Well, if you want 'enterprise' you should be using real enterprise software, like a solution from IBM, Sun Microsystems, or RedHat Linux. These companys will sell you a contract that DOES give your business recourse when something goes wrong. Read such a contract. It almost always boils down to "best efforts".
If you were exploited by a 0-day bug in code that was in OpenSSL at source (rather than any patches your distro maintainer had added), everyone else was also vulnerable but you happened to be the unlucky one who was exploited, I suspect the contract wouldn't be terribly useful.
This is why you don't rely on one thing as your sole source of security. In this case, you'd probably want to configure SSH to deny root logins, set up something like DenyHosts to thwart bruteforce attempts and maybe run some sort of intrusion detection system - preferably connected directly to a firewall so detected intrusion attempts can be automatically blocked.
Like where? A licence to mix water, sugar and yeast? That's just about the stupidest thing you could ever require. My, my, what is the world coming to when people can't even get the ingredients in beer right.
Plug and play, BTW, has nothing to do with a pre-made OS install for the purposes of either system recovery or mass imaging of a new product line. Unless you plan on recreating your image for every product you churn out, it has rather a lot to do with it.
(Says me who's adopted a procedure of automatically install XP using a scripted install rather than imaging because XP's implementation of PnP quite simply doesn't, post-install)
And liquid Nitrogen is cheaper to buy than beer. You're obviously drinking way too expensive beer, try a 40 of old english malt liquor, sure it tastes nasty, I bet it does. There's no such thing, because there aren't AFAIK any English distilleries selling any malt liquor right now, so Heaven only knows what you're buying. Petrol?
How do US carriers get away with this? They all do it, so your choices are:
1. Put up with it. 2. Don't bother having a mobile phone.
(I wonder if anyone's ever considered investigating these companies for racketeering - wouldn't surprise me even remotely if they were colluding on these things)
Dictatorships don't tend to get more done, they just try to do less. I take it you've never tried getting someone in a public service role in the UK to do something then?
TFS says the code must be specifically targeted to a particular machine which, on a PC, means a very big challenge.
Regardless of this, it's still a pretty big challenge. It's well out of script-kiddie land and into "determined hacker" territory - and I can't imagine anyone would take it on unless the target was really worth it. Think large bank or governmental organisation.
Thing is, though, large banks and governmental organisations buy hundreds, if not thousands of identical PCs at a time - and they're likely to be based on relatively conservative hardware, rather than "latest and greatest gaming rig" stuff. Finding out what type of PC to target and obtaining one for your own development purposes would probably be relatively easy. Then all you've got to do is socially engineer the software onto a target PC.
more like intel payed HP to put there drivers on to all systems in way that MS says they do not support. HP needs to step up and pay for peoples down time and the cost of having a tech come out and fix it. This may even need to come down to a class action law suit.
make the head line say HP systems useing a unsupported by MS driver setup / image load crash under SP3. Very curious, because in every company of any significant size I've ever worked in, the OEM version of the operating system is only there so you've got the license to please Microsoft and the BSA.
The actual installation more often than not comes from a customised install based on a corporate image.
This does a number of things:
1. Ensures that the PC is running known software. Rather than "Windows + whatever crapware HP are installing this month". 2. Eliminates any issue with "You haven't registered this copy of Windows so it's shutting down until you do". Corporate XP versions obtained through the site licensing agreements don't require registration. 3. Guarantees that when the world's OEMs finally stop shipping XP, there is still a mechanism in place to roll out XP PCs. (Though this may be more of a problem than it used to be, as some manufacturers have developed a habit of changing the PCI ID of hardware they OEM. Thus you can't always install generic ATI drivers from ATI's website on an HP PC with an ATI graphics chip).
Having said that, there are hundreds of much smaller businesses out there for whom this would be an unnecessary extravagance.
HP should NOT be using the same image for their Intel and AMD-based systems. In that case, I trust you'll forgive me asking this question:
What was the point in all the years spent by the PC industry on "Plug & Play", implementing ideas like unique IDs allocated by a manufacturer to their hardware devices and an operating system which can scan these IDs and choose drivers accordingly?
Except that the bug had been triggered many times before, seeing as how Samba had code in place to work around it. Yeah, I noticed that. Had the Samba team not reported the bug upstream? Most of them seem to be a fairly professional bunch, it seems unlikely they'd spot a bug like this and just code a workaround without at least a quick email to one of the BSD mailing lists.
I was faced with exactly this problem myself around October/November last year.
You've basically got three options:
1. Go for a completely outsourced service.
Pros: It's someone else's problem to look after.
Cons: A company of 50 staff will never be terribly important to such a service provider. Unless they provide an extremely good control panel and logs, sooner or later someone's going to ask where an email is and your answer is going to be "er... let me get back to you on that.... er... I don't know".
2. Go for an appliance - either in the form of a prebuilt lump of tin like the Barracuda system mentioned elsewhere or in the form of a precooked Linux installation which is literally just a matter of "insert CD, boot, tell it what it's IP address is and what domain it's providing email for".
Pros: Dead easy to set up. Most also provide a nice web-based UI.
Cons: The decent ones are almost universally commercial and you have to pay licensing fees on a per-active-email-address basis, which can get very expensive - particularly when the vendor won't tell you how their system decides how many email addresses are regularly active and the first you know that you're exceeding the license is when suddenly all the spam filtering is disabled.
If you look closely, expect to find that many of them are architected around a number of single points of failure. And in the real world, nobody is likely to check a web-based UI on the offchance that they find an email misclassified as spam sat there.
3. Roll your own. If you take this route, I can strongly recommend rolling it around an existing framework rather than following a bunch of complicated instructions to configure Postfix that you have to re-learn every time anything needs tweaking. This is the route I took, and I based it around MailScanner. MailScanner provides a framework for plugging in spam and virus filters and allows you to divide spam according to its score. Delete high scoring spam, let low scoring spam through with a note in the subject line that it's suspected spam and let non-spam straight through.
Pros: You get to keep a close eye on all the configuration, can keep close track of the logs and respond quickly to any issues. Your users can easily set up filters for spam (for that matter, so can you) and their "potential-spam" where misclassified mail may wind up is in their email client rather than a separate web-based system.
Cons: You need to become intimately familiar with every aspect of your email system in order to manage it effectively. I would argue that any self-respecting sysadmin should be intimately familiar with his email system anyway, but YMMV.
Pointless anecdote, but the only EeePC user I know struggled with the pre-installed linux and eventually had it wiped in favor of Windows. The default linux installed is lobotomized to not let you do anything outside of set tasks, and it takes expertise to hack it into something useful. Another example of a company thinking linux needs to be dumbed down to become friendly, and really making it unfriendly to anyone with more than very basic needs in the process. Really? I've just bought one at work. It was cheap enough not to be too concerned, and I had a need for a very small/light laptop.
It has Firefox, Thunderbird, OpenOffice and Skype preinstalled. Now, if you need something different (like support for some esoteric USB device, or even a printer with poor Linux support), I could see that being a pain.
But I don't buy printers which don't support Postscript - it's too easy for the manufacturers to announce that the model is deprecated and refuse to develop drivers for whatever OS you choose with winprinters, and if you want to upgrade to the latest Microsoft OS it's pot luck if the printer will work. And I don't have any particular need to support some esoteric piece of software or device.
(Imagines compiling Gentoo on that machine. Got, that'd take a WEEK.) Not it wouldn't. I compiled Gentoo (stage 1, back in the days when you could bootstrap from stage 1 onwards - today it's unsupported and has been for some time) on an AMD K6-2 400. Took about 36 hours IIRC.
Probably would take another few days to get to the point of having X and a reasonable sensible window manager, though.
Can I for example, load OpenOffice.org on the Eee PC? You don't have to, it's already on there. And plenty fast enough for day to day use.
I'd describe the eeePC as a middle ground between a laptop and the late lamented Psion Series 5. It's not small enough to use as a PDA, but it doesn't have a keyboard anything like as comfortable as a laptop keyboard.
Like the Psion, it comes with all the software you're likely to want preloaded.
I must be missing something. What makes this insightful? I can run that command right now (after 'setenv whatever vim') and it will install something for me. So either you're being ironic, or maybe you're unfamiliar with installing software on some Linux distributions? Because while that does work, most modern Linux distributions aimed at the desktop include a pretty GUI wrapper around the package manager which allows you to pick & choose what you want from a list.
Ya know, those "Works with Microsoft Windows" stickers you see on hardware boxes are there for a reason. Yep. If Microsoft's current court cases regarding the "Ready for Vista" logo program are anything to go by, the reason is "keep the people who print the stickers in business".
This is easily done when you created the market in the first place. Remember that to most people advertising is valid information, i.e they take it seriously on the "If it was wrong the majority wouldn't go for it." theory. This extends way beyond Joe Public walking into his local branch of PC World (Best Buy if you're American) and buying whatever has the shiniest, brightest posters advertising it.
There's plenty of business software which only sells because the company has a slick salesman - and I'm talking about the kind of software which comes with a price tag measured in the region of £10-15 thousand just for two users.
My manager (the Finance director) was stung that way only a year or so ago buying a product for the finance department. Apparently, the replacement product is going to be getting some fairly stringent testing before a purchase order is sent out.
What exactly is this enabling? I get that it's for "professional" applications, but what features do those use that aren't turned on normally? The application can ask the video card to perform some intensive work, farming it off from the main CPU of the PC for improved performance.
With the standard GeForce drivers, the video card will refuse to do this. However, with the Quadro drivers, it'll do it just fine.
The article tells you how to persuade the system to use Quadro drivers as opposed to GeForce. It requires some minor tweaking but it doesn't seem particularly dangerous.
There are devices that can spot lenses and an appropriately applied medium power laser can fry the CCD. I'd make a game out of it with prizes for most killed cams. Hell we can set this up as an MMORPG with the proper infrastructure. Do that to my £600 (WTF does/. have against £ signs?) digital camera and I'm marching you down the police station and having you charged with criminal damage.
The UK is a democratic society isn't it? I was under the impression that people voted for the CCTV to be there, and if enough people cared, they could vote it away as well. No.
We vote for someone in our area to represent us in Parliament. That someone is a member of a political party, and the party with the most representatives gets to decide who the Prime Minister is. The Prime Minister gets to decide who the most senior members of government (the cabinet) are.
The political party promises to be tough on crime. After all, everyone likes the idea of less crime, don't they? They promise all sorts of new and innovative techniques to reduce crime, which almost invariably wind up being implemented in the form of "Let's put up more CCTV cameras".
You will note that at no point were we informed that this "new and innovative technique" actually meant "even more cameras which result in pictures of an anonymous grey blob committing a crime".
Nonsense. The Chinese economy is predicated on the need for manufacture. Western economies are increasingly based on services, and there would still be a limited number of university graduates. And there would be no need to manufacture beyond the first few items once we've all got replicators in our kitchen which can replicate any given object with perfect precision, so that's the Chinese economy screwed.
Now, if you could replicate the Ferrari a la Star Trek, the situation would be entirely different, and the ethics of it would be much less clear-cut. If you could replicate any given item of value a la Star Trek, the basic assumption that all Western economies are built on (there exist products that are not plentiful in nature, and value can be created by making these products available in exchange for other products which are not plentiful in nature, viz. cash) would evaporate overnight.
I'm not sure such a replication device is such a great idea.
It's not "incompetence at best" to screw up the newly changed postage pricing system, especially if they're when posting from overseas. It's just a mistake. It is, for a number of reasons:
1. The lawyer, at least according to the summary, is from London. He's not posting from overseas. 2. This "recent change" was well over a year ago. 3. The lawyer is a lawyer. (Well, in UK terms a solicitor, but it amounts to the same thing). They send things of varying size by post all the time. The idea that they're not aware of the rules regarding how much postage has to be paid is for all practical purposes unthinkable. If they are aware, they intentionally screwed up so they're malicious. If they're not aware, that means they don't know how much they have to pay to post any given set of documents. Seeing as these rules have been in place for some time and a large chunk of their job involves posting documents, I think it's fair to describe such ignorance as constituting incompetence.
If Microsoft wanted to legally challenge the GPL, they could easily set up a dummy corporation with huge amounts of money whose sole employees are top notch lawyers and their only job is to build a case and fight it. They wouldn't be doing it piecemeal through half arsed efforts through companies that hold no fealty to them. Sounds a lot like SCO in the last 5 years.
Are you sure they don't require parking? It's not simply that it does so automatically? It is on modern hard disks, but I wouldn't be 100% certain when it's 400MB.
Doubtless someone with a better recollection than I can clarify.
Slashdot Mirror
These companys will sell you a contract that DOES give your business recourse when something goes wrong. Read such a contract. It almost always boils down to "best efforts".
If you were exploited by a 0-day bug in code that was in OpenSSL at source (rather than any patches your distro maintainer had added), everyone else was also vulnerable but you happened to be the unlucky one who was exploited, I suspect the contract wouldn't be terribly useful.
This is why you don't rely on one thing as your sole source of security. In this case, you'd probably want to configure SSH to deny root logins, set up something like DenyHosts to thwart bruteforce attempts and maybe run some sort of intrusion detection system - preferably connected directly to a firewall so detected intrusion attempts can be automatically blocked.
Water, hops, malt, yeast. That's all it is.
(Says me who's adopted a procedure of automatically install XP using a scripted install rather than imaging because XP's implementation of PnP quite simply doesn't, post-install)
Scottish distilleries, OTOH.....
1. Put up with it.
2. Don't bother having a mobile phone.
(I wonder if anyone's ever considered investigating these companies for racketeering - wouldn't surprise me even remotely if they were colluding on these things)
TFS says the code must be specifically targeted to a particular machine which, on a PC, means a very big challenge.
Regardless of this, it's still a pretty big challenge. It's well out of script-kiddie land and into "determined hacker" territory - and I can't imagine anyone would take it on unless the target was really worth it. Think large bank or governmental organisation.Thing is, though, large banks and governmental organisations buy hundreds, if not thousands of identical PCs at a time - and they're likely to be based on relatively conservative hardware, rather than "latest and greatest gaming rig" stuff. Finding out what type of PC to target and obtaining one for your own development purposes would probably be relatively easy. Then all you've got to do is socially engineer the software onto a target PC.
make the head line say HP systems useing a unsupported by MS driver setup / image load crash under SP3. Very curious, because in every company of any significant size I've ever worked in, the OEM version of the operating system is only there so you've got the license to please Microsoft and the BSA.
The actual installation more often than not comes from a customised install based on a corporate image.
This does a number of things:
1. Ensures that the PC is running known software. Rather than "Windows + whatever crapware HP are installing this month".
2. Eliminates any issue with "You haven't registered this copy of Windows so it's shutting down until you do". Corporate XP versions obtained through the site licensing agreements don't require registration.
3. Guarantees that when the world's OEMs finally stop shipping XP, there is still a mechanism in place to roll out XP PCs. (Though this may be more of a problem than it used to be, as some manufacturers have developed a habit of changing the PCI ID of hardware they OEM. Thus you can't always install generic ATI drivers from ATI's website on an HP PC with an ATI graphics chip).
Having said that, there are hundreds of much smaller businesses out there for whom this would be an unnecessary extravagance.
What was the point in all the years spent by the PC industry on "Plug & Play", implementing ideas like unique IDs allocated by a manufacturer to their hardware devices and an operating system which can scan these IDs and choose drivers accordingly?
I was faced with exactly this problem myself around October/November last year.
You've basically got three options:
1. Go for a completely outsourced service.
Pros: It's someone else's problem to look after.
Cons: A company of 50 staff will never be terribly important to such a service provider. Unless they provide an extremely good control panel and logs, sooner or later someone's going to ask where an email is and your answer is going to be "er... let me get back to you on that.... er... I don't know".
2. Go for an appliance - either in the form of a prebuilt lump of tin like the Barracuda system mentioned elsewhere or in the form of a precooked Linux installation which is literally just a matter of "insert CD, boot, tell it what it's IP address is and what domain it's providing email for".
Pros: Dead easy to set up. Most also provide a nice web-based UI.
Cons: The decent ones are almost universally commercial and you have to pay licensing fees on a per-active-email-address basis, which can get very expensive - particularly when the vendor won't tell you how their system decides how many email addresses are regularly active and the first you know that you're exceeding the license is when suddenly all the spam filtering is disabled.
If you look closely, expect to find that many of them are architected around a number of single points of failure. And in the real world, nobody is likely to check a web-based UI on the offchance that they find an email misclassified as spam sat there.
3. Roll your own. If you take this route, I can strongly recommend rolling it around an existing framework rather than following a bunch of complicated instructions to configure Postfix that you have to re-learn every time anything needs tweaking. This is the route I took, and I based it around MailScanner. MailScanner provides a framework for plugging in spam and virus filters and allows you to divide spam according to its score. Delete high scoring spam, let low scoring spam through with a note in the subject line that it's suspected spam and let non-spam straight through.
Pros: You get to keep a close eye on all the configuration, can keep close track of the logs and respond quickly to any issues. Your users can easily set up filters for spam (for that matter, so can you) and their "potential-spam" where misclassified mail may wind up is in their email client rather than a separate web-based system.
Cons: You need to become intimately familiar with every aspect of your email system in order to manage it effectively. I would argue that any self-respecting sysadmin should be intimately familiar with his email system anyway, but YMMV.
It has Firefox, Thunderbird, OpenOffice and Skype preinstalled. Now, if you need something different (like support for some esoteric USB device, or even a printer with poor Linux support), I could see that being a pain.
But I don't buy printers which don't support Postscript - it's too easy for the manufacturers to announce that the model is deprecated and refuse to develop drivers for whatever OS you choose with winprinters, and if you want to upgrade to the latest Microsoft OS it's pot luck if the printer will work. And I don't have any particular need to support some esoteric piece of software or device.
Probably would take another few days to get to the point of having X and a reasonable sensible window manager, though.
I'd describe the eeePC as a middle ground between a laptop and the late lamented Psion Series 5. It's not small enough to use as a PDA, but it doesn't have a keyboard anything like as comfortable as a laptop keyboard.
Like the Psion, it comes with all the software you're likely to want preloaded.
There's plenty of business software which only sells because the company has a slick salesman - and I'm talking about the kind of software which comes with a price tag measured in the region of £10-15 thousand just for two users.
My manager (the Finance director) was stung that way only a year or so ago buying a product for the finance department. Apparently, the replacement product is going to be getting some fairly stringent testing before a purchase order is sent out.
With the standard GeForce drivers, the video card will refuse to do this. However, with the Quadro drivers, it'll do it just fine.
The article tells you how to persuade the system to use Quadro drivers as opposed to GeForce. It requires some minor tweaking but it doesn't seem particularly dangerous.
Have a nice day.
We vote for someone in our area to represent us in Parliament. That someone is a member of a political party, and the party with the most representatives gets to decide who the Prime Minister is. The Prime Minister gets to decide who the most senior members of government (the cabinet) are.
The political party promises to be tough on crime. After all, everyone likes the idea of less crime, don't they? They promise all sorts of new and innovative techniques to reduce crime, which almost invariably wind up being implemented in the form of "Let's put up more CCTV cameras".
You will note that at no point were we informed that this "new and innovative technique" actually meant "even more cameras which result in pictures of an anonymous grey blob committing a crime".
I'm not sure such a replication device is such a great idea.
1. The lawyer, at least according to the summary, is from London. He's not posting from overseas.
2. This "recent change" was well over a year ago.
3. The lawyer is a lawyer. (Well, in UK terms a solicitor, but it amounts to the same thing). They send things of varying size by post all the time. The idea that they're not aware of the rules regarding how much postage has to be paid is for all practical purposes unthinkable. If they are aware, they intentionally screwed up so they're malicious. If they're not aware, that means they don't know how much they have to pay to post any given set of documents. Seeing as these rules have been in place for some time and a large chunk of their job involves posting documents, I think it's fair to describe such ignorance as constituting incompetence.
Doubtless someone with a better recollection than I can clarify.