C’mon, fess up.  Who did the discovery protocol for Windows Universal Plug and Play?

Was it supposed to work for USB?

Windows has always been annoying in regard to USB.  I’ve had it “forget” mice and jump drives (sometimes never to accept them again on that port).  I’ve had a port “locked” by an Adobe picture manager (which I hadn’t realized Adobe was installing while I was trying to upgrade Reader to get rid of the latest round of vulnerabilities) so that it never recognized my camera again on *any* USB port, and insisted that every jump drive I attached was a camera.  Windows has never been willing to specifically identify any USB port even if it reports a problem.

Recently our printer (yes, a Winprinter with a USB connection: these days, can you find any other type?) has been flaky.  Not the printer itself: it’s fine.  And, yes, I did install the correct Win 7 driver, thank you very much.  Not that either Microsoft nor HP were very helpful about that.  The computer started out just fine, for a few months.  Then it started not recognizing that it had a printer.  Then it started seeing that it had something connected, but couldn’t tell what it was.  And sometimes it would cycle between these states constantly, while I was working.  (I’d hear a rising double beep as it realized it had a printer, or a falling double beep as it lost it, or couldn’t recognize it.  It got so bad that I’ve had to turn the speaker volume down given the near constant clamour of beeps.)  We tried different things: rebooting, changing to another user, power cycling the printer, power cycling the printer and waiting a while before we turned it on, turning the printer on first, not turning the printer off when once it had successfully accepted a print job.  Sometimes they worked, sometimes they didn’t.  Recently it’s gotten a lot worse.

(And, yes, I did Google it.  And AltaVistaed it  Never found anything helpful.  Even when I added profanity, as I suspected would be the case with someone who had gotten as frustrated with it as I was.)

So, at Gloria’s suggestion, today I hauled the computer out of its nook and swapped the printer to another USB port.

She was right: after I changed it the queue printed.

I lost the keyboard, monitor (twice), mouse (twice).  Eventually got them back. And then the computer crashed.  I lost some bookmarks I had collected this morning, and some outbound email: don’t know what or how much.  As far as I can tell I still have access to other devices, but I got a report that the Passport drive has a problem and I’m currently running a check on it.

But the printer is still printing.  So far.

I could really get to hate Microsoft.  Very easily …

A few more places to find books.

Bookyards - unfortunately, these seem to be limited to what you could find on Gutenberg, and they are in PDF.

Mobipocket - at least these are in .mobi format.

Baen - they’ve done a lot of their back catalogue.

Bookmonk - interesting site, graphical links, for those who choose books by cover.

Smashwords - new publications, many free.

Except it won’t be.

I’m assuming the reporter who quoted the statement in the title as coming from the Davos “Global Shapers” group was trying to make his own headline. Hey, that works (I even used it myself). But this is not the first time we’ve been warned about the Armageddon that is cyber terror, and it’s time somebody called bullshit on it.

Now don’t get me wrong, I’m not mother Teresa. I work in IT security, and have been known to scare people now and then with the “this is what might happen to you if you won’t fix your security”.  Most times I’d like to think I was calling it the way I saw it, but I’m sure more than once people that were listening to me thought I was exaggerating. And probably much more than once, I was. But this is not an “exaggeration”. It’s something totally different.

Have you been terrorized? I bet you have. You don’t have to know someone who was killed by a suicide bomber; it’s enough if you think back to when the school bully tried to take your lunch. That was terrifying. And terrorizing. You thought bodily harm will come to you, and this is why “terror” works so well: it’s scary.

Is ‘cyber terror’ really that scary? Well, lets compare. Many of us have been “victims” of cyber terror. You probably visited a web site that was defaced by political hacker wannabes. Were you terrorized?

We’ve all heard about the attacks in Estonia. That was the most effective cyberwar to date. But did anyone died? Lets compare it to the war (actual war) in Georgia. Again Russia clashing with a neighbor, but this time people died; lost their homes; forced to move their lives elsewhere. I’m sorry, but that’s not the equivalent of having to reformat your computer or losing facebook connectivity for 24 hours.

War is war: people die, suffer bodily harm, have their lives change. I’m not against the term “cyber-war” or “cyber-terror”, but can we put it in proportion please?

So no, the next ‘cyber war’ or ‘cyber terror’ attack won’t be worse like 9/11. It won’t be even mildly comparable to 9/11. Unless it kills thousands of people, in which case there will be nothing “cyber” about it.

A new study notes that “scholarly” academic journals are forcing the people who want to publish in them (the journals) to add useless citations to the published articles.  OK, this may sound like more academic infighting.  (Q: Why are academic fights so bitter? A: Because the stakes are so small.)  But it actually has some fairly important implications.  These journals are, in many eyes, the elite of the publishing world.  These articles are peer-reviewed, which means they are tested by other experts before they are even published.  Therefore, many assume that if you see it in one of these journals, it’s so.

(The system isn’t pefect.  Ralph Merkle couldn’t get his paper on asymmetric encryption published because a reviewer felt it “wasn’t interesting.”  The greatest advance in crypto in 4,000 years and it wasn’t interesting?)

These are, of course, the same journals that are lobbying to have their monopoly business protected by the “Research Works Act,” among other things.  (The “Resarch Works Act” is a whole different kettle of anti-[open access|public domain|open source] intellectual property irrationality.)

I was, initially, a bit surprised by the study on forced citations.  After all, these are, supposedly, the guardians of truth.  Yes, OK, that’s naive.  I’ve published in magazines myself.  Not the refereed journals, perhaps: I’m not important enough for that.  But I’ve been asked for articles by many periodicals.  They’ve had all kinds of demands.  The one that I find most consistently annoying is that I provide graphics and images.  I’m a resarcher, not a designer: I don’t do graphics.  But, I recall one time that I was asked to do an article on a subject dear to my heart.  Because I felt strongly about it, I put a lot of work into it.  I was even willing to give them some graphics.  And, in the end, they rejected it.

Not enough quotes from vendors.

This is, of course, the same motivation as the forced citations.  In any periodical, you make money by selling advertising.  In trade rags, the ease of selling advertsing to vendors is determined by how much space you’ve given them in the supposed editorial content.  In the academic journals, the advertising rates are determined by the number of citations to articles you’ve previously published.  Hence, in both cases, the companies with the advertising budgets get to determine what actually gets published.

(As long as we’ve here, I have one more story, somewhat loosely related to publishing, citation, open access, and intellectual property.  On another occasion, I was asked to do a major article cluster on the history of computer viruses.  This topic is very dear to my heart, and I put in lots of time, lots of work, and even lots of graphics.  This group of articles got turned down as well.  The reason given in that case was that they had used a Web-based plagiarism detector on the stuff, and found that it was probably based on materials already on the net.  Well, of course it was.  I wrote most of the stuff on that topic that is already on the Web …)

Today a Conservative Canadian Senator made a rather bizarre suggestion about giving convicted murderers a rope, and allowing them to hang themselves.  (No, I’m not kidding.  But he later retracted the statement.)

But, never let it be said that we couldn’t look at ideas, regardless of how they come.  Moral repugnance aside, is this a good idea?  Probably not.

Would it save money?  Only if the murderer felt really, really sorry.  And, isn’t that what we wanted out of the justice system in the first place?  So, we might have saved money and wasted a life.

Then again, what if the convicted person was not guilty?  I would think that an innocent person, unjustly convicted, would be a prime candidate for suicide.  So then we have a monetary saving at the cost of an innocent life.

And, for those who really don’t feel bad about killing people, they might welcome the option of getting out of a life sentence.  So we may be reducing the deterrent effect if we implement the rope idea.

If we’ve got a real psychopath, is it really a good idea to give him a rope, or poison, or a knife, or a gun, or anything particularly dangerous?  It isn’t too hard to start to imagine scenarios where he/she/it could do some real damage, even within the prison.

Maybe we should chip in and buy the Senator a copy of Schneier’s “Liars and Outliers.”

BKZERODY.RVW   20111213

“Zero Day”, David Baldacci, 2011, 978-1-4555-0414-5, U$29.99/C$32.99
%A   David Baldacci www.DavidBaldacci.com
%C   237 Park Ave, New York, NY   10017
%D   2011
%G   978-1-4555-0414-5 0446573019
%I   Hachette Book Group
%O   U$29.99/C$32.99
%O   Audience n- Tech 1 Writing 2 (see revfaq.htm for explanation)
%P   643 p.
%T   “Zero Day”

At one time, in information security terminology, “zero day” meant a measure of difficulty or vulnerability.  That meaning has been largely destroyed by overexposure in the media.  Today it simply means “we want to scare you.”

To top it all off, here is this book by David Baldacci.  As a common-or-garden thriller it is OK.  But it has nothing to do with computers.  Nothing to do with information security.  Zip.  Zero (you should pardon the expression).  Zilch.  Nada.  Null.  None.  Nugatory.  Not a sausage.  The titular phrase isn’t even used anywhere in the book.  It seems to have been used as a title simply to say “we want you to think this is really, really scary.”

copyright, Robert M. Slade   2011     BKZERODY.RVW   20111213

A vendor speaking at a conference (is there any other kind of presentation at conferences these days?) has made a call for a new standard for information security awareness training.

” … the way to do this is via a new infosecurity standard that solely focuses on training and awareness and is delivered in the work environment”

Now, I’m all for security awareness.  I’m all for more security awareness.  I’m all for better security awareness.  I’m all for infosec departments to actually TRY security awareness (since they say often say, “well, if it was gonna have worked, it woulda worked by now” and never try it).

But, come on.  A new “standard”?

As the man^[1] said, the wonderful thing about computer “standards” is that there are so many to choose from.

What are we going to certify?  Users?  “Sorry, you have been found to be too stupid to use a computer at work.  You are hereby issued this non-jailbroken iPad.”

No, undoubtedly he thinks we are going to “certify” the awareness materials themselves.  Good luck with that.

I’ve been a teacher for a lot of years.  I’ve also been a book reviewer for a lot of years.  And I’ve published books.  Trust me on this: a variant of Gresham’s Law is very active in the textbook and educational materials field.  Bad textbooks drive out good.  As a matter of fact, it’s even closer to Gresham: money drives out good textbooks and materials.  Publishers know there is a lot of money to be made in textbooks and training materials.  Publishers with a lot of money are going to use that money to advertise, create “exclusive” contracts, and otehrwise ensure that they have the biggest share of the market.  The easiest way to do that is to publish as many titles as you can, as cheaply as you can.  “Cheaply” means you use contract writers, who can turn out 2-300 pages on anything, whether they know about it or not.

So, do you really think that, if someone starts making noise about a security awareness standard, the publishers won’t make absolutely certain that they’ve got control of the certification process?  That if someone comes up with an independent standard that they can withstand the financial pressures that large publishers can bring to bear?  That if someone creates an independent cert, and firmly holds to principles and standards, that the publishers won’t just create a competing cert, and advertise it much more than the independent cert can ever hope to?

After all, none of us can possibly think of any lousy security product with a lot of money behind it that can command a larger market share than a good, but independent, product, now can we?

[1] Well, maybe it was Andrew Tanenbaum, but maybe it was Grace Hopper.  Or Patricia Seybold.  Or Ken Olsen.

Recently I was discussing the use of technology in education, when an odd (to me) question came up.  It was about the use of ebooks.  That wasn’t really high on my radar on the tech-in-ed landscape.  When I started (good grief, more than 30 years ago) the use of computers for textbooks was a vague, blue-sky idea that a guy named Vannevar Bush had once talked about.  (Actually, he was talking about a desk, rather than a book.)

Recently, of course, there has been a lot of discussion about ebooks.  School boards have been looking into cost savings.  Major tech corporations and publishing conglomerates are getting on the bandwagon.  So, her interest was natural.

Specifically, she wanted to know:

> Perhaps you talk to me a bit about why (from a non-environmental
> standpoint) it’s important for students to use digital e-books?
> Is there a learning curve when it comes to learning from an ebook
> rather than a textbook? Is there a shorter attention span?
> What about eye strain?
> How would this effect the structure of learning?

This I could do, having been given a Kindle for Christmas this year.  I have just finished doing my first review for the series, using an ebook on the device.  Definite tradeoffs: it was easier to grab quotes, much harder to make notes, easier to search, and a right royal pain to try and flip back and forth to check notes, index, etc.  Also a complete pain to check references in other works.

In terms of education, and using study materials in school, it was easier to grab quotes — which would make copying and plagiarism easy and very tempting.  That’s a bad thing.  It is much harder to make notes, and makes study, or writing your own paper, more difficult.  Again, given that the purpose of many assignments is to get students to practice creating their own writing, this is a bad thing.

On the other hand, it’s easier to search, and that’s good for studying.

But it’s a right royal pain to try and flip back and forth to check notes (most books don’t have footnotes any longer, they are no endnotes–at the back of the book), the index, appendices, and other material in the book.  It is also a complete pain to check references in other works — definitely bad for studying and learning.

In terms of it being “important” for students to use ebooks: as a former public school teacher I don’t think it is.  The only reasons would be cost, and getting up to date materials.  Frankly, the quality of almost all school texts is absolutely appalling, so having the latest version of tripe isn’t all that important.  So, that just leaves cost.

There is a learning curve to using an e-reader, but a fairly small one.  No, I take that back.  Actual reading isn’t that hard, but you do have to learn something about filing, arranging, and accessing material on the device, particularly in a school/learning situation.

The small screen size is a bit annoying, although you generally can increase the font size.  (The book I just finished reviewing was in PDF, and the options for font size for that are very much less.)  Generally I didn’t find much eye strain, although I’m used to reading small print, but in low light it was pretty awful.

In terms of learning structure, there could be some advantages.  As a teacher, I could create notes and send them to the devices of all the students: it would help that they could not say they didn’t have the assignment 

An item for discussion:

I’ve see this stuff in some recent reports of lawsuits.  First people started using social media, for social things.  Then corps decided that socmed was a great way to spam people without being accused of spamming.  Then corps suddenly realized, to their horror, that, on socmed, people can talk back.  And maybe alert other people to the fact that you a) don’t fulfill on your promises, b) make lousy products, c) provide lousy service, and d) so on.

Gloria ran into this today and asked me about the legalities of it.  I imagine that it has all the legality of any waiver: you can’t sign away your rights, and a waiver has slightly less value than the paper it’s printed on (or, slightly more, if a fraudster can copy your signature off it  [Sorry, I’m a professional paranoid.  My brain just works that way.]).

Anyway, what she ran into today (a Facebook page that was offering to let you in on a draw if you “liked” them) (don’t worry, we’ve already discussed the security problems of “likes”):

“We’re honoured that you’re a fan of [us], and we look forward to hearing what you have to say. To ensure a positive online experience for the entire community, we may monitor and remove certain postings. “Be kind and have fun” is the short version of our rules. What follows is the longer version of rules for posts, communications and general behaviour on [our] Facebook page:”

[fairly standard “we’re nice people” marketing type bumpf - rms]

“The following should not be posted on [our] Facebook pages:”

Now, some of this is good:
“Unauthorized commercial communications (such as spam)
“Content meant to bully, intimidate or harass any user
“Content that is hateful, threatening, discriminatory, pornographic, or that
contains nudity or graphic or gratuitous violence
“Content that infringes or violates someone else’s rights or otherwise violates the law
“Personal, sensitive or financial information on this page (this includes but is not limited to email addresses, phone numbers, etc.)
“Unlawful or misleading posts”

Some of it is protecting their “brand”:
“Competitor material such as pictures, videos, or site links”

Some has to do with the fact that they are a franchise operation:
“Links to personal [agent] websites, or invitations from [agents] to connect with them privately”

But some it is limits freedom of expression:
“Unconstructive, negative or derogatory comments
“Repeat postings of unconstructive comments/statements”

And, of course, the kicker:
“[We] reserves the right to remove any postings deemed to be inappropriate or in violation of these rules.”

Now, it’s probably the case that they do have the right to manipulate the content on their site/page any way they want to.  But, how far can these “rules” go?

One of the most common definitions for the term DLP (Data Loss Prevention or Data Leakage Prevention) is “systems that identify, monitor, and protect data through deep content inspection, contextual security analysis of transaction (attributes of originator, data object, medium, timing and recipient/destination and so on) and with a centralized management framework.”

Purpose of this article
Organizations are interested to protect their sensitive data, and DLP provides them with the framework to do that. So far no news… However, the DLP world is a bit more complicated than that and the purpose of this article is to highlight few basic domains and areas that are worth thinking about when considering DLP solutions.

Common Data Locations and States

• Data in motion – Any data that is moving through the network to destinations outside the local / corporate LAN via the Internet
• Data at rest – Data that resides in files systems, databases and other storage methods
• Data at the endpoint – Data at the endpoints of the network (e.g. data on USB devices, external drives, MP3 players, laptops, and other highly-mobile devices)

Examples of sensitive data:

• Confidential and/or proprietary data, for example: processes, methodologies, development code and etc.
• Customer and employee data
• Financial data
• Data that is regulated by regional and national laws such as HIPAA, SOX and GLBA

Common Data Leakage Channels:
Technical side:

• Email Traffic - SMTP from mail servers
• Web mail (Gmail, Yahoo, etc)
• Uploading files to internet destinations (HTTP, HTTPS, FTP)
• Posting on internet sites (blogs, social media, forums)
• Instant messaging (gTalk, MSN, Yahoo, Skype)
• P2P networks
• Wi-Fi networks
• Key loggers, Trojan horses
• Multiple platform (Windows, Linux, MAC, etc)
• Application permissions (ERP, database, SaaS platforms, SharePoint)

Physical:

• Mobile devices
• Non-encrypted hard drives
• USB drives (Disk on key, external hard drives)
• Portable media (CD/DVD, floppy drive, backup tapes)
• Physical security (hard copy of documents)

Human factor:

• Lack of employee awareness to security risks
• Partners, suppliers, temporary employees and visitors
• Working from home, remote locations, internet cafe

Company’s needs to protect themselves from scenarios as mentioned below:

• Inadvertent forwarding of email containing product development or business plans to another email recipient
• An employee extracts data from a secure system and conducts the analysis on a less secure system
• Sending unreleased pricing information to the wrong email address
• Customer or competitive information sent by an employee to a third-party for financial gain
• A disgruntled employee with privileged access to sensitive information acts maliciously and steals information
• Proprietary information sent to a distributor, who might then forward it on to competitors
• Backup tapes are stored in a non-secure environment and curious intruder removes the tape to examine the content
• Incorrect settings of permissions of file and directory structure could allow anyone access the information

DLP solutions prevent confidential data loss by:

• Monitoring communications going outside of the organization
• Encrypting email containing confidential content
• Enabling compliance with global privacy and data security mandates
• Securing outsourcing and partner communications
• Protecting intellectual property
• Preventing malware-related data harvesting
• Enforcing acceptable use policies
• Providing a deterrent for malicious users (by creating the possibility of being caught)

How to implement DLP solution:

1. Perform risk assessment to find out:
   
• What type of data exists in the organization?

 

• Where is the data located/saved?

 

• How valuable is the data to the organization?

 

• What type of loss is the organization willing to accept?

 

• What are the regulatory and privacy gaps for the organization?
2. Classify the organization data:
   
• Top secret

 

• Secret

 

• Confidential

 

• Restricted

 

• Unclassified
3. Decide what information does the organization would like to search and protect:
   
• Pattern, keyword matching and dictionaries

 

• Document fingerprinting

 

• Database fingerprinting
4. Prepare data loss prevention plan:
   
• How to limit the damage to the organization

 

• How to avoid similar incidents from happening in the future

 

• How to report to the management, stock holders and media on the current data loss incident
5. Prepare policies, standards and procedures for handling data loss incidents:
   
• Scan HTTPS traffic on the gateway

 

• Block data from leaving the organization

 

• Encrypt sensitive information inside database

 

• Full disk encryption

 

• Encrypt data before sending to partners/suppliers

 

• Prevent use of portable media

 

• Employee awareness training
6. Deploy the DLP solution:
   
• Install a product on the gateway

 

• Configure SSL termination – recommended

 

• Configure encryption gateway for SMTP traffic – recommended

 

• Deploy agents on the end-points – highly recommended
7. Ongoing monitoring:
   
• Review incidents on regular basis (daily/weekly)

 

• Fine-tune the product to raise alerts on important incidents and collect all other incidents.

 

• Create reports on regular basis to locate top senders/targets

 

• Perform data discovery on regular basis (daily/weekly/month) on network shares, servers, end-points, etc.

The article can also be found at: http://security-24-7.com/dlp

You can, of course, just buy books from Amazon.  It’s pretty easy: you choose the book, arrange payment, click on a link to send it to your Kindle, and, next time your Kindle is connected to a wireless network you choose “Sync & Check for Items” from the menu on the home page, and they get loaded onto your machine.

But, let’s suppose you are, like me, cheap.

Well, Amazon is still a source.  You can search on “public domain,” for example.  (Type in “public ” and Amazon will helpfully suggest something like “public domain books for kindle free.”)  That will get a list of books, most of which will be available free of charge.  (Most of them probably started life in Project Gutenberg.  We’ll get there later.)  You can even do it while your Kindle is connected via wireless, in the “Shop in Kindle Store” option on the home page menu.  Some of the books that come up will be books about the public domain, and those you’ll probably have to pay for.  Also, some of the books, even in the public domain, bear a charge, although it’s probably fairly modest.  You will have to wade through them until you come up with something you want to read.  (You will also have to wade through a whole bunch of titles in German.)

Now, these public domain books tend to be old.  There are definitely classics to be found: Austen, Dickens, Wilde, Twain, and many, many others.  If you want more recent titles, there are other searches you can do.

Try searching on “0.00“  That is the price you will see if the book truly is free of charge.  You’ll still see some of the public domain books, but you will also see some more modern titles.  (For some reason, lots of romances.)  Amazon seems to mess with searches for “0.00″ especially if you add limits, like “0.00 science fiction”  You will only get a very few titles.  (The day I tried it, one was a science fiction magazine.  The description even said that this subscription was always free for Kindle users.  When I tried to subscribe, it asked for a credit card for “recurring charges.”)

But, there are many, many other sources.

As previously noted, there is Project Gutenberg.  This is the Grandfather of all free online book sources, started by Michael Hart.  There are over 20,000 titles in the catalogue, with more being added all the time.  They used to just be text, but they now come in half a dozen formats.  For Kindle, you’ll want .MOBI.  (I’ve also mentioned the formats Kindle will handle.)  Most of these titles appear elsewhere, including ManyBooks, which provides the texts in even more formats.

There is also a Website called Kindle Review.  They have suggestions about where to get free books (although they mostly seem to sell Kindles).  They have suggestions about books free at Amazon, particularly ones that are only available for a short time.  You have to search for some entries, and the site is not easy to navigate, but I found this Amazon listing of limited time offers to be quite useful.  They aren’t all free, but a fair number are.  (Remember, on Amazon, that in the upper right of the page you can sort, and one of the options is by price, lowest to highest.)

A few random observations along the way:

The Kindle has rebooted spontaneously a couple of times since I got it, and sometimes it refuses to connect to wireless unless it gets rebooted.  Since the device is so simple, I would have thought that this shouldn’t be a major process, but it seems to take about two minutes to do a reboot.

One of the times that it wouldn’t connect, and I rebooted it, it scared the liver out of me.  It seemed to be at the end of it’s boot process, came up with the home page–except that it said I had zero items on the device.  At that point I had loaded about 50 books onto it, and sorted them into half a dozen collections, none of which were in evidence.  Shortly after that it did decide that my stuff was there, but you shouldn’t scare old people like me in that way.  It could have major medical consequences.  For my pants, if nothing else.  (When I finally tried out the USB connection to the computer, the first thing I did was back up the whole thing.)

Logging on to hotspots with redirection is still inconsistent.  Sometimes it has no problem at all; other times I go from “Shop in Kindle Store” to “Sync & Check for Items” to the browser, and a couple of times around before I get a chance to a) pick a network to which to connect, and b) a chance to reload whatever page the browser was on before, which finally prompts the redirect and login.

Amazon doesn’t like “selling” you the same book more than once, even if it is free.  (It will offer to reload the book for you, though, in case you’ve lost itor accidentally deleted it.)  If you send books via email, though, it will quite happily load the book twice, and give you two entries for it.

Even before I was given a Kindle, I was vaguely interested.  I use my local library a lot, and review and annotate stuff on their new system.  Recently the library has been pushing the fact that ebooks are available for borrowing.  In fact, they had a meeting about e-readers (which, worse luck, I was unable to attend), and even have some e-readers as loaners.

So, when I got the Kindle, the library site was one of my first stops.

It was not an unqualified success.

First of all, my local library has no ebooks for loan.  The actual ebooks seem to be loaned by the BC Libraries system.  I say “seem to,” because the actual ebooks, and the system for controlling them, seems to be run by an American outfit called OverDrive.  This becomes important once you start looking for titles and ebooks.  There is Kindle compatible material, but none of it is available in Canada.  (Which seems very odd when the site is supposed to be about the “BC” libraries.)

There are a very large number of ePUB format titles.  There are even some that appear to be free for the taking.  I tried one, converted it to .MOBI, and it seemed to work OK.

For the actual loan books, I placed a hold.  The hold came in.  I read the directions on the “Check Out Assistance” link.  I installed Adobe Digital Editions (ver. 1.7.2.1131) (even though I am, as a security specialist, really uncomfortable with Adobe products) in order to be able to return the item.  I “downloaded” the item to Adobe Digital Editions.  It now appears in my “library” on Adobe Digital Editions.  However, the way to “return” the item required help from a library tech, and it definitely is not intuitively obvious.  Oh, and it definitely won’t convert to Kindle format.

I guess I have to go to other sources.

BKZERDAY.RVW   20111109

“Zero Day”, Mark Russinovich, 2011, 978-0-312-61246-7, U$24.99/C$28.99
%A Mark Russinovich www.zerodaythebook.com markrussinovich@hotmail.com
%C   175 Fifth Ave., New York, NY   10010
%D   2011
%G   978-0-312-61246-7 0-312-61246-X
%I   St. Martin’s Press/Thomas Dunne Books
%O   U$24.99/C$28.99 212-674-5151 fax 800-288-2131
%O   josephrinaldi@stmartins.com christopherahearn@stmartins.com
%O  http://www.amazon.com/exec/obidos/ASIN/031261246X/robsladesinterne
http://www.amazon.co.uk/exec/obidos/ASIN/031261246X/robsladesinte-21
%O   http://www.amazon.ca/exec/obidos/ASIN/031261246X/robsladesin03-20
http://www.amazon.com/gp/mpd/permalink/m3CQBX46DOK0AK/ref=ent_fb_link
%O   Audience n Tech 1 Writing 1 (see revfaq.htm for explanation)
%P   328 p.
%T   “Zero Day”

Mark Russinovich has definitely made his name, in technical terms, with Winternals and Sysinternals.  There is no question that he knows the insides of computers.

What is less certain is whether he knows how to write about it within the strictures of a work of fiction.  The descriptions of digital forensics and computer operation in this work are just as confusing, to the technically knowledgeable, as those we regularly deride from technopeasant authors.  “[T]he first thing Jeff noted was that he couldn’t detect any data on the hard disk.”  (Emphasis in the book.)  Jeff then goes on to find some, and notes that there are “bits and pieces of the original operating system.”  Now there is a considerable difference between not finding any data, and having a damaged filesystem, and Russinovich knows this perfectly well.  Our man Jeff is a digital forensics hacker of the first water, and wouldn’t give a fig if he couldn’t see “the standard C: drive icon.”

Generally, you would think that the reason a technically competent person would write a novel about cyberwar would be in order to inject a little reality into things.  Well, reality seems to be in short supply in this book.

First of all, this is the classic geek daydream of being the ultimate ‘leet hacker in the world.  The Lone Hacker.  Hiyo SysInfo, away!  He has all the tools, and all that smarts, about all aspects of technology.  Sorry, just not possible any more.  This lone hacker image is unrealistic, and the more so because it is not necessary.  There are established groups in the malware community (among others), and these would be working together on a problem of this magnitude.  (Interestingly, these are generally informal groups, not the government/industry structures which the book both derides and relies upon.)

Next, all the female geeks (and there are a lot) are “hot.”  ‘Nuff said.

The “big, bad, new” virus is another staple of the fictional realms which does not exist in reality.  Viruses can be built to reproduce rapidly.  In that case, they get noticed quickly.  Or, they may be created to spread slowly and carefully, in which case they can take a while to be detected, but they also take a long time to get into place.

Anti-malware companies don’t necessarily rely on honeypots (which are usually there to collect information on actual intruders), but they do have bait machines that sit and wait to be infected (by worms) or emulate the activity of users who are willing to click on any link or open any file (for viruses).  Malware can be designed to fail to operate (or even delete itself) under certain conditions, and those conditions could include certain indications of a test environment.  However, the ability to actively avoid machines that might be collecting malware samples would be akin to a form of digital mental telepathy.

Rootkits, as described in the novel, are no different than the stealth technology that viruses have been using for decades.  There are always ways of detecting stealth, and rootkits, and, generally speaking, as soon as you suspect that one might be in operation you start to have ideas about how to find it.

A backup is a copy of data.  When it is restored, it is copied back onto the computer, but there is no need for the backup copy to be destroyed by that process.  Therefore, if a system-restored-from-backup crashes, nothing is lost but time.  You still have the backup, and can try again (this time with more care).  In fact, the first time you have any indication that the system might be corrupted enough to crash, you would probably try to recover the files with an alternate operating system.  (But, yes, I can see how that might not occur to someone who works for Microsoft.)  After all, the most important thing you’ve got on your system is the data, and the data can usually be read on any system, and with a wide variety of programs.  (Data files from a SQL Server database could be retrieved not only with other SQL programs, but with pretty much any relational database.)

Some aspects are realistic.  The precautions taken in communications, with throwaway email addresses and out-of-band messaging, are the type that would be used in those situations.  There is a lot of real technology described in the book.  (Although I was slightly bemused by the preference for CDs for data and file storage: that seems a bit quaint now that everyone is using USB drives.)  The need, in this type of work, for a level of focus that precludes all other distractions, and the boredom of trying step after step and possibility after possibility are real.  The neglect of security and the attendant false confidence that one is immune to attack are all too real.  But in a number of the technical areas the descriptions are careless enough to be completely misleading to those not intimately familiar with the technology and the information security field.  Which is just as bad as not knowing what you are talking about in the first place.

Other forms of technology should have had a little research.  Yes, flying an airliner across an ocean is boring.  That’s why the software designers behind the interface on said airliners have the computer keep asking the pilots to check things: keeps the pilots from zoning out.  I don’t know how quickly you can “reboot” the full control system in an airplane, but the last one I was on that did it took about fifteen minutes to even get the lights back on.  I doubt that would be fast enough to do (twice) in order to pull a plane out of a dive.  And if you are in a high-G curve to try and keep the plane out of the water, a sudden cessation of G-forces would mean that a) the plane had stalled (again) (very unlikely), or b) the wings had come off.  Neither of which would be a good thing.  (And, yes, the Spanair computer that was tracking technical problems at the time was infected with a virus, but, no, that had nothing to do with the crash.)

Russinovich’s writing is much the same as that of many mid-level thriller writers.  His plotting is OK, although the attempt to heighten tension, towards the end, by having “one darn thing after another” happen is a style that is overused, and isn’t very compelling in this instance.  On the down side, his characters are all pretty much the same, and through much of the book the narrative flow is extremely disjointed.

Overall, this is a reasonable, though unexceptional, thriller.  He was fortunate in being able to get Bill Gates and Howard Schmidt to write blurbs for it, but that still doesn’t make it any more realistic than the mass of cyberthrillers now coming on the market.

copyright, Robert M. Slade   2011     BKZERDAY.RVW   20111109

And here, I thought I was finally famous.  It’s so disappointing.

I got a “Weekly Follow-up from the National Academic Association.”  I suppose it doesn’t really matter that I’d never heard of them, let alone weekly, because it came from the “Academic Association.”

“Hello Candidate,” it starts, and goes on to tell me that “As the school year opens, the Who’s Who Among Executives and Professionals begin a global search for accomplished individuals in both faculty and administrative roles at post-secondary institutions of learning.”

Could this possibly be a job offer?  They apparently need me to “verify your contact information so that we can properly publish your updated credentials alongside 30,000 of your prestigious peers. Such a listing can only bring you increased visibility and networking opportunities within the scholastic community.”  Only 30,000!  Such a select group!

Alas, when I actually went to the site http://www.wittersphere.info/YM40/53/1338/710177.1/4/13295/1600293/3O80?gy=?qqu06/vc/ld-99505.g78 (tested with a safe browser, but it doesn’t actually seem to be feeding malware) it turned out to be the “International Association of Successful Individuals.”  Therefore, I don’t qualify, but no doubt a number of you do, so I’m letting you know 

Having been given a Kindle, what does one do with it?

Unless you have a Kindle Keyboard (a different model, with a keyboard about the size of that for a slide phone or Blackberry across the bottom of the screen), as noted, the virtual keyboard is a pain, so you aren’t going to do much writing.  That leaves reading.

First of all, then, you have to get some books to read.  You can copy them onto the Kindle, from your computer, with the USB cable.  I’ve done that now, and it works quite well.  Plug it into the computer, wait for the computer to read the device driver, and it shows up simply as a USB drive.  You can put files into the “My Documents” folder, and they show up on the device.  (You can also copy any or all of the “books” on the Kindle onto your computer, as backup.  Oddly, most ebooks seem to have four files associated with them, once you start reading them.)  I’m a bit loath to do the cable connection randomly just now, since, also as noted, plugging into a USB port on a computer starts charging, and, even though it’s a lithium polymer battery, I’d just as soon give it a few full cycles before I start messing with battery memory.

You can use the wireless connection in two different ways.  You can “shop” at the Amazon store.  Or, you can find your own files and ebooks, and email them to your Kindle.  When you set up, the device is assigned an email address.  You can find this under the “Settings” entry of the menu from the home page.  Find an ebook that you want, and send the file, as an attachment, to that address.  The next time the Kindle is attached to the net, you can sync, and that file will be downloaded to your device.  (If it doesn’t show up on the home page, it may be under the “Archived Items” section.  For some reason, some files seem to go there, possibly if the download isn’t complete.)

When I did some testing of the email-to-Kindle function, it generally worked well.  However, in my early tests, about half of the text files, and about a third of the .PDFs, didn’t come through.  I tested sending multiple files (four, all text) as attachments in a single message.  Two of them came through, and the other two never did.

So, you can just get any ebooks, right?  Well, not quite.  The Kindle seems to be fairly limited in this regard.  You can get ebooks from Amazon, of course.  These are indicated by an .AZW extension.  In terms of the ebook standards, you can also get and read .MOBI files.  (.MOBI and .AZW are apparently the same format, except that .AZW are locked by Amazon.  You can get some utilities to unlock and convert them, but I haven’t done a lot of testing with that yet.)  The Kindle can handle text files, but, of course, they don’t have any formatting.  Kindle says it can handle HTML, and that is partially true.  You can send an HTML file, and it will come through.  But it doesn’t render: you simply see the text of the file, HTML code and all.

Kindle says it can handle .PDF, although it also says this is experimental or beta.  It doesn’t support links within a .PDF, but it does support extracting text from a PDF (as long as it really is text, and not an image), which I found handy, and just a little surprising.  It does not, of course, handle locked or password protected files.

And it does not handle .ePUB format, which is a real nuisance.