Well, I was warned.

People told me not to buy the initial version of the Intel laptops, but I figured Apple’s been doing this for a long time — how bad could it be?

Well, this thing is overheating like a mofo. Within 15 minutes it’s too hot to touch over the keyboard and anywhere on the bottom towards the front. This wouldn’t be such a big deal, except my CDRom stops working because of it!

I’ve been trying to install WoW for two days now and it won’t install. By the time I get to the third CD (out of 4) the drive stops working and the box is virtually on fire.

So, I got burned — figuratively. All the hype — all the blogging — all the anticipation — and my system doesn’t even function. I can’t install anything from the CD drive and the box makes me hot just using it.

I called Apple and they told me they’d get back to me in like 4 business days, and that if I call them they’d return my voice mail within 2 business days. Whatever.

If this doesn’t get solved like in the past tense I’m going back to my G4 and getting my money back. This has been nothing but a huge dissapointment.

So sad, too…the system is just awesome otherwise. So fast…so beautiful. I just wish it functioned completely and didn’t cause third degree burns. Baagh!

– (03.09.06) Edit — Well, Apple has stepped up and done the right thing. They are replacing my MBP outright. Way to go, Apple. (03.16.06) Edit — I’ve received the new system and the optical drive works flawlessly. Awesome!

A visitor to the blog recently asked the following of me:

“Please whip up a generic letter that people can send to webmasters why they should stop being such a gay turd head.”

I thought that was particularly poignant, so I wrote up the following as a standard response to send to webmasters whose sites are all borked up in browsers other than IE.

I encourage anyone who gets treated badly, i.e. the site looks like ass when visiting a given page, to send this (or something like it) to the webmaster. It’s like the voting thing; we can’t complain if we don’t at least make an attempt to be heard.

(Edit: My writing authority (Jason) is going to comment that I need to reduce this to roughly half its length, so if you have any editing ideas on how to clean this up I’d appreciate it.)

Dear Webmaster, Upon visiting your site I noticed that it is not fully compatible with the Firefox web browser. This in itself isn’t such a bad thing, except it’s an indication of a larger problem, i.e. that the site is not compatible with W3C standards. In the past it has been common, and almost forgivable, to code a website for Internet Explorer exclusively. Up until the last year or so, so few people were using other browsers that it didn’t make much sense to spend extra development time ensuring that a given site worked in anything other than Microsoft’s browser. That time has passed. A significant percentage of users are now surfing the web using a browser other than Internet Explorer, and this trend is only going to increase as more and more people are exposed to options such as Firefox, Opera, etc. As such, I would offer to you that it would be in your best interest to bring your site into the age of standards compliance. Not compliance with Firefox or Opera, mind you, but compliance with the W3C standards themselves. In fact, the reason that your site does not work properly in Firefox (which is one of the most standards compliant browsers out there) is because in developing for Internet Explorer your site has been literally “broken” in terms of standards. Microsoft has, for whatever reason, steadfastly refused to make Internet Explorer render code in an accepted way. As such, sites that are developed for Internet Explorer alone don’t tend to work correctly in non-IE browsers. But a careful eye will notice that the trend is to move away from this sort of “hobbled” website. Look at Bank of America’s site, or E-Bay, or Amazon. They all code according to the standards *first* — and then add any code they have to to make it look the way it’s supposed to in Internet Explorer. When properly developed, Internet Explorer users will still see the site as they always have, but the site will not be broken (as it is now) for non-IE users. Ultimately this approach will take very little time and energy relative to the benefit you will gain from the effort. By allowing *everyone* to view your site in a seamless manner you will quite simply have a larger number of happy users. Below is some information about the W3C, and some information about how you can go about making your site compatible. I enjoy your site and very much would like to return. Please make it easier for me to do so by welcoming standards-compliant browsers rather than offering them a sub-par experience. Thank you, The W3C Website: http://www.w3.org/ The Web Standards Project: http://www.webstandards.org/about/ A standards-compliant checklist: http://www.maxdesign.com.au/presentation/checklist.cfm

Penetration Testing is one of the most advanced skills within the information security field. It requires not only extensive knowledge but also an analytical and often times creative mind. It’s generally accepted in the community to be an area reserved for the best and most experienced within the infosec field.

While the pentest process involves mostly manual techniques, there are tools available that can assist one during the process. Most of these tools, however, do only small pieces of the process. They cover information gathering, vulnerability scanning, etc. No tool has ever claimed to be able to go from start to finish through an entire pentest — well, none until recently.

There’s a new tool on the scene that supposedly can do everything. It claims to be able to do the discovery, the scans, and finally the compromise and privlege escalation as well. Many in the industry are bothered by this for a number of reasons. First, there’s the primal fear issue. Will we be replaced by a well written piece of software? Ultimately the answer to that is no, but the second question is more poignant.

Will tools like this cheapen the discipline of pentesting — effectively making it available to less-skilled professionals?

The answer is yes, and I can tell you first-hand that it’s the case. Just now I was installing this tool (my company is all about it right now) and was given two options for doing port scans. I could either do the defaults or do custom scans. Fair enough. The problem was the subtext for the custom scan; it read:

“For advanced users.”

Excuse me? Is there another kind of user doing pentests? Evidently so. I openened the menu (to unveil the “advanced” options, you understand) and found timing options for how long to wait before sending “SYN” packets. Wow. That’s high-level stuff.

Keep in mind, this tool is used to emulate a full-blown attack on a customer’s network. this is supposed to be performed by highly qualified professionals with years of IT experience. As I said, it’s one of the most advanced skillsets an information security professional can have. The direct implication that the company that made this tool thinks there would be people performing pentests who didn’t know how port scans worked is quite scary. Worst of all, it’s a sign of things to come. More and more will be calling themselves “pentesters” on the grounds that they were able to get a license for an automated tool. It’s quite sad.

Ultimately it won’t matter because the results that a true pentester can get will always surpass the results of the unskilled wielding applications. But in the meantime our discipline will take yet another hit in the credibiliy department. When managers hear about this sort of application they automatically assume that running foo_tool is a pentest. And that mistake right there is what leads to a great many professionals (and their skillsets) being undervalued.

I swear — if I have to hear Bruce Buffer attempt to be his brother one more time I’m going to get violent. I am sure he’s a nice guy and everything, but he is without a doubt the worst announcer I’ve ever heard in my life.

His voice is painful to listen to; it causes hatred and anger to boil within me. At first it’s funny (he looks like Bill Murray’s character in Caddy Shack), but then after hearing it a few times it becomes the smell of burned popcorn.

For the love of God, will these people please get a new announcer? Just because his brother has a voice doesn’t earn him the right to torture millions of people. All the training and voice excercises have done nothing to help the guy; he needs to find something else to do.

It was fine when the UFC was just starting out — cool, he’s Michael Buffer’s brother — but now that it’s legit and becoming mainstream, they need to get someone in there that doesn’t cause physical discomfort in his listeners.

If I hear another person on Fox News say “Homicide Bomber” I’m going to get violent. I swear these people are retarded.

Here’s the concept for the term:

It’s not fair to the victims to call it a suicide bomber, because they didn’t only kill themselves.

Are these people completely dim? Do they think people regularly take themselves out (and only themselves) with explosives?

Here’s the real reason it’s a stupid term. Bombs kill people. When you hear that a bomb went off in a shopping mall in Tel Aviv, you know it was meant to kill human beings.

Now, that leaves two types of bombs — the kind where it was remotely detonated and the attacker was not killed, and the kind where the attacker had the bomb with them when they detonated it. That’s called a fu#%ing suicide bomb. It’s different because of the suicide — not because it killed other people.

Or, to put it another way — the term homicide bombing is redudant — suicide bombing is not. You can have a bombing that kills people that isn’t a suicide bombing, but you can’t have a bombing that kills people that’s not a homicide bombing. So why say it?

Sometimes I hate people.

For no particular reason at all I just feel like mentioning how much I like, and have always liked, Indian people.

To start with, I don’t think I’ve ever met an Indian person I didn’t like. It’s almost as if having a good nature is an element of the culture. When I think of Indians that I’ve known over the years (starting all the way back in school in the Bay Area), pleasant memories come to mind in every single case.

I guess my first statement wasn’t quite right; the reason I’ve been thinking about this recently is because not a week goes by when I don’t hear conversations where Indians are spoken of in a negative way. People (especially in the South) think of Indians as mindless idiots who go around stealing jobs from hardworking Americans. They make fun of their accents, the fact that they work so hard, and anything else they can cling to. The saddest funniest thing is when these mouthbreathers try and make fun of Indians based on their Muslim faith. “They need to get out of my face and go worship Allah!!”, they’ll say.

I’m quite tired of it. Not only are Indian people good natured, but I love other parts of their culture as well. I like the fact that they are quiet. You never need to call the police to complain about your Indian neighbors, for example. I also like the fact that they have such strong family values, and how focused they are on education. I love their desire to acheive.

People make fun of the gas station stereotype, for example, but what they don’t realize is how much of an accomplishment it is. These people who had to learn Engish as a second language, and here they are thriving in a foreign land. I applaud it. And to those who are bitter, I say you’re sad little people who should be ashamed of yourselves.

To put a point on it, I think this country would be a whole lot better if more Americans were half as intelligent and motivated as the average Indian in this country. Luckily, there is a cure for the problem — books. Unfortunately, they’re like Kryptonite to so many in this country.

Someone pointed out this Gentoo flame article the other day and I just got around to finally reading it.

Well, it was lame. Not because the guy likes Slackware better than Gentoo, but because of the reasons he gave. His major gripe seemed to be that it was difficult to get KDE running in Gentoo.

I say bovine fecal matter. I just showed two relative Linux novices how to do this exact same thing in very short order, and I’m not even a “Linux on the desktop” kind of guy. Do you know what the key was? RTFM. Gentoo’s documentation is utterly sick. Between the official offerings and the Wiki, you can essentially do anything you want by reading the literature. That’s anything from getting sound working to getting Snort to report to MySQL.

Look, I’m a fanboy, to be sure, but I’m an inclusive fanboy — meaning I love singing the praises of my distro but I don’t get off on trashing the alternatives. My basic philosophy is that which is highlighted in my article called Geek Battles: A Call For Perspective.

Essentially, if you like a given tool and are able to use it to effectively create things, then that’s all that matters. How leet that tool is, or whether or not leet people use it, is irrelevant. You can’t be leet by using leet tools but failing to do anything with them.

Anyway, I digress.

I love Gentoo for a very simple reason — it’s the Linux distro I’m the most comfortable with. I have a good friend that spent a lot of time in a Redhat shop, and he keeps finding himself going back to it. Why? Because it’s familiar to him, and that’s the most natural thing in the world. Any fool running UberLeet Distro version 7 better know some serious Kung Fu if they intend to give my buddy any flak for running what many idiot’s think is a “lesser” distro. They’re likely to be severely embarassed. Ken knows crane style, and if uberboy isn’t versed in defecating chinchilla he’s in for a rude awakening. :)

Look, use what you feel comfortable with. For me that’s Gentoo (and Debian to a lesser degree). But for the love of God, if you don’t feel comfortable with a distro, don’t embarass yourself by claiming it’s trash — especially when the main problem you had with it was based on not reading the instructions. People like this need to seriously get a grip.

I listen to like 5 channels on XM, and two of them are Fox and CNN. Lately I’ve become absolutely militant when the news gets interrupted with the same exact guy doing commercial after commercial about home refinancing, GoToMyPc, or whatever else. It’s insane.

Not only do the commercials suck, but I’m paying like $13 a month to listen to them. To top it off, they took my favorite station off the air, making it available online only.

I’m seeing less and less benefit to this service as time goes on. If things don’t change quickly I’m either going to be looking at Sirius or dumping satellite radio altogether.

So I’m in a room tonight and the whole group I’m with is going off about how they hate companies that employ Indians for tech support. I listened for what seemed like hours as they made feeble attempts at explaining why Indians shouldn’t be allowed to do tech work.

Then, in a fit of stupidity that highlighted the whole event, one of them tries to imitate one of the Indians giving him support:

“I don’t know the answer to your questions, sir. Let me go and consult Alah.”

I shouldn’t have smiled (I was there professionally), but I turned away so they couldn’t see me and supressed a laugh. The true joy in this is that if any of them had seen me, they would have thought I was simply partaking in their witty humor.

In fact, I was about to piss myself over the irony of the situation. Here you have a group of dumbass rednecks who think Indians worship Alah trying to make fun of the people taking their jobs. It’s just too good.

The problem with most cell phone carriers is that they’re too predictable. You call someone and they answer. You call them, they answer. On and on like that with no variation.

Cingular has a way of handling that pesky monotany — give different responses.

Just today, for example, I called a buddy of mine and got a busy signal. Turns out he wasn’t on the phone. That’s cool. Other carriers would have put me right through to him. Not Cingular though — they’re breaking new ground.

The next time I called him I got the three tone error message saying that the number didn’t exist anymore. Just for giggles they made it an ALLTEL error. That was creative.

On my third attempt I got through to him. Boring, I know, but it turns out it was ok since I really wanted to talk to him. Oh, and all of these calls took place within like 5 minutes, by the way.

Anyway, it’s good to know that in a sea of followers, Cingular is willing to break out and try something other than the overplayed “call –> answer” model. I’m glad to see innovation is still alive and kicking.