Larry Seltzer

A study by researchers at the University of Michigan finds that more than 75% of bank web sites had at least one design flaw that could allow attackers to compromise users accounts or their identities. Unfortunately, the data was collected in November and December of 2006. The research was presented in a paper last week […]

Before we go anywhere else with this, if you haven’t yet patched your DNS servers against the DNS spoofing bug revealed earlier this month, you’ve made a big mistake. Drop everything, cancel your vacation and patch it now. The news and blogosphere are full of advisories, such as this one from Microsoft, warning of the […]

Perhaps too late, it’s widely recognized now that the IPv4 address pool will run out in the next few years. The current prediction, based on current data, is for the IANA to exhaust its pool on Jan. 25, 2011, and for the last block from the last RIR (Regional Internet Registry) to go on Dec. […]

The most striking fact about the San Francisco network lock out case has been the absence of details that would allow an informed outsider to say “Oh, that’s what’s going on.” We’ve been left mostly with vague accounts from spokespeople. But one thing must be true of this incident: Administrative controls in San Francisco government […]

You have to give it to Apple. At least they’re trying, in their inexperienced way, to make the iPhone acceptable to enterprises. They even have a web page about it. The really bare-bones necessities may be there already: A mail client that can talk to Exchange Server, VPN support, some Oracle support. Perhaps most importantly, […]

The reports of domain tasting’s impending demise were met with skepticism in some quarters. The argument was that the new fees were insufficient, and that tasting would continue to be profitable. Domain Tasting, to recap, is a practice by domain speculators in which they register a domain and then drop the registration within 5 days. […]

The researchers who published a large study of Web browser security this week had a great idea and excellent data to work with. Too bad they overreached with their conclusions. A lot more is being made of this paper than is warranted. The researchers, from ETH Zurich, Google and IBM, looked at log data provided […]

PCs crash every now and then. We do what we can to prevent it, but we also have to prepare for when it happens. Any business that doesn’t have an effective backup plan, one that has been tested and has at least some off-site component, is being irresponsible. My favorite recent story of business backup […]

A new policy from ICANN will soon open up the Internet to a theoretically infinite number of new Top-Level Domains. How much of a difference will it make? In the short term, not a whole lot. In the long term it could have a big impact. I would argue it’s likely to cause more trouble […]

Last September, Errata Security CEO Robert Graham told us in an interview that SQL Injection was a great risk for Web sites based on many open-source tools and on older, pre-.Net Microsoft technologies. Boy, was that ever a prescient interview. Several months later, as Wired put it, a massive attack hit half a million Windows […]

The testing of anti-virus products has always been a tricky business. The better actors in that business are improving their standards, and this presents a challenge in testing. As I described recently, the most famous testing standards these days are bankrupt in terms of their value to users. The WildList and the VB100 tests which […]

Firefox 3 is finally here. I’ve been testing the betas and release candidates off and on and there’s no doubt it’s an improvement on Firefox 2, probably a big improvement. I’m moving over to it. Click here to read a gushing review of Firefox 3. For me, the biggest improvement in Firefox 3 is that […]