"Massive 'Lurid' APT attack targets dozens of government agencies"

September 26, 2011 | By Roger A. Grimes | InfoWorld

Particularly noteworthy in the Lurid campaign is the ease with which the perpetrators managed to compromise their victims in the first place: They simply used known Adobe Reader exploits and malicious screensavers to infect user machines with malicious downloaders, which in turn connected to the hackers' command-and-control servers to await further instructions. As far as payload went, Trend Micro found that the downloader could install malware as a Windows service. It could also copy itself into the system folder and "ensure persistence by changing the common startup folder in Windows."

Microsoft and Apple both have serious problems with Adobe.

Has Adobe's persistent arrogant disregard for security made it the Ford Pinto of software?

Here are some alternatives...

PDF Readers (use instead of Adobe Reader)

• List of PDF Software

Flash Players (browser plugins to replace Adobe Shockwave Flash)

• LightSpark
• Gnash
• Swfdec (not in active development?)

SWF, Shockwave, Flash

• Discussion of the relationship between SWF, Shockwave, Flash, etc.

"Fed. Government Pays IT Contractors Nearly Twice As Much As Its Own IT Workers"

By Stephanie Overby, CIO, Wed, September 14, 2011

A Comment...

Finally! Somebody crunched the numbers and put them in a form everyone can understand. Now that their small pilot project of the Federal government has proven it can be done, POGO should move on to where the real waste, fraud and abuse is -- State Governments.

Let's summarize...

• Public employees, in all fields, have always been, and probably always will be, paid less than private industry employees doing the same work, with the same experience, and the same level of quality. The trade off used to be better job security, but that is rapidly disappearing with no increase in pay.
  
• For the typical government contractor, its salaries are higher, it has additional staff and resources dedicated to nothing but obtaining and managing contracts, and it has to make a profit.

Where in all that is there room for any cost savings?

Blasphemy Warning!

The mantra that "Anything government can do, private business can do better" is a fraud. It is pure marketing. There is no factual basis for it whatsoever.

Government, like business, has its share of slackers, "creative advancement strategists" and "funding siphoners".

Unlike business, it usually can't keep them hidden for long.

If businesses were required to be as open as government, people would vote to vastly expand government because it does everything far cheaper and most importantly... far more beneficially to you and me.

The Founding Fathers wisely realized (after much heated argument) that our success as a country depended on always maintaining a healthy balance between competing interests. In this case -- government and business.

Business interests on the other hand, have spent the last 235 years dismantling that principal. They've spent the last 30 years constantly screaming "government is too big", though it is far smaller than it needs to be. In doing so, the gargantuan business community has succeded in taking over the country and virtually enslaving (albeit, lavishly) our elected officials.

If all outsourcing were eliminated tomorrow, within 2 years I think we could pay off the national debt and buy Canada (Okay, maybe only British Columbia and the Yukon - so we're contiguous with Alaska.)

But the way things are going, it may be Canada that buys us. (Works for me!)

I don't doubt for a minute that American business would sell if the price were right!

"Google Antitrust Probe to Shed Light on Search"

Fri, September 16, 2011, CIO, By Grant Gross
A Comment...

Looks like there's a coordinated "War on Google" going on.

I just hope Google can hold out till after the next election. If the Democrats win big, these malicious attacks on the most successful American business today will cease. If they don't, everyone at Google should probably just cash out.

The ultra-right has a death-grip on Congress and has proven, without exception, that they will destroy anyone and anything in order to insure that that black man is not reelected. (Google was Obama's #5 top campaign contributor in 2008 according to OpenSecrets.org.)

The current congress cannot be dissuaded from its crusade. To try is a waste of effort.

The only way to take back our country is to vote our conscience.

The disorganized Democrats are a long way from ideal, but history has shown us in horrifying clarity what a well-organized, single-minded group can do to bring the world to the brink of destruction.

Some may complain that my comments are off-topic for this forum. That compartmentalization of our lives is exactly how we got into this mess... refusing to recognize how interconnected everything is.

Who is running the government matters.

At no time in our lives has it been more important to study the issues and the people who are or want to be the people telling us what we can and cannot do.

At no time in our lives has it been more important to stand up to our coworkers, our employers, our friends and stop this insanity.
  

"The cloud hazard no one talks about"

September 19, 2011 By Paul Venezia | InfoWorld

A Comment...

Information management is like transportation.

Mass-transit only works well in very populous areas and with lots of redundancy in the system. That's why most people drive cars.

Cloud computing is "mass-transit" for information.

Local processing is like having your own car.

Cloud computing is a solution desperately in search of a problem. Its marketing appeals to the near-sighted, the cheapskates, the people who never think about disaster planning and have to be rescued, at great risk to others, when it happens.

Reliable systems are built by minimizing variables and risks.

Functionality should be implemented as close to the user as technology allows. Anything above first level (i.e. desktop, laptop, phone, etc.) should be asynchronous with alternatives if all the redundant links are down.

Cloud computing's usefulness is not in reducing costs.

Cloud computing's usefulness is in improved reliability through redundancy.
 

"Space race: The search for 25-year-old spare parts"

September 14, 2011 By Anonymous | InfoWorld

A Comment...

In 1998 I was hired by a state agency rebuilding its computing infrastructure for Y2K. I was part of a team of in-house programmers, database managers and networking gurus, along with consultants expert in our new software, to completely replace a 1970 mainframe system with one running Unix on DEC Alphas.

This was a large, mature, public safety IT operation where "downtime was not an option". Every system alteration was planned meticulously with usually multiple "plateaus", points where we could stop and reassess if necessary. Ideally, a no-go decision at a plateau still left us with some improved functionality. Everything was double and triple-checked and everyone looked over everyone else's shoulder to avoid what could be catastrophic, blurry-eyed bungles (And we liked it that way!).

It was one of those plateaus when we realized there was not going to be time before January 1, 2000 to rewrite the millions of lines of COBOL in the batch programs. (Believe it or not, in 2000 most of the vital data processing done in the world was still done by COBOL batch programs -- and still is!)

So for many years (maybe still?) a lone, black IBM mainframe running MVS and COBOL sat next to 6 new cream-colored DEC Alphas running Unix.

What was the mighty mainframe doing?

It was being an application server running COBOL batch programs that got their data from Oracle on the DEC Alphas.

There are good business/government reasons to stay with 100% reliable old software if it does what you need, instead of upgrading to the latest and greatest, but unavoidably buggy and unreliable. And old software usually requires us to keep old hardware going.

Maybe computers should be more like automobiles. Most cars don't get "upgraded". They are used pretty much as they came from the factory until they no longer do the job and then you buy a new one (or at least, new to you). You can even continue to use the old one in some reduced capacity if you want.

Today, I still love getting new life out of last decade's -- or last century's -- hardware.

(So naturally I run Linux.)
    

"7 IT superheroes -- and their fatal flaws"

September 12, 2011 By Dan Tynan | InfoWorld

A Comment...

Despite the headline's implications, Mr. Tynan's article illustrates that it is when backed into a corner by aggressive superiors that IT "superheroes" often get into trouble.

IT attracts highly intelligent people with low EQs (Emotion Quotients). We range from the socially awkward, through Asperger Syndrome, to somewhere else on the austism spectrum. Successfully navigating human interaction, particularly when it involves a disagreement, may be as terrifying and impossible for us as the average person navigating a computer that has crashed to the command line.

IT people immerse ourselves in computers because humans are too complicated!

IT managers are supposed to be the link between the "normal" people and us "geeks". Their superiors have singled them out from the rest of us and think of them as "geeks with people skills". They are translators.

As such, IT managers tend to be mediocre technologists that build on their strengths in organization, motivation and negotiation to move into management. Management is a body of knowledge all of its own... just as complex as IT if done well. But these people started out to be technologists, and little is more emotionally devastating than to discover you are really not so good at what you want to do. These lingering regrets can leave them less than charitable when trying to motivate their staff.

The best IT managers are those who are able to overcome those regrets. They manage to accept their own limits and pragmatically understand that IT people are always working at their intellectual limits and are depending on those managers to do what they themselves cannot.

Extreme focus on the task is what makes these people "superheroes". But they are like a cameraman with his eye glued to the lens -- they need someone to watch their backs. They need an IT manager who champions their work and defends their honor.

It would take a very skilled and self-reliant individual to successfully swim the moat of crocodiles that surrounds most IT operations. The world on the outside struggles with the very human fear, and thus hate, of what they don't understand and we geeks on the inside live in terror of their wrath.

Too melodramatic?

I thought it was colorful.

Okay, here's the businesspeak translation...

IT is pretty universally hated because nobody understands how unpredictable IT projects are. The complexity and constantly changing technology makes an IT project truly like rebuilding a plane... in flight!

That's what causes all the delays and design compromises. Thus IT people live in constant fear of losing their jobs to someone more naive or more arrogant who will promise eager CEOs and managers whatever they want to hear, then deliver smoke and mirrors, take their promotion and be gone leaving a skeleton "maintenance" staff to actually implement the difficult parts of the task.

"Superheroes" are, by definition, different.

Capitalizing on their talents just requires a little "MacGyverism"... using what you have to accomplish your goals. In this case, adapting the organization to the collection of talent rather than trying to force the talent into a rigid organization that was never optimal anyhow.

CatEyesPromotions.us...The ccTLD ".us" is not just for government.

Got an email today signed...

Cat Gregory

Licensing Examiner

Charitable Bingo Operation Division

Texas Lottery Commission

It was written as if "Cat" knew me and was talking about someone "we" knew who had to evacuate due to wildfires.

What got me suspicious, aside from the fact I had no idea who this person was, was the email address they gave in the text of "Cat@CatEyesPromotions.us". No quotes. It was an email link.

Notice the ".us"!

My research found dozens of hits on Google for various promotions-like sites of all different kinds. If you're interested, here's the Google search results.

The top level domain ".us", which is the registered country code Top Level Domain (ccTLD) for U.S. city, county, state and federal government entities, can actually be registered by anyone.

Any U.S. citizen, organization, company, or foreign company "with a bona fide presence" in the U.S. can use ".us".

You don't see too many non-government ones though. The most widely recognized is probably del.icio.us. There is an official naming convention for government use of ".us", but then many agencies still use .gov (which is restricted) or .com which is just more confusing.

Is it deceptive to allow most anyone to use ".us"?

On the other hand, lots of people depend on the country code TLD for other countries in judging the safety of a link before clicking.

Is this "profiling"?

Yes.

Is it justified?

I don't know. Fodder for another post maybe?

Now, this person may very well be really named "Cat Gregory", work for the Texas Lottery Commission as well as "CatEyesPromotions.us" and just sent her email to the wrong person.

However, given the Internet's "target rich environment" for fraud, theft and otherwise malicious "entrepreneurship", caution would seem prudent.

Comments pro or con?

Reference

• Full list of Top Level Domains (TLDs)

"HP transfers WebOS from the PC group: The game's afoot" (#2)

September 5, 2011 By Galen Gruman | InfoWorld

A Comment to the comment "programmers have tunnel vision"...

"The developer personality" unsettling to you?

What unsettles us the most about others are usually traits we worry about in ourselves.

The authoritarian, aggressive fanatics running our congress make my head explode daily. Probably because I've struggled all my life to control my own authoritarian, aggressive (though very liberal) tendencies.

For all their abilities, computers are incredibly stupid.

The level of minutia required to be a programmer is incomprehensible to most "normally adjusted" people. It takes an introvert or Asperger's sufferer to excel at software development.

Good human interaction depends on countless assumptions of intent, context, and definition.

Computer languages and environments have entirely different characteristics. Even though they're based on English, they are so different from it, and different from each other, that "being fluent" in any of them uses up most of the person's thinking capacity. If you can speak English and program in BASIC, you are truly "bilingual".

Thus, a person who "communicates well in the real world" and then tries programming, seldom masters it. They may gain competency in one or more languages, but they're never fully comfortable. They often eventually move into documentation, QA, or management and provide the vital link between developers and everyone else.

Think about all those "team of misfits" stories though...

Almost all of the world's activity is built upon the great achievements of misfits. Be they individual geniuses like Edison and Einstein or teams where each member excels in some needed skill but may be quite deficient in other ways.

The great leaders of these teams have been good communicators, secure in their own strengths and un-threatened by their team members' superior abilities in other areas. They excel in their ingenuity in assembling these misfits to actually "fit" together in unique ways that create a team more capable than the norm.

So when you get frustrated with a developer's pendantic arrogance and cluelessness of how what their saying affects others, put them on your next team! You have the ability to learn to communicate with them because you understand human interaction in ways they cannot. In turn, they have the ability to make computers do things you can only dream of... so tell them your dreams. Chances are, the coding will be trivial.

Now that ridiculously simple feature you want? That will probably tax their talents to the limit... which they'll love! Why will it be so hard? That's another story.

"HP transfers WebOS from the PC group: The game's afoot"

September 5, 2011 By Galen Gruman | InfoWorld

A Comment...

There is enough technical merit in WebOS and its Palm legacy that it's very unlikely to fall out out of use entirely unless HP kills it by holding on to it in a misguided effort to enhance the company's assets value.

That said, WebOS as a revenue source for HP is a non-starter.

There are only three ways to realize WebOS's value...

• Used in an innovative new product -- as it was designed to do.
  
• Sold for any patents it may have (sadly, reality vs. the future -- End Software Patents).
  
• Release as open-source and gain hundreds of volunteer developers, documentors, project-managers and promoters. They will incorporate the best of WebOS into Android, Linux, and other open-source-friendly software, thus growing its market. This larger market will produce product opportunities HP can take advantage of before competitors because of its continuing active involvement in the open-source development.

"Earth to developers: Grow up!"

September 01, 2011 by Neil McAllister | InfoWorld

A Comment...

Each language has its own strengths.

Forth taught me bottom-up programming. Pascal taught me structured programming. C taught me linked-lists and pointers. SQL taught me declarative and top-down programming. C++ and Javascript taught me object-oriented/based programming. I've learned countless other indispensable techniques working in dozens of other languages (often not by choice I might add).

If you're a programmer -- that is, if you cannot go very long without feeling compelled to program something -- then learning a new language is like a cabinet-maker getting a new tool or a composer hearing an exciting progression he's never heard before. You immediately start cogitating the possibilities: problems you can solve more elegantly, features that now become practical to implement.

Every programmer brings to a project a different set of experiences and skills. The most successful projects are the ones that take advantage of those strengths.

To be sure, choice of tools is still largely dictated by organizational concerns like licensing, maintainability and compatibility with existing systems. But programming has reached a level of maturity where there are usually a number of different tools that can be used to accomplish the same goals. Thus, there are fewer valid arguments to use a given tool exclusively.

Perhaps it then could be said that...

Good programmers are experts in using their tools.

Great programmers are experts in choosing their tools.

Let's all grow up and accurately access our own abilities, then work to mesh those abilities with others to produce the best software we can.

"Linux Foundation chief: 'You are an idiot' if you don't give back to open source"

August 30, 2011 By Julie Bort, Network World, InfoWorld

A Comment...

Until Linux and the Open Source concept came along, software development followed the "industrialization" model of change typified by the classic "waterfall" development process (plan, specify, build part 1, build part 2,..., test, deploy). Despite no project ever successfully being completed that way, that's how they were approached.

The astronomical advances in microprocessing wrought by Kennedy's space program intersected with that reality late in the last century to make iterative development (plan, build, test, repeat till works, deploy, fix/update, redeploy, repeat ad infinitum) actually sound practical. Which was great given that all software development had always been done that way (though none could bring themselves to speak such anarchist blasphemy).

Linux however, like capitalism, is a human-created system based on an "evolutionary" model of change.

In nature, genetics and environment interact to produce near-infinite diversity, thus providing many "mutations" that are better suited to the new conditions.

So too in business. Though most businesses fail, things are learned by those failures which result in creating better new businesses.

The comparatively limited planning of Linux projects results in greater innovation and software better adapted to task. Development is driven by functional necessity, peer-review and reliability (cause programmers really hate repeated debugging) rather than rapid development.

Think cabinet-maker verses assembly-line shelving.

Canonical is trying to succeed by "industrial computing" rules in an "evolutionary computing" world. An almost impossible task (see Microsoft). And they don't have hardware sales to pay the bills while they try to monetize "free software" (see IBM).

The next IBM, Apple or Microsoft will be the company that figures out how to measure, and thus monetize, "value" in this new paradigm. Google is the most promising at the moment, but so far has only been able to make money (albeit: A lot!) selling tickets to the spectacle. IBM and Apple have seen the future but aren't entirely sure how to get there from here.

Microsoft -- Well, I doubt that the dinosaurs were even aware of the existence of those little burrowing mammals except when one went squish between their toes. We know how that turned out.