Tag Archives | PHP

Skype worm: click here if you're foolish…

SANS Internet Storm Center, InfoCON: green reports “Skype 'worm' whinnies…, (Tue, Dec 19th). It appears that the possible Skype “worm” that we reported on yesterday is actually more of a Trojan Horse…”

One more time: an attachment, whether it shows up in email, IM, Skype, floppy disk, USB tab or in the transporter room, is from an untrusted source until you can confirm what it is, where it comes from, why its here and whether you should click on it. There are no trusted sources. “Click here for something really cool” is not an offer you should be taking up!

It's Patch Tuesday, again!

The SANS Internet Storm Center publishes Microsoft Black Tuesday – December 2006 overview — looks pretty grim. Seven patches focused on the OS: Internet Explorer, deeply embedded in the Operating System, and still generating monthly flaws, Outlook Express, Microsoft's bundled email client, Windows Media Player, Microsoft's bundled application as well. Other flaws include crss, SNMP, RIS, and one in Visual Studio 2005. All Windows users should review and patch asap.
So, for 2006, MS released 78 patches for Windows and included software, as well as some not included in this count for Office and other tools. That doesn't stack up too well against previous years. The “Trustworthy Computing” memo is getting long in the tooth, and Microsoft should have enough time to review and audit its software and remove a lot of these flaws. Instead, we see “new” versions of their software like Server 2003 still affected by common components with flaws. Hopefully, with the release of Windows Vista and Office 2007, many of the flaws will finally be plugged. But Microsoft's customers have to be growing tired of this.

LPI discontinues lifetime certifications

“All certification designations earned before Sep. 1, 2004 will no longer be considered “lifetime” designations”

Shades of TiVo! What is it about “lifetime” that the Linux Professional Institute doesn't understand? Ah, they meant the lifetime of the certification, not of the certificate holder. LPI missed the boat on that one.

Over at Linux Watch, Stephen J. Vaughn-Nicholls outlines the changes to the LPI certification program. IT professionals who've been through the ringer with Novell and Microsoft and Cisco and A+ will recognize the tune: the program gallops along at first, realizes that they might be allowing holders of “legacy” knowledge to claim currency, and cut off their own revenue stream. Consequently, they beef up their renewal requirements.

I ran the certification hamster-wheel with Microsoft in the nineties: 16 exams in over 7 years, earning the MCSE designation for NT 4.0 and MCSD for Visual Studio 6. The certifications along with a liberal sprinkling of the logos on business cards, web sites and correspondence certainly helped the marketing efforts of my employers, and I worked hard to maintain the credibility of those programs.

The problem that happens with these kind of designations is that the effort to maintain the certification begins to exceed their value. With four, five or six exams needed to stay current in a single year, you can start to devote more time to studying for recertification than is practical. Staying current for the sake of your clients also means maintaining systems that are four to ten years old. Despite the vendors best wishes, old versions just don't go away, with “Don't fix it if it ain't broke” as a good engineering practice. At Ted Roche & Associates, we continue to support clients with applications that date back to the 80s in a couple of cases. We support clients with FoxPro 6, 7 and 8 applications (a couple of them ported from FoxBASE), PHP4, PHP5, MySQL 3.23, 4.1 and 5.0 applications, and lots of stuff in between. While there's sometimes an opportunity to jump onboard with the latest stuff, it's often the case that a couple of years pass before a new development opportunity comes along that provides the practical hands-on time to master new features and hence qualify to pass the new certification.

Microsoft faced wholesale mutiny when they attempted to discontinue some titles, or force the expiration of some titles like MCSD in favor of a .NET-centric specialty, long before the .NET platform had a reasonably large base in the real world. Certification authorities need to think long and hard about the way to support the lifecycle of their certifications. MS split off new certs, like MCAD, to distinguish the old from the new as they chose the road less traveled into DotNetLand. With Linux, it can be trickier to quantify: are you getting certified on the 2.4 kernel or the 2.6 kernel? XFree86 or X.org? Fedora, Kubuntu or OpenSuSE?

I'm in favor of ongoing continuing education or the equivalent; many professions have CEU requirements. However, certifying agencies have to recognize the balance needed between ongoing certifications and the value of their cert. Lawyers would find other professions if they needed to pass their bar exams every year.

Apple releases 7th major security update of 2006.

Over at InfoWorld, Robert McMillan is reporting that Apple patches AirPort wireless bug. “Apple Computer Inc. has fixed a number of flaws in the software that ships with its personal computers, including a bug in its AirPort wireless drivers that was disclosed earlier this month… Apple's Tuesday update also fixes several issues in products that ship with OS X, including flaws in the ClamAV antivirus software, Perl, PHP (PHP Hypertext Preprocessor) and Samba… In total, 22 patches were released in this update, named 2007-007 by Apple.” Double-oh-seven, eh? Get patching!

Happy Holiday Hardware Hacking

Columbus Day holiday gave me the chance to set up a MythTV back end. It was a good chance to see how complicated it was to set it up (not hard). But sitting around the office to watch TV was no fun. So, the trick was to cobble together another machine to run the front end in the entertainment center in the living room. Thanksgiving Day weekend gave me the time to work on it.

A ThinkPad A31p served as the front-end machine. “Lucky” is over four years old and has fried USB connections, a dead wireless card and a dead backlight — perfect for repurposing. The display was a Samsung 23″ LCD via a VGA connection. A remote control made by Phillips and a USB-based IR receiver was included with the WinTV PCR-150mce thats in the backend digitizing the videos. Like the back end, I followed Jarod Wilson's Fedora Core MythTV HOWTO. only installing mythfrontend rather than the entire mythtv-suite. Installation was a piece of cake.

The gotcha (and the good reason this was saved for a weekend) was configuring the video. The ThinkPad A31p has a built-in ATI Radeon FireGL Mobility 7800 M7 with VGA, S-Video-In and TV-Out. While ATI supplies proprietary drivers, there are several Open Source projects that support many of the features. The trick was working out the combination of them that produced the optimal video. Laura and I watched “Gentlemen Prefer Blondes” last night, it was a bit like a stop-action flick, probably about 10 frames per second. Today's hacking involved learning more than I wanted about xorg.conf, the radeon driver, X, DRI, DRM, Xv

Some other neat links that helped me along: unlike many Open Source (and proprietary!) underdocumented applications, MythTV has a remarkable User Manual

The remote control has good pointers for configuring here
here, and here.

Things still left to do: configuring ACPI to leave the laptop running while closed.

Apple Safari 'safe' files bitten again

SANS Internet Storm Center, InfoCON: green is reporting “Mac OS X Apple UDIF Disk Image Kernel Memory Corruption, (Wed, Nov 22nd). A vulnerability has been reported in the way OS X handles corrupt DMG images…(more)”

Apple did pretty well with their proprietary apps on top of OS X, but one real bozo bit flipped was have the option to open 'safe' files enabled by default in Safari. That ASSuMEs that 'safe' files can't have a flaw that leads to… well, exactly what this exploit does. Remember, never open an untrusted attachment, whether on a web page or an email. And there are no trustworthy attachments. Test, confirm, verify, then install or run. If using Safari, turn off 'safe' files, because they are not.

New MythTV links and news

The GNHLUG-discuss mailing list has been abuzz for the last month with disucssions about MythTV. I've learned a lot I had not yet gleaned from the documentation:

I hadn't realized that it was possible to receive and record HDTV-level broadcasts from the analog cable feed for those “broadcast” channels in the local area.

One GNHLUG member posted his How-To on building a MythTV front-end with no noisy fans or hot hard drives. This little box would work well in the entertainment center.

A link to a great discussion of the Architecture of MythTV.

At the MerriLUG meeting on Thursday, the January topic was announced: we'll be meeting Jarod Wilson, author of the Fedora Core MythTV HowTo. That's a meeting not to miss!

Groklaw: Microsoft Patent Pledge Useless

Groklaw is reporting SFLC's Bradley M. Kuhn's Letter to the FOSS Development Community Regarding Microsoft's Patent Promise. The Software Freedom Law Center's CTO Bradley Kuhn has issued a statement regarding the Novell-Microsoft agreements and how they will impact FOSS developers. They have analyzed in particular Microsoft’s Patent Pledge for Non-CompensatedDevelopers and see little value and in fact say it's worse than useless, because it creates an illusion of safety and because it limits severely what that developer is allowed to do with his work: read more

Novell turns to the dark side

OSNews links to a Register story: Perens: 'Novell Is the New SCO'. “Often cast as the peacemaker in free software disputes, Bruce Perens is on the warpath. When we caught up with him, he wasn't in a mood to be charitable to Novell.”

“Novell is violating the GPL,” he tells us. “It's up to the Free Software Foundation, which owns the copyright, to pursue this. But the FSF owns the C library and the compiler outright. There isn't much Novell can do without either.”

Powered by WordPress. Designed by Woo Themes

This work by Ted Roche is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 United States.