Daynotes Journal Week of 18 August 2003 Latest Update : Sunday, 24 August 2003 09:17 -0400

Monday, 18 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

10:07 - I'm back. Not hitting on all cylinders, but I am back. I'd actually intended to continue posting last week, but I decided to take the week off. Anything I'd written you probably wouldn't have wanted to read anyway.

I was thinking about what to do as a memorial to my mother and father, and I decided to name a double star after them. Now, the International Astronomical Union will tell you that only they are entitled to name astronomical objects, but they're full of it. Historically, the person who discovers something is entitled to name it, a right that is still generally recognized today. If the discover chooses not to name his discovery, it's up to the first person who cares enough to give it a name.

There are a lot of double stars out there. In fact, double and multiple stars are more common than single stars, although it may take a serious telescope to show the companion to what appears to be a single star. Most doubles have no names, or perhaps only the primary is named. The vast majority of double stars have only catalog designations.

I had several criteria in choosing a double star to name for my parents. First, I wanted one that would never set at our latitude of about 36° N. In other words, a circumpolar star system, one located near Polaris. Second, I wanted a reasonably bright pair, but not so bright as to have drawn too much attention. There are millions of very dim doubles out there. Our 10" scope can see down to about 14th magnitude, but I wanted a pair that required no more than a binocular to view. Third, and perhaps most difficult, I wanted a pair that were closely matched in brightness. There are millions of pairs with a large difference in magnitude. The primary might be 4.5 and the secondary 12.3, or whatever. But I wanted a pair that were much closer in magnitude, ideally within half a magnitude. Finally, I wanted a stable pair with a reasonable separation, which is to say a pair that is separated far enough to be easily split and that maintains a consistent separation.

I found such a pair. Its catalog designation is STF1694. It's located in the constellation Camelopardalis, about 7° from Polaris, which means it never sets in most of the Northern Hemisphere. The primary is visual magnitude 5.29, and the secondary 5.74, which means they are very close to the same brightness, and are just at the limit of naked-eye visibility on a very dark, clear night. It's also a very stable pair. In 1820, the separation was 22.0 arcseconds, with a position angle of 328°. (The position angle, or PA, is the bearing of the companion relative to the primary, in this case 328° or about NNW). In 1997, the separation was 21.5 arcseconds, and the PA 329°. Until now, no one had cared enough about this pair to give them an official name. I do, and so I've named them. Here's a starchart that shows exactly where they are.

As of now, the primary and companion stars in the double star cataloged as STF1694 have official names. The primary is William Ewing Thompson and the companion is Lenore Agnes Fulkerson Thompson. And so they will remain, forever. I plan to call them "Mom and Dad" for short.

Back when all the to-do started about civilians getting smallpox inoculations, Jerry Pournelle and I were speculating about our own resistance. Jerry had had one inoculation at age 6, before he started school, about 64 years ago, and a second when he joined the army and was sent to Korea 50 years ago. I had had an inoculation 44 years ago, before I started elementary school.

At the time, everyone was saying that inoculations given so many years ago had worn off and would confer no immunity. Jerry and I agreed that that was stupid. Surely we would be better off than someone who had never been inoculated, even if our immunity was limited. After all, a child who catches a viral disease is ordinarily subsequently immune for life from that disease. Why shouldn't a smallpox inoculation confer similar lifetime immunity? Antibodies is antibodies.

As it turns out, it appears that the "experts" were wrong and we were right. The newspapers and on-line news sources are now reporting that a smallpox inoculation does confer long-term, perhaps permanent, immunity. I don't recall when routine smallpox inoculations ceased, but I believe it was in the early 1970's. If so, anyone 40 years old or older should rest easier the next time the news media starts blathering on about the dangers of a smallpox epidemic being loosed by terrorists.

[Top]

Tuesday, 19 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

10:43 - I need to do something about my main file server, which is running NT 4 Server. Alas, NT4 is now EOL as far as Microsoft is concerned, so the choice comes down to installing Windows 2000 Server, which I have; a later version of Windows Server, which I could get simply by requesting it; or Linux. Guess which one I've decided to install. Yep, Linux it is. As far as I can see, Windows Server buys me absolutely nothing. Linux running Samba can do anything that needs to be done, and can do it on a lot less hardware than Windows Server would require.

If anyone knows of particularly good Samba tutorials, configuration guides, etc., please let me know. I think my goal is to set up the Linux server to look pretty much like an NT4 Server file server. That is, it will be the PDC for the local Microsoft Networking domain, and will serve files to Windows and Linux clients.

Windows 2000 Service Pack 4, which I have installed on my den system, appears to have a significant problem. At least, I think it's SP4 causing the problem. Periodically, for no apparent reason, the CPU utilization peaks at close to 100%, preventing anything from working until the problem goes away. The problem may last anything from a few seconds to several minutes. Actually, it may last indefinitely under some circumstances, because the longest I've left the system hung before doing a power reset is about five minutes.

When this happens, even Task Manager takes forever to come up, which made it kind of hard to figure out what was going on. I finally did nail it, though. Services.exe grabs 99% of the processor and won't give it up. I have no idea why it does this. My usual solution when a process goes zombie on me is to kill the process, but that's obviously not a solution for services.exe.

Last night, I was just finishing a game of FreeCell. I moved the last card to win the game, and the cards started moving up to the top stacks. It got as far as the sevens and then froze up. I immediately fired up Task Manager, and found for about the tenth time in the last few days that services.exe was using 99% of the processor. I sat there watching it for thirty seconds or so, and the system finally came back to life, with services.exe dropping way down in CPU utilization. There was nothing special going on, just FreeCell.exe and the usual background services. All of those run on my other Windows 2000 systems with no such symptoms, and none of those other systems are running SP4, so I conclude that it's very likely that SP4 is causing the problem.

I'm afraid the solution may be to revert to an earlier SP, assuming that's even possible.

11:05 - Here's an excellent candidate for the next Darwin Awards. According to Jerry Pournelle, one of Larry Niven's Laws is:

"Do not throw shit at an armed man. Do not stand next to someone who is throwing shit at an armed man."

So, this moron reporter, who to make matters worse is of Palestinian origin and appearance, is working in a war zone. He points a shoulder-mounted television camera at a US tank. One of the tank crew, understandably nervous about RPGs, shoots the dumb son of a bitch. And people are outraged.

Give me a break. That tank crew member did exactly what he should have done, and in doing so did the gene pool a favor. Alas, according to news reports, this moron reporter had already succeeded in passing along his defective genes to a new generation.

According to reports, the US military offered their condolences and called the shooting a mistake, which is much more than they should have done. A more appropriate response would have been something like, "We're sorry we wasted ammunition on that dumb son of a bitch."

11:36 - SoBig.F has started to proliferate again big-time. I'm not sure what triggered it, but there is definitely a flood of SoBig.F messages on the Internet today. I was just reading an Inquirer article about it. When I finished reading the article, I checked my mail and found nearly a dozen SoBig-related messages that had come in in the last half hour or so. Half of them were SoBig.F-infected messages. The rest were warning messages from moron mail servers, telling me that I'd sent them an infected message. Of course, I hadn't. I really wish mail servers wouldn't return messages to the forged "From:" address. At least most of them were simple text messages of a kilobyte or two. One truly moronic mail server sent me a 100+ KB warning message that included the infected attachment. Duh.

11:41 - It's worse than I thought. I just checked my logs, and SoBig.F-infected messages are arriving here at a rate of 25 per hour. That's ridiculous. What set this thing off again?

12:40 - I just sent the following message to subscribers:

A new variant of the SoBig worm, SoBig.F@mm, is flooding the Internet. For details, see:

<http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html>

This worm appears to be particularly virulent. My main email account alone is now receiving infected messages at the rate of more than 100 per hour, up from 25 per hour an hour ago. This thing is spreading very fast.

And it's getting worse. My main email account is now receiving SoBig.F messages at the instantaneous rate of about 200/hour, up from 100/hour half an hour ago, and 25/hour an hour ago.

Update your AV sigs. Symantec has updated sigs for SoBig.F, and I presume that the other AV vendors will soon do the same, if they haven't already.

14:00 - If I were the Marine who had just married this woman, I think I'd tell my lawyer to get me an annulment, no matter what it cost.

14:35 - I see that Microsoft has announced pricing and availability for Office 2003. As usual, they've priced it literally an order of magnitude higher than what it's actually worth. I'm wondering if there's anyone, anywhere on the face of the planet who actually needs Office 2003. I doubt it. From Microsoft's viewpoint, of course, this is an excellent upgrade. It will generate a lot of revenue for them, and will perpetuate their proprietary Office format lock-ins.

I've heard it said that Microsoft enjoys 80% gross margins on Office. I'd be shocked if it were really that low. I think something on the close order of 95% is more likely, given the amount of work involved to produce Office and the number of units it sells. At the volume they sell, it can't possible cost more than $5 or so to produce a retail box, and of course most units of Office don't include that expensive $0.25 CD and the couple dollars in packaging and pamphlets that the retail box uses.

I hope Office 2003 falls flat on its face, not because I wish Microsoft ill, but because I wish proprietary data formats ill. Microsoft is making much of their adoption of XML in Office 2003, but of course they're using a Microsoft-flavored XML. Microsoft can't help embracing and extending. It's what they do. But anyone who wants a standards-compliant XML-based office suite need look no further than the free OpenOffice.org.

14:56 - Processes tend to be permanent, continuing to be used long after anyone remembers why they were designed that way in the first place, and even when it makes sense to alter them to reflect new realities. Today, Jerry Pournelle says:

I am printing out Burning Tower in Courier Double Spaced 12 point so that it will look like a typewriter did it, and sending it to the publisher. Progress in the publishing industry...

Which reminds me of a law firm for whom I once did some consulting. They were faced with a disaster, because the company that printed their invoice forms had discontinued the six-part form they had been using, and now offered at most a five-part form. I was holding one of their six-part forms, and the conversation went something like this:

Them: "Oh, woe is me. We'll have to re-design our entire billing process because now we'll have only five copies of each invoice rather than six."

Me: "What do you do with the six copies?"

Them: "The original, white copy and the blue copy go to the client. The client keeps the white copy and returns the blue copy with their payment. We file the green copy in the client file, the pink copy in the matter file, and return the aqua copy to the billing attorney for his invoice file."

Me: "What do you do with the canary copy?"

Them: "Oh, we throw that away."

Sometimes it's very hard to keep a straight face.

[Top]

Wednesday, 20 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

9:58 - I am still covered up in mail. I am embarrassed to say that I have messages from new subscribers that I haven't had time to process yet. I appreciate your patience, and I'll try to get caught up. I'm still working on the backlog that started to build up late last month when my mother went into the hospital. I hope to have the entire backlog cleared in the next week or so.

Yesterday didn't help any. I was getting so many SoBig.F messages that at times spam messages began to look rare. The SoBig.F plague peaked for me at around 200 messages per hour. That's actual infected messages. In addition to those, I was getting probably another 200 messages per hour from mail servers bouncing messages they thought were from me.

Things settled down a bit yesterday afternoon and evening. When I checked my mail at about 7:30 this morning, I had received 140+ new SoBig.F messages on all accounts since about midnight, so the rate had dropped off to about 20 per hour. Of course, I had another 100+ delivery error messages as well.

What's really interesting is that about half the SoBig.F messages I've received had no attachment. It was clear that they were in fact SoBig.F messages by the subject lines and body text, but the attachment was missing. That's not happening at rocket, roadrunner, or my other mail servers, so I can only conclude that many outbound mail servers are stripping the attachment.

Here's irony, Microsoft style. Over on the HardwareGuys.com messageboard, one of my readers posted a link to this page. Apparently, services.exe jumping to 100% CPU utilization is a known problem. Here's the irony: In that article, Microsoft says:

"Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Microsoft Windows 2000 Service Pack 4."

I'd never experienced that problem on any of my Windows 2000 systems until I installed SP4. Way to go, Microsoft. It now appears I have a decision to make. Option 1, I can install SP4. Hmmm. That's probably not going to work, given that SP4 is causing the problem. Option 2, I can call Microsoft to get a hotfix, which they provide only upon request. Heck, if the person I talk to agrees that the problem isn't my fault, they may not even charge my credit card. I don't think so. Option 3, uninstalling SP4, was a non-starter. As it turned out, I'd apparently told SP4 setup not to save the old data, so I can't revert. There is, of course, Option 3A, stripping the drive down to bare metal and re-installing Windows 2000, but that doesn't seem reasonable. Right now, I'm inclined to choose Option 4, which is to upgrade that system to Red Hat Linux 9.

I like this guy. The BSA Gestapo showed up at his business. He hadn't done anything much wrong, but ended up paying many thousands of dollars in fines and legal fees. Worse still, the BSA made his company a poster child. Mr. Ball decided he was mad as hell and wasn't going to take it any more. So he banned Microsoft software from his business and converted to OSS. Take a moment to read this article. This guy speaks plainly and blows away all the FUD that Microsoft works so hard to propagate about the difficulties and costs of using OSS in a typical small business. He sounds like a man I'd like to know.

And speaking of Gestapo, it appears that, for the first time, SCO is getting ready to take legal action against a Linux end user. They haven't announced the name of the company that is their intended victim, but it occurs to me that the Mafia uses Linux, too. Hmmmm. Wouldn't that be nice... I can just see Darl McBride waking up one morning and finding a horse head in bed with him. I really, really hope that SCO picks on the wrong company. I don't doubt that IBM and Red Hat will weigh in with legal and financial aid for whatever company SCO picks on. The advantages to them in discovery alone would be too great to miss that opportunity. I'm almost inclined to send SCO a nyah-nyah letter.

Obnoxious Microsoft EULA department: Yesterday, in addition to the MSBlast and anti-MSBlast worms and SoBig.F, the Internet was flooded with messages from Microsoft to their IM users. I didn't get any, because I don't use IM of any sort, but many people I know got literally dozens of copies of the same message. The Inquirer took the time to read the new EULA for Microsoft's IM, and posted some fascinating excerpts.

Basically, anyone who accepts the new IM EULA agrees that Microsoft may force them to upgrade to a new version at any time, even if they're happy with the old version. Also, Microsoft reserves the right to charge for any new version. Isn't that the way heroin pushers work? Offer people free samples until they're hooked,  and then charge the hell out of them. Yet another reason to avoid Microsoft and its EULAs.

10:47 - I just finished off another 2-litre Coke, and that reminds of a habit I have. Barbara must find it very annoying, but she's been a good sport about it. Not all of the time, but sometimes when I empty a 2- or 3-litre Coke, I rinse it out, fill it with tap water, and store it. I won't be comfortable until I have at least a kilolitre of stored water.

I'm sure that sounds bizarre to many of my readers, but anyone who lives in Cleveland or Detroit can probably appreciate my actions. Many people there had no water at all, because there was no electricity to run the pumps, or the water coming out of their taps was unsafe to drink. This time, the problems were of short duration, a couple days to a week, but there's no guarantee they'll be short-term next time. In our case, for example, a tornado or inland hurricane could wreak havoc with our water treatment facilities. If severe damage occurred, it might be a month or more before full service was restored.

A reasonable amount to store is one gallon per day per person, or roughly 25 litres/week. That covers drinking, cooking, and minimal sanitation and personal cleanliness. Beyond that, I'd like to have additional water stored to help friends and neighbors, and it would also be nice to be able to flush the toilets occasionally. On that basis, and planning for a month without water service, a kilolitre seems a reasonable goal.

Storing the water is simplicity itself. All you need do is rinse the empty soda bottle thoroughly and fill it with tap water. Tap water is chlorinated sufficiently to make it unnecessary to add chlorine bleach or another disinfectant. If you want to be really thorough, you can run each bottle through a quick final rinse in a pan filled with bleach diluted 1:10 or 1:20 with water. If you're really concerned about stuff growing in your stored water, you can add a couple drops of bleach to each bottle before you cap it. I generally remove the label and use a Sharpie to date the bottle.

Having a good supply of water and a reasonable stock of nonperishable foods can make the difference between continuing to live reasonably comfortably during an emergency and having to evacuate or do without. Don't forget dog food.

12:31 - Here's a puzzler. I just took a 2-litre bottle of water and five pounds of pipe tobacco downstairs to store. On my way back upstairs, I found Barbara's keys lying on the stairs. Hmmm. She's at work. I know she's at work because she emailed me from there. My own keys are in my pocket. So obviously Barbara must have used her spare set. But why did she leave her regular keys lying on the stairs? Hmmm.

Actually, losing car keys is almost a secondary sex characteristic. I'll bet that I could ask twenty non-sex-specific yes/no questions, perhaps as few as ten, and know with a very high degree of certainty whether the person answering those questions is a man or a woman. One of those questions would be, "Have you lost your car keys in the last six months?"

Not that women are genetically more likely to lose things. I think the reason for the difference is that men's clothing has pockets, lots of pockets, and women's clothing generally doesn't. Do clothing designers think women don't need to carry things?

Perhaps I will come up with that list of questions. Off the top of my head:

1. "Do you like or dislike Maria Muldaur's Midnight at the Oasis?"

2. "If you come upon a parking place that's five feet longer than your car, could you parallel park in it without damaging any of the three cars?"

3. "By natural inclination, would you separate whites and coloreds when doing the laundry?"

4. "Does your spouse or significant other snore?"

None of those is definitive in itself, of course. I know men who are laundry wizards, and women who can parallel park after barely slowing down. The fourth question is a pretty good one. Most women have a recurring dream that their spouses/SOs snore, and aren't shy about announcing it in public. Most men, conversely, wouldn't think of accusing their spouses/SOs of snoring, at least in public. They realize that they have to sleep sometime.

The first question is probably the closest to definitive. I've never met a man who wouldn't listen to Maria Muldaur's voice singing Midnight at the Oasis, and I've met few women who don't gag upon hearing it. Conversely, most women can at least tolerate Barry Manilow, while most men feel a strong urge to vomit when one of his songs comes on the radio.

Which reminds me of the time that Marcia Bilbrey solicited my advice. She wanted to buy a birthday or Christmas gift for hubby Brian, and I had her nearly convinced that he had a secret passion for Barry Manilow. I even pointed Marcia to an Amazon.com link for a multi-CD edition of his greatest hits. Alas, she smelled a rat, and asked Brian before she ordered it.

[Top]

Thursday, 21 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

[Top]

Friday, 22 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

-------- Original Message --------
Subject: SoBig DoS coming
Date: Fri, 22 Aug 2003 10:49:23 -0700
From: Roland Dobbins
To: Jerry Pournelle, Robert Bruce Thompson

http://www.f-secure.com/news/items/news_2003082200.shtml

And

-------- Original Message --------
Subject: Fwd: Sobig.f surprise attack today
Date: Fri, 22 Aug 2003 11:25:45 -0700
From: Roland Dobbins
To: Jerry Pournelle, Robert Bruce Thompson

Everyone should block all traffic to/from these IPs ASAP.

Begin forwarded message:

From: "Todd Mitchell - lists" <lists@ciphin.com>
Date: Fri Aug 22, 2003 11:13:27 AM US/Pacific
To: <jdawson@flexpop.net>, <nanog@merit.edu>
Subject: RE: Sobig.f surprise attack today

Computers infected with the Sobig.F worm are programmed to automatically download an executable of unknown function from a hard-coded list of servers at 19:00 UTC (3:00pm EDT) X-Force is recommending wholesale outbound filtering of the following IP addresses:

67.73.21.6
68.38.159.161
67.9.241.67
66.131.207.81
65.177.240.194
65.93.81.59
65.95.193.138
65.92.186.145
63.250.82.87
65.92.80.218
61.38.187.59
24.210.182.156
24.202.91.43
24.206.75.137
24.197.143.132
12.158.102.205
24.33.66.38
218.147.164.29
12.232.104.221
68.50.208.96

The request method uses UDP port 8998. X-Force also recommends that this port be filtered outbound.

[Top]

Saturday, 23 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

[Top]

Sunday, 24 August 2003

[Last Week] [Monday] [Tuesday] [Wednesday] [Thursday] [Friday] [Saturday] [Sunday] [Next Week]
[Daynotes Journal Forums] [HardwareGuys.com Forums] [TechnoMayhem.com Forums]

[Top]

Copyright © 1998, 1999, 2000, 2001, 2002, 2003, 2004 by Robert Bruce Thompson. All Rights Reserved.