Unless you have HIPAA, PHIPA, SOX, CISSP, work for DoD, or just a company who values privacy. Then you get a Blackberry and download the right apps. There should be no such thing as an iphone or droid at a company who has security requirements. Please tell me I’m wrong with citations of how an iphone or droid is fully compliant with FIPS140-2 and is listed on the appropriate NIST site so I can show my attorney. Then I will snuggle up in my happy google cloud or let my coworkers get all happy in their iphone cloud.

I do envy you people who are arguing about megapixels and screen size. Not becuase your petty arguments have merit, just because I want the happy ladder instead of the Escher staircase.

One side note- I still challenge anyone to show me an iphone app with a real business use for me that can’t be replicated by blackberry or droid. So far it doesn’t exist. I think these are all fairly equal platforms and just flavors, not fat vs carbs.

netsh ipsec static add policy description=”ossec block list”

netsh ipsec static add filter filterlist=”ossecfilter” srcaddr= 69.89.20.50 dstaddr=me protocol=tcp mirrored=yes

netsh ipsec static add rule policy=”ossec” filterlist=”ossecfilter” filteraction=block desc=”list of ips to block”

netsh ipsec static set policy assign=y

This blocks windowsnerd.com

Add another entry for slashdot. Ipsec doesn’t like having an empty entry so leave an addy in there to seed it for a delete in another step:

netsh ipsec static add filter filterlist=”ossecfilter” srcaddr= 216.34.181.45 dstaddr=me protocol=tcp mirrored=yes

Now if you open the ipsec MMC, you will see an applied ipsec policy, crack it open and you will see both entries for each IP.

Try going to windowsnerd.com, slashdot.com and another page. The first two will not work. All traffic has been blocked

Unblock -

netsh ipsec static delete filter filterlist=”ossecfilter” srcaddr= 69.89.20.50 dstaddr=me protocol=tcp mirrored=yes

Repeat – now you can block and unblock by running the static add and static delete command over and over. It will update the policy you created in the first step. Not quite as cool as adding to hosts.deny and firewall, but the same end result.

This example is for use on an application like OSSEC. If you desire, you can specify per port, IP addy, DNS name, whatever you want.

Why is it taking so long for the Apple tablet to come out? It is getting beat over and over again. The Nvidia tablet, Dell slate, old school dell xt, oqo gear. Apple does things for good reasons.They are waiting for a a perfect storm of ideas. Small light touchscreen tech is maturing this year. Battery life is better with atoms and SSDs. And-

I’m guessing the Apple tablet is running a thinned down OSX. Probably named OS 11. It will be super lightweight, just some wireless drivers, graphics, small fast storage. Exactly what the standard cookie cutter Chrome OS machine will be later this year. All the manufacturers are ramping up on the touch screen slate. Apple will be fashionably late as usual (like on the current lack of security patches,) and dazzle us with some overpriced gadget. As always, I won’t buy one because I can’t afford the lack of bang for bucks. But if someone gives me a toy that cool I’ll be ever so happy.

Where does this leave me? Errr ummmm… Yipes. MS has been working on their own cloud for a long time. I wonder if it will arrive in time before the google hurricane.

So there is my crazy prediction for 2010. Apple iSlate or whatever is running a ChromeOS style OS, on near netbook hardware, and sold at Verizon with cell service. If they don’t have a light OS, goodbye Apple, and welcome google vs MS for the next cold war.

<localfile>

<log_format>mysql_log</log_format>

<location>/var/log/yourlogfile.log</location>

</localfile>

Restart ossec and it should start reading your mysql logs now. Anyone have additional rules to add in for mysql?

After an SSH into a new Ubuntu machine, you can see that there are patches available. And not just Ubuntu patches, for all the packages you have installed.

Dear Microsoft: I wish that at the login screen to Windows, in all that empty space, you have a box that says:

XXX programs can be updated. XXX are security updates

XXX drivers can be updated. XXX drivers address critical issues

Once this is done, I would like to see Microsoft leading a charge to develop a central patch distribution service like Linux does so well. Manufacturers would be responsible for updating and uploading their latest into the system. The default action would be to install updates as a manufacturer releases them. Settings would allow you to download and notify, notify only or ignore. At that point we add to the login screen-

XXX 3rd party programs can be updated. XXX are security updates

I think it will be a pain in the ass to set up. But not as much of a pain in the ass as users who refuse to update java, flash, quicktime, acrobat and everything else out there.

Go in the BIOS

Disable Flash cache

Switch from AHCI to ATA disk mode

save and reboot

This will unbluescreeen, allow you to update all of your patches, then go grab all the latest drivers and firmware from Dell Support. 

Linux does this too on certain machines/chipsets. Man it is a pain when they switch interfaces, the OS guys take years to recover.

http://www.pcworld.com/article/163836/eight_reasons_your_next_computer_should_be_a_pc.html

There are many many other reasons the cycle won’t be broken. Macs are cool, just not going to dominate.

Home users tend to buy what they have at work. Mac refuses to support old OS and software choices. Too many businesses get stuck in a rut where they run an old Windows OS because of an old application. Can’t do that on a mac. They want a low renewal and replacement age.

This can be seen in so many ways. Hardware that breaks a lot. Not ever easy to maintain. Even the G5 tower had impossible to remove processors despite their incredibly high failure rate. Wasn’t the G5 tower supposed to be all easy to swap things in and out of? pshaw. Macs are created to be as disposable as possible. Cracking all the imacs open has always sucked. The CRT monitors were always having huge issues. The mac air overheats. Just check the apple forums. Same problems, same chinese innards, different sticker. 

Mac is a closed system. Which is why it works well. It should as it is written/built by Apple(still amazing considering the amount of code for any OS.) They are getting close to the thin line between monopoly and cool small competitor. A closed system can’t survive with a large market share because law suits will force them to stop being a monopoly. No more scuttling mac clone vendors, software has to be supported longer, programs from 3rd parties cause kernel panics. Viruses and spyware runs rampant on OS’s that have too many 3rd party applications not conrolled by the MAC. Not a pc I want to own. I like the low market share closed system macs I own now. They don’t crash too often, have more patches than raggedy ann, but look good and keep clickin. Security through obscurity rocks. 

Mac can’t possibly keep the insane stock price can they? I hate when a stock is overvalued because it is trendy to own vs performing. Here are today’s numbers to compare-

top 2 rows are today, dividends are bunk from me looking on google quick.

yeah dividends are hard to predict right now, but go google it yourself. still more than 0 for the last 3. I don’t have any stock at $100 a share that doesn’t pay. 

Overall my psychic prediction is this- Mac can not have a large market share and still be Mac. If they get big, you will see malware, crashes, clones, and windows running on mac hardware. OR you will still see rabid mac fans supporting a small company that popularizes cool tech. Notice I didn’t say innovates, creates, invents.

This is not a setback that will keep me from using windows. I just think it is pretty funny and I’m still all ancy to get a real copy from MS instead of my current torrented version. See? Here is a little screenshot from their silly failure of a download client:

windows 7 beta failure to download