How To Subscribe and Unsubscribe is at the end of this note. Mailing List Trouble? See http://www.langa.com/help.htm
Questions about the advertisers? See the end of this note. Please also see legal notices at the end of this note. LangaList: ISSN 1533-1156

Please recommend the LangaList to a friend! (And maybe win $10,000 !)

An easier-to read formatted HTML version of this newsletter is available
<a href=" http://www.langa.com/newsletters/2001/2001-11-12.htm ">here</a>

The LangaList
Standard Edition

2001-11-12

A Free Email Newsletter from Fred Langa
That Helps You Get More From Your Hardware, 
Software, and Time Online

Please visit our sponsors and help keep the LangaList S.E. free!

1) Product Activation Now Hacked, Too

In the last issue, we discussed how the "Passport Wallet" had been hacked--- and hacked so badly that Microsoft had to shut down the service to prevent its users' identities and credit card info from being stolen.

Passport is very, very aggressively pushed on many of Microsoft offerings--- especially XP--- and is mandatory for using some services such as HotMail/MSN. Fortunately, not everyone who has a Passport has elected to use the Wallet feature; but with or without the Wallet, Passport remains (IMHO) a very bad idea.

The other technology we've been discussing as part of XP's rollout is Windows Product Activation: It's less of a personal security issue than is Passport, but it's also less avoidable because you must--- must--- register your WPA-protected software within the allotted timeframe or the software reverts to nearly-useless functionality. (Microsoft is trying to force a semantic distinction between "activation" and "registration." But I decline to participate in the doublespeak: If you must "phone home" and must provide the vendor with some unique identification that will be stored in a vendor's database---even if the information is a machine-generated hardware hash code--- I call it "registration," even if Microsoft wants to call it something else.)

It's true that other apps from other vendors also require a WPA-like signup. But usually, this practice is restricted to low-volume, high-end software (where the risks of piracy were very high), and to free software (like Netscape's browser) where the vendor needs to try to make a buck by getting its marketing hooks into you. But this kind of registration has never been tried on anything as ubiquitous as a Windows operating system.

At first, Microsoft said WPA was intended to crack down on serious pirates, but this was clearly a smokescreen: Pirates have never been stopped by copy-protection schemes in the past. And in fact, they haven't been stopped by WPA:

Within hours of the operating system's glitzy launch on Oct. 25, malicious coders in Asia began distributing a software program over the Internet that allows users to bypass Microsoft's Product Activation technology...  (More: http://computerworld.com/nlt/1%2C3590%2CNAV47_STO65278_NLTOS%2C00.html )

The hack--- widely available on "warez" and cracker sites--- tricks the OS into always thinking it's day one of the activation process, leaving you with 60 more days to register/activate. Because the activation countdown timer never decrements, the software never reverts to reduced functionality mode.

Since XP came out, Microsoft has modified its stance: It now admits that WPA was never intended to stop professional software cloners--- the guys who make millions by churning out mass-produced illegal copies of Microsoft software. Instead, WPA was to prevent casual users from making extra copies of our software on our laptops and PCs. In other words, Microsoft admits it wasn't going after the major criminals, but instead was targeting the little guys all along. Does this seem like a good plan to you?

The more I look at Passport and WPA, the less there is to like about them. And consider: There's even something called "Managed Passports," in which Microsoft intentionally and by design allows someone to create a Passport in your name, but over which you have no real control. Yikes!

Please come read about "Managed Passports" and the whole WPA/Passport mess  at http://informationweek.com/story/IWK20011101S0026 and/or then add your comments at http://www.informationweek.com/forum/Fred Langa .

See you there!

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

2) High-Risk Security Problem--- With No Good Solution!

Man, oh, man: Another Microsoft security problem.

...A vulnerability exists because it is possible to craft a URL that can allow sites to gain unauthorized access to user's cookies and potentially modify the values contained in them. Because some web sites store sensitive information in a user's cookies, it is also possible that personal information could be exposed.  Microsoft is preparing a patch for this issue, but in the meantime customers can protect their systems by disabling active scripting. (The FAQ provides step-by-step instructions for doing this).... When the patch is complete, Microsoft will re-release this bulletin and provide details on obtaining and using it.

Risk Rating:
- Internet systems: High
- Intranet systems: High
- Client systems: High

Microsoft encourages customers to review the Security Bulletin at
http://www.microsoft.com/technet/security/bulletin/MS01-055.asp

And this is the company that wants us to entrust it with our online identities and credit card info? Gimme a break.

And by the way: Remember the Plug-And-Play security patch I mentioned about a week ago? The non-ME versions of the patch were OK, but Microsoft has withdrawn the WinME version of it because it was buggy. ("Explorer hangs and machine performance can be erratic.") Sheesh.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

3) Lies, Damned Lies, and Benchmarks (Part 1)

Our recent discussion of OS performance opened a hornet's nest, and I've gotten a *lot* of (ahem) heated email. So, let's take a moment to step back from the fray and look at benchmarks in general:

Rule of thumb: It's never wise to trust any one benchmark because *any* test is a reflection of the test designer's own particular approach. That approach may or may not accurately predict what will happen in your specific case using your software on your hardware.

A famous example: There used to be ads touting the speed of Mac processors; the ads made their case by showing independent benchmarks that proved that the Mac was much faster than an equivalent Intel-based box in completing a given task. No doubt about it: The claim was 100% truthful. The only problem was that the given task was performing a "Gaussian blur" in Photoshop.

OK, if you're a designer who spends all day doing Gaussian blurs in Photoshop, this measurement will matter a lot to you. To everyone else, it's at best only indicative; at worst, it's totally irrelevant. The ad wasn't wrong--- Macs *are* faster than PCs in selected areas--- but by isolating a "best case" example, the ad was misleading because it was based on a measurement most people didn't care about at all.

This is the problem with many benchmarks, and why taking any one benchmark at face value is dangerous.

And even when benchmarks focus on matters of vital importance to all users, there still are problems in human perception. This may surprise you, but it's true: Most users cannot reliably detect software speed differences of less than about 10% or so; and some users need a 15-20% speed difference before they can definitively say that software "A" is faster than software "B". Even trained and experienced software evaluators need a stopwatch to detect speed differences in the low single-digit percentages.

But you'll routinely see reviews and ads that claim speed "wins" based on differences that are in this low range--- too small for most people to sense; and therefore, in most cases, too small to matter.

To me, if a speed difference is too small to change the way you work--- if the difference is only evident using instrumentation under controlled laboratory conditions--- then any claim that an OS is faster or slower than another is largely meaningless. Such speed measurements may be intellectually interesting,  yes; but if a given speed increment doesn't pay off in terms of how you work, then I submit that it doesn't really matter.

That said, let's look at some recent tests in the next item.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

4) Lies, Damned Lies, and Benchmarks (Part 2)

The InfoWorld XP benchmark tests I reported in the last issue ( http://www.infoworld.com/articles/tc/xml/01/10/29/011029tcwinxp.xml ) focused on systems using WinXP or Win2K to handle very heavy workloads within Office XP applications. Win2K won handily, and by amounts that were large enough to matter. If this scenario reflects your situation--- you're considering using Windows XP to run a heavy workload through Office XP apps--- I think the results are worth noting.

But what about other circumstances? PC Mag ran tests of PCs using Office 2000 instead of Office XP as the work environment. In these tests, they saw the XP operating system yield a small speed increase compared to Win98 (test scores of 30.3 vs. 32.3, respectively); and they saw no meaningful difference in comparing Win2K versus XP. (Win2K was a bit faster in their "business" app tests and XP was faster in "content creation" tests.) To me, none of these results indicates a meaningful advantage for XP.

PC Mag did report a clear winner in boot time: 34 seconds for XP versus 39 seconds for ME and 49 seconds for Win2K. But while XP clearly wins in this area, it's not the sort of thing that will let you knock off work early for the day. (Spouse 1: "Gosh honey, you're home fifteen seconds early!" Spouse 2: "Yes, dear, and I owe it all to XP's reduced boot time!")

A third set of tests--- more comprehensive than either of the two mentioned above--- was done by "Tech-Report" (
http://www.tech-report.com/reviews/2001q4/os/index.x?pg=1 ) Their tests show results roughly similar to the Ziff-Davis/PC Mag tests: XP "wins" (but not by a lot) in most areas; and it loses (but not by a lot) in few areas.

So what does all this mean?

As I reported in the last issue, despite Microsoft's claims to the contrary, XP does not appear to be meaningfully faster that other versions of Windows in normal real-world applications--- except when compared to Windows ME, which is the poorest-performing member of the Windows family. (If you're currently using WinME, you probably will get better performance from XP... but you'll also get better performance by switching to Win2K or even Win98SE. See http://content.techweb.com/winmag/windows/features/merunbetter/default.htm .)

If you're using a well-tuned installation of Win98 or Win2K, and running Office 2K or earlier, I don't think you'll see any meaningful speed change in switching to XP. Some things will be a little faster, some will be a little slower, but none of it will let you go home early.

If your situation matches that of the the InfoWorld tests, XP will probably slow you down.

Benchmarks are truly useful tools, but no one benchmark tells the whole story. And sometimes, they even can be misleading--- such as when they focus on performance differences too small to matter in real life.

By all means read and use benchmarks when deciding what's right for you. But always take them with a grain of salt and a healthy dose of skepticism.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

5) Eradicate IE

Vitaly Larichev writes:

Fred, Re problem "How do you uninstall internet explorer and reinstall [an earlier] version?" Use IEradicator!

From the site http://www.98lite.net/ieradicator.html

"IEradicator is tiny script that uses the Windows setup engine to surgically remove Internet Explorer versions 3 through 6.0 from Windows 95, Windows 98, Windows 98 Second Edition, Windows Millennium and Windows 2000(sr1)"

I used it this way. First, I removed IE by IEradicator, then overinstalled my Win98 from CD. It didn't rewrite the registry, but having noticed that IE is not present, installed an old version of IE from CD. If any need, you may upgrade to later IE versions afterwards.

Thanks, Vitaly!

IEradicator is a very clever script indeed; it and its "big brother" product--- 98Lite--- can strip out an amazing amount of, er, stuff that Microsoft says can't be removed from your system.

But you have to read all the caveats. Example, IEradicator will NOT work on Win2K SR2 or XP.

And remember that having a full system backup is the only safe way to undertake fundamental system changes (like these): When products like Eradicator work, they work great. But if anything goes wrong, you can be left with a huge mess on your hands; a good backup will save your bacon.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

6) Thanks!

Thanks to thousands of you, the LangaList remains one of the ten most-recommended "Computing & Internet" web sites, according to the folks at Recommend-It!

It's a great feeling to know that this newsletter (and Langa.Com) is useful enough for many, many of you to have suggested it to friends and colleagues.

And, as a way of saying "Thanks!" there are two prizes you can win simply for making a recommendation. For example, if you use the Recommend-It service, you can win $10,000 (full details also available via this link): http://www.recommend-it.com/l.z.e?s=143182

Or, win a no-strings $30 Gift Certificate for any item at Amazon.Com--- books, software, hardware, kitchenware, toys... and more. To have a shot at winning, just use the following link to recommend the LangaList to a friend. Your friend just may find a new source of useful information; I just may gain a new subscriber; and you just may win a $30 Gift Certificate! (Full details also available via this link): http://www.langa.com/recommend.htm

Either way, thank you again, and good luck!

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

7) What's "WNAD?"

I have a bit of an issue, that I haven't been able to find any info on and am hoping you can shed some light for me. Have you have heard anything on an executable: WNAD.EXE. It suddenly appeared in my Windows directory... Zonealarm fired off a warning this morning Oct 27th that this application was attempting to access the internet. I run Ad-aware on a regular basis, and it hasn't tripped to this at all.

It seems to me that this is set to run some sort of internet ad, with a page name of intro2.php. I have disabled the Run entry for this program, which just had the name of WNAD, but am wondering where it came from.... --- David Nesbitt, Canada

For questions of this sort, I find that a fast search of Usenet Newsgroups often turns up good information (leads, at least, if not full answers). Sometimes, the groups are faster at responding to virus/worm/trojan problems than anti-virus and anti-spyware sites! For example, check out:
http://groups.google.com/groups?q=wnad&btnG=Search&meta=site%3Dgroups

Using that link, you can see that "WNAD" was embedded in one of those anti-Bin Laden joke emails that's been making the rounds.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

8) They Loaded The Code

Do you have a home page or website? (It doesn't matter what size.) Please click over to http://www.langa.com/code.htm , and maybe you can join the hundreds and hundreds of LangaList readers who have "Loaded the Code!" (If you've already "Loaded The Code" and are wondering if your site will appear here or on the Langa.Com web site, please see http://www.langa.com/link.txt )

Speaking of which: Here's another eclectic sample of reader sites--- some professional, some very personal:

View A Randomly-Chosen Reader Site
http://www.langa.com/randomlink.htm

Manually Browse All Posted-to-Date Sites Starting At
http://www.langa.com/readersites.htm

SpyWare Info
http://66.34.160.192/spywareinfo/index.html

Bob Hendricks' Bookmarks
http://people.ne.mediaone.net/bobhendricks/index.html

Raymond Erdey
http://members.telocity.com/rerdey/

HerbShop.com
http://www.herbshop.com/links.htm

"Da Bronx"
http://www.bobbalogh.com/

Buttons & Bows Square-dancing
http://www.coslink.net/personal/stets/

Welcome to Pope's Links
http://www.mts.net/~mspope/

rants & raves: the best & worst in IT
http://www.rantitraveit.com/

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

9) Argh! It's The Return Of Evil NetBEUI!

In recent issues ( http://www.langa.com/2001b.htm ), we've discussed XP networking. Because it's based on Win2K networking, XP's way of doing things will be unfamiliar and perhaps puzzling to those used to Win9x/ME-style networking.

In the last issue, I listed three excellent resources for getting up to speed with Win2k/XP-style networking, especially on smaller peer-to-peer LANs. ( http://www.langa.com/newsletters/2001/2001-11-05.htm#2 )

And that brings us to NetBEUI: the NetBIOS Extended User Interface protocol. It's clunky and outmoded, but many small Windows-based networks still use NetBEUI for file and print sharing.

By default, XP doesn't "speak" NetBEUI, but you can make it do so: http://support.microsoft.com/support/kb/articles/Q301/0/41.ASP . This way, you can add new clients to an old network, and still have all your PCs be able to communicate and share information.

But any time you're changing the way your systems share file- and printer-access, be sure to run security checks afterwards to ensure you haven't opened a hole in your defenses. The fast, free tests at http://www.grc.com and http://www.dslreports.com both can give you a high-level online security check up in a couple minutes. DSL Reports also offers a free, in-depth scan that takes somewhat longer to run. Likewise,  http://scan.sygatetech.com/ offers a very thorough scan, but can take literally hours to run. For a list of other test sites, see the "Online security tests" section of the page at http://www.informationweek.com/story/IWK20010916S0021 .

In any case, when you're changing your network setup in any way, it always pays to work carefully, and then to verify your work via an outside security test.

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

10) Just For Grins

In the last issue, we had a small item that used numeric equivalents for letters in order to convert words to a percentage you could use when someone asked you for a "greater than 100% effort." For example:

H A R D W O R K:
8 1 18 4 23 15 18 11 = 98% only

K N O W L E D G E:
11 14 15 23 12 5 4 7 5 = 96% only

But:
A T T I T U D E:
1 20 20 9 20 21 4 5 = 100%

And:
B U L L * * * *
2 21 12 12 19 8 9 20 = 103%

Well, many, many, many (!) readers suggested additional approaches to exceed 100%. For example, Steve Waskow suggests:

The old tried and true "K I S S I N G * * *" beats them both with 108%, while the George W Bush method, "H A V I N G T H E R I G H T P A R E N T S" tops them all with a rousing 249%....

There were a ton of other submissions, too, but most were unprintable in a newsletter like this. Still, thanks to all who wrote in! 8-)

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

11) Plus! Edition Highlights:
Easily ID Mysterious Startup Entries;
Pro/Con Counterattacking Spammers;
Hard-Core Way To Ensure CDRs Can't be Read;
Navigation ShortCuts on the Toolbar

Today's LangaList Plus! Edition contains all ten items above, plus about 30% more content including: a site that can help you know what each startup entry does on your system, and which are safe to remove or deactivate; a discussion of the benefits and drawbacks of counterattacking spammers via ISP notification; an extreme--- but effective--- way to erase CDR data for good; and easy navigation shortcuts for your toolbars.

Plus! Edition info: http://www.langa.com/plus.htm 

Click to email this item to a friend
  http://www.langa.com/sendit.htm

return to top of page

See you next issue!

Best,

Fred
(fred@langa.com)

Please recommend the LangaList to a friend! (And maybe win $10,000!I)

An easier-to read formatted HTML version is available in the "Current Issue" section of http://www.langa.com.  (The HTML version of each issue normally is available by 9AM EST [UT-5] of the issue date.) All past LangaList issues are also available at the Langa.Com site.

return to top of page

Administrivia:

UNSUBSCRIBE: From the same email account you used to sign up with), send an email to
unsubscribe-langalist@lyris.dundee.net

SUBSCRIBE (it's free!): Create and send a new email to
subscribe-langalist@lyris.dundee.net

CHANGE ADDRESS? LIST TROUBLE? HAVE QUESTIONS? OTHER PROBLEM? NEED HELP? See http://www.langa.com/help.htm

This is a 100% OPT-IN newsletter: See http://www.langa.com/info.htm

About the advertisers: http://www.langa.com/privacy.htm#ads

Disclaimer: http://www.langa.com/legal.htm  In brief: All information herein is offered as-is and without warranty of any kind. Neither Langa Consulting LLC, nor its employees nor contributors are responsible for any loss, injury, or damage, direct or consequential, resulting from your choosing to use of any information presented here.

This newsletter is a free service of Langa Consulting LLC and is Copyright © 1997-2005 Fred Langa/ Langa Consulting LLC. All worldwide rights reserved. LangaList: ISSN 1533-1156

return to top of page