|
Please Note: Archived information (e.g. below) may become out of date. How
To Subscribe and Unsubscribe is at the end of this note. Please email the LangaList to a friend! (Use this super-fast form !) The LangaList2-May-99 In This Issue:
Intels PIII Serial Numbers Get HackedI hate to say "I told you so" but, Intels lame "processor serial number" scheme has already been broken, with potentially dire consequences for your online privacy. In my column in the current issue of WinMag, I wrote about Intel's embedding an individual "processor serial number" (PSN) in each Pentium III (PIII) chip. (See "Chipping Away at Our Privacy" at http://content.techweb.com/winmag//library/1999/0501/ana0008.htm ) The PSN is a 96-bit ID that can identify the user's PC to any software that knows how to request it. The PSN has many legitimate uses, but it also is a fabulous way to track---stealthily!---who you are and what you do on the web and with your software. In the above-referenced column I wrote, "When these chips become common, software makers could use the PSN to record on which machine a particular application had been installed. Sure, this could reduce piracy, but it also could cause problems if you legitimately wanted to move your apps to, say, a new machine .Online, Web sites could access the PSN to let in---or block out---people using a particular PC, even if they changed their names, ISPs or software." In short, the PSN could be used to learn all about what software you use, what web sites you visit, and so on. Intel downplayed the significance of the potential privacy intrusion, but quietly responded to privacy concerns with a software patch that supposedly disables the PSN until and unless the user---you and I--- turn it on. At least, that was the theory. But in the column referenced above, I quoted cryptographer Bruce Schneier as saying of the PSN: "[A] system is only as secure as the smartest hacker. All it takes is for one person to defeat the tamper resistance. There's always someone who manages to unravel the protection ... This won't be any different." And it wasnt: Last week, a company called "Zero Knowledge" found a way to access the PSN even if youve turned it off. Their trick is to use an ActiveX control; the control extracts the PSN and stores it in a Cookie. Note that Zero Knowledge isnt doing anything wrong. Theyre simply demonstrating the security vulnerability created by the PSN; Zero Knowledge doesnt do anything with the numbers it could collect, and is totally up front about what it is doing, and why---there is no subterfuge involved whatsoever. Still, you wont believe how Intel reacted to this demo program. If you have, or think that someday you ever might want a PIII-based PC, you owe it to yourself---and your privacy---to learn all you can about the Processor Serial Number fiasco. Start with the article referenced above, and then click over to the WinMag BBS area this week: I'll provide a ton more detail, links for the PSN-sniffing demo, quotes from the developers of the applet, and Intels very, very strange response. The column will go live around midday (UT-4) on Monday May 3 1999 at http://content.techweb.com/winmag/ , and the ensuing discussion will run all week. Join in! BrowserTune ProgressI spent last week deep in the guts of the BrowserTune2000 demo. The result---version b1.8---will be available around midday (UT-4) on Monday May 3. If youre new to the LangaList: BrowserTune is a free, highly-popular series of safe, noninvasive web pages that puts your browser through its paces to ensure that everythings working properly. The current full version is BrowserTune98 ( http://www.browsertune.com/bt98 ) and the newest version is BrowserTune2000 , or "BT2K." BT2K is available in demo form at http://www.browsertune.com/bt2kdemo/ , with a full beta to be released soon. The most obvious change to BT2K this week is that Ive incorporated the JavaScript "Math Error" test into the automated portion of the series. Surprisingly, many browsers are worse at correcting rounding errors than a $5 throwaway drug-store calculator! That gives you something to think about when youre doing things like ordering merchandise online, using online tax-preparation software, and the like. But the larger change to BT2K this week is less visible: Its changing the demo pages to an internal format that will allow me to "hook in" the demo to the rest of the BrowserTune site at the appropriate time. I use FrontPage for much of that gruntwork--- the handling of style sheets, buttons, indices and so on. But I hand-code all the actual tests myself in order to avoid introducing any FrontPage weirdnesses or dependencies into the tests. So, once the tests are stable and working, I then can layer in the FrontPage stuff in a way that lets me manipulate the pages more easily, but without altering the hand-coded tests in any way. The upshot of which is simply that BT2K is on track, and getting better every week! If you havent checked it out, or if you ran any version earlier than v1.8, check out the new version starting midday May 3 at http://www.browsertune.com/bt2kdemo/ !(And by the way, if you missed the discussion of the browser math errors in last weeks issue, click over to here: http://www.browsertune.com/bt2kdemo/matherror.htm .) Microsoft Gouges DeeperOK, now Im getting really steamed. Last December in "For-Pay Betas: Benefit Or Boondoggle?" ( http://www.informationweek.com/langaletter/121698langa.htm ), I wrote about Microsofts increasingly frequent practice of charging for betas under the guise of "preview" programs. I wrote how a beta program used to involve the limited distribution of
preliminary code to a relatively small group of trusted individuals or
organizations. The beta testers would help find real-world bugs and report these
back to the software publisher so the bugs could be corrected before the final
"gamma" code was frozen and released. For example, last week Microsoft announced a "Corporate Preview Program" for Windows 2000. (W2K is, of course, in the manner of the singer Prince, "The Operating System Formerly Known As NT5.") In it, youll get two CDs of unfinished beta code--- blank CDs cost under a buck each. Youll get some manuals (OK, paper and printing isnt cheap), an email newsletter (negligible cost, and its probably marketing propaganda anyway), and some limited tech support. What do you think Microsoft is charging? Would you believe over $100? Ill tell you all the details in my InformationWeek column this week. But the upshot is that I think this is bizarre and even a little grotesque. Microsoft is one of the most profitable companies in the world, and yet theyre now charging more just to get a look at a buggy beta preview than Microsoft's competitors charge for final, shipping code! For example, SUSE is releasing Linux 6.1 on May 3, and their full, final version will cost just $50; less than what Microsoft wants to charge you for a preview of their unfinished code. What possible justification can Microsoft have for this? I can only think of one: greed. But thats my opinion. Come get the rest of the details, and then tell us whats your take: Will you or your company use the Win2K for-pay preview? Have you used other for-pay betas? Is it a reasonable way to do business, or just a way to gouge the users? Join in the free and wide-open discussion starting Wednesday May-5-99 at http://www.informationweek.com/langaletter ! Still More On The "Continuous Operation Bug"Im still getting mail about the "Continuous Operation Bug" I mentioned two weeks ago. This is a weird one in which a Windows computer will hang after precisely 49.7 days of continuous operation. The culprit is a bad timing algorithm in the Vtdapi.vxd file. Many readers went to the Win98 Windows Update site to grab the most recent version of the Vtdapi.vxd file, but found the menu there didnt offer them the option of downloading whats called the "Continuous Operation Bug Fix." If you went to the site and didnt see the option, thats because you dont have the bug. The Vtdapi.vxd bug is mainly a Windows 95 issue; if youre running a correctly-installed version of Windows 98, for example, your system wont have the Vtdapi.vxd on it. No file, no bug. You can use the Start/Find utility to search for Vtdapi.vxd. If youre running Win98 and its not there, dont worry. If youre running Win95, the correct (fixed) version of the file will have these characteristics: Date Time Version Size File name If youre running an earlier version of the file, check out this page for details on the fix: http://support.microsoft.com/support/kb/articles/q216/6/41.asp . Broken Link?Several readers sent email in the last few weeks like this one from Henry M. Willits:
Thanks Henry (and all others who wrote). Actually, the page is fine; its that some mail readers need a space after a URL in order for them to correctly parse it. Without the space, they tack on the punctuation to the URL, rendering it meaningless. Ive edited the URL in the newsletter template to insert a space; the link should now work on any email reader. And: Id sincerely appreciate it if you each could recommend this newsletter to at least one friend. Its fast, its free, its easy, and seeing the subscriber list grow from week to week is a wonderful thing! Do you know one other person who might find this newsletter interesting or useful? Click on over to http://www.langa.com/recommend.htm#2 to see just how easy it is to send them a free copy, in your name. Thanks! Conflicting Views on Virus Checkers: Part OneLast weeks warning about the Chernobyl Virus generated a lot of mail. Many were like this one from reader Judy Protas:
Well, Im glad to help, Judy, but theres no "staff" here. Its just me--- Im a freelance writer, working alone. I personally use Norton 4.0. I have no particular reason to upgrade, since this version is still fully supported by Symantec, and Im still eligible for free weekly antivirus updates. I use Windows Task Scheduler to run Norton AV every day at 6AM, and it thus catches any viruses that may have crept in during the last days work. This, plus the fact that Im a fanatic about backing up my work, keeps me sufficiently safe without having to go nuts with antivirus software that's always on and active in the background. For other (more recent) antivirus options, check out Windows Magazines "Recommended List." (See http://content.techweb.com/winmag/ ) It always has up-to-date evaluations of all the major classes of hardware and software, including antivirus applications.Conflicting Views on Virus Checkers: Part TwoReader and frequent writer Lanny Marcus (in Cali, Colombia) takes a different view. He writes:
So there is something to be said for anti-virus checkers that sniff every bit and byte coming in through the wires: they prevent damage before it can happen. But the price is that youll have an extra process running on your PC all the time, eating some clock cycles and memory. Its up to you--- and Lannys way does offer a higher degree of protection than mine. But the one thing you shouldnt do is NOT use some form of virus protection. Its a nasty world out there, full of all kinds of weird and wacko people. You owe it to yourself to install at least a minimal level of anti-virus protection on your PC. Navigator/Communicator JavaScript Bug?Several readers using the 4.51 version of Netscapes browser have reported finding pages where embedded JavaScript markup code---which should be hidden---is being displayed on web pages they visit. From the code snippets theyve sent me, it looks as through the browser is missing or misinterpreting the "comment" tags web authors use to hide their JavaScript. For example, reader Waldo Hamilton said a CMP page showed him this:
All that is JavaScript thats part of CMPs ad-banner rotation system. The code itself should not display. With only a couple cases reported, its too soon to draw conclusions, but its interesting that all the instances, so far, have involved Navigator/Communicator 4.51. Stay tuned! Just For Grins: Safe FaxSeveral readers sent me the following, which appears to have originated at the "Just Joking" list at JustJoking-Subscribe@egroups.com :
See you next issue!
Best, Fred( fred@langa.com ) (P.S. Please email the LangaList to a friend! Use this super-fast form !) An easier-to read formatted HTML version is available in the "what's new" section of http://www.langa.com . All past LangaList issues are also available via the same link.
Why are you getting this newsletter? There are only two ways to get on the list (direct email request or via the WinMag mail list signup page) so if you're getting this newsletter; your name came to me through one of those channels. SUBSCRIBE (it's free!): Send email to subscribe-langalist@lyris.dundee.net
|
Please Note: Archived information (e.g. below) may become out of date. |