You know, there’ve been several occassions on which I’d have really loved to have left a comment on Hayley’s LiveJournal, but she’s set it so that only people she’s listed as “friends” can post comments to it, and she hasn’t listed anybody as friends!
But hey; now that I’ve mentioned this on my blog, everybody who knows us both will pester her until she fixes it. Winnage.
Checking my GMail account this morning, I noticed an unusual icon in the lower-right corner of the browser window:
It turns out that Google‘s GMail service seems to be testing an ATOM feed – a kind of syndication feed (similar to those used by weblogs and news sites – see Scatmania’s ATOM feed) that can be ‘subscribed’ to from your desktop computer.
Right now, the GMail feed looks pretty bare:
Nonetheless, this is an interesting turn of events – didn’t Google recently say that no other automated mail checking tools were to be used except for their own GMail Notifier (sorry, can’t find a news story to link)? But now it looks like they’re working on developing a format by which anybody can ‘subscribe’ to their own inbox (although probably only using a web browser – the non-browser-based XML readers seem to have difficulty with cookies, which are likely to be required.
It’s all interesting.
A secure password does not make a system secure. No password – in fact, no authentication system – is entirely bulletproof. The key when designing a password-based access system, and choosing passwords, is to balance an equation. You must make the effort required to crack the password more valuable than the data the password protects. This will force the attacker to attempt another approach – there is no value in them continuing to try to break the password.
When laying barbed wire, we do not attempt to completely block access to the defended area (the enemy will just stay put and bring in tanks), unless we want to bring in enemy tanks (to, for example, ensure that they aren’t elsewhere!). We lay out barbed wire in a pattern that requires infantry to take a longer route in order to get in, in order that we can shoot at them more on their way. When laying barbed wire, there is never any doubt that the enemy will penetrate it, given enough effort.
When I tell people that no password is completely secure, and describe all that is above to them, they sometimes don’t believe me, or see the relevance. So here’s another example I came up with this morning:
When people install burglar alarms in their houses, they think they are doing it to prevent burglars. But this doesn’t work, otherwise the number of burglars would be expected to go down as the ratio of houses with burglar alarms has increased. No; a burglar alarm does not prevent burglars – what a burglar alarm does is makes the effort (in this case, the chance of getting caught) not worth the data protected (your TV, VCR, computer, etc.). So the burglar goes elsewhere – perhaps to steal less valuable stuff, but from somewhere that the effort is substantially lower. Burglar alarms don’t stop burglars – they redirect them.
But if the value of the data you’re protecting increases, then the equation disbalances, and it becomes worth the effort. If you start keeping stacks of gold bars in your living room, our burglar will probably risk getting caught to try to nab them. Or they might spend time getting the experience and equipment needed to disarm your alarm first. Or they might watch your daily patterns; see if you sometimes forget to arm the alarm, or maybe they’ll bribe your ex- to share with them the code.
There’s the basics of security engineering. Now, here’s the bit I missed:
Hackers are a very complicated set of people, of all manner of ages, disciplines, experience levels, and motivations. An important factor with many hackers is that, regardless of the possible value of the data, the effort taken to break into the system is irrelevant as a deterrent! Many hackers see more challenging systems as a ‘challenge’, and try to break into these systems just to prove that they can. Imagine your suprise when you find that your house has been broken into and all the gold bars in your living room have been autographed by some greyhat.
Now go change your passwords.
I’ve finished TromaNightAdventure, a WikiGame on RockMonkey. It’s at version 0.9, so far, because there’s still a few things I’d like to do with it (like add a “hints” page, for example!). But nonetheless, if you’re a Troma Night fan, you ought to go play it!
The internet is becoming a scarier and scarier place.
In a recent “honeypot” study, a Windows XP computer with Service Pack 1 was infiltrated in just 200 seconds, without even opening a web browser.
For the less techie-minded, a “honeypot” study involves setting up a new PC with a new operating system (in this case, a Windows XP SP1 machine) and connecting it directly to the internet to see how it is attacked and to what end. In this case, all they did was connect said computer to the internet… and less than four minutes later, it had been compromised by an attacker. Within half an hour, it was receiving instructions to act as a bridge to attack other computers.
Four minutes isn’t long enough to download and install ZoneAlarm. It certainly isn’t long enough to install Service Pack 2. And all across the globe, newbie PC users are buying off-the-shelf computers with no firewall, taking them home, and connecting them to the internet, basically ‘volunteering’ their computers and their bandwidth to be zombies and attack others around the world, relay spam, or share their files with anybody, anywhere.
If anybody needs help securing their system, just give me a shout.
As I’ve mentioned in previous posts, I’ve been getting more than my fair share of blogspam of late. I’ve been spending about twenty minutes every three or so days clearing out the ‘moderation’ queue and updating my keyword lists. Worse still, some spam has been getting through nonetheless (hopefully I’ve always been quick to remove it, and so none of you – my readers – have had to see any of it).
So: I’ve implemented a new anti-blogspam solution: whenever you post a comment to my weblog from now on you’ll be asked a simple question. The answer is usually obvious… to a human… but very difficult to automate a computer to answer. I appreciate any feedback on this (why not leave a comment to this post), and I’ll let you know whether it fixes the problem. And, of course, if it does, I’ll offer my code snippet back to the WordPress development team in order to include it, perhaps, with a future version: or, at least, offer it to friends of mine who use similar blog engines and are troubled by spam.
I need sleep.
In other (almost equally geeky) news, I’ve been spending a good deal of time working on my new RockMonkey WikiGame – TromaNightAdventure. If I can keep up a reasonable development rate on it this weekend (which could be tough – I’ve lots to do, and Gareth is visiting and keeps distracting me with cool technology like GPS devices and VoIP telephones), it’ll be ready on Tuesday evening. Watch this space.
News of the day: (here I go, flooding you all with lots of small posts), I’m now Daniel Huntley BEng(Hons) MBCS, ‘cos I’m now a member of the British Computer Society. Not quite sure whether or not this is a good thing, yet, but hey.
Hmm… they’ll be sending me my membership card seperately from my information pack for “security reasons”? WTF?
Oh, and in other news, BBC News is reporting that Internet Explorer’s usage dropped for the first time to less than 90% in recent polls, with Firefox taking up most of the ‘switchers’. This is good news, indeed (as anybody who’s looked at Abnib in (a) Internet Explorer and (b) Any Standards-Compliant Browser will understand).
Strangest thing I’ve seen all week.
Perhaps it’d help if I’d seen this Uzumaki thing… hmm…
<ROFLMAO>
Want a giggle? Go to Google and type “old dead language” into the search box (with or without the quotes… either way), and hit “I’m Feeling Lucky!”.
This is the follow-up to my experimental googlebomb the other week. I’ve had my fun, now, and I actually believe it’s possible (I was skeptical when I first read about it, but it turns out that Google really is that easy to manipulate) to pull off a googlebomb of this scale with my limited resources.
In other (equally geeky) news, I’m starting to have trouble with blogspam, and my usual keyword/IP/link-count filters aren’t catching it all… might need a reprogram.
Another fantastic Dudley’s Dungeon today. For NetHack fans only.
Heard this today:
“There’s something the Student’s Union don’t want: a silent, invisible, anonymous army of disgruntled students.”
Made me smile.
For $12.99, you can have a model smash your phone and publish the video to the internet for you to enjoy again and again. Fucking weird.
Rediscovered this online – some questions for the heterosexual:
Made me smile.
Sat up last night with Bryn and Claire with a cheap bottle of wine and the remains of an expensive bottle of whiskey and watched The Simpsons (Season 3, DVD 2) and Puppets Who Kill (Season 1, the episodes we hadn’t seen yet).
A nice night in.
I seem to spend most of my time on this blog posting retrospectively about what I did on any given weekend. Will try to spice things up with a little more thought and debateworthy stuff in the future – I’ve got some ideas. In any case:
Friday was Andy’s gig – not as good as the last one I went to, but still a fab show (and, in particular, some great guitarwork this time around). Claire couldn’t come – she was in Gregynog on a Computer Science away-half-weekend (the replacement for what used to be the “second Aberdyfi weekend” that we used to have in the first year).
Saturday was Troma Night. Rory (visiting) and not-gay Gareth (recently discovered to be in Aberystwyth) came along, as did Claire’s friend Ruth, and a good time was had by all.
And, of course, Sunday was Geek Night. We played Hacker for the first time in ages, as well as a little Fluxx. Matt seems to be a huge fan of the latter – perhaps it apppeals to the mathematician inside him.
Oh, and: Yay!