Larry Seltzer

Many years ago, I saw Timothy Berners-Lee, father of the World Wide Web, speak at a conference. His message was that URLs users could decipher were a bad ideal; Web applications should employ URLs that are deliberately complex, black boxes for which only the Web server has a key. I dont recall the specific reasoning […]

Its not uncommon in the browser-vulnerabilities business to hear about an issue that crashes the browser. Most of the time you hear about Internet Explorer—justifiably so, since its the one nearly everyone uses. Other browsers have these same problems, too. You just dont hear about them for the same reason you dont hear about the […]

The latest buzz on the worm wire is Palyh, a.k.a. Mankx, a.k.a. Sobig.B. It does very little that hasnt been done by dozens of other Windows mass-mailer worms (it also spreads to network shares, if available), but it did spread very rapidly. I received a couple copies of it myself in e-mail before the new […]

I once was technical director at a computer magazine for which sci-fi writer Orson Scott Card wrote a regular column, prompting me to read the “Enders” series of novels. (Bad column; great novels.) I was reminded this week of an event from one of these books, in which (if I recall correctly) an advanced civilization […]

Im still wondering whats so special about the Fizzer worm that set the Net on fire this past week. Reports from antivirus vendors had the new worm spreading far and wide. Its Wednesday night and the storm appears to be passing. A second payload could somehow lie undetected and ticking, but enough smart programmers with […]

For how many of you out there is running a firewall—or running IT in general—central to your business? I bet the percentage is a small one. Nevertheless, you have to do these things in order to protect and facilitate the things you really do for a living. This is why I believe in services for […]

Spam filtering is an exercise in trade-offs. There are many different technological approaches to the problem, and some are implemented better than others. But the different approaches also have their own inherent problems, and your tolerance of those problems is part of the equation in deciding whether the approach is a good one. One of […]

So afraid was the government of encryption that they once pursued Phil Zimmerman, author of PGP (and according to Zimmerman hes still under investigation), for releasing free encryption software. I think its important to oppose such investigations for reasons of libertarianism, but you have to wonder why the obcession with encryption when there are far […]

Theres a security show running in London right now called Infosecurity Europe 2003. As a promotional tease, the organizers of the event arranged a frightening little survey. They went to Londons Waterloo (train) Station and looked for people in business dress with briefcases and other trappings of business and asked them for their computer passwords […]

Ive been guilty of this one myself, but like so many practices that now are widely known to be unsafe, who knew at the time? The problem is SQL injection. The very short form of the description is that the attacker finds a data-driven Web site where forms are used to provide data to a […]

Microsoft recently published guideline documents for security hardening of Windows 2000, both for workstatios and servers, and Windows Server 2003. The Windows 2000 document, the Windows 2000 Security Hardening Guide, provides a baseline level of coverage to be supplemented by numerous other guidelines. The Windows 2003 document, the Windows Server 2003 Security Guide, describes the […]

Perhaps Microsofts biggest mistake with Windows 2000 was including a number of services in the default installation that were not necessary for most servers—most prominently, Internet Information Server (IIS) Version 5. Im told by insiders that even during the Win2K beta, Microsofts JDP (Joint Development Program) partners—the very large customers who are the engine of […]