Network security is a lot like tough love

For those of you that are parents, have you ever considered how keeping our networks secure is a lot like trying to provide tough love to our children? When we are raising our kids, knowing when to say no is one of the hardest things we have to do. We also have to let our kids make their own mistakes, and when they do how they have to face the consequences. Finally, blended families through remarriage have their own special issues. (My thanks to my friend Carol for the original idea.)

Now, let’s consider what this means for us as network and IT professionals. Learning how to say no is understanding how to block the wrong kinds of traffic entering our networks, such as malware and viruses. And today’s threats are also coming over Instant Messaging and peer-to-peer connections, so there is that to consider. It is always tough to say no to your kids, and your users, and even harder when your users always want to hear yes when we are saying no, too.

Learning from our users mistakes is also particularly difficult. We have to review our firewall and access logs and make sure that network exploits haven’t happened on our watch. Part of this is also understanding when we don’t have sufficient resources for this kind of monitoring and being able to make a case to outsource this function so that we can spend our time elsewhere.

Part of tough love parenting is teaching our kids how to face consequences of their actions, and part of our jobs as networking professionals is showing our management the consequences of their actions too. If our firewalls and other protective gear is outdated, that decision will have certain consequences. If our desktops are more than five years old and haven’t been patched with the latest protection, that will have consequences too. If we have deployed virtualization without careful analysis, that will ripple across the data center when there are problems.

Finally, there are the special issues that blended families and step-children bring to the table, and that has its analogs with how mergers and acquisitions play out in the corporate world. What if my newly acquired subsidiary is running Juniper and I am a Cisco shop? Or if they outsource all their Web servers and I still run them inside my data center? Or if I have been using a smaller vendor that is now bought by HP or Cisco or Oracle, just to name a few companies that have been on buying binges as of late?

How does this translate for our daily interactions with our users? Part of being a great parent is being able to listen to the subtext, and understand what your kids are really saying to you when they ask you questions. The same can be said for our users. I remember one of mine from the middle 1980s who didn't like any of my suggestions for how to use his PC. What he really was telling me is that he wanted to make his own mistakes, and learn from the experience. Of course, he formatted his disk and wiped out his data along the way to learning how not to do that, and I had to hold my tongue.

Another facet of IT-by-parenting is understanding that security-by-obscurity is not going to work. On the Internet, especially today's Facebook-Twitter-always-in-your-face Web 2.0 version, everyone knows your business, and even your personal life too. You need a plan, and you need to protect your networks accordingly.

Yes, being able to provide tough love is, well, tough. If you want to hear more about this, it coincidentally is the topic of a speech that I am giving on Thursday at the Sonicwall sales conference in San Francisco. If you can’t make it, I can bring this talk to your meeting and customize it for your audience, too.

Come see the spyware side at Sears

The news late last year about a community Web site from Sears hasn't been good, and should be a sobering lesson for any would-be eCommerce merchant. Security researchers uncovered issues with the site, MySHCcommunity.com (Sears Holdings Company is what the buried acronym stands for). Users can "optionally" install some very pernicious spyware on their computers that will track their browsing history and purchases.Harvard B-school professor Ben Edelman's blog describes the installation process in copious detail here.

Sears' documentation for what exact information is being tracked by the software is buried inside a license agreement that few will read, and even fewer will understand if they do. It is also, according to Edelman and others, misleading and potentially illegal. Ever wondered why companies that produce this spyware use different names? It is so consumers can't easily figure out what is being delivered to their PC. The MySHC software goes under different names, such as VoiceFive and TMRG, Inc. yet seems to be similar to ComScore's RelevantKnowledge affiliate marketing software.So what can we all learn from this debacle?

First, protect your customer's privacy or you won't have any customers to worry about. Australia is just one of many places around the world that is beefing up its privacy laws this year to protect unintended data collections and breaches. IT managers need to be involved in the creation of new applications that touch customers and vet these things properly. They also need to understand the regulatory and compliance implications of collecting all this customer data, and where this information is stored both inside the corporation and how it is shared with any partners or consultants, too.Second, any corporation should by now have a clearly worded privacy policy that is brief, to the point, and not written in legalese.

Security researcher Benjamin Googins from CA talks about how users will see one of two different privacy policies, depending on whether or not the spyware is installed on their PC by MySHC.

Finally, call a spade a spade. If you are going to conduct research on consumer buying trends, then do so in a way that doesn't monitor their computers: Sony found this out the hard way a few years ago. Since the blogosphere pounced on MySHC, Sears execs have defended the practice, claiming that few users actually go through the process of installing the software. That is a lame excuse, and time for some straight talk and to retool the site and remove the software.It shouldn't take a Harvard professor and an engineer with a packet analyzer to make Sears come clean about its privacy policies.

How to create a viral video

Ever wonder what it takes to create a viral video? As someone who started out in college as a physics major, it is gratifying to see people like Stephen Voltz, Fritz Grob and Walter Lewin become famous, at least on the Internet. These people might not be household names like the Spears clan, but at least they are doing things that I can be proud of.

Voltz and Grob are the guys behind Eepybird.com, the people that combine Mentos with Diet Coke to create geysers of exploding soda and some very entertaining videos. Their videos have been downloaded millions of times and enjoyed by people all over the globe.

Paul Gillin and I got the chance to chat with them this week on our TechPRWarStories.com podcast series. (For those of you that haven't yet subscribed, each week we talk about new media topics that would be of interest to public relations and marketing professionals, as well as interview leading luminaries and interesting people.)

What is fascinating is how quickly the duo became famous: within a week of uploading their first video, they were booked on all the major talk shows (and this is back when these shows had writers so the competition for guests was tough). Voltz and Grob talked about having excellent video production values isn't quite right for their audience: like so many things on the Internet, Just Good Enough Production is really what counts, and getting across a Just Plain Folks sensibility is really the best path towards more click-throughs. Plus, seeing all that spraying soda helps, too.

You can download the podcast here and hear directly from them about why they do what they do.

Contrary to popular belief, the duo has had plenty of support from the marketing arms of both Mentos and Coca-Cola companies. As you might imagine, they consume a lot of product for their backyard experiments, and they told us that a lot of planning and testing goes into setting up the final shots that you see online – sometimes these three minute videos take months of preparation. They now devote themselves full-time to their experiments, and have gone on the speaking circuit and done them live at various cities, soaking volunteers with soda geysers.

Lewin is an MIT physics professor who is also a download king, but his videos are educational rather than pure entertainment. His videos are the actual lectures that he gives his undergraduates, and are part of the MIT Open Courseware project. MIT has put 1800 of its courses online over the past several years, and now has some of them available in ten different languages including Thai, Chinese and Spanish. If you need to brush up on your intro to physics, you can start with this link here.

It is nice to see all three guys become notorious, and I mean that in only good terms.

Vendors as tech publishers

I have known Sam Whitmore my entire journalism career -- we both were at PC Week (Sam actually was one of its founding editors) in the middle 1980s. Sam runs his own shop called Media Survey, where he interviews tech and business media and tracks trends for PR professionals and others. He asked me to write a series of articles about the evolution of vendors becoming their own tech publishers. They ran on his subscription-only mailing list late last month and are reprinted below with his permission.As the major tech publishers go through additional layoffs, shut down publications and generally disinvest in their editorial product, the most experienced journalists are going to work as analysts and joining and creating vendor-driven editorial projects.

These projects are not always some custom-published vanity efforts but attempts at real editorial efforts to extend brand awareness and fill the void left by the tech pubs. Microsoft, Cisco, Salesforce.com, and Oracle all try to mimic the level of professionalism and technical authority of the trades. These vendors are all worth taking a closer look at -- but know that you may never see it all: in Cisco's case, at least one former trade editor has been hired to publish content behind a gate exclusively for customers, employees and partners."You have greater impact on the industry as a whole when you're writing reviews and working at a major trade publication," says Lori MacVittie, a former Network Computing labs analyst who now works out of her home as a technical marketing manager for F5 Networks. "Now we have a much narrower role working for F5," she says. "And you realize that you are going to have some bias, and try not to say nasty things about the company we work for."

More often than not, the journalists who succeed in vendor-land are the technically savvy ones. Peter Coffee, whom I hired back in the late 1980s at then-PC Week has been with Salesforce.com for most of 2007 and does a brilliant job blogging and video-posting about Web applications development.

Former InfoWorld marquee columnist Jon Udell has been with Microsoft for about as long, and continues to write about data access and programming issues. Reading their blog posts show their depth of understanding of arcane issues that isn't your average bedtime reading, even for many seasoned IT professionals.

While at Network Computing, MacVittie and her husband Don often played the role of analysts, because of the high quality of advice they gave to vendors. "When we were at CMP, we used to talk about how much we wanted vendors to open that kimono and show it to us," says Lori. Now that we are at F5, she says, she has a new appreciation for complexity and how difficult it can be to make sense of it all.

The tech pub world is evolving beyond just blogs and podcasts, and likewise, we'll have a hopefully rich mix of vendor-sponsored content from a wide variety of sources. Let's hope that tech PR pros, in concert with their clients, can play an important role in the overall discourse.

Part 2. Why journalists leave their tech publishers.

While some tech journalists have found a new home on the vendor side, others have become reportorial industry analysts. Maybe we should call them "journanalysts." Why do they leave?

Former eWeek lab analyst Henry Baltazar is now with The 451 Group in San Francisco as a storage analyst. He says that "although my audience as analyst is smaller -- since most of the content I produce only goes out to our subscriber base -- our readers (VCs, investment banks, vendors, end users) have influence over the markets I cover." He is also writing in more depth and has more time to cover the companies than he had at eWeek.

China Martens left the IDG News Service this summer to join The 451 Group in Boston. Martens says she has "more influence as an analyst, since the level of engagement is very different. There is a sense that as an analyst you get much greater insights into the 'why' of decision-making, and of course there is more time to engage with people, too. We also don't quote anyone in our reports so there is not the same pressure as in journalism to come up with the killer quote or two."

She also makes the point that The 451 Group keeps her objectivity intact: "I couldn't work anywhere where there were any restrictions in place on what I could say, and fortunately I've still never had to." Unlike some analyst firms like Gartner or Forrester, The 451 Group doesn't take vendor payments for specific research reports.

Deni Connor left Network World this fall. She remains there as a freelancer, writing a twice-weekly storage newsletter. But now Deni works for herself, as principal analyst for Austin, Tex.-based Storage Strategies NOW. "This is something that I wanted to do for a long time," she says. "And really, it is pretty much what I have been doing when I was a journalist, providing technical content to readers." Connor did PR for a networking vendor back in the day when Token Ring was still a viable technology, and ran an internal publication for Novell, too.

It is this background that has encouraged her to put out her own shingle. "I am fortunate that I have marketing experience and know-how, and am comfortable promoting and marketing my own business," says Connor. "Other journalists that don't have this background may find that a limiting factor."

Part 3. What does this all mean for PR professionals trying to get ink – or page views – for their clients?

Well, for one thing, it is going to be harder to keep track of where to pitch stories, and also harder to get these pitches across the transom. You should first hone your skills at tracking the blogging community: use a blog search tool, start posting comments on the more influential ones, and go meet them at the conferences that the bloggers who are working in your market niche attend. In China Martens' case, she has had to find a whole new set of AR contacts: "the analyst relations and public relations folks at the companies I cover are completely different, so it feels almost like I am starting over, establishing fresh relationships with companies that I've tracked for many years."

Second, it is too late now, but the most successful PR types are those that have developed good personal relationships with these editors before they depart CMP, Ziff et al. If you want to pitch the vendor-sponsored editors, make sure you fit into their niche and have something that can complement the overall message and product line that they represent. This means understanding your client's overall partner, channel, and distribution ecosystem and being able to find how your client's news nugget can apply to these third-party players.

For example, a new SharePoint add-in product can be pitched to people writing about collaboration (such as someone like Chris Miller who writes IdoNotes.com), to Microsoft-centric bloggers, and to major ISVs too. You need to cast a wide net, and spend some time tracking this stuff down. Which means now more than ever you need to understand the overall context for that news nugget, too.

Third, if you don't know how to use RSS feeds to keep up to date on what these folks are doing, now is the time to learn. We have put links to the RSS feeds of the journalists that we mentioned on purpose (rather than provide links to ordinary Web URLs), and if you haven't tried an RSS reader, I recommend starting with Bloglines or Google's Reader. To make things easier, you can check out the consolidated links on my Pageflakes page and see what you might find appealing.

Using a cell phone overseas

If you are traveling overseas and don't want to pay a ton of money for your cell calls, this column is for you. I got started down this path because of some upcoming speaking engagements in Australia in the new year, and I wanted to be prepared and be in touch. Soon, it turned into A Project, and now I share the results with you, my gentle readers, for your own benefit should you find yourself in similar straights.

You have the following alternatives

- Buy a phone calling card once you get to your destination and use it from payphones or your hotel,
- Don't do anything and use your existing US phone,
- Buy a new SIM module for your existing phone, or
- Buy a new SIM module and a new phone.

Why bother? If you have ever taken your cell to Canada (or even further a field), you know why: the per-minute cost for calls is ginormous. And while it is nice to be in touch when you travel around the world, there are lower-cost ways to do it.

The calling card is a decent option, depending on where you are going and what your hotel charges for both toll-free and local calls. Some are still back in the profiteering stone ages and charge almost as much as the cell providers on a per-minute basis, even to make a local call or to connect to the calling card provider. You should know that some calling cards may not work with some pay phones, according to Dan Dern. He also reminds me that you might want to invest in a DMTF tone generator if you need to call back to a stateside answering machine – some foreign phones don't generate the correct touch tones. You can use the Java applet on your computer here.

The other options will only work if you have at least a tri-band phone on either T-Mobile or AT&T/Cingular networks. If you are using Verizon or Sprint, you need a new phone. Most of the world's cell phones (except in Japan and a few other places), work on what is called the GSM networks that operate at either 900 MHz or 1800 MHz. The US and Canada GSM networks operate at 850 MHz and 1900 MHz. So if you have a phone that can work on at least three of the four bands, you should be set to roam abroad.

So we arrive at the last options, and here is where things get interesting. Before I get any further, let me explain that your cell phone has two important pieces: one is the phone itself, and this makes a difference with the number of radio bands that it works on. But the second piece is the SIM card that is inside the phone, and if you are like most normal people you probably haven't given this little thing much thought – until now. This SIM card is what is used by the phone to store your address book and also gives your phone your inbound number and identity on the cell network. It is about the size of a microSD memory card.

If you replace the SIM card that came with your phone with a card that works in the country you are visiting, you get several benefits. First, you don't pay roaming charges for local in-country calls, although if you are calling back to the States, you will pay international long distance charges. Second, if people in-country are trying to reach you, they don't pay for the international calls either. (Some of the networks overseas have the more enlightened method of calling party pays, but we won't go there for now.) You also don't use any minutes on your American cell accounts, which can be good if you have a limited number of minutes – when you travel, you don't think about all the time you are on calls. The trouble is if you are going to several different countries, then you need different SIMs and have to keep track of the numbers too. That gets onerous.

So there is another solution: buy a SIM card from Maxroam.com. This Irish vendor offers a universal SIM that will work across the globe, and has lower per-minute rates no matter where you are. Plus, like the VOIP services, you can set up your number to automatically forward to a series of numbers, so that you can be more easily reached as you travel. You don't have to sign a contract, the SIMs are inexpensive (about $43), and you can add more minutes to your account easily over the Web and charge your credit card. It took me a few minutes to setup and activate the SIM online: you pick a US-based number for your phone, and pay for another number in the country or countries that you are visiting. They have a wide selection. Each additional number is just a few dollars per month to maintain.

There is just one catch. Chances are, your cell phone is locked to your carrier that you are currently using. This means if you try to take out your SIM card and replace it with this Maxroam card, your phone won't work. You might be able to receive calls, but not make outgoing calls.

So how do you get your phone unlocked? You can pay for a special code that you enter and here is where things get dicey. Until recently, American cellular carriers claimed that unlocking was illegal. The laws are changing, but still many of the companies that provide this service have the feeling of going to the seedy side of town where goods are bought in cash through an open car window, not that I conduct my business in this fashion, you should know. There are a number of unlocking providers, here are just a few and what they charge per phone to unlock:

- Uniquephones.com $15
- Gsmliberty.com $25
- Cellularunlockcodes.com $20
- Unlockexperts.co.uk $13
- Cellularlocksmith.com $20
- Cellphonerepair.org $25

I have tried a few of these, and haven't had good experiences. All of them work by first charging your credit card the fee, and then sending you the code via email. Sometimes they take their sweet time in sending this code. Uniquephones "lost" my order, and only when I emailed their executives and spoke to them personally (they are based in the UK), did I get my code delivered.

There are other services that have downloadable software, but that seems even more trouble. Once I got my code, it took seconds to enter it on my AT&T phone, and it was running on T-Mobile's network with my new number from the Maxroam folks. Sweet.

If you are reluctant to do business in this fashion, then you have another option, and that is to still buy the Maxroam SIM card but get a new phone that comes unlocked. If you are a Verizon or Sprint user, this is really your only option. There are many Web sites that offer to sell you unlocked models. The least expensive phones that I could find (that were at least a tri-band GSM model) were on TigerDirect.com – they were selling a Motorola V180 for $50. And Amazon.com has a Motorola V220 for $70. Neither of these phones are going to win any design awards, but they will do the job.

Plan on taking a few weeks to negotiate all of these options, so don't do this a few days before you have to leave the country. And you might want to bring along your current SIM card, just in case.

Facebook vs. LinkedIn

The world of social networking is getting, well, more social. But I question whether it is also getting more open, at least with my understanding of what the word open means. And whether it is becoming more useful, at least for business purposes.Last week Facebook and Bebo (another network that is primarily UK-based) announced that the copious applications that were created on Facebook will now be able to run on Bebo, and soon other social network sites.

Also in the news, LinkedIn announced a beta version of its home page, which I almost missed because it is so much like its existing home page I am not sure what the fuss is about. They also have finally revived their Groups application and have made it easier for users to add a few applications too.So are we seeing more openness with these social sites, or just more vacuous PR-ware announcements that have little importance? A little of both.First, let's talk about what I think openness should be.

Ideally, I should be able to write an application to a published series of program interfaces, and be able to move data in and out of the social network site in a way that makes the most sense to me, the ultimate user. None of the sites come close to doing this right now.Let's just compare Facebook and LinkedIn and see where the stack up on the openness scale. Facebook has a published guidelines for how to build applications. As a result, there are thousands if not millions of apps that have been written, from the frivilous to the semi-useful. People try out apps when they see what their friends have done, because the proces of selecting an app is one of the notifications you can see on your news feed home page. As a result, these apps can get very viral and quickly gain traction. Or they can languish if you don't have the right A list friends to spread the word. Facebook apps are kind of like a trendy new nightclub: if you invite the right friends to come on the opening night, you are going to have a crowd lining up outside your door. These are the apps that are now going to be shared with other social networking sites like Bebo.

Ironically, Facebook is trying to prove to the world that they are more open than Google, who announced their own application interfaces under the "Open Social" name a few weeks ago. You could say that Facebook is trying to be like the Microsoft of the social networking sites, if Microsoft would ever open up some of its Windows programming interfaces. Or maybe they are just trying to not be evil. (Too bad they muffed that part with the various privacy issues, but that's for another column.)Open applications isn't the only metric of usefulness here.

Also important is how you populate your network on these sites. With Facebook, you can import your contacts to populate your list of "friends" from a variety of Web-based email services, including Gmail, Yahoo, and so forth. You can import contacts from a text file if you prepare it properly. However, once you contacts are imported and linked to your account, you can't export them or even figure out what someone's email address is if they have changed it, unless they tell you explicitly on their profile. LinkedIn doesn't have a set of apps guidelines yet, although they keep talking about it. They have similar contact import features to Facebook, although they will terminate your privileges if you send out emails to too many people that you reject your approaches,claiming they don't know you. The service does allow you to export your contacts anytime you wish, and in several nice formats too.Let's move to talk about groups of your contacts. Neither of them is as useful as they could be. Ideally, I would like a publishing system that I can alert all the people in that group with a single posting. Maybe it is because I have been publishing this Web Informant email newsletter for so long that I continually hope there will be something better than an email listserve to send it out. Facebook allows anyone to create a group on any topic. Many of them reflect the collegiate (or inane) demographics of their audience, and most of the people that I link to there are in a constant state of joining and unjoining various groups. It is easy to do both, and as a result group membership isn't really worth much, other that to keep track of which groups are popular among your friends, since the act of joining is what shows up on the home page "news feed" as individual events and again can be very viral. But since each individual has to take the action of joining a group, you can't set up a pre-populated group with all of your friends. You can send out notifications to all of your friends, but that isn't quite what I am talking about here.Facebook has this groups capability already built-in, there is no need to add an additional application and several business people have begun using Facebook as their primary communications mechanism in a one-to-many fashion. (Jeff Pulver, the VOIP impressario, is one of the more notable and public ones.)

As I said earlier, LinkedIn's Groups has been enabled in the past several weeks. You first have to get approval from the LinkedIn Police to create your group. This took me just a few hours. Then you have to invite people to join, but you can't just send out a notice to your existing LinkedIn network of people that you have identified. No, that would be too easy. There is a multiple-step, multiple-opt-in procedure before you can join my "Strominator" group, as an example. Go ahead, I dare you to try, you will see how tough it is.

I understand why LinkedIn is doing what they are doing, but it isn't going to work, and unless you have tremendous patience and are very detail-oriented, it is much easier to use something else to group your contacts, like an email listserve.

So here we are. A little more openness for social sites. Google is trying to get its own beachhead established, and while Facebook stumbles about with its privacy issues, they have the beginnings of something that can be used for ad hoc groups. LinkedIn is still too heavy-handed for my taste, which is too bad because we all have internalized the LinkedIn dance: Update your profile, ask for recommendations, then start looking for a new job. And in the meantime, we have newer social networking sites like Spock to deal with too. And do-it-yourself sites like Ning.com that allow you to pretty much build your own network from scratch with very little programming skill.

F for fake

It is time once again to recap the fakery, hoaxes, and all-around trickery online over the past year. It seems like we have had an exceptionally busy one. Thanks to social networking sites, user-generated content, and increasing use of online by everyone over eight years old, we have plenty to write about this time around.

To start the creative juices flowing, I caught "The Hoax," the Richard Gere movie about Clifford Irving, one of the all-time great fakers (he faked a biography of Howard Hughes and sold it for millions of dollars, eventually winding up in jail). I couldn't help thinking as I was watching this movie (which of course plays very loosely with real events) how much easier Irving would have had it in the online era of today. Back in the 1970s, he had to get on planes and mail forged handwritten letters with real postmarks and such to disguise the fact that he never actually talked to Hughes. Today he could do the same thing in about ten minutes with a blog.

So the biggest news the past couple of weeks has been the Myspace teen suicide backlash taking place about 40 miles away here in Missouri. The suburban community passed a law making it a misdemeanor to harass someone online. Almost immediately we have a fake blog that purports to be the writings of the Drew family gathering hundreds of comments and fueling the vigilante fires even further. The story, for those of you that have been not online, is about a teenage girl named Megan Meier who killed herself last year over a series of fake Myspace postings from a boy that were actually written by Lori Drew and her older teenaged employee. Drew was a neighbor of Meier, and ironically the harassment law that was recently passed to punish her Myspace postings could be used to benefit her and punish her own blogging impostor. (You might need to re-read the above graf, I know it is a bit confusing.)

While this was happening, a friend of mine was telling me about how he was posing online as a woman, trying to ensnare a former employee of his who faked some reports and was never caught. Luckily, he doesn't live in any community that has any online harassment laws. Sadly, he thinks this is all le mot juste and his own version of online justice.

Back to the blogosphere, earlier this year we have Dan Lyons (with whom I once worked when we were both at PC Week back in the 1980s) outed for being the author of the "Fake Steve Jobs" blog and ensuing book tour. I hope some day I can aspire to be the author of a fake blog that will boost the sales of one of my books. (We assume that the royalty payments go to Lyons and not Jobs, but I haven't checked.) In the meantime, I will have to settle for being the real author of real blogs.

Lyons isn't alone, here is a list of several others.

Meanwhile, Steve Colbert's fake presidential bid is dead in the water as a result of his show being in reruns because of the writer's strike. The main point of contention of the strikers is how writers are paid for online works, which are supposed to be over real bylnes. Are you still with me?

And let's now forget earlier this summer with John Mackey, co-founder and CEO of Whole Foods, who posted to Yahoo's financial Web sites using an alias. Mackey was outed in an FTC document, and it turns out he was writing these posts over eight years. Eight years! No mea culpa, either.

Here's hoping that you all have a really great holiday season, surrounded by the actual people that you know and love and care about, and that you can step away from the computer for a few minutes too.

N.B. For those of you too young to remember Irving contemporaneously, he also wrote a book about Elmyr de Hory, a noted art forger. Orson Wells did the movie version, which is where we get the title of today's post. Irving continues to sell copies of the "autobiography" from his Web site.