If you must use IE–

If you must use Internet Explorer, please, please, please, turn off all scripting, Java and ActiveX support. Learning how to restrict security in Internet Explorer is easy. Once you turn off all JavaScript, VBScript, ActiveX and Java support, 99% of all worms, trojans, phishing schemes and other parasites that rely on Internet Explorer (Or any application that uses components of IE.) to spread will be stopped dead.

I’ve suggested this to the laity for years but often relented because I knew that being so restrictive would break 90% of the Web. But after spending this year cleaning trojans from many machines and finding XPSP2 a bit disappointing, I have decided to insist on it.

There is a tool (I wonder why this wasn’t added to IE6 in XPSP2?!?) that lets you to quickly build a whitelist of safe sites where you can allow all the bells and whistles to work while still filtering out all the garbage. With this tool, which works in Internet Explorer 5 and higher, you can turn off all scripting, Java and ActiveX for all the Web and only turn it on for the small fraction of sites that you actually care about and need. I didn’t know about this tool until recently. It’s a pain to build a whitelist manually which was why I didn’t insist on such tight security for my customers these last few years. Maybe this tool will make my case for me.

Posted in Security and Privacy | Comments Off on If you must use IE–

A justification to learn new stuff

So in relation to my earlier post about XHTML, yesterday I was reading what Jacques Distler had to offer for justifications for serving XHTML as application/xhtml+xml. But it’s easy for him–many of his entries serve up MathML. Unlike him, I am only humble ex-physics major but, I’ll use any excuse to justify learning something useless. And his page pointed me to something that may justify my dangerously futuristic web design: Syncato.

Syncato, as near as I can tell, is a content management tool, written in python, to work entirely in XML. This means it can start with XHTML but it can start tying into many other things so long as you define things in XSLT or XPath. At last I can blog and do XML at the same time!

But there are barriers in front of me:

  1. I don’t know python, XSLT or any of that new fangled stuff. But I could use this as an excuse to learn it.
  2. This site sits in a server that doesn’t have python or any of the other requirements Syncato needs. However this could change. Baka tells me he plans to move things to a safer machine in a colocation company. Perhaps I’ll have access to more modern tools there.
  3. I’ll have to painstakingly merge all my old Greymatter pages into Syncato. Luckily since they are almost all well-formed and valid, this shouldn’t be too maddening just laborious.
  4. Syncato really isn’t ready for prime time. But as I recall, when I installed Greymatter over three years ago, it wasn’t really ready either and since then I’ve forked very far from Greymatter’s current trunk.

Anyway, I intend to explore this gadget in my carefully planned and efficient life.

Posted in Webmastering | Comments Off on A justification to learn new stuff

Back to HTML 4

Nearly three years ago I converted all the markup on this site from strict HTML 4 to strict XHTML 1. Fairly soon after this, I discovered that, to be kosher, I had serve this with the MIME format set to “application/xhtml-xml.” For a long time I ignored this, noting that I could get away with serving this as “text/html as long as I didn’t try to embed any real XML in it.

Recently though, in the process of trying to send content with the correct MIME on the site of a customer of mine, I discovered that I was dodging a lot of issues just for the sack of bogus bragging rights. Yes, it is cool that I am trying to be as futuristic as possible in my web development but, it’s pointless if I am not doing it right and if I don’t really have a reason to do so. I don’t plan to embed MathML, SVG or ChemML in any of my customer’s sites soon, so what’s the point? Here, on this site, which is hosted on two Solaris boxes in the basement of Baka’s parent’s house in Alameda, I have to do a lot of back and forth with Baka before I try anything really exotic, like play around with mod_rewrite. So in the end, the XHTML experiment may have to be called to a close.

Posted in Webmastering | Comments Off on Back to HTML 4

The most clever social engineering I've seen so far.

On Saturday, around 2 in the morning, I received a blind carbon at one of my work addresses that had a frighteningly clever phishing scheme posing as a Red Hat security update. I thought it was real and the only reason I didn’t apply this rootkit to the Linux box I have is because it’s Knoppix and it’s off–although I do have a really old laptop with Red Hat 7.2 on it.

My laziness saved me long enough for my paranoia to set in:

  1. After a bit, I realized that I never used the address in question to receive Red Hat technical updates. I did sign up for Red Hat technical updates years ago but that address has long since expired. How’d Red Hat get this one?
  2. The mail was blind carbon, not entirely suspicious in itself but, enough to prompt me to examine the mail more closely.
  3. I looked at the mail’s markup and headers and saw that they pointed to locations that didn’t make sense: ns1.ultracoms.net, www.wcml.co.uk and 217.8.3.5. Please note, the proceeding links are safe; they point to whois records, not the machine or machines where this spam came from. I have a suspicion these sites won’t be visible on the Net much longer.
  4. With my browser, firewall and proxy security set to maximum and from an IP number not related to my work address, I viewed these locations. If you’re curious, for the love of all that’s holy to you, please don’t use Internet Explorer to look at these locations!
  5. Then I started taking strings from the mail to put in a search engine. Sure enough, I got back lots of pages warning about a social engineering hoax that was nearly exactly like the one I got.

Phew! Dodged a bullet there! But clearly, the mail shows that the phishing scheme is mutating. The two pages I cite in point five are already of out of date.

This mail scared me. From now on, whenever someone laughs at my network paranoia, I’m going to point them to this page and say, “Never say never!”

Posted in Security and Privacy | Comments Off on The most clever social engineering I've seen so far.

Where are we headed?

As I go to vote later today, the arrogance of our foreign policy and the alienation of long time allies will figure large in my mind. A correction must be made. This is probably no surprise to my friends, since turning 18 in 1981, I’ve been a life long Democrat. But there are other reasons why I’m voting for Kerry. These reasons, I think, matter even more to global civilization then our lonely occupation of Iraq.

Over the last four or so years, I’ve seen a maturation in an ideological movement called transhumanism. It seems that its adherents and admirers have finally begun to realize that they have to depart from their fringe status and choose a side in the political structure of the United States if they are going to any say about future technological development. It seems to me that they’ve decided to settle down on the left side of the aisle.

I think they’ve noticed that it was Gore, who was one of the earliest advocates of nanotechnology in DC, not Gingrich, who didn’t jump on until five or so years later. They certainly seem to be aware that it was Bush II who appointed Kass and Fukuyama to an unelected committee of scholars who managed to slow biotech research in this country for 4 years. I think they’ve noticed that it was Kerry, not Bush, who made stem cell research a campaign issue. I think it’s becoming clear that the left, at least the moderate left, is beginning to embrace science and technology again. I think the tired and simplistic arguments of the libertarians and miniarchists from transhumanism’s early days are wearing thin.

I’ve always been hesitant to call myself transhuman or extropian but this new found political maturity is refreshing to me. I don’t know if what I am talking about here makes any sense but I’ve always been a big picture person and this transhumanism thing will figure very large eventually.

Posted in The Future | Comments Off on Where are we headed?

Sometimes you just gotta let your freak flag fly!

Despite years of completely justified ridicule, people still watch television.

Adults, with kids, taxes and jobs still act like complete idiots at football games. People still play golf–that’s one I’ve never understood. People still make beadwork. People still dance badly in clubs. People still attend live theater. People still dress themselves to the nines for events and situations that don’t warrant such efforts. Kids still think wearing black and studs is cool. Old farts, who should know better, still attend Pink Floyd concerts. And people still play D and D.

A hat tip to the Lord of all Grognards!

Posted in Games | 2 Comments

Why I am a standards fanatic

Professor Dragovich wrote to me:

“I don’t think web sites have to be ADA compliant. Do publishers have to publish books that are ADA compliant? Digital versus analog information. Why one and not the other.”

Actually all major book publishers now have to comply with several laws, both national and international, concerning accessibility, including the ADA–namely large print editions, Braille transcription and audio cassettes of books must be available. This is often handled by third party companies and organizations.

But that’s beside the point.

Just because a law is vague on one or two points doesn’t mean that legal precedence doesn’t apply. If we were strictly literal about the Constitution, all our current government would be illegal and invalid. If we interpret the Bill of Rights narrowly, we don’t have any right to privacy or a whole range of other rights that we now take for granted. Is that literalism what we really want? Maybe some would say yes, but I am glad I don’t live in country founded on those principles.

Private or personal websites, like private housing, don’t have to comply with the ADA or Section 508 or similar rules in FCC code. I haven’t really argued that private sites should, or if I have, I have only argued that it’s the right thing to do and that it’s easy to do, not that it should a be a legal requirement.

Commercial sites, on the other hand, are essentially places of business, just like brick and mortar places of business. Governmental sites are just like government offices; people go there to conduct their taxes, licensing, notarization and so on. The ADA applies to places of business and government offices in hardspace (On these points the law is generally clear even though there still some sticks in the mud that argue about it.) so, by the same reasoning, they should apply to places of business on the Internet.

It is true that the ADA was written before the rise of the Web but it does mention and apply to telecommunications technology. There are several sections in the law where the exact technology is intentionally vague. I think they did this for a reason: They tried to anticipate new technologies that might arise and tried to make the law as broad as possible.

This is basically the argument made by lawyers who currently claim that the ADA and other similar laws do apply to the Web and most software in general.

So now we are faced with a choice:

  1. Do we rely on legal precedence and just slowly extend and evolve current law by court ruling?
  2. Or do we go through the expensive process of forcing city, state, federal and international legislatures and bodies to create brand new laws that essentially say, “Oh yeah, we meant the Internet too,” when that much should be obvious already?

Seems to me that the first option is cheaper and more flexible but, in truth, legislatures, courts and deliberative bodies are now doing both.

The Internet and the Web have the potential to be the great enablers for people with disabilities. True, the retrofitting of existing sites and web applications is expensive. Retraining webmasters to do things right in the first place is expensive. But to design web applications from scratch to be accessible is easy, cheap and has many other benefits totally unrelated to accessibility so why not make them accessible now instead of being forced to?

Professor Dragovich continued in his letter about the metric system:

“In your rant about metric, you say engineers are the worst violators. BS, man, the problem lies in the manufacturing sector, where the cost of re-tooling and re-labeling is prohibitive. Engineers routinely work in both systems.”

Well, yes, that’s probably true. Most belabored engineers, such as yourself, are just trying to make things work in a perverse system. They realize that converting back and forth is a necessary horror for the time being. Actually I wrote that rant, which is partially tongue in cheek, as a response to an dispute you and I had one day many years ago about metric. As I recall, you said the same thing then too.

Of course it’s expensive. But at what point does the expense of total conversion ever become smaller than the expense of the status quo, never?

The main thing I object to is fact that we have to have two systems. This just increases the chance of error. It was precisely this that destroyed that Mars probe I cited back in the Nineties. Being forced to convert back and forth is a needless complication. As an engineer, you well know that it’s best, if possible, to sweep away any needless complications.

Either we should never convert to metric at all and ban all metric from this country for the sake of expediency. Or we should just stop dragging our heels, stop wasting money of the status quo and drop the traditional system entirely. Having two just wastes money and time.

But I agree that the US is never really going to go whole hog into conversion until its leadership in GDP is knocked aside by the EU, China and India.

Realistically, I know that converting web sites and applications to be accessible and that converting fully to metric and dropping all use the traditional system is only going to happen very slowly and it’s going to be expensive.

But I can dream, can’t I?

Heck, maybe I should take up the use of Dvorak keyboards just to really be perverse!

Posted in Webmastering | Comments Off on Why I am a standards fanatic

A big setback for accessibility in the US

I just read that an appeals court has ruled that the ADA does not apply to websites. This is amazingly stupid and the judges who made this decision should turn in their robes. The whole point of the ADA and Section 508 was to be an anticipatory set of laws to apply broadly in an wide range of unexpected circumstances. The Web was just an idea in 1991 but I am certaint that the authors of the ADA would have vehemently asserted that the law does apply to the Internet and the Web. I, being a webmaster who specializes in accessible and standards-compliant design, will continue to build accessible sites.

Posted in Webmastering | Comments Off on A big setback for accessibility in the US

Making the switch to Firefox

As a webmaster, I’d been using Mozilla since version 0.7 and Opera since version 3 to design and test with. I’d build for Mozilla first and then tweak things so they worked in Internet Explorer vesion 5, which at the time most people had. This has been my pattern until the present day: design in the browsers with better CSS support first, then tweak to adjust for IE5+. All during this time I was still using IE6, and earlier, as my main working browser.

I had tuned my systems and a lot of my tools to work with it as the default browser. I was able to escape all of the popups, page highjacking, spyware and trojans because I generally know what I am doing and knew not to trust Microsoft’s default settings in IE. I would always browse with scripting and Active X support turned off. I put IE6 behind Privoxy to block ads, spoof my headers and generally micromanage the hell out of my HTTP stream. This kept me safe for the last four years and longer.

But yesterday, I finally bit the bullet and set Firefox as my default browser. Not because I was worried about IE’s wanton libertine of a security model, I already had that in hand, but because I finally decided to tune my tools and such to work with it. I had been using it so much in my daily work that I figured that I should finally go all the way. I’ve heard that Microsoft is beginning to get worried about loosing browser share and they may reverse their decisions made about Longhorn and IE7. At least they are more open to developer feedback now, so I am hopeful.

But until the Lazy M Ranch gets off its collective rear, I’m staying in a modern browser. I will of course still continue to design my CSS conservatively to support IE5+ for my client’s sites but here, at FI, I think I am finally going to try some, really advanced CSS-fu.

Posted in Webmastering | Comments Off on Making the switch to Firefox

YAWDR: Yet another Web design roundup

  • Over at Digital Web Magazine, there is an article about merging CSS with content managment applications. The article is short on technical detail but does describe various different interfaces and goals to be reached.
  • Opera, Mozilla and Firefox (And for all I know Konqueror and Safari can too.) can all zoom web content better than Internet Explorer can. Juicy Studio shows us some JavaScript that gives IE a decent zoom function that’s keyboard accessible.
  • Juicy also discusses the advantages and disadvantages of methods for hiding the label element from browser display.
  • The Man in Blue shows us how to use JavaScript and CSS to make fluid layouts work better for differing screen resolutions. Boy damn! I need that!
  • David Shea shows us how to make the min-height attribute behave better in browser with buggy CSS support.
  • With one of the better uses of Flash I’ve seen, Doug Livingstone, shows us how the CSS box model works.
  • This one is not about technique, design goals or accessibility, it’s about two interesting gadgets called Furl and Spurl.
  • And of course the WaSP has got 1, 2, 3, 4, 5 and 6 useful tricks to show us for making standards-compliant designs work in older browsers
Posted in Webmastering | Comments Off on YAWDR: Yet another Web design roundup