Support for Windows XP ended today.
Today, probably the biggest security flaw the Internet has ever had was made public.
http://www.pcworld.com/article/2140920/heartbleed-bug-in-openssl-puts-encrypted-communications-at-risk.html
The OpenSSL library had a “mistake” introduced in 2011 which could give a third party the ability to extract a server’s private encrpyttion key – which would allow that third party to listen to and decrypt all previous “secure” recordings made of Internet traffic to and from that server – which would then expose usernames and passwords and cookies of anything ever sent over a secure connection.
This is exactly what Snowden exposed that the NSA had done. The “mistake” was exposed by Google, which at least in public is on the warpath with the NSA and the US Government.
The OpenSSL library is a fundamental building block of every Internet connected computer. This will affect every computer on the internet, not just XP. The library is often linked into executable objects, which means this hole may be there for some time – it probably will force Microsoft to push an emergency patch to Windows XP.
There are people “in the know” about who introduced this bug and whether it was a careless oversight or a deliberate compromise of the security of the entire world. Something like OpenSSL has lots of eyeballs reviewing changes. Someone has got some ‘splaining to do.
From what I’ve been able to find so far, Microsoft wrote their own implementation of SSL, so Microsoft products like the IIS web sever are not vulnerable, but that doesn’t mean Windows servers are not affected. If a thrd party software implemented its own SSL using OPENSSL, it may still compromise the server. My confidence level in what I just stated is not high – I don’t write operating system software
Adding to the mystery is the other person who independently found this at a security firm – used to be Microsoft’s chief Security Officer.
Google is in an interesting position in this cloak and dagger world. They had had a significant office in China until the Chinese had hacked into them. Were they there as an independent firm, to spy, or to be a decoy for to attract spies?
No one enters a country with a passport and visa saying they work for another country’s spy agency. Our country is full of spies from other countries and we have spies in other countries. Whatever is in the news is a minute amount of what is going on.
The guy whose name is on the bug and the fix is an unremarkable PhD from The U.K.
If I had to guess, probably 75% that it was accidental – but a lot of eyes should have been double checking the code.
Warning, William Robinson, Warning!
http://www.wired.com/2014/04/dropbox-rice-controversy/
mayor mike’s team reports
http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html
I contend now, as I did back then, that Google had a deal in China to test and perfect their filtering and ‘search bias’ before implementing it on everybody.
One reason I believe Microsoft (Feds?) terminated XP support is because it might -not- have as many backdoors as Windows 7 & 8… ‘legacy code’ aside.
e.g. NetBEUI, a non-routable protocol, is hidden on the XP CD. But after XP, MS stopped including it and deferred to NetBios and TCP/IP for LAN file sharing.
If M$ were sincere, they would scuttle their NT code base (an OS/2 fork). Just browse through to the links for each ‘security update’ issued on Patch Tuesday; typically, the entire line of NT-based operating systems is affected by each ‘fix’.
Windows NT, 2000, XP, Vista, 7, and 8 are all built on NT; they give the UI a facelift, tweak the kernal, and update some dll’s and their .NET/spyware every few years.
Want (or need) to keep using XP? Set up a VM (virtual machine) with Linux or Win7 as the host OS and run XP as a guest and keep a snapshot or two of the system state.
I use a triple boot setup (just in case) with VMware Workstation; running both Linux & Windows 7 as reciprocal hosts/guests, and XP as a 3rd OS and guest on the first two.
Oracle’s VirtualBox is another good VM alternative, and it’s free.
TrueCrypt or BestCrypt for encryption, NOT Bitlocker (see below).
http://mashable.com/2013/09/11/fbi-microsoft-bitlocker-backdoor/
I hate my iPad. I wrote a big long screed about the arrogance of Linux users and their ignorance about NTFS, but Safari reloaded the page where I was typing because I opened another tab, then came back.
My friend from the food distributor in Chicago called last night about something else, and we discussed Heartbleed and the end of XP. To the best of his knowledge, the company has not even started to migrate its desktops away from Windows XP. The company has around 25,000 employees and is the 10th largest private employer in the United States
Running XP inside a VM is something I’m actively considering.
It would be easier if the anti Microsoft folks weren’t naive assholes. One implementation being pushed to do this – the guy in the video tries to convince you that – “the Windows file system is based on MS/DOS” – ummm, no it isn’t. NTFS is extremely different from FAT. Microsoft realized that FAT and FAT3 2 were inadequate for a serious commercial operating system. The person went on to say that Linux uses a “modern” file system. Ext2 was created in 1993, and ext3 that added journaling was created in 2001. Ext4 was released in 2008 – this is 2014. Windows Introduced NTFS in 1993. Journaling was added to NTFS in windows 2000 (in 2000). Even if you somehow rationalize that ext3 is better than NTFS, creating a virtualized NTFS volume in an ext3 physical volume doesn’t fix deficiencies with NTFS – it adds a layer of overhead. Now you have ext3 journaling changes being made to the NTFS journal…
When you have 10,000 Windows machines in a large company, controlling access to files / folders / directories solely by membership in “groups” based on user names breaks down very quickly. ACL security descriptors establish rules in the file label itself that says who is allowed to do what to the file. Ext3 is a good implementation for a unix style operating system that was designed in the 1970s
Art, it’s funny you mention NTFS… I just finished data recovery for a client; failing disk with unreadable sectors (IDE drive, XP).
It had 3 partitions: Dell recovery & diagnostic partitions intact, but system/data partition, table, MBR, and MFT all corrupted.
Pulled out the full-monty recovery toolkit: UlitmateBootCD + PartedMagic (linux LiveCD with ddrescue, testdisk, GpartED, etc), plus a large arsenal of DOS low-level disk utilities…
Ultimately, I ended up using DOS tools to recuperate the disk enough to recover 98.5% of the data: FreeDOS, SpinRite (v6), testdisk/photorec, and a disk sector editor which I can’t recall at the moment. (HDAT2, etc. would time-out on read errors).
The -design- of NTFS is why the recovery effort was successful, and is probably one the best things to come out of Microsoft NT.
I still have an old, slow computer loaded with XP. I almost never fire it up and quit updating the OS 2 years ago. I run W7, 64-bit on a 2-yr old machine that still runs OK. I have no choice but to run Windows because of proprietary software, or is there a better non-Windows OS that will run it, other than that fruity OS?
Most consumer software is written for Windows. If you are somewhat technical there is Linux which is free and quite good. For browsing, word processing, spreadsheets and listening to on-line streams, it is a great choice. If you want to get more into the how it works internally, then there is a learning curve. Firefox and Chrome run on Linux, IE does not.
http://www.debian.org/
I was watching a video last night from Google’s presentation to developers on their cloud services. Google’s direction is extremely clear. Whether you are comfortable with it is something only you can decide. Internet speeds are growing rapidly and remote virtual disks are “fast enough” for most things most people do. Google has built its cloud on a highly customized Linux, but none of that really matters as the cloud spawns virtual machines instantly as needed in a way that scales almost infinitely. The search engine can handle one million transactions a second and data access in trillions per second. The presenter showed the hot fall over – while he was streaming an HD video, they killed the primary instance (like simulating a hard drive failure) – the backup instance was activated and the handoff was synced so the player didn’t even stutter, let lone lose the stream.
Google sees almost all data being in the cloud and progrms running in the cloud. The only thing you need is a presentation device (ie Chromebook). You won’t be developing on a PC, because applicants will be developed in and run in the cloud.
Is this the future? They brought the guy from Snapchat on the stage. In 3 years, it went from an idea to a $18 billion purchase by Facebook using the Google Cloud.
I concur that it is the way of the future. Look at the industrialization of America and the UK in the 1700s and 1800s. It started by harnessing non-human, non-animal power that other countries could not do.
That meant water power in rainy England and the rainy east coast of the US. Locating on a river and using water wheels to turn gears so that muscle could be freed. First to process grain and other food, then to operate factories.
Eventually, electricity was harnessed and the plants no longer needed to be located on the rivers- power could be transmitted to them from the generators that were on the rivers.
Think the internet today the same people thought of electricity 100 years ago. Instead of transmitting energy, it is transmitting information.
It is a radical transformation of society. Also think of the cloud owners and the cloud renters as you would think of landlords and tenants… or wealthy estates and share croppers.
The ultimate consequence of this transformation was the civil war. People in the South were suddenly able to buy very high quality textiles at much cheaper prices than the New England mills could produced as they didn’t have the technology to create patterns automatically using cards.
The explosion in textiles and the invention of the Cotton gin created huge demand for American cotton and the income pouring into the south was buying other consumer goods from England rather than the US factories in the NorthEast. The Federal government imposed tariffs to block the Southern / English trade (some claiming their motivation to end Salvery), and the seeds of war were planted. “Yankees” understand very little about the “Civil” war.
You are right, Art. War is normally about power and money but justified as good versus evil, right versus wrong.
FWIW – My 10 year old has her own google docs account provided by her school. She and the other students are encouraged to write their essays, homework there.
No worries about the dog eating their homework or them forgetting it. Their teacher has assess to their school accounts and can read their work from the teacher’s userid.
I am ok with it, but wonder whether her homework from 2014 will be used for target marketing in the future.
I’m sure they are being encouraged (conditioned) to put everything in the cloud or Google docs…
The end-game is likely far more insidious than just future target marketing. e.g. Psychological profiling, monitoring, and data-mining for ‘anti-social’ tendencies and gleening info about their household, mom, dad, etc.
Question: is EVERY keystoke (or word) being stored, regardless of whether they edit or delete the content?
It’s always about power and money…. or, chaos and control as Agent 86 would say. 🙂
The cost of persisitant storage is so low that you could record everything you do, including each heartbeat, each place your body was, every time you bought, everywhere you drive and how fast, every email you sent, every comversation you’ve had, every breath you took, everything your eyes saw and fit it intoa $100 disk drive.
I know. A number of years ago, the girl down the street overdosed from drugs. She was 17. Chicago is full of shootings, and there was the multiple stabbings today in a Pittsburgh area school.
I have mixed feelings about monitoring but children do need to be monitored and guided. Sure technology can be abused, so can guns and knives… but you have to weigh the pros and cons and in general I think closer monitoring of children is a good thing.
A century ago, neighbors knew neighbors and kept an eye out for each other. Then we became a mobile society- people sell their homes every 7 years on average, and work far from their immediate neighbors. If technology, through a virtual community, can help fill the gap and keep kids out of trouble, the good out weighs the bad IMHO.
This is what parents/family should do, not the government schools… Better think about that control.
Linda, Respectfully disagree. Anyone that has responsibility for the care of small children has the responsibility to monitor them and guide them from harm’s way.
You can debate whether children should be home schooled, or whether government should be in the school business, but those are tangential topics.
Are you given the ability to read it? Are there folders that are hidden from parents?
I went shopping today at Office Max and they had a prominent end of aisle display near the register of some program for Common Core. I don’t know what it contained, but the box was about the size of the 12 can box of Pepsi Throwback.
I don;t have an ID to log in and see, but I haven’t asked for one. How is it different than kids writing on paper than handing it in to the teacher…. or writing on the chalkboard?
Homework is an interesting thing. Teachers of young students don’t want parents to help so much that the students get everything right when they really don’t understand the subject. Homework is used by teachers to gauge when the class is ready to move on to the next topic.
The cloud concept fails when force-paired with metered internet bandwidth. After 15 years, cable and DSL are still not available in from my neighborhood which is only 8 miles south of the Rome GA city limits. So I pay $90/month for 15GB of high speed satellite internet. But no VOIP, no Skype, no Netflix, no Hulu, no significant FTP/SFTP action, and certainly no clouds.
Even if you have a “fast connection”, it can take 8 months to finish your first cloud backup
prboylan – If you have cell phone service where you live, I think you can do better than that $90/month for 15 GB with any of the major cell phone carriers. You need a smart phone and use it to create a WIFI hotspot that you can use in and around your home or anywhere you place the smartphone. If you already have cell phone service, consider a second phone that you always leave at home for that purpose – with the family plans, it the second phone will cost you about $10 / month additional.
Would you like your gravatar icon back?
haven’t really considered that question before….
Re: Gravatar icon
Sure, my blog posts seem kinda empty without it. Although the one I had that was automatically assigned had a frown on it. That’s really not me. 🙂
CC1s121LrBGT, a Verizon 4G air card is exactly what I’m using for corporate VPN connections which are often horrible over satellite because of the long ping times. The air card is WAN #2 on my router and I do load balancing between the satellite and the air card connections. But the air card is metered also and costs about the same per month as the satellite for 20GB of bandwidth.
I see. I just checked the Sprint site because I know they have been advertizing unlimited data, text and talk. They do in fact still have that for your smartphone, but their software limits the tethering (data sharing from the phone to your other devices) at 5 GB per month than starts with additional monthly fees.
prboylan, If only someone would come up with a web site where you could compare internet service providers and choose the best plan for meeting your needs. 🙂
Bwahaha
So think of the 80s sitcom “Cheers” where everybody knows your name. In the future, all the devices in the world will know your preferences because of cloud connectivity.
You get in a rental car, or drive your friend’s car, and it will know your radio station presets and the program you normally listen to in similar environments/circumstances.
Walk into Starbucks on the other side of the world, and they will know your favorite beverage.
The world will be one big User Interface to the cloud.
Now look back 100 years from today. The first automobile purchasers had to be mechanics. The first radio owners were experimental hobbyists. The first home computer owners were programmers. …. big data is also on its way to being everywhere just as automobiles, radios, and home computing are today.
The guy who wrote ooTunes is now working for this company
http://www.spacemonkey.com/
The idea is to have a distributed cloud
That cartoon was from here
http://xkcd.com/
If you aren’t a tech geek, they won’t all make sense
CC1s121LrBGT, I agree that anyone having the responsibility for the care of small children has the responsibility to monitor them and guide them from harm’s way. I just do not think that the federal government should dictate what or how the students are taught. This is the job of which the local/state should be in control.
The only thing that Common Core will accomplish is to produce “Worker Bees” for the elite. It is truly a bad situation.
I agree with you regarding the federal government. Since the creation of the Department of Education, educational scores have decreased compared to almost any other country in the world. I do understand the rationale for creating federal standards – there are some really corrupt school districts, mostly in inner cities, where the unionized workers can not be replaced despite poor performance that damages the children’s future.
Personally, I believe the solution is some competition. Imagine if only there was one food store and you were authorized to use it and only it. Why should schools be any different.
I am not big on social programs, but I do support my tax money being spent to educate children. Our future depends on it, and the be blunt, if they are not successful, we can not expect to collect much social security. 🙂
Schools is where the Libertarians have to confront reality. A society without universal education would be a horrible place to live. Public schools require public funding – and from there the slippery slope starts. If the only children who went to school were those whose parents could pay for it, the underclass would become very large and dangerous. People who feel they have nothing to lose will do almost anything even if it is just to destroy the things they can’t have.
100% agreed. Children by definition are not able to fend for themselves and the window of rapid learning and brain development is finite.
Likewise, Republicans believe in too many specialized accounts (college funding, health savings, retirement savings, etc) to empower choice. The fact is that a even competent investor at 40 years old is more of a gullible target at 80 years old. Look at former President Reagan for example, before he passed away, he could not recognize family members.
Thomas Jefferson believed strongly in publicly funded education, which is remembered firmly by the University of Virginia in Charlottesville, an easy horse ride from Monticello.
I think where we veered off course was Federal money. States don’t have printing presses, so that acts as a constraint on pumping too much money into a University system. Create Federal grant programs and loans and University costs and bloated spending will absorb all that cash and more.
I am for public funding of education through funding the students rather than directly funding the entrenched interests that are in the business for a living.
Having several different ways of doing things across the country is one of the founding fathers’ best ideas- it keeps the country from betting all chips on one hand and ensures that multiple hands will be played so that everyone can see which hands are best and which are worst.
New from Holland
http://www.wired.co.uk/news/archive/2014-04/11/glow-in-the-dark-highway-launches
Some Common Core info
http://www.lp.org/news/press-releases/republican-roots-of-rotten-common-core
I think it unlikely my nephew comes here, but if I actually saw value in discussing government policy with him, that’s exactly the conversation we would be having – you have a visceral reaction of hate when you hear “Republican”, yet you embrace Commin Core, which is really little more than George Bush’s No Child Left Behind. What’s the difference? The goal appears to be to create uniformity in a world that demands diversity.
I think parents should have more control and choice. Let them decide which schools and programs, more like the college choice that young adults have for themselves today.
Local/state being in control is still a monopoly with no competition… and quite frankly, it American education is not very good because there is no accountability. The local administrators like to trick parents and taxpayers that they have a good product by inflating grades. If my kid gets all A’s I might think that is great because I remember what A’s were when I was in school…. but what if I find out that everyone else in the class got a mix of A’s and A+’s? Then the all A’s is below average.
There needs to be a national test (or perhaps competing national tests) so that those paying for the education can see what they are getting for their money (local/state taxpayers mainly in today’s world) and so parents can see how well their children are really doing compared to other children.
For those who might be curious (and you know who you are!), the SRGuide web server is not vulnerable to HeartBleed, even if I was running encrypted web services
[root@SRGuide firewall]# openssl version
OpenSSL 1.0.0j-fips 10 May 2012
The Heartbleed flaw was introduced in early 2013 with version 1.0.1
They don’t call it “bleeding edge” for nothing!