Preview: Microsoft's Windows Longhorn: "Disclaimer: This is a preview based on a very early release of Microsoft's next-generation operating system. It lacks the modern user interface elements that will be in the final version. Given that the code is far from final and may contain many debug elements, the system's performance will likely improve in subsequent releases. Any statements we make about perceived performance may not apply to the final version, and any feature discussed here may also change before Longhorn's final release in 2006. "

Longhorn is the codename for the next-generation version of Microsoft's flagship Windows operating system. It's also the company's most ambitious project since the first Windows NT release. An impressive array of new technologies will be built into the new OS -- a few of which were included in the pre-release version we checked out.

Due to its ambitious nature, Longhorn has had its release pushed out to sometime in 2006. Because of this, Microsoft has committed to a second service pack release for Windows XP, which may add a few Longhorn elements – particularly in the realm of security.

Some of the key features of Longhorn include:


Improved security -- through it's NGSCB initiative

WinFS, a new file system based around relational database technology (NTFS will still be available)

New user interface technologies based on DirectX rather than the aging GDI interface. Every window in the release version will be a 32-bit, z-buffered, 3D surface.

A new presentation and UI design subsystem, codenamed "Avalon," based around XAML (Extensible Application Markup Language).

A new communications architecture, codenamed "Indigo," that's an enhanced and integrated version of Microsoft's .NET framework.

http://www.extremetech.com/print_article/0,3998,a=111043,00.asp

Panther Patches Mac OS X Security Holes: "Security researchers have identified three new vulnerabilities in Apple Computer Inc.'s Mac OS X, one of which may allow attackers to execute some arbitrary commands as a root user under some circumstances. "

The flaws affect all versions of the operating system through 10.2 and are fixed in release 10.3, also known as Panther, according to Apple.

The first vulnerability is a buffer overrun that allows an attacker to crash the OS X kernel simply by entering a command line argument of a specific length. Once the attack is executed, the machine crashes immediately, without generating any log files or error messages, according to an advisory on the issue released Tuesday by @stake Inc., based in Cambridge, Mass., which discovered both weaknesses. The crashed machine will reboot eventually.…

However, an attacker can also use this vulnerability to get the machine to return small amounts of its memory to him. Researchers at @stake said it appears the only thing being returned to the attacker is memory addresses, which aren't normally considered to be sensitive information.

Although they were unable to use this flaw to run code on vulnerable machines, the @stake researchers said that it may be possible, given that the weakness lies in the OS X kernel itself.

The second new problem involves the way that the OS handles core files, which are a snapshot of the system's state when a machine crashes. When core files are enabled in OS X, processes owned by root will write a core file to the /cores directory. These files are owned by the root process, which would have read-only access to them. The attacker can also read the contents of the core files created by the root process.

But, because the directory is writable and the names of the files in it are predictable, an attacker could create symbolic links to these files and point them to files elsewhere on the system. In this way, he could essentially overwrite any of the core files. To do this, the attacker would need interactive shell access to the machine, @stake said.…

The third vulnerability involves the fact that OS X allows many applications to be installed with insecure file permissions. This can result in many of the files and directories in these applications being globally writable, @stake said.

Although Apple has provided fixes for these flaws in Panther, the latest version of OS X, it has declined to create any patches for users who plan to stick with earlier versions. Panther has only been available since Oct. 24 and costs $129 for a single-user upgrade. The lack of a fix for existing, still-supported versions of OS X has been a topic of much conversation on security mailing lists this week.…

http://www.eweek.com/article2/0,4149,1365177,00.asp

Good Information Architecture Increases Online Sales:
Imagine you’re downtown and you want to buy a Kraftwerk CD.

You visit Tower Records, go to the Electronic section, find category K, locate Kraftwerk, and select their Tour De France CD. Great! You’re off to the checkout and…

Hang on. Where’s the checkout?

They’ve moved it to the second floor. When you get there, you hand over you credit card. Big mistake. You should have registered downstairs first.

You head back down to the basement. Do you have two copies of your ID? No. “But it’s only a $9.99 CD!” you argue. The store stands firm. Wonderful music though it is, you’re soon off to a store that’s more conducive to purchasing.

This scenario may be a little far-flung, but if you’ve ever shopped online, you’ve probably had a similar experience at some point. You wanted to buy something, were ready to use your credit card… but the process was so excruciating that you gave up.…

http://www.sitepoint.com/print/1235

World Domination for Small Web Businesses: "Most Web designers define their target market as either:

1. 'Small to mid-sized businesses'

Or:

2. 'People who can be reached through word of mouth from clients and colleagues'

"

Both these “target markets” cost Web designers revenue, time and money. This article explains why. Then, it shows how to focus on a specific target market to increase revenue, cut marketing costs, and make business development easier and more effective.…

http://www.sitepoint.com/print/1238

"About Us" -- Presenting Information About an Organization on Its Website (Jakob Nielsen's Alertbox):
Summary:
Study participants searched websites for background information ranging from company history to management biographies and contact details. Their success rate was 70%, leaving much room for usability improvements in the 'About Us' designs. "

Representing a company or organization on the Internet is one of a website's most important jobs. Explaining the company's purpose and what it stands for provides essential support for any of the site's other goals. Unfortunately, most websites do a poor job on this explanation.

It is fairly common for sites to have an About Us section, and in fact I recommend having a homepage link that's explicitly called either About or About Us. This link need not be the most prominent on the homepage, but it should be present and easily visible. In our study, users had trouble locating company information when the link had a nonstandard name, like Info Center, or when it was placed near graphical elements that looked like advertisements and thus were ignored.…

http://www.useit.com/alertbox/20031027.html

OJR article: The E-mail Paradox: Bane and Boon for Journalists' Productivity: "Close your eyes and imagine a world without e-mail. No more SoBig viruses, no more spam, no more forwarded jokes. Gosh, what would you do with all that free time? Maybe you'd be more productive. That's the thinking behind the internal office e-mail ban at British mobile phone company, Phones4u.

That's all well and good, but for journalists, an e-mail ban is like going back to the Stone Age. Media folks depend on e-mail for news tips, feedback from readers and discussion lists. Journalists are the power users of e-mail and the Web, so that leaves them with a paradox: The constant barrage of e-mail does as much harm as good."

http://www.ojr.org/ojr/glaser/1067022673.php

Political Animation on the Web: "Mark Fiore creates a single editorial cartoon a week, yet he's among the hardest-working artists in the profession. That's because Fiore does political animation -- a compelling mix of words, pictures, motion, voices, sound effects, and music.

A prime example is last month's animation marking the second anniversary of 9/11. As a piano plays mournfully in the background, title cards announce: 'Two years after more than 3,000 innocent people were killed, we present ... A Nation Remembers.' Then Fiore shows scenes of Ground Zero workers 'who were told by the EPA the air was safe'; the 19 hijackers, 'none of whom were from Iraq'; and New York City firehouses, 'six of which have been closed due to budget cuts.' Meanwhile, a cartoon version of President Bush frantically advises viewers not to remember all that. But Bush does want people to remember things like his wearing of a flight suit this spring. 'That was sure cool,' intones the president, as voiced by Fiore. 'I'll never forget that day!'"

Fiore, whose clients include newspaper Web sites, spends more than 35 hours on each 45-to-60-second animation. Part of the process is familiar to any print editorial cartoonist -- a position Fiore once held as a freelancer and San Jose (Calif.) Mercury News staffer. Fiore checks out the news, comes up with an idea, and does research before writing and sketching a storyboard showing various scenes.

Then, Fiore does anywhere from 10 to 30 drawings the old-fashioned way -- ink on paper. "That's really important to my work," he told E&P Online. "I want to have a line so it doesn't look too 'computery.' My goal is to bring my style from the print world to animation." He also letters some of the text by hand.

http://www.editorandpublisher.com/editorandpublisher/features_columns/article_display.jsp?vnu_content_id=2013532

W3C Seeks Re-examination of Eolas Browser Patent: "The World Wide Web Consortium is seeking a reexamination of a Web browser patent that it says threatens to undermine the smooth operation of the Web."

The patent is at the heart of a legal wrangle between Eolas Technologies Inc., which holds a license to it from the University of California, and Microsoft Corp. Microsoft in August lost a $521 million patent-infringement jury verdict in the case and since has announced changes to its Internet Explorer browser that it says sidesteps the patent's method for embedding and invoking interactive applications such as plug-ins and applets from Web browsers.

On Tuesday, W3C Director Tim Berners-Lee sent a letter to the United States Patent and Trademark Office formally requesting a reexamination of the patent, U.S. Patent No. 5,838,906. The Web standards group claims that the patent is invalid because "prior art" (a legal term in patent law referring to whether an invention existed prior to the filing of a patent) was not considered at the time the patent was granted in 1998 or during the trial.

"A patent whose validity is demonstrably in doubt ought not be allowed to undo years of work that have gone into building the Web," Berners-Lee wrote in his letter to James E. Rogan, undersecretary of commerce for intellectual property in the patent office

In a separate filing with the patent office, the W3C last week outlined examples of prior art, including two publications from a Hewlett Packard Laboratories researcher, Dave Raggett, about a proposed HTML+ specification that it says were published a year before the patent filing.

The W3C claims that the publications describe the EMBED tag in HTML+ in an identical way to the EMBED tag in the patent.…

http://www.eweek.com/article2/0,4149,1366698,00.asp

Sliding Doors of CSS, Part II: A List Apart : Sliding Doors of CSS (Part I) introduced a new technique for creating visually stunning interface elements with simple, text-based, semantic markup. In Part II, we’ll push the technique even further. If you haven’t read Part I yet, you should read it now.

Here, we’ll cover a new scenario where no tab is highlighted, combine Sliding Doors with a single-image rollover, provide a fix for the clickable region in IE/Win, and suggest an alternate method of targeting tabs. We’ll skip a basic recap of the technique (see Part I for this) in favor of jumping right back in where we left off.…

http://www.alistapart.com/articles/slidingdoors2/

: In the last month the music-downloading landscape online has shifted once more with these five major events, not all of them good:

¶Apple Computer made its iTunes player and music store available to PC users.

¶A legal version of Napster emerged.

¶A new download store called Audio Lunchbox announced that it would open on Halloween.

¶Musicmatch added an online store to its music player.

¶EMusic added restrictive rules to its music subscription service.

In a striking lack of originality, every new service above is in some way a designer imposter of iTunes, which sells songs for 99 cents each and albums for $9.99.

The war for a legitimate digital-music store began in 1995, when a New York company called Sonicnet started offering singles for download. The artists were allowed to set the prices of their songs and to keep all the money from the download. Of course, in those olden times, a download could take anywhere from five minutes to five hours, and the sound quality was described by the company itself as "better than an AM radio in a '72 Nova."

Clearly, Sonicnet's music store was more of a me-first venture than a moneymaker, but the message was clear: the Internet was a place for artists to control and directly profit from their music. But in most online services today that dream has been lost, with the services functioning as online arms of the record companies while the artists receive pennies (or fractions of pennies) for each download.

The second dream from the golden age of music downloading was summarized in a catchphrase: All you can eat. The future of the business was in allowing fans access to all the music they wanted for a monthly fee. So far, only the free unauthorized services have accomplished this, chiefly ones that are now defunct, like Napster and Audiogalaxy. The reason the authorized downloading services haven't accomplished this goal is not because the technology or will is lacking, but because full cooperation from record labels and publishers has not been forthcoming. They fear they would become obsolete.

Thus the authorized services online today are all compromises. The service perceived as the greatest success is the iTunes Music Store, originally a feature of the Macintosh computer. The service is based more on the retail model than the cable television one. Its charges of 99 cents to download a song and $9.99 to download an album are not much cheaper than buying the CD at a discount retailer. Within four days after iTunes began offering a PC version of its technology this month, one million PC users had downloaded the software, Apple reports.

With the success of the iTunes Music Store, other services are rushing to copy it. By and large, they are not succeeding, because what works about the iTunes Music Store is not necessarily its pricing system but its ease of use, its lack of restrictions on downloaded music, its design and its integration of Apple's iTunes media player and iPod portable digital music player.

Nonetheless, that hasn't stopped the competition. There's Buymusic, an online song store that has little going for it, and Musicmatch, which has integrated an Apple-like store into its music jukebox. And the newest service, Audio Lunchbox, tries to squeeze into a gap by offering music for Mac and PC users that the iTunes Music Store does not: chiefly songs from artists on independent record labels.

Perhaps the greatest competition for iTunes on the PC is the new and very legal Napster 2.0. The service combines the song-selling of iTunes (even the prices are the same) with a semblance of the community feel of the original Napster. Users willing to pay $9.99 a month for a subscription get extra features, such as being able to listen to the playlists of other members, access to message boards and a personal mailbox and the ability to download as many songs as they want onto their PC (but with a catch: they still have to buy the song if they want to take it off their home computer and put it on, say, a portable digital music player).

But iPod owners won't be flocking to Napster because its songs are encoded as Windows Media files, which are not compatible with the iPod. Samsung, however, has created a digital music player specifically designed to be used with Napster 2.0.

If it sounds as if it's a mess out there in the online retail world, it is, and ultimately only a few services will flourish.

Online Music Business, Neither Quick Nor Sure

The Ten Most Abused Words in Tech
This is not a Letterman-style Top Ten list. This topic deserves more serious attention than a mildly humorous rundown.…

Most of the guilt for these abuses lies squarely on marketers. These are the people whose very livelihoods depend on the ability to "create unmet needs." If that phrase doesn't make you shudder, then you're probably in marketing or PR. It's not that I consider the profession an evil one, but the need to communicate complex technologies has often forced some marketing and public relations people to come up with new and exciting ways to abuse the English language.

In response, I've compiled a list of the ten most abused words in the tech industry. This list, by the way, is in no particular order -- though I find the first two or three particularly egregious.

Experience

The most obvious misuse of this word is the way Microsoft overuses it, but they are by no means the only abuser. We hear about the "Windows experience," the "gaming experience," and, by God, the "driver installation experience." Life is full of experiences, so I'm unclear as to what's really special about the "living room experience." I experience my living room every day and no TV or computer exists in it. It's to the point now that when I hear the word "experience" used in a product pitch or presentation, I feel vaguely nauseous. Whatever's being pitched to me at that point had better be damned good to overcome my queasiness.

Seamless

I get particularly annoyed with a sentence like, "This should be a seamless experience." Even my Gore-Tex parka isn't seamless -- although I did once have a pair of hiking boots with only one seam. I know what's trying to be communicated here, but the term has become so overused that it's meaningless.…

http://www.extremetech.com/print_article/0,3998,a=110431,00.asp

Search Inside the Book
How It Works
A significant extension of our groundbreaking Look Inside the Book feature, Search Inside the Book allows you to search millions of pages to find exactly the book you want to buy. Now instead of just displaying books whose title, author, or publisher-provided keywords that match your search terms, your search results will surface titles based on every word inside the book. Using Search Inside the Book is as simple as running an Amazon.com search. For example:

1. Let's say that you're interested in finding books about "rocket experiments." Just as you do today, type "rocket experiments" into our search box and click the GO! button. You'll get a list of the books that contain that term in the author's name, the book's title, or in the book's text. Books participating in our Search Inside the Book feature with "rocket experiments" in their text will show an excerpt with your search term highlighted. To see all references to "rocket experiments" within a particular book, click the "See more references to 'rocket experiments' in this book" link.

2. This link will take you to an index page for the book you selected, where you will see excerpts from all the pages where "rocket experiments" appears. This is a great way to quickly and easily browse sections of the book that are relevant to your search. If you want to see a specific page from the book in its entirety, simply click on the link to that page.

3. At this point, one of two things will happen. If you are a registered, recognized Amazon.com customer, you will go directly to the page you selected. If you are not a recognized customer, we will ask you to sign in or create an Amazon.com account (if you're not already a customer). Once you have signed in or set up an account with us, we'll take you directly to the page you selected. Once there, you'll see that "rocket experiments" is highlighted throughout the page and that you can browse forward and back two pages. Additionally, you'll find a navigation bar above the page that allows you to search for other terms in the book and browse other pages. Of course, you can always purchase the book by adding it to your Shopping Cart or by using 1-Click ordering, and we'll deliver the book to your door.

Search Inside the Book FAQ
http://www.amazon.com/exec/obidos/tg/browse/-/10197041/102-8019720-7150504

http://www.amazon.com/exec/obidos/tg/browse/-/10197021/ref%3Dsib%5Fmerch%5Fgw/102-8019720-7150504

Where Is Windows Going?
The next version of Windows isn't due out until at least 2005, leaving us to wonder: Will Microsoft address the big questions users have about stability, security, and features? In this special report, we look at where Windows is heading.

Love it or hate it, Microsoft Windows is almost ubiquitous. Well over 90 percent of desktop and laptop computers run Windows. In the two years since Windows XP first shipped, it has become a tremendous commercial success.

In our reader surveys, most respondents seem happier with Win XP than with previous versions of Windows; it crashes less often and has more features. But it has its shortcomings. Although it's more stable than previous versions, it still crashes and hangs. And more important, the number of security threats against Windows is growing. Although Microsoft has responded with updates and patches, it's disheartening that they are needed weekly.

The next Windows OS, code-named Longhorn, isn't expected until 2005 at the earliest. Because the industry needs to plan ahead, outlines of the system are beginning to come out. Longhorn looks ambitious; Microsoft calls it a "big bet," the kind that it makes only every decade or so.

Among the areas Microsoft is working on are making the system more "trustworthy" and secure, adding new communications and collaboration tools, creating a new content-based storage system, making it easier for developers to create stable applications, and improving the user interface and presentation of media.

In some areas, Microsoft's plans are clear. For example, for developers, Microsoft has long promoted switching to "managed code," which should result in more stable applications.

On security, Microsoft's goal is "trustworthy computing," including a Next-Generation Secure Computing Base, which splits the OS into halves, one tied to the hardware for secure communication and authentication, one for everything else. This would allow for more secure applications and better digital rights management, but it also requires hardware and software changes.

We know Microsoft is working on a storage system called WinFS that should make finding information easier.

In the pages that follow, you'll find out more about each of these areas—and where Microsoft's competitors are going.…

http://www.pcmag.com/print_article/0,3048,a=109987,00.asp

Ever wonder how a certain company sending unsolicited e-mail messages got your address?

Michael Rathbun, the director of policy enforcement at Allegiance Telecom, an Internet service provider in Dallas, says he thinks he has much of the answer.

Some five years ago, Mr. Rathbun bought a Palm hand-held organizer and, in registering it on Palm's Web site, gave the company an e-mail address he never used for anything else. Initially his in-box received only offers for products related to the organizer, but eventually he started getting advertising from some well-known companies like Bank of America, SBC Communications and Sprint. Lately, that one address alone has been receiving dozens of e-mails a month offering everything from travel clubs to acne remedies.

"This is not stuff," Mr. Rathbun said, "that I should be getting from them."

The problem of spam or unwanted commercial e-mail is usually attributed to outlaws and hucksters — peddlers of pornography, get-rich-quick schemes and pills of dubious merit — who use hackers to send their fraudulent messages in ways that cannot be traced.

But the torrent of spam that is flowing into people's electronic mailboxes comes not only from the sewers but also from the office towers of the biggest and most well-known corporations.

Established companies insist they send e-mail only to people who have voluntarily agreed to receive marketing offers. A spokeswoman for Palm says it does not know how Mr. Rathbun's e-mail address got into the hands of spammers and says it has never sold its customer list.

But often companies rent e-mail lists from a cottage industry that has emerged to lure Internet users, through a variety of schemes, into signing up for e-mail marketing.

At best, if you have ever entered a contest to win a prize, subscribed to an online newsletter or simply purchased a product on the Web, you may well have also agreed, as many such fine-print contracts put it, "to receive valuable offers from our marketing partners."

This practice falls under the rubric of what is called opt-in marketing, or getting permission to send advertising messages.

But many e-mail executives admit that these same list companies also add to their databases by buying, trading — sometimes even stealing — names.

"Everyone is looking for a quick buck now, and people are claiming to sell opt-in data who don't have it," said Pesach Lattin, who runs Adspyre, a New York e-mail marketing firm.

Moreover, some companies have allowed the e-mail addresses of their own customers, either deliberately or inadvertently, to fall into the hands of list peddlers who in turn sell them to e-mail marketers of all stripes. Sometimes, the lists are stolen from corporate owners by employees or vendors looking to make a quick profit. But in many cases, the big companies are deliberately buying and selling access to names, relying on privacy policies — often hard to find on their sites — that they say permit such actions.

"White-collar spam" is how Nick Usborne, a newsletter writer and Internet marketing consultant, refers to this phenomenon.

"When a responsible company," Mr. Usborne said, "gets someone to sign up for a newsletter and says, now that we have their e-mail address let's make more money off it and send them e-mail they didn't ask for, that's white-collar spam."

The antispam bill passed unanimously by the Senate last week imposes tough penalties on people involved in the lowest forms of spam but it does not deal with the central questions Mr. Usborne and others raise about white-collar spam. It does nothing, for example, to establish rules defining an appropriate list of names that a purveyor of a legitimate product can use to send an offer by e-mail. Nor does it regulate the transfer of names between companies.

The law would require that every e-mail message offer recipients a method to remove themselves from an advertiser's mailing list. But with the way that names are traded today, this method would do little to reduce the amount of e-mail people receive, industry executives say.

"People don't realize that once you sign up for a contest or free stuff on the Web and you forget to uncheck a box, these people will pass your name to a hundred other people,'` said Paul Nute, a partner of Soho Digital, a New York advertising agency that represents e-mail marketers. "You've just raised your hand and said, `Send me the diet pill offers.' And there is no way to get them all to stop."

http://www.nytimes.com/2003/10/28/technology/28SPAM.html?pagewanted=all&position=

Changing the product key on Windows XP
For most Windows XP installs, you’ll never need to worry about the validity of the product key assigned to your copy of the OS. However, software does tend to get installed without authorization, even in the most carefully managed shops, and so from time to time you may need to reset the XP product key.

For example, perhaps a user installed a pirated copy of XP but now wants to go legal. Maybe you've been hired by an organization that installed 100 pirated copies of XP but now has a legitimate volume-licensing key (VLK). Perhaps an end user purchased an additional retail license for XP but needs to use his original CD to install the software. When situations like these arise, changing XP's product key is often the most practical—or only—solution.

Determining if you have a valid product ID
Hopefully you already know if you're dealing with a pirated copy of XP. But if you're unsure, a quick way to tell is to install Service Pack 1. Shortly after releasing Windows XP, Microsoft realized that most pirated XP installations were using two specific VLKs, the most popular of which begins with "FCKGW.” These VLKs produce product IDs that match either XXXXX-640-0000356-23XXX or XXXXX-640-2001765-23XXX, where X is any number.

If you try to install SP1 and get the following error message:

The Product Key used to install Windows is invalid. Please contact your system administrator or retailer immediately to obtain a valid Product Key…"

You are dealing with a pirated copy of Windows. For more information about obtaining a valid product key, see Microsoft Knowledge Base article 326904.

You can also directly check the OS’sproduct ID by right-clicking on My Computer, clicking Properties, and selecting the General tab. The machine's product ID will be located under the Registered To section. If the ID matches either of the two models commonly associated with VLK fraud, you’ll need to obtain a valid XP product key before proceeding. None of the procedures described below will work without a legitimate product key.…

How to Change the Product ID in Windows XP

HOW TO: Change the Volume Licensing Product Key on a Windows XP SP1-Based Computer

http://support.microsoft.com/default.aspx?scid=kb;EN-US;326904

http://support.microsoft.com/default.aspx?scid=kb;en-us;321636

http://support.microsoft.com/default.aspx?scid=kb;en-us;328874

http://techrepublic.com.com/5100-6270-5034890.html?fromtm=e103

WinXPnews™ E-Zine
Tue, Oct 28, 2003 (Vol. 3, 43 - Issue 99)
Does Tech Jargon Cause Confusion?
This issue of WinXPnews™ contains:
EDITOR'S CORNER
Speaking the Language: Does Tech Jargon Cause Confusion?
Followup: Office 2003
HINTS, TIPS, TRICKS & TWEAKS
lder Settings: Another Fix
What to do if HAL is missing
Another Alternative Browser
What is thumbs.db?
Better Movie Playing with Older Media Player
HOW TO'S: ALL THE NEW XP FEATURES
How to Clear the Page file at Shutdown
How to Remove the NetMeeting Remote Desktop Sharing icon from the tray
How to make file names appear on the left when you use the DIR command
How to Keep your Internet connection open when switching users
WINXP SECURITY: UPDATES & PATCHES
New Security Bulletin Warns of Flaw in Windows Messenger
WINXP QUESTION CORNER
How to Format the Hard Disk on an XP Machine
AutoComplete Stopped Working
WINXP CONFIGURING & TROUBLESHOOTING
Can't Install XP Pro to a Separate Folder After Installing XP Home?
Compatibility Mode Setting is Ignored
"Memory Could Not be Read" Error

http://www.winxpnews.com/

Microsoft Security Bulletin MS03-043
Buffer Overrun in Messenger Service Could Allow Code Execution (828035)

Affected Software:
Microsoft Windows NT Workstation 4.0, Service Pack 6a -
Microsoft Windows NT Server 4.0, Service Pack 6a -
Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 -
Microsoft Windows 2000, Service Pack 2 -
Microsoft Windows 2000, Service Pack 3, Service Pack 4 -
Microsoft Windows XP Gold, Service Pack 1 -
Microsoft Windows XP 64-bit Edition -
Microsoft Windows XP 64-bit Edition Version 2003 -
Microsoft Windows Server 2003 -
Microsoft Windows Server 2003 64-bit Edition -

Non Affected Software:
Microsoft Windows Millennium Edition

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-043.asp

Build cross-browser XML paging code
If scrolling through a long XML table is not an optimal experience for
your browser app, why not implement pagination? Presenting data in
page-length chunks can help your users find the data they need. See how
to build
fast, cross-browser XML pagination.
From Builder.com Bulletin

http://builder.com.com/5100-6371-5085227.html?tag=sc&fromtm=e601

Comment Spam
We've all seen that comment spam is becoming a serious problem. Particularly on Movable Type weblogs, where the generated pages are all very similar in structure and semantics, spammers are abusing comment systems to increase their rank on Google.

Even more frustrating than the spamming problem is the fact that there isn't a simple solution that will work for everyone and that all options have their own sets of pros and cons. During the past couple of months, we've been throwing around ideas at Six Apart about the best ways to combat spammers.

Readers of your weblog must register before posting to your weblog.
Before someone can post a comment to your weblog, they must register with your site.

For many webloggers, this solution is not ideal. Informal polling of webloggers has revealed that many do not want to require someone to register before posting. It usually discourages conversations from forming and is a barrier for open discussion. Additionally, without federation, logins on multiple weblogs become unmanageable.

While we do plan on integrating comment registration into Movable Type Pro (which we'll be talking about in more detail very soon), it's an option that serves a different purpose than just blocking spam. If you want to prevent links to explicit pornography from appearing on your site, you shouldn't have to be required to turn on comment registration.

Comments require approval before being posted
When a comment is posted, you can receive an email that provides a clickable link you must visit before the comment can be posted on your site.

For webloggers with a small amount of readers, this solution may be ideal. However, if you receive a good deal of comments, it's a solution that doesn't scale. Additionally, it may ruin the spontaneity of discussion.

Image comprehension technology
Before a comment can be posted on a weblog, human eyes must enter a code that, ideally, is not readable by a computer.

This solution is not feasible because of accessibility issues. Additionally, spammers seem to be searching with bots and entering spam manually.…

http://www.sixapart.com/log/2003/10/comment_spam.shtml

How spammers are targeting blogs
Technology analyst Bill Thompson has been getting lots of comments on his weblogs, unfortunately most of the want to sell him Viagra. He has been "flyblogged".

Earlier this week I got an e-mail to tell me that someone called Levitra had commented on one of my entries on the VoxPolitics weblog.
Since it's a group weblog for "e-democracy titbits and crumbs", we get quite a few comments from random readers, and often they are useful and informative, so I read it with interest.

Sadly, it was not about the latest e-voting disasters in California - a topic of great interest to me - but a rather obvious piece of spam.

It said; "Interesting comments and a Superb Web Site" and then, like so many spam e-mails, had a link to a site that wanted to sell me a Viagra alternative.

Over the next few days I got 20 more, most offering Viagra substitutes but one featuring a cable TV scam - presumably for the times when I would have used up all my Viagra supplies.

Every one of them was posted as a comment on the blog, and they could only be removed individually through the administrative pages of the site, which takes ages.

It felt like the digital equivalent of flyposting - coming home one day to find your windows covered with posters for dodgy clubs and bands you have never head of.…

http://news.bbc.co.uk/2/hi/technology/3210623.stm

Generating Thumbnails on the Fly Using ASP.NET!
If you've ever attempted to create image thumbnails for your site, you'll know it's a tiresome task. You either do it manually, or use an inflexible system such as the FrontPage thumbnail feature.

However, as you've seen in previous tips, ASP.NET gives us tremendous control over how our images work. As such, we should be able to generate thumbnails on the fly... and this snippet will enable you to do just that.

http://www.developer.com/net/asp/article.php/3098311

Syndicated Photography Feeds
Pheed.com is a database of information about photographs available on the web. We present the work of photographers who have made information about their images available as an RSS feed. RSS is a simple document format based on XML that is used to syndicate web-based content. A pheed is simply an rss feed that has been extended to include information about photographs; a photo feed. The links to the left will show you how to create an rss pheed and include information about your photographs in our database.

http://www.pheed.com/

Effective XML: 50 Specific Ways to Improve Your XML
Item 3, Stay with XML 1.0

This book excerpt is from Elliotte Rusty Harold's "Effective XML: 50 Specific Ways to Improve Your XML;" ISBN 0321150406. All rights reserved. Item 3, Stay with XML 1.0 is posted with permission from Addison-Wesley.


http://www.webreference.com/programming/xml/

Columns & Editorials from the ACM
Association for Computing Machinery
Founded in 1947, ACM is a major force in advancing the skills of information technology professionals and students worldwide. Today, our 75,000 members and the public turn to ACM for the industry's leading Portal to Computing Literature, authoritative publications and pioneering conferences, providing leadership for the 21st century.

http://www.acm.org/~hlb/col-edit/

The Basics of Color Systems and Color Management
If you talk to a printing professional they will most likely tell you that they have been doing color management their entire life! They will say that they have been getting customer correct color off their printing presses and they've been getting this off their scanners and they've been proofing it and the press operator has been doing color management for his or her entire career.

How are they accomplishing this? They've been chasing color.

If you talk to a designer, they will most likely tell you that they send their files to the printer. What does the printer do with these files? They rework them to translate the color that the designer has created into the capabilities of their printing facility. And that's how the designer has managed color.

What has that done with color? It's made color magic.…

http://www.eworld.com/colorsync/benefits/training/index.html

Introduction to Cryptography
People mean different things when they talk about cryptography. Children play with toy ciphers and secret languages. However, these have nothing to do with real security and strong encryption. Strong encryption is the kind of encryption that can be used to protect information of real value against organized criminals, multinational corporations, and major governments. Strong encryption used to be only military business; however, in the information society it has become one of the central tools for maintaining privacy and confidentiality.

As we move into an information society, the technological means for global surveillance of millions of individual people are becoming available to major govenments. Cryptography has become one of the main tools for privacy, trust, access control, electronic payments, corporate security, and countless other fields.

Cryptography is no longer a military thing that should not be messed with. It is time to demystify cryptography and make full use of the advantages it provides for the modern society. In the following, basic terminology and the main methods of cryptography are presented. Any opinions and evaluations presented here are speculative, and the author cannot be held responsible for their correctness.

http://www.networksolution.com/understanding/introduction.htm

Accessing Dreamweaver's JavaScript API
Macromedia's Dreamweaver is one of the most popular visual HTML editing tools. And for good reason -- it's powerful, accessible, and it generates pretty good code. During Dreamweaver's evolution, Macromedia has added some interesting new features -- most notable for our purposes is the enhanced JavaScript functionality.

Not only the application is scriptable, it (almost) supports the DOM Level 1 spec and defines its own JavaScript-API with more than 400 different functions. It's also possible to customize the menus and incorporate new commands into it.

http://www.oreillynet.com/lpt/a/902

Son of MSBlast on the way?
A program that exploits a software vulnerability Microsoft recently described could spell trouble for companies that haven't quickly patched their system, security experts said this week.

Released on a security mailing list earlier this week, the program takes advantage of a flaw in Microsoft's Messenger Service to cause Windows-based computers to crash. The vulnerability affects almost every current Microsoft Windows system, leaving security experts concerned that independent hackers will quickly find a way to take control of a large number of computers by exploiting the flaw.

"I think we are going to see a repeat of the (MSBlast worm)," said Vincent Weafer, senior director of Symantec's antivirus research center, referring to the program that spread across the Internet in August. The program used a similarly widespread Windows flaw to break through computers' security. "It took three weeks (for hackers) to figure out a working worm in that case."

http://zdnet.com.com/2100-1105_2-5095935.html?tag=adnews

It's time to re-examine the security hurdles facing businesses every day--worms, viruses, wireless worries, identity theft, the list goes on. How secure are your systems? Are you ready for what might be around the corner?

Last month, we gathered a panel of experts from around the country to tackle the latest security challenges while our live audience provided the pulse of the IT community by answering real-time poll questions. Now, you can be part of the Webcast--watch, learn and take the polls to see how your answers compare. In Digital Defense Test 2003 you'll see three scenarios based on real security breaches, and you'll see how the experts would solve the crises and prevent future problems.

http://zdnet.com.com/html/z/tu/1003/ddt2003.html

Flont
Need a font forecast? Enter your words, choose a size and click 'preview'. Need a headline for comping? Just drag the Flont image to your desktop.

from Veer

http://www.veer.com/flont/

The Visual Basic .NET Resource Kit

The Visual Basic .NET Resource Kit is an essential resource for any Visual Basic .NET developer.

http://msdn.microsoft.com/vbasic/vbrkit/

SVG Mobile Competition
Entries due 3 November 2003
Announcing the first official SVG Mobile Competition. Nokia have provided a 3650 tri-band GSM handset as a prize for the best SVG Mobile greeting card. What do we mean by greeting card? It's really up to you! It could be a birthday card, a funny cartoon story, a demonstration of the power of SVG - whatever you want. We're intentionally leaving it open in order to give you as much freedom as possible. Here is your chance to be known as the first SVG champion.…

This is the first in a series of SVG competitions …running over the next few months. Each competition will have a slightly different theme. There is a collection of prizes from different industry sponsors to give away, so watch this space!

http://www.w3.org/Graphics/SVG/Competition

Two major scientific research centers said Wednesday that they had set a new world speed record for sending data across the Internet, with a transmission equivalent to transferring a full-length DVD film in seven seconds.

http://zdnet.com.com/2100-1103_2-5092064.html

A pioneering attempt to overturn the U.S. government's Cold War-era laws restricting the publication of some forms of encryption code ended quietly Wednesday when a federal judge dismissed the lawsuit--but only after assurances that the anticrypto laws would not be enforced.
U.S. District Judge Marilyn Hall Patel in San Francisco threw out the case after the Bush administration said it would no longer try to enforce portions of the regulations, according to parties involved in the proceedings.

Daniel Bernstein, an iconoclastic math professor at the University of Illinois at Chicago, filed suit in 1995 after spending three years wrangling with the federal government over whether a simple encryption program could be freely distributed on the Internet. U.S. law at the time deemed online publication an "export" that could be punished with severe prison terms.

"I hope the government sticks to its promises and leaves me alone--but if they change their mind and start harassing Internet-security researchers, I'll be back," Bernstein said in an e-mail statement. Bernstein, author of the widely used qmail mail utility, did not respond to an interview request.

Bernstein's case, and two other similar attempts, have been credited with forcing the federal government to drastically scale back its attempts to regulate the kind of privacy-protecting encryption technology used in every Web browser and many e-mail readers. At one point such encryption was regulated by the State Department and treated as a "munition" like tanks and fighter jets, but the Clinton administration responded to the lawsuits by relaxing the rules and transferring responsibility to the Commerce Department.…

Bernstein's lawyers, with attorneys from the Electronic Frontier Foundation among them, complained that the encryption regulations had been repeatedly changed to derail Bernstein's case, which claimed the rules violated the First Amendment's guarantee of free expression. In a separate case, the 6th Circuit Court of Appeals had said: "Because computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment."

A January 2000 letter from Bernstein's lawyers to the government said that the rules unconstitutionally required researchers to divulge their work to the government. "The requirement that Professor Bernstein and others simultaneously notify both (the Commerce Department) and (the National Security Agency) at the time of electronic publication of source code, when no such notification is required for publication or communication of such code on paper, is another Constitutional problem," the letter said, citing regulations that will no longer be enforced.

http://zdnet.com.com/2100-1105_2-5092154.html

VeriSign sells off domain registrar
VeriSign said Thursday that it is selling its Network Solutions domain registration business for roughly $100 million, but plans to retain control over the database that directs people to .com and .net addresses.
The Network Solutions business is set to go to Pivotal Private Equity, a Phoenix-based venture capital firm, in exchange for $60 million in cash and a $40 million senior subordinated note. VeriSign will also retain a 15 percent equity stake in Network Solutions.

VeriSign said it would not part with the .com and .net database it operates, which it acquired through its $21 billion buyout of an independent company called Network Solutions three years ago. That company consisted of two businesses--a registrar, which sells Internet addresses, and a registry, which directs people to Web sites.

It's giving up the registrar business, which has become essentially a commodity service in a field in which competition has been heating up. VeriSign rebranded the unit in January as Network Solutions after two years of operation under its own name and had been seeking a buyer for the business over the last several months.

What it's keeping is the registry, recently renamed as VeriSign Naming and Directory Services--and which operates in a field where the company still has a relative monopoly. The registry business, according to VeriSign, is the backbone of a global .com and .net domain name infrastructure that handles over 10 billion interactions per day.…

http://zdnet.com.com/2100-1104_2-5092316.html

The Modern Tales syndication service allows webmasters to place a constantly-updating version of their favorite comics in the Modern Tales family on their own websites. At any given moment, the latest episode of the syndicated comic will appear within your own web page. Your readers will be drawn back to your website to follow the story (which is, of course, the same reason that newspapers and magazines carry comics). Some percentage of those readers will follow the link back to Modern Tales or one of its sister sites, and eventually choose to subscribe, to gain access to the archives (which is, in turn, analogous to buying a Dilbert paperback).…

http://www.moderntales.com/tooncast_list.php

Court Data Online
The federal court system is gradually moving its legal information online, making it much easier to search and read case information. The convenience of online access to court documents might eventually revolutionize court reporting.

The Public Access to Court Electronic Records system (known as PACER) allows users to get case and docket information online from Federal Appellate, District, and Bankruptcy courts.

At least 26 of 94 U.S. District Courts and 60 of 90 bankruptcy courts are now using online electronic systems for tracking some or all files, according to the Associated Press. Appellate courts will convert next year.

In some cases, you can get the whole case online, from the first motions filed to depositions to the judgment. Other information available online can include:

A listing of all parties and participants, including judges, attorneys, and trustees
A compilation of case-related information, such as cause of action, nature of suit, and dollar demand
A chronology of dates of case events entered in the case record
A claims registry
A listing of new cases each day
Appellate court opinions
Judgments or case status
Types of documents filed for certain cases
Images of documents entered into evidence
You can see which courts make information available online and access links to them via this page.

http://pacer.psc.uscourts.gov/cgi-bin/links.pl

http://www.poynter.org/column.asp?id=32&aid=51371

ContextMenu Plus, the latest premium utility from PC Magazine, gives you the power to edit, add, or remove menu commands from any Windows context menu. Best of all, it won't force you to wade through a multitude of file extensions and registry entries to make your edits. Instead, you can make changes directly from the rightclick menu. It also includes a host of other timesaving features, like the ability to copy and move files and explore local and network drives through virtually any right click menu.

http://www.pcmag.com/article2/0,4149,1337759,00.asp

PC Magazine's Top 101 Web Sites - October 2003
Condensed choices to bring you the top 101 most incredibly useful sites comprising 16 categories

http://www.pcmag.com/category2/0,4148,7488,00.asp

20 Great Google Secrets
Google is clearly the best general-purpose search engine on the Web (see www.pcmag.com/searchengines). But most people don't use it to its best advantage. Do you just plug in a keyword or two and hope for the best? That may be the quickest way to search, but with more than 3 billion pages in Google's index, it's still a struggle to pare results to a manageable number.

But Google is an remarkably powerful tool that can ease and enhance your Internet exploration. Google's search options go beyond simple keywords, the Web, and even its own programmers. Let's look at some of Google's lesser-known options.…

http://www.pcmag.com/print_article/0,3048,a=108625,00.asp

Microsoft Security Bulletin MS03-040
Cumulative Patch for Internet Explorer (828750)
This is a cumulative patch that includes the functionality of all previously released patches for Internet Explorer 5.01, 5.5 and 6.0. In addition, it eliminates the following newly discovered vulnerabilities:


A vulnerability that occurs because Internet Explorer does not properly determine an object type returned from a Web server in a popup window. It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user's system. If a user visited an attacker's Web site, it could be possible for the attacker to exploit this vulnerability without any other user action. An attacker could also craft an HTML–based e-mail that would attempt to exploit this vulnerability.
A vulnerability that occurs because Internet Explorer does not properly determine an object type returned from a Web server during XML data binding. It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user's system. If a user visited an attacker's Web site, it could be possible for the attacker to exploit this vulnerability without any other user action. An attacker could also craft an HTML–based e-mail that would attempt to exploit this vulnerability.

In addition, a change has been made to the method by which Internet Explorer handles Dynamic HTML (DHTML) Behaviors in the Internet Explorer Restricted Zone. It could be possible for an attacker exploiting a separate vulnerability (such as one of the two vulnerabilities discussed above) to cause Internet Explorer to run script code in the security context of the Internet Zone. In addition, an attacker could use Windows Media Player’s (WMP) ability to open URLs to construct an attack. An attacker could also craft an HTML-based e-mail that could attempt to exploit this behavior.
To exploit these flaws, the attacker would have to create a specially formed HTML–based e-mail and send it to the user. Alternatively an attacker would have to host a malicious Web site that contained a Web page designed to exploit these vulnerabilities.

As with the previous Internet Explorer cumulative patches released with bulletins MS03-004, MS03-015, MS03-020, and MS03-032, this cumulative patch will cause window.showHelp( ) to cease to function if you have not applied the HTML Help update. If you have installed the updated HTML Help control from Knowledge Base article 811630, you will still be able to use HTML Help functionality after applying this patch.

In addition to applying this security patch it is recommended that users also install the Windows Media Player update referenced in Knowledge Base Article 828026. This update is available from Windows Update as well as the Microsoft Download Center for all supported versions of Windows Media Player. While not a security patch, this update contains a change to the behavior of Windows Media Player’s ability to launch URLs to help protect against DHTML behavior based attacks. Specifically, it restricts Windows Media Player’s ability to launch URLs in the local computer zone from other zones.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-040.asp

SpamAbuse
SpamAbuse helps you report and punish spammers for sending you their junk e-mail. This is a completely free service. Often, by reporting spammers, they can lose their accounts and even get charged "fees" by their Internet Service Providers. In addition, reporting spam to SpamAbuse results in blacklisting the sites responsible for allowing it to be sent. SpamAbuse not only reports spammers once, but tracks them down and follows their provider, reporting them continuously as they try to change their tactics and move from ISP to ISP. By reporting spam, you can help to turn the tide on spammers. SpamAbuse makes this otherwise slow and technical task quick and easy and we follow up to make sure these spammers get banned for good.


http://www.spamabuse.org/

Journalism Tools: Watchdog Reporting
Thoughts and strategies on one of journalism's most important missions, monitoring the powerful.

http://www.journalism.org/resources/tools/reporting/watchdog/default.asp

Firdamatic
Firdamatic™ is an online tableless layout generator that allows you to create and customise layouts easily only by completing forms, making creating skins for your Firdamatic-based layout a breeze.

http://www.wannabegirl.org/firdamatic/

The Search Engine Report - Number 83
In This Issue
+ Search Engine Watch News
+ SES Chicago Agenda Available!
+ Search Engine Articles By Danny Sullivan
+ Search Engine Resources
+ SearchDay Articles
+ Search Engine Articles

http://searchenginewatch.com/sereport/article.php/3088721

Microsoft Sued for 'Massive, Cascading Failures'

A lot of people say MS should be held financially responsible for security vulnerabilities in Windows. Meanwhile, whenever a security vulnerability in UNIX/Linux systems is reported, the usual response is "well, of course no operating system can be completely secure.

http://www.winxpnews.com/index.cfm?id=96"

Software makers usually are not held liable for product flaws, because users must agree to licensing contracts that protect makers from liability.

But this suit takes a novel approach. It claims that Microsoft software, with a greater than 90-percent market share, is so dominant that there is little choice but to use it. Because of Windows' ubiquity, argues Hamilton's attorney, Dana B. Taschner, Microsoft cannot avoid responsibility.

Taschner, based on Newport Beach, California, specializes in plaintiff law and is a member of the America Bar Association's E-Privacy Committee.

http://www.winxpnews.com/index.cfm?id=96

http://www.newsfactor.com/perl/story/22417.html#story-start

QHost-1 Trojan changes DNS settings, exploits IE
New details have emerged about a mysterious Trojan that has been changing domain name server settings on systems since yesterday.

Dubbed QHost-1 by antivirus software vendors, the Trojan changes DNS settings and renders some network-dependent services such as e-mail and Web surfing unavailable for corporate users.

Fixing systems hit by QHost isn't difficult. Security service provider Counterpane Internet Security Inc. recommends changing the DNS server settings back to their original settings. One could also obtain DNS settings from DHCP. Correcting the registry keys created by QHost is another fix.

QHost takes advantage of a new "object type" vulnerability in Microsoft's Internet Explorer browser. Exploits were discovered last weekend, alerting security experts to the flaw, which is related to a flaw Microsoft patched in August.

QHost's success likely will be limited because the Trojan cannot spread on its own. Users must be lured to a malicious Web site.…

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-032.asp

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci930281,00.html

Two Major Databases Spring Security Leaks
The security firm Application Security Inc. reported this week that IBM's DB2 Universal Database and MySQL AB's MySQL open-source database have a total of three vulnerabilities that range from low- to high-risk levels.

The first DB2 weakness is a buffer overflow in db2dart. This entails a UDP service used for discovery of DB2 databases on a network. The UDP service is overwhelmed when more than 20 bytes of information are sent.

All versions of DB2 are affected, although the risk level is only medium. The fix is IBM's FixPak 10a, available here.

DB2's second new weakness is a vulnerability to denial-of-service attacks in its discovery service. This is a service used in turn to locate another service when configuring connections. Again, if a packet larger than 20 bytes comes in to the server, the service shuts down.

This vulnerability also affects all versions of DB2. The second DB2 flaw has a low risk level. The fix is available here.

The MySQL database has potential for a buffer overflow in its "get_salt_from_password" function. This is a serious risk, and it affects all versions of MySQL. According to Newman, a malicious user could grant him- or herself administrative privi-leges and then use the function to trigger a buffer overflow.

http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report

http://www.mysql.com/downloads/mysql-4.0.html

http://www.mysql.com/downloads/mysql-3.23.html

http://www.eweek.com/article2/0,4149,1306270,00.asp

An open-source group that maintains software for securing communications
released a patch on Tuesday to fix several vulnerabilities that were found during a security test by the U.K. government.

The security flaws exist in the OpenSSL Project's version of the secure sockets layer (SSL) software used by Web sites and browsers to cryptographically secure data. Two of the flaws could lead to a denial-of-service attack, and a third may allow an attacker to break into a system from the Internet.…

Not to be confused with the OpenSSH project--SSH stands for secure shell--which has patched its software twice in the last month, the OpenSSL Project develops and maintains an open-source version of SSL software. A year ago, the Slapper worm infected Linux computers that hadn't been patched to fix a different hole in the same software.

Cox said that a specially crafted digital certificate could crash the OpenSSL software through either of two flaws, causing a denial-of-service attack. The third flaw could result in a security hole that could allow online vandals to attack a server or enable a worm to spread. All versions of OpenSSL, up to and including 0.9.6j and 0.9.7b, are affected…

http://zdnet.com.com/2100-1105-5085327.html

Microsoft Baseline Security Analyzer
As part of Microsoft's Strategic Technology Protection Program, and in response to direct customer need for a streamlined method of identifying common security misconfigurations, Microsoft has developed the Microsoft Baseline Security Analyzer (MBSA).

MBSA Version 1.1.1 includes a graphical and command line interface that can perform local or remote scans of Windows systems. MBSA runs on Windows 2000, Windows XP, and Windows Server 2003 systems and will scan for common system misconfigurations in the following products: Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Internet Information Server (IIS) 4.0 and 5.0, SQL Server 7.0 and 2000, Internet Explorer (IE) 5.01 and later, and Office 2000 and 2002. MBSA will also scan for missing security updates for the following products: Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, IIS 4.0 and 5.0, SQL Server 7.0 and 2000, IE 5.01 and later, Exchange 5.5 and 2000, and Windows Media Player 6.4 and later.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/Tools/mbsahome.asp

The Windows XP startup disk allows computers without a bootable CD-ROM
Windows XP Professional with Service Pack 1 Utility: Setup Disks for Floppy Boot Install
The Windows XP startup disk allows computers without a bootable CD-ROM to perform a new installation of the operating system. The Windows XP startup disk will automatically load the correct drivers to gain access to the CD-ROM drive and start a new installation of Setup.

Quick Info
File Name:
winxpsp1_en_pro_bf.exe

Download Size:
4302 KB

Date Published:
9/9/2002

Version:
SP1

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=83F53BE9-28FA-40E8-8EC2-631504EF5E26

The Windows XP startup disk allows computers without a bootable CD-ROM
Windows XP Home Edition with Service Pack 1 Utility: Setup Disks for Floppy Boot Install
The Windows XP startup disk allows computers without a bootable CD-ROM to perform a new installation of the operating system. The Windows XP startup disk will automatically load the correct drivers to gain access to the CD-ROM drive and start a new installation of Setup.

Quick Info
File Name:
winxpsp1_en_hom_bf.exe

Download Size:
4301 KB

Date Published:
9/9/2002

Version:
SP1

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=FBE5E4FC-695F-43E5-AF05-719F45C382A4

MCSEworld>>>Knowledge Base>>>Tips and Tricks>>>
Shell enhancements or tweaks Windows XP/2000

http://www.petri.co.il/other_free_shell_enhancements.htm

IE holes lead to AIM, dial-up attacks
Security holes in Microsoft's Internet Explorer have been exploited by hackers to hijack AOL instant messaging accounts and force unsuspecting Web surfers to run up massive phone bills, computer experts cautioned on Friday.
Some IE users are also finding that malicious Web sites are secretly slipping Trojan programs onto their computers, which could prove an even more dangerous exploit, said Drew Copley, a research engineer at Aliso Viejo, Calif.-based eEye Digital Security, who discovered the original security vulnerability.

Such stealth programs can include keystroke loggers that record everything a person types or software to erase the hard drive, among other things, he said.

Microsoft has released a patch for the original hole, which was reported about a month ago, said Stephen Toulouse, security program manager for Microsoft's Security Response Center. The company is looking into what it says are variations of the original hole that have been discovered since then that the patch does not fix, Toulouse said.

"We will release a fix for the variations," he said.

Security experts are reporting the variations as new security holes, disclosed within the past three weeks and used for different types of attacks, Copley said.

Microsoft and eEye Digital Security said they have issued information for temporary workarounds.

In general, the attacks are accomplished by leading Internet Explorer users to a malicious Web site, either by sending an e-mail with a link to the Web page or distributing a link through instant messaging, Copley said.

When the Web site appears, it downloads code that can execute commands on its own onto the unsuspecting computer user's machine, Copley said.

An attacker has written a program that uses a security hole in Internet Explorer to hijack an already running AOL Instant Messenger account, changes the password and sends a message to the buddies list with a link to the malicious Web page, according to postings on the Bugtraq security e-mail list.

The Web site the posting listed as stealing the AIM passwords appeared to have been shut down.…Another attack is being accomplished by sending computer users to Web sites--typically porn sites--that change the computer's dial-up settings to an expensive long-distance phone number without the person knowing it, said Richard Smith, an independent Boston-based security researcher.

In the so-called "porn dialer" attack, victims are being charged as much as $5 a minute instead of paying their normal Internet service fee, he said.

A third type of attack steers computer users to pay-per-click Web sites, where the spam marketer gets paid each time someone goes to the Web site, Copley said.

Computer users can protect themselves by applying patches, following the workaround instructions, or changing their settings in Internet Explorer to prompt them before a Web site downloads programs that can execute on their own, Toulouse said.

http://zdnet.com.com/2100-1105_2-5083234.html

Put XHTML 1.0 Strict and Transitional to work
XHTML 1.0 Strict
XHTML 1.0 Strict is the most demanding XHTML flavor, but it provides the cleanest structural markup. Strict code is free of any markup used to define layout. It uses cascading style sheets (CSS) to control the presentation. This separation of structure from presentation is what makes XHTML Strict flexible enough to be displayed on different devices. The reliance on CSS to control presentation can be problematic for developers, because it's not a good choice for Web content that needs to be viewed on devices or in browsers that do not recognize style sheets.

XHTML 1.0 Transitional
XHTML 1.0 Transitional is the more forgiving XHTML flavor. Unlike Strict, which completely separates structure from presentation, Transitional allows you to use tags to control the look of your markup. Its goal is bridging the gap between HTML-based pages that allow the markup to control the presentation and XHTML Strict, which does not. Its main benefit is that it overcomes Strict's CSS dependence. Transitional pages are still accessible to users who use older browsers or who are using devices that don't recognize style sheets.

How to choose?
The choice between Strict and Transitional depends on a couple of factors:

Audience. If you find that much of your audience uses older browsers that don't recognize style sheets, Strict may not be the right answer—although I would make the case that supporting standards is more important than backward browser compatibility at this point. If most of your audience is using the latest versions of Internet Explorer, Netscape, Opera, or Safari, Strict is the best long-term choice.

Current code. If you already use CSS and your HTML doesn't contain a lot of markup that controls presentation, you can make the leap to Strict.…

http://builder.com.com/5100-6371-5061538.html?fromtm=e606

2003 CSI/FBI cybercrime survey
The eighth edition of the longest-running annual survey of computer crime and losses has recently been published by the Computer Security Institute. The study, which is conducted in cooperation with the San Francisco FBI office, is based on the results reported by 530 security specialists working in U.S. corporations and government agencies.

The number of incidents remained about the same as in the 2002 survey, but overall economic loss was down significantly; losses due to financial fraud in particular were down by 90 percent.

Theft of proprietary information was reported as being responsible for the most financial loss, with the average reported loss pegged at about $2.7 million per incident.

Denial of service attacks were responsible for more than $65 million in total losses among those surveyed, making it second only to theft of proprietary data in total cost.

Insider attacks and system abuse followed virus infections as the top category of adverse events based on the number of incidents.

In a blow to crackers who think they can move into the mainstream, 68 percent of the respondents were strongly opposed to hiring reformed hackers.

The high incidence of virus attacks reported is also a bit surprising, since 99 percent of the companies surveyed reported using antivirus software. A full 98 percent also report using firewalls.

Back when the survey began, fewer than one in five serious attacks were reported to authorities, but that percentage has doubled in recent years to around 30 percent. Of those who gave a reason for failing to report incidents, more than half said they didn’t know they could report incidents. But nearly three-quarters say that they don’t report incidents because they fear negative publicity.

The report speculates that so many companies said they didn’t know they could report incidents because they simply weren't sure which agency would have jurisdiction. This certainly remains a serious problem, with few local authorities being willing or able to pursue cybercrimes. In some cases, the Secret Service might be involved, but the FBI is often the only agency that would have both the capability to deal with this sort of crime and the jurisdiction. However, the FBI has been swamped with new antiterrorism duties since 9/11, and when it wants to pursue a nonviolent cybercrime, it often doesn't have the resources available.

When asked for his interpretation of the survey results, Special Agent Tom Grasso of the Pittsburgh FBI office pointed out that there was an “even split between unauthorized use by insiders and outsiders” and noted that a big percentage of respondents blamed disgruntled employees for the attack. He also reminded security specialists to consider past survey data when analyzing this year's results. "The authors of the study commented that this [year’s numbers] are in line with pre-2001 data, which could mean that 2001 and 2002 were just unusually high.”

Grasso is the FBI liaison with CERT and is the driving force behind the National Cyber-Forensics and Training Alliance (NCFTA), a partnership among law enforcement, academia, and industry that is working to improve cyberforensic skills.

Free PDF copies of the full report are available.
To obtain your free copy, fill out the form on this page.
Bound and printed versions are also available through
Kinko's DocStore service; a small fee is charged to cover
printing and shipping costs.

Companies can take one commonsense step to help prevent attacks: They can patch their systems. According to the CSI/FBI report, almost unbelievably, even companies that experienced serious computer system intrusions failed in nearly 10 percent of cases to patch the vulnerable systems. In the 2002 report, only 77 percent reported patching known holes that had been exploited. It might be interesting to ask some of them just what economic or other considerations kept them from patching a hole when they knew an exploit existed and had been used to successfully attack them at least once.

http://www.ncfta.net/

http://gocsi.com/forms/fbi/pdf.jhtml?_requestid=990693

GotDotNet Workspaces
GotDotNet Workspaces is an online collaborative development environment where .NET developers can create, host and manage projects throughout the project lifecycle.

What sort of tools are available to make all of this happen? Check out the About Workspaces page for details on all the features. Still don't have the answers to all your questions? Try looking in the FAQ.…

For those of you unaware of this application, the Workspaces are an open source community written and provided free by Microsoft. Yes, you heard right. I did say open source, free, and Microsoft in the same sentence.

If this surprises you, you obviously haven't seen the ASP.NET Starter Kits, Web Matrix, TaskVision, Terrarium, or the Application Blocks. But before you start comparing Workspaces to something out of the movie Antitrust, Microsoft has a very clearly defined user agreement that states your source code will only be stored and not viewed.

http://www.gotdotnet.com/community/workspaces/docs/about.aspx
http://www.gotdotnet.com/community/workspaces/docs/faq.aspx


http://www.gotdotnet.com/community/workspaces/default.aspx

Microsoft Bloggers
Microsoft folks are blogging about
everything from their favorite martini recipes, to marketing
challenges, to the guts of the Common Language Runtime
inside the .Net Framework. And now Microsoft is planning on
making some public noise about its support for RSS 2.0,
according to Empire Blog Watcher Mary Jo Foley.

http://www.microsoft-watch.com/article2/0,4248,933657,00.asp

Sobig.f proves why focusing on commercial spam is a mistake
One of the biggest mistakes being made on the anti-spam front by vendors, service providers, lawmakers, and lawyers is the focus they are placing on technological and legal solutions that attempt to define, in one-size-fits-all fashion, what spam is.

Many of these solutions start with the notion that spam is unsolicited commercial e-mail. They leave alone other types of unwanted e-mail --- worms, viruses, surveys, political messages, chain letters, etc ---- that are equally empowered to destroy the Internet's e-mail system.

Perhaps now, with the latest variant of the Sobig worm wreaking havoc on the Internet, these misguided anti-spam fighters will realize that defining spam is a waste of time. Tracing Sobig's footsteps and side effects,… shall reveal that focusing on any one type of unwanted e-mail leaves the Internet's e-mail system vulnerable to an irretrievable breakdown. The same industry-wide standards that could help in the battle against spam can also relieve the Internet's e-mail system of the life-threatening congestion caused by worms like Sobig.…

To cover their tracks, senders of unwanted e-mail prey on this weakness --- the ability to "spoof" an e-mail header --- in the Internet's SMTP standards. Even worse, this weakness is often exploited to make an e-mail look to the recipient as though it's coming from someone they already know. This technique increases the likelihood that the unwanted e-mail will get opened by the recipient. .

To a recipient, the Sobig worm and a spammer look very much the same. They're both the source of a tremendous amount of unwanted e-mail. They both forge the originator's credential information to cover their tracks. They both flood the Net with unnecessary traffic. They're both a drain on the recipient's (or receiving organization's) time, money, and productivity. But where they differ is in their distribution. Whereas a spammer will often send transmissions from a single or small number of addresses, Sobig works like a Distributed Denial of Service (DDoS) attack. First, it finds vulnerable systems on the Internet and then, via its payload, it deputizes them into originating more worm-laden e-mail.

The result is very spam-like. An enormous amount of e-mail traversing the Internet, all bearing forged credentials that not only aren't traceable to the originators of the worm itself, but aren't even traceable to the deputized system. But it gets worse.…

http://techupdate.zdnet.com/techupdate/stories/main/0,14179,2914521,00.html

Why Verisign's Wildcard DNS is a Bad Idea
Verisign, owners of what was once Network Solutions, have introduced a new wrinkle to the web. By adding 'wildcards' to their domain name settings, any domain name not found will be redirected to their 'helpful search portal.' This is because, in reality, an address was found: Verisign's wildcards match anything not found elsewhere. If the domain is found, but not the page, that domain's 'not found' page will be displayed. I'll leave it to others to discuss the technical details if they choose to.

Why is this a bad idea? Not because it annoys me personally. If that were a valid argument it would deny fans of certain television sitcoms and certain styles of music their rightful enjoyment. Verisign had a Bad Idea from a business perspective, and from a web perspective. It's a bad business model, it violates the spirit of the web, and it confuses and potentially alienates customers.

A Bad Business Model
Network Solutions was once a government-sanctioned monopoly. Not the open-to-debate type of monopoly Microsoft is accused of being, but a true monopoly. As the only vendor for domain name registration, they could essentially make their own rules.

Those days are gone. Now, domain name registrars can be found on any virtual street corner. Verisign, as the new NetSol, is trying to recover from that loss of monopoly. Let's briefly compare these two alleged monopolies, Microsoft and Verisign/Netsol. Microsoft develops (or purchases) tools that are useful to me, and which I usually have a hard time finding elsewhere for a fair price and the same quality. (I realize that's a subjective statement, so if you disagree, feel free to write your own article and make your own subjective statements to the contrary.) Microsoft has done a world-class job of marketing, making their tools the de facto standards of the software world, as far as the average end-user is concerned.

Verisign provides no services which can't be found elsewhere, at a better value for the same or superior quality. Their marketing has done nothing compelling to cause me to desire their services. Although they have lowered prices on extended domain name registration, their first-year price is exactly what it was during the days of their monopoly. This makes bad business sense when equal or better registration services are commonly available for less than one-third the cost. Higher prices, in a good business model, must be offset by some compelling reason for the customer to pay them. Verisign has not provided that reason.…

http://evolt.org/article/Why_Verisign_s_Wildcard_DNS_is_a_Bad_Idea/25/60224/index.html?format=print

Microsoft PowerToys for Windows XP
They're back! PowerToys are additional programs that developers work on after a product has been released to manufacturing. They add fun and functionality to the Windows experience.

Note: PowerToys operate as they should, but they are not part of Windows and are not supported by Microsoft. For this reason, Microsoft Technical Support is unable to answer questions about PowerToys. PowerToys are for Windows XP only.

Important Notes
You must uninstall your old PowerToys before installing the new ones.
PowerToys will only work with US-English regional settings.
Just look at your PowerToy choices:


http://www.microsoft.com/windowsxp/pro/downloads/powertoys.asp

Patch issued for critical Sendmail flaw
A critical vulnerability has been found in Sendmail, the most widely used mail server software.

The vulnerability allows attackers to take control of servers using Sendmail, which is commonly used on Linux, Unix and BSD systems.

The discovery and subsequent disclosure of the security flaw comes one day after serious security problems in the OpenSSH secure shell server software were disclosed.…


It's the third time this year that a serious vulnerability has been found in Sendmail software, and the second reported by Michal Zalewski, the researcher that posted the most recent bug. The earlier bug was found by Internet Security Systems in early March.

Users can upgrade to version 8.12.10, which is not affected by the glitch, or apply a patch.

http://zdnet.com.com/2100-1105_2-5078601.html

Don't Let Your PC Become a Porn Zombie
More than a thousand Windows PCs were hijacked recently, unbeknownst to their owners, to send spam and distribute pornography. This was done via a Trojan known as Migmaf (migrant Mafia) that turned their machines into proxies, or relay points, which hid the real servers involved. (For more information, see the article at www.wired.com/news/print/0,1294,59608,00.html.) The victim machines, controlled from afar, are often called zombies. Here's how to keep your PC from becoming a zombie in the service of spammers, pornographers, and malicious hackers.

It's important to understand that although mainstream news coverage of such exploits is a recent development, these activities have been occurring practically since the general public was allowed to use the Internet in the early 1990s. Back then, hackers who wanted to cover their tracks would take control of machines running certain programs that let Windows-based PCs share Internet connections (before Microsoft built Internet Connection Sharing into the operating system). They'd then use these machines as proxies for their attacks on other systems. When investigators tried to trace the break-ins, they would find only the Windows machine, which kept no record of the hacker's whereabouts.


Pornography and spam make for good headlines, but the purposes for which most compromised machines are used are not nearly as sensational. Most often, machines are used as repositories for warez—pirated software—or as rendezvous points for IRC sessions among hackers. They're also commonly used as soldiers (or zombies) in distributed denial-of-service (DDoS) attacks, in which large numbers of computers focus a barrage of network traffic on a single company or computer system. In most cases, users whose machines are compromised never know that their systems are being used for nefarious purposes.

You can protect your machine by learning to recognize the signs that your computer is being invaded. Are the lights on your cable/DSL modem, or network hub flashing wildly when you're not doing anything on the Net? Is your hard drive seeking frantically when the system ought to be idle? Does your system seem sluggish? While none of these symptoms are sure signs that your computer has become a zombie, they merit investigation.

If you're running Windows, try typing netstat-a in a command window. Do you see established connections to other machines, even when your browser and e-mail programs are closed? If so, your computer could be compromised. (For helpful information on the ports Trojans generally use, as well as the free PestPatrol Port Checker utility, check out http://pestpatrol.com/Support/About/About_Ports_And_Trojans.asp#advice.)


http://www.pcmag.com/article2/0,4149,1268110,00.asp