Slashdot Mirror

I use Seagull Networks for all my sites. I recommend them highly.

I've been with them for something like five years. I always get prompt personal customer service for the rare issue that ever comes up.

They support SSH login. I upload my web pages with SCP. You can use SSH tunnelling to get your pop mail, or log into a shell via ssh and use elm or pine.

There is a full suite of development tools online, and you can run CGI's that you write yourself.

I mentioned this earlier in my recommendation of Seagull Networks (note - SSH, SCP and CGI's you can write and install yourself, even in C or C++) - but I'll say it again.

If you want reliable email, it is important that you own your own domain name. If you want email to get to you easily and reliably, then it's important that the domain name be easy for people to remember and to spell, even when you've just spoken it to them over the phone. (Note that while my business name is GoingWare, Inc. I've also registered goingwhere.com and had Seagull alias it to make sure people can find me.)

You think your Yahoo or Hotmail account is reliable? Guess again. How many big companies have tanked in the last few decades? What if yahoo decides it's not worth their while anymore to provide email service, even if you want to pay for continuing to have the privilege of having the same email address for the rest of your life.

I was proud to be one of the first customers for Scruz-Net - until they went down for a week just after I started my consulting business!

And they've been bought out more times than I can count. I keep my old ISP account there mainly because I haven't moved all my web pages yet, but periodically I download all my email from there and pick the real mail out from the spam and send them a message asking them to use my new permanent emails, either crawford@goingware.com or michael@geometricvisions.com.

I've also got a few pages on scruznet that I feel are important for people to be able to find in the distant future, so I'm slowly going through my old site there, moving the pages to one of my own domains, and putting a page in the original's place with a META REFRESH tag and a note. But the problem is that some sites have permanent links to my scruznet pages embedded in their databases that I've been unable to get them to correct.

In the long run, I'll close my account at Scruznet and they say they will redirect accesses to my old site to a single, fixed URL but people may not be able to find what they're looking for.

As I emphasize in Market Yourself - Tips for High-Tech Consultants, it's important to own your own domain name not just to maintain a professional appearance and so your customers can find you, but everyone should own their own domain name so they can have a permanent address.

If you own your own domain name and your service should go bad, you can relocate it to another provider and be up in a few days. Mainly you just have to wait for the new DNS to take effect.

(For other helpful programmer's tips (mostly technical) see GoingWare's Bag of Programming Tricks.)

An added benefit of owning your own domain name is that you often get what are incorrectly termed "postmaster" email addresses. With these, any mail sent to anyuser@yourdomain.com will be delivered to your mailbox. You can combine this with filtering email clients to suppress spam. You still have to download the stuff but what you do is sort all of your legitimate mailing list mail into separate mailboxes, and mail addressed to your real name into the main mailbox you read, and leave everything else in your inbox.

Then if you need to give a website a valid email address, say to allow them to send you a password, you give them the email theirdomain@yourdomain.com.

If they sell your name to a mailing list at least you know who's done it. For example, this is the way that I know that Citibank is using the email I used to log into my cardholder webpage to access my account - I've only used that particular email for that one page. But Citibank is now sending spam to this address asking me to sign up for their card! How dumb can they get!

If you really don't care whether an email address should last, as when signing up for a web page, this is when you really do want to get yourself a Yahoo or Hotmail account. That way their servers can handle all the spam and not yours.

I strongly recommend Seagull Networks at http://www.seagull.net/

Whenever anyone asks me for a hosting recommendation, I always recommend Seagull.

No, Seagull is not an ISP. While it would be nice to have a secure ISP, you're better off using any random joker for your ISP, owning your own domain name so you can relocate it in the event your service tanks (I discuss this in Market Yourself - Tips for High-Tech Consultants) and accessing the hosting service via SSH and SCP (secure copy). Note that it does no good to only use SSH - you have to use SCP as well.

Here's a sample SCP command line, in case you can't figure it out, it's very simple but I had a hard time from the man page:

scp foo.bar crawford@www.goingware.com:.

The above places file foo.bar in the home directory of user crawford on www.goingware.com.

scp crawford@www.goingware.com:web/index.html stash

This copies index.html from directory "web" on www.goingware.com and places it in directory "stash" on the local machine.

Please read my web page on Why You Should Use Encryption

Besides being a good service, it's a small enough company to offer personal service. I've sent support email to the webmaster at 2am his time and had the problem fixed and the mail answered within the hour.

But even though it's a small service, it's not a low-quality service. They have high-performance machines, they are in a good colo facility with a high-speed connection to the backbone, they upgrade their service regularly and the webmaster, Paul Celestin, is just a damn nice guy.

I'm not sure if he still publishes it but Celestin used to produce a CDROM full of useful free source code for the Macintosh. Some of my own Mac open-source programs were on it.

These are the sites I personally have located there:

• http://www.goingware.com/ - My consulting company, GoingWare Inc. My livelihood depends on the reliability of this site.
• http://www.wordservices.org/ - Seagull hosts this public-service site for free in exchange for me placing a small banner ad on some of the pages
• http://www.geometricvisions.com/

In addition, my wife has a couple sites on Seagull through my account, and my friend Andy Hasse used to host http://www.williebrown.com there (yes, if you live in San Francisco you might remember that Hasse was a consultant to mayoral candidate Clint Reilly when the Brown campaign discovered Andy owned the williebrown domain.)

I have a couple tips for you on checking email. I use PGP when I'm trying to be secure, but it's really not that much that I really care for complete security. But I just don't like people snooping on me, mostly I think it's none of their damn business what's in my mailbox even if it's spam.

So mostly I read my email at seagull using elm while logged in via SSH, and when my mailbox gets big, I move it to my home directory and copy it to my home machine via SCP:

goingware$ cp /usr/spool/mail/crawford ~

goingware$ echo "" /usr/spool/mail/crawford

back on my home machine:

C> pscp crawford@www.goingware.com:crawford .

It is also possible to download your email via POP with SSH via port forwarding. I describe this on the BeOS Tip Server. It doesn't seem to be responding right now but if you go to its search and enter "ssh" you'll find the tip I submitted called something like "Secure email download via ssh". The instructions have some BeOS specific items but most of what's there will work on any systems.

Don't have SSH? Try one of these:

• Nifty Telnet/SSH for Macintosh - includes a graphical SCP client!
• putty for Windows (also supports NT/Alpha) and pscp for secure copy
• CygWin - a GNU environment for Win32 - use bash, compile with GCC, a lot of linux code builds right out of the box in Cygwin
• The Secure Shell Community Site
• SSH Communications Security (commercial)

I strongly recommend Seagull Networks at http://www.seagull.net/

Whenever anyone asks me for a hosting recommendation, I always recommend Seagull.

No, Seagull is not an ISP. While it would be nice to have a secure ISP, you're better off using any random joker for your ISP, owning your own domain name so you can relocate it in the event your service tanks (I discuss this in Market Yourself - Tips for High-Tech Consultants) and accessing the hosting service via SSH and SCP (secure copy). Note that it does no good to only use SSH - you have to use SCP as well.

Here's a sample SCP command line, in case you can't figure it out, it's very simple but I had a hard time from the man page:

scp foo.bar crawford@www.goingware.com:.

The above places file foo.bar in the home directory of user crawford on www.goingware.com.

scp crawford@www.goingware.com:web/index.html stash

This copies index.html from directory "web" on www.goingware.com and places it in directory "stash" on the local machine.

Please read my web page on Why You Should Use Encryption

Besides being a good service, it's a small enough company to offer personal service. I've sent support email to the webmaster at 2am his time and had the problem fixed and the mail answered within the hour.

But even though it's a small service, it's not a low-quality service. They have high-performance machines, they are in a good colo facility with a high-speed connection to the backbone, they upgrade their service regularly and the webmaster, Paul Celestin, is just a damn nice guy.

I'm not sure if he still publishes it but Celestin used to produce a CDROM full of useful free source code for the Macintosh. Some of my own Mac open-source programs were on it.

These are the sites I personally have located there:

• http://www.goingware.com/ - My consulting company, GoingWare Inc. My livelihood depends on the reliability of this site.
• http://www.wordservices.org/ - Seagull hosts this public-service site for free in exchange for me placing a small banner ad on some of the pages
• http://www.geometricvisions.com/

In addition, my wife has a couple sites on Seagull through my account, and my friend Andy Hasse used to host http://www.williebrown.com there (yes, if you live in San Francisco you might remember that Hasse was a consultant to mayoral candidate Clint Reilly when the Brown campaign discovered Andy owned the williebrown domain.)

I have a couple tips for you on checking email. I use PGP when I'm trying to be secure, but it's really not that much that I really care for complete security. But I just don't like people snooping on me, mostly I think it's none of their damn business what's in my mailbox even if it's spam.

So mostly I read my email at seagull using elm while logged in via SSH, and when my mailbox gets big, I move it to my home directory and copy it to my home machine via SCP:

goingware$ cp /usr/spool/mail/crawford ~

goingware$ echo "" /usr/spool/mail/crawford

back on my home machine:

C> pscp crawford@www.goingware.com:crawford .

It is also possible to download your email via POP with SSH via port forwarding. I describe this on the BeOS Tip Server. It doesn't seem to be responding right now but if you go to its search and enter "ssh" you'll find the tip I submitted called something like "Secure email download via ssh". The instructions have some BeOS specific items but most of what's there will work on any systems.

Don't have SSH? Try one of these:

• Nifty Telnet/SSH for Macintosh - includes a graphical SCP client!
• putty for Windows (also supports NT/Alpha) and pscp for secure copy
• CygWin - a GNU environment for Win32 - use bash, compile with GCC, a lot of linux code builds right out of the box in Cygwin
• The Secure Shell Community Site
• SSH Communications Security (commercial)

A very important thing to understand is that you are only as secure as the neighboring machines you allow logins from.

Since most Unix machines will allow telnet access from any IP address, and many other machines allow FTP or other filesharing access from any address, then you are basically as secure as the weakest machine one of your friends or users happens to log into you from, which could be anywhere and is not under your control unless you make special effort.

The reason for this is that if a cracker (always use the correct terminology...) should break into some less-secure machine than yours, he could install a network sniffer or keystroke recorder on it that captures your buddy's password the next time he logs into your supposedly secure machine from the compromised one.

Poof goes your carefully secured fortress. He doesn't have to use any careful exploit at all to crack your machine. He just logs in using your buddy's username and password.

Better hope you're machine is tightened down against root cracks, and you better hope your buddy wasn't logging in using the root password.

One thing for sure - don't every log into anywhere as root, or do an su, if your telnetted via an intermediate machine, as there could be a sniffer or recorder running on that machine.

This exploit may be even easier than you think - one of the original versions of telnet could be compiled with a debugging flag that, if set to true, would dribble all the keystrokes out to a file. All the hacker had to do would be to gain write access to the telnet executable file and set the value of the global debugging flag from 0 to 1 and he'd get everyone's keystrokes that ever used telnet.

Me? I don't ever use telnet. I use ssh (secure shell). The only external site I ever log into is my web hosting service. I think a minimum requirement of a web hosting service these days is that they provide secure shell access to their customers - mine does, it is Seagull Networks. Does anyone know any others?

Also don't transfer files with FTP - passwords are provided in the clear and crackers can copy your files with sniffers. Use scp (secure copy) instead.

Tilting at Windmills for a Better Tomorrow

If you worry as I do that people snoop on the Internet, then you should use encryption. Don't just use encryption for important secret messages, use it all the time so that the snoopers won't be able to tell when you're up to something they should be paying attention to. Even if you have nothing to hide, generating encrypted traffic on the net improves its overall security because it makes it more difficult for crackers to focus on those who appear to have something going because they use encryption (even encryption is subject to traffic analysis).

Please read my page Why You Should Use Encryption.

If you get your mail from and put web pages on a hosting service, then at a minimum you should use one that provides secure shell (ssh) and secure copy (scp) access. One such hosting service that does is Seagull Networks. Does anyone know any others?

When you retrieve your email via POP or load a web page via FTP your password is being transmitted in the clear. You have no control over which routers and cables it passes through in the process, so you have no way of knowing if someone's running a sniffer on a compromised host. Usually you have no knowledge even of the route, unless you go to the trouble to run traceroute regularly.

You can download your email via an encrypted channel with ssh port forwarding if your mail host provides ssh. The instructions given are oriented to the BeOS but apply in general to any OS for which an SSH client exists.

If you run a website that uses passwords please consider allowing the users to enter their passwords via SSL (https).

If you use websites that require passwords, please use a different password for each site. At the very least, use a unique password for your important sites, like your email, web pages and financial sites. If you keep the passwords in a file (which you may have to do because there are so many sites that take passwords), encrypt the file.

Be aware that most sites that have passwords do not encrypt them, otherwise they wouldn't be able to send you your password reminder in clear text. I've even used sites that mailed out password reminders in the clear every couple months just to prompt me to use the service. Note that anyone at the site who has root access, anyone who compromises the site or anyone running a sniffer on or near the site will be able to catch your passwords.

Also I think it is very likely that many websites are provided for no other purpose than to collect passwords for later use by crackers - beware of that free trial and use a unique password if you must accept the offer!

Use the anonymizer or, if you have Windows 95 or 98, Freedom to protect your privacy while you web surf.

Finally, do you use a laptop computer? Do you have files on it that you don't wish to share with the random stranger who might steal it someday? How about your competitors? A thief won't likely be in the direct employ of your competitors but they may recognize the value of the information and sell it to them, or even post it on the net for fun.

And remember in this information age the information on our computers is more valuable than the hardware itself, and unlike car stereos can continue providing value to a thief because, once it is fenced, it is still available to be fenced again.

Depending on your OS, you should use PGPDisk or the Linux encrypting kernel on your laptop.

Consider encrypting important information on your desktop too. A friend of mine who is a software developer lost every machine in his company in a robbery - source code, strategic plans, and the customer database.

I know of two cases where laptops were stolen from intelligence agents, once during the Gulf war, and once from an MI5 agent while he'd set it between his legs at a train station. Good thing they used encryption!

Finally, read the Forum on Risks to the Public in Computers and Related Systems available on the Usenet News as comp.risks and on the web at http://catless.ncl.ac.uk/Risks

Tilting at Windmills for a Better Tomorrow

I only use SSH (secure shell) and SCP (secure copy) to access my web hosting service.

There are not many web hosting services that allow you shell access at all, let alone secure shell. One that does is the one I use, Seagull Networks.

The funny thing is I use SCP to upload my web pages. Anyone on the net who wants to can look at my web pages after they're uploaded, but they won't have my password.

Do you use a different password for important sites like your web host from the many websites out there that require passwords for you to register for some service? Good.

Even better is if you use a different password for every website you register one, because some of the websites offering some useful service may be doing double duty as password stealers.

Since most people use the same password everywhere a site can give you, say, a free trial of some porn in return for your password and email and then hack your oaccount.

I would suggest that any university or company do what Apple did when I worked there and require the combination of a password and a cryptographically generated key that's made by some device.

At Apple I had a little credit-card device that showed a different password each minute. I think they basically calculate a new secure hash every minute from the old one, combined with a password that's programmed into the unit but not visible to the user.

See my page on why everyone should use encryption.

Tilting at Windmills for a Better Tomorrow.

Please read my page Why You Should Use Encryption. This explains why ordinary people, even your mother and your kids, ought to be using secure encryption.

Also read my note Secure Email Download with SSH on the Be Tip Server. While the tip is BeOS specific, the basic ideas work fine on other operating systems.

Of course, to download your mail via SSH, you'll need a hosting service that provides it at their end, which is why I recommend Seagull Networks. Note that if you upload content to your website with FTP, you're exposing your password to network sniffers. Seagull Networks allows you to use secure copy (scp) for this so your password remains secure.

Finally, I use the Linux Encrypting Kernel under Linux and PGPDisk under Windows to keep important personal info like my Quicken checkbook, and confidential business information like the source code I'm writing for my clients encrypted on my laptop so the theives won't have them if my computer is stolen.

With either one you can create a big file that when mounted with a passphrase is accessible like any ordinary filesystem. I have even found that I can run MPEG movies off a PGPDisks with no loss in playback quality on my laptop which has a 450 MHz Pentium III.

Finally read the Forum on Risks to the Public in Computers and Related Systems for significant discussions on privacy issues. It is available as comp.risks on the Usenet News and on the web at http://catless.ncl.ac.uk/Risks/.

Do you think Microsoft takes care to protect your privacy when designing its products? Guess again.

The scary MSWord residue feature

I recently received a legal document as part of a personal negotiation that I am doing. The document was e-mailed to me in MSWord format. As I was showing it to my lawyer (who happens to be my wife), we decided to put our thoughts inline using the track changes feature of word. After selecting Tools, and Track Changes, we clicked on "Highlight changes in document" and voila, suddenly a whole bunch of red appeared on the screen. We looked at it closely and realized that everything in red represented changes in the document that my counterpart's lawyer had written. We got a good look at the previous version of the contract, as well as a bunch of comments and justifications that the lawyer wrote to his client. It was an eye opening experience.

It appears that instead of selecting "Accept all changes" before sending it to me, the other party to the contract simply turned off the highlighting to the track changes feature.

This is obviously a case of an unsophisticated person misusing a feature. However, it is very dangerous. Lawyers send word documents around all the time, and many of them do not really understand all the features that they use, nor should they have to. I imagine that I was not the first person to see some behind the scenes conversation in an important word document, that I was never intended to see.

I haven't tried them for colocation services (although I've discussed it with the webmaster) but I heavily recommend Seagull Networks. I use them for hosting several domains I own and always recommend them to people who ask me.

Here's why:

• They allow shell access via telnet and secure shell
• Supporting ssh allows me to use secure copy (scp) to upload content
• I can read my email via a shell login with Pine or Elm without downloading all my mail (important when one uses several operating systems)
• I can write my own CGI's in any programming language I want and install them myself. They provide the gnu development tools.
• They have excellent customer service. I've sent in questions in the middle of the night and got back authoritative answers within the hour.
• Their prices are quite reasonable - $25 a month for basic virtual domain hosting, which might seem high but you get the shell access and secure shell

Write to seagull@seagull.net if you want to ask the webmaster about colocation. That's not really their specialty but hosting is.

I host these domains with them:

• www.goingware.com
• www.wordservices.org
• www.geometricvisions.com

In addition my fiance has two domains there and a friend has two domains there under my account (there's a discount for reselling the service - your first account is free but more under the same billing are cheaper).

I haven't tried them for colocation services (although I've discussed it with the webmaster) but I heavily recommend Seagull Networks. I use them for hosting several domains I own and always recommend them to people who ask me.

Here's why:

• They allow shell access via telnet and secure shell
• Supporting ssh allows me to use secure copy (scp) to upload content
• I can read my email via a shell login with Pine or Elm without downloading all my mail (important when one uses several operating systems)
• I can write my own CGI's in any programming language I want and install them myself. They provide the gnu development tools.
• They have excellent customer service. I've sent in questions in the middle of the night and got back authoritative answers within the hour.
• Their prices are quite reasonable - $25 a month for basic virtual domain hosting, which might seem high but you get the shell access and secure shell

Write to seagull@seagull.net if you want to ask the webmaster about colocation. That's not really their specialty but hosting is.

I host these domains with them:

• www.goingware.com
• www.wordservices.org
• www.geometricvisions.com

In addition my fiance has two domains there and a friend has two domains there under my account (there's a discount for reselling the service - your first account is free but more under the same billing are cheaper).

I asked about this on (a perhaps inappropriate place) linux-kernel. What I'd like is a completely GUI email client for Linux. For my needs it doesn't have to be free software but I think it would be the greatest benefit to the community if it was. Here's what I require:

• Completely GUI configuration, no scripts or text files to edit
• Use ISP/hosting service mail servers simply by entering POP and SMTP servers in the preferences
• critically importanthandle multiple email accounts from multiple servers and domains
• Be able to switch email accounts without quitting the program. Eudora for windows or mac can use multiple accounts but you have to quit and start it up with a different config file
• Able to select the "From:" address with a popup menu (and have the right SMTP server used)? This is particularly important to be able to do in replies when I want to reply from a different address than it was sent to
• No configuration of sendmail or any other mail software on my linux box required.
• Arbitrary and unlimited numbers of mail filters, that sort into:
• Unlimited numbers of mailboxes
• Scales to handle tens of thousand of letters in a mailbox, with the ability to search various ways (both in headers and body text) and to sort by header fields

Both Mail-It and Postmaster for the BeOS can do this, and for that reason I use the BeOS when I do my full mail download; most of the time when I read my mail I use elm on linux at my web hosting service Seagull Networks (one of the few web hosts which doesn't just allow shell accounts, but ssh - secure shell access).

KMail with KDE lets you use POP and SMTP providers but only works with one account.

If anyone knows of a good mail client that will serve my needs as described on Linux I will gladly switch.

I subscribe to the notion that just about any traffic on the Internet ought to be encrypted, just for the hell of it, whether it has any interesting info in it or not.

I'd like to see Slashdot, for example, have the option of being served up on 128-bit SSL. I mean all the pages on the site. It would probably be best for the slashdot folks if this were done with hardware encryption support.

For one thing, encrypting all one's casual traffic helps to provide cover for people who really do have something to hide.

I recommend using a web hosting service which provides secure shell login access. One such web hosting service is Seagull Networks. Here is how I retrieve my POP mail through SSH port forwarding. The tip entry gives BeOS specific instructions but the basic idea should work on any platform for which SSH is available.

And yes I know my email is sent to seagull in the clear, but what this does is generate encrypted traffic (generally a good thing) and also prevents my ISP from snooping on me unless they hack into my hosting service.

If you work in a company and are concerned that your employer may be snooping on your personal email (you're not mailing out your resume are you? Know how an ethernet sniffer works?) then you should definitely use SSH for your mail.

Also on my laptop I use PGPDisk to encrypt my Quicken Checkbook and source code on NT, and the Linux Encrypting Kernel to encrypt source code on Linux. If someone steals my laptop, my clients won't have all their trade secrets stolen too.

Mike