July 2004 Archive

This was a partial fund raising show and we were on for an hour and a half. Our premiums are Gold Card Technical support, a 2 CD set with Pacifica archives of the political conventions narrated by Amy Goodman, a CD with an anthology of our shows up to and including tonight's show and Hank's checklist for how to maintain a computer.  See our premiums page. 

Our guest was Professor Rebecca Mercuri who discussed E-Voting and the danger to America - How easy will it be to steal the 2004 Presidential Election? Her web site is www.notablesoftware.com. 

For some background see www.verifiedvoting.org about voting-machine security and also E-voting: Nightmare or nirvana? by Paul Festa of CNET News.com June 30, 2004. 

There was an article on the front page of the New York Times today about electronic voting machines. In Florida, an audit was not possible because a computer crash destroyed the voting records and there was no backup. Way to go Florida.
  Lost Record '02 Florida Vote Raises '04 Concern By Abby Goodnough July 28, 2004

E-voting critic calls on hackers to expose flaws by Robert Lemos, CNET News.com July 29, 2004. Rebecca Mercuri called the current voting process a statistical game of shells, one that e-voting machine makers are playing for profits. 

The democratic party platform has nothing on technology and nothing on eVoting at all. Considering this is, in part, the reason they lost the Presidential election, Dr. Mercuri could not understand it. She had worked with the democratic party on this. 

Dr. Mercuri, well known for the “Mercuri Method,” a voter verified balloting process, has issued the “Mercuri Challenge.” Electronic voting software companies are invited to test their software at DEFCON, utilizing the best minds in security to prove or improve the accuracy of their systems. The Mercuri Challenge is available at www.notablesoftware.com/MercChallenge.pdf 

Ms. Mercuri will be speaking at the Black Hat conference on July 29th and at the DEFCON conference July 30th.

Press Release: 
eVoting Takes Center Stage at the Black Hat Briefings, The “Mercuri Challenge” is Issued 
Dr. Rebecca Mercuri and Bev Harris to Present Research on Election Data Manipulation in 2003 and Beyond

Seattle, Wash. ­ July 19, 2004 ­ Black Hat Inc, provider of digital self defense, today announced eVoting as a key issue for its Black Hat Briefings, taking place at Caesars Palace in Las Vegas on July 28-29, 2004. On the morning of July 29th, Dr. Rebecca Mercuri, renowned eVoting computer scientist, and Bev Harris, author of Black Box Voting: Ballot-Tampering in the 21st Century will present research on election voting manipulation to an audience of 2000 technically elite computer security professionals, including the best minds from government agencies and global corporations as well as the underground's best hackers. The full agenda of the Black Hat Briefings is available online at www.blackhat.com/html/bh-usa-04/bh-usa-04-schedule.html. 

Dr. Mercuri, well known for the “Mercuri Method,” a voter verified balloting process, has issued the “Mercuri Challenge.” Electronic voting software companies are invited to test their software at the Black Hat Briefings, utilizing the best minds in security to prove or improve the accuracy of their systems. 

“Thanks to the Help America Vote act, electronic voting software will be the primary tool used to count votes in the 2004 Election,” said Jeff Moss, CEO of Black Hat. "If the security concerns identified by experts are not addressed, it will be difficult to trust this technology in the future.”

Managing Election Data: The California Recall, July 29th at 09:00 
The California recall election, held October 7, 2003, was controversial on a number of levels. It was the first such Gubernatorial challenge in the state's history, it sported a slate of 134 candidates (from computer gurus to actors), and it was nearly delayed by a legal challenge from the ACLU on the grounds of potential disenfranchisement of certain population groups. The complex set of resulting vote data, from 58 counties using a diverse range of equipment, was subsequently misinterpreted to promote various agendas. This talk will lend insight on what may await the US in November 2004 by providing an analysis that dispels erroneous assertions about the benefits of electronic voting, while raising strong questions about both the accuracy of election systems and the reports generated from them.

Dr. Rebecca Mercuri became an overnight celebrity during the media frenzy that ensued when the U.S. Presidential election ended in a dead heat in November 2000. A few weeks earlier, she had successfully defended her Doctoral Dissertation "Electronic Vote Tabulation: Checks and Balances" at the University of Pennsylvania, and then found herself writing testimony in the now-legendary Bush v. Gore case that was working its way through the legal system. Her testimony was presented to the U.S. 11th Circuit Court of Appeals and referenced in the briefs to the U.S. Supreme Court. Since then, she has provided formal testimony on voting systems to the House Science Committee, Federal Election Commission, U.S. Commission of Civil Rights, and the U.K. Cabinet, has been quoted in the U.S. Congressional Record, and has played a direct role in municipal, state, federal, and international legislative initiatives. Rebecca's comments on election technology are frequently cited by the media, and she authors the quarterly "Security Watch" column in the Communications of the Association for Computing Machinery (archived at www.notablesoftware.com). Having recently completed a research fellowship at the John F. Kennedy School of Government in their Belfer Center for Science and International Affairs, Dr. Mercuri will be moving to Harvard University's Radcliffe Institute in the Fall.

Bev Harris, author of Black Box Voting: Ballot-Tampering in the 21st Century, began writing on the subject of electronic voting machines in October 2002.
Her investigative journalism has since been cited in The New York Times (three times), and on CBS, Fox News, and CNN. In writing Black Box Voting, Harris spent over two thousand hours researching voting machines, and interviewed hundreds of witnesses including many election officials and even voting machine programmers who work directly for the firms that build these machines. During the course of writing Black Box Voting, Harris discovered that one of the largest voting machine companies, Diebold Election Systems, had committed a massive security breach, leaving thousands of sensitive voting system program files on an unprotected Web site. These files have now triggered a national investigation and activism movement to restore clean, trustworthy voting systems.

Dr. Rebecca Mercuri and Bev Harris to Present Research on 2004 Election Vulnerabilities at DEFCON 12 

July 20, 2004 ­ DEFCON, the largest hacker gathering in the world, today announced eVoting vulnerabilities as a key topic for DEFCON 12,
taking place at the Alexis Park in Las Vegas, July 30 - August 1, 2004. DEFCON brings together a unique mix of the best minds from the hacker underground, government agencies, and global corporations. On July 30th, Dr. Rebecca Mercuri, renowned eVoting computer scientist, and Bev Harris, author of Black Box Voting: Ballot-Tampering in the 21st Century, will present research on 2004 Election vulnerabilities to this annual gathering of hackers. The full agenda is available online at www.defcon.org/html/defcon-12/dc-12-schedule.html  

In The News

HP and Dell are both offering deals on recycling old computers, monitors and printers. 

Congress increased the penalty for identity theft and for phishing. 

Spy Bouncer is itself Spyware even though it is sold as an anti-Spyware program. 

There is a new, nasty virus going around via email. It is called Bagle.AG and like other Bagle viruses it sends out spoofed e-mail messages. 
    Virulent Bagle.AG Virus Wreaks Havoc By Jay Munro in PC magazine July 20, 2004

Our guest was Danny Burstein of Panix, which is both an ISP and a web site hosting company. You can read about Panix web site hosting. The topic was what to look for in a web site hosting company. Joe has used Panix as his ISP for a very long time. 

Hank had a client with a very bad web site hosting experience, the site being down and then having year old files restored. Danny discussed the sorts of things to look for when choosing a web site hosting company. How reliable is your ISP? When you call them on the phone does a person answer it? At the very least you should expect daily backups. Panix uses RAID to allow for hot swapping of failed disk drives and does backups every six hours. 

When selecting a web site hosting company ask how much disk space and traffic bandwidth you are allowed in the basic monthly price. Also ask how fast a connection there is between the web server and the Internet. If you get your own domain, ask about email services provided.  

A family web site might be free with your ISP account. The cheapest Panix hosted web sites are $10 a month. These are at the Panix domain however. 

Patrick wants to make his own web site, but he only wants family members to be able to see it. Danny said that any web hosting company that runs the Apache web server should be able to provide this service very easily. Some blogging services also let you password protect your blog web site. 

Patrick also asked why he was spamming himself. This results from a virus on someone else's computer that spreads by sending emails to every email address it can find. Typically, the from address is forged and randomly chosen. 

The iTunes service just had its 100 millionth song downloaded. 

Danny said there is no real competition for DSL, all providers have to use Verizon's wires. If DSL is not working well, get cable. 

Beverly wants to sell stuff online. Alfred suggested Yahoo stores for handling the direct selling. eBay is another option, not for the auctions but for their fixed price selling. There are also companies/people that will help you sell merchandise through eBay. 

Bill asked about a program to clean out his registry. Hank likes a shareware program called Clean My PC. Alfred suggested doing a full backup of the registry before changing anything.

Our last caller asked about setting up a web site to sell her own CDs. Stevie suggested www.cdbaby.com and www.mp3.com also does this.  
  

HP and Dell going green Mercury News July 14, 2004. Dell and Hewlett-Packard will now recycle electronics for free. HP will accept old electronics equipment dropped off at Office Depot outlets across the country from July 18 to Sept. 6, free of charge. Dell will pick up old computers and their accessories at the homes of customers, if you buy a new Dell. 

We have just added a new web page to our web site for Hints and Tips. To send us your tips, send an email message to tips at pcradioshow.org. 

In The News 

New bug fixes were released for Windows and Internet Explorer. Time to run Windows Update. 

CERT recommended that you no longer use Internet Explorer due to its slew of security bugs (aka "holes"). 

Service Pack 2 (SP2) for Windows XP is expected at the end of the summer. The full version will be about 260 megabytes.

We discussed how it is sometime impossible for dial-up users to get bug fixes online because they are so big. 56K modems really transfer data at about 5K per second. Malcolm in Australia wrote to us after the show - he calculated the time to download the new service pack via a dialup connection. It is around 16 hours at 5k/sec, assuming of course, you don't get disconnected. In Australia he noted that many ISP's have a 4 or 5 hour hangup, to stop people from line sitting. 

What to do? If you have to download a service pack via dialup, use software that is capable of resuming mid-stream after an interruption. If you know someone with broadband and a CD burner, beg them for a favor. If you know someone with broadband and you have a laptop computer, bring it to the broadband connection. Finally, Microsoft has in the past sold service packs on CDs for about $10 or so. 

After the show, a listener sent us an article stating that Microsoft will distribute Service Pack 2 for Windows XP on CD for free. 

Could it be a trend? Usage of Internet Explorer has gone down for the first time. Perhaps people are concerned about the security bugs in IE. 
    IE Market Share Tumbles for First Time in Six Years by John P. Mello Jr. TechNewsWorld July 13, 2004 

If you are using the Firefox web browser, make sure you have the latest version which is 0.9.2. If you have 0.9.1 you can download just a patch rather than the entire browser all over again. This is still a beta version of the browser, the first production release (that is, with most of the bugs fixed) is expected in the middle of September. Michael and Joe are big fans of Firefox, despite the gripes with it that Michael has documented. 

Firefox is free, more functional than IE and more secure than IE. On the plus side, Firefox includes built-in pop-up blocking and tabbed browsing (opening multiple web pages in a single browser window). On the down side, there are some web sites that do not work well with Firefox. 

Spyware is breaking through to the main stream media. On July 12th the Wall Street Journal had a story by Lee Gomes called "Spyware Is Easy To Get, Difficult to Remove and Increasingly Malicious". Mr. Gomes, a tech reporter for the Journal, got hit with Spyware and decided to write about it. 

The definition of Spyware has expanded over time. It used to refer just to programs that run silently on your computer and try to watch what you are doing. Now the term has come to mean all sorts of malicious software, Michael prefers the term "malware". 

Cookies are the least offensive form of Spyware. In IE you can block cookies from "third parties", that is, advertising agencies by: Tools -> Options -> Privacy tab -> Advanced button. Firefox can also block third party cookies. You can also use anti-Spyware programs to get rid of tracking cookies that might still find their way onto your computer. 

Hank has been using some Linux distributions (distros) that run off a CD. This way his web browsing tracks disappear every time the computer shuts down. Later in the summer we will have a guest to discuss the use of the Fedora distro from Red Hat. 

Mouse Pointers 

Some are bigger than others. Some are right handed and some symmetrical. Joe used to use a mouse called Felix. Mice connect to the computer using one of three different ports: serial (old days), PS/2 or USB. The problem with USB models is that they may not be usable in safe mode and they won't work with Windows 95. Some mice work with the Mac, others only work with Windows. On fancy mice, you can push the wheel left or right for forward or back. Other fancy models have extra buttons on the side. On the bottom, there is either a ball (cheaper) or an optical detector. Optical mice are usually more accurate. 

Mice can be either wired or wireless. On some wireless models, the only way to turn off the mouse is to remove the batteries. When the batteries weaken, the mouse pointer will jump around. Wireless mice are either infrared or Bluetooth. You may not be able to use too many wireless mice near each other, they may cause interference with each other. 

Some work with Linux some don't. A mouse may work with one Linux distribution but not others. 

Pat can't get his CD-ROM drive to open. Alfred suggested a paperclip. Look for a small pinhole in the front of the drive and insert a paperclip into the hole, after having bent it out straight. Hank suggested trying to open the drive the normal way while at the BIOS setup screen - this to insure that Windows is not at fault. 

Michael from Iowa suggested a web page with a list of Live CDs. These are CDs containing a bootable version of Linux for people who want to see what Linux is without having to install it on a computer. You put a Linux Live CD into your computer and boot it up. 

Joe discussed tinyurl.com a free service that provides short URLs. 

Michael called to say we were being broadcast on short wave (9.87 MHz), which was news to us. After the show a listener emailed that Off the Hook simulcasts on short wave and someone probably just forgot to pull the switch at 8 PM. 

A caller asked for advice buying a new computer. Alfred recommended Windows XP Professional rather than the home edition. He also suggested Dell, something Michael disagreed with (see his gripes about Dell) because their technical support has not been good. Alfred felt they don't load up a computer with assorted software that you don't want. Hank suggested this is true of the EVO line of Compaq. Hank also suggested the NetVista by IBM. Joe and Hank are fans of the Shuttle, but there is no real tech support with it. 

The next caller asked about computers sold by the Home Shopping Network which come with tons of software. Michael felt that the more software is loaded on a computer, the more likely it is you will have problems. No one on the show was very impressed with the software bundles. 

A callers hard drive crashed and he was quoted $1,300 by a company in Texas to recover the data. Joe and Hank suggested he get an estimate from www.ontrack.com in New Jersey. Backup, backup, backup, backup, backup, backup, backup, backup, backup, backup, backup, backup, backup, backup, backup. 
  

In The News 

Microsoft just released a bug fix for Internet Explorer. Instead of releasing this fix on their schedule, they actually released it when it was needed. It is not really a patch in the classic sense, but instead it disables a single ActiveX program used by Internet Explorer. This program is often used to download malicious software to your computer. Most importantly however, there are still a few known bugs in Internet Explorer that have no available fixes. Microsoft is working on fixing these known IE bugs. 

• Another Internet Explorer flaw found July 7, 2004 by Robert Lemos CNET News.com. It was common knowledge that the most recent patch (bug fix) for IE did not fully fix the problem. This article provides some background. Quoting: "This marks the third time in a month that Microsoft has had to play catch-up to researchers' public disclosures about insecurities in Internet Explorer."
• Microsoft Security Efforts Blasted Microsoft Security Efforts Blasted By Erika Morphy Enterprise Security Today July 6, 2004
• Microsoft Internet Explorer does not properly validate source of redirected frame from US-Cert last updated July 6, 2004. 
• Are the Browser Wars Back? How Mozilla's Firefox trumps Internet Explorer by Paul Boutin June 30, 2004 in Slate magazine

Is it time to ditch Internet Explorer because there are just too many bugs in it? Two of us said yes, two said no. The US Government suggested not using Internet Explorer as one of the ways to avoid the latest round of bugs in IE (see link above from US-Cert). The most popular alternative web browser is Firefox from the Mozilla foundation. It is open source and, as such, totally free. 

Joe pointed out that there are web sites that will not work well with Firefox (the blame sometimes falls on the web site, sometimes on the browser). One of them is the New York Water Taxi. Michael has documented additional problems with Firefox on his computergripes.com web site including web pages that do not display well with Firefox. Despite these problems, he suggests using Firefox whenever possible. No one is suggesting getting rid of Internet Explorer, the point is just to use Firefox by default and only revert to IE for web sites that do not work well with Firefox. The classic web site that Firefox does not support is Windows Update which depends on ActiveX. This can be viewed as a good thing however as ActiveX is the source of many of the problems with Internet Explorer. Indeed, the just released patch, turned off an ActiveX program.

The Electronic Frontier Foundation is going to try to overturn ten Internet and software patents they deem "stupid". One patent is making telephone calls over the Internet. 

Dell has recalled portable power adapters for some of their notebook computers.
    Dell recalls notebook power adapter cords July 1, 2004 CNET News.com

Google is being sued by the company behind Googles, which are toys for children.
    Google faces trademark tug-of-war with kids Web site AP July 7, 2004

Joe did a review of  X1, software to help you find data and files on your computer. In effect, it is a personal search engine, one that works just on your computer. He liked it. 

It locates any word or group of words in the files and email messages on your computer. It can even search network drives. It can also preview the files that contain your search words. 

The searching is instantaneous. Needless to say, there is an upfront cost to building its index. You tell X1 which directories to index. Afterwards Joe found the cost of maintaining the index not to be noticeable. The estimated size of the X1 index file is 10% of your hard disk.  

X1 works with many email programs, but is optimized for Outlook. For example, you can answer email from within X1, but only with Outlook. X1 works on all versions of Windows, even Windows 95. The cost is about $100. 

Hank discussed the Shuttle PC compact computers. Shuttle computers are extremely small. Not as small as a notebook computer, but they are the smallest machines that use the same internal components found in full size computers. A typical model is 7" wide by 8" high by 12" deep. Many companies make compact computers, Hank called the Shuttle, the "Cadillac" of this type of machine. 

He's a big fan of the machines having put together 19 of them in the last few months. You can purchase a Shuttle machine fully assembled, but Hank is a fan of buying a bare bones edition. These come with the box, power supply and motherboard. You then have to buy and add the processor, ram, hard disk and CD drive. The motherboard includes USB, parallel port, video, FireWire, Ethernet, audio and more. 

The heat sink is very sexy feature of the Shuttle machines. Due to its excellent design the need for noisy fans is minimized. 

Hank has purchased Shuttle PCs from three on line dealers newegg.com, zipzoomfly.com and excaliberpc.com. They have all be fine. He mentioned that he built a shuttle box for $370. The components used in this case were: 

• CDRW 52X32X52|SONY CRX230ED-B2 BK  $27.00 
• HD 40GB|WD 7200RPM 8MB WD400JB      $57.00 
• CPU INTEL CELERON 2.4G 478P               $68.00 
• DDRAM 256MB ADATA|32Mx64                 $39.00 
• XPC ACCES|PC8 LPT CABLE BLACK          $7.00 
• BRBN PC SHT|SS51G W/FAN                 $169.00 

This does not include Windows however. Hank warned that the assembly instructions are terrible. If you have never put together a computer, don't get a bare bones system, go for a fully assembled version.  

Shuttle computers were reviewed recently in the Washington Post Shuttle XPC Packs a Lot Into a Small -- and Imperfect -- Package by Rob Pegoraro (registration required). 

Patrick asked about storing a single copy of his bookmarks for use on multiple computers. Alfred has worked with OnFolio that organizes both links and entire web pages. Joe uses PowerMarks. Firefox imports Favorites from other browsers. 

How do you extend a WiFi network? Alfred suggested just setting up more Access Points. 

Fergus has a virus that kicks in when he loads IE. Joe suggested using housecall.antivirus.com to scan your computer for viruses for free. Hank suggested getting all the Windows bug fixes too. Michael suggested using another web browser other than IE. 

Bob from Wayne, NJ got cut off by mistake. Sorry Bob, please call back. 

Verizon is offering a free home networking wireless router with their DSL service for new customers. It costs $99.95 but there is a $99.95 rebate. The deal ends July 17th. A caller wondered by Verizon says that speed and un-interrupted use of the service is not guaranteed. If they guaranteed the speed, they could be sued for not providing it. Also, your DSL speed is dependent on the distance between you and the nearest telephone switching office. Hank warned that you should be sure to install the filters on each of your telephones. The guys on the show are Verizon DSL customers and said the service works fine. Hank pointed out that this wireless router also has four ports for connecting Ethernet wires. 

Jim asked about fractals in the hope of adding detail to pictures he took at a low resolution. Nothing can add detail to a picture that is not there already. After the show a listener wrote that there is a program called Genuine Fractals by Lizard Technology that is the industry standard for making billboards and posters from non-vector artwork.

Hank recently used a regular camera at a wedding and scanned in the negatives to make digital pictures. He uses a Nikon Coolscan which can deal with a strip of six negatives (but not an entire roll at once). 

Frank gets 10 to 20 copies of his incoming SPAM email but only a single copy of the good email. He has anti-spam software on his computer but instead uses webmail from his ISP to filter out the junk. Michael suggested using the free MailWasher to weed out SPAM on your ISPs server before downloading it to your computer. Joe suggested I Hate Spam that sells for about $20 or so and plugs into Outlook Express. 

Daniel can not log on using AOL dial-up, he gets a no dial-tone error message. Alfred suggested making sure the phone jack works by plugging a normal telephone into it. Hank said to get the latest drivers, then do a software uninstall of the modem using Device Manager and then re-install it. Michael suggested using the Modems applet in the Control Panel which has a diagnostic feature. This at least verifies that Windows can talk to the modem. If it can, then the problem is one for AOL. 

Tim is doing a full virus scan with Windows XP and was advised to first disable System Restore. Michael pointed out that disabling System Restore wipes out all the backup checkpoints it has made. However, the recommendation to do this is in case a virus got copied by System Restore. Anti-Virus programs often can't get at the System Restore cache to check it for viruses. 

Donna asked about the difference between Celeron and Pentium. Hank said the major difference nowadays is simply in marketing - they are basically the same. The Pentium is faster in large part simply because is has a larger cache. Alfred said a Celeron should be fine. Michael said that if you have to ask the question, you can live with a Celeron. Hank said a 2.4 Celeron is about 20% slower than a 2.4 Pentium.