February 2008 - Posts

• More Web Insecurity

  Today I logged on to a government web site to fill out some forms. I was expecting this and was happy to see a post card with my customer id and a reminder to go to the web site. I was horrified when I was asked for the customer id or my social security number and my birth date to authenticate me. My social security number is not something that I give out but I am relatively free with my birth date as it seems to be pretty harmless to give out. Of course anyone could read the postcard and have that information. The page that displayed after I authenticated had my social security number, birth date, address, phone numbers including cell phone, and height, weight, hair and eye color. It seems this would be very useful to someone engaging in identity fraud. I guess I will have to figure out who is the correct person to report the problem to and hope they fix it before I have to fill out the forms next year. Posted Feb 29 2008, 10:30 PM by Scott Golightly's Blog Filed under: CardSpace

• Microsoft's EU Fine - What's Up with That?

  So last week Microsoft announced that they were going to publish APIs for their major products along with expanding the interoperability lab and not suing open source developers for using their technology as long as it isn't commercial use. I thought it was a good move and will help the ecosystem around Microsofts platform. Today the EU fined Microsoft $1.3 Billion for charging competitors too much. Microsoft has said the fine is for past offences since they were told in October that they are in compliance. I can understand that Microsoft needs to pay for past sins. My big question is who gets the money? I wonder how much of it is going to the companies hurt by the over charging and how much is going to the lawyers and government coffers. Posted Feb 27 2008, 10:46 PM by Scott Golightly's Blog Filed under: Technology

• UCNUG Meeting Tonight

  Tonight will be the Utah County .NET User Group Meeting. Sean Hokanson will be speaking about log4net. You can get more information at http://www.ucnug.org. Posted Feb 20 2008, 08:14 AM by Scott Golightly's Blog Filed under: Events

• Privacy and Security are Definitely Different but Can't I have Both?

  I just had to share this snippet from an e-mail I got. I am not quite sure how they think that my privacy is assured when they are sending my user name and password in an unencrypted e-mail and anyone who can get it can then log in as me and see everything in my profile. I was especially surprised as the company that sent this is a "reputable survey company" and I signed up with them because they were running a survey for Microsoft and I felt that I had an opinion that should be heard. I am considering opting out of their service since they don't seem to know the implications of their e-mail. Once again we see a case where username/password for login is not a good idea. On the plus side since I am using a program to store my password the one they sent out is unique to their site so I don't have to worry about someone getting into another account with the information. I am hoping for the day when I can start using my information card to log in to web sites like these so they won't feel the need to send me my user name and password. Posted Feb 14 2008, 09:44 AM by Scott Golightly's Blog Filed under: CardSpace

• Windows Server 2008 and Vista SP1 RTM

  OK, so the press releases went out yesterday about the RTM of Windows Server 2008 and Vista SP1. According to the schedule I saw I should be able to start downloading it from MSDN subscriber downloads. If you don't have an MSDN subscription then you have to wait until later (up to 6 weeks) to get the service pack. How long depends on whether you are a volume license customer, download it from Microsoft, or wait for it to show up as an update from Windows Update. Of course retail availability will take a while as it still takes time to print boxes and press DVDs. Here is the schedule that I have seen 2.4.08 Win2008 available to OEMs, MSDN, & TechNet SP1 available to OEM & Retail channels 3.1.08 Win2008 Volume Licensing availability SP1 Volume Licensing availability 3.18.08 SP1 available on Windows Update, Download Center, MSDN & TechNet 3.19.08 Win2008 Retail availability 4.18.08 SP1 pushed via automatic download I expected a big outcry over the delay between the RTM and when it will be an automatic download. I haven't been seeing that in the press releases. I have mixed feelings about this. On one hand I would like to see everyone have the latest patches as soon as they are available. On the other hand I can see large organizations wanting to have time to test the changes and make sure they are right for them. I remember the special tool to block IE from automatic downloads for people who didn't want it. I guess this is the best of both worlds in that it gives you the option to download it as soon as you can while also giving large organizations the ability to test. Also, another more technical and better reason for the delay in Vista SP1 is that some drivers that were not developed following Microsoft's guidelines might cause issues. I haven't seen what those issues are and by all accounts they don't stop the installation but by having the download available for the more technical type audiences with an IT department first it might pressure the writers of those drivers to update the drivers and get them out to the general public before they start seeing whatever issues there might be. Posted Feb 05 2008, 04:52 PM by Scott Golightly's Blog Filed under: Vista