IANARS (I am not a rocket scientist), but I wonder if NASA could start building these in relative volume (10-20 or so). Then, combined with a MIRV-like rocket (that would eject each rover's landing pod at a calculated latitude/longitude), this could get more of the surface of Mars studyable close up.
It would be an excellent (and relatively inexpensive... emphasis on relatively) way to study Mars as well as other planet's moons in great detail.
Factoring out the Linux/MS opinions, maybe people should not be connecting their machines directly to the Internet in the first place (although not being able to connect and use a paid for service is a bit harsh). If there were a law about computer security, not directly connecting machines to the Internet would be one of the first points in it, next to not running unknown executables as root or administrator that are received via IM or E-mail.
Barring honeypots and routers with a hardened attack surface, I don't understand why anyone would connect any machine directly to the Internet without some type of hardware firewall. This applies for not just Microsoft operating systems, but any type of OS, be it Linux, BSD, MacOS, AIX, Solaris, IRIX, HP-UX, Ultrix, Tru-64, OS/2, VMS, or any other OS with a TCP/IP stack. Its just asking for trouble, because remote exploits are not just limited to Windows.
One idea that would solve the problem for everybody involved would be having Lund offer NAT-ready firewalling routers with their Internet offerings (either for free, or for a small fee.) This way, people's machines are protected from Internet attack (which means fewer zombie boxes on the ISP's network), and people can use the Internet regardless of operating system, because the router does the DHCP handshaking for internal machines (or even that can be shut off and people use their own fixed set of IPs.)
I thought a virtual keyboard would be the thing too, until I read on the anti-malware lists that almost all modern keyloggers also take compressed screenshots of when and where you click your mouse. Maybe a virtual keyboard that would work with mouseovers (hover the mouse for a couple seconds above each key) would be the ticket, as that would require FRAPS-like video monitoring by spyware (which would be a noticable bandwidth hit), and did not generate keypresses, but sent the mouseovers directly to the server.
A lot of on screen keyboard utilities generate keypresses that go through the keyboard buffer, where the OS, and malware can scoop them up, so having a utility that was directly connected to either an application, or just shipped the mouse locations directly to the server for parsing would be best.
This seems like a rather lame, feel good proposal. "Emailing spyware" and having it be a success is a lot more complicated than it sounds.
This assumes a lot. I'm pretty sure most stuff emailed this way would be utterly foiled by someone who uses Mail.app, mutt, elm, pine, Mailwasher Pro, or even Thunderbird. If the email is successful as a law enforcement trool, black hat criminal organizations will be going head over heels to get a copy so they can disassemble it, and use it for their own schemes.
Akamai not just does the networking for banks, but I'm pretty sure they handle a lot of high volume services that if tampered with would mean a lot of damage. Microsoft Update/Windows update is hosted on their network, for example.
Most banks pay attention to their IT infrastructure, and if a compromise happened, heads would roll. However, almost always, there would be some way of showing due diligence [1] so nobody goes to prison or major lawsuits don't get filed. On the other hand Akamai's whole line of business is dependent on how secure their servers are, so I'm pretty sure they have a lot more manpower and resources dedicated to that (as a percentage), compared to a bank or credit union. Security is Akamai's reputation, where a breach with them would be as catastrophic and company destroying as having Verisign end up with its root signing private keys for anyone to download on a FTP server.
From what I read, Akamai does a very good job of keeping their stuff locked down.
[1]: HIPAA/SOX/other regs are another can of worms, and are almost as daunting (if not more so) for IT departments as keeping the infrastructure maintained.
Banks, especially in the US, need a system like above for authentication, where its not just a single username and password protecting someone's accounts from total destruction. Some banks now use a system where you type in your username, it asks one of several personal questions, then your password, but that doesn't protect much against a keylogger, as an attacker can keep trying the questions until he/she finds the one that gets presented with an answer in the keysniffer's output.
PayPal, eBay, and Verisign offer a rebranded Vasco keyfob that one can use. Enter in username, tab to the password field, enter in your password, then append the six digit number from the Digipass Go 3 (the OEM name), and you are in. Though this is not as well engineered as a SecurID system, it still forces a would-be thief to have physical custody of the keyfob and the password to the account.
Some European banks use a system similar to the age-old one time password system found in BSD (S/Key or OPIE). You obtain a list of one time passwords on a piece of paper that you scratch off in the mail, and every time you log in, you scratch off the next one on the list. This can be attacked (there are some targeted phishing attacks to try to get users to type in multiple lines off the OTP paper), but it keeps a compromised user PC from becoming an entry point for an attacker.
Lastly, there are always Aladdin eTokens that store a private client certificate. This is one of the more secure ways, because there are zero passwords used. The server asks the client (any web browser pretty much) for a certificate similar to how a SSL enabled web browser asks the web server for its cert, the web browser passes the signing request to the eToken, the eToken signs it on the physical card (the private key never leaves the eToken), and the server checks the validated cert against the user list and lets the user in. For academic places (universities), this is one of the absolute best ways to do things.
All and all, probably the best solution would likely be a hybrid system, similar to an eToken NG-OTP keyfob, that allows a user to plug the token in and use it online with client certificates, or offline, typing the six digit number off the LCD screen.
Disclaimer: I don't work for Aladdin, RSA, or Vasco, but like their products.
Another issue is if the AI makes a wrong guess, assuming the pilot wants to "zig", when the pilot wants to "zig-zag" -- doing a multi-stage action. An example would be a driver swerving left and right abruptly to avoid a zombie on the highway.
I can perhaps see a car or plane's AI going into a "ready" state, perhaps doing a fast check of control systems in preparation for some action of the driver/pilot.
I am glad Retrospect is still actively being worked on. I help a number of non profit companies out, and Retrospect is by far the best application for backing up small and midsized networks out there.
Retrospect is one of a very few software products I've purchased multiple copies of, just because the product is so good. I rarely go out of my way and state to use a certain program explicitly, but I have had a lot of times when I was able to completely recover machines from hard disk failure using just a disaster recovery CD and an external drive with the backup set media.
Retrospect Professional and a USB external hard disk has kept a non profit organization(that I volunteer at occasionally) out of bankruptcy (or at least major financial trouble.) Their main computer (running XP and not connected to the Internet) that had all their financial records had a hard disk crash. Other than Retrospect's scheduled backups, the place had no recent backups of the machine or the financial data on it. Thankfully, I configured the machine about six months before the disaster where the machine automatically did a backup nightly. Restoring the machine to its old state was a relatively simple process of replacing the crashed hard disk, booting a disaster recovery CD I made "just in case" (which was stored in the "in case of emergency" file), plugging in the external hard disk, typing in the backup set password, and restoring the main volume.
I'm very glad EMC hasn't pulled the plug on Retrospect, as its the best utility for backing up SOHO LANs, bar none.
Disclaimer: I don't have any relation to EMC/Insignia/Dantz, just a very happy customer.
I like Spelljammer, mainly because its fairly uncommon, and its a rich source of campaign material. I wish it were not as overlooked as it is, because it provides a great alternative to the ho-hum planes walking that seems to be the standard these days. I hope WotC updates the Spelljammer sources too, so I won't have to translate rules, and do like what you (SteveFoerster) stated, focus on the plot and storyline.
You are right about that. At level 1-2, one good lucky strike from an orc or skeleton may mean that a campaign goes back to "roll new characters" mode.
I have gotten around that in my DM-ing by having level 1-2 be more of quest related, granting exp when the players find each other, negotiate passage past guard patrols (and past bandits pretending to be patrols) into the first starting city.
Character death is a part of AD&D, but I try not to use it often (though I have to balance that, as I don't want the party unkillable either), because rerolling sucks and takes away from the story, as the party has to pick up the new character.
I know that having more levels is the "in" thing to do.
Originally, in AD&D First Ed, you hit level 20, there was a high chance that your DM would suck up your char sheet because your character was so powerful that it was a god, and not a minor one.
The first MUDs were somewhat based around that, when you hit the topmost level, you became an immortal. The level limit for "ascension" ended up being between 20-30.
As time went on, this limit climbed to 40, 50, then on some MUDs, even was as high as level 100.
Around 1999, MMOs came into the picture. UO didn't use a level based system, but EQ did. To keep players going, and the game interesting for people at the level cap, the original level 50 limit was raised to 60, 65, 70, now 75, and in the next major expansion 80. EQ2 similar, except the game is structured by tiers, starting at 50, then 60, now 70, and will be 80 come the next expansion. WoW too. Next expansion, level 80.
There is something lost in this climb for levels, to the detriment of everything else. In WoW, level pretty much is the gauge of your character's abilities, so a character that is level 70, that has crappy equipment is more often asked for groups/raids than a level 65 with excellent stuff.
I used to DM, and have been since First Edition AD&D. In campaigns, levels were there, but they were mainly a gauge of progress, of what difficulty I needed to make encounters. Characters had a lot more ways to progress and gain in power. They could gain reputation by pushing back orc scout parties, learn spells (In First Ed., magic items were VERY rare, and a +1 sword would be something that would be a 3-4 session campaign, but worth obtaining.), and perhaps travel, guarding trade caravans (or waiting until the caravan was alone, then sacking the people on it.) As the party grew, they became impressed into a local ruler's service as a scout group for taking care of enemies and seeking relics, then the party eventually was able to start their own kingdom after a number of fights, and having to not just go head off places, but make sure the kingdom was in good order while they were gone.
I like levels at a low number. For a lot of intents and purposes, 20 is enough. Epic levels in third edition and up never really played a part, because at that level of character power, I'd have to move the party off of the usual medieval fantasy world into either different spheres (Spelljammer), or do like everyone and their brother does, and start plane hopping, which meant that it wasn't really my campaign world, but just using the Planescape sourcebooks pretty much verbatim.
Maybe I am an old timer, but I try to get player characters to grow "horizontally", and focus on getting reputation, gear, and status with their class guilds, rather than climb the numbers with regards to level. When getting status and doing missions, the XP comes in its due time.
If one has the cash, there is a decent alternative for longer and longer passwords changed more frequently. SecurID, though expensive, can drop in and work in almost any computing environment. Aladdin eTokens are excellent too (one can use client certificates with them, so users can use SSL based web pages). Finally, one can use a security key like the one that Vasco OEMs to Ebay/Paypal which works in the OpenID framework.
The nice thing is that for staff and faculty, one can give them eTokens, while students can use the old username/passwords.
I have seen some third party endpoint protection you can install that works on XP Home, like www.portprotector.com. For enterprises, I am not sure about something easily deployable.
Thin clients are useful, but a lot of places can get by with desktops by doing the following (and this is a bit extreme, but secure):
1: Using Windows, and having them protected with Deep Freeze, or the Shared Computer User Toolkit, both roll back a machine to a known good state on reboot.
2: Have the machines on a private LAN with the only connections to the outside world are connections to a WSUS server (for windows updates), a domain controller (for being able to log on) and two RDP servers. One RDP server allows for Web browsing to the outside as a normal user on a terminal server, and one RDP server allows for access to Outlook and other programs for internal use. Should some malware find a way to both get access at that user, then escalate to admin on the public Web browsing box, it won't be able to affect critical internal data.
Deep Freeze seems to keep a change journal (where the original data is left untouched).
If you do a cypher/w on a Deep Freeze protected (frozen) disk, eventually it will say it runs out of space and will not allow any changes to the drive. Rebooting fixes this back to normal.
Deep Freeze is a lifesaver in a university environment. I've seen library machines absolutely crippled by spyware. A power cycle later, the machine is pristine and ready to go. Of course, there are ways to bypass it, but Faronics seems to do well in blocking those attacks, and if one forces the guest user to run as a regular user (not an admin), there is no way to access the critical system files.
MS also has a free utility for XP (Shared User Computer Toolkit) that does similar, although it does require some repartitioning, and the users have to run as users with no admin privs (which may be an issue for a lot of software packages.)
If one can't use thin clients, Deep Freeze in a university environment is definitely a good solution, as one can make a standard image, install it, then "freeze" the machine, and pretty much be assured that machines will be spyware free. Couple this with a system policy to have machines that have not been used in 5-10 min to autoreboot every three hours, and one can be pretty much assured that students sitting down to do paperwork are likely on a spyware-free box.
This is similar to martial arts experts. If a Joe Sixpack got lucky and mauled a black belt in a fight, a subsequent civil (maybe criminal) action would be laughed at. If the situation was reversed, the black belt will likely face some jail time (even if he was the one that was jumped) and a big personal injury lawsuit.
How about universities use the time tested way of doing things, and have all the sensitive data put on a secure cluster. Then, if people want access to the databases, they can remote in via RDP, Citrix, or some X based protocol, depending on OS. Backups can be done via something like TSM, Networker, or some enterprise level solution which supports end to end encryption from the daemon (or service) running on the machine through the network, all the way to the disks and tapes.
This is basic separation of functions. You have your central IT stuff that is critical to the university (personal info, grades, etc) locked down both physically and network wise, then you have your usual campus networks (resnets, wireless) that have access to the Internet and university resources.
Going after removable mass storage devices (USB flash drives, iPods) won't do much good. Students are smart and will find some way to get around it. Instead, keep the confidential data behind a quality security system (solid firewall, physical security), etc.
BRU is a great utility, and has done decent backups. I remember it in the sort of heyday of IRIX, using it to dump stuff stored on indigo machines to tape.
However, it is sort of aging too. It doesn't do encrypted backups, and this doesn't sound like a big thing, but in these days of HIPPA, SOX, and other corporate regulations, having encrypted backup tapes means a quiet report to the local police about stolen hardware, versus having to report to the press data loss (if in California, and the tapes contain personal data), and the legal (both civil and criminal) consequences. BRU does encryption from the client to the server, but it really needs an encryption layer before the data hits the tape. Preferably, it should have a key management layer where multiple keys can be used.
BRU also doesn't work on Windows, as far as I can tell.
Retrospect is a venerable (sometimes slightly quirky) product, but it offers features that almost no other backup programs provide, unless you go to Legato Networker, IBM's TSM, or another enterprise-wide backup system that costs a large amount of cash.
For laptops, (disclaimer: I'm not in any way affiliated with Dantz, but have had very good success with their products, ever since Retrospect 1.0 on Macintosh System 6 in 1989.) I do recommend Retrospect. It can back up open files, has solid encryption, can back up to almost anything, from hard disks to tapes and network shares, and can back up SQL servers. If you can get a laptop to VPN in, I'm pretty sure, you can get Retrospect to back it up (it used synthetic full backups, so only changes get copied over the network.)
Another idea, if you can configure a VPN, is to put all the MSDE data that the laptop users use on one Windows 2003 machine, and run SQL Server and Terminal Services. Then, you can focus on backups of that machine (Retrospect has a lot of options for keeping SQL Server backed up), and less on worrying about keeping client files copied.
Its less of liability (as in suing a company if something happens), rather its a target where fingers can be pointed at.
Scenario 1: Machines with Commercial OS "A" get breached. IT department shows that the OS, database, and other security measures are commercial, by known brands. Corporate rep gets tarnished, but because the company did due diligence with a solid paper trail, there is a smaller attack profile by potential plaintiffs.
Scenario 2: Machines with a non-commercial OS "B" get breached. IT department has to find a reason why their "homebrew" solution was implemented, and explain this to shareholders, potential plaintiffs, and the SEC guys. Company gets sued into oblivion, and people go to prison for violating corporate regulations (mainly for not observing "due diligence" with consistant security precautions.)
This has little to do with the OS, this has to do with spending the cash to get the OS passed by independant auditors, so legal eagles are happy. In larger companies, technological solutions are just one part of the solution. One must have a paper trail that can stand audits, both internal and external.
I'm glad RedHat had the money and wisely spent it to get RHEL certified here.
I'm for a "corporate" or "enterprise" version of Linux, because it gets Linux more mindshare. Its a lot easier to adopt an OS if you know the "big boys" are running it, than if its not that well known or proven in the enterprise.
I've posted about this on other threads, but having a distro of Linux that has certifications like Common Criteria, FIPS, and others is always a plus. This allows companies to show that they are doing due diligence and satisfy the legal eagles.
Its a noble effort, but in an IT shop, if I went to use a third party patch bundle that isn't cryptographically signed or vetted by a known company, I would be in a lot of legal hot water should a security breach occur. I don't see the AutoPatch people using PGP either, so I have little assurance of tamper resistance.
If the AutoPatch people did sign their packages with either PGP or get a MS code signing key, things would be different, however a code signing key does cost some cash.
I like service packs because I can slipstream them into a main OS CD with not much effort. This helps assure me that from the second I stick in the OS CD for an install, the machine is relatively up to date on security issues.
For example, with the old Windows XP CD I have from 2001 that has no service packs, the machine has to be initially installed physically disconnected from the Internet [1], the firewall turned on, then SP2 and other stuff run on it from "trusted" DVD media, or a read-only USB stick. With XP SP2, the firewall defaults to on, so there is less of a need to isolate the machine until its at a current patch level (although I do anyway until I get the basic AV/anti-malware/software firewall installed.)
Maybe MS can compromise, do a monthly rollup of patches that is easily slipstreamable, so I can make an OS CD that would be current with fixes to a certain date.
[1]: Technically disconnected from the LAN. Connecting anything directly that isn't hardened against attack (router, BSD box, etc.) is just asking for trouble.
This shows that what is needed is more research on higher capacity batteries, from the capacitor type which charges in seconds, to having exponentially more energy density per pound.
Its a lot easier to engineer a power distribution and charging electrical system, compared to having multiple systems to handle highly explosive gas as well as an electrical system. Its also a lot easier to generate electricity, pipe it into a charging system, compared to the energy used to split water into H2 and O2.
I used to like fuel cells, and thought a H2 based economy would be a good thing, but I'm having second thoughts now, because once batteries are able to carry a respectable energy density, there is pretty much no need for carrying H2 around anywhere.
Slashdot Mirror
IANARS (I am not a rocket scientist), but I wonder if NASA could start building these in relative volume (10-20 or so). Then, combined with a MIRV-like rocket (that would eject each rover's landing pod at a calculated latitude/longitude), this could get more of the surface of Mars studyable close up.
It would be an excellent (and relatively inexpensive... emphasis on relatively) way to study Mars as well as other planet's moons in great detail.
Factoring out the Linux/MS opinions, maybe people should not be connecting their machines directly to the Internet in the first place (although not being able to connect and use a paid for service is a bit harsh). If there were a law about computer security, not directly connecting machines to the Internet would be one of the first points in it, next to not running unknown executables as root or administrator that are received via IM or E-mail.
Barring honeypots and routers with a hardened attack surface, I don't understand why anyone would connect any machine directly to the Internet without some type of hardware firewall. This applies for not just Microsoft operating systems, but any type of OS, be it Linux, BSD, MacOS, AIX, Solaris, IRIX, HP-UX, Ultrix, Tru-64, OS/2, VMS, or any other OS with a TCP/IP stack. Its just asking for trouble, because remote exploits are not just limited to Windows.
One idea that would solve the problem for everybody involved would be having Lund offer NAT-ready firewalling routers with their Internet offerings (either for free, or for a small fee.) This way, people's machines are protected from Internet attack (which means fewer zombie boxes on the ISP's network), and people can use the Internet regardless of operating system, because the router does the DHCP handshaking for internal machines (or even that can be shut off and people use their own fixed set of IPs.)
I thought a virtual keyboard would be the thing too, until I read on the anti-malware lists that almost all modern keyloggers also take compressed screenshots of when and where you click your mouse. Maybe a virtual keyboard that would work with mouseovers (hover the mouse for a couple seconds above each key) would be the ticket, as that would require FRAPS-like video monitoring by spyware (which would be a noticable bandwidth hit), and did not generate keypresses, but sent the mouseovers directly to the server.
A lot of on screen keyboard utilities generate keypresses that go through the keyboard buffer, where the OS, and malware can scoop them up, so having a utility that was directly connected to either an application, or just shipped the mouse locations directly to the server for parsing would be best.
This seems like a rather lame, feel good proposal. "Emailing spyware" and having it be a success is a lot more complicated than it sounds.
This assumes a lot. I'm pretty sure most stuff emailed this way would be utterly foiled by someone who uses Mail.app, mutt, elm, pine, Mailwasher Pro, or even Thunderbird. If the email is successful as a law enforcement trool, black hat criminal organizations will be going head over heels to get a copy so they can disassemble it, and use it for their own schemes.
Akamai not just does the networking for banks, but I'm pretty sure they handle a lot of high volume services that if tampered with would mean a lot of damage. Microsoft Update/Windows update is hosted on their network, for example.
Most banks pay attention to their IT infrastructure, and if a compromise happened, heads would roll. However, almost always, there would be some way of showing due diligence [1] so nobody goes to prison or major lawsuits don't get filed. On the other hand Akamai's whole line of business is dependent on how secure their servers are, so I'm pretty sure they have a lot more manpower and resources dedicated to that (as a percentage), compared to a bank or credit union. Security is Akamai's reputation, where a breach with them would be as catastrophic and company destroying as having Verisign end up with its root signing private keys for anyone to download on a FTP server.
From what I read, Akamai does a very good job of keeping their stuff locked down.
[1]: HIPAA/SOX/other regs are another can of worms, and are almost as daunting (if not more so) for IT departments as keeping the infrastructure maintained.
Banks, especially in the US, need a system like above for authentication, where its not just a single username and password protecting someone's accounts from total destruction. Some banks now use a system where you type in your username, it asks one of several personal questions, then your password, but that doesn't protect much against a keylogger, as an attacker can keep trying the questions until he/she finds the one that gets presented with an answer in the keysniffer's output.
PayPal, eBay, and Verisign offer a rebranded Vasco keyfob that one can use. Enter in username, tab to the password field, enter in your password, then append the six digit number from the Digipass Go 3 (the OEM name), and you are in. Though this is not as well engineered as a SecurID system, it still forces a would-be thief to have physical custody of the keyfob and the password to the account.
Some European banks use a system similar to the age-old one time password system found in BSD (S/Key or OPIE). You obtain a list of one time passwords on a piece of paper that you scratch off in the mail, and every time you log in, you scratch off the next one on the list. This can be attacked (there are some targeted phishing attacks to try to get users to type in multiple lines off the OTP paper), but it keeps a compromised user PC from becoming an entry point for an attacker.
Lastly, there are always Aladdin eTokens that store a private client certificate. This is one of the more secure ways, because there are zero passwords used. The server asks the client (any web browser pretty much) for a certificate similar to how a SSL enabled web browser asks the web server for its cert, the web browser passes the signing request to the eToken, the eToken signs it on the physical card (the private key never leaves the eToken), and the server checks the validated cert against the user list and lets the user in. For academic places (universities), this is one of the absolute best ways to do things.
All and all, probably the best solution would likely be a hybrid system, similar to an eToken NG-OTP keyfob, that allows a user to plug the token in and use it online with client certificates, or offline, typing the six digit number off the LCD screen.
Disclaimer: I don't work for Aladdin, RSA, or Vasco, but like their products.
Another issue is if the AI makes a wrong guess, assuming the pilot wants to "zig", when the pilot wants to "zig-zag" -- doing a multi-stage action. An example would be a driver swerving left and right abruptly to avoid a zombie on the highway.
I can perhaps see a car or plane's AI going into a "ready" state, perhaps doing a fast check of control systems in preparation for some action of the driver/pilot.
I am glad Retrospect is still actively being worked on. I help a number of non profit companies out, and Retrospect is by far the best application for backing up small and midsized networks out there.
Retrospect is one of a very few software products I've purchased multiple copies of, just because the product is so good. I rarely go out of my way and state to use a certain program explicitly, but I have had a lot of times when I was able to completely recover machines from hard disk failure using just a disaster recovery CD and an external drive with the backup set media.
Retrospect Professional and a USB external hard disk has kept a non profit organization(that I volunteer at occasionally) out of bankruptcy (or at least major financial trouble.) Their main computer (running XP and not connected to the Internet) that had all their financial records had a hard disk crash. Other than Retrospect's scheduled backups, the place had no recent backups of the machine or the financial data on it. Thankfully, I configured the machine about six months before the disaster where the machine automatically did a backup nightly. Restoring the machine to its old state was a relatively simple process of replacing the crashed hard disk, booting a disaster recovery CD I made "just in case" (which was stored in the "in case of emergency" file), plugging in the external hard disk, typing in the backup set password, and restoring the main volume.
I'm very glad EMC hasn't pulled the plug on Retrospect, as its the best utility for backing up SOHO LANs, bar none.
Disclaimer: I don't have any relation to EMC/Insignia/Dantz, just a very happy customer.
I like Spelljammer, mainly because its fairly uncommon, and its a rich source of campaign material. I wish it were not as overlooked as it is, because it provides a great alternative to the ho-hum planes walking that seems to be the standard these days. I hope WotC updates the Spelljammer sources too, so I won't have to translate rules, and do like what you (SteveFoerster) stated, focus on the plot and storyline.
You are right about that. At level 1-2, one good lucky strike from an orc or skeleton may mean that a campaign goes back to "roll new characters" mode.
I have gotten around that in my DM-ing by having level 1-2 be more of quest related, granting exp when the players find each other, negotiate passage past guard patrols (and past bandits pretending to be patrols) into the first starting city.
Character death is a part of AD&D, but I try not to use it often (though I have to balance that, as I don't want the party unkillable either), because rerolling sucks and takes away from the story, as the party has to pick up the new character.
I know that having more levels is the "in" thing to do.
Originally, in AD&D First Ed, you hit level 20, there was a high chance that your DM would suck up your char sheet because your character was so powerful that it was a god, and not a minor one.
The first MUDs were somewhat based around that, when you hit the topmost level, you became an immortal. The level limit for "ascension" ended up being between 20-30.
As time went on, this limit climbed to 40, 50, then on some MUDs, even was as high as level 100.
Around 1999, MMOs came into the picture. UO didn't use a level based system, but EQ did. To keep players going, and the game interesting for people at the level cap, the original level 50 limit was raised to 60, 65, 70, now 75, and in the next major expansion 80. EQ2 similar, except the game is structured by tiers, starting at 50, then 60, now 70, and will be 80 come the next expansion. WoW too. Next expansion, level 80.
There is something lost in this climb for levels, to the detriment of everything else. In WoW, level pretty much is the gauge of your character's abilities, so a character that is level 70, that has crappy equipment is more often asked for groups/raids than a level 65 with excellent stuff.
I used to DM, and have been since First Edition AD&D. In campaigns, levels were there, but they were mainly a gauge of progress, of what difficulty I needed to make encounters. Characters had a lot more ways to progress and gain in power. They could gain reputation by pushing back orc scout parties, learn spells (In First Ed., magic items were VERY rare, and a +1 sword would be something that would be a 3-4 session campaign, but worth obtaining.), and perhaps travel, guarding trade caravans (or waiting until the caravan was alone, then sacking the people on it.) As the party grew, they became impressed into a local ruler's service as a scout group for taking care of enemies and seeking relics, then the party eventually was able to start their own kingdom after a number of fights, and having to not just go head off places, but make sure the kingdom was in good order while they were gone.
I like levels at a low number. For a lot of intents and purposes, 20 is enough. Epic levels in third edition and up never really played a part, because at that level of character power, I'd have to move the party off of the usual medieval fantasy world into either different spheres (Spelljammer), or do like everyone and their brother does, and start plane hopping, which meant that it wasn't really my campaign world, but just using the Planescape sourcebooks pretty much verbatim.
Maybe I am an old timer, but I try to get player characters to grow "horizontally", and focus on getting reputation, gear, and status with their class guilds, rather than climb the numbers with regards to level. When getting status and doing missions, the XP comes in its due time.
If one has the cash, there is a decent alternative for longer and longer passwords changed more frequently. SecurID, though expensive, can drop in and work in almost any computing environment. Aladdin eTokens are excellent too (one can use client certificates with them, so users can use SSL based web pages). Finally, one can use a security key like the one that Vasco OEMs to Ebay/Paypal which works in the OpenID framework.
The nice thing is that for staff and faculty, one can give them eTokens, while students can use the old username/passwords.
I have seen some third party endpoint protection you can install that works on XP Home, like www.portprotector.com. For enterprises, I am not sure about something easily deployable.
Thin clients are useful, but a lot of places can get by with desktops by doing the following (and this is a bit extreme, but secure):
1: Using Windows, and having them protected with Deep Freeze, or the Shared Computer User Toolkit, both roll back a machine to a known good state on reboot.
2: Have the machines on a private LAN with the only connections to the outside world are connections to a WSUS server (for windows updates), a domain controller (for being able to log on) and two RDP servers. One RDP server allows for Web browsing to the outside as a normal user on a terminal server, and one RDP server allows for access to Outlook and other programs for internal use. Should some malware find a way to both get access at that user, then escalate to admin on the public Web browsing box, it won't be able to affect critical internal data.
Deep Freeze seems to keep a change journal (where the original data is left untouched).
/w on a Deep Freeze protected (frozen) disk, eventually it will say it runs out of space and will not allow any changes to the drive. Rebooting fixes this back to normal.
If you do a cypher
Deep Freeze is a lifesaver in a university environment. I've seen library machines absolutely crippled by spyware. A power cycle later, the machine is pristine and ready to go. Of course, there are ways to bypass it, but Faronics seems to do well in blocking those attacks, and if one forces the guest user to run as a regular user (not an admin), there is no way to access the critical system files.
MS also has a free utility for XP (Shared User Computer Toolkit) that does similar, although it does require some repartitioning, and the users have to run as users with no admin privs (which may be an issue for a lot of software packages.)
If one can't use thin clients, Deep Freeze in a university environment is definitely a good solution, as one can make a standard image, install it, then "freeze" the machine, and pretty much be assured that machines will be spyware free. Couple this with a system policy to have machines that have not been used in 5-10 min to autoreboot every three hours, and one can be pretty much assured that students sitting down to do paperwork are likely on a spyware-free box.
This is similar to martial arts experts. If a Joe Sixpack got lucky and mauled a black belt in a fight, a subsequent civil (maybe criminal) action would be laughed at. If the situation was reversed, the black belt will likely face some jail time (even if he was the one that was jumped) and a big personal injury lawsuit.
How about universities use the time tested way of doing things, and have all the sensitive data put on a secure cluster. Then, if people want access to the databases, they can remote in via RDP, Citrix, or some X based protocol, depending on OS. Backups can be done via something like TSM, Networker, or some enterprise level solution which supports end to end encryption from the daemon (or service) running on the machine through the network, all the way to the disks and tapes.
This is basic separation of functions. You have your central IT stuff that is critical to the university (personal info, grades, etc) locked down both physically and network wise, then you have your usual campus networks (resnets, wireless) that have access to the Internet and university resources.
Going after removable mass storage devices (USB flash drives, iPods) won't do much good. Students are smart and will find some way to get around it. Instead, keep the confidential data behind a quality security system (solid firewall, physical security), etc.
BRU is a great utility, and has done decent backups. I remember it in the sort of heyday of IRIX, using it to dump stuff stored on indigo machines to tape.
However, it is sort of aging too. It doesn't do encrypted backups, and this doesn't sound like a big thing, but in these days of HIPPA, SOX, and other corporate regulations, having encrypted backup tapes means a quiet report to the local police about stolen hardware, versus having to report to the press data loss (if in California, and the tapes contain personal data), and the legal (both civil and criminal) consequences. BRU does encryption from the client to the server, but it really needs an encryption layer before the data hits the tape. Preferably, it should have a key management layer where multiple keys can be used.
BRU also doesn't work on Windows, as far as I can tell.
Retrospect is a venerable (sometimes slightly quirky) product, but it offers features that almost no other backup programs provide, unless you go to Legato Networker, IBM's TSM, or another enterprise-wide backup system that costs a large amount of cash.
For laptops, (disclaimer: I'm not in any way affiliated with Dantz, but have had very good success with their products, ever since Retrospect 1.0 on Macintosh System 6 in 1989.) I do recommend Retrospect. It can back up open files, has solid encryption, can back up to almost anything, from hard disks to tapes and network shares, and can back up SQL servers. If you can get a laptop to VPN in, I'm pretty sure, you can get Retrospect to back it up (it used synthetic full backups, so only changes get copied over the network.)
Another idea, if you can configure a VPN, is to put all the MSDE data that the laptop users use on one Windows 2003 machine, and run SQL Server and Terminal Services. Then, you can focus on backups of that machine (Retrospect has a lot of options for keeping SQL Server backed up), and less on worrying about keeping client files copied.
Its less of liability (as in suing a company if something happens), rather its a target where fingers can be pointed at.
Scenario 1: Machines with Commercial OS "A" get breached. IT department shows that the OS, database, and other security measures are commercial, by known brands. Corporate rep gets tarnished, but because the company did due diligence with a solid paper trail, there is a smaller attack profile by potential plaintiffs.
Scenario 2: Machines with a non-commercial OS "B" get breached. IT department has to find a reason why their "homebrew" solution was implemented, and explain this to shareholders, potential plaintiffs, and the SEC guys. Company gets sued into oblivion, and people go to prison for violating corporate regulations (mainly for not observing "due diligence" with consistant security precautions.)
This has little to do with the OS, this has to do with spending the cash to get the OS passed by independant auditors, so legal eagles are happy. In larger companies, technological solutions are just one part of the solution. One must have a paper trail that can stand audits, both internal and external.
I'm glad RedHat had the money and wisely spent it to get RHEL certified here.
I'm for a "corporate" or "enterprise" version of Linux, because it gets Linux more mindshare. Its a lot easier to adopt an OS if you know the "big boys" are running it, than if its not that well known or proven in the enterprise.
I've posted about this on other threads, but having a distro of Linux that has certifications like Common Criteria, FIPS, and others is always a plus. This allows companies to show that they are doing due diligence and satisfy the legal eagles.
I do worry about "Tivo-ization" though.
Its a noble effort, but in an IT shop, if I went to use a third party patch bundle that isn't cryptographically signed or vetted by a known company, I would be in a lot of legal hot water should a security breach occur. I don't see the AutoPatch people using PGP either, so I have little assurance of tamper resistance.
If the AutoPatch people did sign their packages with either PGP or get a MS code signing key, things would be different, however a code signing key does cost some cash.
I like service packs because I can slipstream them into a main OS CD with not much effort. This helps assure me that from the second I stick in the OS CD for an install, the machine is relatively up to date on security issues.
For example, with the old Windows XP CD I have from 2001 that has no service packs, the machine has to be initially installed physically disconnected from the Internet [1], the firewall turned on, then SP2 and other stuff run on it from "trusted" DVD media, or a read-only USB stick. With XP SP2, the firewall defaults to on, so there is less of a need to isolate the machine until its at a current patch level (although I do anyway until I get the basic AV/anti-malware/software firewall installed.)
Maybe MS can compromise, do a monthly rollup of patches that is easily slipstreamable, so I can make an OS CD that would be current with fixes to a certain date.
[1]: Technically disconnected from the LAN. Connecting anything directly that isn't hardened against attack (router, BSD box, etc.) is just asking for trouble.
This shows that what is needed is more research on higher capacity batteries, from the capacitor type which charges in seconds, to having exponentially more energy density per pound.
Its a lot easier to engineer a power distribution and charging electrical system, compared to having multiple systems to handle highly explosive gas as well as an electrical system. Its also a lot easier to generate electricity, pipe it into a charging system, compared to the energy used to split water into H2 and O2.
I used to like fuel cells, and thought a H2 based economy would be a good thing, but I'm having second thoughts now, because once batteries are able to carry a respectable energy density, there is pretty much no need for carrying H2 around anywhere.