Category Archives: privacy & security

What is the definition of spam?

In the most technical sense, unsolicited emails advertising something, usually a commercial enterprise, that are sent out indiscriminately are clearly considered spam. However, in this age of endless email, most have a much broader definition of spam and those who email as much as I do can probably be heard calling any annoying emails spam. These email messages may even be sent under a legitimate umbrella, but once they become too frequent and completely unwanted, once they lose whatever initial value they may have had, they become spam. For example, if you buy something from an online vendor, they might begin to automatically send you followup emails on sales, deals, etc. While you may be interested in them at first, too often do online retailers abuse their relationships with their customers and end up sending too many emails with too little relevant information. In the end, you find yourself unsubscribing from all emails from the vendor, afraid that subscribing to even one newsletter or list will result in another onslaught of spam. In this case, the emailing isn’t completely indiscriminate since you provide your email address and establish a relationship with the sender through your purchase, but most people would consider those messages as spam. But this is old hat to those of us who regularly shop online– if given a choice, I always uncheck all options to receive promotional emails or any other communication from vendors outside of information about my orders– and we accept this constant process as a tradeoff for doing business online.

But what happens when it gets personal?

Two years ago, I attended a large New Year’s Eve party that was thrown by a group of semi-professional party throwers. Expensive tickets were purchased online and black tie was worn. Unfortunately, as a result, I was unwittingly subscribed to one of the organizer’s personal email list for advertising events. I didn’t make the connection between attending that party and getting on this mailing list until recently since there were a number of organizers whose names I can’t remember, but I have been getting emails from this person that I had never met before in my entire life ever since. The emails seemed to be personally addressed (using a suppressed recipient list rather than a formal mailing list) and there wasn’t an easy way to unsubscribe– sure, I could probably respond to the email and ask to be removed, but when it comes to spam, I don’t like to respond and make myself known. In most cases, it only increases the spam exponentially since then they know there’s a real person behind the email address.

In any case, I’ve been putting up with these emails for two years and they were getting more and more frequent as the latest event being advertised, this year’s New Year’s Eve party, neared. So, I finally responded to the email and asked to be removed from the list. Who knew that it would result in the ridiculous email exchange below?

My original request:

Please remove me from your list. You have subscribed me under [email address].

To which I received the following response:

Hello Sindy,

May I ask why you would like to be taken off my list?

Now, I would have preferred something more along the lines of, “You have been removed from the list. Out of curiosity, why would you like to be taken off of my list?” I would have considered that an appropriate and prompt response to my request and if I chose to, I could give him some exit information for his own purposes. Instead, I have now been pulled into participating in this guy’s own little marketing research survey and still didn’t have my request honored. Nevertheless, I simply responded:

I never asked to be added to this list and I am not interested in these events.

At this point, this should have certainly been sufficient and I should have been removed from the list. Instead, I received another followup message:

Hi there Sindy.

I apologize if you received my email by accident. I sent this to my friends and anyone who has attended my parties the past few years. I throw 2 parties each year, my annual Tailgate party at the Giants game and my annual New Year’s Eve party. I have your email address either because you went to one of my parties or you asked me to send you info or one of your friends requested for you.

Did you look at my party this year? Let me know what you think.

So, I finally realized how I had gotten onto the list in the first place, but that didn’t make this entire exchange any less annoying. I mean, what part of “remove me from your list” do you not understand? And certainly, if I was responding to your messages about this year’s party with a request to remove me from the list entirely, then I’ve probably taken a look and am not interested. So, I responded with the following message:

I may have been added to your list from having attended a New Year’s party 2 years ago, but I don’t recall ever asking to be added to the mailing list and even if you were to automatically subscribe me, I think an explicit request to remove me from your list should be sufficient. It’s ridiculous that you are making me jump through hoops to be removed. I am not interested in the events that you have been sending me emails about for 2 years and even if I were, I’m certainly not interested now. This is nothing short of spamming. Please remove me from your list.

Now, I was completely riled up and had decided that I would most certainly post this exchange here, expose this guy for the spammer that he was, and spread the word that nobody should go to his party lest they be supporting a spammer and be sentenced to annoying emails for the rest of time. However, he sent the following response that, while very misguided, was at least polite and so I’ll refrain from actually naming him here, posting his email address, or mentioning the actual event (although many might be able to figure it out):

Thank you for your eloquent response Sindy.

My list is my own personal list of friends and friends of friends. There is nothing corporate or spam-like about it. If you received this email, it is because you personally attended one of my parties or a friend recommended you attend. I apologize you have jumped through hoops in order to be removed. Your hoops are my attempt to get to know who you are. I apologize for that and will remove you from my personal list as it is crystal clear you want no part of me or the parties I create.

Have a terrific rest of the week and Thanksgiving. Enjoy your New Year’s as well.

Personally, I think what is and what is not spam is in the eye of the recipient. In this case, my relationship with the sender was a loosely personal one because while I had attended an event that was held by that person (among others), but so did several hundred, maybe even thousands other people and most of us probably have never actually met the organizer. Nevertheless, messages from your friend are not immune to being considered spam. Case in point: if a friend emails you to see if you’d like to buy one of his homemade t-shirts, that may be considered an unsolicited email advertising a commercial product, but since he’s your friend, you probably wouldn’t consider it spam. However, if he continues to send you email every week, continually trying to sell you his latest creation despite the fact that you continually choose to NOT buy one, you would probably start to find it annoying. At that point, you might say to him, “Could you stop spamming me with these emails?” And suddenly, what began as a simple friendly email has become that vicious thing we know as spam. Sure, its not as bad as some of the Viagra, penis enlargement and debt consolidation spam that plague us all, especially if he promptly honors your unsubscribe request, no questions asked, but in the broadest sense, its still spam. And the fact that you have a personal relationship with the spammer, that you actually know this person, doesn’t necessarily make it any better– it’s almost worse because you might be likely to not take future messages from this person as seriously or you might even be inclined to ignore them completely.

In the end, our ability to send valuable, useful messages becomes increasingly important everyday. With email becoming an increasingly important part of people’s everyday lives, being a trusted point of communication is essential. When you send out messages indiscriminately, when you abuse the convenience and power of email, you’re only losing stock in yourself.

The evil that is Sony

Okay, I won’t really do commentary on this since so many people have been talking about this for several days now (an eternity in the Internet world). If you aren’t aware, a programmer named Mark Russinovich discovered that “copy protection” (DRM) software placed on some of SonyBMG-produced CDs installs a rootkit to “protect the software” itself. The reality is that a rootkit may be one of the most evil things you can install on a person’s computer– it’s essentially a piece of software that can conceal all traces of certain activities on a computer. As you can guess, this is a tool often used by hackers and virus writers to hide their activities once they’ve gained access to a machine. The term comes from the fact that the software is usually a recompiled set of Unix commands that allows the intruder to act as “root” (the super user on a system with all rights and permissions in all modes) without being detected even by the system administrator. Although the term stems from Unix, rootkits exist for a number of operating systems, including Windows. Evil, isn’t it?

On top of that, once Sony was outed, they offered a Web-based uninstaller for the rootkit. However, if you were to use the Sony-provided uninstaller, it would leave a security hole open on your computer that could be easily exploited by a mailicious user (i.e., hacker). Again, evil, no?

In any case, I thought I would post on this for those people who might read this little blog and who might have not been paying attention to the Sony DRM fiasco because they didn’t readily understand words like “DRM” and “rootkit.” If you consume music, if you use a computer, this is an important thing for you to be aware of and to learn about. In my mind, in the name of balancing the demands of fair use and copyright, Sony took advantage of a malicious technology because the average person could not understand it, much less detect it. Of course, what really amazes me is that in among all of the software engineers, product managers, and others who were involved in the development of Sony’s DRM software, not one person thought that this was a bad idea? There most likely was and I’d be interested to see if one of those people could give some insight into the origins of this fiasco, to help us make sense of this ridiculousness. Maybe that lone voice of reason lost his job or took some cash to shut up or was forced to sign an NDA or other confidentiality agreement over it, but I’ve got a feeling that if he was brave enough to talk now, I’m sure many would be interested in what he had to say and I bet some would even champion him for getting out the truth.

For more info on this whole thing, review Russinovich’s original post on his discovery as well as Ed Felten’s ongoing commentary, including Alex Halderman and his analysis of the security hole caused by Sony’s uninstaller and their proof-of-concept exploit.

BigFix followup in The Chronicle

I was interviewed for an article on patch management solutions at universities after a reporter at The Chronicle of Higher Education found my blog entry on BigFix. So, finally, after much anxiety and anticipation, here it is:

Plugging Holes in the Security Dike

Although I wish that somebody actually working for Information Security Services at Stanford was quoted (and not just the director emeritus), it’s interesting to see that we’re not the only ones who were concerned about privacy and liability. Now, if only we would act on those concerns rather than just recognizing that they are an issue and moving on in the name of security at all costs.

Temptation, thy name is BigFix

In an effort to deal with the rise in widespread security vulnerabilities and exploits over the past few years, Stanford has decided to use BigFix Enterprise Suite for patch management. Of course, patch management is certainly not the only thing this software can do (and will be used for) and as we at ResComp began to learn what BigFix is usually really used for and could really do, privacy alarm bells went off in our heads and for the past year, we’ve been fighting a battle to strike a balance between keeping student computers and the Stanford network secure and protecting student privacy rights. And despite how much time and effort has gone into this fight, I haven’t really written about this here because we were still in the middle of negotations. But the lid, at least for now, has been closed and I can sound off on some key privacy and security issues.

The deal is this: the decision to use BigFix was first made by the folks at ITSS (and given the go ahead, of course, by higher ups). At Stanford, the IT structure is a little strange. It’s divided into two main groups: ITSS, who focuses on administrative systems, infrastructure, etc., and the Libraries, who focus on academic computing needs (including residential needs since Stanford has a strong committment to residential education and most students live on-campus). But of course, real management of computing resources and services is even more decentralized than this strange arrangement, so as one can guess, managing the network and deploying technology throughout campus usually involves getting a lot of people from different groups to work together. You can imagine how folks in charge of administrative systems and infrastructure can often disagree with folks in charge of promoting the academic mission and student life. On one hand, allowing students to connect whatever computer they want to the network and experiment with their computers is, I believe, a key part of educational freedom and promotes self-learning. On the other hand, it’s a nightmare for network security and management, not to mention desktop support. Another part of this balancing act is the fact that a university computing environment isn’t necessarily a corporate computing environment and in addition to regular university employees , you have faculty who often have experimentation with computing technology at the heart of their research and you have students who live on-campus and make it their home, their community. Certainly, there are significant differences between what kind of programs a faculty member can run on computers paid for with research funds and what a residential student can do with his personally-owned computer and what a university employee can do with his university-owned computer.

In the end, the compromise was to provide supplementary documentation for residential students, hoping to educate students about the privacy concerns and let them make the right choice for their own computing needs. Our main goal was to make sure that students were educated (what a novel idea at a university) and had all the information necessary to make the right decision for themselves. The one thing we wanted to avoid was to have the University hand down BigFix as a requirement for getting onto the network. While I certainly agree that the University should be able to require students to patch and secure their machines, I do not believe they should be asked to install a potentially invasive piece of software on their computer and in the name of security, give up their privacy rights. Some may say that the list of retrieved properties is nothing to get so worked up over, that collecting this information automatically will help local network administrators and departments have better inventory information, and that most people won’t care if the University collects this information about their computers. Well, I hardly think that poor record keeping and inventory management on the part of local network administrators or the fact that most people just won’t mind are reasons to ask 10,000 students to install, in one sense, monitoring software on their personal computers.

Personally, BigFix for University-owned machines, especially those that store confidential information (including email), is a no-brainer– I believe that in those situations, computers should be imaged and employees should have locked-down configurations (no administrator access) anyway. And because we are talking about workplace resources, I understand that there is no reasonable expectation of privacy (although, I believe that a more relaxed approach fosters higher employee morale). But when it comes to my personal computer, I will not choose BigFix. In some ways, my situation is similar to those of the residential students my department supports– as part of my employment, Stanford provides me with “Stanford DSL,” paying for my service and giving me Stanford IP addresses for my home network. And realistically, when I come home from work, my employer can still monitor my network usage. In my home, my situation is very similar to students living on campus (although, unlike them, I have the option of a different broadband provider) and given that situation, I won’t be using BigFix at home. For me, I am more than capable of following good security practices to keep my computer, and in turn, my little part of the Stanford network secure. I don’t believe that there is an urgent and pressing need for the University to know how much total drive space I have or the serial number to my personal computer. Some of the retrieved properties might seem trivial– what my CPU speed is or what my computer name (something that’s already available via Windows networking)– but I should still be able to choose whether or not people know. It might seem trivial for people to know what color my couch is or what shape my dining table is, but it’s still my right to decide who knows these things. The most important thing, at least right now, is that we hold onto the right to choose because while it may seem trivial today, who knows what our “trivial” personal information could be used for tomorrow.

Which brings me to my final point: one of the big reasons why we must protect our personal privacy is that unfortunately, there are many out there who might use it against us. When we were in the thick of the privacy argument over BigFix, we realized there was a fundamental misunderstanding– some thought our reluctance to use and promote BigFix was because we feared that the information collected would not be secure, because we feared that the central databases would be broken into somehow or that console operators would abuse their access to this confidential information. These are concerns, of course, but our greater fear is that tomorrow, the next day, or sometime after that, suddenly the information would be used by the proper officials through the proper channels in a way that we do not agree with. Today, some collected information might be used only for inventory purposes, tomorrow, it could be used to unfairly profile network users. Today, total disk space might just be for statistical purposes, tomorrow, it might be used make unfair accusations about what that disk space might be used for. It’s a propos that I just finished reading Dan Brown’s “Digital Fortress.” A recurring theme is “Who will guard the guards?”

Last week, I finally got my console operator account access and logged in to take a look at the console software. I had sworn to myself, to my fellow console operator, and to the folks at ITSS that I would not be looking at the retrieved properties. We collect our own statistics during network registration and our yearly survey (with over 50% participation each year) and keep organized network node records– we don’t need to look at records for inventory purposes and we don’t want to look. And for us, we believe and have proven that spreading the word, using our RCCs and the dorm community network to educate and encourage students to follow good security practices, actively managing and policing our network, knowing our users, is the best way to maintain good security. We don’t necessarily need a 100% solution– we need one that keeps our networks manageable and usable. But when I pulled up the console software, I couldn’t help but look. Retrieved properties for hundreds of computers just come up automatically as soon as you login. Ah temptation, thy name is BigFix. I only looked around for a few minutes, but by the time I had logged off, I felt like I had violated so many with a few easy clicks. If I could do it so easily, believing so strongly against looking at the data, imagine how easy it would be for those who want to look, are dying to look and analyze and use this data for their own purposes. Who will guard the guards?

In the end, that question was never really answered– or rather, few believed somebody needed to guard the guards. But there was the final piece of our compromise: we asked that a notification list be created for all BigFix users, that the option to subscribe to the list was presented during installation, and that whenever the list of retrieved properties changed, everyone on the notification list would be notified. It’s not a perfect solution– we would have preferred mandatory and automatic subscription for all users who install the program and a heads up before the list was changed– but it’s something because it, once again, lets us hold onto choice. Today, I might be willing to give up this much privacy in the name of security and convenience; if you ask me tomorrow to give up a little more, I might decide that the price has become too high and I can exercise my choice to opt out. And isn’t that the basis for freedom, educational or otherwise– choice?

Does Microsoft mirror?

Another thought on the problems with SP2 on college campuses: does Microsoft have mirrors for Windows Update? Granted, I’m sure they have a sophisticated setup for handling load, etc. for customers trying to download patches as well as for pushing out patches over Automatic Update (although it’s not clear how they are choosing who gets SP2 over AU when), but taking a page from P2P, they should consider distributing patching resources throughout their network either by location and/or market type. If Microsoft could loosen their grip on patch distribution just a little (their reluctance evidenced by shutting down sp2torrent.com and their restrictive rules on what universities can do with their free SP2 CDs), they could set up some great mirrors to help lessen the load and get patches out faster and easier.

For example, if you set up some Windows Update servers on some big Internet 2 hubs, you could cover a huge part of the higher education market– millions of college students patched and thousands of IT workers who are a little less disgruntled at Microsoft (because trust me, most of us have some beef with the folks at Redmond). Certainly, it’s within MegaCorp’s capabilities to create a server image that’s locked down and can be pushed out to “Windows Update Affiliates” around the country.

Told you so: SP2 on campus

Looks like college campuses are facing serious problems with the horrible timing of SP2:

Windows XP SP2 Upgrade Causing Campus Headaches

This is exactly the problem I started to predict over a week ago:

Desperately Seeking SP2
Microsoft redeems itself…a little

While I can say “told you so,” it’s still going to suck for university IT workers everywhere. Especially considering Microsoft is only giving universities one CD for every 50 students and won’t let universities make their own copies for distribution. An average undergraduate dorm at Stanford has about 100 students, so that’s only 2 CDs per dorm. (We actually have a different deal, but let’s go with this basic deal.) Assuming that the average time to install SP2 is about 30 minutes to an hour (calculating in time between passing off the Microsoft-pressed CD to the next person, variable computer speed and performance, etc.) and that you could probably get people patching for a total of 8 hours spread throughout the day, you could get about 16 people upgraded a day. So, it would take about six or seven days to upgrade an entire dorm. Of course, this is a very optimistic estimate– calculate in the time that somebody just isn’t around for a few days and doesn’t pass on the CD in a timely manner or somebody’s computer is slow and it just takes a long time or somebody just loses the damn CD. It could be upwards of two to three weeks before everyone gets SP2 installed and that’s a lot of time during which a vulnerability and exploit can come out and wreak havoc.

The point is that schools will have to institute a mixed model of distributing CDs and installing over the network. But how do you do that when students are more preoccupied with meeting friends and roommates, buying books, picking and registering for classes, paying bills, going to Target to buy some extra-long twin sheets, etc.? Not to mention all of the community building activities Stanford’s Residential Education program pushes. How do you encourage students in a way that will a) get them to install an important security update in a timely manner and b) do it in a way that is evenly distributed over multiple channels? On one hand, you’ll have students who try to get the CD as soon as possible so that they can be patched and secure. Okay, in a dorm of 100 students, after the first two grab those CDs, what about the other 98? Well, they’re busy and they’ve got to go run errands and meet up with friends and talk to professors and whatever else they have to do, so they don’t have time to be waiting around to meet up with Joe down the hall so that they can get the CD. They’ll either run Windows Update themselves or wait until Automatic Update happens or never get patched at all. That’s not very good distribution.

Last year, before RPC hell and back, Stanford’s IT organization decided to cut back on costs and not distribute an Essential Stanford Software CD, a CD which, among other things, included anti-virus software and was traditionally given to all new students when they came to campus. But come late July, the RPC exploits began to hit and suddenly, everyone realized that the CD was a pretty good idea and that it would be the perfect way to get people patched before they got onto the network. So then, there was a mad rush to get CDs pressed and distributed to not just new students, but all 10,000 students living on campus. I wonder what will happen if an exploit hits around September 1 and suddenly it becomes critical to get students patched with SP2 before they connect to the network. Will Microsoft be willing to allow us to copy and distribute CDs then? Or will universities have to bear the burden of whatever new exploit as they are asked to pay for more CDs and wait for Microsoft to press and ship them out?

Who knows what will happen? I think many of us are just simply going to get the CDs out there and hold our breath, hoping that a new vulnerability and/or exploit doesn’t come out, that SP2 won’t break too many computers, and that it won’t make our networks not only sluggish, but just completely roll over during this important period where students– and university staff– are trying to get the school year started, a process of which the Internet has become a critical part. We have seen how much network usage and hits to central campus servers spike during this period and we’ve seen our mail servers slow to a crawl. We’ve seen how much network traffic is hit already with email and file-sharing viruses and spyware. We’ve seen the Windows Update site fail under the burden of users trying to patch their computers. I guess we’ll just have to see what happens when they are all put together.

Microsoft redeems itself… a little

Interestingly enough, especially after my recent rant about the timing of SP2 for Windows XP and my long-time rants about simple services Microsoft could provide to help out universities, it looks like Microsoft has finally listened. I heard through the grapevine that Microsoft is going to help Stanford out in the coming weeks as we prepare for fall student arrival by pressing SP2 CDs for us to distribute to RCCs and other technical support staff. (There’s even talk that they’ll make these CDs available for free to plain ol’ folk at brick and mortar locations.) We also have access to a CD image (that I’m download right now) if we want to burn our own CDs as well. The way in which SP2 is distributed over CD is tightly controlled– as is usually the case with anything from MegaCorp– and it unfortunately reduces our ability to also distribute a little configuration tool (< 500 KB) that will open up certain ports and change IE settings, addressing the inevitable issues that will come up specifically for Stanford users. Hopefully, we'll be able to distribute this little tool on our Essential Stanford Software CD that goes out to new students (if the CD hasn't already gone to press yet), but here's the amusing user support scenario that we came up with:

An incoming junior gets a new computer right around the end of August. Because most computer vendors aren’t installing SP2 yet on their drive images, his computer doesn’t have SP2 installed. But the student comes back to school and moves onto campus around September 26th and hooks his computer up to the network. Among other reasons, because he’s living off of the “free” electricity and high speed network available to him for only $10 per month, he leaves his computer on and connected to the network all the time. Now, hopefully, he’ll have automatic updates turned on or he’ll have listened to his RCC’s recommendations to install the latest OS patches or he’ll have installed Stanford’s new BigFix client to help with keeping his computer up-to-date. So, his computer gets SP2 pretty soon after he gets onto campus and he gets to, theoretically, take advantage of all the new security features that SP2 provides.

However, once SP2 is installed and the firewall is turned on, there are certain things that don’t work. Specifically, certain ports are blocked, so now he can’t log on using PC-Leland, Stanford’s desktop application that allows Kerberos single sign-on. Well, this is kind of annoying because most likely, he’s already configured his email client to use PC-Leland for accessing his Stanford email account, so his email probably doesn’t work now. Also, every time he tries to access anything on the Web behind Stanford WebAuth, including signing up for classes, accessing Coursework (Stanford’s course management system), etc., he has to login via the authentication page on the Web. But the problem is that there’s a known caching problem with the WebAuth page and if his browser’s not checking for new content every time he visits a page, he’ll go into an endless loop after authenticating and never be able to actually get to the page he was trying to access.

But no worries. He walks down the hallway and tells his RCC about his problem. The RCC is a little overwhelmed with beginning of the year computer problems or doesn’t want to confuse his not necessarily tech-savvy resident with complicated directions on how to open up ports, so he tells him to run the little SP2 configuration tool that has been put out by Stanford. Well, he’s not a new student, so he didn’t get a copy of this year’s CD, so he’ll have to go download the tool off of the Web site. Oh, but wait, that Web site is behind WebAuth, so he’ll run into the same caching problem. Okay, well, then the RCC will take some time out to help him fix that and then finally he’ll be able to get the configuration tool, get the right ports open, and get going.

A possible addendum to this scenario: if this student had installed the BigFix client when he got onto campus, at the recommendation of ITSS, he might have gotten SP2 pushed out to him through this system rather than Automatic Update (since it’s not clear how quickly someone would get SP2 pushed out to them over AU even with constant high speed network connectivity). But the second SP2 is successfully installed, BigFix would not work thereafter since the port it uses to push out patches is now blocked with the firewall. So, BigFix was able to push out SP2, but if there are new vulnerabilities and additional critical updates (which there most certainly will be), BigFix will not be able to push those out. We’ll have to hope that the student will be able to open up the correct ports soon or have Automatic Update running so that he can get his computer patched. Ironically, BigFix could end up shooting itself in the foot– an issue outside of the major concerns we had about this new system.

Of course, many of the user support issues here are not all the fault of Microsoft or even Stanford and in the end, a large OS upgrade like this will cause user support issues no matter what (although let’s not even get into the weird conflicts SP2 causes with popular antivirus software). And in the end, I give credit to Microsoft for actually listening to the one suggestion we gave them last year after RPC Hell– to give us resources to easily put critical patches and updates onto a CD and get users patched without having to put them on the network. I have to say, after over a year of constant struggles with security, privacy, and copyright, this little victory is both surprising and welcomed.

Desperately seeking SP2

We’ve been hearing about SP2 for Windows XP for so long and frankly, dreading it. I know that Microsoft has been trying to address these concerns, but a big software release/upgrade like this is going to undoubtedly create a large user support issue. And considering that’s a huge chunk of my department’s business, we’re all a little worried.

But even after they announced that the code was finalized (no more release candidate teases), SP2’s still not available for individual computers. Granted, it’s available for IT professionals as a huge download, but the Microsoft TechNet site emphatically tells you not to use it for individual computers. Making it available earlier for IT professionals is helpful because we get a slight taste of what’s to come, but we’re not worried about our centrally managed computers breaking. It’s easy to just re-image them and apply a fix. No, we’re worried about thousands of students out there in the dorms installing SP2 on their individual computers all with their own configurations, setups, and quirks. And even if solving people’s problems are just simple preference and setting changes, it’s a huge user education and support issue. So, I desperately want to go through what an individual computer upgrade/install scenario would be like, but They. Just. Won’t. Let. Me. And honestly, I don’t want to get it through a special download (i.e., I want the go through the experience as close to the way students will experience it as possible), but it doesn’t really help matters when Microsoft squashes Downhill Battle’s attempts to share SP2 over P2P. Microsoft could have really won some major cool points by letting sp2torrent.com continue– it not only demonstrated a great way to use P2P networks, but also ease the burden of distributing a free upgrade that’s supposed to deliver improved quality of service for Microsoft customers.

But the thing that really just hurts my feelings is that the release for individual computers is scheduled for August 25. That’s right in the middle of the major fall back-to-school time for most universities. Even at a quarter-system school like Stanford, you start getting students trickling in right around that date and then the move-in numbers increase through the end of September with two major bursts– one for incoming freshmen and other new students and one for everyone else. And Microsoft might think they’re being smart by encouraging people to turn on Automatic Update so that they can break up the distribution and keep people off of Windows Update, but after the RPC vulnerabilities from last summer, lots of schools might require SP2 before allowing student computers on the network. So, despite their tricky Automatic Update plan, there’s a good chance that lots of students are going to actively pull SP2 from Windows Update rather than waiting for it to be pushed out to them over Automatic Update.

Well, I guess we’ll just have to brace ourselves for the inevitable Windows headache that happens every fall. You know, I really do like Microsoft and Windows most of the time, but their sensitivity to universities and the higher education community is just… well, stupid.

Big Brother is not welcome!

I really have to congratulate Texas A&M for delivering a network security solution that still protects privacy (thanks to the direction of their administration that encourages non-invasive security practices). The Security Team there has built an open-source solution that effectively monitors for network instrusion and dynamically blocks (through a firewall) compromised or vulnerable computers before they can get onto the network. Their product, NetSQUID, is simply a Perl script that sits between Snort and IPTables. Computers are blocked according to the Snort rules the network administrators choose to deploy and Web requests from those computers are automatically redirected to an information page that lets the user know what’s happened, how to fix their computer, and how to get help if they need it.

This process is similar to the one we’re using at Stanford, but it’s so much better! It’s much more elegant and consistently applied across the residential network– they’ve put a server in front of every single residential hall (i.e. every single subnet) and it handles all network intrusion detection and management through one system. This is really a great example of how a university can leverage readily available, free, open-source products out there (it even runs on Linux) and significantly improve security and network health in one simple move– the only real cost to them is the initial staff time to develop the product and then the hardware that it runs on. And really, considering how much time and money improved network security and effective reaction plans can save, these are relatively small, but very worthwhile investments. Stanford lost millions in staff time from the Blaster and Welchia attacks alone last year.

And they’re still maintaining user privacy! The Texas A&M security team admits that they did not consider network management options that required desktop clients (e.g., Perfigo, BigFix, etc.) because they didn’t want to require users to have a particular piece of software on their computers. This is great since products like Perfigo’s CleanMachines and BigFix are primarily designed for corporate environments and can often return lots of properties about a computer on your network. While those types of solutions might be great for managing University-owned computers, they are not the right answer for privately owned student computers. How would you feel if Verizon or Comcast or whoever your ISP was could find out how much hard drive space you had (free or otherwise) or what version of Microsoft Office you’re running? Residential students live where they work. This is not just school to them; it is their home and it is their community. And Big Brother is not welcome!