Dropbox authentication: insecure by design

Dropbox authentication: insecure by design

Derek Newton, on his Information Security Insights blog, has observed that copying a single file (config.db), not specific to a particular computer, out of Dropbox's application data folder (%APPDATA%\Dropbox)*, allows anyone with that file to install and sync with the Dropbox account linked to that particular installation of the local client software. What's the big deal? This means that all of the files stored in that Dropbox are accessible** to anyone who has a copy of that particular config.db, even if the password for the Dropbox account is changed. Please give the original post a read for his three recommendations to deal with this vulnerability.

*His example is from a machine running Windows.

** For viewing, copying, changing or infecting with malware.

I want: HP ProLiant MicroServer

HP ProLiant MicroServer series overview - HP Small & Medium Business

These are quite affordable (<$400), fairly expandable and capable of RAID 0 or 1.

I think I'm going to get one and put ESXi on it.

Unidentified Network issue with VMWare’s virtual NICs in Vista | a Single Point of Contact

I ran into the problem of the virtual network adapters used by VMWare virtual machines remaining unidentified after I reinstalled VMWare Workstation (version 6.5.4) on my freshly installed Windows 7 build (I figured that it was time for an upgrade from XP).

I found the fix at Matt Wade's blog, a Single Point of Contact:

Unidentified Network issue with VMWare’s virtual NICs in Vista | a Single Point of Contact

B-17 at the Santa Barbara Airport (edited)

This is the B-17 "Aluminum Overcast", at the Santa Barbara Airport on 4/25/2010. I posted these pictures earlier, but decided to consolidate them all to a single post. Click on the pictures to see them full size.

Above: Cockpit from the port side.

Above: Technical specifications and crew positions.

Above: Exterior seen from starboard side.

Above: Exterior seen from port side (closer).

Above: Bow exterior.

Above: Engine closeup.

Above: Ball turret closeup. Note the Nazi swastika on the right side of the turret. That means a Luftwaffe pilot had a VERY bad day.

Above: Cockpit interior. Hard to see in this picture, but some of the modern equipment present includes GPS and satellite radio. The satellite radio is used to provide consistent weather reports.

Above: Interior bomb bay.

PowerShell

I recently concluded a class on using Microsoft's PowerShell, which is a more sophisticated scripting shell than the basic Windows command line interface (cmd.exe). All in all, I was impressed by it. It's still not as integral to Windows as bash (or other flavor of shell) is to UNIX/Linux, but it's a step closer.

Microsoft's advantage over open-source

Now, I realize that open-source software has many advantages. This posting is not about them. Go Google "open source advantage" to see the multitude of postings that cover that subject. No, this posting is about Microsoft's advantage over the open source development community. Horrors!

No, not horrors... what was the other word of which I was thinking?

Oh, yeah. Boredom.

Huh?

Here is the back story. I was recently revising my resume using OpenOffice Writer. All in all, Open Office is a pretty solid office suite, especially for the price (which is free, if you didn't know.) However, I encountered some problems* when saving to Rich Text Format (.RTF). Why did I choose .RTF? So that people can open the file with a minimum of hassle. This would be preferable to sending out my resume in OpenOffice Writer's default format (.ODS), which would basically require people to have OpenOffice installed** if they wanted to read it. Reading the resume, of course, being the goal of sending it out in the first place, instead of having the recipients do something such as ignore the file. Microsoft can't really say that it is ahead in this part of the game: just ask anyone who has tried to send a Word 2007 (.DOCX) file to someone using a plain vanilla version of Word 2003.

So, I encountered a problem with formatting in my document when I tried to save the document in a form that doesn't require me to provide free technical support to the people to whom I send the document. This problem is one known to the OpenOffice user community, and I would hope it is known to the developers within that community. (Sadly, my coding skills are as of yet insufficient to grab the raw source code and fix it myself.) Apparently, this issue (which perusal of the forums will reveal has been known about for at least a year) is too boring (not sufficiently interesting) to attract the unpaid programming efforts of the open source community to effect a fix.

And therein lies my realization of an advantage Microsoft (or any other company) has over the open source development community: money. You see, money is what you give people to do things that they otherwise not be inclined to do. Things that might make them bored. So, when a problem is sufficiently boring, the (largely unpaid) open source community might never get around to fixing it. A company like Microsoft, on the other hand, can decide that the problem needs to get fixed and pay someone to do the boring work. (Actually making that decision is a whole other mess, mind you.)

The moral of the story: a boring problem led to me paying Microsoft for a copy of Office 2007.

* Specifically, problems with bullets and indentation. More specifically, said bullets and indentation not always being present after the file was saved, closed, and reopened. This is a known issue and discussions can be found in the OpenOffice Community Forum. There are workarounds, but the issue has not yet been fixed in code.

** There are plug-ins for Microsoft Office that allow this, but you never want to assume that optional third-party components are installed.

Help for Haiti

I'm linking this from Direct Relief International. Please contribute if you are at all capable of doing so at this time. Direct Relief is a medical aid organization based in my home town of Santa Barbara. As mentioned on their home page, "A recent bequest has enabled Direct Relief to cover all fundraising and administrative expenses from its own funds. All contributions will be used for programmatic work."

In the long run, Haiti will also need to rebuild its highly-degraded ecology to become self-sufficient. I believe that permaculture is the best way to accomplish this goal. Permaculture Haiti is a portal (still under construction) for coordinating efforts and sharing ideas on how to restore Haiti. Please take a look at it and contribute if you can.