Larry Seltzer

The DNS is fragile they say. Not only is it another one of those old Internet protocols that was never designed to handle either the load or the level of attack to which it is subjected today, but the sheer number of DNS servers out there is immense, and many are misconfigured. Imagine then trying […]

I can imagine, back in 2000, a company taking offense at a vulnerability report and having a bad attitude about it. Back then you could forgive people for thinking that exposing such problems will make things worse. Things are different now. There’s only one way to approach such things these days: embrace the idea that […]

Look back at the security news three or four years ago and you’ll see a “worm of the week” phenomenon in action. Malware was spread, and botnets created, through e-mail messages. These e-mail messages had attachments and social engineering that attempted to trick the user into running the attachment. This approach is now comparatively rare, […]

I can sympathize with Microsoft’s Jeff Jones. We both like to throw gasoline on a fire now and then. It’s fun to see the flames that ensue. The flames last week came from Mozilla, responding to Jones’ Browser Vulnerability Analysis report. Jones, a “Security Guy” at Microsoft, has made a hobby of monitoring and reporting […]

Early this year I noted that Web site hacking is where it is at. Vulnerabilities in server-based software are a growing trend and management practices make it more likely that such sites will go unnoticed. As 2007 comes to a close, we see another wave of such attacks, especially those that attempt to manipulate search […]

“Not Invented Here” is an unfortunate syndrome that affects many a company. I think NIH is the unfortunate driver behind Microsofts policies on SMTP authentication. Were all suffering as a result. This is the second in my “Microsoft Could Do More” series. Microsoft has done more than most with respect to SMTP authentication, which is […]

Most people must assume that theres some agency in charge of the Internet, someone who can enforce rules and impose new standards. Of course there isnt. Partly its from misleading representations of technology on TV and the movies. I especially remember one “Law&Order” episode in which the NYPD computer guru ran a “tracert” program that […]

This could be the first in a series of probably intermittent columns on things Microsoft should be doing. Its important to note that starting a few years ago Microsoft finally got religion on security, and it does a heck of a lot for its customers and the community at large. But it could do more. […]

Ive had an interest in digital signatures for code signing for a while, but it seems to me theres been a lot of action lately in the field. Code signatures dont get a lot of respect from people who consider them an inconvenience, either for legitimate or illegitimate use. Opponents often disparage them as imperfect […]

You wouldnt go surfing to just any site. Youre careful about where you go. You only go to sites you trust. But who are you trusting? A series of recent attacks has resulted in seemingly respectable news sites serving malware and redirecting users to sites that serve malware. The problem is in the ads on […]

So it turns out that Comcast is slowing down BitTorrent traffic. The term often used is “rate-limiting.” In fact there are some claims that Comcast is flat-out blocking the service, but it says it is only rate-limiting, and I believe it. I have had readers contact me to say that they run BitTorrent on Comcast […]

This is what we get for taking Alan Turing’s name in vain. The ‘T’ in CAPTCHA is for Turing and his famous proposition that a machine could be said to be called “sentient” when a person out of view talking to it could not tell if it were human or machine. The goal of a […]