Monday, December 29, 2008

Slow down!

Do you get the feeling that the pace of life is accelerating too quickly for you? I do. I think it all started with instant coffee and TV dinners. In the tech world, there was email because we couldn't wait for telephone calls, or snail mail to be returned. (Don't you just love that term? Talk about slow!) But that wasn't fast enough, so we went to Instant Messages. But even those that take more than a few minutes to answer aren't acceptable, and so now people text each other from their cell phones because they can't wait until they are sitting in front of a computer.

We say that Web pages are called slow to load if they don't appear onscreen in 20 seconds or so before we hit the reload key. And it was too hard to build Web sites from scratch, so we have Wordpress et al. to make building blogs a snap. But even blogs are too much work, so we now have Twitter to send short bursts of information out to the world. Soon we will have nanoblogs, one-word missives that we can transmit to millions of people. Pity that we have become so pithy. The devil is in the details.

Videos that are longer than three minutes are too long to watch. We have Tivo and DVRs that can fast-forward automatically through commercials, because no one wants to watch them in real time anymore anyway – who has the time to wait for a program to start at the top of the hour? It seems so quaint now that was the only way we could all see "must-see TV" back in the day on our black and white sets that were encased in our cherrywood furniture.

We have video Skype calls for instant conferencing and impromptu meetings, even with people that are in the same office, because we can't spend the time to get up from our cubicles and walk down the hall. Software "builds" used to be created weekly, then daily, now they are done hourly, and even that isn't fast enough for the always-connected, hyper-broadband generation. It used to be enough to carry around a few megabytes on a flash drive, now we can take our entire digital repository and listen to music and videos too.

And don't even get me started about social networks, or online dating, or even online breakups (I don't need to know anything more about Jimmy Wales, puh-leeze!).

Maybe it is time to start slowing down. Take a few minutes to re-read that email before hitting the send key and regretting what you said in haste. Call someone on the phone in real time, and turn away from your screen when you are talking to him or her so they have your undivided, single-tasking attention. Interact with someone in your office by getting up out of your chair and visiting with them, not to waste time or shoot the breeze, but to get a reaction and some face-to-face feedback.

Have a nice holiday break, if you are reading this this week. And a great New Year's!

Tuesday, December 16, 2008

SecurePC may be too costly for what it delivers

Is $600 for a "netbook" too much to spend these days? Apparently so. I tried out the SecurePC from 01com.com and while a nice package, the price is a bit steep considering the competition.

The idea behind the SecurePC is a nifty one: put together a stripped-down version of Windows XP that just can connect to the Web and do nothing else. You do not have access to any local storage, so your PC can't get infected from malicious Web sites or emails. You can't download any programs. If it lives out on the Internet, you can run it – the usual Flash and Java add-ons come with the machine. Otherwise, forget it.

The notebook runs Intel's Atom processor, so it is quiet, cool, and compact. The screen is bright but isn't going to win an awards for size – it is a 10 inch diagonal and can run an external video monitor in the odd resolution of 1280x960 because of its form factor, I guess. And it comes with a solid state hard drive so there is one less moving part and heat source to worry about.

I liked the design and feel of the machine's hard plastic case and they way it boots up almost instantly – it takes longer to find your wireless network than it does to bring up the overall system. The keyboard is a bit cramped for me, particularly the comma and period keys that are somewhat squished together. And it comes with three USB ports, although I am not sure what you would connect to them other than an external mouse. If you try to plug in a thumb drive, you aren't going to get any files off it. The SecurePC does support USB 3G broadband modems, but I didn't test any.

You can access network shares via the wired or wireless interfaces, but again, I am not sure what you would do with the files when you see them, unless you could run a auto-executing virtual machine session across the network. To get an idea of how stripped-down this OS is, you open up a rather sparse Control Panel. There isn't much you can do, which I guess is good if you are getting this PC for grandma.

The disk storage is limited, and I had to play some games adjusting the virtual memory settings that would also allow enough room for temporary files: InTouch could spend some more time tweaking these setings. Another drawback is that you can't upgrade your OS when Microsoft issues the inevitable patches since you have to wait for InTouch to release a new image of the machine's innards.

If you are paranoid and can live without any applications – other than IE – than this is worth a look. It could be the perfect kitchen computer, or a second machine to do a lot of Web searching or Webmail on. The only real issue I have is the price. For $350, I can get a Dell, Acer, HP mini (or others here) that has a 10 inch screen and a full version of Windows and larger hard drives, and for the price of the Secure PC I can get a full-strength laptop with a 15 inch screen. And to make things more complicated, Radio Shack is selling netbooks for $99, plus the cost of a 3G broadband wireless plan from AT&T for $60 a month for a two-year contract.

Wednesday, December 10, 2008

How to stop leaking data

One of the great things about the Internets is that it provides universal connectivity between your desktop and the world. But that is also a tremendous weakness and security professionals often lose sleep over how easy it is for a rogue employee to email a friend – or even his private Webmail account – their entire customer list or other confidential information.

There have been a number of products to try to track or block leaking data, and this week I was testing one of them for my WebInformant.tv video screencast series -- TrueDLP from Code Green Networks. The idea is fairly simple: you install their appliance on your network, point out your most sensitive data, and then it watches over your packets and sees what is leaving the premises. It doesn't take that long to setup and install, once you figure out what it is doing and what you are doing.

The tricky part is figuring out exactly what is your most sensitive data, and being able to focus in on it in a way that the product can identify. It comes with dozens of various templates to be able to recognize social security numbers, or names and addresses, or stock symbols, or other kinds of well-formatted data. But the real plus is being able to handle unformatted data, such as a memo about a customer's preferences that is just a Word document, for example. Code Green can connect to a SQL database and directly handle the query syntax to select particular data types, and it can also connect via WebDAV to Sharepoint servers or other document repositories too. Once you find your data, you create protection policies and tell the appliance what to do – whether to just log the violation or actually block the activity.

You also need to make sure that you are matching everything properly, because the last thing you want to have on your hands is a series of false positives that you have to chase down. You can also set up fancier things, such as automatically requiring emails between two places (such as your office and a partner) to go out encrypted. Speaking of encryption, they work with the Blue Coat Web proxies so that even if someone is using SSL connections to talk to their Webmail accounts they can take those packets apart and see what someone is doing. That is pretty spooky, but hey, you have been warned!

There are other things that the product does, such as being able to detect content on removable USB thumb drives, or even block their usage entirely. This is the way of the world: as these drives get beyond 64 GB (yes, gigabytes), they are more of a threat for someone to just literally take an entire database out the door in their pocket. I recently ran up against this when I was in my bank trying to provide documentation for a loan. I had brought a CD, a USB thumb drive, and had saved the documents on my Google account just for good measure. Because of the bank's endpoint security lockdown policies, I was 0 for 3 and had to send them the old fashioned way, by making paper copies, once I got home. At least it was nice to know that they had protected their employee's PCs.

The interesting thing is what happens after customers get their hands on this Code Green product. Lawsuits typically ensue, so to speak, because often the network administrator finds someone is doing something that they aren't supposed to be doing. One of the product managers I was working with told me that this usually happens within the first week of the product being put into production. Given that the basic price of the product is ten grand, I figure that is as close to instant ROI as you are going to get these days, considering the cost of most litigation.

So take a gander over at WebInformant.tv and watch the four-minute video of the Code Green appliance. It is a very innovative way to detect and prevent data leaks and well worth a closer look.

Monday, December 1, 2008

Has TinyURL gotten too big?

If you use a service to shorten Web links such as TinyURL, you might want to rethink your strategy and perhaps look to another service provider. Why? Because lately, TinyURL has gotten too popular, thanks to Twitter using the service to condense long links into more manageable lengths that can fit into their 140 character limits, among other users. As with many things on the Interwebs, the price of popularity is outages, what some would call being Slashdotted, after the Web site that can direct thousands of readers towards an article in a click of a mouse. And apparently TinyURL has suffered from a regular series of outages, whether due to popularity or poor IT planning, I can’t say.

TinyURL isn’t the only URL shortener, but perhaps the oldest and most well known. In an informal survey of people on my LinkedIn group, it was by far the one of choice. Most people were not aware of any downtime with the service, which isn’t surprising because unlike IM or email services that we pretty much depend on throughout the day, URL shorteners don’t report their status immediately, and usually not to the people who have created and posted the shorter links. The only way someone would find out if they weren’t working was to click on all of their shortened links and make sure that they are directed to the appropriate page.

So there are several issues here. First is the usage of these services from a general sense: they can obscure malware or exploits and they create a dependency that can increase link rot if they break. One of my correspondents alternates his shortened links with two different services, to at least cover the possibility of a single point of failure.

But the second issue is that why should anyone continue using an unreliable service, and one that will continue to get more popular as more people get comfortable with Twitter and similar services? It seems like now is a good time to consider alternatives to TinyURL, which is the subject of an article last week in by Marshall Kirkpatrtick in the ReadWriteWeb. There are probably thousands of such services, and Chris Messina has screen shots of them here.

The service notlong has a list of others, along with a more detailed comparison of their own (at notlong.com/links). What is interesting about their service is that you can have a subdomain, such as webinformant.notlong.com, that will point to your link.

Marshall recommends the bit.ly service, which was also mentioned by some of my correspondents. The only issue I have with it is the dot “ly” domain belongs to Libya, and while the relationship between any domain owner and the Libyan government is small to none, it still makes me somewhat uncomfortable. Another service that has come highly recommended is SNURL.com, which is also easy to remember and has some nice features. Google has a service call shortur that you can load on your own Web site, provided you have php support.

Good luck and let me know what your experience has been with these services.

About Me

My photo
David Strom has looked at hundreds of computer products over a more than 20 year career in IT and computer journalism. He was the founding editor-in-chief of Network Computing magazine, and now writes for Baseline, Information Security, Tom's Hardware, and the New York Times.