Please visit the LangaList Home Page

Please Note: Archived information (e.g. below) may become out of date.


How To Subscribe and Unsubscribe is at the end of this note.
Mailing List Trouble? See http://www.langa.com/help.txt
Want an easier-to read formatted HTML version? See http://www.langa.com/whats_new.htm

Please email the LangaList to a friend! (Use this super-fast form !)

The LangaList

2-May-99

A Free Email Newsletter from Fred Langa About BrowserTune,
HotSpots, Columns, Tips & Tricks, and Other Activities

In This Issue:
Privacy Risk!: Intel's P3 Serial Numbers Hacked
BrowserTune Progress
Microsoft Gouges Deeper
Still More On The "Continuous Operation" Bug
Fixing a "Broken" Link
Confllicting Views On Virus Checkers: Part One...
...And Part Two
Navigator/Communicator Bug?
Just for Grins
More!

 

Intel’s PIII Serial Numbers Get Hacked

I hate to say "I told you so" but, Intel’s lame "processor serial number" scheme has already been broken, with potentially dire consequences for your online privacy.

In my column in the current issue of WinMag, I wrote about Intel's embedding an individual "processor serial number" (PSN) in each Pentium III (PIII) chip. (See "Chipping Away at Our Privacy" at http://content.techweb.com/winmag//library/1999/0501/ana0008.htm ) The PSN is a 96-bit ID that can identify the user's PC to any software that knows how to request it.

The PSN has many legitimate uses, but it also is a fabulous way to track---stealthily!---who you are and what you do on the web and with your software. In the above-referenced column I wrote, "When these chips become common, software makers could use the PSN to record on which machine a particular application had been installed. Sure, this could reduce piracy, but it also could cause problems if you legitimately wanted to move your apps to, say, a new machine….Online, Web sites could access the PSN to let in---or block out---people using a particular PC, even if they changed their names, ISPs or software."

In short, the PSN could be used to learn all about what software you use, what web sites you visit, and so on.

Intel downplayed the significance of the potential privacy intrusion, but quietly responded to privacy concerns with a software patch that supposedly disables the PSN until and unless the user---you and I--- turn it on. At least, that was the theory. But in the column referenced above, I quoted cryptographer Bruce Schneier as saying of the PSN: "[A] system is only as secure as the smartest hacker. All it takes is for one person to defeat the tamper resistance. There's always someone who manages to unravel the protection ... This won't be any different."

And it wasn’t: Last week, a company called "Zero Knowledge" found a way to access the PSN even if you’ve turned it off. Their trick is to use an ActiveX control; the control extracts the PSN and stores it in a Cookie.

Note that Zero Knowledge isn’t doing anything wrong. They’re simply demonstrating the security vulnerability created by the PSN; Zero Knowledge doesn’t do anything with the numbers it could collect, and is totally up front about what it is doing, and why---there is no subterfuge involved whatsoever. Still, you won’t believe how Intel reacted to this demo program.

If you have, or think that someday you ever might want a PIII-based PC, you owe it to yourself---and your privacy---to learn all you can about the Processor Serial Number fiasco.

Start with the article referenced above, and then click over to the WinMag BBS area this week: I'll provide a ton more detail, links for the PSN-sniffing demo, quotes from the developers of the applet, and Intel’s very, very strange response. The column will go live around midday (UT-4) on Monday May 3 1999 at http://content.techweb.com/winmag/ , and the ensuing discussion will run all week. Join in!

return to top of page

BrowserTune Progress

I spent last week deep in the guts of the BrowserTune2000 demo. The result---version b1.8---will be available around midday (UT-4) on Monday May 3.

If you’re new to the LangaList: BrowserTune is a free, highly-popular series of safe, noninvasive web pages that puts your browser through its paces to ensure that everything’s working properly. The current full version is BrowserTune98 ( http://www.browsertune.com/bt98 ) and the newest version is BrowserTune2000 , or "BT2K." BT2K is available in demo form at http://www.browsertune.com/bt2kdemo/ , with a full beta to be released soon.

The most obvious change to BT2K this week is that I’ve incorporated the JavaScript "Math Error" test into the automated portion of the series. Surprisingly, many browsers are worse at correcting rounding errors than a $5 throwaway drug-store calculator! That gives you something to think about when you’re doing things like ordering merchandise online, using online tax-preparation software, and the like.

But the larger change to BT2K this week is less visible: It’s changing the demo pages to an internal format that will allow me to "hook in" the demo to the rest of the BrowserTune site at the appropriate time.

I use FrontPage for much of that gruntwork--- the handling of style sheets, buttons, indices and so on. But I hand-code all the actual tests myself in order to avoid introducing any FrontPage weirdnesses or dependencies into the tests. So, once the tests are stable and working, I then can layer in the FrontPage stuff in a way that lets me manipulate the pages more easily, but without altering the hand-coded tests in any way.

The upshot of which is simply that BT2K is on track, and getting better every week!

If you haven’t checked it out, or if you ran any version earlier than v1.8, check out the new version starting midday May 3 at http://www.browsertune.com/bt2kdemo/ !

(And by the way, if you missed the discussion of the browser math errors in last week’s issue, click over to here: http://www.browsertune.com/bt2kdemo/matherror.htm .)

return to top of page

Microsoft Gouges Deeper

OK, now I’m getting really steamed. Last December in "For-Pay ‘Betas’: Benefit Or Boondoggle?" ( http://www.informationweek.com/langaletter/121698langa.htm ), I wrote about Microsoft’s increasingly frequent practice of charging for betas under the guise of "preview" programs.

I wrote how a beta program used to involve the limited distribution of preliminary code to a relatively small group of trusted individuals or organizations. The beta testers would help find real-world bugs and report these back to the software publisher so the bugs could be corrected before the final "gamma" code was frozen and released.

But just as it's done in so many other areas, Microsoft has turned that around. They’ve scaled back their true, classic betas, and in parallel offered the beta code to all comers in something called a "preview" program.

For example, last week Microsoft announced a "Corporate Preview Program" for Windows 2000. (W2K is, of course, in the manner of the singer Prince, "The Operating System Formerly Known As NT5.") In it, you’ll get two CDs of unfinished beta code--- blank CDs cost under a buck each. You’ll get some manuals (OK, paper and printing isn’t cheap), an email newsletter (negligible cost, and it’s probably marketing propaganda anyway), and some limited tech support. What do you think Microsoft is charging?

Would you believe over $100?

I’ll tell you all the details in my InformationWeek column this week. But the upshot is that I think this is bizarre and even a little grotesque. Microsoft is one of the most profitable companies in the world, and yet they’re now charging more just to get a look at a buggy beta preview than Microsoft's competitors charge for final, shipping code!

For example, SUSE is releasing Linux 6.1 on May 3, and their full, final version will cost just $50; less than what Microsoft wants to charge you for a preview of their unfinished code. What possible justification can Microsoft have for this? I can only think of one: greed.

But that’s my opinion. Come get the rest of the details, and then tell us what’s your take: Will you or your company use the Win2K for-pay preview? Have you used other for-pay betas? Is it a reasonable way to do business, or just a way to gouge the users? Join in the free and wide-open discussion starting Wednesday May-5-99 at http://www.informationweek.com/langaletter

return to top of page

Still More On The "Continuous Operation Bug"

I’m still getting mail about the "Continuous Operation Bug" I mentioned two weeks ago. This is a weird one in which a Windows computer will hang after precisely 49.7 days of continuous operation. The culprit is a bad timing algorithm in the Vtdapi.vxd file.

Many readers went to the Win98 Windows Update site to grab the most recent version of the Vtdapi.vxd file, but found the menu there didn’t offer them the option of downloading what’s called the "Continuous Operation Bug Fix."

If you went to the site and didn’t see the option, that’s because you don’t have the bug. The Vtdapi.vxd bug is mainly a Windows 95 issue; if you’re running a correctly-installed version of Windows 98, for example, your system won’t have the Vtdapi.vxd on it. No file, no bug.

You can use the Start/Find utility to search for Vtdapi.vxd. If you’re running Win98 and it’s not there, don’t worry.

If you’re running Win95, the correct (fixed) version of the file will have these characteristics:

Date Time Version Size File name
------------------------------------------------
6/23/98 2:44pm 4.00.951 18,570 Vtdapi.vxd

If you’re running an earlier version of the file, check out this page for details on the fix: http://support.microsoft.com/support/kb/articles/q216/6/41.asp .

return to top of page

Broken Link?

Several readers sent email in the last few weeks like this one from Henry M. Willits:

Subject: Error in Link

You need to correct the following link in the Langalist:

>Please email the LangaList to a friend! (Use the super-fast form at http://www.langa.com/recommend.htm#2 !)

This doesn't lead anywhere! The "!" at the end of the address needs to be removed in order to become effective.

Thanks Henry (and all others who wrote). Actually, the page is fine; it’s that some mail readers need a space after a URL in order for them to correctly parse it. Without the space, they tack on the punctuation to the URL, rendering it meaningless.

I’ve edited the URL in the newsletter template to insert a space; the link should now work on any email reader.

And: I’d sincerely appreciate it if you each could recommend this newsletter to at least one friend. It’s fast, it’s free, it’s easy, and seeing the subscriber list grow from week to week is a wonderful thing!

Do you know one other person who might find this newsletter interesting or useful? Click on over to http://www.langa.com/recommend.htm#2 to see just how easy it is to send them a free copy, in your name.

Thanks!

return to top of page

Conflicting Views on Virus Checkers: Part One

Last week’s warning about the Chernobyl Virus generated a lot of mail.

Many were like this one from reader Judy Protas:

Dear Fred.

I love your e-mail.

I installed Dr.Solomon (recently sold, as you know) and found that because it sits in the background working constantly, it slowed Scan-Disk something chronic, and probably caused other glitches I wasn't even aware of (no geek I).

In today's e-mail you mentioned a stand-alone virus check that could be programmed to do a fast run-down while the system is off. Can you either explain what to look for or give me an actual product name to ask for?

Many thanks for a reply from you or staff.

Judy P.

Well, I’m glad to help, Judy, but there’s no "staff" here. It’s just me--- I’m a freelance writer, working alone.

I personally use Norton 4.0. I have no particular reason to upgrade, since this version is still fully supported by Symantec, and I’m still eligible for free weekly antivirus updates. I use Windows’ Task Scheduler to run Norton AV every day at 6AM, and it thus catches any viruses that may have crept in during the last day’s work.

This, plus the fact that I’m a fanatic about backing up my work, keeps me sufficiently safe without having to go nuts with antivirus software that's always on and active in the background.

For other (more recent) antivirus options, check out Windows Magazine’s "Recommended List." (See http://content.techweb.com/winmag/ ) It always has up-to-date evaluations of all the major classes of hardware and software, including antivirus applications.

return to top of page

Conflicting Views on Virus Checkers: Part Two

Reader and frequent writer Lanny Marcus (in Cali, Colombia) takes a different view.

He writes:

Dear Fred:

I respectfully disagree with you.

Yesterday, Pilar, my wife, was helping one of her girl friends research something for one of her classes. She was at the site of an organization of Peruvian exporters. Pilar does not download files.

She clicked on a Link to read an article, and suddenly was startled to find that she was downloading a file. During that process, she got this Warning Alert from Norton AntiVirus 5.0: "W97M.Nottice.D virus in file pubnov3.doc in compressed file pubnov3.zip"

I sent an e-mail to the web site, advising them they have an infection.

Also, 2 or 3 weeks ago, a friend of ours in Bogota, an M.D. who I exchange e-mail with daily, sent an e-mail to me that was infected…. My friend told me he got the virus from the Colombian Embassy in Australia.

Cordially,

Lanny Marcus; Cali, Colombia, South America

So there is something to be said for anti-virus checkers that sniff every bit and byte coming in through the wires: they prevent damage before it can happen. But the price is that you’ll have an extra process running on your PC all the time, eating some clock cycles and memory.

It’s up to you--- and Lanny’s way does offer a higher degree of protection than mine.

But the one thing you shouldn’t do is NOT use some form of virus protection. It’s a nasty world out there, full of all kinds of weird and wacko people. You owe it to yourself to install at least a minimal level of anti-virus protection on your PC.

return to top of page

Navigator/Communicator JavaScript Bug?

Several readers using the 4.51 version of Netscape’s browser have reported finding pages where embedded JavaScript markup code---which should be hidden---is being displayed on web pages they visit. From the code snippets they’ve sent me, it looks as through the browser is missing or misinterpreting the "comment" tags web authors use to hide their JavaScript.

For example, reader Waldo Hamilton said a CMP page showed him this:

document.write("(A HREF=\"xxx://newads.cmpnet.com/click.ng/Params.richmedia=yes&transactionID=" + seed + timenum + "&site=win&pagepos=top\")");

All that is JavaScript that’s part of CMP’s ad-banner rotation system. The code itself should not display.

With only a couple cases reported, it’s too soon to draw conclusions, but it’s interesting that all the instances, so far, have involved Navigator/Communicator 4.51. Stay tuned!

return to top of page

Just For Grins: Safe Fax

Several readers sent me the following, which appears to have originated at the "Just Joking" list at JustJoking-Subscribe@egroups.com :

A SHORT GUIDE TO SAFE FAX

Q. Do I have to be married to have safe fax?
A. Although married people fax quite often, there are many single people who fax complete strangers everyday.

Q. My parents say they never had fax when they were young and had to write memos to each other until they were 21. How old do you think someone should be before they fax?
A. Faxing can be performed at any age, once you learn the procedure.

Q. If I fax myself, will I go blind?
A. Certainly not as far as we can see.

Q. There is a place on our street where you can go and pay to fax. Is this legal?
A. Yes, many people have no other outlet for their faxing and must pay a 'professional' when their need to fax becomes too great.

Q. Should a cover always be used for faxing?
A. Unless you are really sure of the one you are faxing, a cover should be used to insure safe faxing.

Q. What happens when I incorrectly do the procedure and I fax prematurely?
A. Don't panic. Many people prematurely fax when they haven't faxed in a long time. Just start over (most people don't mind if you try again).

Q. I have a personal and a business fax. Can transmissions become mixed up?
A. Being bi-faxual can be confusing, but as long as you use a cover with each one, you won't transmit anything you're not supposed to.

return to top of page

 

See you next issue!

 

Best,

Fred

( fred@langa.com )

(P.S. Please email the LangaList to a friend! Use this super-fast form !)

An easier-to read formatted HTML version is available in the "what's new" section of http://www.langa.com . All past LangaList issues are also available via the same link.

return to top of page

Administrivia:

Why are you getting this newsletter? There are only two ways to get on the list (direct email request or via the WinMag mail list signup page) so if you're getting this newsletter; your name came to me through one of those channels.

SUBSCRIBE (it's free!): Send email to subscribe-langalist@lyris.dundee.net
UNSUBSCRIBE: Send email to unsubscribe-langalist@lyris.dundee.net
LIST TROUBLE? CHANGE OF ADDRESS? HAVE QUESTIONS? NEED HELP? See http://www.langa.com/help.txt
This newsletter is a free service of Langa Consulting LLC and is Copyright © 1999 Langa Consulting LLC. All rights reserved.

return to top of page


Please visit the LangaList Home Page

Please Note: Archived information (e.g. below) may become out of date.