Computer Security for the Home and Small Office

Andrew Murphy writes " The Register's security guru Thomas Greene has written a book for the average computer user, though it contains a great deal of information that professionals need to know. It's insightful, instructive, and calls for open source software even on Windows for enhanced security. The single most interesting feature is the author's emphasis on open source software as a security feature per se. He rightly notes that there are no secrets in OSs, and teaches users to leverage this transparency regardless of their platform. As early as the introduction, Mozilla is urged as a secure replacement for IE and OE, and this came before the Scob outbreak." Read on for the rest of Murphy's review. Computer Security for the Home and Small Office author Thomas C. Greene pages 405 publisher Apress rating 9 reviewer Andrew Murphy ISBN 1590593162 summary No secrets means that open source software, when it survives, tends toward robustness -- so it can help even if you run a closed-source operating system.

The book covers popular OSs replacements for Windows applications and utilities; it explains vulnerabilities; it offers practical setup information for both Windows and Linux to harden a system and make it extremely difficult to attack.

The Preface describes the book in general terms. The Introduction explains firewalls and their limitations, and explains how to install Mozilla to limit email and http exploits and spam.

Chapter One debunks the malicious-hacker mythology and shows that most so-called hackers are only script kiddies who are easily thwarted with commonsense tactics.

Chapter Two explains malware, spyware, bad system configurations, and the scores of other routes to system exploitation and privacy invasion that firewalls and antivirus software don't address. It includes a step-by-step guide to simplifying and hardening a system. Most importantly, it offers a useful guide to turning off unnecessary services and networking components for both Windows and Linux, and setting sensible user permissions, and is liberally illustrated with screen shots.

Chapter Three offers a good breakdown of social engineering and phishing scams, and how to defend against them.

Chapter Four is about using common tools, like Ethereal, Netstat, PGP, etc. It explains how to monitor an Internet connection to spot software secretly reaching out or phoning home to remote servers; how to monitor your system for signs of malicious processes; and how to use PGP and GnuPG to encrypt sensitive files and Internet correspondence. This is one of the best introductions to using encryption available anywhere.

Chapter Five explains how to eliminate all traces of Web activity from your computer and defeat forensic recovery of stored data; how to surf the Web anonymously using an encrypted connection and defeat remote monitoring; how to set up and use SSH (SecureShell) to conceal both your identity, and the data content of your Internet sessions from all third parties, including your ISP. The many hiding places of sensitive or incriminating data are revealed for both Windows and Linux users.

Chapter Six explains the advantages and disadvantages of migrating from Windows to Linux; why Linux is easier to configure for security, and why it's better suited to less technically-inclined users; how to judge whether Linux is right for you, and the issues you should consider before migrating. The author is clearly biased towards Linux, but he understands that most users will stick with Windows. Hence the emphasis on tools that run on Windows.

Chapter Seven is a catchall essay explaining security from an anecdotal point of view. There were places where it got a bit tedious, but the idea is to look at security as a process or a frame of mind, not a specific series of computer settings. The material in this section is informative in only a general sense. The real configuration information comes in chapters Two, Four, and Five.

There are several indexes with useful information on firewalls, ports, Trojan activity, sources of information, and more. Most of this information is conveniently located and linked at the author's website, BasicSec.org

Overall, the book is exceptionally well written for a tech manual. The author is a good writer and his prose flows nicely. The book is highly readable, and even witty in parts. I found myself laughing aloud on several occasions. The author has the art of The Register's irreverent presentation. I enjoyed reading it. But it is not perfect, so I give it a 9 out of 10.

My biggest criticism is that the book shifts back and forth from practice to theory and back again. It's good that readers learn the reasons for the (very sensible) procedures and settings listed; but I felt that the book was organized wrong. This is a minor issue, and the book remains exceptionally useful; but instead of interlacing the various parts, theory and practice might better have been separated in two distinct sections. It's difficult simply to flip to a section of this book and learn what needs to be done: there is a lot of theoretical talk between each practical item. It's very good talk, and very instructive talk, all right, but I would have preferred that it be located in a particular place. I would rather not have to read the entire book through in order to tweak my system for good security. Unfortunately, the author has structured the book so that a read-through is necessary.

Overall, this book will tell professionals what they need to do, and novices everything that professionals ought to know, but probably don't. It's in plain English, so no one should worry that they can't grasp it. You can make your computer, or your network, very hard to attack, whether you use Windows or Linux. This book will show you how in excellent detail. You've got to read the whole thing, unfortunately -- but it will work nicely for you, casual user and sysadmin alike.

You can purchase Computer Security for the Home and Small Office from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.

Comments

The problem with security books for the home user

[prostoalex]

...is that few people ever read them.

The banner urging you to install the latest Internet optimizer or a totally free peer-to-peer app is so much more convincing.

i'll be buying several copies...

[wwest4]

...at the company's expense. Everyone stumbles into the IT office and asks these questions, and the answer doesn't exactly fit in an FAQ because everyone has a slightly different situation.

And save your breath about whether or not it's my job to answer such questions. I probably don't work where you do.

Re:i'll be buying several copies...

[Anonymous Coward]

So isn't answering those questions your job?

Re:i'll be buying several copies...

[Saeed al-Sahaf]

So isn't answering those questions your job?

The book is for the "home user". Most help desk / IT shop guys get asked a lot of questions by fellow employees that are not work related, and in those cases, no prob. not his job. On the other hand, is the boss going to want to pay for these books?

Re:i'll be buying several copies...

[wwest4]

> is the boss going to want to pay for these books?

that depends on how much you bill out per hour, if the "boss" is one of the users asking the questions, and if it's worth the ROI in terms of user satisfaction. in the case of most IT generalists, the cost is trivial compared to the time spent studying each individual case, or compared to giving a cold shoulder to the guys that ultimately fund your paycheck.

in a similar move, we initially bought AV software for them as well (though eventually the client made a deal w/ NAI, now McAfee, who offers "enterprise" deals including home user licensing benefits). it makes sense for us - instead of letting this expected service pull time away from more complicated work, we come up with ways to push the responsibility back onto the users without completely ignoring their needs.

Re:i'll be buying several copies...

[Saeed al-Sahaf]

Yes, actuall, I understand what you are saying. We bought Symantec Anti-Virus Corp Version for all our people to take home (as well as several other apps).

Re:i'll be buying several copies...

[cammoblammo]

And save your breath about whether or not it's my job to answer such questions. I probably don't work where you do.

Actually, it's good to think that people do ask these questions. If the answers are listened to, such questioning should be encouraged.

This book should be open source

[TheSpoom]

Really, I'd LOVE to be able to point one of my tech support callers to a free online version of this book. It would be very helpful because I wouldn't have to explain to them why Firefox is better than Internet Explorer, and then have them think I'm just paranoid when I tell them all the ways spyware can get in their system.

Re:This book should be open source

[Anonymous Coward]

...and then have them think I'm just paranoid when I tell them all the ways spyware can get in their system.

I get this a lot from my boss. My response is always one of my favorite quotes: "It isn't paranoia when they really are out to get you!"

Re:This book should be open source

[Anonymous Coward]

Try doing what I do--I teach a free class, open to the public, at our local library.

I didn't start this, they already had classes set up which I started helping out with, but I *did* create the class on security for average folks.

Just be prepared to supply a bit of free tech support :)

Re:This book should be open source

[sp00]

This birngs up another good question... Are there any open source books on security (I haven't ever really looked)? I would guess that even if there are, they aren't aimed and the "home" or casual user.

Re:This book should be open source

[DP]

If a tech support guy ever did that to me, I'd make sure he got fired for it. That is not doing your job, that is shirking your duty. If you're getting paid to do tech support, you better damn well be ready to give tech support, not say "RTFM, lamer."

If you can't explain the advantages of security without sounding paranoid, it's your problem, not the customer's.

Re:This book should be open source

[cpeterso]

I'd LOVE to be able to point one of my tech support callers to a free online version of this book.

Who wouldn't like free stuff? But since this information has obvious value to you and your tech support callers. If your time is worth something, then saving your time (by buying this book) should be worth something, too.

Re:This book should be open source

[Anonymous Coward]

Also, with a bit of subtle social engineering, I bet you can determine a lot of passwords...

Re:This book should be open source

[narrowhouse]

There is a question of where the "Tech Support" job begins and ends. I often field calls from people who ask me what they can do to lower their risks of Spyware installing itself, but I can't really recommend Moz/firefox etc. because our company intranet will refuse to even TRY and display on a Gecko based browser (even with a forged ID saying it is IE).
I've been shutdown by callers who "...don't want to know how it works, I just want you to make it stop" if that is the attitude you are facing it will be an uphill battle trying to "support" them by giving them the knowledge to help themselves.

Re:This book should be open source

[TheSpoom]

Comment I posted earlier. I support Internet Explorer all the time, and I'm very good at fixing it. I never use a browser swap as a "fix". My comment was just that I would love to be able to show customers how to avoid getting spyware and malware in future AFTER the call is done.

Parent is flamebait.

Re:This book should be open source

[hitmark]

how about installing opera? its not gecko but its not ie either :) let me guess, your intranet is running iss and active directory?

Oh

[ParticleMan911]

So basically, this book contains all the information that the average /. reader already knows.

Re:Oh

[Anonymous Coward]

Don't misoverestimate this place.

It contains all of the information that the average /. reader claims to already know and/or brags about knowing.

Re:Oh

[Anonymous Coward]

Don't misoverestimate the book. I happen to know all sorts of things that aren't covered in the book, such as how to tie my shoes, what to do in case of fire and how to prepare hot grits.

Re:Oh

[Anonymous Coward]

how to prepare hot grits

Now there's a book I need. Ever thought of becoming an author?

Re:Oh

[Anonymous Coward]

Not always.

How about the nooobies who are just getting into the knowledge?

I also have books for reference because I am not always on the computer. A book is also a great way to get the initial foundation while I find the internet great at solving a specific problem.

JMHO

Re:The problem with security books for the home us

[CrazyTiger]

Exactly.Too many people lack common sense.The only people with common sense (like us) go online to get info for free.

Average user?

[scowling]

Chapter Four is about using common tools, like Ethereal, Netstat, PGP, etc. It explains how to monitor an Internet connection to spot software secretly reaching out or phoning home to remote servers; how to monitor your system for signs of malicious processes; and how to use PGP and GnuPG to encrypt sensitive files and Internet correspondence. This is one of the best introductions to using encryption available anywhere.

(And so on.) It looks to me as if the book has failed completely as a guide for the average home or small office user. Your mom is the average user. Your mom plays Pogo all evening and clicks on every mail she receives. You need to explain security to her in such a way that it can fit on both sides of an index card. GnuPG? I think not.

Re:Average user?

[wwest4]

You're right. But I still advocate a book of this sort because it targets a second tier of power users who are competent, if not truly advanced/pro. They can read the book and coddle the cluebies. Many who might call themselves advanced or professional find themselves in the potentially insufferable position of being responsible for answering questions like these. Some natural teacher/prophet types may love it, I'm sure, but for those who don't, this book is a means to delegate to the "power users."

Re:Average user?

[jollyhockysticks]

Chapter Four is about using common tools, like Ethereal, Netstat, PGP, etc.

Indeed the last thing I want is for more "average users" playing with ethereal, oh sure its not so dangerous now but once they've tried the soft drugs you know that leads onto the hard stuff!

netstat sure, go for your life with netstat and PGP , ok generate your keys and get the email plugins installed if you will, spend some more cpu cycles for someone somewhere... but really, why ethereal?

Are we really expecting average users to dissect their packets to stay secure?

Re:Average user?

[stratjakt]

Well, as the lead-in says, this was written by the "guru at theregister.com", or translated, by an out-of-touch linux zealot.

By out-of-touch, I mean he has no idea what an average user is, or what they're willing to do. Ethereal is next to useless as a security tool, it's a great tool for troubleshooting complex networking setups, but a box with XP Home that dials into AOL is hardly a complex network.

They might as well suggest the "average user" set up an elaborate honeynet.

A security book for the average user probably could fit on both sides on an index card, hell one side: Know what a firewall is and how to configure it. Know not to run executable code unless you trust the source. Keep your machine up to date, and scan for viruses reguarly.

That's about it, at least, thats about all I'd expect out of an average user, and that's about all I'm willing to do myself. I've never cracked out ehtereal to "secure my box". Thats ridiculous.

The "dont run executables" is a tricky one under Windows, because it's no longer clear to the average user what's executable or not. It used to be simple: files that end in .bat, .com or .exe. Now it could be .vbs or a macro in a .doc or .xls. How many average users know what .msi means?

Not that it's easier for the average user to know in the unix world, where they have to "ls -l" to see if the executable bit is set.

Re:Average user?

[Bill Dog]

The "dont run executables" is a tricky one under Windows, because it's no longer clear to the average user what's executable or not.

This list is probably a good start, if not everything.

Re:Average user?

[0x0d0a]

You think personal firewalls are a good idea from a security standpoint?

[shakes head] Wow, we sure are on different wavelengths.

I'll give you maybe antivirus software, avoid executing code (note: the number of things that can be "executable" is large, as you pointed out), and keeping your machine up to date. I'd also suggest use of AdAware or similar spyware remover.

Not that it's easier for the average user to know in the unix world, where they have to "ls -l" to see if the executable bit is set.

The ls -l and the file extensions do not serve the same purpose. If they *did*, *IX would be a lot easier, as you'd just have to teach them one command "ls -l" instead of every executable extension.

Re:Average user?

[Anonymous Coward]

Unless you have ls colors on, in which case executable files will be the only ones that are green and bold (or however you've set them).

A Most important home-use chapter

[grunt107]

IMO is Ch5: Chapter Five explains how to eliminate all traces of Web activity from your computer and defeat forensic recovery of stored data; how to surf the Web anonymously using an encrypted connection and defeat remote monitoring; how to set up and use SSH (SecureShell) to conceal both your identity, and the data content of your Internet sessions from all third parties, including your ISP. The many hiding places of sensitive or incriminating data are revealed for both Windows and Linux users.

This will help the casual web users who get bashed by the spyware-grabbers. Like my parents.

Re:A Most important home-use chapter

[Pidder]

Just because the book contains more advanced topics doesn't mean it can't be aimed at the casual user. To me it seems that the book is aimed at the casual but interested user. Someone who's not the least interested in security will not pick this up no matter how basic it is. As Joe Sixpack starts reading this book he will learn more and more and by the time he comes to chapter 5 he will hardly be Joe Sixpack anymore.

Is it ironic, hypocritical or neither?

[Soukyan]

An open source advocate won't just give away the book for free. So why again should source code be made free? Just a thought.

Re:Is it ironic, hypocritical or neither?

[TheSpoom]

That's the classic "free as in beer vs. free as in freedom" argument, and has been argued on Slashdot too many times to count. Just take a look at the GNU philosophy section for the answer to your question.

And just in case you're wondering, the GNU also publishes the Free Documentation License.

Re:Is it ironic, hypocritical or neither?

[TheWingThing]

Open source software != free of cost.

Any book or article is open source anyway - you can read it completely, unless it's a research article that publishes only the results and not the raw data.

Re:Is it ironic, hypocritical or neither?

[Sasha Slutsker]

Neither, this is a book. It was produced from trees and cost money to manufacture. Obviously, these expenses need to paid off. Plus, this is probably this guy's job. He needs money to put food on the table. No one can survive without money.

He is merely saying that free software is often very secure and advises to use it. He is not saying that everything in the world should be free in some sort of communistic world.

Re:Is it ironic, hypocritical or neither?

[Soukyan]

But if I were to take the book and reprint it under another name and ad a few chapters of my own and then proceed to sell it? Does open source not advocate this sort of use of source code? Are we speaking specifically of GNU or are we talking true open-source? I appreciate the replies and I understand those aspects, but while you can reference another's material in the book world, you can never legally profit from it. Also, open source licensing is ripe to turn into a quagmire of different types and freedom's of use. Is this better or worse? Does it cause more or less litigation? As was stated, this has been discussed many times. Just some more thoughts on the matter. "Open source" as it is touted is not the utopian answer to our problems. It has a bundle of problems on its own.

Re:Is it ironic, hypocritical or neither?

[The Master Control P]

Because a book is a real-world item that is not effortlessly duplicated by every general purpose computer in existance.

Re:Is it ironic, hypocritical or neither?

[jgoeres]

You're confusing a free book with Free Software. A free book costs you nothing to buy. Once you buy it, you own that physical copy of the book. You don't have the right to, say, add a chapter to it and resell (or re-giveaway) it.

With Free Software, you can do exactly that (metaphorically speaking).

Re:Is it ironic, hypocritical or neither?

[RatBastard]

Because a book is a real-world item that is not effortlessly duplicated by every general purpose computer in existance.

Which is completely irrelaivant and meaningless. The contents of the book could be released as a PDF file, series of HTML files, DOC file, RTF file, etc... which could be effortlessly duplicated.

But what does the effor involved to duplicate something matter?

Re:Is it ironic, hypocritical or neither?

[jgoeres]

Now you're offtopic. I'm not sure what your point is. I suggest you read the links already suggested above.

Re:Is it ironic, hypocritical or neither?

[Anonymous Coward]

That's the classic "free as in beer vs. free as in freedom" argument...

Yes, and this is neither.

Re:Is it ironic, hypocritical or neither?

[symbeon]

Actually, you're talking Open Source Software, not Free Software. Free Software, or Freeware, is something that is available for you to use free of charge. It doesn't entitle you to view the source code, it only says that you can use it for free. Open Source means that you can take the code, modify it and then redistribute it.

Re:Is it ironic, hypocritical or neither?

[jgoeres]

Correct, but "Open Source" is a kind of "Free" software. If I had meant Freeware, I would've either said "Freeware," or "free software." Small F, and not just a semantic difference.

Additionally, the original poster was talking about Open Source Software.

In any case, I think the original poster was probably just trolling. If not, these replies have given him/her enough to read through.

Re:Is it ironic, hypocritical or neither?

[The Master Control P]

"But what does the effort involved to duplicate something matter?"

Because as the amount of effort to duplicate something decreases, it's scarcity and therefore value decrease. The reason MS can sell Windows for thousands of dollars is because they impose artificial scarcity by hiding the source, which drives up cost.

If the book were released as as HTML/PDF/rtf/whatever, it too would be effortlessly duplicatable and therefore have almost no monetary cost beyond what we choose to pay for it, just as linux has no monetary cost unless you choose to pay your favorite distro vendor.

Re:Is it ironic, hypocritical or neither?

[truthsearch]

While he won't give you a paper copy of his books for free (limited commons), Eric S. Raymond, another open source advocate, publishes his paper books online for free - as in beer and speech. Some (all?) are under a Creative Commons license.

Re:Is it ironic, hypocritical or neither?

[jafiwam]

You may want to word it as:

"because the amount of effort to duplicate decreases, it's scarcity and therefore _PRICE_ decreases"

I just have this thing about being specific about "value" verses "price" in economic discussion as they are different concepts.

It looks like you meant price... but typed value. If everybody had a free copy of the book, it would still be very valuable to someone who wanted to secure their PC. The price would just be zero.

Re:The problem with security books for the home us

[lukewarmfusion]

The parent post is actually insightful (as well as funny). So many of us have tried to tell our parents, friends, relatives - even complete strangers - about the importance of security. But they still download Kazaa (not lite), they still choose a password named after their dog, and they still open every damn attachment they get.

Security = extra work, confusing settings, and ways to mess things up
Insecurity = identity theft, loss of property or information, and probably cancer

It sounds like a pretty easy choice to me.

Marketing security.

[Anonymous Coward]

"The banner urging you to install the latest Internet optimizer or a totally free peer-to-peer app is so much more convincing."

BANNER:
"Would you like to be secure from spyware? Would you like to keep the government from spying on you? Would you like to be free from unwanted advertising? How about viruses and blue screens? Click HERE to find out more."

Main benefit I see

[Anonymous Coward]

I see the main benefit of a book like this
as something to take my less computer-literate friends past the basic steps of:
->install Firefox
->install firewall.
->install a/v software (and run said software).
->install anti-spyware software (and run said software).
If it is as simple and clear as stated, it might
replace the wonderful calls I get during dinner from my new-to-computer friends/relatives along the lines of
"I was doing x to that firewall software, and
now nothing works".

And I didn't get my first first post... I suppose that's what I get for being off-topic...

something missing here...

[kaan]

"Overall, this book will tell professionals what they need to do, and novices everything that professioanls ought to know, but probably don't."

While I agree that novices probably ought to know a lot of the topics covered, there is something fundamentally missing when many (most?) novices still barely realize they have an alternative to using Windows. I interface with lots of people who basically think you have two choices - owning "a computer", or owning "a Mac" (as though owning a Mac wasn't a real computer).

The bigger problem, aside from addressing security problems, is educating the general public that they have choices, and there are different security impacts based on your choices. We live in a world where hundreds of thousands of Windows users don't even know about Windows Update, which is arguably the simplest thing you can do to avoid security vulnerabilities (yeah, yeah, I know sometimes they introduce problems through WU, but Microsoft seems to fix half a dozen "critical" security flaws per month).

So what novice out there is going to even take note that there's a book that covers security problems/issues and offers fixes for problems they're not even aware of?

Re:something missing here...

[hal2814]

"I interface with lots of people who basically think you have two choices - owning "a computer", or owning "a Mac" (as though owning a Mac wasn't a real computer)."

I find this a bit annoying, but I would blame the software manufacturers and salesmen more than the ignorant users. How many times do you hear of a piece of software running of PC or MAC when they really mean it runs on Windows or OS X (or 9 or whatever)? I remember back when a Novell rep tried to claim that multiplatform meant Windows 98 AND Windows NT (x86 only of course). While it's good to see our previous file and print server overlords overcome such ignorance, the average user still has not. To them there is PC and Mac and as long as software reps perpetuate this view, it won't go away.

Re:something missing here...

[yopu]

I'm curious: why do so many people insist on writing "MAC" (all caps), when (1) that stands for "Media Access Control;" and (2) "Mac" is short for "Macintosh"?

Re:something missing here...

[hal2814]

Because PC is not Pc. Therefore MAC cannot be Mac. If MACs were the dominant platform, we'd be talking about Pcs and Macs. You need to brush up on your sales logic.

Re:something missing here...

[Tokerat]

PC is an acronym (kinda) for Personal Computer. Since a Macintosh is a personal computer, it too is a PC. Toss that one at a sales rep and watch their heads explode like telling a hardcore RPG freak that Square sucks ass.

Average user?-Hidden security.

[Anonymous Coward]

"You need to explain security to her in such a way that it can fit on both sides of an index card. GnuPG? I think not."

PGP can be made a transparent part of the process of using your computer.

Re:Average user?-Hidden security.

[Beryllium Sphere(tm)]

>PGP can be made a transparent part of the process of using your computer.

Only at the expense of security.

Unless you verify key fingerprints out of band you're getting very little protection. That's not transparent and I've never found an easy way to explain it.

Then there's backing up keyrings and choosing a meaningfully strong passphrase.

Impressive link collection

[Anonymous Coward]

Just in case his site gets /.'ed, here is his impressive list of links. - Jonah Hex in non-karma whore mode.
Downloads
Linux Wipe Tools: Three shell scripts for securely wiping all data from the swap partition, wiping unused disk space on the root partition, or wiping an entire disk, by Thomas C. Greene.

No Messenger: A batch file that eliminates Windows Messenger and fixes the problem of Outlook Express loading slowly when Messenger is absent, by an anonymous friend of The Register.

FileCheck MD5: A free, simple, lightweight MD5 utility for Windows, courtesy of Brandon Staggs.

Errata: A text file containing my various blunders and ommissions in the book (right-click and "save as," or view as HTML). Last updated 6 June 2004.

Links to Other Goodies
Mozilla: A free, open source Web browser and e-mail client for Linux and Windows, feature rich and far more secure than Internet Explorer and Outlook Express. Recommended for novices.

Firefox: A free, open source, stand-alone Web browser for Linux and Windows. Very light and fast. Recommended for intermediate users.

Thunderbird: A free, open source e-mail and news client for Linux and Windows. Recommended for intermediate users.

GnuPG: Gnu Privacy Guard; a free, open source replacement for PGP, for Windows and Linux.

WinPT: Windows Privacy Tools; a free, open source GUI frontend to GnuPG for Windows.

Anonymizer: Various services for anonymous Web surfing, e-mail, chat, etc.

OpenSSH: A free, open source SSH (Secure Shell) client and server for Windows and Linux.

PuTTY: A free, open source GUI frontend to OpenSSH for Windows.

Ethereal: A free, open source network traffic analyzer for Windows and Linux. Windows users will need to install WinPcap before installing Ethereal.

Ad-Aware: A free, closed source adware/spyware scanner for Windows.

SpyBot Search & Destroy: A free, closed source adware/spyware scanner for Windows.

Sam Spade: CGI gateways to numerous online tools, such as whois, traceroute, etc.

SourceForge: A vast repository of open-source software for Windows and Linux. The site can be overwhelming, but it has a search engine to help users locate packages.

GNU Project: The home base of the open source movement. A repository of open source products, chiefly for UNIX-compatible systems.

Security Information
About Internet/Network Security: An informative and useful site dealing with computer and Internet security, with reviews of security products and books, practical howtos and tips, and links to numerous tools and information resources, geared toward beginners and intermediate users.

SANS Institute: An educational and research organization with a vast archive of security research documents, news, and advisories, geared toward intermediate and advanced users.

CERT/CC: Computer Emergency Response Team Coordination Cente

Re:Impressive link collection

[anomalous cohort]

Why is Mozilla for novices and Firefox and Thunderbird for intermediate users?

Re:Impressive link collection

[Anonymous Coward]

first 4 links are 404

Re:Impressive link collection

[downbad]

Because Mozilla has bigger buttons.

Re:Impressive link collection

[Jonah Hex]

first 4 links are 404

Yea, sorry about that, they link directly to the files on his site and thus he didn't have a "complete" link to them including the server info. Here's "fixed" links:

Linux Wipe Tools: Three shell scripts for securely wiping all data from the swap partition, wiping unused disk space on the root partition, or wiping an entire disk, by Thomas C. Greene.

No Messenger: A batch file that eliminates Windows Messenger and fixes the problem of Outlook Express loading slowly when Messenger is absent, by an anonymous friend of The Register.

FileCheck MD5: A free, simple, lightweight MD5 utility for Windows, courtesy of Brandon Staggs.

Errata: A text file containing my various blunders and ommissions in the book (right-click and "save as," or view as HTML). Last updated 6 June 2004.

Joanh Hex

Re:Impressive link collection

[Anonymous Coward]

GNU Project: The home base of the open source movement. A repository of open source products, chiefly for UNIX-compatible systems.

I'd love to see RMS's face if he read that!

Re:Impressive link collection

[weapon]

My Favorite AIDA32 you can get the user to do ana analysis of there system in a couple of clicks and e-mail it to you. the website has closed down and support is removed but you may be able to download it from http://www.majorgeeks.com/download181.html
it has been removed from some mirrors!

Weapon

Re:Impressive link collection

[0x0d0a]

If you're the guy that wrote diet libc, I'd like to thank you. I learned nice lightweight coding tidbits by reading documentation and source from diet libc.

Re:The problem with security books for the home us

[Anonymous Coward]

The banner urging you to install the latest Internet optimizer or a totally free peer-to-peer app is so much more convincing.

To whom? This sounds like a totally elitist attitude to me! I consult for a number of small business owners that depend on their computers for business. When things are explained to them so that they understand (none of this "Just do this and shut up" crap) I have never had one of them that insisted on practicing unsafe computer acts again. I suspect that more of the problem lies in presentation than in stubborn/stupid computer users!

Remember; ignorance can be cured, stupidity can't!

Re:The problem with security books for the home us

[Anonymous Coward]

Or reading any book for that matter. That goes for users in the workplace..Who happen to be home users

Lesson 1 Install Service Pack 2

[Raindeer]

Simple

Re:Lesson 1 Install Service Pack 2

[Hockney Twang]

Perhaps not so simple. I'm gonna go ahead and make the assumption that a large number of people will have(have had) serious stability issues as a result of SP2. Remember the 3 out of 5 figure that everyone blew off because it was related to some malware that's incompatible with SP2? Well most users have malware on their machines, that's just the way it is. They don't know or care enough to remove it, or buy this book. And if they install SP2, all they'll know is that their computer no longer wokrs.

Re:Lesson 1 Install Service Pack 2

[Anonymous Coward]

...ultimate Windows security for 2 of 5 users

Re:Lesson 1 Install Service Pack 2

[Anonymous Coward]

I'm going to make the assumption that you're a dumbass. I installed RC2 on some machines that that were in dire need of it (friends who had a ton of spyware that wouldn't go away) but I never saw any problems. I have also upgraded those machines in question, as well as a few more, to SP2 final without any problems whatsoever. I really think that article was just some good ol' MS bashing in its finest form.

Re:Lesson 1 Install Service Pack 2

[JCholewa]

> Simple

Yeah, real simple, if you want to be hideously out of date.

You should upgrade your Win2k to *at least* service pack 4. Recommending users stick to sp2 is ludicrous.

something missing here...An Apple a day.

[Anonymous Coward]

"While I agree that novices probably ought to know a lot of the topics covered, there is something fundamentally missing when many (most?) novices still barely realize they have an alternative to using Windows. I interface with lots of people who basically think you have two choices - owning "a computer", or owning "a Mac" (as though owning a Mac wasn't a real computer)."

Well I'll say two things about an Apple computer. One they do pay attention to security. Two they present security in such a way that it isn't the onerous burden like it is for other platforms.

Re:The problem with security books for the home us

[digitalsushi]

yeah but each of us that gets it for free knows a guy who does nothing but buy brand new tech manuals and then stuff them under the passenger seat of their car three nights later.

there are no secrets in OSs

[Junior J. Junior III]

There are no secrets on library shelves, either, but if the populace never signs out a book and actually reads it, or if they try to read it and can't understand the language, what good does that do them? OSS isn't inherently secure. It has the opportunity to be peer-reviewed and pronounced "secure" by the peer reviewers. And even they can be wrong, if they're not clever enough to spot a hole.

Re:The problem with security books for the home us

[pinchhazard]

Definitely. Free information online is teh best and guaranteed reliable or your MONEY BACK!

There are not secrets...

[FerretFrottage]

He rightly notes that there are no secrets in OSs

If only that we true for SOs!!!! "What do you mean you use to be a man? Nah, no big deal, I'm cool with that...although I did always wonder why I caught you reading /. --that explains it."

Re:There are not secrets...

[FooAtWFU]

"What do you mean you use to be a man? Nah, no big deal, I'm cool with that...although I did always wonder why I caught you reading /. --that explains it."

Sir (or madam):
That was too much information.

Re: The book is missing "dummies" in the title

[Alwin Henseler]

Too many people lack common sense.

No, they don't. They just don't (and/or don't want to) understand all the inner workings of technology they use every day. That's true for computers, cars, kitchen appliances, VCR's, whatever.

So in terms of computer security, an average user behaves like a dummie. The book should have been named "Computer security for Dummies" or something like that, to appeal more to the target audience. Isn't this "... for dummies" series of books very popular anyway?

Other useful info at cert.org

[sczimme]

CERT.org's tips for home network security. It's very basic but might help.

They also offer The Home Computer Security guide, which seems to parallel Mr. Greene's book in some key areas. This page includes a link to a pdf which goes into detail on the examples (encryption, firewall, anti-virus, patches, ACLs).

Point your tech support callers to these free docs - or others easily available via your favorite search engine - if the idea of a commercial book bothers you that much. Not everything has to be open source. Alternatively, why don't you write the open source manual that you need? Isn't that the idea behind F/OSS?

Re:Other useful info at cert.org

[CobaltBlue612]

I do tech work sometime, and its flat out stupid of anyone to trying pushing the open source line in places where people just want a fix, not a migration strategy. People call support because of what they have is broken, they dont want it replaced, they want it fixed. If they wanted something new they'd be calling the sales department. I'm not saying we shouldnt try to promote OSS, but why not promote it when people are arguing about why their pc crashes, since then you appear more objective, and gain a receptive audience. The first words out of a customers mouth if you told them to swap IE for a more secure browser created by a community of developers in their spare time would be "Heh, dork", and they'd ask me to fix the problem they have ;)

Re:Other useful info at cert.org

[tbmaddux]

Point your tech support callers to these free docs - or others...

I frequently pass along Schneier's 3-year-old Safe Personal Computing essay from Crypto-Gram as a good initial set of steps to take coupled with good long-term recommendations (don't use MSIE, don't use Windows).

Re:Other useful info at cert.org

[chris_mahan]

When someone asks you to fix a 12 year old car with problems that can't easily be fixed, will break again, and whose value keeps falling, you tell them that it would be cheaper for them to buy a newer car, no?

Re:Other useful info at cert.org

[TheSpoom]

I *never* use a browser swap as a "fix". 80% of my troubleshooting time, however, is with Internet Explorer issues. From my perspective, Internet Explorer is simply broken, and while I am VERY skilled with fixing it and its various issues and malware, after I have fixed them, in my opinion it is beneficial to the customer if I mention that Internet Explorer is not the only browser out there.

Macs left out. (sigh)

[tb3]

It's a pity he covers Windows and Linux but completely ignores Macs. (I checked his website; I'm sure). There must be the same number of home/office users of Macs as Linux, probably more. Although the Mac is secure against spyware, malware and viruses at present, it would be useful to inform people about security considerations for the Mac, how the built-in firewall works, and so forth.

Re:The problem with security books for the home us

[Hexedian]

In my opinion, the real problem is that computers aren't MADE for the average user. An average user should not have to worry about firewalls, security exploits and the like, just like an average driver does not have to worry that his engine or breaks might malfunction.

I.Q. Test

[Anonymous Coward]

A more secure home user? Simple. Make Internet use dependant on the user's I.Q.

50 or below: Fox News, CNN, MSNBC, Hotmail, any .gov
75 or below: Microsoft, Dell, Compaq, etc.
100 or Below: Slashdot, any .net
125 or Below: Any .com, save....
150 or below: Apple.com

Pfeh. Letting blind people drive. Why, oh why are there so many accidents??

Re:I.Q. Test

[BarryNorton]

Do I understand you to mean (which you've written) that Slashdot can only be read by the subnormal? Or are these disclusions?

Re:I.Q. Test

[base3]

You must have forgotten the decimal point in the last entry in your table.

Why am I seeing this?

[Snowgen]

This strikes me as off-topic, but I can't think of anywhere to post it where it would be on-topic, and this is as close as it gets.

In my preferences, under "Exclude Stories from the Homepage", I have checked "Book Reviews". I just double-checked. So why does this story show up on my homepage?

Am I doing something wrong? Is there a bug in slashcode? Is this not really a book review, despite the words "Book Review"?

Can anyone help me out?

Re:Why am I seeing this?

[SuiteSisterMary]

See the two icons listed beside the story; a lock and a stapler? Hover your mouse over each picture, and you'll see what the story is listed as; in this case 'security' and 'IT.'

Re:Why am I seeing this?

[Anonymous Coward]

Then it would in fact appear to be a bug in Slashcode, somebody should fix it so if filters by Section OR Topic, not Section AND Topic.

misoverestimations

[Anonymous Coward]

But can you ride a Segway without falling over? Finish a bag of pretzels without need of the Heimlich maneuver?

Re:misoverestimations

[ParticleMan911]

Yes. But I can't ride my bike without falling off it...

Dummies Guides already do all this, better too...

[GuyFawkes]

Tom Greene writing something insightful and instructive?

Well, that would be a first I suppose, him and Orlowski (sp?) are the two biggest problems the reg has IMHO.

For my money when there is already stuff like the Dummies Guide to Network Security (www.dummies.com) why bother?

For those that asked for online articles
http://www.dummies.com/WileyCDA/DummiesA rticle/id- 1983,subcat-NETWORKING.html
http://www.dummies.co m/WileyCDA/DummiesArticle/id- 1808,subcat-NETWORKING.html
http://www.dummies.co m/WileyCDA/DummiesArticle/id- 1518,subcat-NETWORKING.html

etc etc

Re:The problem with security books for the home us

[buchan232]

Nope I'm sorry but the original poster is right. The users I deal with day in and day out want NOTHING to do with security.
We have tried to explain both nicely and in the "Just do this and shut up" way.

No matter how we try and tell them they do not care.

"Thats not my job"

I have dealt with a very wide range of users and for the most part it has nothing to do with the sysadmins presentation more the users lack of knowledge.

Re: The book is missing "dummies" in the title

[jadenyk]

But if you lack the understanding of the inner workings of your car, you go to a mechanic or, even better, buy a book to learn all about it so you can fix it yourself. This is common sense.

When it comes to computers, security included, I would say that 90% of your average consumers (not your average /.er) does lack common sense. Before buying and/or using a computer, they should either get the proper manuals (books like the one reviewed here, though I didn't RTFA at all) or retain the services of someone who will keep their computer safe, secure and running correctly.

Re:The problem with security books for the home us

[NineNine]

Security = extra work, confusing settings, and ways to mess things up

Insecurity = identity theft, loss of property or information, and probably cancer

Well, you also have to consider that for all of the screaming privacy/security insanity on Slashdot, that security isn't important to most home users. Of course people get fucked over, but not everybody running unpatched Windows 98 is fucked. Even if a large % of users have backdoors, etc. installed, what % of those users have something worth stealing? It comes down to if the extra time, money and effort in securing a computer is really worth it to them.

Re: The book is missing "dummies" in the title

[PitaBred]

As an aside, I refuse to buy any "For Dummies" or "For Idiots" books, because I don't believe I am either.
I'm perfectly capable of understanding most anything, give me a reference manual or a "for beginners" type of book. I'm not dumb simply because I don't have the information. I'm dumb if I'm not able to absorb the information.

Build It In or Legislate It, Don't Wait for Users

[reallocate]

Few of us read books about auto safety, either, but automobiles and the roads they travel on are demonstrably safer than in years past. This happened because manufacturers designed and built safer cars. Sometimes legislation mandated those improvements, other times the market mandated the changes.

Imagine if someone started selling a hardware or software gizmo that promised to keep your machine free of all spam and viruses, forever, period. Imagine that this gizmo actually worked. Imagine the sales boost for PC's that sell with this gizmo built in.

Ditto for computer security. The best way to make home and SOHO computing more secure is to build that security into the hardware and software we use and in the networks are traffic moves on. And, yes, some of that will be legislated as the net becomes increasingly critical to our daily wellbeing.

We can't expect any but a tiny fraction of computer users to "learn" their way to better security. Nor can we pretend that the wide open and unregulated nature of the infant internet will survive.

Re: The book is missing "dummies" in the title

[GTRacer]

But here's the rub, at least as I see it...The average person treats a PC like a VCR, as an appliance. However, they need to treat a PC like a heart-lung machine. At least in terms of respecting the danger that misuse can bring.

A badly programmed VCR won't do anything other than tape over something or tape the wrong thing. A microvave (for the most part) is point-and-cook. A computer is far-too multi-purpose and essential to be treated like a run-of-the mill appliance.

I'm not saying all casual users need to get certifications, but having a higher expectation of responsibility wouldn't hurt.

BUT, on the flipside, soft- and hardware makers need to be held to higher standards. Cars have to meet government standards, as do medical devices. PCs need to, also!

GTRacer
- Who do you want to DDoS Today?

Re: The book is missing "dummies" in the title

[two_socks]

Too many people lack common sense.

No, they don't. They just don't (and/or don't want to) understand all the inner workings of technology they use every day.

Considering that most of these people have to use computers at work on a daily basis, and probably use them at home at least every few days, isn't refusing to learn about the technology, by definition, lacking common sense?

Me no want to read book...

[Mr. Certainly]

Wait...read a book?

*shudders*

Why can't they be more like Dell and have a 1 sheet poster with cute pictures telling us how to setup our computer?

Honestly, the majority of computer users -- Joe6Pack&SoccerMom (TM) -- are stupid. They don't read the manual to a machine that is more complex than their automobile.

We're not asking the normal user to be an expert in rebuilding their engine or to understand how a transister works...but seriously. Read a few books and learn where the hell the gas/brake/power button is located and what double clicking/opening programs/start menu/interet means.

Maybe it's M$'s fault for not providing an Operating System where flaws/problems/features don't cripple the non-savvy user.

Too bad no one makes a computer system for the non-savvy...something easy where there aren't 500 holes that need to be patched before you connect it to the internet...what did you say, Apple? Macs? Oh, I take that back then.

Re:Dummies Guides already do all this, better too.

[TheClarkey]

>Tom Greene writing something insightful and instructive?

>Well, that would be a first I suppose, him and Orlowski (sp?) are the two biggest problems the reg has IMHO.

Disagree, Greene is a great writer and has written excellent articles for the register explaining to newbies and power users how to secure linux You could say its "insightful" and maybe even "instructive"...

Security Book?

[hunterx11]

It's like a Service Patch for wetware!

Re:The problem with security books for the home us

[somegeekgirl]

Unfortunately, it's true. My father runs a small business and is constantly plagued by spyware, malware, viruses and so on. I've tried and tried and tried and tried to get him to switch to Firefox and Thunderbird. Even after running Spybot and showing him how much spyware he had on his system, he has yet to switch over. This isn't a matter of him not knowing how things work, or understanding the technical end of things. He simply doesn't want to deal with a process that he thinks (no matter what I tell him) is going to cost him a lot of time and energy switching over and getting used to. I would imagine that a lot of people are the same way. The flaws drive them nuts, but they're convinced that the solution is just too complicated and time-consuming to find.

Review of the review.

[veg_all]

The first couple of paragraphs consist of an intro and a
description of the preface.

The third paragraph describes the first chapter.

The fourth paragraph describes the second chapter.

The fifth paragraph describes the third chapter.

The sixth paragraph describes the fourth chapter.

The seventh paragraph describes the fifth chapter.

The eight paragraph describes the sixth chapter.

The ninth paragraph describes the seventh chapter.

The tenth paragraph notes there are indexes.

Overall this review is skeletal at best.

I give it a 3 out of 10.

Overall, this review is useful for nearly some people, not so useful for others. It's
certainly written in English, so more than half of Slashdot's
readership will feel a vague sense of familiarity.

Re: The book is missing "dummies" in the title

[jadenyk]

Do you really think it's a hardware issue? I think that we should leave hardware the way it is. Most people have no idea what's in the case of the computer and really, they have no need to know.

To use my car analogy again, the owner needs to know how to check the oil, tranny fluid, washer fluid and how to drive it safely. They don't need to know how to replace the drive shaft.

I think the government needs to regulate for safety, which, in computer terms, basically = security. The government should regulate Microsoft, Apple, SCO, etc. They should regulate AIM, Yahoo, Gain, etc... When you have Wind...erm...I mean Security Holes on your machine, you can fall victim to something like identity theft or, you could be used in part of a larger attack on another server.

I think most users would be "safe" and happy to leave replacing HD's or upgrading RAM to the "mechanics". The users who want to learn, well, it's much like a car - get in there and do it.

My limited experience

[truthsearch]

Unfortunately I use Windows at work. I use WinPT and Putty frequently. They're great apps, although they're a bit unpolished. I know little of networking and security and have no problems using them. But I'm a developer. I think an average user would have a problem using either. They're both for people who know what GnuPG and OpenSSH are and how to use them. They don't hide the details, which is a good thing in general, but hard for beginners. I think an average user might get by with WinPT since it adds a toolbar button to Outlook. Luckily Putty is for secure terminal sessions and FTP so it's unlikely an average user would need to bother with it.

Impact

[maximilln]

I don't think that it's a problem to demonstrate the advantages of security. Everyone knows the advantages of security. The difficulty is demonstrating impact. The vast majority of people, since they don't understand computers, feel that the basic knowledge of how to crack security is enough of a deterrant and lock in and of itself. The general need for additional security measures is perceived to be paranoia.

Unless there's a widespread and media popularized outbreak of identity theft, or computer hijacking, or people who can't check their e-mail or browse the web, then computer security will continue to be perceived as a topic of paranoia.

Currently the impact of computer insecurity is considered to be an annoyance. Extrapolated damages of corporate insecurity are given the same regard as the extrapolated damages of trading mp3s. Until authorities take a tough stance on abusive network activities (spam, browser hijacking, unwanted pop-up advertising, unauthorized collection of consumer data) then the general populance will continue to accept a loose attitude towards computer security.

The fact is that insecurity is profitable as a business. There's no real motivation to protect the consumers so why should the consumers waste effort protecting themselves?

Re: The book is missing "dummies" in the title

[swv3752]

It is more like a car or boat. It needs regular maintance; while misuse is not lethal yet, it can have legal ramifications; and a certain amount of training is needed to just use them.

BTW, PCs do meet certain standards, as electrical devices they need to meet certain FCC regs, of course this is not much different than an FM stereo...

Re: The book is missing "dummies" in the title

[Dego]

Dude you are taking your computer far too seriously. Heart-lung machine? Go outside.

Network monitoring

[flakac]

Chapter Four is about using common tools, like Ethereal, Netstat...

If you're talking about Joe User, you need to stick to what works under Windows. Last time I checked, Ethereal on win32 platforms only worked on LAN (eth) adapters and not dialup connections. If you've got a cable modem or DSL hooked up via an ethernet adapter, then it's a viable option. I'll agree about netstat, but I really don't think I'd be able to teach my a non-technical person how to interperet the output -- even given a book with examples, a non-techie really doesn't stand much chance tracing down what programs have what ports open.

As far as monitoring open connections on a win32 box, I'd heartily recommend TCPView. It's capable of printing out information on all connections, their states and what processes they're associated with. Very powerful tool, and I can talk my mom through using it over the phone, even sending my the results via email.

Re: Using PC's like appliances

[Alwin Henseler]

The average person treats a PC like a VCR, as an appliance.

I suppose that is true for, say, 90% (pick your number) of users? You can try to change that, or accept it.

Changing that means: educating users. For some limited groups that might work, but I'd say experience shows that for Joe average, it doesn't. Average users, for the most part, aren't gonna change their behaviour, they're just gonna keep on browsing random websites, clicking on random e-mail attachments, pop in random disks, and run random binaries.

Accepting that, means: consider a PC an appliance. Let maintenance be done in ways that are possible to do for a normal user, but might just as well be done by third parties (automatic updates is one way). So a possible solution would to be to create OS'es that make a PC behave such that it's safe to run random binaries, pop in random disks, click on random e-mail attachments, without worries about screwing up the system.

Current PC security ultimately depends on trusting the user, assuming that he/she knows what he's doing. I'd say, experience shows that for those 90% of Joe average, that trust is misplaced. For a user sitting behind a PC, it's just too easy to change essential aspects of the OS. Maybe some other security model would make more sense?

Re:The problem with security books for the home us

[Anonymous Coward]

I sure as hell hope that the average user is concerned with his brakes functioning!

Re: The book is missing "dummies" in the title

[Anonymous Coward]

the government needs to regulate

Just what we need, more Gov't regulation. Because they do such wonders with everything else that they lay their hands on! If we get Gov't regulation of comp security I can guarantee that we'll shortly thereafter end up with all kinds of other government intrusions into the IT world, like a tax on email for instance.

Re:The problem with security books for the home us

[chris_mahan]

Tell him you'll not help him with his computers anymore until he uses firefox+Thunderbird.

Next time his machine crashes and stays down, tell him you don't wanna hear about it.

It's cold, but if my friend told me his car's engine died because he wouldn't fix the clutch, after I'd told him what would happen if he didn't fix it, then I would just shrug and mutter: "I told you so", and let him buy a new one.

You know, people don't care about security because it does not cost them enough.

Charge $300 per hour for computer security repair. If they balk at the price, tell them to go elsewhere.

Top down security.

[Anonymous Coward]

"We have tried to explain both nicely and in the "Just do this and shut up" way. "

Unfortunately there's no "stick" to your "carrot".

If so and so introduces a virus? Will they get penalized? If so and so breaks a multi-million dollar piece of equipment? Will they get penalized? If so and so leaks details of a contract to competitors? Will they get penalized?

"Thats not my job"

This isn't so much a bad person as it is bad managment? Is managment walking the walk? If so then everyone else should already be "secure". How so? If securities important to them, they will take the steps to make it important to everyone else that "still works there".

Re:The problem with security books for the home us

[sp0rk173]

The only people with common sense (like us) go online to get info for free.

If only a small percentage of the total internet userbase "go online to get info for free", then how precisely is that common sense? It's certainly isn't very common. It's sensical, I'm not doubting that, rather what I'm saying is, common sense is standardized by the massses - it's what most people do. It's common. On the internet, common sense just happens to be ruled stupidity/laziness. Smart internet use, unfortunately, isn't common sense. It's the exception to the millions of ignorant users out there.

Re:The problem with security books for the home us

[Anonymous Coward]

Macs are. Buy a Mac!

You forgot one...

[argent]

Know what a firewall is and how to configure it. Know not to run executable code unless you trust the source. Keep your machine up to date, and scan for viruses reguarly.

You forgot: "Don't use Internet Explorer or any version of Outlook." And that should have been the first one on the list.

The "dont run executables" is a tricky one under Windows

Try this variant: "Don't open any file you receive in email unless it's obviously some file you were already expecting that person to send you".

Re: The book is missing "dummies" in the title

[Slime-dogg]

heh, no... You're dumb if you can't speak.

At least, that was the original meaning of the word.

Re:The problem with security books for the home us

[cammoblammo]

...if my friend told me his car's engine died because he wouldn't fix the clutch...

Don't mean to sound like a troll, but how do stuffed clutches kill the engine? I can see how it's possible, but how common is it?

Having said that, it's been a while since I had the chance to do so much as change oil. My work gives me a car (Good Thing) but it's automatic and I'm not allowed to do any more than refill the window washer reservoir. All that stuff I used to know...

Actually, their computer use policy is much the same. Do MS license cars?

Re:Dummies Guides already do all this, better too.

[GuyFawkes]

A quote from Mr Greene himself, speaking about himself.

"I loathe Microsoft, adore Linux, loathe Feds, adore soldiers, loathe cops, adore firefighters"

yeah, I can see why slashdotters like the guy, the first 5 words alone are enough...

Fact is _I_ have never seen anything insightful or instructive from his pen, mainly perhaps because I have never seen anything original from his pen, it all appears to be stuff he has read elsewhere (same places as me perhaps) and then reworded and revamped himself... this might equate to "all my own work" in academic thesis circles, but that is not the same thing... I have no argument that he is a good source for a synopsis.

Re: The book is missing "dummies" in the title

[hitmark]

personaly i find the dummies series a nice read. sure the titles are a bit wack but your looseing out on some nicely layed out info on the basis that you want to look more 1337 (did i just use that word/number?) then you may be...

replying to myself, re linux security

[GuyFawkes]

Fact is green's articles on linux security are IMHO a joke, I have been asked the same question, any MY answer was thus.

"Get yourself a laptop, cpu not too important but make sure it has at least 512 meg of ram, pull the hard disk and sell it on ebay, now get yourself a couple of usb flash disks, make sure everything written to them is STRONGLY encrypted, now stick a 802 card in the pcmcia slot, now stick a knoppix live-cd in, now go somewhere where there is "war" type access and only then boot it up and do your thing..... you are now as secure as it gets, until someone with enough power says the thing that makes you give up the encryption key to your usb sticks."

_anything_ less than this simply is not secure.

Re: The book is missing "dummies" in the title

[hitmark]

more like a lack of time and interest in keeping up to date with the latest exploit news, the latest viruses and so on.

this may offend a lot of users but i think we would be better of if most of the net was behind a freaking big firewall/proxy and where all traffic across or behind said firewall/proxy was checked for viruses and similar stuff. sure it shooting a big hole in the freedom of the net but its either or.

or we can start to ship console like boxes where the os and office apps are put on a cd or dvd as read only data and where the os dont allow for any app to be run of any rw media (or if they are, they should be sandboxed to hell and back. like most proper java apps are). that way there is nothing for the viruses to grab hold of. and if the customer signs up for getting a updated cd/dvd mailed to them ever so often they dont have to go into the minefield that is the net to get the latest updates. just pop the latest disc into the drive and you have spreadsheet, wordprosessor, mail and web at your service. and if you want to play games? eject the disc, insert game and the game starts.

basicly im talking about a extreme version of the xbox here...

sure its nothing a power user would be happy with but atleast it would keep the viruses at bay...

Re:The problem with security books for the home us

[chris_mahan]

It stresses the metal of the engine because of the rapid change in torque load. When the engine is stressed, things break. it can develop oil leaks, break seals, knock out valves, etc.

It's not that common because without a working cluch, generally the car won't go, so it gets fixed. But a slipping clutch can stress the engine.

Waiting for Knoppix for the "average user"

[AYeomans]

I wish someone would produce a live-CD (like Knoppix) oriented for that "average user".
Viruses? Spyware? Bad installs? Not a chance of writing to the CD. Problems? Just restart.

I'd like to be able to recommend a disk - IMHO Knoppix is almost there, but needs a few less alternative programs (e.g. browser, mail) and a few more easy-setup programs (for network, ISP, email) - plus the "Dummies Guide" book.

Try the sample chapter

[AYeomans]

found here. It does exactly what you ask, though for Mozilla rather than Firefox.

Re: The book is missing "dummies" in the title

[Bert64]

The hardware has to meet certain standards, but the software does not... 99% of the problems with todays computers is caused by bad software.. theres rarely something wrong with the hardware.

Re: The book is missing "dummies" in the title

[Bert64]

Well, since corporations are afforded the same, or often more, legal rights as people... Insecure computer(s) could quite easily kill a corporation, either by leaking secrets, by being used for denial of service etc... Surely, if corporations have the same rights as humans, this would be considered murder.
It's also possible you could kill a human using an insecure computer, you could manipulate police computers to plant evidence and place someone on death row, or you could take control of a computer controlled device that has peoples lives in it's hands, such as an aircraft.

Re:The problem with security books for the home us

[cammoblammo]

I'm pretty glad to say that that was more or less what I thought would happen. I haven't lost it yet!

Re: The book is missing "dummies" in the title

[GTRacer]

Ha-ha, very funny!

I never meant too imply I consider my machine as essential as a heart-lung machine. I was just illustrating that the risks in improper use, maintenance or design are more catastrophic for PC's than for washing machines.

And I DO go outside - twice a day in fact when I have to go to work and back. But that's about it ;)

GTRacer
- Not alabaster or cream

Re: Using PC's like appliances

[GTRacer]

Well, when you get down to it, probably 75 or 80 percent of people treat their cars as an appliance. So since most people can't be bothered to check on things BEFORE the breakdown, many states and governments do the checking for them during scheduled inspections for tag renewal.

I don't expect to see more l33t home users. What I want to see is something along the lines of PC inspection stations or checkups where every so often users have to have the machine scanned for common and new vulns, and for patch compliance.

I know this is getting into Big Brother tinfoil hat territory, but I'm getting tired of being hosed by stupid or malicious people taking advantage of end-user trust.

GTRacer
- Spyware REALLY sucks!

Re: The book is missing "dummies" in the title

[Phisbut]

more like a lack of time and interest in keeping up to date with the latest exploit news, the latest viruses and so on.

Keeping up-to-date for the average user really isn't all that hard.

I'm gonna play devil's advocate here, but Microsoft does patch a whole lot of security holes with Windows Updates. How many of those viruses/exploits that they talk in the news also say "It affects unpatched Windows systems" or "Users should download the latest Windows Update to stop being vulnerable".

If the average user even slightly cared about 3 things, overall security would be much much higher : Automatic Windows Update, Firewall, Anti-Virus software.

Together, those 3 things can probably stop 90% of all attacks/hacks. Refusing to try and learn that is the car equivalent of refusing to understand how the brake pedal works.

Re: The book is missing "dummies" in the title

[hitmark]

but as it have been shown, getting a newly installed system to update of the net is a bad idea as the very exploits its suppoed to get protection againt hits your system while your getting the updates to stop them...

yes there is systems like slipstream but most home computers theses days as shipped with recovery cd, not windows install cds...

Re: The book is missing "dummies" in the title

[Dego]

Well, yes. But the book and the thread are about home computers.

The problem is massive cluelessness.

[Xenographic]

Even if a large % of users have backdoors, etc. installed, what % of those users have something worth stealing?
-----

You're talking out your ass or you'd know why those home users get targetted. The attackers don't generally want what's on the computers, they want to use the computers themselves.

They use them to send spam, hack even more computers, store files, etc. If your computer is used as a significant part of an attack (e.g. they use it to hack a DOD computer), you can expect the Feds on your doorstep. If they store illegal files (e.g. child pornography, for which there is strict liability--if you possess it, you're guilty of a crime, do not pass go, do not collect $200) on your computer, you can very well be hosed, too. You could say that that's hypothetical, but all of these have happened.

Granted, in the child pornography case, the evidence that there was a backdoor on the computer was enough to cast doubt on whether it's owner actually "possessed" the illegal files. However, if you look at cases like Steve Jackson Games vs. the US Secret Service, you'll see that even if you're not found to have any tertiary legal liability for those using your computer or network unlawfully, you CAN still suffer for it. Granted, I hope that the government is smarter in its execution of search warrants now than it was when Steve Jackson was made to suffer, but still you have to realize that being involved in any such case is not fun.

And yet you illustrate why we need to give more of a security education to home users. It is for exactly this reason I give free lectures on this at my local public library, and I encourage anyone else with security knowledge and a convenient forum to do the same.