Dan Gillmor reports that Clear Channel’s sponsorship of pro-liberation rallies is raising eyebrows. Of course, it depends on your reading of the idea of sponsorship; the source article doesn’t explain how Clear Channel is involved, other than by allowing their on-air talent [sic] to mention and promote the rallies. By that same logic, I could bust CNN’s Aaron Brown for “sponsoring” the antiwar rallies last night in Chicago and San Francisco, since he spent quite a bit of time discussing them. So, inquiring minds want to know: did Clear Channel actually pay the tab for any of these rallies? And who’s paying for the organization and logistics involved with the antiwar rallies? All those port-a-johns, podiums, and speaker systems aren’t free.
No errata yet…
I don’t have any errata yet, but instead of maintaining a separate static page, I’ve decided to create a new category for errata. What prompted this? I got mail from the guy at Microsoft Press who heads the support team for their security books, asking me if I’d answer reader email. “Shell, yes”, I told him; the new category is preparation.
Comments Off on No errata yet…
Filed under FAIL
Choices, choices
This Wired story poses the question: if your cat needed a $9,000 kidney transplant, would you pay for it? What if it meant that you couldn’t pay your mortgage? All this for an 11-year-old cat. I don’t know whether to be touched by the loyalty or angered by the stupidity. If she just wanted to throw away nine grand, she could have donated it to a worthy cause– I mean, that’s a ton of money for pet medical care. I can imagine how this would play out at our house:
Me: Honey, the cat needs a kidney transplant or it’s going to die.
Wife: How much will that cost?
Me: About nine months’ worth of mortgage payments.
Wife: WHAT?!
David: Well, living in a cardboard box might not be so bad.
Thomas: Two rights don’t make a wrong. (Ed note: he says this at random intervals)
Wife: That’s as much as it’ll cost to replace the roof!
Me: Boys, living in a box means no more TiVo.
Chorus: Goodbye, cat; been nice knowing you.
Comments Off on Choices, choices
Filed under Musings
Get aggregated
If you read more than one or two blogs, and you’re not using an aggregator, you’re missing out. See, most of the software used to publish weblogs is designed to support RSS, a protocol that allows syndication. (For those just joining us: syndication is republishing someone else’s content, as when your crappy local paper publishes someone else’s weather data.) Anyway, the advantage of aggregators is that they gather up all the weblogs you’re interested in and put them in a single interface, so you can skim through them quickly. Mainstream news sources (including the NYT, Christian Science Monitor, and others) have syndicated feeds, too. I currently have about 50 blogs in my subscription list.
On the Mac, I use NetNewsWire. On the PC, I’ve heard good things about Syndirella and NewzCrawler, though I haven’t tried either of them.
Now, word up to DefenseTech, Bob Thompson, The Bloviator, and JohnP: your blogging software doesn’t support RSS. Please upgrade. That is all. (I was going to add Charlie Stross to the list, but even though there’s no link for it, pasting his URL into NetNewsWire does the trick.)
Personal to Julie: add the “syndicate” div to your template, OK? I had to find the URL by hand.
Comments Off on Get aggregated
Filed under General Tech Stuff
Is this thing on?
Jeremy seems to have broken TrackBacks somehow. This post is solely to add a TrackBack to see whether it works. Move along; nothing to see here.
Comments Off on Is this thing on?
Filed under Friends & Family
Don’t go near the water
Dori shares a sad tale of swimwear that’s not meant for swimming:
I called the company up today to complain and was told that (wait for it) their suits are not appropriate for wearing into pools or hot tubs, as that may cause colors to run or fade.
That’s pretty cool– sort of like those fake fruit bowls at my doctor’s office.
Comments Off on Don’t go near the water
Filed under Musings
Buffer overflow in IIS WebDAV: Patch it now!
Microsoft has MS03-007 out. The bulletin describes a buffer overflow vulnerability in the WebDAV component of IIS 5.0 on W2K; Windows 2003 and Windows XP aren’t affected. The practical effect of this vuln is that an attacker can run code of her choice on your server (at which point it’s not really your server anymore.) The worst part is that an exploit for this problem is already circulating.
There are several ways to avoid this problem:
- If you were already running URLScan, you’re in good shape. Its whole purpose is to block malformed or bogus requests before IIS ever gets them. If you’re not running URLScan, well, why not?
- Go to the download page and download the patch. It’s a self-installing executable; after installing it, stop and restart the W3SVC service. You don’t need to reboot.
- Go to
Windows Update and scan for the patch. The Windows Update installer may prompt you for a reboot. - Use the Automatic Updates client to download and install the patch. Unfortunately, this route will prompt you for a reboot, although you can sneak by by killing its process and bouncing the W3SVC service.
- Disable or remove IIS. Obviously you can’t do this for your Exchange servers, but other servers may not need IIS. See KB article 321141 for details.
- Disable WebDAV only. This is easy to do.
- Download the URL Buffer Size Registry tool and use it to set the MaxClientRequestBuffer value. Microsoft recommends setting MaxClientRequestBuffer to 16K, but in the same sentence they warn that doing so may break “some programs.” In my testing, a setting of 16K didn’t seem to interfere with OWA or Exchange, but your environment may have a different mix of requests. I’ve asked MS for a definitive statement on this; in the meantime, you can either use a larger value or use URLScan, which has templates for OWA. (Side note: of course, by reading KB article 816930 you could make this change yourself, but the tool can scan multiple machines to find those that haven’t had this limit applied).
- If you choose to apply MaxClientBufferSize, you should probably also use a group policy setting to apply the registry key and you’re in business.
What about long-term solutions? Well, you should definitely be using IIS Lockdown on all your Windows 2000 servers. If you combine that tool with reasonable attention to patches, you will be in relatively good shape. You should aggressively follow up with MBSA scans to check for correct patch installation. In almost all cases, your life will be easier if you deploy the Software Update Service (SUS) to pull patches and stage them for mass installation. When I get a free minute, I’ll be writing an article here describing exactly how to use SUS.
In the meantime, if you read and follow the recommendations in chapters 6 and 14 of the book, you can relax.
Comments Off on Buffer overflow in IIS WebDAV: Patch it now!
Filed under Security
Too bad most of my friends are married
I wonder how long it’ll take for eBay to remove this Instant Girlfriend kit from auction.
Comments Off on Too bad most of my friends are married
Filed under Uncategorized
Kung-Tunes
So, I finally found out how to make my blog reflect what I’m listening to: Kung-Tunes is a small background application that asks iTunes what’s playing, formats the result using a template I specify, and uploads it using scp. Worthless, but nifty.
Comments Off on Kung-Tunes
Filed under General Tech Stuff
Get Smart
So, as everyone within range of a television knows, Elizabeth Smart was found and returned safely to her family. Now the Salt Lake Police Department has some explaining to do (they seem to be better than Boulder but nowhere near the NYPD). But that’s not what I wanted to talk about; instead, what’s with all this “it’s a miracle” talk?
Don’t get me wrong. I know full well that God answers our prayers; I have a firm testimony of that. What I see missing from most accounts is the connection between her safe return and the fact that Elizabeth’s family never gave up. They continued to work to get the word out, and they were aggressive in prodding the slow-moving SLPD to get with the program when their younger daughter identified the handyman as the perp. Their hard work helped implement the miracle. It’s tempting to dismiss this as another case of “God helps those who helps themselves,” but I prefer to think of it in another way. My friend James Harris often advised people in difficult situations thusly:
Get down on your knees and pray as though everything depended on the Lord. Then get up and work at it as if everything depended on you alone.
Comments Off on Get Smart
Filed under Spiritual Nourishment
TechNet chat: Using ISA Server to Securely Publish Exchange Server
TechNet is sponsoring yet another Exchange security chat, this one with folks from the ISA Server product team. April 9, from 1200-1300 EST / 0900-1000 PST / 1600-1700 GMT.
Comments Off on TechNet chat: Using ISA Server to Securely Publish Exchange Server
Filed under General Stuff, Musings
New post-SP3 rollup for Exchange 2000
Technically, this isn’t a security alert, but Microsoft has released the first post-SP3 rollup fix for Exchange 2000. KB article 813840 links to the list of fixes.
There’s a companion set of fixes for the Active Directory Connector. KB article 815452 contains its list of fixes.
UPDATE: Microsoft has pulled the downloadable update, citing mismatches between the rollup binaries and the associated symbol files. They haven’t yet provided an ETA for restoring the download, although the KB articles are still there.
Comments Off on New post-SP3 rollup for Exchange 2000
Filed under Security
One more reason to love truck stops
So, while I was in Seattle, McDonald’s announced that it’s going to start offering wireless access in its stores. This is interesting insofar as it shows how WiFi is spreading beyond traditional geek havens. However, last night while driving home from the airport, I stopped for gas. Turns out that T/A Travel Centers, a large network of truck stops, is adding WiFi access too. (They’re still rolling it out, and I have a call in to their project leader to get more details). I already favor the Monroe T/A because it has the nearest Popeye’s, so this is an extra bonus.
This provides terrific proof that the market for widespread WiFi is still growing rapidly. I love the idea that I can combine fueling and emailing, even though I can get email on a handheld. Of course, I could go off on a lengthy digression about how stupid it is that most major airports (which, as you may have noticed, are often filled with impatient laptop-toting connectivity junkies) don’t have WiFi but that truck stops and fast-food restaurants do, but I’ll spare you.
Now, to teach my 8-year-old how to pump gas so I can stay inside and use the laptop…
Comments Off on One more reason to love truck stops
Filed under General Tech Stuff
Free SQL security chapter
Just in from NTbugtraq: Erik Birkholz is giving away the SQL Server chapter from his new book, SPECIAL OPS: Host and Network Security for Microsoft, UNIX, and Oracle. I have no idea if the chapter is good or not; I do know that the book’s Exchange chapter was written by Jim McBee, who knows how many beans make five. You can get it directly, or check out the book’s cool web site (much cooler than this one, I must admit.)
Comments Off on Free SQL security chapter
Filed under General Stuff
It’s what’s for dinner
I decided to try Daypop, and what to my wondering eyes did appear but a link to “International Eat an Animal for PETA Day”. I don’t agree with PETA’s central premise, but I’m more than happy to let them express their opinion. However, I find it deeply offensive that they terrorize people (yes, arson counts) who disagree with them, all the more so that they’re now using the Holocaust as a metaphor for meat consumption. Comparing the Holocaust to large-scale chicken or beef farming– thus equating Chicken Little to a man, woman, or child– is way over the line in my book. Accordingly, I’m going to write them a nastygram and tuck in to a big old plate of some kind of critter.
Comments Off on It’s what’s for dinner
Filed under Musings
Paul's Down-Home Page 