May 29, 2011

Apple’s malware challenge: Usability as its security world changes

Apple’s security reality is changing right before our eyes and the company’s response will be telling. The toughest challenge will be shutting down hackers while keeping its trademark usability in tact.

Steve Jobs & Co. is known for creating devices that can spur gadget lust with just a mere rumor. Apple customers for years have taken the view—inspired by the company’s commercials—that its software is safer. If you have a Mac there’s no need for anti-virus software. You’re secure.

The reality is Apple enjoyed security by obscurity. Its market share wasn’t worth the attention from hackers. Now Apple is worth the attention. Where’s the glory in taking out a smaller computing player when you can take out the big dog—Microsoft?

As a result of Apple’s lack of hacker interest, the company could talk about being more secure even as it tended to rewrite QuickTime and plug security holes every time it launched a new product or generated buzz. While you were playing with your latest greatest Apple software release the company would patch vulnerabilities.

Here’s Apple’s chain of events over the last month:

  • Mac Defender malware attacks Apple users.
  • Apple remains mostly silent and tries to thread the customer service needle.
  • Apple then announces a fix and that a future update will put Mac Defender to bed with an update.
  • Evil doers launch a new renamed version just a few hours later. The new malware is renamed (predictable) and split into two parts, a downloader that delivers a payload similar to Mac Defender (not so predictable).

Does any of this sound familiar? It should. Microsoft went through this same learning process with its security procedures. Microsoft had to button down its security operations and today is able to fend off a lot of attacks.

Ed Bott nailed the importance of these malware attacks against Apple when he said:

Apple appears to be treating this outbreak as if it were a single incident that won’t be repeated. They seriously underestimate the bad guys, who are not idiots. Peter James, an Intego spokeperson, told me his company’s analysts were “impressed by the quality of the original version.” The quick response to Apple’s move suggests they are capable of churning out new releases at Internet speeds, adapting their software and their tactics as their target—Apple—tries to put up new roadblocks.

If Apple plans to play Whack-a-Mole with these guys, they’re in for months of misery. Just ask any Windows security expert who was around in 2003 and 2004 when Microsoft was learning a similar painful lesson. If each reaction from Apple takes two or three weeks, the bad guys will make a small fortune and Mac users can count on significant pain and anguish.

Microsoft eventually got security religion, but there was a cost—usability. Vista’s most hated feature was UAC (user account control). Bott later noted that UAC was enough to drive any level-headed person to PC rage.

In a nutshell, Microsoft added a key security feature—and drove its users nuts. Apple naturally capitalized on Microsoft’s UAC flub.

 

This usability vs. security line is one Microsoft has been walking for years. If you use all three of the top Web browsers regularly—IE 9, Google Chrome and Mozilla’s Firefox—you notice pretty quickly that IE 9 has more prompts and security features that can be annoying. I don’t doubt that IE 9 is the most secure browser around, but there are times I feel like I’m taking medicine that has a nasty taste to it.

It’s not like Apple hasn’t paid any attention to security. The biggest issue is that Apple seems to be underestimating what it is up against. Apple is just supposed to work. Security sometimes requires some inconvenience to users. If you build security in from the ground up, usability can suffer.

Apple’s trade-off will between security and UI will be its biggest challenge in the years ahead. If I were to guess, Apple’s Mac malware issues are just the warm-up act for bigger things.

  • Why not target Apple’s iOS, which is a dominant mobile OS?
  • Why not target iTunes and all of those credit card accounts on file?
  • Why not go for the glory of bringing Apple down?

In other words, Apple may have to spend some time talking security frameworks. That’s quite a sea change. If Apple can integrate hardware, software and more security into a package where the consumer doesn’t notice then it will have pulled off a great feat.

Final thought: One natural reaction to talking Apple security is to bring up Google’s Android. Android will be just as big of a hacker target and Google will have to respond to the same challenges as Apple. Ironically, Microsoft’s Windows Phone 7 will have a free pass for a while. Why? Security by obscurity. Microsoft in mobile just isn’t big enough to matter.

Related:

Permalink • Print • Comment

Microsoft Skype breaks open-source partnership

I told you so. I knew that Steve Ballmer could talk all he wanted about how Microsoft would continue to support non-Microsoft platforms, but that there was no way he’d actually do it. The first proof is here. Digium, the company behind the popular open-source Asterisk private-branch exchange (PBX) program, has announced that Skype has unilaterally ended its deal that allowed Asterisk to work with Skype.

Digium’s letter to its Asterisk users reads:

Skype for Asterisk will not be available for sale or activation after July 26, 2011.

Skype for Asterisk was developed by Digium in cooperation with Skype. It includes proprietary software from Skype that allows Asterisk to join the Skype network as a native client. Skype has decided not to renew the agreement that permits us to package this proprietary software. Therefore Skype for Asterisk sales and activations will cease on July 26, 2011.

This change should not affect any existing users of Skype for Asterisk. Representatives of Skype have assured us that they will continue to support and maintain the Skype for Asterisk software for a period of two years thereafter, as specified in the agreement with Digium. We expect that users of Skype for Asterisk will be able to continue using their Asterisk systems on the Skype network until at least July 26, 2013. Skype may extend this at their discretion.

Skype for Asterisk remains for sale and activation until July 26, 2011. Please complete any purchases and activations before that date.

It doesn’t require a genius to see what the Microsoft and Skype are doing. This summer Microsoft will be launching the Microsoft-hosted version of its Lync unified-communications server, aka Lync Online. Asterisk is a direct competitor to the entire Lync line. Need I say more?

While Microsoft still hasn’t explained how they’re going to integrate Skype’s rickety peer-to-peer (P2P) infrastructure with its server-based Lync server or its cloud-based Lync Online, it’s on their to-do list. What isn’t on MicroSkype’s to do list is supporting non-Microsoft owned and controlled platforms.

Skype’s Response:

Jennifer Caukin, a spokeswoman for Skype, has a different slant. Caukin said, “Skype made the decision to retire Skype for Asterisk several months ago, as we have prioritized our focus around implementing the IETF SIP [Session Initiation Protocol] standard in our Skype Connect solution. SIP enjoys the broadest support of any of the available signaling alternatives by business communications equipment vendors, including Digium.  By supporting SIP in favor of alternatives, we maximize our resources and continue to reinforce our commitment to delivering Skype on key platforms where we can meet the broadest customer demand.”

Related Stories:

Microsoft’s Lync Online: What’s coming when

How Microsoft, Skype, Nokia can rule: Cut out obscene data roaming rates abroad

Beyond Skype: VoIP Alternatives

How Skype does, and doesn’t, work

Microsoft’s Ballmer $7.7-Billion Skype Blunder

Permalink • Print • Comment

Your email address says more about you than you think

It sounds simple enough, but I do worry that many of my generation don’t quite see things from a prospective employer’s perspective. I can, in all honesty, because to me an email address guarantees somebody’s relationship with a company, and can be used to prove an identity on behalf of an organisation.

Email has not gone out of fashion with the younger generation. Devices such as the iPhone and the BlackBerry have brought email directly into the hands of already-digitised young adults. Social networking increases, but email has remained steady and will increase exponentially throughout their university timeline – and onto their careerpath.

It’s the first thing they see

But more often than not, when you apply for a job, your name won’t stick out but your email address will. It’s the first public information they will see and first impressions count more than most would lead you to believe.

Email addresses can be used like social statuses. To have a *.gov.* email address signifies political importance, whereas certain *.edu addresses can automatically show academic credit. The domain you use shows who you are and what you do. If you’ve worked hard to get to the position where you have such an email address, then use it to your advantage.

Your email can pre-determine the outcome

There is no doubt you would have experienced the, “oh, you only go to Yale? Yah, darling, I go to Harvard Law” (and it by no means just applies to the products you use or buy). My university is a world leader in criminology and my degree will be far more in credit than its counterpart degree from Oxford, but Oxford has an international name for itself and trumps pretty much every other university in our meager little country.

Email addresses are the same. My *@kent.ac.uk email address may not compare to one of *@harvard.edu but it will. Harvard will take precedent over Kent, UCL or even NYU and Yale. It’s not to say everyone will act in the same way towards a person’s academic institution; but the one point of information will increase your chances.

It’s a university email address. That automatically shows a level of education that so many still don’t achieve. Any email address associated with a university or academic institution by *.ac.* or *.edu makes you look good from the word go. It can tell a lot about you without having to say a word.

But if you graduate from a lesser-to-a-higher institution such as NYU to post-graduate study at Harvard, use the Harvard email address when sending your resume. It looks better from the start, but don’t miss anything off your resume. The person about to employ you might have graduated at NYU themselves, for example.

Personal email accounts just look trashy

But they do!? The Oatmeal has a hilarious yet true insight into how email addresses translate your computer literacy. I agree in that Gmail accounts do look best from a personal perspective, and Hotmail does look a little bit “I still go on MySpace”, but as I’ve said before, if you wish to overcome the *@hotmail.com stigma but still use the service – get a *@live.com or *@live.co.* address which can also signify your citizenship status (ie. *@live.co.ca for Canada).

Seeing as your email address can identify who you are and who you work for, or rather which organisation or institution you are associated with, those with their own-domain could be at an advantage if you are trying to make an impression.

But your own discretion is important. Identify who you want to work for, the type of people you are applying to, and which account you should use. It does make a difference, and it takes an element of common sense and third-person perspective to determine which email address to use.

And one last thought; if you are using your work email address to pursue other employment opportunities, make sure your current employer cannot read your email. It’s happened, and people can end up losing out altogether.

Permalink • Print • Comment

Email is far from dead; ‘no viable replacement’ in sight

New statistics shed light on the vast importance Google, Microsoft and Yahoo! place on their web-based email services.

Though email is effectively a prehistoric web service, dating back to the launch of the Internet, it maintains its dominance as the most effective communications method we have still today.

Email isn’t dead, nor is it ‘on its way out’.

Regardless of the ‘Facebook effect’ and other growing social networks and instant messaging services have on the younger Generation Y, there is no viable replacement in sight.

The figures show that just over 23% of Google visitors visit Gmail, with nearly 40% of Windows Live users going straight to Hotmail, and just under 20% of Yahoo! visitors going to Yahoo! Mail.

Though Google, Microsoft and Yahoo! each has fewer users on their email services than Facebook has, email provides not just a communications platform, but an identity for other social web services. Facebook heavily relies on email to function and perform.

This may not surprise many, as email is the cornerstone of the services provided by these companies, with often only search coming first.

Email is still evolving and is a fluid and dynamic platform. And while spam may be annoying, web services have spent years blotting out the issue, with spam levels dropping significantly in the previous two quarters.

Instant messaging and social networking only offers a strain of what email can provide. Though it may be the primary choice for younger people to engage in with their social lives, in business and the workplace email will still reign as the dominant choice for industry.

Although the Generation Y may find email to be ‘unfashionable’ and ‘outdated’ compared to Facebook and instant messaging applications on their smartphones, the very vast majority of smartphone users will have an email account attached to their phone regardless.

While Google, Microsoft and Yahoo! have no interest in losing their hundreds of millions of users overnight, their email service will continue — and continue to grow, as more take advantage of the now standard features beyond the realms of simply sending and receiving messages.

Related content:

Permalink • Print • Comment

Fedora 15’s five best features

Fedora Linux not for everyone. If you’re an experienced Linux user who wants an easy-to-use desktop Linux, I recommend Mint 11. If you’re new to Linux and just want something that’s easy to pick up and use, I think you should give Ubuntu 11.04 a try. But, if you’re a Linux expert, and want to explore the outer limits of what’s possible with Linux, then Red Hat’s new Fedora 15 Linux is the distribution for you.

Why? Well, here are my five favorite reasons to use Fedora 15. I’m going to start though with one reason I don’t care for this release of Fedora. Let’s call this one: Feature 0.

0) The GNOME 3 desktop environment

GNOME 3 claims to be the “the next generation of GNOME with a brand new user interface. It provides a completely new and modern desktop that has been designed for today’s users and technologies.” It’s not.

First, did we really need a “completely new desktop?” I don’t think so. I quite liked GNOME the 2.x series. It worked well for me and I didn’t need to learn anything new to use it. I get the point of Ubuntu’s Unity, which is a radically different shell that rides on top of GNOME. Unity is meant for Windows and Mac users who’ve never used Linux It’s also clearly designed to eventually become a tablet interface. When I look at GNOME though what I see is change just for the sake of change not change for greater end-user usability.

The idea of GNOME 3 was to get rid of clutter OK, I can see that, but in doing it GNOME’s designers had made GNOME less usable For example, in shifting from one project to another in your workspace you need to use the dashboard as a window management interface For me, this is like having to stop my car to shift gears That by itself is so annoying that I quickly stopped using GNOME 3.0.

I also found miss each windows’ minimize and maximize buttons. You can still minimize and maximize application windows, but what used to be an automatic action now wastes time. Finally, GNOME makes it very hard indeed to tweak your desktop. There’s no easy way to even set up a screen saver! I mean seriously, I have to do something like:

gsettings set org.gnome.desktop.interface gtk-theme 'Clearlooks‘

from a shell just to change my desktop theme?

 

GNOME 3 Failure: I saw this message far too many times.

 

It also doesn’t help any that GNOME 3 won’t run on basic graphics hardware. You need just the right mix of graphics and graphic drivers to get it to work. On my systems, I was only able to get one to work by using the Radeon driver for an older ATI graphics card.

In short, GNOME 3.0 is new but for users it’s a step backward. Fedora 15 is the first major distribution to include GNOME 3 by default. That was a mistake. Like Fedora 4 in its first not ready for prime time versions, GNOME 3 is not what most users want from a desktop. As for me, I’m sticking with GNOME 2.32, with occasional visits to KDE 4.6.

Now that I’ve got that out of my system, here’s what I like about Fedora 15.

5 Good Things about Fedora 15

1) Better power management

Desktop Linux has never done a great job of laptop battery management. Fortunately, Linux doesn’t drink up that much power so it usually ends up with decent battery life anyway. But, Fedora 15 redesigned power management utilities give it better battery life than other Linuxes.

I checked this by running Intec Battery Mark 1.1 on Windows XP in a VirtualBox virtual machine on my Lenovo ThinkPad R61 with its 2.2GHz Intel Core 2 Duo processor T7500 and 2GBs of RAM. With Mint 11, my six-cell battery lasted an hour and fifty-seven minutes. That’s pretty darn good for a three-year old battery.

With Fedora 15, though, it made it to 2 hours and ten minutes, which is pretty darn close to what it used to do when it was brand new. Anything that gives me 10% better battery life is a major win in my book.

2) Better End-User Software

Like most up-to-the-minute Linux distributions, Fedora uses LibreOffice in place of OpenOffice, as its office suite. LibreOffice, while an OpenOffice fork is better thought of as an improved version of OpenOffice. It looks the same, works the same, but it’s also faster, has many minor bug fixes and has far better Microsoft Office file format compatibility. Last, but not least, since Oracle will no longer be putting any resources into OpenOffice, LibreOffice is the most significant open-source office suite yet that’s still being actively developed.

Firefox 4 in Fedora 15 worked just fine.

Firefox 4 in Fedora 15 worked just fine.

In addition, Fedora includes Firefox 4, which is certainly better than the older Firefox 3.x series. On the other hand, I would have been happier if it had used Chrome 11. But, no worries, this is Linux. Installing Chrome and making it my default browser took me less time to do than it did to write this paragraph.

3) Dynamic Firewall

OK, this is a beta feature so you have to manually install it and only network administrators are likely to find it that exciting, but I–who sometimes still wears his network administrator hat–think that it has great potential.

Like its name suggest dynamic firewall enables you to change firewall settings without needing to restart the firewall. So, for example, you can set the firewall to change its rules, as needed for virtual machines or Virtual Private Networks (VPN).

You can also use it to open up the firewall for a specific network request, such as discovering a local printer or a Windows server, and then closing down the port once you’re done with that procedure. This has got real possibilities and I like it already. If all goes well, it will become the default firewall in Fedora 16 and eventually in Red Hat Enterprise Linux (RHEL)

4) Virtual Desktop Support

Slowly, but surely, Simple Protocol for Independent Computing Environments (SPICE)virtual desktops are coming to Red Hat. In Fedora 15, SPICE has been integrated into the virtualization manager, virt-manager.

Since Red Hat future desktops plans center on virtual desktops, presumably running on Kernel Virtual Machine (KVM), I find this very interesting. I also found that you can finally set up speedy SPICE virtual desktops without tweaking configuration files by hand.

5) RPM 4.9.0 Package Manager

RPM 4.9.0, Fedora and RHEL’s software manager has been given a real tune-up. It’s now easier than ever to install software on Fedora .For more on that see the RPM 4.9.0 release notes. The bottom line is that RPM does a much better job of handling any RPM package that you try to install on your system.

There are many other neat features as well such as security improvements in handling common Security Enhanced Linux (SELinux) problems with an easy to use GUI and improved encrypted home directory support. And then there’s the BoxGringer image and virtual machine (VM) creator, and, at long, long last, a built-in consistent and sane network device naming system.

Now if they would only do something with GNOME 3! Or, better still, the GNOME 3 designers brought back some of its more end-user friendly bits and bites I’d be perfectly happy with Fedora.

Related Stories:

Put on your new Red Hat Linux

Red Hat-IBM pact, OVA launch will drive more KVM use in enterprise

Red Hat’s Future Linux Desktop

Big Blue plus Red Hat plus Private Cloud equals Purple Reign?

Red Hat, Eucalyptus, Rackspace leading open source IaaS charge

Permalink • Print • Comment
« Previous PageNext Page »
Made with WordPress and a healthy dose of Semiologic • Sky Gold skin by Denis de Bernardy