Wampum

Sunday Technotrivia

In comments Friday, Steve Plonk wrote that Wampum was offline for [the bellsouth] area. The only network event of any note this week was the Comcast outage.

Comcast said the intermittent but often-severe nighttime outages . which also occurred April 7, Tuesday and Wednesday across the country and in the St. Paul area . are related to software malfunctions on company computers responsible for receiving, interpreting and routing subscribers' Web-site requests. E-mail also was affected in some cases.

A company spokeswoman wouldn't elaborate on the nature of the software problems, identifying them only as a "memory leak." But she said steps meant to end them roughly coincided with Thursday's erratic outage, which may have been less severe than the earlier ones, and added the fixes will likely avert future service blackouts of this kind.

By coincidence, BigPond/Telstra, a provider in Oz, found that it only took 6 compromised customer machines to make a difference:

Disconnecting six compromised personal computers on Tuesday evening eased the difficulties caused by bogus requests which clogged BigPond's domain name servers (DNS), slowing customer e-mail and Web site access, Telstra said.

We never heard back from John Dowdell's colleges, so as far as we can tell, cookies in Flash are here to stay. Those who Flash, Share, by design. Update: Adobe is now the data collector using the .so mechanism.

From the "National Cyber Security Alliance", who wouldn't dream of suggesting that using Microsoft Operating System Product (any) and a bottom-feeder ISP (any, but cable companies come to mind quickly, followed by the $9.95/mo crowd of modem port resellers, followed by any TelCo offering xDSL at Cable pricing) is problematic ab initio, some data:

blank	Dialup Users	Broadband Users
Anitivirus	84%	86%
Firewall	7%	51%
Parental	16%	4%
VIRUS	25%	15%
SPY/AD	88%	74%

Source: http://www.staysafeonline.info/news/safety_study_v04.pdf

Reading this like a poll, this suggests that every connected Microsoft/Intel machine that isn't generating royalties to at least one A/V vendor is hosting virii, and a third of the dial-up connected M/Imachines that are generating royalties to at least one A/V vendor host virii, possibly because virii propagation is synchronous with use, and A/V update is not. There is a joke in the operator community about installing Microsoft Service Packs (containing A/V updates). Can a machine actually complete an update on a fast, but undefended link without being infected? The humor is knowing that the answer is "no".

The other major item of enlightenment (no, I don't care that dialup has a 400% greater penetration by NannyWare marketers, I even consulted for one for pin money over the winter break) is that firewalls have no effect on the installed base of machines that host spyware/adware, and that any question that when asked of random sample of link-technology-independent Microsoft/Intel users, so any WiFi hotspot will do, that generates a "correct answer" fewer than one time in four -- say "Did you vote in the November 2004 election, and did you vote in a Democratic primary or caucus, and did you vote for John Edwards" -- is as likely to be true as the machine the survey subject is using is to be unpopulated by spyware and adware.

Wampum was visited by 103 different machines in the space of about 200 midnight minutes, which contributed 127 comments, no more than five in any writable comment URL, mostly about health products and social play service providers. The ad-insert operator's address inventory does not have clusters, when viewed from an Autonomous System (AS) perspective. UUNet is just one AS. Off hand, any address-based filtering scheme would have presented no cost to this insertion campaign. I think what is needed for "flash" events is the ability to undo the database transactions for some temporally characterized class of transactions.

Posted by EBW at April 17, 2005 10:10 AM | TrackBack