Communiqué
Insecurity
iMarc is a little unusual in its Mac-PC distribution. More than half of our design team use Windows, while more than half of our developer team use Macs. Overall, we are almost exactly split: eight Windows users, eight Mac users, and Will, who recently went Ubuntu.
Security is of general interest, but in particular, I think the Mac is becoming a more insecure platform ... not so much inherently, but because it's finally becoming interesting to organized internet crime.
BBC News has published an interesting article about the business of "cyber crime" Boom times for hi-tech criminals.
Let's start with a key excerpt from the BBC article:
"2007 was a fairly interesting year," said Joe Telafici, vice president of operations for McAfee's Avert Labs, "cyber crime continued to fuel most of the security attacks we saw."
It was a year, he said, which saw the effective extinction of young hackers who wrote viruses and other malicious programs for fun.
Now, he said, Windows malware was all about money.
Some attacks, such as phishing runs, were clearly about stealing cash from victims either from a credit card or bank account.
But, he said, many others that looked more innocuous were done with money in mind. For instance, he said, trojans placed in banner ads that try to hijack a home PC were all about getting hold of resources that can be rented out for a fee to spammers or other net-based criminals.
"There's a real eco-system built around this," he said.
Paul Henry, vice president of technology evangelism at Secure Computing said the tool of choice for many hi-tech criminals was the botnet - a collection of hijacked home PCs.
Ars Technica has just published a summary of Mac OS X market share, discussing both absolute numbers and trends.
As of November 2007, the Mac had reached 7.3% market share. Remember, we're coming from just 4% two years ago. That's nothing to sneeze at.
Now, let's tie these two articles together and do a little New Year's forecasting: as the Mac market share grows, Macs will begin to become relevant to the botnet market. There are enough out there to be interesting, and the POSIX-compliant BSD (Unix) layer provides some nice tools for crackers once they're in.
In fact, it's already happening. In October, a Mac-specific trojan horse masquerading as a video plug-in for Safari/Firefox was sighted in the wild and took over lots of Macs. Admittedly, we joked about it because it was pretending to give you access to free pornography, and it was pretty primitive in its effects, but as a proof of concept, it does its job nicely. The writing is on the wall.
Of course, marketshare alone isn't everything. Ten years ago, Linux distributions were the target of choice for early botnets. Linux was vastly outnumbered by Windows on the net, but Linux distributions were insecure by default and very easy to exploit. After a few years, all the major distributions got the message and new (and updated) Linux distros were secured by default. It worked -- crackers turned their attention to the next easiest system to exploit, Windows.
Back Oriface had its day, followed by worms such as Code Red and Nimda, which spread themselves with startling effectiveness. (Nimda is said to have become the most widespread worm ever in just 22 minutes.) In January 2007, Storm Worm appeared, and by September, it had created a botnet of ten million Windows PCs. Big business, indeed.
Well, the Mac is next. There are enough Macs on the net to be interesting; they make a nice platform for internet-connected processes and distributed computing; and Apple is slow to respond to security vulnerabilities, making it a ripe target for attacks in the period between discovery and patching.
I am frustrated, at times, by the constant stream of tiny Windows security updates from Microsoft, but the fact is, that stream of rapid patches helps keep modern versions of Windows secure. Apple's approach of occasional monolithic updates is easier for users, but leaves much longer gaps between the discovery of security vulnerabilities and their resolution. To date, Apple has been reasonably responsive in quickly patching actual exploits (which are of far more concern than vulnerabilities, which are usually theoretical), but I fear that Apple's model of slow response and no public acknowledgement of issues while they're working on them is going to leave the Mac platform vulnerable.
We've seen Apple improve its security response times over the past year, but there is still progress to be made. Ultimately, however, responsibility for good security lies in the hands of end users -- you and me. Keep your firewall up; install security updates; don't install software from unknown sources (especially if it promises you free pornography, folks!); don't open email attachments from strangers.
In the Windows world, you can -- contrary to popular belief -- stay virus and worm free without antivirus software (if you start with a clean install of Windows XP Service Pack 2 or later), but it requires diligence and care. I believe that Mac users must adopt a similar mindset. Mac OS 9 was virtually immune to attack because the core OS was so unfriendly to networking, while Mac OS X has been too insignificant to be of interest to professional cyber criminals. This has changed.
Mac OS X is now interesting to organized internet crime. We, as users, must adopt good security practices. Mac OS X provides a fairly secure base, but it's not perfect, and it's up to us to maintain our Macs' integrity.
Happy Fake Birthday To Me
As a former developer, I'm familiar with Unix time and the Unix Epoch.
Unix time is the number of seconds that have passed since the Unix Epoch. The Unix Epoch is midnight, January 1st, 1970.
I almost always use the Unix Epoch as my birthday when signing up for throw away accounts – web forums, social networking sites, and anything else that requires a birthday to register for.
Yesterday, Jan 1, I received about 20 Happy Birthday emails like this:
-------- Original Message --------
Subject: Happy Birthday from The Official San Diego Chargers Forum
Date: Tue, 1 Jan 2008 00:01:20 -0800
From: The Official San Diego Chargers Forum <chargersforums@xxx.xxx>
Hello PatsFan,
We at The Official San Diego Chargers Forum would like to wish you a happy birthday today!
Happy real birthday to Unix time and happy fake birthday to me.
RIP Netscape
AOL has announced that they're discontinuing the Netscape web browser as of Feb 1, 2008.
This marks the end of Netscape's thirteen-year history. It makes me a little sad ... Netscape started out as the radical innovator that expanded the web's capabilties by leaps and bounds, including LiveScript (hastily renamed JavaScript to catch a ride on Sun's bandwagon), about sevently zillion new tags including the infamous <blink> tag, and really pushing forward the design capabilities of web sites.
There's nothing like it today. The pace of web innovation is glacial, hampered by the W3C's inability to get out of its own way. The WhatWG, a forum created by Mozilla, Opera and Apple, has picked up the reins to some degree, but it's nothing like the radical innovation in the early years of the web. The browser wars pushed us forward, and I almost miss them. Perhaps this is the price of the web's maturation.
RIP Netscape. Thanks for the memories.
(If you really love Netscape, you can skin FireFox to look like the old Netscape.)
(image courtesy of The Unofficial Apple Weblog)
The Illusive Perfect Pump
How can it be that I’ve never had a perfect pump? Read More
iMarc Zeitgeist
Google just released their 2007 Zeitgeist, a list of search trends, patterns, and popular terms for the year.
Here are some trends, patterns, and popularity stats for iMarc's website during 2007.
Summary
Throughout 2007 iMarc.net averaged 2,507 visits per day and just over 11,630 pageviews per day. The average visitor viewed 4.6 pages per visit.
Though "hits" is an irrelevant and useless number, we managed to generate 18.3 million of them in 2007.
On May 7, 2007, we launched a new version of our website. It was a complete visual redesign and simplification of the site architecture. Before the redesign we averaged 2,074 visitors per day and 4.4 pageviews per visit. After the redesign our traffic jumped to 2,672 visits per day and 4.77 pages per visit. In terms of pure numbers a 28% increase in traffic qualifies as a successful redesign.
Search Terms (Referrals)
Most popular terms that people used on a search engine to find our site:
- imarc
- zombie photoshop
- make your own movie
- jessica alba hot
- old woman
- christian keyes
- unix web server
- web 2.0 tables
- pythagorean wins
- kim jackson
Searches
Popular terms that people used on our own search page to find specific content on our site:
- tutorial
- photoshop
- zombie
- alba
- redesign
- tsunami
- freebsd
- construction
- mitx
- poster
Popular Pages
The most popular page was actually our blog's RSS feed. In terms of real webpages, the most popular were:
- PS Quickie! Your Own Crazy Movie Poster
- AHHHHH! Oy! Alien Invasion! A Photoshop Tutorial
- Home Page
- Freakish Zombie in 11 Steps!
- Make Jessica Alba Hot in 11 Steps!
- Make me a dirty old woman! (in 11 steps)
- PS Quickie: Meteor Invasion!
- Portfolio
- 9 Expert CSS Ideas You Should Think Twice About Before Using
- Communique
Browsers
- Internet Explorer (36.73%)
- Firefox (31.19%)
- Opera (4.47%)
- Safari only accounted for 1.74%, coming in below such fantastic browsers as "msnbot", "unknown", and "AppleSyndication"
Operating Systems
- Windows (52.60%)
- Unknown (35%) – I'm guessing this is RSS readers grabbing the blog feed
- Macintosh (9.14%)
- Linux (2.27%)
Thanks.
The state of typography on the web: still awful.
Here's a pathological case of typography on the web:
Justified:
Justification without hyphenation is like taxation without representation.
(If you're reading this on the home page, it won't make sense until you click the Read More link. Sorry.)
Justification, as you can see, is just a disaster. Not only is there no hyphenation, there's no kerning or letterspacing or anything that would help the text look better.
The W3 Consortium's CSS3 draft includes some spacing rules in the draft spec, but as demonstrated in Glenn Fleishman's Hands on with Kindle article on that device's typographic deficiencies, word spacing alone isn't enough:
Without hyphenation, it's still pretty bad.
The W3 working group is attempting to address hyphenation in CSS 3, but it's still largely undefined and frankly my hopes aren't high unless the spec mandates a hyphenation dictionary for each supported language.
The best we can get today is to not use justification— respect the limits of the technology instead of fighting them. Frustrating, but sometimes that's what design choice is about.
Ragged:
Justification without hyphenation is like taxation without representation.
One Space
As a general typographic rule, only a single space is required between sentences.
Many people have been incorrectly taught to end a sentence and hit the space bar twice. Why? Because it's easier to read sentences when they're more spaced out? No — in fact, the opposite is true.
This horribly bad habit originated in the days of blackletter and gothic typefaces. Type was dark and heavy. Printing methods were literally medieval. Large blocks of type may have benefited from the extra breathing room.
Thankfully, those days are long gone.
Today, the extra space leads to tiny rivers of emptiness flowing through your paragraphs. It's much easier to read an evenly colored paragraph. In typography, color refers to the denseness of the page. An evenness of color helps the reader's eye bounce along evenly. Add an extra space between every paragraph and the eye is jerked along, constantly stopping and starting, or caught drowning in a spacious typographic river.
In the nineteenth century, which was a dark and inflationary age in typography and type design, many compositors were encouraged to stuff extra space between sentences.
Generations of twentieth century typists were then taught to do the same, by hitting the spacebar twice after every period [full stop]. Your typing as well as your typesetting will benefit from unlearning this quaint Victorian habit. As a general rule, no more than a single space is required after a period, colon or any other mark of punctuation.
—Robert Slimbach, Elements of Typographic Style
Luckily, the web makes adding two spaces much more difficult. Multiple spaces or tabs in HTML are treated as a single space. To actually print two spaces in HTML, the developer need adds special code for a non-breaking space. That makes it even more offensive when people add an extra space on the web.
Information Gathering Phase
Last week, the New England Patriots had a shortened work week. They played on Monday night the previous week instead of the normal Sunday afternoon.
After losing a full day of preparation to the Monday night game and Tuesday as a rest day, the logical plan be to start practicing as soon as possible. Instead, coach Bill Belichick, gave his players an extra day off so the coaches could spend more time gathering information and planning.
The bigger part of the problem isn’t practice for the players, it's for the coaches to be ready for the players when they come in here.
...I don’t think you want to give your team a game-plan and then, as you do more work on the [opponent], find out 'this isn't quite what we want here' and you have to change it.
We thought it would be better to take a little time ourselves from a coaching standpoint, a staff standpoint, to ... get things as close to exactly the way we want them, so when we do give them to the players, we don't have to go back and change them."
—Bill Belichick, Wednesday 12/5/2007
So the Patriots didn't practice on Wednesday, but the coaches spent the day gathering information and planning. Four days later, the Patriots spent Sunday afternoon scoring at will against the Pittsburgh Steelers.
A Hands Off Underreaction
Recently Rob posted a blog with a long binary string in its title – 73 unspaced ones and zeros. The enormous title blew out the design of our homepage. The long title stretched across the shorter columns.
We spent a minute discussing possible "fixes". Do we add functionality to our CMS to hyphenate words? Do we automatically break long unbroken strings?
Our eventual conclusion was to uderreact and do nothing. We decided the author knows more about his content than the back-end CMS. The author can easily view and edit his content if it doesn't look good. If our CMS does nothing, the worst-case scenario is that the homepage looks a little weird until the content is edited. That seems preferable over automatically altering the author's content with hyphens, spaces, or breaks.
Once you start auto-correcting a whole new series of problems and usability issues are introduced. Ever try starting a sentence with a lower case letter in Microsoft Word? iMarc finds Word's auto-correcting difficult to work around. Sometimes it's best to step aside and let things happen as they were written.
The hands-off approach is difficult. Developers like to develop features. Sales people like to sell features. But sometimes it's better to stop tinkering and treat your software like the country mom treats her child in the magazine article, City Mom, Country Mom (excerpt below). This article, originally published in Down East Magazine, touches on the hands-off approach, letting things happen, and worst-case scenarios.
One summer, the author's family leaves the padded playgrounds and baby proofed city for a month in the country.
Viewed from New York, the land of padded playgrounds and antibacterial gel, Maine can seem like the land of the parentally supervised toddler death wish. Another "we're not in New York anymore" moment occurred during a Fourth of July cookout.
Our host's backyard concluded at the crest of a steep hill that was littered with an assortment of children's riding vehicles – a plastic Tonka truck, a Radio Flyer car, a wagon. At the bottom of the hill loomed the blunt corner of a garden-bed railway tie, a sharp fence post, and a number of big trees. My Manhattan-patented Parental QuickStock Vision registered the serious-injury possibilities as infinite.
A little girl hopped on the plastic Tonka truck and sped down the hill, bull's-eyeing for a tree and capsizing halfway. She stood up, righted the truck, and pulled it up the hill to go again. Soon all the kids were zooming down the hill, their parents hollering an exaggerated "oof" after every particularly impressive wipeout.
To defend the Maine way, the worst-case scenario for the Tonka-truck hill ride is a hospital trip, yes — but all other scenarios aren't only a blast, they also allow kids to feel that they have a creative, confidence-boosting stake in beating back their own boredom.
You could argue that an underreacting parent helps a child overcome fears that might otherwise be legitimized by a full-scale freak-out.
—Heidi Julavits, Country Mom, City Mom
Less Computers
Today marked the end of life for our 10 year old UMAX Supermac. This computer was born in an ancient time when Apple allowed Mac clones. We used the UMAX for internal DNS processing but eventually realized that antique computers do more harm than good.
We still host about 150 of our clients' websites. We just don't host them in our own datacenter any more. We can't, nor do we want to, compete with top-tier datacenters. It's easier to get a dedicated server at ThePlanet.com and deal with the software – web files, databases, and Apache – instead of hardware, bandwidth, and redundant power.
We've replaced our T1 line with a cable modem. Consumer targeted DSL and cable far outperform our old T1 for 1/5th the cost.
Over the past three years, we've added 7 employees. During that same timespan, we've gone from 14 server-based computers down to just four – two testing web servers, a fileserver, and a backup server.
Anyone want a 10 year old Mac clone? It cost $4000 when it came out in 1996.
RSS