Google Continues its Quest to be the New Microsoft

August 15th, 2011

In its unending attempt to be the “new Microsoft” (who successfully achieved its goal of being “the new IBM” many years ago) Google has purchased Motorola Mobility, the spinoff of the Motorola corporation that makes mobile phones.  This does two things for Google.  First, it demonstrates that they intend to make smartphones, not just smartphone operating systems, and that is Apple’s line.  Second, it grants them access to a lot of intellectual property, including engineers and a large quantity of patents.

Google is paying cash, to the tune of 12.5 billion dollars, which certainly sends the message to competitors about how big its war chest is.  They swear that they will keep Android open, but I’m not sure I’d want to be HTC now.  The real question is whether Microsoft can profit off of this by picking up some more Windows 7 smartphone makers.  Probably not, since they’re in bed with Nokia.  From a higher point of view, it looks like everyone now believes that hardware and software merged is how you fight the smartphone battle.

 

Share

Posted in Product and Company Commentary | Comments Off

Oracle Releases Java Standard Edition 7: The Sun Sets

August 3rd, 2011

Oracle released Java Standard Editon 7, the programming interpreter for the Java language, which powers a lot of interactive content on the web.  Oracle completed its acquisition of Sun Microsystems, the creator of the Java language, and this is the first version of Java to be released under the Oracle moniker.  For those of us who have been in this industry for awhile, it is a sad reminder of how technology companies come and go.  Sun’s design of Java was designed to work back when the Internet was a nascent technology.  The dream was that you could write the program code once, then load the interpreter on any computer system, including the rampant number of UNIX variants of the time, Microsoft’s Windows, MacOS, or just about anything else, and run the exact same program on each platform.  Sun called it “write once, run anywhere”.

Java had some great features.  It used a sandbox to limit what “bad” software code could do, it ran on many platforms as it claimed it would, and it was easier to program but had many of the powerful features of C++, upon which it was based.  It also had several downsides.  Although the sandbox limited the damage a Java program could cause, hackers found methods to work around the sandbox, and also found errors in the Java Interpreter itself.  Java’s Interpreter had to be patched when security vulnerabilities were found, just like all other software, and that became a problem for system administrators.  Java’s interpreted nature also made the programs that ran under it relatively slow.  Java programs also had to be downloaded and ran locally, which could prove cumbersome and slow.

What has really eaten into Java’s use, however, is that much of the basic interactivity that programmers needed it for can now be handled through the increasingly adept versions of javascript, cascading style sheets, HTML, and the ubiquitous Adobe Flash.  All web browsers build javascript, CSS and HTML into their rendering engines, so no third party applications are required to use their features.  User interfaces can now be built with many features that would have required a locally installed program when Java was built.  That is relegating Java to an increasingly small niche.

So Oracle has purchased Sun, and has released a new version of Java.  I tend to wonder if it will be the last.  It seems that Oracle may find Java’s legacy of patents more lucrative than licensing the actual technology.  Oracle sued Google for patent infringement for sections of its Android operating system, which it claims violate patents related to Java’s design.  The Sun has set, and perhaps in its twilight a cloak of darkness will fall over Java as well.

Share

Tags: , ,
Posted in Product and Company Commentary | Comments Off

Sniffer hijacks secure traffic from unpatched iPhones – Computerworld

July 29th, 2011

Sniffer hijacks secure traffic from unpatched iPhones – Computerworld.

This is scary.  Essentially, iOS has a flaw whereby if you browse a secure site on an unsecured (public) network (like a Starbucks’ wifi), the secure site can be spoofed without your knowledge.  Essentially, you can forge the security certificate, your device will think it’s real, and any data you send can be captured by the man in the middle.  Think of it as your postal carrier reading all of your mail without your knowledge.  The software package to do this is freely available and apparently extremely simple to use — anyone who can operate a computer could use it to snoop on you, no expertise required.

Strangely, this vulnerability is 9 years old.  It was fixed in Windows years ago, but somehow Apple missed it.  Pretty poor in my opinion, but there you go.

The long and short: patch your iPad and iPhone as soon as possible.

Share

Tags: , ,
Posted in Mobile Devices, Network Support Patches, security | Comments Off

MacOS X: The Lion Roars, but it may Bite if you use Adobe Products

July 22nd, 2011

Apple released MacOS X 10.7 (aka Lion) this week to much fanfare and generally positive reviews. However, it should be noted that if you are a user of Adobe products (I am), then you may want to wait before deploying Lion, as Adobe has not ironed out a variety of issues between its software and the new OS. The blame game is being played all over, but it seems to us that since Adobe stopped publishing its products on Mac first, Steve Jobs has been hankering for payback. Apple also seems to be less interested in its traditional power user base as judged by the release (and public excoriation) of the latest version of Final Cut Pro. At any rate, it seems that wise users of Adobe’s professional products shouldn’t update (or buy new Macs) until this is worked out.

Share

Tags: , , , ,
Posted in Uncategorized | Comments Off

US-CERT Issues Security Guidelines: Small Businesses Laugh

July 22nd, 2011

The US-CERT (United States – Computer Emergency Response Team), in response to the sudden increase in popularized computer network penetrations within the United States and abroad, issued a bulletin summarizing what their experts consider to be reasonable security guidelines.  Most small businesses, if they really had to do what CERT is asking, would simply start to laugh.  Is it because the recommendations are poor?  Of course not, they’re all great recommendations that should be followed by everyone.  The reason small businesses would laugh is that implementing some of these things is difficult or impossible for them.

Some of it is easy and intelligent: use strong passwords, make sure that the average user has at least an 8 character password, etc.  Some of it is intelligent, but not as easy.  Change your password every 60 to 90 days.  This is good advice, but a lot of users would change their passwords and immediately forget them, or change them and write them down where they could be easily picked up again.  Not the result you want.  Change the administrator passwords to 15 characters.  For most admins in small business, this won’t happen because the admin is also the finance guy, the sales girl, the operations guy, or otherwise has to have the password to do work, but it isn’t the core work to be done.  Also, changing administrative passwords usually has consequences beyond the immediate, so it often requires a trip from consultants like us, and that means cost.

Some of the suggestions just won’t be followed.  US-CERT advises implementing an intrusion detection system (IDS).  There are certainly freeware versions of these, and managed switches have become inexpensive, so you can’t complain that you need to invest a lot of money in a smart switch to use an IDS.  However, who’s going to monitor the results?  Who can rule out false positives and maintain the system?

As we’ve also noted, the biggest problem for small businesses is patching 3rd party software.  Microsoft is easy, but if your users don’t have administrative privileges to their own computers, they can’t install updates for Oracle’s Java; nor Adobe’s Flash, AIR, Reader or other software.  If they do have administrative privileges, you’re opening up another potential problem and you have no guarantee that end users will patch their systems as they should.

Overall, the US-CERT message is a good one, but one that small businesses will largely ignore.  They’ll evaluate the risks and decide almost immediately that it’s a bad insurance policy.  What we really need are better ways to patch common software.  If anyone’s built a better mousetrap in regards to this, we here at Vectrocon would love to see it, because so far we haven’t found a reasonable solution for our clients, and both we and they would love to have one.

Share

Posted in Network Support Patches, Networking, security | Comments Off

Small Business: How Much Socializing Can You Do?

July 19th, 2011

With Google+ entering the scene, small business owners might start to feel that there’s only so much socializing, real and virtual, that one can do. Every organization possesses only so many resources, and small businesses tend to have fewer than their larger peers.

It has become common wisdom that businesses of all sizes require a “social strategy” whatever that is. It seems that has something to do with using “social” technical tools to emulate the word of mouth that has forever been the most effective of all advertising methods. It also incorporates the old physical touchstones that all successful salespeople know: you can’t make commissions sitting in your office.

However, the resource of time is limited. How much socializing can you do and still actually take orders, manage employees and vendors and insure projects are completed on time. How much time can you spend socializing? How much of that socializing really amounts to new contracts?

Google+ may be a great service, but it certainly seems that there are already too many social networks to keep up with. Vectrocon or its employees in their official capacity currently maintain pages or accounts with Twitter, Facebook, and LinkedIn. We belong to multiple networking groups. We maintain an email newsletter and obviously update our blog. The value of all of these items are very difficult to measure. We see a clear return on investment from some (but not all) of our networking groups. Those we intend to continue to pursue. However, we are already sharpening our knives when it comes to some of the other services.

If Google+ catches on, as it appears to be doing, it will raise the question of what we will eliminate in order to fit it into our already crowded social calendar. Will we drop our Facebook site? Will we slave all of our posts to our blog? We already do that to a large extent with Facebook and Twitter. One adoption hurdle for Google+ for our use will be whether we can push an RSS feed to it. If not, we probably won’t adopt it, unless it completely dominates.

You only have so much time to socialize. How do you intend to use your time? What resources do you think are most important? Have you measured your results? What measurement criteria do you use?

Share

Tags: , , ,
Posted in Uncategorized | Comments Off

Age of the Invincible Botnet? Age of Expensive Security! Definitely.

July 8th, 2011

A researcher at Kaspersky labs recently uncovered a botnet, or collection of computers that have been enslaved to do the work of a third party, consisting of 4.5 million computers.  The botnet features some extreme capabilities, ranging from its own encryption algorithm, multiple methods of communication between the slavers and the slave computers, an ability to hide itself in the master boot record of the computer and even detection and removal capabilities for rival malware.

The researcher claimed that the botnet was “indestructible”, and in the time since his disclosure, Microsoft has claimed otherwise.  Either way, for our small business technology clients, these new threats are becoming increasingly worrisome.  They are difficult to detect, nearly impossible to remove short of fixing the master boot record and completely reformatting the hard drive and they can be used for a vast array of activities that could cause problems for a small business.  It’s no wonder that less configurable but more secure platforms are becoming increasingly interesting to small business owners.  If you can’t load software, you can’t be infected.

The idea of pushing security to a third party is becoming increasingly attractive.  Although many folks worry about cloud security and data breaches, sometimes the weakest link in the security chain exists within your own small business.  If you don’t have your systems monitored all the time (and sometimes even if you do) you can let threats pass your defenses.  You need to buy and implement security software, provide training and establish best practices.  You have to fight the political battle between expediency and productivity on the one hand and adequate security (which always reduces productivity) on the other.  Anything that reduces the overhead associated with these activities will look attractive.

With new malware such as described by Kaspersky, whether it’s “indestructible” or merely extremely threatening, a small business must determine how much money they need to spend to ward off these types of pervasive threats, or whether its even possible to do so.

At Vectrocon, we’re becoming increasingly convinced that security costs could very well grow to be one of the largest maintenance costs for small businesses.  Between government mandates, credit card and financial institution mandates, public outcry about data breaches and direct costs of security software and infection rectification, small businesses should expect to pay more for securing their technology.  Any service that aids in reducing those costs needs to be considered.

 

Share

Posted in Uncategorized | Comments Off

Microsoft to Issue 4 Patches Next Week; Retire Vista SP1 and Office XP

July 8th, 2011

Microsoft will eliminate support for the Service Pack 1 for its Vista operating system, and will also retire Office XP (circa 2002) from support.  I don’t currently have any of our small business clients using these platforms, but just in case you are, be warned that you should seriously consider upgrading or determine ways to protect systems that have to use those particular software versions from outside attack.

Since this is an odd numbered month, the patch load from Redmond is light.  There is only one critical patch, and interestingly enough it does not affect any Windows server operating system, nor does it affect Windows XP.  This makes for a relatively small footprint.  The other strange part of these patches, however, is that they correct a lot of vulnerabilities – some 44 in all, which makes it one of the largest bug squashes in Microsoft’s history even though the patch count is small.

We expect our clients to have a relatively easy time with this patch release.  As ever, attempt to verify that patches work well in your environment prior to deploying them on live systems.

Share

Posted in Uncategorized | Comments Off

Mozilla Retires FireFox 4, Considers Retiring 3.6

July 8th, 2011

Microsoft still can’t kill Internet Explorer 6, but the Mozilla foundation, makers of the Firefox browser, have already killed version 4 and are seriously considering killing the even more venerable, but perhaps more widely deployed, Firefox 3.6

This is one problem with the Internet and the culture of constant modification.  All IT departments are forced to adopt to new technologies, even if the old technology works OK for them, because software developers now sacrifice their old code on the altar of limited resources.  If you want to continue to develop new products at breakneck speed, there is only so much time left to repair problems found in older versions of your software.

Many IT departments were very unhappy with the news that they will need to remove Firefox 4 from all of their corporate computers and replace it with a newer version, since security fixes will no longer be developed.  With security breaches rampant and their results devastating to those afflicted, no one can risk leaving unpatchable software lying around.

However, the cost for trying to remediate this problem could be quite high.  As long as you have tools to automate the process, it’s not such a major concern.  However, without such tools, this becomes a major problem.  Also, tools are great, but imperfect.  It takes time to prepare the tool, test the rollout and then actually use the tool to delete the old software and replace it with the new.

For small businesses, this probably isn’t such a terrible ordeal.  In many cases, to be blunt, their security is lax.  If an end user can install their own software, they have probably already upgraded to the latest version of Firefox automatically.  This, however, causes problems on its own…

Share

Posted in Uncategorized | Comments Off

Microsoft Office 365 Now in Prime Time

June 28th, 2011

Microsoft has moved its hosted suite of collaboration applications, dubbed Office 365 out of beta.  Depending upon the plan you choose, price ranges from $6.00 per user per month to $27.00 per user per month.  In the most limited plan, you still have access to Microsoft Outlook with full Exchange integration, access to a hosted version of Sharepoint, Microsoft’s Intranet in a box, the ability to host your own private instant messaging server and conduct online meetings.  Essentially, it’s corporate grade collaboration at a very attractive monthly fee, and there’s essentially no learning curve for end users.

In the Enterprise versions, depending upon the package, the integration with your on premise Active Directory is included (this allows you to have single sing-on to all your Microsoft functionality, from your PC to your applications), you are allowed 25GB mailboxes, you can search across mailboxes, in certain plans there is automatic archiving, anti-virus and anti-spam is included, and it can even integrate with your phone system for unified mailbox features, etc.  Essentially, Microsoft wants to own your communications stack, and they’re making it very attractive to outsource that function.

This is Microsoft’s first attempt to combat Google Apps with an in the cloud solution.  We have already used hosted Exchange and Sharepoint as well as the older OCS IM application from Microsoft, using a different provider, and the results have been very good.

Note that this service has already had outages, but then again, most businesses we know also have periodic IT outages.  As we’ve said before, when discussing any cloud service, including Microsoft’s, Google’s or any other providers, compare what has happened and what might happen and what you can pay to mitigate that problem in house vs. what might happen in the cloud.  No system is perfect.  The real question isn’t whether or not an outsourced application is 100% reliable – none of them are, the question is whether they are reasonably reliable.

Overall, we would guess that Microsoft’s “whichever way works best for you” approach to on premise vs. cloud might prove to be both a practical and marketing coup.  Just from browsing Microsoft’s main Office 365 page, we would suspect that interest is brisk.  Free trials are available.

Share

Posted in Product and Company Commentary | Comments Off

« Older Entries
Newer Entries »