January, 2009

Overheard - Who’s not ready for DTV?

This is a surprise: Baby Boomers and older Americans are better prepared for the switch over to digital television than younger people. Paul Briand, Baby Boomers better prepared for TV switch

Nielsen said it measured the preparedness for the upcoming transition to all-digital broadcasting and how many households would be unable to receive any television programming at all if the transition occurred on Jan. 22, the day of the survey’s posting.

It said 4.0 percent of Americans 55 and older were unready for the transition, while 8.8 percent of Americans 35 and younger were not prepared.

According to Nielsen, a total of 6.5 Americans (5.7 percent) aren’t ready for the switch to digital television, which is scheduled for Feb. 17.

For the life of me, I don’t understand why our Senate voted to delay the switch to digital TV.

Overheard - Wikimedia and Mozilla hook up to shake up

Today, video and audio on the web are dominated by proprietary technologies, most frequently patent-encumbered codecs wrapped into closed-source player widgets. Wikimedia and Mozilla want to help to build a web where video and audio are first class citizens: easy to use and manipulate by anyone, without compulsory royalty schemes or other barriers to participation. Erik Möller, Mozilla and Wikimedia Join Forces to Support Open Video

Mozilla and Wikimedia share a strong commitment to open standards. Version 3.1 of the Mozilla Firefox web browser will include built-in support to play audio and video in the open source Ogg Vorbis and Ogg Theora formats. All audio and video in Wikipedia is stored in these formats.

This is interesting. Mozilla gave $100,000 to the Wikimedia Foundation to “help coordinate improvements to the development of Ogg Theora and related open video technologies.”  That’s not a lot of money, but it’s generating a lot of buzz because it’s a step towards open video standards.  Christopher Blizzard (Mozilla) does a nice job explaining how a better Ogg would potentially open up the market for streaming video and knock both Adobe (Flash) and Microsoft (Silverlight) off their proprietary thrones.

Ogg isn’t a file format — it’s a container format.  What’s that? Well, when you order something from Amazon, it’s put in a box and the UPS guy delivers the box to your house.  On the Web, when you order a streaming video, think of Ogg as the virtual box that’s used to deliver the video to your computer.   Wikipedia has a handy chart that compares container formats.

Overheard - Viral marketing at its best

Celeb Choreographer Ashley Wallen took the dancers through an intensive 80 hour rehearsal to ensure they nailed the performance as they could only film a single take. Commuters stand and watch in amazement as the routine gets going and many can be seen taking pictures on their phones still unaware of what is happening around them. Karl Walderman, T Mobile Liverpool Street Station flashmob ad storms YouTube

By now you’ve probably heard about the T-Mobile flashmob at the Liverpool train station.  What a brilliant piece of marketing.

Here’s the official press release.

Overheard - Switching operating systems is like going to Burger King and trying to order a Big Mac

People encountering Ubuntu for the first time will find it very similar to Windows. The operating system has a slick graphical interface, familiar menus and all the common desktop software: a Web browser, an e-mail program, instant-messaging software and a free suite of programs for creating documents, spreadsheets and presentations. Ashlee Vance, A Software Populist Who Doesn’t Do Windows

There’s a big blogswarm right now about about whether or not Ubuntu is easy to use.

It all started when a college student in Madison Wisconsin bought a Dell laptop for a distance learning class and the computer arrived with Unbuntu Linux as the operating system.  She was not a happy customer because she wanted Windows — so she went to the local TV station to get some help. The story got picked up by Digg and by Slashdot and Linux bloggers everywhere and the poor girl was bombarded with hate comments.

I’m just not getting it.

Is this an Ubuntu story?  Or is it a dissatisfied customer story?  It’s certainly NOT a story about how girls are stupid idiots and should not be allowed near a laptop running Linux.  But that’s what you might think from reading some of the trash floating around the blogosphere.

Sure, Ubuntu might look like Windows — but hey guys, does it work exactly like Windows?  That is, can you really expect the average college kid who’s grown up using Windows to open a laptop running Ubuntu without a hitch?  Apparently someone at Dell tech support thought so.  That is until he started getting blaimstormed in the media for ending this Wisconsin student’s college career.

The whole thing is kind of silly.  It’s not the girl’s fault, it’s not the tech support guy’s fault and it has nothing to do with Ubuntu.

You’d have the same problem if you asked a Windows’ user who’s never used a Mac to start work tomorrow using  OS X . There are going to be some moments of confusion and getting lost.  It would be silly to presume otherwise. Yeah, the basics are still the same, but things are put in different places and tools are called by different names.  It’s just OS culture shock.  You have a panic attack and you get over it. That’s all that happened to that poor girl in Wisconsin.

The real story here is “What is Dell doing shipping laptops with Ubuntu as the default OS?”

Aha! Now THAT’S an interesting story.  You see, Mark Shuttleworth — who describes himself as a billionaire, bachelor and ex-cosmonaut — has teamed up with Dell to make Ubuntu the operating system of choice for low-end laptops.  And he’s not doing it for the money. He’s doing it because he likes the challenge.  (And what’s more challenging than selling something the customer can get for free?)

His company’s name is Canonical.  According to New York Times it’s worth $30 million right now. Keep an eye out for Mark Shuttleworth.  Like Bill Gates, he’s an intriguing mix of businessman-humanitarian.  Mark Shuttleworth is going to be a very interesting personality to follow as the world’s economy recovers from the Crash of ‘08.

Overheard - What color is your meter MAID? Green

Data center managers are starting to recognize that 70 percent to 90 percent of their data is not transactional in nature, but rather, persistent data that is rarely changed, and infrequently accessed…The key to managing persistent data is to deploy storage systems that are tuned specifically to its needs. One technology that is ideally suited for persistent data is MAID (Massive Array of Idle Disks) storage. Will Layton, Getting Ahead of the Data Storage Energy Crisis: The Case for MAID

Tonight I’ve been reading about MAID and how it can help cut energy costs in the data center by limiting the number of spinning disks.  This week’s buzzword (besides Obama) seems to have been “intelligent power management.”

Ironically, according to a CDW Corp. report titled “Energy Efficient Information Technology,” 94 percent of IT executives with purchasing responsibility said they cared about energy efficiency but had no idea how much energy their IT operations used — even though they realized that that knowledge is critical to energy reduction efforts.  CDW should have sent them all this list of low-hanging-fruit energy savers from SearchSMBStorage.com

Overheard - Confliker / Downadup worm alert

Security vendors from across the spectrum have warned that a stingy worm has been successfully exploiting a hole in Microsoft Windows server service. Known as Confliker or Downadup, the worm spreads by exploiting a remote procedure call (RPC) vulnerability. Robert Westerfelt, Confliker, Downadup worm hype? Get the facts

There’s a new variant of the Conficker worm. It’s known as ‘Downadup.’ Microsoft issued a patch for the worm last October but it’s still spreading and mutating.

The worm, which some authorities say has been able to build the largest botnet on record,  works by exploiting a vulnerability in remote procedure calls that allows remote code to be executed once a vulnerable machine receives a specially crafted RPC request.  In plain English, this means that if an end user views a specially crafted Web page using Internet Explorer, his computer will request malicious code to be executed. Like many of its malicious predecessors, this worm denies infected machines Internet access to security vendor websites.

Microsoft added routines to clean up Conficker infections to the January edition of its Malicious Software Removal Tool.  Customers in the U.S. and Canada can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates. The National Cyber Alert System recommends that to prevent further infections by infected USB devices, users should disable the Windows auto-play feature.

Overheard - Amrit Williams’ open letter to President Obama

Implementing a compliance program is only as effective as its controls are at identifying deviations from desired states. Since computers tend to quickly drift from desired good states in the absence of continuous assessment and correction, static compliance efforts that assess and enforce compliance at discrete points in time program are ineffective. Amrit Williams, Open Letter to Barack Obama: Securing Critical Infrastructure - The First 90 Days

It’s quite a day here!

Overheard - Security and the SSL VPN

Despite the popularity of SSL VPNs, they are not intended to replace Internet Protocol Security VPNs. The two VPN technologies are complementary and address separate network architectures and business needs. William Jackson, quoting from Special Publication 800-113

I started to add to a short definition we have for FIPS - Federal Information Processing Standard - to promote our newest site, SearchCompliance.com and somehow I got turned around and started reading about SSL VPNs.  (Somewhere in my reading I discovered that Federal agencies deploying SSL VPNs have to configure them to only allow FIPS-compliant cryptography and SSL.)

What got my attention was a blog post by someone named Shakya about how SSL VPNs are vulnerable to man-in-the-middle attacks. The reason? Because many SSL VPNs weren’t built with wireless in mind.  Shakya does a really good job explaining the vulnerability in simple terms.  His blog is not for the faint of heart, but it reinforces this warning — never check your bank account balance at Starbucks!

Circling round again to SSL VPNs, the Department of Commerce put out a Guide to SSL VPNs last summer.  It’s really well written. If you are making a business case for implementing an SSL VPN or you’re an admin who needs help with documentation for the business side, I suggest you take a look.  As the report from  points out, an SSL VPN is not a magic security bullet.  There are still many instances when a VPN application installed on the end-user’s computer is the way to go.  Not everything will be done in the cloud.

Overheard - JBoss is Red Hat’s golden goose

Red Hat’s JBoss business is growing twice as fast as its Linux business, and it delivers $10 in consulting fees for every $1 in subscription revenue. This means that JBoss is much more interesting to Red Hat’s channel than Red Hat Enterprise Linux is. It also means that JBoss should be the foundation for Red Hat getting into the application business in earnest. Matt Asay, Red Hat: JBoss growing twice as fast as Linux

JEMS is available from Red Hat through subscriptions that include certified software, support, updates and patches, documentation and multi-year maintenance policies.

Note: I’m starting to hear “cloud services” being called “middleware” again.  Cloud computing = middleware as a service (MaaS)?  I don’t think it’ll stick.  The acronym is pronounced Mass and will just remind the user that when his stuff is in the cloud and he’s given up all that control,  he’d better pray.

Overheard - Data leak prevention market is hot

DLP, once seen as a quick-fix solution for reducing data breaches, is rapidly being recast as a core strategy for discovering sensitive information in the enterprise and controlling access to it. As that evolution occurs, DLP is increasingly becoming the spark that restarts previously stagnant data encryption projects. Tim Wilson, Encryption: DLP’s Newest Ingredient

DLP stand for data leak or data loss protection. It’s a more popular product name with vendors than the old name they tried in 2007, extrusion protection.  (What an awful name!)   As DLP products have evolved and been integrated with other security tools like desktop and mobile device management, DLP vendors have tried out other names including the very silly name, anti-employee theft prevention (who would want to steal an employee?).

But seriously,  the goal of any DLP product is to plug leaks by monitoring and documenting data as it leaves an organization.

In the past, you’d only find a DLP product at a network gateway in a large corporation.  Services industries, healthcare and insurance quickly jumped on the DLP bandwagon, motivated by compliance regulations –  but increasingly vendors are targeting the mid-market.  Forrester predicts that 20% of all small and mid-sized businesses (SMBs) will be shopping for a DLP solution in the next 12 months and 25% have already adopted email encryption, network storage encryption and data leak prevention.