Month: April 2006

  • My Mac is back. Oh yeah!

    I’ve been off the air effectively for two weeks with the temperature sensor issue. It’s been everything I could do just to do the things I had to do, like moderate the webappsec queue. Everything else – writing the Guide, responding to e-mail, doing my slides for OWASP EU, etc have all been put on hold. That really sucks.

    The AppleCenter told me that my Mac would be ready at 3 pm, so when I popped in at 4.45 pm to pick it up, I was surprised to find that it was not yet done. The tech replaced the lid and I got out of the store just after 6 pm. :(  

    AppleCenter Richmond repaired my Mac using a spare part from another G4 laptop that didn’t end up needing it, rather than wait any longer for the mythical part to come from Apple’s lephrechaun factory. The laptop now has no warranty, so hopefully it will survive long enough for me to save enough dosh to buy a MacBook Pro, or … more likely a nice shiny Dell. 

    The trackpad button is now really stiff and the temperature sensor is reading the ambient temperature of the interior of the case (around 25-40 C depending on use). This is good. However, I feel an eBay auction coming on as soon as I have the difference in dosh between the sale of the G4 and the next one. I can’t stand lemons.

    Now, to get my life back in order. If you’ve been waiting for an e-mail response from me, I can now do it. It will take most of Easter to get through them all. I beg for your patience. 🙁

     

  • Service Orientated Architecture (SOA) Security

    Recently, I’ve been doing a fair amount of work in the SOA area. It’s funny how many folks want to expose ancient code directly to untrusted third parties.

    All is not well in the SOA space, and it’s important to understand the risk of web service enabling calls to “trusted” systems. That code is generally not written to handle input from malevolent attackers – it was designed to be called from internal staff who you have a strong legal relationship with and all the motivation in the world to keep their jobs.

    This slide pack was intended for the April Melbourne OWASP chapter meeting, and it’s a basic taster of the stuff I’m going to be including in the forthcoming OWASP Guide 3.0.

    Securing SOA (927 kb, PDF)

  • Why Apple will never win the desktop dominance battle

    For the last few months, I’ve been battling a debilitating issue with my Apple G4 laptop. It has narcolepsy. The trackpad in many G4 laptops contains a faulty temperature sensor. It normally reads -16 to 4 C (which is wrong), but the operating system monitors it. From time to time (and for me all the time), the sensor will register -150 C to +260 C.

    When this happens, the OS puts the computer into emergency sleep. There is no way to turn this behavior off.

    This has not been the only battle with faulty hardware. My laptop lost half its memory shortly after I acquired it, and this required a new logic board to remedy. But not before Apple tried replacing all the RAM several times. In the end, it took Apple four or so weeks to get a new logic board. Luckily, I could struggle through with half my memory. Imagine if it was dead.

    Well, that’s where we are today. My laptop puts itself asleep almost continuously now. I can barely get 10-20 seconds out of the laptop. For all intents and purposes, it’s a $3600 silver hunk of crap.

    Apple in their infinite wisdom, must *see* the laptop fail. There are no Apple dealerships near me. I cannot easily take time off work. The Apple dealers which are open late do not have any service staff on after hours. You get the picture. I have the logs dating from January. I have the Apple support article. I know the part number. I can show the temperate sensor readings and the obvious places it goes crazy. Apple will not believe me because they haven’t seen it fail. Well, I finally managed to find some time to go take it to Apple in late March when it was totally driving me nuts. It’s now nearly 12 days later, and I still have a faulty computer.

    Compare this to the last Dell I had (I’ve had three). One morning, my hard drive crapped out. I rang them at 9 am to report the issue. The tech was there at 11 am, and I was using the recovery CD at 11.15 am. Or the HP workstation I bought in the mid-90’s after my last Mac, a Quadra 650. About two years into its three year warranty, the monitor developed a fault and I rang in to get it looked at thinking I might need to drop it off somewhere. No – HP sent out a courier the same day with a brand spanking new monitor and the courier waited for me to unpack the monitor and repack the faulty monitor. Now that’s service.

    Apple wants me to pay $530 for AppleCare to continue my warranty for another two years as my warranty runs out on Tuesday. It’s obvious that I need it with this pile of steaming feces – it’s a lemon. But why should I pay for such crappy service? As far as I’m concerned as a customer, if I tell you something is not right, you just tell me when I can bring the damn thing in and you will fix it right there and then.

    But no – Apple can’t currently tell me when the required part (a new “top” unit, which includes the temperature sensor for the trackpad) will arrive, so I’m forced to wait. They don’t provide me an alternative laptop in the meantime.

    Apple – I was considering a nice new MacBook Pro. Your truly awful customer service has turned me off your products. If you can’t be bothered to stand behind your $3600 products, when Dell stands behind their $1500 products so much better, I can’t honestly justify the additional $1100 to buy your crap.

    I’m not going to buy the $530 AppleCare. I’m going to save up for a nice new shiny Dell and end my switching experience permanently. This sucks.

  • Movie plot threat contest

    Don’t let your government be the only one to come up with insane and stupid reasons why they want to curtail your freedoms.

    Bruce Schneier has just the idea:
    Movie Plot Idea Submission Thread

    Feel free to submit a story idea – you never know, you may be the next Swordfish or Firewall!