From FreeKareem.org:

The family of Al-Azhar student Abdul Kareem Nabeel Suleiman, accused of “contempt of religion”, has disowned him before his court verdict session on the upcoming Thursday. His father, a retired mathematics teacher, has demanded applying the Sharia [Islamic law] ruling on him by giving him three days to repent, followed by having him killed if he does not announce his repentance.

I find it hard to root for cultures like this. At times I lose all hope and succumb to feelings of superiority and contempt. This is one of those times.

Why would I say this when their offerings thus far have been somewhat lackluster? Easy, they have the room to stumble. As long as they hold onto their infrastructure dominance they’ll remain in the ultimate postion as far as security goes.

Ultimately, security is going to take place at dozens and hundreds of places in a corporate environment at the same time. The entity that controls the most of those is going to have the most potential for domaince. That entity, right now and for the forseeable future, is Cisco.

Fun With Numbers

Several times in my life I’ve come to the conclusion that many of my interests are oriented around a central concept: that of controlling things in my environment.

Nietzsche called this The Will To Power, and I’ve always rather liked the name. In fact that’s the name of a role-playing-game I made many years ago. Anyway, it’s a very attractive concept to me because it seems to permeate so much of my life.

A few examples:

• Blogging Few things are more ego-centric and will-to-powerish than wanting to be responsible for the spread of ideas — especially if you go through periods where you obsess over visitor statistics.

  I’m not saying it’s not an overall positive thing for many people, e.g. in my case being focused on spreading understanding and such, but I still can’t shake the feeling that it’s tied to something more sinister. I think you’ll find this same underlying theme in the lives of many big bloggers and writers.

• Guns and Laser Pointers Many think that these are very different animals, but I submit to you that they have a lot in common. Namely, the ability to look at something across the room and affect it. This is why women don’t like laser pointers; they just aren’t wired the same.

  Placing a little green dot on someone’s house from half a mile away is really just another way to claim that house as your own posession. “Aha! Look at what I’m doing to you from a distance! Now watch me point at the moon!” It’s quite transparent.

• Collecting Information I think the act of hording information about various topics (like this site was designed to do) is another behavior that falls into this class. And if you think about it, people with this affliction don’t ever use anything they horde.

  They just continue collecting because the stuff that they don’t have is inherantly more valuable than what they already own. Why? Because secretly, the goal is to collect ALL the information. It’s a power thing — through and through.

So I’m not saying this is a bad thing — only that it’s something we should recognize. Once we realize what we’re doing we can more easily control it. Oops.

Very cool stuff…

Here’s a Scottish one: http://accent.gmu.edu/searchsaa.php?function=detail&speakerid=82

I’ve just completed a “Reddit this” FeedFlare module for Feedburner users. This will add the option for your RSS users to submit your posts to reddit.com right from their RSS feed application. After it’s installed, it’ll look like this:

And here’s the FeedFlare link so you can use it in your own feed. I’ll be adding it to the official repository soon so people won’t have to do a custom addition: http://dmiessler.com/feedflare/redditthis.xml

Feel free to contact me if you have any questions or comments.:

Here’s the fix: in $blogroot/wp-includes/post-template.php, edit line 453 (for me) to read:

if ( pregmatch('///', $content, $matches)  && !isfeed() )

The bolded part is added to ensure that the more tag shenanigans don’t take place in feeds. Many thanks to Manbou Haven for the answer.

Anyway, this should put an end to my RSS feed issues. If anyone is noticing lingering weirdness, do let me know.

Many who are new to networking and security wonder what it means to have “ports” open on your computer. Some get rather anxious when an online port scan reveals that something’s open on their system. What follows is a silly, but hopefully memorable way for beginners to remember how nework ports work.

Houses, Windows, and Midgets

Imagine a house with many, many windows. And imagine that all these windows are spring-loaded so they slam shut when they aren’t being actively held open. Also within the house are a number of midgets. Each one is able to talk to people outside the house temporarily, but only through an open window.

Well, ports on a computer — just like spring-loaded windows — are also closed by default. They don’t just stay open on their own. The second someone stops holding one open, it slams shut. So when you do find one that is open, your mission is to find out what little midget program is holding it that way.

Don’t worry about the port. It can’t stay open by itself. Instead, focus on the midget.

For that task you can use a program from Foundstone called Fport. It’ll give you the name of the midget program so you can find him and tell him to get the hell out of your window. Once he’s gone, i.e. you’ve shut down the program, the port will be closed again.:

I could shield my body from a medieval sword attack using nothing but my amassed collection of printed out vim tutorials. I thrive on them. They sustain me.

I hate the idea that I could be using something like vim in a sub-optimal fashion. I want to do things the best way possible; it’s an obsession that extends to much more than just vim.

I do realize it’s a major flaw. It breaks the fundamental Zen rule of not letting the best be the enemy of the good. Well, I don’t know if that’s a Zen rule, but it seems like it would be. Do you guys have similar obsessions, and if so, how do you handle them?

Yesterday I wrote about Joanna Rutkowska’s work that highlighted a serious security flaw in Windows Vista. Her finding was that in Vista, many applications require that they be installed with administrator privileges, and that during the install process users are given two options: 1) install with elevated privileges, or 2) don’t install the application at all.

Yesterday’s post was sloppy, however. It came to the conclusion that Microsoft made a security design error in implementing this system. The truth of the matter is that there is a serious security problem with respect to Vista, but that problem is not due to a recent decision by Microsoft.

The real problem is that thousands upon thousands of 9x and XP applications were written according to the old security model, i.e. the one in which installers were able to spray their parts all over the system with no issues because they ran as administrator. This won’t work in Vista because they’ve gone to a restricted user model, so they have only one choice — allow the applications to install with elevated rights.

Microsoft had no other choice, really. The alternative is telling people that their old programs are insecurely written and can’t be used. That wouldn’t go over well. Unfortunately, allowing the applications to go in as administrator creates a major problem for Microsoft: it trains the users to say yes when an application asks to be installed with elevated privileges.

This is what’s going to do the real damage. It’s the fact that people are going to get so used to allowing legitimate applications to install with elevated rights that when a piece of malware asks to do the same they’ll happily oblige.

Not good.

But it’s not a Vista problem, really. It’s going to hurt Vista, but the real problem is that of legacy support. It’s ironic, really. All this work to make Vista more secure and it’s going to be largely undermined by how lax they were in the past.: