snipe

Not sure where this goes, but.... I recently had to write a paper for one of my university classes... I thought this might be of interest to some. (Or not... LOL) Feel free to disagree with me of course! This is likely something that only the technoweenie will even want to look at, but I figured I'd throw it out there for anyone to take a peek at. (Its important to note, for you geeks out there, that the audience for this paper was *not* IT folks) Which is Worse– Microsoft, or Their Viruses? If asked who is to blame for the seemingly endless stream of computer viruses that threaten our Inboxes, many people conjure up images of pale, pimple-faced hackers malevolently hunched over computer terminals, quivering with the anticipation of wreaking havoc on innocent Internet users everywhere. While there are certainly a significant number of computer hackers with some degree of epidermal issues, there is a much larger and vastly more ominous force at work. Unlike the unseen computer hackers that invade our lives, millions of people across the world not only invite this ominous force into their homes and places of business, they actually pay for it. The entity I am referring to is Microsoft Corporation. Windows has silently spread like a cancer, promising businesses across the globe the ability to lower costs with a secure, user-friendly operating system to manage their workstations, servers, and web-applications, while what they actually deliver is an insecure, inferior product that is the very reason why every computer user with an e-mail account has quickly become so familiar with viruses. If asked, most people would guess that viruses have been around for five or ten years, however the evolution of the computer virus actually goes back over fifty years, with the development of the first theories for self-replicating computer programs in 1949 (Computer Virus Timeline, 2004). Although viruses remained purely theoretical until the early 1980s, they have clearly made up for lost time over the last decade, and much of that is due to the introduction of Microsoft Windows. Every year, thousands of computer systems and web servers are brought to their knees by various virus threats. These viruses are specifically written to exploit computers running Windows software, and they do a fine job at it. Windows is always the target because it is human nature to see an easy opportunity and take it. Many of the hackers who write these viruses are teenagers, and many of them would not bother if they didn’t feel that they had a good chance at succeeding. In fact, over the last few years, programs have actually been created to allow hackers who are less sophisticated the ability to create viruses with little or no effort. “Some virus writers do no more than follow the directions in a point-and-click virus-writing toolkit” (Goldsborough, 2003). Microsoft’s blame is two-fold: inferior product coupled with superior marketing. In 1995 – almost a decade ago – the first macro viruses appeared. A macro virus not only replicates itself like other viruses, but it also had an embedded macro which allows it to execute other commands as well. As an example, if a macro virus was written specifically for Microsoft Word, once a Word document became infected, the virus would replicate itself and execute the embedded macro commands to any other Word document opened or created (Kee, 2002). These macro viruses have been around for almost ten years, and yet Microsoft has failed to implement even the most basic changes to their software. For example, the out-of-the-box e-mail clients that are built into Windows software (Outlook and Outlook Express) have for years been heavily criticized for their security issues. The basic problem is that Outlook and Outlook Express contained – and in fact still contain – an inherent flaw in their design which makes them especially susceptible to these types of viruses: they allow HTML, JavaScript, and VB Script to be executed when a user attempts to read the infected email. This problem has gotten much worse over recent years, as the worms have become more sophisticated with their infiltration, scouring address books and even sent and received emails, looking for e-mail addresses to propagate themselves to. One of the easiest ways this situation could be avoided is by simply providing the option for users to choose to read e-mail in text-only, as opposed to HTML/rich-text. This would simply print the malicious code out within the email, rather than actually executing it, effectively rendering it harmless. This would be such a minor adjustment for Microsoft to make, and yet year after year, they do nothing. Unfortunately, Microsoft’s problems do not end there. One issue that Microsoft has never been able to fix is a programming problem called "buffer overflows." A buffer is a part of memory, a temporary storage area where data can be held. When the amount of data sent to a buffer is too big to fit, some of the data overflows into another buffer. A smart hacker can deliberately use a buffer overflow to get malicious instructions into the machine. I'm told that buffer overflows are a common programming error, but Microsoft seems unusually susceptible to them. Issuing a security patch can plug the hole, but the number of such patches issued by Microsoft is appalling. Surely this is one area where Microsoft's security has failed over the years. If a hacker can find these holes, why can't Microsoft get to them first? (Gilster, 2003). As if inferior programming was not quite enough, Microsoft exacerbates their culpability by doing such a wonderful job marketing their product. They unquestionably dominate the market for both home and business computing. Although some might call this good business, I call it gross exploitation of the technologically challenged. Microsoft’s primary selling point is its ease of use, which ironically is exactly what causes the problem in the first place. A large percentage of their market consists of individuals who are not very tech-savvy. Rather than secure the system to have stricter settings turned on by default, their software is set up to be susceptible to malicious code the very moment it’s installed. Considering the gaping security holes that are inherent in the MS-DOS/Microsoft software, this equates to handing a loaded gun to a child. As one Information Technology professional put it, “Windows is like leaving a car in a run down area of town with the doors open and the keys in it and a post-it stuck to the screen saying 'please don't steal me'” (Jake, 2003). Unfortunately, the virus problem that Microsoft perpetuates does not only affect those individuals who have selected Windows as their operating system of choice. Hundreds of thousands of non-Windows web servers suffer every year because of the security issues in Windows software. When a worm infects a Windows-based computer, which will replicate and email itself out to thousands of additional e-mail addresses, it does not discriminate who to send emails to by web server operating system. The end result is that the tremendous increase in e-mail traffic (sometimes as much as several hundred-thousand per hour) may result in a Denial of Servicer attack, also known as a DoS attack. Simply put, a DoS attack is when a computer or network becomes so flooded with traffic that it crashes and can not function. This means that users and systems administrators who have specifically chosen not to partake in the insecurities of the Windows world are forced to bear the burden of Microsoft’s flaws. To be fair, there are other factors that have contributed to the significant increase in computer viruses over the last ten years. The simple fact that so many people with varying levels of computer experience are on-line now is itself a large contributor to the virus problem, but perhaps viruses would not be as prevalent if the average user was not working with software that left them so exposed to virus threats. In looking at the way Microsoft has handled itself over the past ten years, one might suggest that Microsoft itself behaves much like a virus- although an anonymous IT professional was quoted as saying “Windows isn’t a virus. A virus actually does something.” References (2003, November 10) Computer viruses now 20 years old. BBC News World Edition. Retrieved February 7, 2004 from http://news.bbc.co.uk/2/hi/technology/3257165.stm Computer Virus Timeline. Infoplease.com. Retrieved February 4, 2004 from http://www.infoplease.com/ipa/A0872842.html Forno, Richard (2002, June 24). MS to Micro-Manage Your Computer. The Register. Retrieved February 6, 2004 from http://www.theregister.co.uk/content/4/25843.html Gilster, Paul. (2003, October 15). Hackers enter via Windows. The News & Observer. Retrieved February 1, 2004 from http://www.newsobserver.com/gilster/story/...p-2706278c.html Jake. (2003, November 5). It is Microsoft’s Fault. The Mac Observer. Retrieved February 3, 2003 from http://www.macobserver.com/comments/commen....shtml?id=36338 Kee, Rich. (2002, November 16). Evolution of the Computer Virus. SANS Institute. Goldsborough, Reid. (2003, November). Arming Yourself in the Virus War. Consumers' Research Magazine, 86 (11), 31. Sha Sha Chu et al. (n.d.) The Social Impact of Viruses. Virus: A Retrospective. Retrieved February 7, 2004 from http://cse.stanford.edu/class/cs201/projec...ses/social.html

Haha - that'll be the day! For folks like me who run a server for clients, the very best thing you can do is being proactive. Tell them in advance that they might get an email like that and explain that it is NOT valid and urge them not to open the email. It also certainly helps if you have an open door relationship with your clients. I explained to mine that 1) No one should ever get an email from "staff@" - because that address does not exist... 2) email accounts are not arbitrarily cancelled. No one's email account would ever be disabled without darned good reason, and not without every effort being made to contact the user for them to rectify whatever the issue might be.... and 3) ANY such announcement would NEVER be explained by way of an attachment. Period. My clients are not exactly the most tech-savvy, but by contacting them bnefore they needed to contact me, its saved everyone (mainly me, really) a lot of headaches. No panicked phonecalls, no need to doing virus removals on entire office networks. I also explained tha if they EVER get an email that appears to be from my me or my staff that they have even the teenie weeniest bit of doubt about - they should not open it and call us immediately. It sucks that we have to jump through these hoops, but the only defense we really have (other than making sure you update your virus definitions - or choosing not to run windows) is to keep everyone affected "in the know". Plus your clients will feel more confident in the fact that you are looking out for them even *before* there are problems, which is always nice.

kaseytraeger - did you manage to get through it? What are your thoughts?

webgryl, Flashkit also has some great stuff. In addition to the tutorials, there are tons of sample files, sound loops, and other gew-gaws that can help you learn if you're one of those trial-by-fire learners. Some people learn better by reading, others learn better by deconstructing existing stuff. Either way, FlashKit is a great place to start. In addition, here are some more good places to look: http://www.w3schools.com/flash/default.asp http://www.kirupa.com/ http://www.flashguru.co.uk/tutorials.php http://www.spoono.com/flash/tutorials/ (I'm a big supporter of finding it for free online before throwing out the big dough on a book - but shhh! don't tell my publishers that! LOL)

On windows, I use BulletProof FTP, for mac I use Fetch, and for linux I use ncftp - although I actually prrefer SCP over ftp any day.

The ODP is also known as DMOZ, an acronym for Directory Mozilla. This name reflects its loose association with Netscape's Mozilla project, an Open Source browser initiative. The ODP was developed in the spirit of Open Source, where development and maintenance are done by net-citizens, and results are made freely available for all net-citizens. http://dmoz.org/help/geninfo.html#mean (At least thats how they tell it - and it *did* used to be that way... but its gone downhill)

Well thats sure good to know. I have sent in 12 requests to have a client's site moved to the correct category, and have never heard back from them. This is going on a year now. The client needed to be moved from "Clothing" to "Skin care" - kind of a big difference! I'm not shocked that they're losing their oomph. They have been difficult to deal with for quite some time now - at least a year or so. Unresponsive, without even an acknowlegement that they got your request. Which, imho, is FINE - as long as other BIG sites aren't using your information. Maybe its just me, but I think that when you have commited yourself to being the backbone of large search engines/directories, you are thereby obligated to keep up with things in a timely manner.

I figured I'd post the closest thing to an answer that I could work out, since no one else seemed to know, and it may come up again. Despite the fact that I had disabled eximstats in the WHM "Tweak settings" area, it continued to send me an email every 5 minutes telling me that eximstats failed. I wasn't losing any sleep over the fact that eximstats wasn't working, but the emails were driving me crazy. Upon looking at the error log, the reason for its failure is because the mysql database for eximstats was never created. The SQL code is located (at least on my server) at /usr/local/cpanel/etc/eximstats.sql. (Typing "locate eximstats" from the command line will tell you where your eximstats stuff is) That .sql file contains the mysql code needed to manually create the eximstats database. After I did that, nomore emails, and eximstats is working. Now... I just need to figure out why I can't turn it off...

Hiya all, I just wanted to mention that we recently gave TCH a blatantly shameless plug on our non-profit org homepage, in a meager attempt to try and express our gratitude for the incredible support you guys have shown us. Its still up at http://www.pet-abuse.com I feel this is worth mentioning because as a policy, we do not plug other companies goods or services. As a relatively well-known non-profit, we must always maintain our impartiality to just about everything that does not have directly to do with our mission statement and goals - after all, it ultimately comes down to our reputation being on the line. This is a well-deserved exception. Not *once* did we feel like *our* crisis wasn't as important as someone else's, and I have thoroughly enjoyed every experience I have had with every member of the TCH staff that I have had occasion to deal with. When I first signed up, I admit I was a little nervous since there is no normal telephone support - but that was because I had temporarily forgotten the nightmares I have gone through on the phone with other hosting companies. Not only were that compeletely useless, but I had to sit on hold for 20 minutes to talk to someone who treated me like an idiot - and all on my dime! The support TCH provides is second to none, and I have dealt with many hosting companies, of all sizes and reputations. Imagine that - a hosting company who is affordable *and* treats you like they value your business and loyalty. Now I've seen it all! Thanks guys - its so nice to know that I have people I can count on. Rock Sign Rock Sign Rock Sign Rock Sign Rock Sign Rock Sign Rock Sign

Every few minutes or so, I get an email: Subject: eximstats on 614822.servernode.net failed eximstats failed @ Sun Mar 28 03:50:14 2004. A restart was attempted automagicly. I have eximstats unchecked in the WHM tweaks - why is this still happening? I can see its barfing because the eximstats database does not exist (tho I'm not sure why). How do I either 1) quickly fix eximstats OR quickly disable it altogether? Thanks!

justbishop - can you give a url to the site you're talking about?

You are my HERO! Thanks! Sorry for the n00b questions - I have never used WHM before this server, so there's still quite a bit I'm figuring out with regard to the quirks.

Well yes - I did that (tho it seems strange tha WHM wouldn't do that automatically) - but still the same thing. I'm puzzled.

Howdy gang, I am in the slow and painful process of restoring the dedicated server accounts one by one, and I see something funny happening. When I restore an account (using "Restore a Full Backup/cpmove file"), the domain name resolves OK, but it throws a Forbidden error, even when a specific file is requested. I'll give you an example - http://www.caring4wildlife.com/ The DirectoryIndex is set properly in the apache conf, and the files and dirs are there - so its a bit of a mystery. (The files are all there....)

I use that one as well

The dos style 8.3 format is more or less a leftover from the days before windows could handle longer names - and it honestly just helps keep some "creative" programmers in line. (I have gotten everything from "form posting page number one.php" to "excopy_send_me_now_resend.php") Not that longer filenames are going to cause a problem, but they are just usually not necessary, assuming that your directory structure is set up in a reasonable fashion. Remember that this document was created for my programmers, so some bits of it may be more strict that is "generally accepted" - because that the way I am. As far as the title tags for hyperlinks, as far as I have found, the W3C still accepts "title" as an accessibility-friendly tag, and Bobby still validates them as such. "Clearly identify the target of each link. [Priority 2] Link text should be meaningful enough to make sense when read out of context -- either on its own or as part of a sequence of links. Link text should also be terse. For example, in HTML, write "Information about version 4.3" instead of "click here". In addition to clear link text, content developers may further clarify the target of a link with an informative link title (e.g., in HTML, the "title" attribute). " (from http://www.w3.org/TR/WCAG10/ ) Either way, I'm not hung up so much on validation and standards as I am on pratical use. I have several friends of mine who are legally blind, so I have the advantage of being able to apply this stuff to a real situation and see how it flies.

I have checked a bunch of software sites out (including softwarefolder and hotscripts) - nothing seems to be right on the money. :-/

I realize that this isn't really a tutorial, and this isn't something I usually share with the rest of the world, as it was designed to help my programmers (and contractors) better understand the standards I require when people do work for me. However, I have shown it to several people who have found it extremely help with their own programming, design and marketing - and some have started using it as their own style manual for when they deal with contractors and new programmers. Some parts of this may not be of interest to individual programmers, but I figured I'd offer the whole thing up in case anyone is interested. Love it or hate it, here it is. I hope it helps a few people out. style_manual.pdf

Hidee ho I have an online community that I would like to be able to offer @domain.org email addresses for members. (Actually, I currently do, but its a pain in the butt to do it manually with almost 3000 members.) I was wondering if there is a *decent* script out there that does that sort of thing. I have already looked into everyone.net's email services (and I use them for a different site) - but this community site is a 0-revenue model for me, so I would prefer to have something set up on my server, rather than have to pay $10/month or what have you. Anyone have anything that they have used that works?

Hah, maybe for you... sleeping babies just make me grateful that they're sleeping instead of crying or drooling or pooping. *does not have children*

I don't know if this has been posted before or not, but whenever it comes to finding out info about a domain name or an IP, I always use SamSpade - http://www.samspade.org

This is an article I wrote a while ago, but that still holds true. Just thought you guys might like it. http://www.snipe.net/geek/articles/article.php?CatID=5&ID=69

Actually it can, assuming you have those features enabled on the server. fopen() can open local files *or* urls - http://us2.php.net/manual/en/function.fopen.php and PHP has a bunch of ftp functions built in as well: http://us2.php.net/manual/en/ref.ftp.php

Are you referring to telnet vs SSH?

I would *definately* open a trouble ticket - but also remember that when it comes to transferring domain names from one registrar to another, the one you're leaving usually takes their sweet time. They're losing you as a customer after all. Certainly its wise to submit a ticket and have TCH check up on it, but just realize that depending on your old registrar, sometimes it *does* take up to 10 days.