvenient." "We don't have anything a hacker would want." "Security is a waste of money." "I use (a Mac / Linux / Microsoft Security Essentials) and I'm not vulnerable." Despite all evidence to the contrary, such persons throw up obstacles to even the most basic of security measures. How does one deal with such deliberate, even prideful, ignorance?

IT supports business, and IT decisions must be made in the context of the needs of the business. The primary need is profitability. IT is a cost center, not a revenue generator. So IT expenses must be carefully evaluated against the cash flow of the business. However business is also about evaluating risk, and weighing the cost of threat mitigation against the likelihood and consequences of its occurrence. Which is a long way of saying that you must speak "dollars and cents" when discussing IT security with the business principals.

Stakeholders will sometimes focus just on the cost of security. But let's flip that around, and talk about the dollars and cents of the risk. Why? Because the hackers exploiting these risks do it for the money. Whether one considers the information in their network to be of value or not, there are many ways to generate cash from an unprotected PC connected to the Internet. Brian Krebs, a security blogger who focuses on breaking down threats in ways that everyone can understand, published an interesting article and accompanying chart that together illustrate the many ways your PC can be turned into cash.

Aside from harvesting your social security number, bank account numbers and credit card numbers - which can all be immediately resold on the Internet, how about gathering your email contact list for sale to spammers? What about using your compromised PC to serve child porn on the web? Or grabbing your login credentials for any number of websites, including access to your business servers? Or adding your PC to an army of thousands of zombie bots used to launch distributed attacks on high-value Internet targets?

The antidote to ignorance is knowledge. And while you may not convince those who proudly cling to their ignorance, you just might change the minds of those whose job it is to keep an eye on the dollars and cents.

Ever what?

2013-03-12T18:34:00.001-07:00

Many of my friends know that I recommend Evernote unequivocally. Evernote is my personal repository for all kinds of information, accessible from just about anywhere. Evernote runs on Windows & Mac, iOS & Android, and even as a web application (Windows Phone, PalmOS, BlackBerry, Windows 8 Touch, Safari, Chrome and Firefox too!). Regardless of the platform(s) on which you run Evernote, it keeps your personal information synchronized between all your devices and PCs.

Evernote is incredibly useful, but many first-time users have difficulty understanding what it can do for them and how to use it effectively. Lifehacker has published a great article that walks you through several uses that illustrate what it does and how to do it. Here's another article here that you may also enjoy.

What do I use it for? Keeping track of my web accounts, interactions with customer service reps, all the places I stash my money, scanned contracts and other important documents, project pictures, drawings & documents, tips & how-tos, manuals for my appliances and many, many other bits and pieces of information that I don't want to lose. It's fully searchable, quick & convenient to use and very portable. Try out a free account for yourself, install it on your portable devices and then see what you can do with it.

Plug those holes: web browser plug-ins

2013-03-09T08:24:00.001-08:00

Courtesy of How-To Geek, here's a great article about browser plug-ins and how to disable them. You're probably already familiar with Windows and OS X start-up programs and the havoc they can wreak. Browser plug-ins and Internet Explorer's "add-ons" and "browser helper objects" ("BHOs") can be another source of vulnerability and frustration, just like the Java plug-in we've talked about in the last few weeks.

Plug-ins are supposed to add functionality and features to your online web experience. But often, because of poor programming or unforeseen interactions, they can break your browsing experience or worse, expose your PC to attack. How-To Geek has two more articles you might find helpful if you want to tune-up your web browser.

If you'd like an automated tool to help keep your Windows PC clean, try Malware Bytes (free version here). Keep it up-to-date and run it weekly as a complement to your current anti-virus solution. If you'd like a tool that gives you a bit more control over the details, try CCleaner. One caution, CCleaner is an advanced tool for Windows and OS X, so please be careful. I wouldn't want you to cut yourself

Java security problems, again

2013-03-06T08:12:00.002-08:00

For the third time in a month, Oracle has issued a new Java security patch. If you use Java, you need to download and then install the new version. Once you've done that you should without fail disable Java in your web browser.

With that out of the way, my primary recommendation is still to remove Java from your systems unless you absolutely need it to run a critical application. For more background on Java security problems, please read my blog post from just a few days ago.

Break any eggs lately?

2013-03-02T10:56:00.001-08:00

This is absolutely hilarious. PHB actually seems effective, but don't be fooled.

Curious about Google Search?

2013-03-02T09:52:00.003-08:00

Google has published a great article about the plumbing that makes their search engine work. It's pretty simple and straightforward; I'm sure that you'll enjoy it.

If you want to sharpen your Google search skills, take these free online lessons. If you'd just like a quick reference for search operators, you'll find a few good ones here, here and here.

And if you value your search privacy (you should!), use DuckDuckGo as a front-end to your Google searches.

Have fun!

Dark clouds on the horizon?

2013-02-23T04:51:00.000-08:00

To punctuate my previous two posts on cloud solutions, CIO Magazine offers up this observation:

Unfortunately, too often cloud applications and services are bought by people who really shouldn't be buying. Sure, they may have the budget ... but that doesn't mean they necessarily have the training to make good IT decisions, let alone the discipline or skills in their underlings to actually execute a coordinated technology strategy.

That's a juicy point. But I'm not trying to sensationalize the issue - cloud solutions are a necessary part of an overall IT strategy. The article goes on to make another important point:

The system isn't the critical asset. The data is. The data in almost any cloud system is worth far more than whatever you pay on a monthly or even yearly basis. If your data gets gunked up or made meaningless, that could cost you a lot of profits—or even get you in some trouble.

Give the article a good read. As you craft your company's cloud road map, keep those points in mind. The cloud can free your business from many headaches and it can add to its agility and competitiveness. But build your strategy on a solid foundation of sound planning and competent execution.

Have a great weekend!

Java - What, me worry?

2013-02-22T13:06:00.001-08:00

There's an interesting article today on THE VERGE. Joshua Kopstein poses the question "Why won't Java just go away?" That leads to our question: "What is Java, and do I need to worry about it?"

Java is present on many PCs - Windows, Mac and Linux. It's a both a programming language and an application platform. It enables programmers to write software one time and then run it on any computer that supports Java. It also plugs in to most modern web browsers so that users can run a variety of web applications. But after reading today's article you might be wondering if you really need Java on your computer.

Let's make some distinctions first. There are Java programs that run on your computer. There are Java programs that run in your web browser. And then there is JavaScript, which is not Java and thus not a topic for today's discussion. While all of the Java platform has vulnerabilities, your computer is most likely to be compromised through Java programs that run in your web browser. The web is the most efficient way to distribute attacks, and that is where you need to focus your attention.

What do you need to do today? First, let's make sure that you're actually running Java. Open a command prompt (or Terminal) on your computer and type java -version. If you see a version number returned along with a trademark notice, then you have Java installed on your computer. Or you can go to this website and run a quick test. Do you need it? Well, that depends. If you know that you need it, first you should update it to the most current version. Next, you should disable it in your web browser - follow the instructions here.

If you're not sure that you need Java, then I recommend that you uninstall it. If it turns out that you need it, you can always re-install it. But given the severity and frequency of the current attacks, my opinion is that it's best to avoid running Java if at all possible.

That brings up some other advice that I'd like to give you. Adobe Flash and Adobe Acrobat Reader (PDF) are notorious for exposing their users to vulnerabilities, via both by web browser and by downloaded documents. Keep your Flash updated, or uninstall it completely. It's slowly but surely being replaced by HTML5 video standards, and it's no longer supported on iPhone/iPad and Android. In order to read PDF files, consider using Nitro PDF Reader or Foxit PDF Reader. While they have had vulnerabilities in the past, they are generally more secure than Adobe Reader.

IT administrators, are you paying attention?

Cloud for Small Business - Hot nor Not?

2013-02-21T12:10:00.003-08:00

Last week I offered Rodney Roger's perspective on the place of cloud computing in the enterprise. His premise, with which I completely agree, is that current "enterprise" cloud offerings lack the breadth and depth of on-premise systems. To paraphrase him, Salesforce and Workday are not ERP. He's absolutely right. He also points to emerging cloud solutions that do fit well in the enterprise (Box and ZOHO). By the way, if you enjoyed his article, here's another.

But what about the SMB market? SMB is a broad category, and the smaller end of it has needs that are much different than the larger end of it. Do cloud services make sense?

Well, let's define what "cloud" means. Most of us think in terms of "Software as a Service" (SaaS). Quickbooks Online, Google Apps and Salesforce come to mind. Programs that we used to install on our PCs and servers, but we now pay a subscription for and use on any device (PC, laptop, tablet, smartphone) anywhere that we have an Internet connection.

But "cloud" has an even broader definition. There's what is called "Platform as a Service" (PaaS), the delivery of services via the Internet, such as Amazon Web Services, Google Apps Engine and Microsoft Azure. Cloud applications are built on top of these services. Rather than running your own data center and application stacks, PaaS providers provide the platform on which to deliver your own cloud apps. Popular apps like Instagram (Amazon EC2) and Pulse (Google App Engine) are able to scale to hundreds of thousands of users quickly by leveraging the massive infrastructure of the PaaS providers. And then there's "Infrastructure as a Service" (IaaS), which can be as simple as your web-hosting provder or hosted phone system and as complex as hosted storage or hosted virtual machines. Amazon and Google enjoy great success by integrating their PaaS and IaaS services into complete top-to-bottom stacks that make deploying your cloud solution very easy.

All of this is very cool and very geeky. But what does it mean for the small business owner, with ten to twenty users answering the phones, sending emails, processing orders and paying suppliers? He has no IT staff; perhaps just a part-timer or a consultant on call. Well, think about this question: how costly is SMB downtime compared with enterprise downtime? Non-productive employees still need to be paid, orders need to be taken and shipped and the bills need to be paid. Cleaning the desks and straightening the file cabinets can only be done for so long before people need to be sent home. The small business owner can ill-afford the added costs and missed sales opportunities resulting from system downtime when cashflow is critical. As they say, you don't get to pick when a crisis will happen, downtime chooses you.

Traditionally we'd aim for a reasonable level of protection and redundancy. A good firewall, malware protection on the users' PCs, backup battery and power protection, mirrored drives in the server and maybe even a spare (sometimes older) server that can be pressed into service in a pinch. Good backups are important - a current image of your server that can be rapidly deployed to different hardware and daily backups of your files. These are the basic ingredients that are needed to get you back up and running in a day.

But what if your Quickbooks database gets corrupted, or your Exchange mailboxes disappear? What if your files are pillaged by persons unknown? What if your users' PCs are part of an Eastern European botnet used to harvest credit-card information from some massive online retailer? These are all problems I've encountered at one time or another. The bottom line is that most IT infrastructure is simple to set up, but requires skill and experience to protect and troubleshoot. A small business owner is not an IT admin, and probably doesn't want to be. As SMB systems become more capable, mobile and complex they require regular care and feeding and greater expertise to maintain.

So what does the cloud offer for SMBs? First, freedom from infrastructure downtime. The IT systems migrate to large datacenters with proper security, adequate power and cooling and exceptional redundancy. Second, freedom from software patches and updates, hardware administration and troubleshooting. Does that mean no admin? Not at all - there are still user accounts to be maintained, status to be monitored and backups to be performed (because you should always have a copy of your own data, right?). Third, mobility. The freedom to get to your applications and data from your smartphone or tablet, from your laptop at Starbucks, or from the PC at home. And finally, often better integration between different services - CRM integrated with accounting data integrated with electronic signatures integrated with project management.

What are the downsides? I mentioned a few last week. First and foremost is cost. Do your homework and compare the four-year cost of a cloud solution to the four-year cost of an on-premise solution (hardware & software acquisition, license and support subscription, system administration, power & cooling, etc). Do the numbers compare favorably, keeping in mind you're removing a huge chunk of downtime risk? Second, increased bandwidth costs. Depending upon the cloud solutions in use and the number of users at your site, you will probably want 2Mbps or better Internet service. That will cost you at least $150/mo for business cable or DSL, or about $250/mo for higher quality data service. Third, does the provider take security seriously? They should give you HTTPS (not merely HTTP) access, the ability to assign and revoke your users' passwords, isolation between their support staff and your data and the ability to control where and when your users can login. Finally, what level of mobility does the provider give you? Smartphone and tablet apps? An HTML5 website? 3G/4G access or just WiFi?

So, have you tried any cloud services lately? What does your solution look like?

UPDATE 2014-Mar-24: ZOHO has requested that I remove the links to their products. You can find them at zoho [dot] com.

Cloud: sexy - Enterprise: not so much

2013-02-15T22:06:00.001-08:00

I read this article several weeks ago. I've pondered it. I've read it over again. Here's a quote:

If you unnaturally extend or generalize cloud solutions to me, or if you pontificate cloud idealisms without providing tangible platforms that can service what I am, then you waste my time. When you waste my time, I discard you.
Please don’t misdiagnose this as me being slow to adopt your solutions.

I've had this discussion with both vendors and internal stakeholders. My approach to cloud services is encapsulated in a few simple questions:

Is the expense budget in better shape than the capital budget?
Over four years, how does the cloud cost compare with the on-premise acquisition, deployment, administration and maintenance costs?
Does the cloud solution increase capability or mobility?
Does the cloud solution integrate well or co-exist with existing platforms and services?
Does the cloud solution reduce the administrative burden?
Is the cloud solution sufficiently secure?

Cloud solutions are wonderful. SaaS, PaaS and IaaS. I've made use of Google Apps & Office 365 (email, productivity and collaboration), ZOHO (productivity), Zendesk (helpdesk), LogMeIn (presence and VPN), Harvest (timekeeping and billing), Box, Crashplan & Dropbox (storage and sync) and many others. They're great approaches that provide simple, robust solutions to frequently thorny problems. But they're not the whole approach to every business need, nor are they always the best approach.

Make no mistake: as a consultant and mobile professional, I depend heavily on cloud services to keep me responsive, productive and in touch wherever I'm working. And as an IT professional I've replaced on-premise systems with cloud services to enhance capabilities without adding cost. But do your homework first.

And if you use the term "ROI" with me, I'm going to pick you up and physically throw you out the door.

;-)

UPDATE 2014-Mar-24: ZOHO has requested that I remove the links to their products. You can find them at zoho [dot] com.

The Simple IT blog has moved!

2013-02-15T21:51:00.002-08:00

Good evening everyone. As part of an overall effort to streamline my professional infrastructure, I've moved this blog to a new home on Blogger. All my previous posts have been relocated; unfortunately your comments were not :-(

Wordpress has been great. It offers a whole lot in terms of features and capability. But that's not why I moved the Simple IT blog.

You can still find the original Wordpress blog at sagejohn.wordpress.com if you're feeling nostalgic. But I'm not sure how long I'll leave it there.

Have a great weekend!

Hello Kitty

2013-02-06T09:37:00.000-08:00

Hello Kitty in space:

7th-grader's science fair project. Successful launch, ascent, descent and recovery. Watch the video here.

Read the story here.

Interlude

2013-02-05T09:35:00.000-08:00

The view from the beach in Condado, San Juan, Puerto Rico. Everyone needs to get away now and then.

Actually we were in PR for our son's wedding. We had a great time, enjoyed meeting new friends and seeing family. We had some wonderful meals too. The ceremony and reception went off without a hitch and the newlyweds jetted off for a honeymoon in Cancun.

But now we're back home. There's work to be done.

:-)

Opportunities

2013-01-15T09:15:00.000-08:00

Here I am, two weeks into the new year. I thought I'd have more time to write, but I've been busier than I thought. So what am I doing with myself? Well, there are always opportunities.

One thing I really miss is consulting. New places, new faces, new problems to solve. I've made some phone calls, met some people, had a few interviews. Can I land a job as a consultant, or shall I strike off on my own as I did almost twenty years ago?

Or perhaps I should focus on landing a job with an organization that could use my particular skills: IT management, ERP, business process improvement, saving money while increasing capability, etc. To that end I sent out my one-hundred-and-third job application this morning. I've had a few interviews, with a few more coming up. Some tentative offers, but nothing concrete yet. Apparently there are more than a few highly-skilled but laid-off IT workers in the pool.

I have to be honest - I feel strange these days. I've never been laid off or fired in my entire career. It's not a comfortable reality. It's hard to put a finger on exactly how I feel; it changes moment to moment. Certainly anxiety is always present, underlying every decision I make and every dollar I spend. Yet so many of my friends and co-workers have been through so much worse, what right do I have to complain?

So I'm trying to make the most of it. Brushing up my skills at Codeacademy and Khan Academy. Working my LinkedIn network. Catching up with old colleagues.

Oh, I almost forgot. I didn't quite manage to harpoon the whale. The last few weeks of my employment were a blur of project handoffs, documentation, last minute work and twelve-hour days. The all-on-one online backup and site-to-site synchronization solution proved as elusive as the famous white whale.

I ended up selecting two different solutions. I picked Crashplan PRO for online backup and got it up and running. It took about ten days to seed 500GB of data to their servers from ours. I also piloted a few laptops with the Crashplan client. Overall the interface is informative and functional and the retention options are outstanding. I liked it so much that I'm running it at home.

Site-to-site sync didn't quite make it in time for my departure. We accomplished an initial seed over a weekend using robocopy. We picked GoodSync as our preferred solution, but my role in that saga ended on December 14th, 2012.

Back to the present. I'm doing some engineering work for a friend who's running his own MSP business, and I'm preparing for a couple of big interviews. But most of all my wife and I are getting ready to go to Puerto Rico next week. Number-one son is getting married and I can't wait to enjoy a change of scenery!

Harpooning the whale

2012-11-27T09:04:00.000-08:00

One data set, two locations - each with an EMC VNXe array. Big giant file sets. How do engineers in the US and Mexico share 3D models quickly and seamlessly? We receive engineering drawings and models from our customers. We comb through the files extracting bill-of-materials information, critical dimensions and other vital attributes. A single product may have dozens of associated files totaling several hundred megabytes. Open the main assembly and a significant number of associated files may also be opened. So how can engineers connected only by VPN work on the same filesets quickly and seamlessly, just as if they were sitting in the same room? That's the first problem.

On to the next problem. I hate to change tapes. Actually since there are so few people in our US world domination headquarters, the question of who will change tapes each day is important. I may not be in the office on any given day. We have a sixteen-tape rotation - eight Friday tapes, eight weekday tapes. We can go back to any Friday in the last eight weeks, or any weekday in the last two weeks. That's the extent of our retention needs. I have a nice chart showing which tape goes in the drive on which day. Pop out last night's tape, put it in your briefcase to take home with you. Pop in today's tape. Bring back from home the tape from two nights ago. There should always be one tape in the drive, one tape in your briefcase, one tape at home and fifteen tapes next to the backup log book.

In my fevered imagination I'm plotting a single grand solution to both problems. Real-time, two-way site-to-site data synchronization along with offsite backup set replication allowing for at least eight weeks of retention and file versioning. This is my white whale, the one problem I am compelled to solve before I leave my post for good.

DFS, Robocopy, Unison, Cobian, Synchronicity. SureSync, GoodSync, Syncrify, XXCopy. Those are the non-EMC synchronization options that seem to be available to us, 'cause the EMC solutions aren't cheap enough for our budget. Asigra, CloudBerry, CrashPlan PROe, Egnyte, EVault, Nasuni and Zetta are some of the enterprise-ready online backup contenders - and a few of them claim to offer server-to-server sync too!

Here's what I want from sync. Real-time, with bandwidth throttling by schedule. Honest-to-goodness two-way synchronization. Data compression. Bit- or block-level, not file-level. VSS or open-file support. A management console. For backup I want the following: Retention and versioning policies, some level of backup sets (not just a single copy of our data), a single vendor (don't make me buy AWS separately!), agents for my target servers and laptops, and a management console too. I figure it costs me about $600/month to run tapes - hardware lifespan of four years, tape lifespan of eighteen months and about an hour of my time a week changing tapes and reading logs. Can I beat that number?

I've conferenced with vendors, I've read the manuals, I've installed several trials and now I've made some choices. But tell me, how would you harpoon this whale?

No longer having to eat our own dogfood

2012-11-20T08:59:00.000-08:00

There is a silver lining to all this. Back in April we decided to switch our US cell carrier from Sprint to AT&T. Sprint's Mexico roaming options were not optimal, so after looking at competing bids we signed up with the Death Star. We also decided to deploy iPads to our US team at the same time, having reviewed several Android tablets during the previous year. That brought up the question of which smartphone to deploy alongside the iPads.

Our operations director brought up a good point. The ability to operate phone and tablet in the same way and to be able to share programs between the two devices would, for most of our users, be a plus. It was hard to argue with that, despite my affinity for Android. So in the spirit of "eating our own dog food" - running the same platform your customers run - I too became an iSheep. To his credit, my sysadmin refused.

Most days I wanted to pitch that phone. Keyboard auto-correct is not the same as the stellar prediction engine in SwiftKey. "Share with" is an absolute joke: just email, sms, twitter, facebook instead of the dozen or so options on Android. No notification profiles for all-at-once settings changes or scheduled changes. No file manager. Can't attach files to an email message from within the message compose window. Tiny 3.5" screen. There were some good points - the radios were superb and the phone was very stable. But overall, it was a disruption to my daily workflow.

So I did what any geek would do. I jail-broke the phone. It didn't really make much difference. Nor did iOS 6. The phone was a thorn in my side.

But, soon to be cut loose from the mothership, I realized I didn't need to suffer in silence any more. I ported my number out from the Death Star and back to Sprint. I have a nice new Galaxy Nexus, and probably real soon a Nexus 7 tablet to be its companion.

To be honest, I do miss AT&T's data speeds. But how I love my Android!

Transitions

2012-11-18T08:51:00.000-08:00

"Hey John, got a minute?"

My mornings are usually busy. Look at my email, review open help tickets and yesterday's closures. Look over the logs and checklists. Swap tapes, take a quick glance over the equipment in the server room. Review my open to-dos. That morning I was getting ready to head down to our maquila facility, so I was cramming a lot of activity into a short window of time. But I like to be helpful, so I got up from my desk and followed the CFO into our president's office.

That's how I got laid off. After worrying about it for four years, I'd finally started to relax. I'd worked hard to trim IT costs while offering more and better services, outsourcing basic utilities, keeping in-house those things which needed tight control over cost and outcome. I'd helped get two more factories up and running. I'd stepped in and worked as controller for four months. I'd executed a headquarters move within an impossibly compressed schedule.

Divorced of emotion, a lay-off is a practical decision. Who needs to be kept, who doesn't. I have a strong staff, our department gets it done. They can probably do it without me looking over their shoulder. So as I sat in the president's office listening him explain the situation to me, I understood. I wasn't angry or fearful. I felt bad, because I know these kinds of conversations are difficult. I wanted to say "please don't worry, I'll be okay."

I walked back to my office and started making a list in my head. Site-to-site two-way sync and online backup, maquila entity setup in our ERP program, status of CRM and QA projects, how I should restructure security. Wait, I need to get a job! So here I am, four weeks later, still struggling to get my arms around an effective transition and find a job.

Actually, I have created a project plan for the transition. One in Asana for my right-hand man. One in Google Docs for our CFO, who needs to know what's going on right now and in what direction we've been heading. And here is where it's hard to be divorced from emotion: pride for what my team and I have created, regret for the things I've never found the time to do, fear over what will happen to it when I walk out the door for the last time.

One thing's for sure. I'll have more time to write this blog :-)

Servers in the closet

2012-08-26T09:50:00.000-07:00

Well, here it is. Our "efficiency" server closet:

Quite a change from our previous, spacious custom-deluxe server room.

It's not quite final in this picture. We've added another switch in the space between the chassis switch and the firewall. Cooling remains problematic. But it took a bit of work to get to this point. For one thing, the previous office tenant had a much smaller IT footprint. Here's what they left behind:

That funky wall rack had to go. It was far too deep, leaving me little room for a full rack. And I don't know whose idea the 3" conduits were - they were being held up by the friction of the cable bundles.

Electrical panels on the left wall require 36" of clear space in front, so the new rack needed to face the door. But we need room to walk behind the rack, and the closet door swings in. I did manage to find a 29" deep open rack; the servers barely squeezed in.

Looking in the ceiling I saw the cables nicely draped over a fire sprinkler pipe. That's a no-no in California. I spent a Sunday in the closet, with the help of my intrepid wife, and we cleaned it up quite a bit. Check out those guns (I do what she says):

And here's how I left it for the electrician and the cable installer:

Unfortunately there's no room for our telephone system, so we popped it into a half-rack at our network provider's colo facility:

US-to-MX-to-Colo-to-US VPN is up and running well. Voice clarity is excellent - both the US and Mexico IP phones sound great. We're running all voice traffic over the VPN, so quality was an up-front concern.

Cooling remains our biggest problem. The building uses a chiller plant and heat pumps. We have a one-and-a-half ton heat pump in the ceiling just for the server closet, but it has nowhere near enough capacity. We're the farthest unit from the chillers, so even a bigger heat pump is not going to help. We've been experimenting, so stay tuned and I'll tell you how we get rid of 11,000 BTU/hour from a small closet.

What happened?

2012-08-04T09:40:00.000-07:00

Lots.

Lots of changes in the last six months, it's been hard to keep up. But as you can see from the pics, our IT lab and server room are no more. 160 dedicated amps of power, 3.5 tons of dedicated air conditioning. Backboards on three walls, four NetShelter racks, cable ladder. Nice windows and extra-wide sliding glass doors. :-(

Don't despair. We've consolidated onto a rack-and-a-half in the US, two racks in México. We found someone to lease our unused US factory space (yes, it's been empty since the first of the year) as well as our office space. We've relocated our world-domination headquarters to a nice space just down the road. One rack there, stuffed full. Half a rack in an accommodating colo facility. And two racks in Tijuana slowly filling up.

Have a great weekend, my friends.

Why you should care about search privacy …

2012-02-07T08:30:00.000-08:00

Or, why everyone knows that you're bankrupt and have herpes. Check this out:

http://donttrack.us/