May 19, 2012
Consumerism, Paradox of Choice and Unsubstantiated Claims

On May 15, 2012, The New York Times published an article by Adam Davidson, co-founder of NPR’s Planet Money, titled Making Choices In the Age of Information Overload.

Mr. Davidson meshes together brand information overload or, if you prefer, signaling on one hand and product information/review overload on the other. He thinks that we, as consumers, are better off in an information-rich world. I would go the extra mile and call it an information-obese one.

At one point he quotes a business professor from the University of California, Davis: “If there is a critical-enough mass of informed buyers, that is sufficient” to pressure manufacturers to make better-quality goods, Bhargava says. “That group of informed consumers creates a force. It doesn’t have to be everybody.”

There are two problems here. First, what is a critical-enough mass? 100, 200, 1000 buyers? More?

Second, how do you know that you are dealing with informed buyers and not a company’s employees or software comment bots? And what’s an informed buyer? Somebody who has been using the product for two days and claiming it’s a sturdy, very solid unit or one who has been using it for 2 years?

Some solid, peer-verified scientific ground is more than welcome to back this kind of marketoid statement. I would have preferred it if Mr. Davidson interviewed a psychologist/sociologist instead of a business professor.

April 22, 2012

jazzy diggin by Noray, featured on the very cool, downtempo album 1974-2010 A Tribute (In Memory of Nujabes), released on www.onryourecords.fr. A very good example of mixing with style, including elements of groove and jazz.

I would have love to share another fantastic tune called colors by Ash Day, featured on the same vinyl but last I looked, it is not available on Youtube (and no, for the life of me I won’t go looking for it on Dailymotion). So you have to go to your local vinyl store and catch the good vibes.

April 13, 2012

It’s Your World by Gil Scott-Heron & Brian Jackson. One of the countless contributions of this amazing duo to the great black Music.

Gil, you are dearly missed. May you rest in peace.

March 9, 2012
A down-to-earth observation of the Dropbox Cloud

The Cloud™ is everywhere to be seen in the current Information Technology landscape and many oracles (with vested interests) such as Microsoft predict that it is not going away anytime soon.

It certainly offers many useful features that make our digital lives easier. There are hidden costs however that users should know about before trusting their data (or their employer’s) with the Cloud™.

Take Dropbox as an example. It’s one of the most visible Cloud-based services on planet Silicon. It allows you to synchronize your files across all sorts of devices. It is extremely easy to open an account and install the client and join their 70 million+ users, frolicking in a cozy cloud. But how many of those users took the time to carefully read the Terms of Service or care about two major security incidents the service had in 2011?

Issue 60 of MISC Magazine features an article from yours truly about Dropbox ; in French though. Leveraging some business intelligence, OSINT, careful reading of the ToS and observation of the Dropbox client behavior, the article aims at rising the public’s awareness of some important issues before they trust anything into the hands of Dropbox. I also knock on a few doors that might be worth exploring by other members of the Information Security community.

Is Dropbox secure enough? Is the company behind it trustworthy? Well, there are no easy answers to these questions. It largely depends on your trust scale and the type of data you share on their cloud (and Amazon’s since they heavily rely on AWS). But I certainly wouldn’t upload my employer’s or any sensitive data on their “cloud”. Security has been, is and will remain a trade-off.

If you have the opportunity to read the article, let me know what you think.

December 5, 2011
Twitter’s Free iPad 2 Scam (with a twist)

Someone, something going by the handle @mahanarfmhul3 (a.k.a Mahana Cox) sent me the following message on Twitter:

As of this writing, @mahanarfmhul3 began emitting tweets about two hours ago with a frequency of 1 tweet every 3~5 minutes. The account totals 26 tweets. 19 of them are of the same kind I received:

While the remaining 7 look harmless ; most probably to thwart Twitter’s algorithms for detecting SPAM and phishing attempts. 5 of these “innocuous” tweets are written in English while 2 are in Spanish:

I highlighted a tweet apparently addressed to someone called AdamWeitner. Except that Adam Weitner is not following “Mahana Cox”. And the tweet is not addressed properly to him since the @ sign is not used as a prefix.

Now let’s look into the phony link I received: tinyurl(dot)com/6v5g4wz. Since it’s a TinyURL shortened link, we can preview it by prefixing the URL with preview:

Now that we have the URL behind the shortened link, we can dig a bit further. whois tells us that the domain is very fresh as it was created on Dec 4, 2011 through GoDaddy.

McAfee’s Threat Intelligence and MalwareDomainList do not have identification data (yet) for this URL.

However, Wepawet finds some interesting results:

ipadzu(dot)net seems to be yet another site hosting one of those numerous Free iPad2 scams that are running rampant on Twitter. WOT gives it a poor reputation:

This shows once more why it is unsafe to click on URLs, shortened or otherwise, before doing some basic checks.

During the course of this investigation, no animal was harmed. However, it seems that LongURL have some funny results to say the least:

Sorry Mehana, I am not interested in your free iPad 2 and I’ve flagged you as a spammer with Twitter.

November 16, 2011
Thoughts on Security Practices and the Consumerization of IT

Tim Rains, Director of Trustworthy Computing Communications at Microsoft, has published an interesting post on TechNet pertaining to the IT consumerization wave that is hitting enterprises at full force and the difficulties these companies face to deal with it.

Tim refers the 14th annual Global Information Security survey from E&Y.

The following excerpt, cited by Tim, is a telltale sign of enterprises groping for answers on how to address these consumer-grade devices in the corporate network (emphasis added):

our survey shows that the adoption of tablets and smartphones ranked second-highest on the list of technology challenges perceived as most significant, with more than half of respondents listing it as a difficult or very difficult challenge.

The vast majority of respondents try to tackle the issue from a security policy and awareness perspectives. 3rd comes encryption as many CISOs and CSOs try to concentrate on the data rather than on the equipment.

By approaching the problem from a data-centric point of view, they aim to isolate and protect corporate data stored on BYO devices. Sadly a well-known fact of information security is that whoever controls the device controls the data. Building a castle in uncharted territory is an ill-advised strategy.

I am not saying that data-centric approaches are useless. I am saying that they are not sufficient and must be complemented by a threat-centric approach as championed by Richard Beijtlich.

We should be monitoring what goes in and out of these devices and beef up our incident response capability to act swiftly in case of data exfiltration and other significant threats to brand image, business data and intellectual property etc.

October 28, 2011
Unsung HEROes

IT departments all over the World have a reason to mourn. They have been urged by Forrester Research to support Macs.

What Forrester Research purports as a new era of computing has been here for years but they were blinded by their strong Microsoft/PC inclinations.

They seem to take notice. At last. But in their haste to make this old movement look new, they invented yet another term for what has already been coined BYOD (Bring Your Own Device).

Now, we are told, Mac users should be called HEROes:

“HERO,” it turns out, is a Forrester acronym for Highly Empowered and Resourceful Operatives — “the 17% of information workers who use new technologies and find innovative ways to be more productive and serve customers more effectively.”

Stop rubbing your eyes out of utter disbelief. You aren’t dreaming. HEROes. Highly Empowered and Resourceful Operatives.

We will never stop getting surprised at how imaginative marketoids are.

October 27, 2011

Les Mc Cann playing Love for Sale from the 1969 album Much Les. Got it on LP in near mint condition from the awesome Betino’s Record Shop in downtown Paris.

September 13, 2011
Reading The New York Times, The 2.0 Way

I enjoy reading The New York Times on the iPad much more than on any other device or browser. The NYT iPad application is very well designed and offer the much-touted ‘immersive’ experience many iPad users talk about.

‘Immersive’ applications are nothing new. This is what we may call full-screen apps without resorting to Gartner-like buzzwords. And full-screen applications have existed for a long time. However, the iPad takes them to the next level as Windows decoration, scroll bars, notifications coming from other applications like the dreaded “you have a new message” pop-up and everything else that may cross your focus line is taken away.

When I can’t use my iPad and instead sit in front of my ‘traditional’ workhorse of a laptop I’ve been struggling to find a way that would mimic as much as possible the NYT experience on the Apple tablet.

Let me step aside for a moment as I want you to note how the tables are being turned and how I use ‘traditional’ as an adjective when thinking about my almost last generation MacBook Pro laptop. Apple and, possibly, others are creating a whole new way of computing. Look at the upcoming Windows 8 operating system and you won’t fail to notice how serious Microsoft is about the tablet approach (let’s hope they get it right this time). As a result, I am growing unhappy lugging around 3.5 Kg worth of hardware, dealing with window placement, turning off as much notifications as possible and so on. I have to fight for my right to focus on the task at hand. Computing is a means to an end.

Anyway, back to the main track. I’ve been frequently using Google Chrome for more than a year now and I am satisfied with it. Performance is snappy, security is satisfactorily addressed and useful extensions are out there. Which brings me back to the main topic. The NYT have created a wonderful extension for Chrome that does mimic the iPad application as you can see.

Simple, streamlined and efficient. Isn’t that beautiful design? That’s computing at our service and not the other way around. And hopefully we’ll see more of it in the next years.

July 29, 2011
C’mon Apple! Why have you made these boxes checked by default on OS X Lion, even after the iOS tracking mess?

C’mon Apple! Why have you made these boxes checked by default on OS X Lion, even after the iOS tracking mess?

Liked posts on Tumblr: More liked posts »