|
NETSURFER DIGEST
More Signal, Less Noise |
Volume 07, Issue 24 Wednesday, August 01, 2001 |
NETSURFER LINKS
|
|
BREAKING SURF Study on the Spread of the Code Red Worm At press time, numerous security organizations were warning about the resurgence of the Code Red worm. The worm infects Windows NT and 2000 systems that run unpatched versions of Microsoft's Internet Information Server. Researchers report that Code Red infected more than 359,000 computers within 14 hours on July 19. Their fairly technical analysis includes neat animations that show how the worm infection spread geographically. The research paper states "the global Internet community dodged a bullet" because this particular worm was not particularly destructive and was easily countered. A Wired article looks at the Code Red publicity frenzy and notes that at least one virus expert, the reliable Rob Rosenberger, says that mass e-mail warnings about the worm are more likely to gum up the works than the worm itself. CERT has worm details and links to patches.Study: http://www.caida.org/analysis/security/code-red/ Wired: http://www.wired.com/news/technology/0,1282,45681,00.html Rob: http://www.vmyths.com/rant.cfm?id=3D353&page=3D4 CERT: http://www.cert.org/advisories/CA-2001-23.html
Activities Which Bring You Spam Like most good things in life, the Internet comes with its share of troubles and afflictions, of which spam certainly ranks among the most annoying. But just how do you get on spammers' lists, how do you get off, and how can you stay spam-free? CNet provides many of the answers in true investigative journalism style. Matt Lake opened 12 free e-mail accounts and used each to conduct a single, different online function. What he found is interesting and useful. Reassuringly, online shopping, subscribing to e-mail newsletters, and registering a product or software online are relatively safe activities unlikely to attract much, if any, spam. Engaging in chat sessions or participating in online lotteries, on the other hand, expose you to a high risk of generating spam. Posting anything on Usenet is by far the top spam-bait activity. No one likes mailboxes clogged with unwanted and often distasteful messages, and here's a must-read for anyone who wants to get and stay spam free, with interesting side excursions into a host of related material.http://www.cnet.com/software/0-3227888-8-6602372-1.html Can You Track a Thief through a Virus? Can you track down a computer - and thus the whereabouts of the person who stole it - through its infectiousness? A man whose house was robbed wants to know, because among other items, the thief stole the man's computer, not to mention his beer, and managed to infect it with the Sircam virus. Now the man's friends are getting infected e-mail messages. Surely, there must be a way to zero in on the infected computer by tracking server paths. Once located, the computer can be retrieved by the police, or maybe by one's six-foot-four, 260-pound pal, Radek. Bright ideas welcome at Slashdot.http://slashdot.org/askslashdot/01/07/25/1510213.shtml Personal Information Loose on the Web Someone has been stealing vital personal information and posting it to chat rooms. According to MSNBC, a common link in many but not all of these cases is online purchase of a cell phone from Verizon Wireless or an AT&T Wireless reseller. The posted information includes driving license and Social Security numbers, birth date, credit card information, and sometimes a victim's employer and job title. No one knows how much information has been misused this way, but one source showed 50 such files to MSNBC. More serious than spam, this exploit exposes victims to the festering threat of potential identity theft. Verizon has tried to spin and says it is investigating, but we can't help wondering if this isn't just another example of the serious failure to provide even basic security measures which we've told you about in NSD so many times before.http://www.msnbc.com/news/604496.asp?cp1=3D1 Honeynet Statistics on Blackhat Hacker Activity The Honeynet project has been collecting hacking activity statistics for several years now. It operates a small network of several machines with several operating systems on a simple ISDN connection. It doesn't actively advertise the IP addresses of the network. Even so, Honeynet is the target of numerous hacking attempts, attempts which are increasing in number. This paper presents Honeynet's historical hacking activity over the last 11 months. It concludes, for example, that a newly installed typical Red Hat 6.2 server on the Net will go only 72 hours before being probed and attacked. Windows systems lasted only about 24 hours before attracting attacks. Not surprisingly, the amount of hacking activity has been increasing. The paper also shows how tracking network probing activity can give several days' warning of impending hacking attempts.http://project.honeynet.org/papers/stats/ The music business continues its war against customers. Now, it's trying to pressure ISPs to pull the plug on users who swap copyrighted material through file-sharing systems such as iMesh and Gnutella. Often, independent piracy hunters such as MediaForce and Copyright.Net sniff out file trading for a fee and advise ISPs of the presence and identities of outlaws using their services. Some ISPs, such as Verizon, are refusing to cooperate, but many - including Adelphia, DirectTV Broadband, and Excite-at-Home - seem to be knuckling under, warning clients that they will suspend service if file trading continues. Some users are fighting back, however, responding to warnings or suspension of service by taking their business elsewhere. Once again, we see more diligence, more energy, and more effort spent on offensive defensive measures by the music industry than in finding customer-friendly solutions, but sadly that's what we've come to expect. http://news.cnet.com/news/0-1004-200-6674297.html Compulsory Licensing of Content? This legal think piece by FindLaw's Anupam Chander seeks to tie together the Napster legal decisions, the recent win by writers who sought additional royalties from the New York Times for content posted online, and some innovative thinking about making content available for posterity. Chander postulates a possible legal concept of eminent domain for the written word, whereby content would become public under certain circumstances despite the wishes of the authors. It is a provocative idea, but perhaps not entirely without grounding in US law. It's an article worth reading for those interested in intellectual property issues.http://writ.news.findlaw.com/commentary/20010730_chander.html New Contextual Advertising Technology SF Gate has an article about yet another method of online advertising. A company called EZula is touting a technology called TOPtext that highlights words on a Web page and creates links to advertisers' sites. After you install the program on your PC - sometimes unknowingly - pages in your Web browser have certain words highlighted in yellow. Click on those words and you're taken to an advertiser's Web site. This is not unlike a technology called Smart Tags that Microsoft yanked from their XP operating system after complaints that Web sites don't want their pages defaced with third-party links. The software that installs TOPtext can come bundled with shareware or other programs such as the KaZaa file sharing program, as described in the SF Gate article. EZula says that it is making money with this type of advertising, but the technology is not likely to be popular with either webmasters or netsurfers.SF Gate: http://www.sfgate.com/cgi-bin/article.cgi?f=3D/c/a/2001/07/30/BU231339.DTL EZula: http://www.ezula.com/ The Open Source Debate: Microsoft vs. Red Hat RedHat CTO Michael Tiemann took on Microsoft VP Craig Mundie in a debate about open source vs. shared source at the 2001 O'Reilly Open Source Convention. The video of this debate is available online. If you don't want to watch the whole thing, Wide Open News (WON, which is wholly owned and operated by RedHat) has a good summary of the issues and the remarks. Overall, the debate further contributes to the Open Source debate, and in particular casts light on just where Microsoft is going with its code. Craig Mundie also wrote a post-debate letter about Microsoft's view on open source and GPL licensing.Video: http://technetcast.ddj.com/tnc_catalog.html?item_id=3D1267 WON: http://news.wideopen.com/fc/2-118,209-119,640016 Letter: http://use.perl.org/article.pl?sid=3D01/07/26/2341206&mode=3Dthread&threshol=d=3D The conundrum of copyright in the Internet age continues to provoke bright ideas about how to provide alternative financial incentive for new intellectual output. Here's a detailed and creative concept by Chris Rasch, published by First Monday. In Chris's scheme, someone who wants to fund the creation of open-source software would create a software completion bond and deposit the funds in an escrow account, where it would collect interest. Meanwhile, fueled with this promise to pay, a software developer would borrow funds from a bank and set to work. Independent judges would release the funds in escrow when they determine that the software met the initially defined specs. Chris thrashes out all the details with interesting philosophic side excursions into the whole business of funding public goods. The two main snags are that the scheme assumes a ready market in which developers and potential customers can connect, and that the customers are forced to pay up before development starts. We're skeptical that anything like this will really fly, but we've been wrong before. http://www.firstmonday.dk/issues/issue6_6/rasch/index.html What would be the last organization on the planet you would think would set up a Web site encouraging you to eat whales? How about the People for the Ethical Treatment of Animals (PETA), the militant animal rights organization? Yet here it is, launching the Eat the Whales site. The premise of the site is that one whale contains the meat equivalent of 1,200 pigs, and that eating the whale would spare the pigs - or other magical animals - a miserable life and a mean death. It's satire of course, and pretty humorous for an organization not generally known for its sense of humor. The Eat The Whales campaign is being coordinated by PETA's vegan wing. As noted in the press blurb: "Some people who will blubber about harpooning whales don't hesitate to snag buckets of chicken wings. We're all in favor of saving whales, but every nonvegetarian is responsible for far more suffering and deaths than any Japanese or Norwegian whaler." PETA: http://www.peta.org/news/0701/0701eatthe.html Eat the Whales: http://www.eatthewhales.com/ New "Doctor Who" Audio Adventure It's called "Death Comes to Time" and it's the first Doctor Who adventure since the series was cancelled. The audio requires RealPlayer and is available as a sound-only version or as an "enhanced" version that includes some low-grade animation. While you're listening, check out the official Doctor Who site, which includes interviews with the actors, plenty of information about the characters and the series, and even a chance to vote on whether the series should return to the small screen. At last count, 24,036 visitors voted for a reprise while 237 inexplicably voted against.http://www.bbc.co.uk/cult/doctorwho/ New RSA Crypto Factoring Challenge To encourage "research into computational number theory and the practical difficulty of factoring large integers", RSA is offering a prize to the first person to factor a couple of large numbers. If you factor a 576-bit number, you could win $10,000; for the big one of 2048 bits, you could be $200,000 richer.http://www.rsa.com/rsalabs/challenges/factoring/index.html Security Hole in Lycos's Handling of Embedded HTML There appears to be a security hole in how Lycos, and perhaps other search engines, handles HTML in returning search results. Web sites which format their HTML with codes for the < and > characters in just the right way can execute JavaScript on the user's browser. Details on the SecuriTeam site.http://www.securiteam.com/securitynews/5PP0L2A4UC.html Canada Legalizes Medical Marijuana The BBC reports the new rules under which terminally ill people can use marijuana in Canada. According to the article, individuals will be able to grow pot for their own medical use. The Canadian government will also get into the act and has awarded a contract worth $3.5 million (in weak-kneed Canadian dollars) to a firm to grow the weed for official distribution. The new rules are being closely watched in the US, where there is strong popular support for decriminalizing marijuana. If the Canadian experiment works, the US is likely to follow.http://news.bbc.co.uk/hi/english/world/americas/newsid_1463000/1463923.stm ONLINE CULTURE Blogdex Indexes - Well, You Know Cameron Marlow, a PhD student at MIT's Media Lab, has created an indexing site for blogs. "Blog" is shorthand for Web log, a running commentary of a person's Web travels not unlike what we've been doing here at NSD for what seems like forever. Typically, blogs are written by individuals, updated frequently, and use relatively new Web services (e.g. Blogger) or server software (e.g. Greymatter). The Blogdex will calculate which links show up most often in the thousands of blogs on the Web. In effect, this is an indication of the top memes circulating through the diverse blog community. The index is still experimental and needs more work, but is likely to prove highly popular, not least with journalists and Net sociologists.Blogdex: http://blogdex.media.mit.edu/ Blogger: http://www.blogger.com/ Greymatter: http://noahgrey.com/greysoft/ The LA Times has a brief article about the growing phenomenon of stealth file-trading networks. Groups of users co-opt servers - which they usually don't own, such as government or university machines - and create hidden file-storage areas. The co-opters then engage in the frenzied trading of digital content, everything from copies of the latest movies and TV shows to music, hacking tools, and porn. The article amusingly calls this a "virtual rave party". The practice results in a constant battle between sysadmins and hackers, with the real casualties being public file servers of all kinds, which are shutting down as a result of file-trading abuse. The article notes that once a new illicit server goes online, it only takes hours for it to be accessed by hundreds of users. http://www.latimes.com/news/printedition/asection/la-000061971jul30.story?coll=3Dla%2Dnews%2Da%5Fsection Sircam, the Clueless, and the Dumb People who open unexpected e-mail attachments in this day and age of worms and viruses are clueless, but those who send attachments via e-mail are simply dumb. That's the conclusion of this finely crafted rant piece written by Wired's Jon Rochmis. He wrote it in response to the numerous pieces of random e-mail Wired received from all those machines out there infected by the Sircam virus. We, too, have been overrun with Sircam garbage. Please, people, check your machine for Sircam and give our bandwidth a break. It turns out that Sircam looks through a victim's browser cache, grepping for e-mail addresses. Any popular Web site has been hit hard. Symantec has a free tool that'll de-Sircam your Windows box. Do that, read the Wired piece (the bit about the FBI agent is priceless), never open e-mail attachments, and more importantly, stop sending e-mail attachments. If you must transfer files, use scp, FTP, or carrier pigeon. Attachments are evil. We don't use them and we don't open them. Neither should you.Rant: http://www.wired.com/news/culture/0,1284,45581,00.html Symantec: http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html Vote here on what percent of dotcoms will collapse and die an ugly public death by the end of the year, or just pick over the bones of the poor souls that got shot down early. Read stories of dotcom survivors and study the shell-shocked, like the stumbling pioneers who shared a dotcom business between themselves and the bag lady on the street, until some nasty Wall Street hiccup took it all away. Yikes. The meat of the site is Dotcom death and layoff announcements, mostly linked from third-party news organizations. http://www.dotcomdoom.com/
SURFING SITES The most important invention in the rise of the personal computer was not the transistor, but Pong. Without Pong and its offspring, PCs would still be serious things for serious people, not a staple of modern life. Games put the personal in personal computers. Yes, Lotus 1-2-3 was important and so was Word, but without games, PCs would still be office machines and little else. Pong was, and still is, a form of tennis on a flat screen. Anyone who saw the early versions was instantly hooked. Curmudgeons smiled in delight. The appeal was universal. This site pays homage. The history is all here, from the oscilloscope-based versions developed at Brookhaven National Labs to the many standalone and PC versions. This site is a wonderful tribute to a vital part of PC history.http://www.pong-story.com/ War is horrible and the Great War (now called World War I) was a particularly gruesome example of the type. The soldiers, the people who did the dirty work, developed their own language. Often morbid, and usually tinged with humor, it helped them survive. The British Army has always been a colorful place, both in actual being and in language. This site is simply a long alphabetical list of hundreds of terms, from Addul to Z, and their definitions. There are also a few photos, but little else. Little else is needed. The words and descriptions are enough to provide a picture of what life must have been like. For example: "DOGGO In hiding and keeping quiet. Probably from dog. 'All day we lie doggo in the dugout, partly because of the machine gun trained on the door, and partly because no good was to be got by going outside' - 2Lt Frank Warren, 20th Bn, KRRC, Honour Satisfied." http://members.tripod.co.uk/hinckley/slang.html Folks who speak in public often suffer from foot-in-mouth disease. It's become a regular epidemic. The World Gaffes area of the World News site offers ample proof of the spread and severity of this epidemic. This British site checks news reports for the best of the world's gaffes. Some are very British and will appeal to a limited audience, but most are truly universal howlers. There are an awful lot of people who should have their mouths duct-taped. One warning about this frequently updated site: many of the links will take you to the original source material and out of the site. http://www.worldgaffes.com/ When you hop in here, one of the first things that slaps your eyeballs is the following statement: "Being a baby boomer is more a state of mind than a year of birth." A state of mind? Isn't that pretty much what those happy boys in "Deliverance" were thinking? In any event, the people who put this site together are convinced that the most exciting decades of the last century were the 1950s, '60s, and '70s, and they aim to prove that to you. It leads to a rather weird mix, which includes, for example, Paul Anka's "Five Decades of Hits". These people grew up in a time when there were no VCRs, and darn few TV channels. A time when you sat on the porch in the early evenings, after the chores were done. Still, these early hominids survived. More to the point, they became technologically literate. They put up a site that has more than a couple of really cool things to sift down to. We particularly enjoyed the essays. Everyone's heard of Woodstock, for example. Probably seen the movie a couple of times. Great music, peace, love, dove, and all that. It's refreshing to see another take on it, and you can find that here. And more. Sift happens. http://www.bbhq.com/index.htm The dMarie Time Capsule is an online database that will generate an information page for any given date from 1800 to the very recent past. After inputting their desired date, users can click Quick Page for standard output or Advanced Page to edit specific news headlines, entertainment info, toys, and whatnot to be included in their generated "Time Capsule". Find out what was happening on the day you were born, and then go back and take advantage of the more cryptic possibilities that suggest themselves. We found, for example, that on the day Pearl Harbor was attacked, "I Don't Want to Set the World On Fire" was a hot tune. When the Watergate scandal broke, "I Can See Clearly Now" was the song that set the stage. And folks, on that fateful day in 1889 when the first computer was patented, the song that ushered it in was "With All Her Faults I Love Her Still". Serendipity? http://www.dmarie.com/timecap/ Okay, so Elle's real name is Eleanor Gow, Jayne Mansfield was Vera Palmer, and Walter Matthau used to be a mouthful with Walter Matuschanskavasky, but why they changed their names is the gossip we like most. Sometimes it's obvious: Demetria Gene Guynes became Demi Moore, but she named her kids Scout Larue, Rumer Glen, and Tallulah Belle and hopefully she can see the irony in that. Did you know Lana Turner's eyebrows were shaved off in the 1938 film Marco Polo? They never grew back and she wore false eyebrows in public thereafter. Sure, that's got nothing to do with the fact that she used to be called Julia, but we liked it. http://www.famousnamechanges.com/ We've all ridden the wave of rising and falling gas prices for a while now, and it doesn't look like relief is coming anytime soon. So, what to do to keep from getting gouged at the pump? Well, short of springing for that new ten-speed you've had your eye on, you can head over to this site and arm yourself with information. With a network of over 39,000 volunteer spotters reporting prices from nearly 140,000 gas stations in North America, the site allows you to keep tabs on the lowest go juice prices in your neighborhood or anywhere else in the US and Canada. You can also search for the best heating oil prices or commiserate with fellow drivers on the discussion board. http://www.gaspricewatch.com/ Recipe Plus Bazaar Equals Recipezaar We went straight for desserts. While Recipezaar has more nutritional information than a health farm, there's not much point reading about low-fat spreads when we could snack on the eye candy of Banana Slush and Better Than Sex Cake. We printed out Velveeta Cheese Fudge and then chose Digestive Biscuits in case things weren't moving as they should after the calorie overload. Low blood pressure's not all it's cracked up to be anyway.http://www.recipezaar.com/ Wouldn't You Like to Be a Pepper, Too? Putting a new spin on "playing doctor" is Not Quite What the Doctor Ordered, an online curiosity cabinet of Dr. Pepper soft drink imitators on the market. The collection lists nearly 100 Dr. Pepper pretenders, from such boastful offerings as Dr. Perfect and Dr. Best to the more humble Dr. Cheaper and the decidedly apathetic Dr. Whatever, with photos and rankings based on criteria of flavor, packaging, and similarity to the uber-Pepper. Our vote for least appetizing product name would have to go to Dr. Furr's, closely followed by two in the category of "known, suspected, or rumored to exist" Dr. beverages, Dr. Foot and Dr. Swett, for whom we recommend the obvious: a corporate merger.http://www.andrew.cmu.edu/user/mpreston/browse.html The Toilet Museum speaks for itself... really. Included in this online shrine to the loo is a collection of bathroom sounds, as well as 15 other toilet categories - including Private Moments, Toilette Internationale and Celebrity Bathroom - that feature photos, cartoons, and greeting cards celebrating one of the fundamental achievements of the human fundament. Legend has it that this whiz of a site began as a collection of art that decorated one individual's small water closet in a New York apartment, eventually overflowing (as things are apt to do) onto the Net. Lift the lid and look inside to view such artifacts as a deep-sea photo of one of the toilets on the Titanic. You can conclude your visit by writing on the Bathroom Wall guest book, or clicking on Rear Exits, a list of links to other potty sites on the net. http://www.toiletmuseum.com/ Finding porn on the Internet isn't a problem. But what about converting that handful of sites that stubbornly insists on remaining porn-free? Pornolize.com provides the solution. Just type in any URL, wait a few seconds, and wham - quicker than you can spell "lubricant", your favorite Web page is pornolized with the random insertion of various naughty phrases into the text. The novelty of the whole thing wears off pretty quickly, but there's still a certain juvenile pleasure to be had from seeing, say, the New York Times rewritten in pornolese, with headlines like: "Alan 'assmaster' Greenspan cuts 'muffdiver' interest rates". If that strikes you as humorous, you'll probably get a chuckle out of all this. http://www.pornolize.com/ ONLINE TRAVEL Czarist Russia in Living Color While some of the more affluent Americans were playing with their Kodak Brownie box cameras, a photographer named Sergei Mikhailovich Prokudin-Gorskii was documenting the Russian Empire in color. Using red, green, and blue filters, Prokudin-Gorskii captured black-and-white images on glass plate negatives, which, when projected through a filtered light system, produced a single color image. The Library of Congress staff explains how they do it with modern techniques in the Making Color Images from Prokudin-Gorskii's Negatives section. From the traditional dress of Russian peasant girls to the somber tones of workers outside the Bakalskii mine, this exhibit captures the soul of Russia from 1907 through 1915 in vibrant hues. The vista in the photo of Cathedral of St. Nicholas in Mozhaisk is not to be missed.http://www.loc.gov/exhibits/empire/ We see a lot of travel sites and so we approached TheTravelzine with some trepidation, but the introduction caught our eye: "We think TheTravelzine is for independent travelers who know that anticipation is half the fun, and that the joy of travel is that much greater for the people you meet, and the experiences you share." True enough. An article on how to holiday with carry-on luggage and personal tips pointing to the best coffees and hotels are great ideas. With friendly advice doled out as if from the travel agent of your dreams, this site stands out in terms of easy navigation and infectious holiday anticipation. It beats the heck out of dog-eared brochures. http://www.thetravelzine.com/ FLOTSAM & JETSAM Know When to Walk Away, Know When to Run The big Ernest Hemingway look-alike contest is over for this year, but men with white hair and beards can still get in on the look-alike action here. The faces run the gamut from dead ringers to those who might be more appropriate musing over "The Old Man and the Sea".http://www.menwholooklikekennyrogers.com/ Ever get caught heading to a meeting with a handful of papers and no stapler? Visit here for Zen behavioral modification. Best of all, you'll never have to pry out any jammed staples. http://www.virtualstapler.com/ Fast, Easy Reverse Phone Look-ups You have scraps of paper with phone numbers all over. And, if you're typical, you have no clue whose number each is. No problem. Go to Google, type in the number, and hit enter. Most of the time, the name associated with that number pops right up. Don't worry about format; Google'll ignore anything nonnumeric.http://www.google.com/ Cable Modems, Networks, and Speed What do we all dream of? More speed! This well-diagrammed little piece gives cable users some ideas that we're sure the cable companies won't like. How's 1.3 Mbps sound for a download? There are piles of stuff available here. A tutorial on setting up a home network? No problemo. Only for Wintel users, though.http://www.homenethelp.com/web/howto/Midpoint-connection-teaming.asp CORRECTIONS Last week we reported that Hooters has declared bankruptcy as a result of a lawsuit involving unsolicited fax messages. Actually, it was just the one Hooters franchise in Georgia which fell into bankruptcy. The rest of the chain is apparently healthy and perky.http://www.hooters.com/ It Wasn't SETI@Home, It Was Distributed.Net Last week, we also erroneously reported that David McOwen, a sysadmin at DeKalb Technical College in Georgia, was charged with hacking for installing SETI@Home clients on the university machines. He had actually installed Distributed.net clients, and that got him in trouble. Distributed.net is mostly known for running software which tries to win crypto cracking contests by brute-force parallel computing. They actually do more these days, donating their resources to a variety of scientific and mathematical research. Check out their site for details and screensaver software.http://www.distributed.net/ |
| CONTACT AND SUBSCRIPTION INFORMATION | |
| ||||
| CREDITS | |
| ||||