February 29, 2004:

There are actually a fair number of problems involved with implementing Wi-Fi Protected Access (WPA) on a wireless network, as I've discovered over the past month or two. I've mentioned the missing supplicant problem here before (see my entry for February 5, 2004 entry) and things are getting better: If you're using Windows 2000, WPA Assistant works great and it's a free download. For XP, you can download a free patch containing a supplicant from Microsoft, and it's here. Mac OS/X Panther comes with a WPA supplicant. For other OSes, you'll probably have to pay $40 for Meetinghouse Data's Aegis. This situation should improve over time; I expect an open source suuplicant for Linux at some point, and Win9x, well, let us pray.

Another, even bigger and less solvable problem is that the vast majority of existing Wi-Fi products don't support WPA and probably never will. A thin handful can be upgraded through firmware, drivers, or both—but most of that is Wireless-G. If you're all Wireless-B, and if your gear isn't extremely recent, you should abandon all hope of an upgrade. Worse, there's really no such thing as a "mixed security" network. It's either WEP, or it's WPA. A wireless access point is a hub, and it's only got one radio. Trying to mix security technologies in a single AP basically reverts to the least common denominator, WEP.

My own situation here was interesting: I was planning on upgrading my entire network to WPA-compatible Wireless-G, and found that Carol's ancient Compaq would not cooperate with any Wireless-G client adapter. This made me grind my teeth pretty hard, but then I tried something: I hung my ancient and venerable Cisco Aironet 340 access point off my sparkling new Linksys WRT54G wireless gateway. The Aironet line defaults to requesting an address from the local DHCP server, so I plugged it into the WRT54G, and it just worked.

February 28, 2004:

Well, it's official: My next book project will be Degunking Email, Spam, and Viruses, and it should come out sometime this fall. It won't be a huge book and it shouldn't take too long to write. I will admit that I have another book project I want to do really badly (and I've spoken with some of you about it) but we need this one to build the Paraglyph product line and extend the Degunking brand a little.

There's a lot to say. For example, you can block a lot of spam by searching for the following short strings in a message body:

http://www.%
http://%77%77%77
%68ttp://

These are all real-world (I have the messages where I found them in the deep freeze) spammer obfuscations of the first part of nearly all Web URLs, and because they're obfuscations, legitimate email will never contain them. (The trick is that HTML allows you to substitute a numeric escape like "%77" for an ASCII character like "w"—though nobody needs to go to that trouble but spammers.)

However, what we really need to fight spam is something we don't yet have: A client-side spam payload black hole mechanism. In spam-fighting jargon, a "black hole" is a blacklist of IP addresses known to belong to spammers. Spamhaus and SPEWS are the best known—and the most hated, at least in part because they are put together by people so maddened by the spam wars that they will blacklist very indiscriminately, and un-list almost never, even when an IP changes hands.

However, the real problem with black holes is that they are server-side spam filtering, which assumes that one solution, one set of banned keywords and IPs, will do for all people. There are actually people (in the medical field) who need to talk about drugs like Xanax and Cialis and Ambien, and a lot of server-side spam filters nuke any message containing those terms. (I wouldn't want to be a urologist trying to work with peers and patients over email these days.) Worst of all, you don't know what messages you're not getting. With client-side spam filtering you can at least spot-check your trash folder. If your ISP does it, well, you have no way of knowing how well their filters are working...or overworking. To me, even one false positive is unacceptable, and therefore, server-side spam filtering is worse than none at all.

The Indy components for Delphi contain a DNS resolver component, so creating a utility that builds a database of what domains point to what IPs should be easy to do—and very illuminating. I recently hand-checked a sample of 50 "payload" (within the message body) spam domains, the ones that can't be spoofed without defeating the purpose of the message, and it's amazing how many point to the same block of IPs—or even the same single IP! If a mail client could parse out URLs and resolve them to IPs, we could finesse the problem of bulk domain sales, which allow a spammer to use a domain for a few days and then abandon it. IPs are much harder to come by than domains. A client-side payload black hole would be useful because it would be conservatively maintained—by the user—and remain under the user's control. (Sender black holes are increasingly irrelevant because so much spam forges the "from" field.)

February 25, 2004:

Ash Wednesday. Lent is not my favorite season. I spent my Catholic youth up to my nostrils in penitential sacramentality, and it's taken me a long time to get over it. I'm mostly there; St. Raphael's parish here is about as close to perfect a Catholic parish as I've seen in my years-long search—and it's Episcopalian. The boundaries are slippery, but there's something called Anglo-Catholicism, and...well, that may have to be an entry for another time. Right now, I'm kind of exhausted, but I wanted to relate a quick story of why I really love St. Raphael's.

We went to the small noon service for Ash Wednesday, a quiet, music-less Mass with ashes distributed after the sermon. I hadn't had ashes put on my forehead for a lot of years, nor had I seen a church with the statues and crucifixes covered with violet cloth for even longer—the Romans don't do such things anymore. Carol was acting as acolyte—an adult altar girl—and I was in the pew by myself. It was hard to see something as deeply mythic as the enshrouded crosses without thinking back to my own childhood, and remembering being in the pews with my parents during Lent, with all the statues covered and in the air that inescapable sense of misdirected contemplation that somehow always came across as gloom. As Deacon Edwina made the ashy cross on my forward, whispering, "Remember that you are dust, and to dust you will return," I could only think of my father, who became dust far sooner than the father of a confused and anxious young man should. There were tears on my cheeks as I walked back to my pew, and as I began to kneel again, a little girl in the next pew back (whom I didn't know) reached out and touched my shoulder.

"Why are you crying?" she asked, her face full of concern.

"I was thinking of my father," I said, trying to smile and failing, "who died a long time ago."

She didn't say anything in reply, but she leaned over the pew, put her arms around my waist, and gave me a quick hug. I was thunderstruck. She was maybe nine years old, and I had never seen her before. (Her family goes to the 8:00 liturgy, and we attend the 10:30.) There are times that I find myself thinking that cynicism has won, and we who believe that all manner of thing will (eventually) be well should just pack it in. But at that moment I felt that if a nine-year-old girl will reach out to comfort an old bald guy she doesn't even know, well, the Bad Guys don't have a chance in Hell.

February 21, 2004:

For reasons still unclear, the book listing for Degunking Windows on Amazon is an utter mess. In recent days I've gotten half a dozen emails from people who have gone to Amazon to look at the book's entry, only to find that (at various times):

• The publisher is listed as "unknown."
• The publisher is listed as "No Starch Press."
• The book is selling for cover price instead of the typical Amazon discount
• The book is available "in 4 to 7 days" rather than immediately.

February 20, 2004:

Something weird happened to me the other day: I was doing some Web research (ironically, on viruses delivered via spam) when something changed the home page on IE. I don't remember seeing one of those boxes asking permission to change my home page (and I have drive-by installs disabled) but suddenly IE went to some spammer site and started pushing ad pages at me. I ran all the usual checks for viruses and things and found nothing. How it happened remains a mystery, but I know enough about IE to figure it's not evil spirits.

No, that was the deal-breaker. I've felt IE to be a little dicey for some time now, if for its ubiquity (and hence its high profile for attacks) if not its security flaws. So I downloaded and installed Firefox, the new small-footprint Web browser to come out of the Mozilla project. I tried Mozilla some time back (yeek, it was well over a year ago, maybe closer to two years) and at the time didn't need most of the stuff that came with it. I'm impressed enough with Firefox that I may now try Thunderbird, the Mozilla email client—and possibly, once again, the whole Mozilla shebang.

February 19, 2004:

We got our "certificate of occupancy" yesterday for the new house. It was actually issued a while back, and sat on some city functionary's desk for almost a month because nobody asked for it: We didn't know it existed, and the builder didn't think we wanted to move in yet. Our banker explained the whole thing to us, and I felt like Dorothy in Oz when he told us that we always had the ability to move into the house—at least once the certificate of occupancy had been issued. We didn't need to close, in a real estate sense. "Closing" in our case is the process of making sure all the bills are paid and all the mechanics' leins are removed from the property to establish clear title with us and the bank. We have actually owned it all along, at every stage since groundbreaking, because the developer has been taking draws from our construction loan.

I guess at some level I knew all that, but I've had a lot of other things on my mind. (Ha!) We sanded shelves yesterday and will probably be doing more of that today, tomorrow we'll be sealing grout, and in a few days we'll be having furniture delivered. There's some minor fixup work still to be done (and a mirror to be hung in the bathroom) but it's all pretty routine.

To celebrate "getting" the house, I hauled four boxes of electronics parts up there and piled them in the basement. Mine! Mine, right now! (Dogs and tigers pee on things; I have to stack boxes of vacuum tubes as evidence of dominion.) We've already scheduled phone and cable installation, and Carol is interviewing moving companies. Unlike Dorothy, we'll have to do more than just click our heels together three times to get everything up there. It's going to take some work—but at least the work can now begin.

February 17, 2004:

How's
Jeff's House Coming?

Finished street view
(118K image)

A few odd lots before I get back to work on my Wi-Fi book revision:

• As I write this, Degunking Windows has hit #36 on Amazon, probably because we scored a glowing review in today's Miami Herald. I confirmed with Keith that no (I repeat) no Coriolis book ever got that high; as far as we remember, no Coriolis book ever made it out of triple digits into double, even our fantastically successful MCSE Exam Cram.
• With any luck at all, we'll close the deal on our house next Wednesday, and deliver our new funiture the next day or Friday. (Moving everything from the rental here won't happen until the second week of March.) The tub disaster was fixed, and because it's so dry here, the water that we spilled didn't hang around anywhere long enough to do any damage.
• There is a new email-delivered hijacking scam that is a nasty piece of social engineering: One of those Web greeting cards that plants a back door on your system. See this page for some technical details. These things are getting devilish; this supports my prediction that more and more of the Internet will eventually vanish into strongly encrypted and authenticated private "darknets," and the sort of friendly back-and-forth we now enjoy with relative strangers will vanish into history. (This, I think, is what Friendster and its brethren will eventually become.) In the meantime, it's probably a good idea to nuke those e-cards without opening them, and an even better idea to avoid using IE whenever possible. I'm probably going to Opera.
• I've heard a good deal about "spim," or spam delivered over IM systems like AIM and Yahoo Messenger. Here's one typical article. What I can't gauge is how bad the problem is getting. The only IM system I now use is Skype, and I haven't seen any spim yet. I got one or two during the time I used ICQ regularly, but it didn't seem to be a problem.

February 14, 2004:

February 13, 2004:

It got down to zero last night, and the night before that it was 8° and snowed. I'm trying to keep the sidewalks in front of the new house clear of snow, so that the tradesmen won't be tracking it into the house by the monster bootful. So I was up there the other day, shoveling, and stepped back for a second when I realized something truly astonishing:

I was enjoying it!

Egad. Here's a man who grew up in Chicago shoveling snow and hating it, who moved to Rochester NY where he lived for six years, shoveling snow and hating it, and from there to Baltimore, where he shoveled less snow (and for only two winters) but hated it just as much. So how could it be, that after 19 years without shoveling snow at all, I could find myself flinging it with abandon in 8° weather and reveling in the experience?

The photo above (taken the day I was shoveling so joyfully) should give you a hint: Here in Colorado, snow is generally beautiful. It doesn't stay around that long, either. There is so much sun here that within a few days, most of the snow is gone anywhere the sun shines, and the streets are dry. Back in Chicago, the snow hung around all winter, getting first gray and then black, and finally (sometime toward the end of March) turning into the most disgusting slush you could imagine, filthy with motor oil, salt, and chunks of pavement carved by endless wheels out of the spring's crop of potholes. In Chicago, winters are so gray that people buy full-spectrum lights to keep from getting suicidal. Here, the sun shines virtually every day, and facial sunburn is an issue even in February.

February 12, 2004:

Henry Guzman alerted me to the fact that Wireless Security Corporation is releasing their Windows 2000 WPA supplicant utility as freeware. The news release is here and the download page for WPA Assistant is here. This at least partly ameliorates the problem I reported in my February 5, 2004 entry: That most Wi-Fi hardware vendors are not shipping a WPA supplicant utility with their WPA-certified client adapters. Windows XP has a built-in supplicant; heretofore, everybody else (including users of the corporate favorite Windows 2000) has had to pay $40+ per seat for a third-party supplicant utility. In my view, that borders on fraud. For those OSes without a supplicant, the supplicant should be installed with or as part of the client utility. Period.

I downloaded WPA Assistant but have not tried it yet. We're closing in on closing and it's just making us crazy. I expect to put the utility through its paces this weekend or early next week, and I'll let you know how it goes.

February 10, 2004:

One of the things I'm going to do once we're in the new house is establish a media server, which is going to allow us to display our digital camera and scanned photos on our new TV set, and probably watch out home movies there as well, once we have some home movies. (I have four tapes full of the house construction, but haven't converted them to MPEGs yet. All I need is a second—parallel—life to do all this stuff.). The nice thing about servers is that you don't have to fool with them that much, and it's pointless to devote a separate keyboard or display to them.

You do have to administer servers somehow, and I've become intrigued with the notion of using a remote control utility to create a "headless" windows system. There are quite a few of these, most of them based on an open source project called VNC (Virtual Network Computing) which has forked into numerous separate implementations, including RealVNC and TightVNC. Probably the best gatherum of VNC information is at the VNC FAQ-O-Matic. It has certainly made my early research easier.

With VNC, you can control a Windows system (or a Mac or Linux system for that matter) over a reasonably fast TCP/IP connection, with a (more or less) realtime simulation of the remote desktop. 10-15 frames per second is typical, and more than fast enough for server admin. I have CAT5 cables running throughout my house, so I suspect my home network will be more than fast enough to run VNC—and it's not like I'm trying to play fast frame-rate video games or anything. (Some say you can do that too, though I'm skeptical.) I'm also intrigued by Kaboodle, which is a freeware network management tool that acts as a manager for VNC sessions across a LAN.

The VNC technology suggests something even more interesting: A headless wardriving box administered via VNC through a Wi-Fi connection, and mounted literally in the open sunroof of my 4Runner. That way, there'd be no signal loss in coax from an antenna to the computer, since the antenna would be mounted on the box that contains the mini-ITX motherboard itself. It would be nice if NetStumbler ran as a service, but it's certainly possible to load it and run it on reboot. No I/O except for a speaker to honk when it picks up a node.

February 9, 2004:

Earlier this afternoon, we had Pillar to Post (a house inspection company) come out and go through our new house with a magnifier and a paranoid attitude, to see if they'd spot anything we had missed before hurtling headlong to closing some time next week. They were nothing if not thorough, and left no valve undisturbed and no button un-pushed. As part of that process, they filled our whirlpool bathtub with water...and then pushed the whirlpool button.

Erk. Water began gushing furiously somewhere under the tub. Brett (the inspector) turned the jets off, but by the time he did at least ten gallons of water had gushed from a broken pipe underneath the tub, and had gleefully escaped into the heating ducts and down onto the ceiling of the guest bedroom immediately below it.

February 7, 2004:

How's
Jeff's House Coming?

The kitchen
(108K image)

The view from Jeff's office window
(180K image)

On the other hand (see my entry for February 5, 2004) Linksys has begun doing something good and literally outside the box: They're using GPL'd open-source code in their firmware. This means that they must share the code with the world at large, and the world has responded by doing a lot of really interesting things, including creating small-footprint installs of Linux that run off the WRT54G wireless gateway. Broadband Reports recently ran a piece on tinkering the WRT54G firmware for improving QoS on VoIP, with links to Sveasoft's firmware mods. The WRT54G is the currently favorite because it's new, and has more internal storage and compute power than older Linksys routers, access points, and wireless gateways.

The Linksys "blue boxes" have long been beloved of the hacker (in the better sense of the word) community: See the marvelous insider documentation written by Eric S. Raymond himself. There are some interesting reasons to use an "appliance" like the BEFSR41 instead of trying to do the whole NAT and firewall schtick on a separate Linux box, first of which is that an appliance is generally too stupid to crack, as ESR points out. (You can't get root if there ain't no root to get—I wonder how that might change once Linux-in-a-blue-box becomes common.) There's certainly some upside in it all for Linksys, since the network experts' community is a very thick group, with a high-bandwidth word-of-mouth backbone. Making points with them cannot but generate sales. And of course, Linksys can, if it wishes, take back any or all of the third-party GPL mods and work them back into the "official" firmware, thus taking advantage of free labor from some of the world's most brilliant programmers.

February 6, 2004:

The morning after superbowl Sunday, one of my regular correspondents wrote to ask if I had seen Justin Timberlake rip one of Janet Jackson's bra cups off during the halftime show. He was breathless about the little silver buzzsaw (or whatever it was) that she had glued over her right nipple. My first reaction was, WTF? As I described in my February 2, 2004 entry, Carol and I were at a superbowl party on Sunday, and we spent the entire duration of the broadcast down in Dean Nelson's family/media room, with the show on his wide-screen TV. There were fifteen people in the room, and as best I know, not a single one saw Janet's buzzsaw. (Not to sweat the young-uns; they were all down the hall playing video games.) I remember glancing at the halftime show every couple of minutes, but each time it was the same collection of indistinguishable, no-talent screamwrithers that populate most of TV ostensibly targeted at young people. I saw (with some satisfaction) that everyone else was doing the same thing I was: We were having a nice supper (as I mentioned, Dean is famous for his Superbowl Chili), hanging out with one another, and completely ignoring the TV.

February 5, 2004:

I've been pretty fried at Linksys for some weeks now, and I'm trying to figure out how to deal with it in the update of my Wi-Fi book, which I'm in the process of writing. It could wait until now—but I'm at the point where I'm writing a whole new chapter detailing the new WPA (Wi-Fi Protected Access) security technology, and so time has run out.

The problem is this: Although most Linksys Wireless-G equipment is billed as supporting WPA, that's true only for Windows XP. The problem is that WPA requires a piece of software on the client side called a supplicant, which handles the client end of the WPA security mechanism. Why this isn't part of the client adapter firmware I'm not sure, though I suspect that there is a computational burden in WPA that the little embedded processors inside cheap Wi-Fi client adapters just don't have the muscle to deal with. One of the recent patches to XP includes an integrated supplicant provided by Microsoft. Without that supplicant, WPA won't work on Linksys clients under Win98SE or Win2K.

Linksys has some obscure small print indicating that on OSes other than XP, you need to provide your own WPA supplicant. Funk Software will sell you one for $50; I don't think there are any other third-party supplicants that Linksys hardware supports. I've always been happy with Linksys gear, but it's hard for me to look past such a completely dorky decision. D-Link has begun bundling a non-XP supplicant with its Wireless-G equipment, and I was kind of expecting Linksys to follow suit, as those two represent the dueling titans in the SOHO Wi-Fi market. But so far, Linksys won't even answer my inquiries, and there's no supplicant on the horizon.

February 3, 2004:

February has barely begun, but the March issue of The Atlantic arrived yesterday, and I've been half-crazy wanting to curl up in my comfy chair and devour it. Too many other higher priorities, alas, but I stole a few moments to read Cullen Murphy's tongue-in-cheek "Innocent Bystander" column on assembling a secular "Next Testament" that would be to our modern age what the Old and New Testaments were for prior ages, and maybe a few moderns as well. The piece itself was pretty light and not Murphy's best, but it got me thinking: Could we create a sort of secular Ten Commandments that would pass constitutional muster and yet still stand as a moral code for human society? I sat down last night and, well, did it. Didn't need stone tablets, and in fact it lacks the extreme elegance of the original number, but given that we are transitioning from the age of Freedom of Religion to the age of Freedom from Religion, I figured it would be very much in style. So here they are, arranged roughly in order of their importance:

The Secular Ten Commandments

1. All human life is equally and unquantifiably valuable, including the life of the unborn, the infirm, and the aged: Do not kill except in self-defense.
2. Respect the integrity of the family: Honor obligations to your spouse, your children, your parents, and all that family ties oblige you to support.
3. Respect the integrity of the Earth: Take no more from it than you need, and of what you take, waste no more than you must.
4. Cultivate a generous heart: Give freely of what is rightfully yours to give.
5. Do not use power over others to advance your own interests.
6. Do not lie or break promises, especially for personal or political gain.
7. Do not take what you have not earned nor inherited, nor accept what others do not have the rightful power to offer.
8. Do not engage in sexual immorality.
9. Do not engage in cruelty to animals.
10. Do not allow yourself to think, speak, or act out of envy.

February 2, 2004:

Carol and I went to a Superbowl party yesterday afternoon. Don't pass out—it certainly wasn't for the football. Dean and Diane Nelson, our new neighbors up at the house, invited us to their annual Superbowl party, which includes their friends and relatives and few of their close-by neighbors. Dean is a master at making chili, and we had a fine time meeting some of the neighbors a little prior to moving in to our new house.

Sports is legendarily not my thang, and I had a good deal more fun talking to some of our neighbors, including one who like me has a Jet lathe and makes a fine side-living selling bronze castings of his sculptures. I glanced at the game now and then, just to see who was winning, but whenever the football action broke for a commercial, it was fascinating how everybody in the Nelson's cavernous media room stopped what they were doing and focused on the screen with rapt attention.

I enjoyed most of the commercials, and my top three were the following:

1. The Shards 'o Glass Freeze Pops commercial was as wickedly on point as it was creepy, especially for a tobacco hater like me—not to mention a guy who has spent much of the past month picking up shards o' glass from the odd crannies of my office here. (See my entry for January 22, 2004 for some photos.) For those who missed it, well, it was a convincing evocation of a product—popsicles studded with dagger-like chunks of broken glass—for which there is no safe way to consume except not to consume. At the end, the simple slogan: "What if other people advertised products the way the tobacco companies do?" Pure genius. If you missed the commercial, go to www.shardsoglass.com.
2. Chevy is advertising a new vehicle called the SSR, which is a weird portmanteau of pickup truck, SUV, and PT Cruiser ripoff. As unnecessary as the vehicle might be, the pitch was brilliant: Scene after scene of 11-year-olds with bars of soap in their mouths. Finally, a kid standing on the sidewalk watching one of the SSRs retract its deck lid. The kid starts to say, "Holy sh..." and the camera cuts to that kid, finally, with a bar of soap in his mouth. Great concept, though I think the kids were a little young to be that entranced by a car.
3. Budweiser offered a number of commercials, but none beat the one in which a donkey interviews for an opening with the famous (and enormous) Budweiser Clydesdales. Great silly fun, and I don't even like beer!

February 1, 2004:

Not much time to even think today, so here's a few odd lots to tide you over until the Bowl is done:

• Jim Mischel reminded me of desktoplinux.com, a news/resources aggregator for Linux desktop issues. Beautifully done, and the best place to start if you're researching Linux for use by ordinary people. Jim also mentions a similar side, PCLinuxOnline, which is well worth studying, though it covers a lot of the same turf.
• While we're talking link troves, don't miss wardrive.net. I'm pretty sure I've cited it before, but Jacco Tunnissen keeps adding new material, so you should definitely stop in on a regular basis. It's got virtually every link I've ever seen pertinent to the Wi-Fi hobby, wireless security, and wardriving. First class.
• I discovered another mystery yesterday, while washing a load of jeans. Almost all of my jeans have worn through in one knee, and it's the same knee: my left. What the hell...when I go down on one knee for something, it's always my right knee. (That must be a Catholic thing. One always genuflects on one's right knee, at least while the nuns are watching...) Interestingly, the fabric over the right knees of all those jeans isn't even wearing thin. What could possibly cause this?
• I've never seen anything quite like this. I knew that audiophiles have their lunatic fringe (remember the PC motherboard with a tube audio amp built into it?) but wow, this is as awesome as it is puzzling. Why would anybody want three tonearms on a single turntable? (Remarkably, the chap who created this thing lives in Colorado Springs. He might be worth meeting.)