Lewis' Blog Tales from the trenches of information technology


Google’s HTTPS Everywhere initiative: not so fast…

It seems that Google has a new factor to consider for web rankings: HTTPS.

I understand the allure of encryption. Heck, I use StartPage as my search site, and all of my searches go over HTTPS. The problem is that HTTPS is expensive.


Gravatar Privacy Issues

Most of my regular readers know how paranoid I am about my own privacy. I use throw away email addresses for many things, because I know that nothing comes for free (TANSTAAFL), and whenever anyone offers me something for "free" if I only provide my email address, I have a pretty good idea what's to become of it.


Why should CPAs care about the cloud? Let’s count the ways

Why should CPAs care about the cloud? Let's count the ways.

Egad... Drinking the Kool-Aid? Who are these people in this blog post, anyway, and what on Earth do they know of data security?


Cloud adoption brings unexpected costs, KPMG survey says

I don't know what might ever sway my opinion of the utter uselessness of "moving to the Cloud" (ever see a cloud with a floor under it?)... Indeed, there are uses for everything, and even I have an Evernote account. However, that does not mean that I am not careful about exactly what I store in my cloud-based notebook, including the potential risks to privacy and matters of a critical nature, to which should I lose access for any period of time, it could mean a considerable inconvenience or worse.


Three good ways to thwart tracking attempts on the net

There is a lot of malicious junk floating about the net.I know; that's not a real surprise. Under normal circumstances, a good (standalone) firewall will keep one reasonably safe from the worst of it. However for those of us who travel, it's a constant challenge to keep up with personal firewall tweaking and such, and still, unless one is really running the kinds of stuff typically found in a UTM (Unified Threat Management) solution, just tweaking some firewall rules just isn't going to cut it.

[Shameless plug: Rosenthal & Rosenthal is an Astaro consultancy. If you know of anyone with a need for a truly solid firewall, email filter/scanner, VPN concentrator, etc., referrals are welcome.]

So, what can one do while traveling? Trust the hotel firewall? I think not. Here are three quick tips to help keep your system clean from would-be spoofers and such:

HOSTS file

A quick edit of your hosts file to loop back known bad sites to localhost ( is a good start. To get started, have a look at the list compiled here. This will make some web pages look rather ugly, as the browser brings up the dreaded "cannot access..." in various iFrames and such, but it will speed browsing and keep that excess junk from cluttering the screen.

Squid proxy settings

Squid is great. You can do a lot of things with Squid, such as block entire IP ranges from getting in (or going out to them), which improves performance considerably. I'll post more on Squid configuration in a later article. For now, suffice it to say that Squid can be used as a pseudo-firewall (you just have to not defeat it by turning it off, but this is true of software firewalls, as well).


Another type of proxy is a privacy screen. Enter Privoxy to the scene. One of the annoying characteristics of most web surfing from modern browsers (and ancient ones) is that we tend to leave behind more than we take with us. To truly surf anonymously requires some type of anonymizer, and Privoxy is a good choice (this way, your travels don't follow you home, when you finally do get behind your warm and cozy hardware firewall). A couple interesting guides for chaining Squid to Privoxy (or vice-versa) may be found here and here. Again, I'll post more on this in a subsequent piece, but for now, suffice it to say that this is an excellent addition to your arsenal.

These are but three fairly quick and simple (well, they can be less complicated than others, at least) ways to browse more safely, and are of particular usefulness when away from home (or the office), where the bastion server is unknown and likely not to be trusted. In time, I'll flesh in more details and tips for configuring each of these solutioins.

Happy browsing.


Ramdom thoughts on the 2011 (and beyond?) Firefox release schedule

As I sit here at Panera Bread, catching up on some tech news, an article caught my eye concerning Mozilla's new approach to updates and, tangentially, the (revised) 2011 Firefox release schedule. This started my own wheels turning, as this has been a bit of an annoyance for me, so I thought I'd just jot down a few ideas...

Concerning Firefox's 2011 release schedule:


We (I say "we" because I do/have contribute(d) from time to time) have some bugs in Bugzilla which date back several years (some to the Netscape Communicator days, inherited by the Mozilla project - no kidding!). These have yet to be quashed, and all the while new "releases" just keep coming down the pike, bringing with them their own share of new insectoids. Wouldn't it make more sense to stay at a reasonable "release" level, and just fix it before adding new features (and after all, isn't the purpose of a new "release" to introduce new features)? We already have a mechanism in place for extending the functionality of the browser through plugins and extensions, anyway, so what's the point? (If Mozilla wants to emulate Redmond, then they should consider that under the hood, Windows 7 is NT 6.1, anyway, and Microsoft got a head start with NT growing out of OS/2 - NT started at version 3.)


Firesheep? Not on a Hautspot network

Many of you know that I am the Chief Network Architect for Hautspot. LLC, a little Wi-Fi company which, among other things, is a CLEAR Local Master Platinum Distributor in the Washington, DC metro market. Hautspot's main focus prior to entering into the distributorship agreement with Clearwire, was (and still is) managed Wi-Fi networks built on technology from Sputnik, Inc.

I stumbled upon this article on The Register this evening, describing an engineer at his local coffee shop (the establishment shall remain unnamed on my blog, because I truly despise their idea of java - and I'm a real coffee drinker) using Firesheep - a Firefox extension which allows one to pick off other users' authentication cookies over open networks - and easily hacking other people's social networking accounts (no surprise there, huh?), among other things.

Fortunately, most of our hotspots employ SSID Client Isolation, which is a technology which prevents neighboring users from snooping on other patrons' connections. No client-side configuration is necessary. No crackable VPN passphrases (Steve Gibson, for whom I have the utmost respect, is dead wrong with his suggestion of simply enabling WPA encryption on public WLANs and using a commonly used term, such as the venue name or even "free," as these can be so easily cracked and the system made vulnerable to MITM attack). It simply makes it impossible to route traffic from, say, to on the same LAN; the router won't pass the packets. Period.

Venue owners: for a few $$ per day, you could be enjoying secure, advertising-supported (i.e., you sell ad space on your very own portal page, thus offsetting the cost of the managed service) hotspots, with your own branding for all to see. Authentication is handled on our server. All that's needed on your end is a router/AP, which we provide, and a broadband connection (and if you don't happen to have one of those, we can usually fix that for you, too). Contact us for more info and a FREE site survey.


Why social networking sites are evil…E-V-I-L (part 3)

No news to me that this has happened. The question is, of course, how many other times has this happened that we haven't heard, and when will people learn?

Facebook developers exiled for selling user IDs to brokers

and... how about this one?

Law & Order actress Kathryn Erbe's brother testifies at stalker trial

This whole "friending" thing is about as annoying as the "follow me" nonsense. Remember when the verb form of the noun "friend" was "befriend?" Now, we have to have a whole new word for it (for some reason), unless the ignoramuses really don't know that there already is a verb for making friends... Yikes! It's even listed with a definition on Google Dictionary.

My friends, we're losing the war...


Why must people carbon copy (cc) all the time?


If someone gives me his private office phone number, he doesn't expect me to write it in the office Christmas card.

If someone gives me his cell number, he doesn't expect that I'll scribble it on a bathroom wall at a highway rest stop.

So, if I give someone my email address, why is it that so many recipients treat it like it's public information?

When I get someone's email address, I treat it the same way I would that person's home phone number, private office line, or cell phone. I don't give it out unless I get permission from the owner of the information. Again, this evening, I received a "joke" from a client, with my email address blazoned across the To: header, along with...let me count them...a dozen others (people I don't know).

Beyond the rudeness of sharing my address with strangers, I'm willing to bet that at least half of them are running Windows systems, with easily harvested address books and out-of-date antivirus/antispyware, so that my address is now even more likely to be snatched by some 'bot and used for nefarious purposes.

A couple weeks ago, I got a message from a large company who shall remain nameless, with my address as a cc along with 374 - I'm not kidding - that's three hundred seventy-four other addresses cc'd in the headers. On my Palm Pre, I had to scroll and scroll and scroll just to get through them all. Huh????

Next time, maybe I'll just give out my Social Security number, debit card PIN, and plaster a picture of my kids, their names, and ages on some social networking site...