In the past there have been several worms and viruses that block websites. Conficker is included in this list: it blocks access via the web to several major antivirus vendors' websites.

This means that there is a simple, web-based test to detect its presence:

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html.

If you see all the images, you're not infected :).

Sure, you could set up your mail server to enforce a security policy where any message with more than a certain number of 'Received' headers. But when that 'certain number' is '2', could you receive any mail at all?

(Yes, I actually saw this today: I sent off a quick email to postmaster@ but I'm not sure if it ever arrived or not :S)

Update 24 hours later: I haven't received a bounce, so maybe it did arrive. Hard to say.

This morning I received notice of two security update releases in my inbox: one about Drupal core being upgraded, another about the OpenID module containing a security vulnerability before 1.2.

Since upgrading Drupal core is such a pain, I've generated a patch (it's attached to this post: click on '1 attachment' to retrieve it) for upgrading your existing sites from 5.7. If you're not running a 5.7 site, please don't try to use it.

Slashdot linked to a freedom-to-tinker article announcing what's called a cold-boot attack on disk encryption. The attack relies on the fact that DRAM does not -- as usually thought -- erase its contents upon power loss. In fact, by cooling the chip with something as simple as a can of compressed air the chips can retain their contents for multiple minutes. Getting the keys out is just a matter of booting the machine a second time using a bootloader that reads out the keys.

Even though I know better, it continues to amaze me how easy it is to bypass security systems. Surprisingly, the weakness is not the human element.

I guess canned air is next on the 'must ban this because it can be used to break security schemes' list, along with sharpies and ballpoint pens.

Equal, But Opposite

I'm confident it's not a 20th century invention to use words to mean the opposite of what they conventionally mean. But it certainly is pervasive. And annoying. And very, very dangerous.

Something I saw somewhere:

"English is the language that lets you talk until you figure out what to say"

Take for example, the phrase 'Digital Rights Management protections', which I came across recently.