“Complete failure of Oracle security response”

David Litchfield delivers some very strong medicine to Oracle in his open letter, “Complete failure of Oracle security response and utter neglect of their responsibility to their customers“. I wrote about Oracle’s bad attitude a few months ago, and it doesn’t seem to be getting better. His conclusion:

What is apparent is that Oracle has no decent bug discovery/fix/response process; no QA, no understanding of the threats; no proactive program of finding and fixing flaws. Is anyone in control over at Oracle HQ?

A good CSO needs to more than just a mouthpiece. They need to be able to deliver and execute an effective security strategy that actually deals with problems rather than sweeping them under the carpet or waste time by blaming others for their own failings. Oracle’s CSO has had five years to make improvements to the security of their products and their security response but in this time I have seen none. It is my belief that the CSO has categorically failed. Oracle security has stagnated under her leadership and it’s time for change.

I urge Oracle customers to get on the phone, send a email, demand a better security response; demand to see an improvement in quality. It’s important that Oracle get it right. Our national security depends on it; our companies depend on it; and we all, as individuals depend on it.

Comments Off on “Complete failure of Oracle security response”

Filed under Smackdown!

Microsoft Antigen

It’s official– from a Microsoft press release:

Today Microsoft also announced plans to release Microsoft Antigen anti-virus and anti-spam security software for messaging and collaboration servers based on the technology from recently acquired Sybari Software Inc. Adding to the defense-in-depth strategy inherent in Microsoft Antigen, Microsoft will add its own anti-virus scan engine. When it is available, customers of the Microsoft Sybari product line will benefit from the addition of the Microsoft anti-virus scan engine at no additional charge throughout the length of their contracts. In addition, Microsoft Antigen for Exchange recently completed Microsoft’s Security Development Lifecycle review process, which has been shown to achieve measurably improved levels of security for numerous Microsoft software solutions. Microsoft Antigen for Exchange is scheduled to be available in beta to customers in the first half of 2006.

Comments Off on Microsoft Antigen

Filed under General Stuff, Musings

“Understanding Availability and Site Resilience Solutions”

Another cool MS white paper, this one is an overview of site resilience solutions. The paper discusses inter-site replication, stretched clusters, and some other goodies, citing their pros and cons. (It also links to Microsoft’s guidelines for deploying inter-site replication— well worth reading too.)

Comments Off on “Understanding Availability and Site Resilience Solutions”

Filed under Reviews

Exchange VSS best practices paper

Wow, this is great– a new Microsoft white paper on the recommended best practices for using the Volume Shadow Copy Service (VSS) with Exchange 2003. This is long overdue. VSS is a terrific backup mechanism when properly implemented. If you’re at all interested in VSS, check it out. (Hat tip: Ross Smith)

Comments Off on Exchange VSS best practices paper

Filed under General Stuff, Musings

Fade (Mills)

Kyle Mills is usually an unorthodox writer. His books are usually thought-provoking– for example, Smoke Screen posed the question of what might happen if a major tobacco company said “to heck with it” and shut its doors. However, Fade is a straightforward action novel, and IMHO not a particularly good one. The main character is a former Navy SEAL who is forced to retire after being wounded. He’s bitter, understandably enough, because there’s a bullet lodged near his spine that will inevitably paralyze him, and the government refused to help him get surgery while the problem was still fixable. Now the Department of Homeland Security is trying to recruit Fade to come back, and he doesn’t want to. What follows is a pretty stock tale, uplifted by Mills’ gift for witty dialogue. In the second half of the book, the characters suddenly develop; that’s a weird way to put it, but it’s almost like seeing a flat 2-D drawing morph into a fully rendered 3-D representation. That’s not enough to save the book, though. The ending is predictable, and this just isn’t up to Mills’ usual standards.

Comments Off on Fade (Mills)

Filed under Reviews

Mammoth (Varley)

Fun time-travel romp. The best part: Varley doesn’t even try to explain how the time machine works, which saves a lot of tedious handwaving. Instead, we get extended descriptions of how a very focused (not to say monomaniacal) multi-billionaire locates a frozen mammoth that he wants to clone. He ends up with rather more than that, namely a live juvenile mammoth named Fuzzy, plus some adults. That’s where the story really takes off. Were it not for an excess of bad language, this would be a great young adult book. As it is, this is a fun, if light, read even for non-SF fans.

Comments Off on Mammoth (Varley)

Filed under Reviews

After the Rain (Logan)

Sometimes when I read a book that’s part of a series, I get the feeling that I’m dropping into a long-running relationship between the author and his previous readers. For example, I don’t think many people who pick up Reynolds’ Absolution Gap will find that it’s a satisfying read absent the knowledge of what happened in the first two books in that series.
Fortunately, Chuck Logan doesn’t have that problem. In After the Rain, he continues the relationship between his two primary characters from other books. Nina Pryce is a US Army officer and a member of SFOD-Delta (that’s just “Delta” to civilians), and her sometimes-estranged husband, Phil Broker, is an undercover cop. There’s a lot of history between them, or so we understand from their interplay in this book (I haven’t read any of Logan’s earlier books). Pryce is trying to penetrate what appears to be a terrorist plot in– get ready– North Dakota, and when she uses their 7-year-old daughter as an actress, Broker comes to town to pick her up. Of course, Broker ends up involved in the plot, which is reasonably twisty and turny. In the end, the bad guys fail, although not without cost to the good guys.
Logan’s strength in this book is its characterizations. Both Nina and Phil come off as real, multi-dimensional people: parents, lovers, and sheepdogs. Both of them have strengths and flaws in about equal measure, and the tumultuous nature of their relationships makes for some interesting interplay between them. I didn’t think the primary villain was nearly as well-defined, though– he was much more a cardboard bad guy from the psycho-killer bin at Characters-R-Us. The descriptions of the weather and terrain of a North Dakota summer are quite good, too, although not quite on a par with the lyricism of James Lee Burke or the noir of Barry Eisler.
Put it this way: I’ve already reserved Logan’s earlier Nina-and-Phil books from the library. I may or may not read them all, but I’m willing to give them a try.

Comments Off on After the Rain (Logan)

Filed under Reviews

SMT5600 for $0

For some reason, my review of the Audiovox SMT5600 is one of the most popular items on this blog (according both to page views and my referer log). In that vein, Buy.com’s running a sale on the SMT5600: pay $224.99, then get $225 of mail-in rebates; when you activate it, you can also get a Jabra Bluetooth headset for free.

Comments Off on SMT5600 for $0

Filed under General Stuff, Musings

Monad, baby!

I’m at the Microsoft MVP summit in Redmond this week; today and tomorow are the “heavy” days that focus on specific technologies. Yesterday we had some executive keynotes in the morning, followed by some platform technology sessions. I got to see Jensen Harris’ very cool presentation of the new Office “12” user experience (which I think wasidentical to what he showed at the PDC). I also got my first detailed look at the new Monad shell. Jeffrey Snover did the demo; there’s a video of a similar demo here. I was blown away by Monad’s elegance and simplicity; although Jeff didn’t show any Exchange functionality, it’s easy to see how features like the “-whatif” switch (which runs your script and shows that the output would be, but without committing any writes) could be useful. More interesting (at least to me) is how composable Monad is; you really can combine a wide range of cmdlets to take complex actions. I’m looking forward to learning more details about this today.

2 Comments

Filed under General Stuff, Musings

SANS Exchange security webcast presented by Linux admins

I’m not making this up. From this morning’s email, an announcement from SANS of an upcoming Exchange security webcast. Here’s an excerpt from the announcement:

A Microsoft Exchange Server is often found as one of the most important collaborative assets to current organizations of all sizes. With so much dependency on a reliable e-mail and collaboration
system, many organizations are faced with the problem of how to secure those communications. This webcast will introduce listeners to Exchange messaging protocols and discuss strategies to secure those communications. This webcast will focus on Microsoft Exchange Server 2003. Miles Stevenson has spent the last five years working as a Linux network administrator. He worked in both commercial and
government sectors specializing in low-cost Linux solutions. He currently works as a full time network administrator for the SANS Institute and directs the SANS Assessment program.

Now, I don’t mean any personal disrespect to Mr. Stevenson. However, I don’t understand what in his background as a Linux admin qualifies him to talk about securing Exchange. Securing any enterprise messaging system requires a fair bit of specialized knowledge, including a good understanding of the underlying OS. I wouldn’t expect an Exchange administrator to be able to talk knowledgeably about Linux security, for example. I’m curious about what exactly will be covered in the webcast, but I’ll be on a flight when it’s being presented– if you monitor it, leave a comment here and let me know what you thought about it.

4 Comments

Filed under General Stuff, Musings

Experimenting with MediaManager

I’ve been fooling around with the MediaManager plugin for MoveableType. Its goal is to provide a structured system for creating and tracking entries about books, movies, CDs, and the like. For example, here’s what my current media queue looks like:

Picture 2-1

It still has a few bugs; for example, even though I’m using the sample code from the product page in my page template, I only see one book I’m reading and zero that I’ve read. I also can’t post reviews; I get a MySQL insertion error when I try. However, the overall premise is cool, and I think I’ll be happy with the finished product.

Comments Off on Experimenting with MediaManager

Filed under Reviews

Exchange hotfixes for Entourage 2004 SP2

See, I told you the Entourage blog was about to spring back to life. Today’s entry: the details on the Exchange hotfixes suggested (but not required) for using Entourage 2004 SP2 with Exchange 2000 and Exchange Server 2003.

Comments Off on Exchange hotfixes for Entourage 2004 SP2

Filed under General Stuff, Musings

New vulns in Veritas StorageExec

Hot on the heels of the recent BackupExec vulns, the folks at NGS have been busy finding similar buffer overflow vulnerabilities in the StorageExec product. This Windows IT Pro article credits NGS, but NGS’ own web site doesn’t seem to have an alert. Anyway, Symantec has released hotfixes for StorageExec and StorageCentral.

Of course, the real question is whether Symantec is going to institute the same kind of deep-dive security effort that Microsoft did with their Secure Windows Initiative and Trustworthy Computing. Vendors who don’t do that (paging Mr. Ellison! paging Mr. Ellison to the white security phone!) are going to continue to get their pants pulled down by eager, skilled firms like NGS.

Comments Off on New vulns in Veritas StorageExec

Filed under Security

Service Pack 2 for Office 2004 ships

Today Microsoft announced that it was releasing Service Pack 2 (SP2) for the Macintosh version of Microsoft Office. Apart from the usual bug fixes to all of the Office apps, the big news here is that SP2 makes some major– and welcome– changes to Entourage’s Exchange support.

There’s a long list of tasty new Exchange goodness in the SP2 release, including:

  • A new model for calendaring and address books. Previous versions couldn’t support calendar or contact public folders; this release does. In order to enable that support, the dev team changed the way calendar data is stored and managed. Now you’ll have a calendar on your local machine, plus a calendar for each Exchange account, plus any calendar public folders you have. For most Exchange users, this will be a huge improvement. For the small number of users who’d defined multiple Exchange accounts in the same Entourage identity, you’ll notice that now Entourage doesn’t automatically sync events from every calendar to every other calendar.
  • Much, much better sync performance with Exchange accounts. (They also fixed that annoying bug where the Progress window would pop up even when you’d previously closed it.) Public folder browse performance is greatly improved too.
  • Support for setting permissions on Exchange items. That’s right– you can now grant permissions on any folders in your mailbox, just like you can in Outlook. You can also open other users’ shared folders, provided you have permission to do so.
  • You can create private calendar and contact items.
  • There’s much better support for delegation, including the ability to assign other users as delegates.

There are also some less obvious, but perhaps more welcome, changes. For example, Entourage now honors the Thread-Index and Thread-Topic headers that Outlook uses. That means that conversations with Outlook users will be properly threaded. Entourage also includes a new Conversation view type that properly threads mail messages– a feature that’s long overdue (though you could simulate it by creating your own custom view). You can also do a “get info” on any folder to see how much space it’s taking up on the Exchange server– something I use all the time, given the mailbox limits applied to some of my accounts.

SP2 is available for download from Microsoft’s Mac website; as far as I know, it will update either the RTM or SP1 versions of the Office suite, and you’ll need to install it separately on each machine unless you’re using a software distribution system. Microsoft has also promised to make it available through their automatic update mechanism for Mac Office, but it doesn’t seem to have shown up there yet.

Update: Gerod reminded me that you need an Exchange hotfix to enable sharing and delegation to work; I’d forgotten all about that. (Also updated the links to point to live content)

Update: John Welch has tons of screen shots in his article on SP2.

7 Comments

Filed under General Stuff, Musings

My latest royalty e-mail

I just got a mail message from my agent. Here’s what it said:

Hi Paul,
A direct deposit request has just been sent to our bank for you. Your
money should be deposited into the account you have on file with Studio
B within 2 business days.
The amount of the deposit is: $1.11
The payment is for: Digital Think royalties Q1 2005 – Windows NT Server 4.0 in Enterprise

w00t! ‘Scuse me while I run down to the store and buy a candy bar.

3 Comments

Filed under FAIL