Adam Fields (weblog)

This blog is largely deprecated, but is being preserved here for historical interest. Check out my index page at adamfields.com for more up to date info. My main trade is technology strategy, process/project management, and performance optimization consulting, with a focus on enterprise and open source CMS and related technologies. More information. I write periodic long pieces here, shorter stuff goes on twitter or app.net.

12/30/2005

Nasty MS Web Image Exploit

Filed under: — adam @ 10:01 am

There’s an exploit of the Windows code used to render WMF files (windows metafile – it’s an image format). There are multiple reports of sites in the wild exploiting this to drop trojans.

http://blogs.washingtonpost.com/securityfix/2005/12/exploit_release.html
http://sunbeltblog.blogspot.com/2005/12/new-exploit-blows-by-fully-patched.html
http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

***All versions of IE are vulnerable to automatic infection.***
Earlier versions of Firefox (1.04) and all versions of Opera are still vulnerable, but they prompt you first. Firefox 1.5 is not vulnerable. Some email and IM programs may be vulnerable if they do previews or you click on a link that opens in a vulnerable browser or opens a vulnerable desktop program (Windows Picture and Fax Viewer).

Obviously, the best workaround for this is not to be using Windows.

If you can, disable all access to WMF files at the network level.

A temporary workaround (although it’s apparently still possible to get infected if you open a malicious file in mspaint):

A Microsoft spokesperson said the company is investigating, though no official word from them yet. A couple of security firms, including Verisign’s iDefense, have published workarounds that appear to mitigate the threat. According to iDefense, Windows users can disable the rendering of WMF files using the following hack:

1. Click on the Start button on the taskbar.
2. Click on Run…
3. Type “regsvr32 /u shimgvw.dll” to disable.
4. Click ok when the change dialog appears.

iDefense notes that this workaround may interfere with certain thumbnail images loading correctly, though I have used the hack on my machine and haven’t had any problems yet. The company notes that once Microsoft issues a patch, the WMF feature may be enabled again by entering the command “regsvr32 shimgvw.dll” in step three above.

Now’s a good time to point out that VMWare now has a free player that you can use to run pre-built machines, and also a “safe web browsing” machine that you can download that comes pre-configured with firefox 1.5 running on Ubuntu. If you have enough memory, this is not a bad thing to do for general web browsing.

http://www.vmware.com/download/player/
http://www.vmware.com/vmtn/vm/browserapp.html


12/29/2005

What, nothing about popcorn?

Filed under: — adam @ 1:22 am

Kottke posts his best of 2005 links.

http://www.kottke.org/05/12/the-best-links-2005


12/27/2005

Opera blogging policy

Filed under: — adam @ 8:34 pm

Opera has a public blogging policy. Google, which has fired at least one person for comments on his blog, doesn’t. Yet one more reason why I like Opera.

http://my.opera.com/community/blogs/corp-policy/


Interesting list of Google acquisitions

Filed under: — adam @ 12:38 pm

This is a list of companies that Google has bought. There are some on there that I hadn’t seen before.

http://www.seobythesea.com/?p=64


12/23/2005

My brother on the transit strike commute

Filed under: — adam @ 9:26 pm

My brother shares the story of his transit strike commute from Tuesday morning:

The story of my Tuesday Morning commute!

Strike? Not a problem. I’m a good New Yorker. I can make things work.

I live up in the Bronx, around 250th Street and realized that if the HOV-4 mandate was going to go into effect at 5:00 AM, I was just going to have to wake up earlier. Out the door at 4:15, past 96th street by 4:45 at the latest. I’m at work with a hot cup of coffee before the whole problem can begin.

Piece of cake.

I begin my commute and realize immediately that something is wrong. It takes me a couple blocks to realize that I am riding in my car with a flat tire. If I were not a business owner with a responsibility to my business, my workers and the general global economy, I probably should have taken this as an opportunity to stay home.

Instead, I changed my tire. Given the pothole situation in the City, I’ve done this before. Again, this by itself is not a problem. Fifteen minutes definitely beats my brother-in-law in terms of time to fix a flat. This morning, however, time was crucial. I get back on the road and race down to 96th Street, where I see many lights flashing at the blockade point. I look at the clock.

5:01.

I am, of course, alone in my car.

I am deftly swept from the highway by flashing lights and three men in blue. It was poetic. They waved me to the right onto the exit ramp and I was back out, literally the second car swept off the Henry Hudson Parkway of the morning.

At this point, I figure that the only thing to do now is find some passengers. This is, after all, the intention of the blockade in the first place: to force a carpool to make sure transportation works like clockwork. It’s time to trawl the streets looking for some people who needed a ride.

But who is awake at five in the morning? The city that never sleeps, let me tell you, is quite dormant at 5:00 AM. The only people I could find were some homeless people and some intrepid early-risers in pajamas with cameras, tracking the chaos that was beginning to accumulate. None of these people were eager to take a ride — and very quickly, I realized I wasn’t the only car on the streets looking for passengers. This started to get a little serious.

At some point, I realized that finding people to go all the way was becoming a fruitless endeavor — but perhaps that wasn’t necessary either. Perched as I was now between 96th and 97th on Columbus Avenue, I saw the light at the end of the tunnel. To get past the blockade, all I needed were four people in my car.

Even if they were only going for one block.

But how can I convince people to go just one block?

I decided to fall back on that good old American pastime: I would bribe people.

I started with my brother, who was conveniently located on Columbus Avenue and who I had already awakened several times trying to figure out what to do. I went to his building and found one onlooker, still in her pajamas and another woman who was on her way to the gym, unperturbed by the situation since she was already on vacation.

“Look,” I said, “I am willing to offer both of you $20 to ride one block with me.”

A couple eyebrows went up. After all, this really sounds like a proposition for the red light district. “Are you serious?” said gym girl.

“Absolutely,” I said.

“I don’t need the money, ” said the pajama lady, “I’ll just go along for the ride.”

Great, now I have three people. I called my brother again. “Come downstairs.” “What?” “No, really, come downstairs.” “In a few minutes.” “Just put on your coat and shoes and come down here. I have two people waiting, I’ll take you one block and then you can go home to sleep.” Younger brothers can be worn down in this manner. He relented, came downstairs with a grumpy attitude but with his coat on.

Due to the cold, we made a mad dash for the car. I started up and drove back to the blockade. The police shone flashlights in the car, counted us, and allowed us to proceed.

Fifteen feet beyond the police barricades, I pulled over. The gym girl said, “Happy holidays.” I passed her back a twenty. The woman in the pajamas said, “You know what? I’ll take you up on your offer after all.” I passed her a twenty. I looked at my brother. “You want one, too?” “Sure… why not,” he said, grabbing the bill before I had even finished the question, already going out the door.

On 95th Street, I’m alone in my car again and think to myself that this is how to negotiate a transit strike on $60 a day.

It then took me ten minutes to get from there to West Soho to work. No traffic, after all. If it were any other day, I would think I was fortunate to have found no traffic. But the empty streets pointed to the ridiculous situation that this strike has caused. People shouldn’t have to go through this rigmarole. It’s just wrong.

Besides, when I got to work, eager to have that hot cup of coffee that got me out the door in the first place, I discovered that there was no place around there open to buy coffee from. After all, the coffee brewers were having a hard time getting into the City as well. No Dunkin Donuts, no neighborhood deli, no guy on the corner. On a cold December morning, it’s a sad day in New York City when you can’t get a cup of coffee.


12/22/2005

More Schneier on secret surveillance

Filed under: — adam @ 10:01 am

“This rationale was spelled out in a memo written by John Yoo, a White House attorney, less than two weeks after the attacks of 9/11. It’s a dense read and a terrifying piece of legal contortionism, but it basically says that the president has unlimited powers to fight terrorism. He can spy on anyone, arrest anyone, and kidnap anyone and ship him to another country … merely on the suspicion that he might be a terrorist. And according to the memo, this power lasts until there is no more terrorism in the world.”

http://www.startribune.com/stories/562/5793639.html


12/21/2005

Schenier on NSA surveillance in Salon

Filed under: — adam @ 9:08 am

Bruce Schneier has an excellent piece in Salon on the recent wiretap revelations:

http://www.salon.com/opinion/feature/2005/12/20/surveillance/index.html


12/20/2005

NYC Transit Strike 2005

Filed under: — adam @ 10:37 am



NYC Transit Strike 2005

Originally uploaded by Caviar.

I took some pictures this morning by the traffic blockades on 96th Street, where the NYPD was preventing people with fewer than 4 in the car from passing.


12/19/2005

Perry on felonious wiretaps

Filed under: — adam @ 11:36 am

This is an editorial that Perry sent to his cryptography mailing list.

I posted this earlier today to a mailing list for cryptographers that I run. Please feel free to send it to anyone you like.

To: cryptography
Subject: A small editorial about recent events.
From: “Perry E. Metzger” Date: Sun, 18 Dec 2005 13:58:06 -0500

A small editorial from your moderator. I rarely use this list to express a strong political opinion — you will forgive me in this instance.

This mailing list is putatively about cryptography and cryptography politics, though we do tend to stray quite a bit into security issues of all sorts, and sometimes into the activities of the agency with the biggest crypto and sigint budget in the world, the NSA.

As you may all be aware, the New York Times has reported, and the administration has admitted, that President of the United States apparently ordered the NSA to conduct surveillance operations against US citizens without prior permission of the secret court known as the Foreign Intelligence Surveillance Court (the “FISC”). This is in clear contravention of 50 USC 1801 – 50 USC 1811, a portion of the US code that provides for clear criminal penalties for violations. See:

http://www.law.cornell.edu/uscode/html/uscode50/usc_sup_01_50_10_36_20_I.html

The President claims he has the prerogative to order such surveillance. The law unambiguously disagrees with him.

There are minor exceptions in the law, but they clearly do not apply in this case. They cover only the 15 days after a declaration of war by congress, a period of 72 hours prior to seeking court authorization (which was never sought), and similar exceptions that clearly are not germane.

There is no room for doubt or question about whether the President has the prerogative to order surveillance without asking the FISC — even if the FISC is a toothless organization that never turns down requests, it is a federal crime, punishable by up to five years imprisonment, to conduct electronic surveillance against US citizens without court authorization.

The FISC may be worthless at defending civil liberties, but in its arrogant disregard for even the fig leaf of the FISC, the administration has actually crossed the line into a crystal clear felony. The government could have legally conducted such wiretaps at any time, but the President chose not to do it legally.

Ours is a government of laws, not of men. That means if the President disagrees with a law or feels that it is insufficient, he still must obey it. Ignoring the law is illegal, even for the President. The President may ask Congress to change the law, but meanwhile he must follow it.

Our President has chosen to declare himself above the law, a dangerous precedent that could do great harm to our country. However, without substantial effort on the part of you, and I mean you, every person reading this, nothing much is going to happen. The rule of law will continue to decay in our country. Future Presidents will claim even greater extralegal authority, and our nation will fall into despotism. I mean that sincerely. For the sake of yourself, your children and your children’s children, you cannot allow this to stand.

Call your Senators and your Congressman. Demand a full investigation, both by Congress and by a special prosecutor, of the actions of the Administration and the NSA. Say that the rule of law is all that stands between us and barbarism. Say that we live in a democracy, not a kingdom, and that our elected officials are not above the law. The President is not a King. Even the President cannot participate in a felony and get away with it. Demand that even the President must obey the law.

Tell your friends to do the same. Tell them to tell their friends to do the same. Then, call back next week and the week after and the week after that until something happens. Mark it in your calendar so you don’t forget about it. Politicians have short memories, and Congress is about to recess for Christmas, so you must not allow this to be forgotten. Keep at them until something happens.

Perry


12/16/2005

All cute, all the time

Filed under: — adam @ 1:52 pm

http://cuteoverload.com/


12/15/2005

Rumours of Google acquisition of Opera

Filed under: — adam @ 12:19 pm

Fuckfuckfuck.

http://news.com.com/2061-11199_3-5996531.html?part=rss&tag=5996531&subj=news

Dear Google: Please stop buying good companies/developers and ruining them with your consumer unfriendly terms of service and loose privacy policies. Thanks a bunch. – Earth.

And I quote from Opera’s privacy policy (http://www.opera.com/privacy/):

No personal information is collected or shared, and providing ad profile information in the browser is strictly optional. The Opera user’s Web usage is not tracked.

There’s nothing like this in any Google policy, because this very idea is antithetical to Google’s philosophy, which wants to collect and know everything about you and use that to “improve the Google user experience”/stock price. This phrase in the Opera privacy policy is critical to what makes Opera any good at all. Let’s all gather round and keep an eye on that if this rumor turns out to be true.


Wireless USB hubs are starting to trickle in

Filed under: — adam @ 10:51 am

This is fantastic. Soon, any USB compatible device will also be a wireless device that can be located anywhere. Sort of. They don’t say explicitly, but I’m guessing that this won’t work with non-powered devices that draw power off the bus, such as tablets and some external drives. Still, this will be nice for relocating printers and such across the room without running cables.

http://www.biosmagazine.co.uk/article.php?id=2572


12/13/2005

Alexa index is now open to the public

Filed under: — adam @ 12:13 pm

Wow, that’s so amazingly cool.

‘In short, Alexa, an Amazon-owned search company started by Bruce Gilliat and Brewster Kahle (and the spider that fuels the Internet Archive), is going to offer its index up to anyone who wants it. Alexa has about 5 billion documents in its index – about 100 terabytes of data. It’s best known for its toolbar-based traffic and site stats, which are much debated and, regardless, much used across the web.’

http://battellemedia.com/archives/002116.php


12/8/2005

New worms will chat with you via IM

Filed under: — adam @ 4:32 pm

http://news.com.com/New+IM+worm+chats+with+intended+victims/2100-7349_3-5984845.html


12/7/2005

Why are Firefox and Thunderbird at mozilla.com now?

Filed under: — adam @ 8:15 pm

Firefox and Thunderbird used to be at mozilla.org. Now, with the latest release, they’ve moved to mozilla.com. What’s the deal?


12/6/2005

X-men 3 Trailer

Filed under: — adam @ 6:57 pm

X-men 3 trailer is out.

Well now, that looks very interesting.

http://www.apple.com/trailers/fox/x3/
(or just jump to the large one at: http://movies.apple.com/movies/fox/x-men_3/x-men_3-pre_teaser_h.640.mov)


12/5/2005

Is the world ready for a female Joker?

Filed under: — adam @ 10:24 pm

This post got me thinking about Batman villains for the next movie – particularly casting for the Joker. It struck me that there’s really no reason that the Joker couldn’t be female, and Carla Gugino would be an interesting choice.

http://www.themovieblog.com/archives/2005/11/batman_begins_villains_revealed.html

Maybe not the best image, and she’s not grinning, but this has elements of the right look. Most of the smiling ones I found were smiling-nice, not smiling-evil, but I think she could make the transformation.

Other good choices, I think, would be Robert Downey Jr., Craig Bierko, and Lyle Lovett. Also, I have a soft spot for Enrico Colantoni. He could probably pull it off, but maybe would be better as the Penguin.


Clock and Dusk on the Metlife Building

Filed under: — adam @ 9:16 pm



Clock and Dusk on the Metlife Building

Originally uploaded by Caviar.

I really love the Metlife Building. It always looks very pretty lit up at night, but I happened by it just as the sun was setting the other day, and it just got this amazing glow about it.


Prince of Persia – The Two Thrones

Filed under: — adam @ 8:55 pm

Once again, the folks from Ubisoft have delivered an amazing game experience. The Prince of Persia games have been consistently top-notch in terms of beautiful graphics, fluid action, and the best acrobatic combat engine around, and The Two Thrones continues the trend.

Just a heads up – the PS2 version seems to have a minor glitch. In the Hanging Gardens of Babylon after the elevator, there’s a dagger hole on the center column after a narrow shimmy crevice. There’s another dagger hole clearly visible off to the left, but pushing left and pressing R1 causes the Prince to jump to the right instead, off the pole and to his death. There’s nowhere else to go, and pushing right and pressing R1 does nothing. I discovered through trial and error that pushing UP and pressing R1 sends him left, as needed.

Hope that helps, if you have the same problem.


The Cube Triumphant

Filed under: — adam @ 4:30 pm



The Cube Triumphant

Originally uploaded by Caviar.

The cube is back.


Print your own monopoly money

Filed under: — adam @ 10:16 am

Hasbro has PDFs you can download to print your own monopoly money. Via boingboing:

http://www.hasbro.com/monopoly/pl/page.treasurechest/dn/default.cfm


12/1/2005

Red Closeup

Filed under: — adam @ 7:22 pm



Red Closeup

Originally uploaded by Caviar.

I just started playing around with macro photography, using a set of extension tubes on my existing lenses.

It’s fun!


Powered by WordPress