Floss Your Mind

Net Nanny released for the Mac

Raffi — Mon, 11 Aug 2008 17:55:09 +0000

MacWorld has an article announcing the release of NetNanny for the Mac. Although I’ve been happy with the built in Parental controls on the Mac as it fits with our rules and lifestyle. I will download it and review it for our household.

Bookmark and Share

Upgraded to WP 2.6

Raffi — Tue, 22 Jul 2008 18:02:59 +0000

This was my first major upgrade using Wordpress since moving from Drupal for the blog. The upgrade was not unlike the way Drupal does it and was fairly smooth.

The difference is that Drupal provides built in Maintenance mode, but I had to add a Maint Mode plugin. Unfortunately I wasn’t able to login once I made the code changes and before I ran the db upgrade. I got around that by renaming the directory containing the plugin.

The purpose of this entry is really to test out some additional plugins that I have submitted and saving the above note in case I run across this problem again…think of it as extended memory.

Bookmark and Share

Apple’s iPhone Enterprise Application Delivery- REVISTED

Raffi — Mon, 14 Jul 2008 12:08:26 +0000

On June 13th I posted about the misteps Apple made regarding iPhone Application Delivery for the enterprise. It got several comments to the tune that I was jumping the gun.

I began reading through the iPhone Enteprise Deployment Guide. Some interesting thoughts here noted in this document that I pulled out while I skimmed through. It says in Chapter 1: “It [iTunes] is also required for downloading and installing software updates for devices and installing your enterprise applications.”

Later on in the same chapter it adds: “If you are planning to deploy enterprise iPhone and iPod touch applications, you install the applications on your devices using iPhone Configuration Utility for Mac OS X or
iTunes for Mac and Windows. Once you deploy an application to user’s devices, updating those applications will be easier if each user has iTunes installed on their Mac or PC.”

One positive that I pulled out from the document is that Apple is documenting some registry changes that can be used to help “lock-down” iTunes and limit functionality such as automatic updates and discovery of AppleTV devices. However, it seems that it does not go on to completely prevent Library sharing using Bonjour/mDNS.

Chapter 5 is all about application deployment. Apple seems to confuse the procedure a bit by first saying: “Your users use iTunes to install applications on their devices. Securely distribute the
application to your users and then have them follow these steps” and then saying “You can use iPhone Configuration Utility for Mac OS X to install applications on connected devices.”

There is a web version for Mac or Windows of this latter utility, but it is limited only to creating config files for mail settings, application certificates, etc., while the Mac desktop version (Windows version not available) additionally allowed the viewing of log files and application installs. These tools are primary used for device configuration by an administrator, not by an end-user.

Hopefully Apple will expand the web version of the iPhone Configuration Utility to provide application delivery such that iTunes can be bypassed OR provides more details on how to lock iTunes down further.

One of the commenters asked what my security concern with iTunes was. GNUCITIZEN did a nice write-up on this some time ago, so I figured its best to link to those:

The lines are still too long for me…but i’ll get there eventually. I am also looking to buy an MBA, but after the last price drop I smell a new version (bigger drive? more memory?) coming. Maybe its wishful thinking.

iWelcome your comments.

Bookmark and Share

Productivity apps for the iPhone?

Raffi — Thu, 10 Jul 2008 19:05:19 +0000

While I was trolling through my news feed, I was looking at the new iPhone App Store in iTunes. I was curious about productivity apps since I’ve been using Evernote (oddly its under Lifestyle). But I found this in one in productivity.

Apparently the purpose of this application is to time how long you can hold the single button on the middle of the screen.

Bookmark and Share

School’s Out, What are Your Kids Doing Online?

Raffi — Tue, 24 Jun 2008 14:51:36 +0000

This is something I wrote about last year but was lost when I converted to WordPress. I figured it would be good to revise/rewrite it now.

Now that school is out, what are your kids doing online? Summer months are always a time that is exciting for us and also poses some challenges. The school year brings a natural structure to the day and activities that surround it such as soccer, baseball, art club, music, etc.

I like to provide my kids as much freedom as possible on the computer and the Internet that is age appropriate. Of course “policing” this is a challenge. There are filtering and monitoring applications that are available, however just like in corporations you need to lay down your house rules (corporate policy) before you select and/or implement “parenting software.”

All of my kids are under 12, so our method is to keep the computers within sight at all times. The shared laptop is kept near the kitchen and is always used with one of us around to know what sites they are visiting or what applications they are running. We do use the built in Parental Controls on the laptop where we white list web sites as they need them and I utilize some of the rudimentary filtering in OpenDNS. Again, part of the problem with software or services that do this is that if your kids want to find away around it they will. This is why we keep the computer within sight.

How about when they go to their friends’ homes?

Good question. We will ask our kids to tell us where the computer is in their friends’ homes and if the computer is out of sight such as in a play room that’s in the basement or in their bedroom, then they cannot use it. I trust my kids and all I can do is hope that they do the right things. In the past, my kids have walked out of their friend’s rooms or done something else. The only way I know is that the other kid’s parent has told me. So, so far so good.

The other part is of course educating your children on issues related to privacy, proper use of social networks (if at all), and online safety. My guess is that most of you who are tech savvy probably end up doing this for all of the children in your family. The “virtual” world is anything but that. The Internet, social networks, chat rooms are all part of the real world and encouraging that brings the point home. Although I was negative early on on social networks for younger kids, sites like Webkinz and Club Penguin have allowed us to ease into social networking with a safer environment and teach our kids how to interact with people they know and those they don’t know online. Our hope is that carries into more “mature” social networks. Review your kid’s social network profiles, preferably with them there.

There are a lot of great resources online regarding online safety

Here are a few:

http://www.netsmartz.org - From the Center for Missing and Exploited Children
http://www.cyberangels.org - From the Guardian Angels
http://www.fbi.gov/publications/pguide/pguidee.htm- FBI Parent’s Guide
http://www.ftc.gov/kidzprivacy/ - FTC Kidz Privacy site

Know where they are going and what they are doing, whether its online or not. Good parenting in the online world is just good parenting. At the end of the day, the best thing you can do is to talk with your kids.

What do you do with your own kids?

Bookmark and Share

Weird Problem with Vista User Access Control (UAC)– solved

Raffi — Fri, 20 Jun 2008 03:22:34 +0000

I came across an issue with Windows Vista recently at a client that had been dogging me for quite some time.

Fortunately, most of the client’s PCs here in New York run Windows XP, but one of the principles wanted a Tablet PC and I figured that Vista’s Tablet integration was much better than the specialized Windows XP Tablet Edition.

Although the client admin rights on his own laptop, each time he tried to install an application, the typical UAC dialog box would come up. The installation would continue and then would quit with an error trying to access the H: drive.

Well, the only H: drive that the client had was his network home directory. Why would the installer need access to that drive? The client had that drive mapped so it should have worked right?

The workaround for the past few months was to log in as a secondary local account on the computer in order to install applications. Of course this was a pain, but it minimized my time on the computer and at the client’s site so it was a win/win for both of us. Finally one day I was determined to figure out what was going on.

I couldn’t find anything in the registry, so I ran the Command Prompt as Administrator by Right-Clicking the Command Prompt shortcut and selecting “Run As Administrator.” This explicitly tells the computer that you’re running as full admin without the UAC stuff going off. However, this
“Run as Administrator” acts like a new account. The install still failed, but while looking around in this environment through the command prompt, I found the drive letter H: was not mapped. After mapping the drive letter, the install worked.

Ok, so now I know why it the install fails. When the privilege escalation takes place, the profile no longer has access to that H: drive. But why does it need the H: drive? It turns out the client was redirecting his My Documents to his home drive using a Drive Path setup (H:\My Documents) rather than UNC (\\server\homeshare\username\My Documents). By changing the redirection to use UNC paths, the problems went away for all installations.

Weird oddity, but interesting none-the-less. I’m wondering how this affects other installations particularly environment variable changes or registry changes.

Bookmark and Share

Apple’s Misstep with the iPhone Application Delivery

Raffi — Fri, 13 Jun 2008 16:34:42 +0000

After watching the WWDC stuff this week I came to a realization that perhaps Apple did, but doesn’t care. In working in IT Infrastructure for 12 years for a mid-tier financial firm.

From the Palm to the Blackberry, desktop syncing software was used early on to keep devices up to date. When RIM went to a full wireless sync, this was a boon to IT administrators because not only was syncing done wirelessly, but so was application distribution and policy enforcement.

So why did Apple decide, after building a wireless application delivery infrastructure for consumers to utilize iTunes for iPhone application sync in the Enterprise?

iTunes, like other consumer media application, is largely banned in the enterprise. The reasons are many including the fact its not a business applications, uses mDNS (bonjour) which has been exploited, issues with QuickTime, etc. Besides, any additional software increases the attack surface for an end-user.

So I see this a problem for those Enterprises that will embrace the iPhone as an application delivery platform. Apple could have easily built an mini-AppStore application that could be sold or provided to Enterprises for application delivery or utilized the emailing feature that they have for developers. Or they can provide templates for managing the iTunes installations to pair down features via Group Policy (similar to what Skype has done).

My recommendation to my smaller clients will be related to the risk level they are willing to take. Many will want to use iPhones and do not need the application delivery. But for those that want to use applications on the iPhone will need to determine if iTunes will be a necessary risk they are willing to take.

For me, I’m looking for a way to turn my iPhone into a virtual iPod Touch (i.e. kill the phone service). Why? Well, one of my kids decided that sunscreen might help protect my phone from the sun and it seeped underneath the LCD.

Which gives me a good reason to get the 3G iPhone…I am a fanboy aren’t I? nuts….

Bookmark and Share

Life with Two Macs

Raffi — Tue, 20 May 2008 01:38:08 +0000

I recently purchased an iMac for my office at home. I did this for three reasons. I wanted to get my personal stuff off of my MacBook Pro and the use of a larger screen while at home. The machine itself is beautiful and was a good deal buying it refurbished. Other than a slight mark below the screen that is unnoticeable, it had nary a scratch.

As anyone that has worked with using two different computers has known is that syncing is frustrating. The Mac makes things easier, but it could be better.

File syncing was actually easy with, of all things, a free Microsoft utility called FolderShare. I installed FolderShare on both my laptop and my new iMac. I created a folder called synced documents and threw in there all of my files that I wanted to be available in both places. And voila, it works as designed. I haven’t tried editing in multiple places, etc. as it isn’t part of my normal workflow.

Nearly at the same time I switched to Mac Office’s Entourage from Mail.app. As an aside, I didn’t want to get MacOffice and was pretty happy with iWork and NeoOffice. However, I have to say I’ve been really pleased with MacOffice 2008. I switched to Entourage because my new firm used group calendaring and scheduling and the way I was doing it before (using Spanning Sync to Google and then down to Outlook in a VM–since Snerdware can’t figure out a Leopard version of GroupCal) was prone to problems. All of my mail accounts were either Exchange or IMAP so no syncing required. All of the syncing occurred with the servers that provide those services.

Mac Sync Services is used as a core for any data movement in and out of services such as the address book and iCal. Entourage also uses sync services to get its data to Addressbook and iCal and back. The reason I do this is so that I can sync my iPhone. It also uses Sync services. I have a copy of Spanning Sync which I used to sync my calendars to Google as I mentioned before. The problem arises when two things access Sync Services at the same time such as Spanning Sync and Entourage or the iPhone sync and Plaxo. When this happens, the sync services locks up and has to be quit.

One mistake I made early on was that I had Entourage syncing to iCal and Addressbook on both Macs, which were in turn syncing with dotMac. As you can figure this circular syncing caused lots of conflicts.

I mentioned there were three reasons. Well, my 17 Mac Book Pro is getting a bit heavy to be carrying around in my new position. So I plan to buy a new notebook, perhaps one that has less power than the MBP and give this one to my wife who has a PowerBook right now.

I’m keeping my fingers crossed for some upgrades come WWDC…we’ll see.

Bookmark and Share

Security Certifications and Can’t We All Get Along?

Raffi — Wed, 14 May 2008 02:50:04 +0000

There have been a lot of discussions on the typical security podcasts lately regarding security related certifications, their worth, and their contribution to career.

Most of the conversation has been around the lack of merit of the CISSP. I heard similar arguments regarding the MCSE in the 1990s. For the most part, those critiques were correct that the MCSE had become a paper certification, largely because of the training centers and their focus on Boot Camps. So in the end, it became a moniker of someone that has at least known most of the marketing pitch from Microsoft at one time. It did however open doors.

Having both these certificates and going through the process to attain them, I wanted to give my perspective on the discussion. I have met a lot of MCSEs through my years (NT4, Win2k, Win2k3) that don’t have a clue how to set up and manage a Microsoft-based corporate infrastructure. The tests and the training, do very little to provide that. I would have to say though that the Windows 2003 certificates were better in that they provided design scenarios and the such. But the tests were a walk in the park.

The CISSP is a non-technical approach to the security domains. If anyone is expecting a test or certification to cover ten domains and be a technical certification, it is a pipe dream. The CISSP provides a broad basis for a security manager. You aren’t going to jump into doing penetration testing, or designing advanced cryptography from the CISSP, however it is important to understand these disciplines to be a good manager of IT Security or CSO. The CISSP is a living certificate. It is not a point-in-time one like the MCSE or others that I will discuss later. It is the responsibility of the holder to continue his education in order to maintain it. Of course this is a system that can be gamed by the dishonest and I would suspect that these folks would be flushed out in due course.

Many people focus on other security certificates such as the ones done by SANS (link through PaulDotCom on purpose). SANS training is technical training. They work to train their students on specific topics that are timely (I am looking forward to taking some SANS training myself down the road). I think they fill a really big gap in security training. There are critics of SANS in that some of their certifications could be gamed. I can’t comment much on that since I haven’t gone through one myself but, like the CISSP continuing education, I think those folks will get flushed out. There are other training organizations other than SANS but I used them as an example. SANS provides the bits under the certification domains. Its more for practitioners rather than managers.

To summarize, they are fundamentally different types of training and certifications:

SANS is your deep technical in specific topics
CISSP is your broad knowledge in all of the security domains
SANS is for practitioners
CISSP is for managers
SANS is there to teach you a new discipline in security
CISSP is there to give you a broad base so that you can discuss security with others and your team

This isn’t sweet lemons or sour grapes. I’m happy with my CISSP and I’m proud that I did it. It gave me the basis. It’s not for the kid out of school in my opinion. I think you need to learn your stripes in IT or risk management before you do it. It is a career framework rather than job training.

So now can we all get along?

Bookmark and Share

Indian Government wants to read your Blackberry

Raffi — Tue, 13 May 2008 04:22:39 +0000

The Indian government wants the encryption keys to allow them to read Blackberry messages with Indian subscribers. According to the article from the IDG News Service:

Under India’s Information Technology Act of 2000, the government has the right, under certain circumstances, to intercept electronic communications for security reasons and in the national interest. Security agencies say that terrorists are increasingly using the Internet and applications such as e-mail to communicate with one another.

To be honest, I’m not sure how I feel about this. Is this different than the debates in the U.S. regarding wiretapping or interception?

Partially its different. With RIM/Blackberry you can email people internal to your organization or company assuming that the email is on your own server i.e. Exchange/Lotus Notes. Although the email may travel through the ether it is supposed to be encrypted end to end (it may get decrypted and re-encrypted along the way, I don’t remember). With a subpoena, a “tap” could be attached. Of course I’m interjecting U.S. law (I’m not a lawyer).

If the servers are not within their national boundaries, does the Indian government have a legal way to tap into that?

I think at the end of the day, it’s moot. Terrorists and other evil-doers will go to a platform that doesn’t have a middleman that could undo its encryption like using ActiveSync/Windows Mobile or some other encryption method. I’m sure some underground >insert ex-Soviet country name here< hacker has already figured out a way to run Zfone or Tor on a handheld phone.

Bookmark and Share