"I Will Smash Your Face In"

I've been reading a book called God Save the Fan, by Will Leitch, founder of Deadspin. Deadspin, of course, is an independent sports Web site Leitch started because he felt the people who should be reporting sports news (i.e. ESPN) wouldn't report things in an unbiased manner for fear of damaging their relationship with different sports leagues.

Anyway, in his book, one of the chapters talked about how people idolize players that, if they met them in person, they would not really like. For example, it's easy for me to say Derek Jeter and David Wright and Eli Manning seem like nice people, but I've never met them, and can't know for sure. I'd assume they are similar to most of us, in that they have bad days, make bad decisions sometimes, and have their own insecurities. In the past, the only way players and the masses generally communicated was through press conferences with local reporters who wouldn't always publish everything a player said, for fear of damaging their relationship with the player and team. If I work for the local NBC affiliate and made a certain player angry, the player (and perhaps his teammates) might just give important news to the CBS affiliate, damaging my ability to do my job.

Enter Twitter.

As I have discussed in the past (here, here, here, and here), leagues have tried to crack down on Twitter use, in part to protect the league and in to protect the players from themselves.

The NFL is at a crossroads at the moment. The collective bargaining agreement has run out, and no one is quite sure if the NFL will exist in the fall. Some players are not happy with that idea, and Antonio Cromartie (cornerback, for the NY Jets) called out the union leadership. A player from the Seahawks, Matt Hasselback tweeted (and then deleted) a comment saying someone should ask Cromartie if he knew what CBA stood for. Of course, this could have been a joke, but you can't hear the tone of a message over the Internet. Hasselback apparently decided to delete the message, but once you publish, people see it!

Of course, Cromartie took offense to this, and instead of calling Hasselback and talking with him, tweeted that he will smash Hasselback's face in. Really.

Just because you are a professional athlete doesn't mean you are professional (see: Rae Carruth, Lawrence Phillips, etc.).

So, who knows if Hasselback is a jerk, or if Cromartie really wouldn't smash someone's face in over a comment. Either way, the way news is reported is changing.

Metadata and You

I first encountered the word metadata back when I started creating Web pages in the mid 1990's. Programs called "search engines", like Webcrawler and Altavista, would automatically find your page and make it available for the world to find. They did have issues adequately describing your page, so as a Web developer adding "meta tags" was critical. It was a way of adding text that did not show up in the Web browser, but allowed search engines to find information about your site.

Metadata is something that is used today in many areas, from computer forensics to corporate espionage. I will give you a regular example first. As a professor, there are times when I think something might be an exact copy of someone else's file. The first thing I will do is take a look at the file properties. In Office 2010, I would go to the File tab and select "Info". On the right side are properties. I can see very easily the name of the person who created the file. In a computer lab, most people probably have the same user name, so that may not tell me anything. However, if you created it at home and gave it to a friend, there is pretty damning evidence since your friend has handed in a file with your name in it. Other ways include "date created" - this tells me the day and time the file was created. I am of course not opening up my whole bag of tricks here, but these are two ways to investigate a file further.

In terms of corporate espionage and hacking...many times, the metadata in programs such as Word (and most of the rest of Office) includes data like username, company name and a file path. If this file was created on a network drive, I now know the name of one of your company's internal servers and possibly your username. This information is valuable for hackers!

If you are distributing a file from Office, also be aware if your company uses tracking changes, revisions, comments, or hidden text, that information can be included in a file you distribute. If a member of a company's staff left a comment in the file, there is a good chance it could be found. You can use the Office 2010 Prepare for Sharing options to minimize this risk, though once again, most people do not realize this.

Even programs like Photoshop can cause metadata issues. Let's say you have an image, and you choose to blur out bits of it. Photoshop will save a thumbnail as part of the file, to make it quicker for the operating system to give users a preview. Therefore, a smart hacker may be able to see your original image using some advanced techniques. Programs such as jStrip will help minimize this risk, but many people don't realize it is a risk.

Like many other technology issues, the only way people know about this generally seems to be if they are burned by it.

Verizon, Google, and Net Neutrality

The idea of "net neutrality" is an important one. All ISPs (Internet Service Providers) work together in a collaborative way on the Internet. There are a few key points:

1. ISPs and other Internet companies do not discriminate against each other's traffic (for example, Gmail won't block all email from Yahoo! accounts to try to convince people to use Gmail, and vice versa).
   
2. Every Web site should have the same priority. In other words, pages from Amazon won't be transmitted before pages from some small Web site. This also his prevents companies like Comcast and Verizon (in my area) from trying to get exclusivity agreements with certain sites. For example, right now net neutrality would prevent Comcast paying YouTube a bunch of money in exchange for having faster YouTube connections (and effectively slowing Verizon customers). If they could do this sort of thing, it would make our lives as consumers much more complicated.
   
3. Finally, in practice, this prevents Internet Service Providers from filtering our content and throttling certain types of downloads (for example, blocking or slowing down downloads from file sharing sites).

Note that this isn't the same as monthly download traffic caps, which some providers (such as Comcast) have, and others (such as Verizon FIOS) do not.

Anyway, one of my students (thanks, Kevin!) brought in an article (available here on PC World's Web site) last semester that details a Google/Verizon pact. It sounds great in theory, but there are some ideas that may be shady. First of all, though it says the Internet should maintain net neutrality, they include the phrase "lawful Internet content", which some people interpret as a way to stop file sharing. Secondly, they do not address wireless access, because they feel the market is competitive enough. Finally, there is a provision for a private Internet which would not be covered. Though this could be something positive (stuff like health care systems), others interpret this as a way companies might find a way to exploit and get around net neutrality.

It sounds bad, but a bigger issue is this is all informal as it stands, and companies can do whatever they want at the moment. Something needs to be in place and formalized, and as I've mentioned before, most of the people in Congress do not have a technology background. I just hope we do not find ourselves in a bad situation in five years because Congress got Rickrolled by Verizon and Google.

Web Templates

Back in the stone ages of the mid-1990's, I developed Web pages by hand. Some of my students seem pretty impressed that I can still code a page by hand, and seem to want to do things that way as well. My advice at this point is to not do it that way. A good working knowledge of HTML can be useful in order to tweak a page, or if you are writing a script to generate a dynamic Web page. However, for static Web sites, it generally makes a lot more sense to just use a Web development tool such as Adobe Dreamweaver.

As someone who is not a graphic designer, I would have problems making attractive Web sites. If I were really planning on doing Web development, I would either find a graphic designer to work with, or plan on purchasing some sort of package. Many times, designers or design companies will sell templates to Web developers for this purchase. For example, a site like Project Seven sells some really nice designs that I would never be able to create for $60. The nice part is they are designed for use with Dreamweaver, and should cleanly plug right in to your interface.

I look back on some of my early Web work, and it was clumsy, but by purchasing the rights to something like that, I'd be able to make some really professional sites with very little effort.

NORAD Santa tracker

It always amazes me how people use technology.

As a child, I remember writing a letter to Santa. Now, you can email Santa.

Just to one-up that, NORAD (North American Aerospace Defense Command - a joint Canadian/American effort) has launched a Santa tracker, complete with Google map and computer graphic video. Pretty cool stuff! If I had a small child to show this to, I would certainly do so.

noradsanta.com

Hope everyone has a nice holiday break. Looking forward to doing some recharging myself.

Java up, Adobe down

...in terms of exploits, anyway. Looks like Java exploits are gaining favor with hackers again lately, according to this CNN article.

One of the problems with the Internet and specifically the World Wide Web is there are so many moving parts. Many novice users do not seem to realize the complexity of it all. Any application software (including Web browsers) present security risks, and when you add in the various plug-ins (such as Adobe Flash Player, Javascript, Microsoft Silverlight, etc.), you have a hacker's paradise. In the typical interaction, you have three points where security breaches can happen:
1) The browser
2) The plug-in
3) When the browser and plug-in interact

A perfect secure world would have no plug-ins at all, but that is not realistic. We are left as end users to hope the developers of the plug-ins secure their products.

Adobe has come under fire a bit for some of their exploits, but it seems as if they have done a good job (albeit, a reactive job) of plugging up some of their security holes. The report linked above shows that the number of Adobe exploits recorded has gone down, while Java exploits have gone up. Does that mean that Adobe has fixed their problems, or does it mean that Java problems are easier to exploit? That I can not tell you.

There's an option for that

One thing many computer users don't seem to intuitively understand is the idea of customization for the programs and apps they are using.

My approach to using software is to try to use the software, and when I find something I don't like, to try to find some way to change it. For example, inside of Microsoft Internet Explorer, you can change the start page. Most computer savvy users know this, but one of my friends just called this morning saying he changed his somehow and couldn't figure out how to switch it back.

This applies to Web sites as well. For example, Facebook allows you to turn off certain notification emails, change privacy settings, and change many other options. Most free email providers allow you to set up "filters", which would basically let you screen your mail (for example, you could have all email from people at a certain college go in to a special folder so it does not fill up your Inbox, but does not get deleted). If you use a site such as Yahoo! Calendar, you can set it up so it will send email reminders for events to a certain email address or phone number by default, instead of having to set that up every time you create a new event. Even games like World of Warcraft are customizable. You can switch things on or off using some of the menus in a game.

Chances are, if you are annoyed by something, there is an option to change it. Don't like Excel starting every file with three worksheets? You can change that. Do you hate it when you open a bunch of windows, and things compress on your taskbar? That can be changed. Would you prefer your Word to always space in one inch when you hit tab instead of a half inch? That can be done. Does your Blackberry give you annoying little "message sent successfully" messages every time you send an email? That can be removed.

The key is knowing that things can probably be changed, and finding the answer on the Internet.

Bring out the Dancing Pigs!

"Given a choice between dancing pigs and security, users will pick dancing pigs every time."

Once someone explained that line to me, I loved it. Basically, Bruce Schneier (a US computer security consultant and cryptographer) explained, "If the computer prompts him with a warning screen like: "The applet DANCING PIGS could contain malicious code that might do permanent damage to your computer, steal your life's savings, and impair your ability to have children," he'll click OK without even reading it. Thirty seconds later he won't even remember that the warning screen even existed."

That basically seems to summarize computer security these days. Users often get taken in by phishing schemes, download viruses, give out personal information, and do other things that compromise security...for the promise of dancing pigs. Smart hackers do this and create attractive links that people will click on.

As you can see, there are tutorials taking potential phishers through the process of stealing information. Stopping sites posting information like that is like playing Whac-A-Mole.

Congrats, you shut down a phishing site! Put down the hammer, I don't think others will pop up!

I do not know that most Americans are adequately prepared to figure out what sites are legitimate and which ones are not (and to read warnings). Sadly, people seem to learn by making mistakes and losing their personal information or getting hacked.

Proper Hardware Disposal

In one of my classes last week, we discussed the proper way to get rid of old computer hardware, to avoid privacy issues.

I've gotten rid of old computers, but I generally either keep the hard drives (to destroy) or use software to do a thorough wipe of the drive's data When I say "thorough wipe", I am not talking about deleting files, because data can easily be recovered from a hard drive, EVEN AFTER YOU DELETE IT. Really. As a matter of fact, Microsoft's pre-Windows operating system, DOS, used to include an undelete tool which could recover deleted files easily.

eBay is one place people can purchase used hard drives, and they even provide information on why you need to thoroughly wipe a hard drive before you sell it. You can see that the site shows that social security numbers, credit card numbers, and all sorts of stuff can be found on these hard drives. This means your identity can be stolen even if you do nothing wrong, if a company you have purchased from does not follow good procedures for hard drive disposal. Aside from eBay, there are sites like Craigslist where people get rid of old hardware, and there are always garage sales. In the corporate environment, many colleges and companies pay companies to dispose of old hardware (such as eRevival locally). If you go with a cut-rate company, you may find that though they promise to clean hard drives, they may not do so thoroughly. Any of these are ways that data can be leaked if the hard drives are not wiped.

One way you can provide a level of security is to physically destroy the hard drive, though someone could pick it out of the trash and recover something. The best way is to do a full wipe of the hard drive, or what we used to call a "zeroize" at the company I used to work for. We were putting defense systems in military crafts, and one of the requirements was that the pilot needed to have a button to wipe all the data in the system, to prevent classified data from falling in to the enemy's hands. (Yes, that information is public.)

The Department of Defense has pretty high standards for data wiping, and there are a number of tools that meet their standards. The problem is most of these tools cost money. The one that I recommend is a free tool called Darik's Boot and Nuke (available for download at www.dban.org). Despite the informal name, it is a legitimate program (referenced by CNN and the BBC). There are commercial tools that do this sort of thing as well, but the major difference is not function, it is speed (DBAN has a reputation for being slow - the BBC article says it took two hours for an 80GB drive). DBAN is cool because it gives you a CD to boot off of, and you select the depth of the wipe you want. The more depth you want, the longer it will take to run. If you are going to do this, I would recommend choosing the most in-depth wipe, doing it before you go to bed (as a home user) or before you leave work in the evening (at work), and just letting it run overnight. That way, there is no time wasted waiting for wipe to be completed. In a professional environment, having a DBAN CD around is not a bad thing, especially so your company does not end up in violation with the standards that govern your industry (Sarbanes-Oxley, HIPAA, FACTA, etc.).

A larger company may want to invest in faster, packaged software for this, or a hard drive sanitizer (such as this one - though I am certain their claim of 7 minutes per drive is for the simple wipe and not the seven-pass version).

Any of these options are better than the ol' sledgehammer method, because who wants to clean up that mess?

Spring 2011 Schedule

I just wanted to post my tentative Spring 2011 schedule at Bergen.

I am scheduled to teach:
INF 163 001 (Monday/Wednesday 3:55 PM to 5:50 PM)
INF 101 009 (Tuesday/Thursday 3:55 PM to 5:50 PM)

I may also be teaching a Summer I 2011 course, if that information is solidified, I shall announce it here.

The Gmail Killer

Facebook is preparing to come out with a new email service, where users can get email sent to an email address @facebook.com. There were a number of headlines that advertised this as "the Gmail killer", though it could just as easily be "the Hotmail killer" or "the Yahoo! Mail killer".

First, Facebook started to try to be your "one true login". They seem to be succeeding in this, because a number of sites have started to give you the option to sign in using Facebook instead of creating an account. For example, here are some random sites that came up when I Googled "Facebook Connect":

Evony
Joost
SurveyMonkey
TravelPod

Facebook even has taken so much of Myspace's market that they are introducing a "connect with Facebook" option. That's the ultimate admission on Myspace's part that Facebook has won the war.

Facebook has succeeded there, so they are looking to expand. The next horizon seems to be Facebook email, which they've announced plans to implement. Facebook's CEO says that this email will be even better because they know who your friends are. No, really.

"Because we know who your friends are," said Facebook CEO Mark Zuckerberg, "we can do some really good filtering for you."

There is something a little creepy about that, but I do think this idea will take off. The interesting part is this: back in the early 2000's, sites like AOL had email and chat services, and tried to expand in to profiles...same with Yahoo! and MSN. None of those transitions worked well. However, Facebook starting with profiles and expanding to chat and then email might actually work.

So, Facebook vs. Google...who wins? Time will tell.

Link to story

Keeping up with the Jobses

There's a saying "Keeping up with the Joneses" which goes back to the early 1900's (thanks Wikipedia). It basically has to do with people needing to keep up with the neighbors (in this case, the generic Joneses). I feel like Microsoft has this same symptom at points.

According to recent numbers, Microsoft Windows Mobile was only on 2.8% of cell phones, according to Gartner Research. Compare this with 36.6% for the open-source Symbian OS, 25.5% for the Android OS, 16.7% for iPhone OS, and 14.8% for the Blackberry OS. In other words, Microsoft Windows Mobile just is not cutting it.

Since Microsoft needs to keep up with the Jobses (Steve Jobs is often considered the Face of Apple), Microsoft released Windows Phone 7 last month. Microsoft basically redesigned the operating system, because as we see it wasn't working. According to USA Today, the first phone to run this OS is the Samsung Focus through AT&T, which was released on November 8.

According to cNet reviews, Microsoft does seem to have done a nice job on the operating system, but as they point out, it is an uphill battle to overtake some of the companies above them on the list. One interesting feature that jumped out from the review (since I haven't used it myself yet) was the integration with Xbox Live. That could be something that sets this phone apart, if it gives people access to their games and accounts in a mobile fashion.

We'll see how it shakes out, but Microsoft does have a long way to go.

Thanks to Kevin for the heads-up!

Twitter and Poor NBA Etiquette v2.0

Charlie Villanueva, an NBA player, recently played against Kevin Garnett. During the game, Villanueva claims Garnett called him a cancer patient. Garnett, for what it is worth, said he called Villanueva "a cancer", which isn't as far fetched as it sounds. According to urbandictionary, the term cancer "[is] often used as an insult when referring to someone who is a pathelogical [sic] source of trouble and discord within a group."

Now, who knows what happened and what did not, but I can see someone exaggerating because they are annoyed. Either way, the point is he came out and put it out there, and as we know about Twitter, there is no undo button.

If this guy's name sounds familiar, it is because he is the same guy who was benched for tweeting during halftime of a game in 2009. I blogged about that here. I would think the guy would have learned his lesson about Twitter, but nope. If it is getting in the way of your professional life, perhaps it is time to let someone else serve as your filter.

Death by Farmville

Wow.

We've seen this story on the news before...a parent shakes a child and it dies. Sad, unfortunate, but also not uncommon. This happened down in Jacksonville, Florida. What makes this sensational is the fact that the mother got upset with the child over it interrupting her playing Farmville.

Facebook's role is being overblown in the media. Notice it is not "Mother Shakes Baby to Death". Headlines seem to be more "Child Dies due to Facebook Game". The focus is put on Facebook. News articles do report she was playing it through Facebook, but Facebook did not create Farmville. You don't have to be on Facebook to use Farmville (Myspace and Twitter also work, as I understand). Putting Facebook in the headlines is sexier than putting Farmville in the headline.

Of course, this is also going to be something people cite when they say Facebook is bad for society. I have a friend who hates Facebook, and I am sure this friend will see this headline and just tie it to Facebook.

Let's be honest. If this woman would shake a baby to death over a Facebook game, she probably have done it over a TV show, or cooking, or a phone call, or any of another thousand reasons.

Link to CBSNews Article

Time Machine: Everything Old is New Again

Some topics of interest from this week's classes.

We discussed the Do Not Call Registry, which was a way to prevent telemarketers from calling you. Someday, we may see a Do Not Email Registry, but I wouldn't expect that for a while. I remember telemarketing being annoying in the 80's, and it took them until 2003 to do anything about it. Here's my original post about how to get on the registry and save yourself from telemarketers.

Second of all, passwords came up in one class this week. Microsoft has a free password strength checker on their Web site, where you can see how strong or weak your password is. Here's the link. We also discussed passwords, and how you can make a better password. I discussed the mnemonic device method for creating and remembering a password in class, and here is my original post on that.

Of course, for people majoring in the IT area, it's always a struggle to find a balance between security and ease of use. If you require difficult passwords, your users may end up writing them on a sticky note, or putting them in a passwords document.