Defensive Computing

Last week I wrote that skepticism may be the most important thing you bring with you when dealing with the Internet. A few days later in the Wall Street Journal, Walter Mossberg said basically the same thing - "...the most insidious Internet security problems today rely on human gullibility, not tricky software."

His article, How to Avoid Cons That Can Lead to Identity Theft, included this advice "Don't click on links to offers for free software or goods that you receive in an email, especially from a sender or company you've never heard of."

The problem with this advice is twofold. First, the From address of an email message is very easily forged. You may get a scam message that seems like it came from a company you know, but really didn't. Also, identifying a company you know has its own issues.

Suppose, for example, you got an email message about a really cheap price for a subscription to the Wall Street Journal. The phony From address could well be subscriptions@wsj.com. Suppose too, that the scam sent you to the www.wsj.biz web site.

Many people know that the online version of the Wall Street Journal is wsj.com. But, wsj.biz has nothing at all to do with the newspaper or with Dow Jones. It belongs to Marc Gaines and the web page that currently displays is a temporary one that GoDaddy provides for their customers. The point being, Mr. Gaines, can do whatever he likes with that website, including tricking people into thinking it offers cheap subscriptions to the newspaper. What better way to learn personal information such as name, address, phone number and credit card number? Perfect for identity theft.

Just because a famous company owns the .com domain, it implies nothing at all about other domains.

In the case of the Wall Street Journal, Dow Jones owns wsj.net and wsj.us. However, wsj.info belongs to Seth Wilkof who is looking to sell it. Wsj.org is also a scam-in-waiting. Today, it is a temporary default web page, but it belongs to someone named Natalia Skuridina.

Even someone who doesn't know that wsj.com is the Wall Street Journal, certainly knows the organization behind wallstreetjournal.com. That's easy. But what about wallstreetjournal.net? And wallstreetjournal.org? They both belong to Dow Jones, but, that's where the good news ends.

It is not clear who owns wallstreetjournal.info, but Dow Jones definitely does not own wallstreetjournal.us or wallstreetjournal.biz.

You can see who registered a domain by doing a WHOIS lookup at the website of any registrar. For example, at Network Solutions, go to networksolutions.com/whois and at Regster.com go to register.com/whois.rcmx.

I focused on the Wall Street Journal, only because Walter Mossberg writes for the paper. The concept though, applies universally. I get bitten by it myself. Two websites that I visit are www.speakeasy.net and www.witopia.net. I don't, however, visit them often enough to train my fingers to type .net instead of .com. Neither company owns the .com version of their domain name.

See a summary of all my Defensive Computing postings.

Once again, Walter Mossberg has offered incomplete and potentially dangerous computer advice in The Wall Street Journal. The December 6, 2007 edition of Mossberg's Mailbox had a question from someone whose lone hard disk was divided into two partitions; a small C disk that was almost full and a large D disk with lots of available space. The questioner asked about merging the two partitions together. Mr. Mossberg said that Partition Magic can be used for this purpose and that it "works well."

It is malpractice to suggest changing partitions in any way shape or form without first making a disk image backup. When things go wrong, as they inevitably do, you can lose access to all the files in a partition.

I jumped on the Partition Magic bandwagon early. In the late 1990s, before the availability of virtual machines on PCs, we used it in an R&D lab to run multiple operating systems on a single computer. For years I have used it on my personal machines for a host of reasons.

Partition Magic has its fair share of quirks and problems, not the least of which is that it appears to have been abandoned by Symantec. The Partition Magic gripes at my computergripes.com site are consistently the most popular topic on the site.

Among the operations that can be performed on partitions, combining two of them is perhaps the most dangerous. It is more complex than resizing a single partition and is a relatively new feature. Personally, I never attempted it, both because of the risk and because there are other ways to accomplish the same thing.

In this case, I would shrink the D partition to the minimum allowable size (plus a small fudge factor for good luck), then enlarge the C partition to include the space just given up by the D partition.* Next, I would copy all the files from D to C, then wipe out the D partition and, finally, expand the C partition so that it takes up the whole hard disk.

But, before combining partitions, I would look to avoid the whole thing by moving files from the C disk/partition to the D disk/partition.

Some of the poorly chosen Windows defaults that I mentioned last time, can be tweaked to free up space. For example, the Recycle Bin defaults to 10 percent of the partition in Windows XP and System Restore claims 12 percent by default. The minimum for System Restore in XP is 200 megabytes, give it 300 or 400 and you will probably reclaim many gigabytes. Internet Explorer also consumes large quantities of hard disk space. I doubt you will notice any change if you limit the IE cache to 30 or 40 megabytes.

Windows Update creates folders in the C:\Windows folder with names like $NtUninstallKBxxxxxx$. The total uncompressed size of these folders was 245MB, 285MB and 536MB on three different Windows XP machines that I checked. These folders can be moved out of the C disk/partition, as they are used only to uninstall bug fixes. If there is a large collection of pictures, music and/or videos, they can certainly be moved to free up space. Finally, there is the Disk Cleanup feature of XP that exists for just this purpose (get the Properties of the C disk, it's a button on the General tab).

Partition Magic is also expensive. Similar software, GParted, is available for free in Linux (download from CNET Download.com or see sample screenshots). You can boot your computer using a Linux Live CD and run GParted that way. I have done this with Ubuntu and Knoppix but many other Linux versions/distributions also include partitioning software.

You don't read PC magazine for mutual fund advice and you shouldn't read The Wall Street Journal for computer advice.

* I'm simplifying things a bit. There is actually another necessary step: after shrinking the D partition, it has to be moved to the right before the C partition can be be expanded. Also, if after this shrink/resize operation all the files from the D partition don't fit onto the C partition, then another round of shrink/resize would be needed. Backup, backup, backup.

See a summary of all my Defensive Computing postings.

A few days ago in The Wall Street Journal someone with a 5-year-old PC asked Walter Mossberg how to determine when to buy a new PC. The response in the paper was short. Fortunately, this blog lets me offer a longer, more detailed answer.

The first thing Mossberg said in his response was "There's no universal answer to your question." I disagree. The simple answer is that a computer needs to be replaced only when it no longer does something you want or need it to do. This has nothing to do with the age of the hardware.

That said however, the Internet comes into play too. It's a dangerous place and one in which Windows users need a lot of protection. (I blogged about protection offered by the free DropMyRights program back in August.)

There comes a point where old Windows computers can no longer defend themselves online because the necessary anti-malware software no longer supports the machine, for hardware and/or software reasons. Then too, there is the constant flow of bug fixes that every operating system needs to install. At some point, Microsoft stops issuing bug fixes for old versions of Windows.

When an old computer can no longer defend itself on the Internet, either because of the lack of new bug fixes or the lack of support from anti-malware software, then the machine should no longer be used online. However, it can still serve many off-line functions and isn't necessarily at the end of its useful life.

I would not use Windows 95, 98, ME, or NT4 on the Internet. Many, if not most, anti-malware software no longer runs on these old versions of Windows and Microsoft no longer fixes bugs. Windows 2000 however, is fine.

Excluding the Internet, the most likely issue with an old computer is that it can't be used to run the most recent software. At times this can be a blessing in disguise, but if the hardware is what's lacking, there may be a simpler and easier option than buying a new machine.

If the new software requires additional RAM, I suggest going to crucial.com and letting it scan your computer. (This only works with Internet Explorer, and if you use DropMyRights, it needs to run in unrestricted mode.) The Crucial System Scanner reports on the number of memory slots in your computer, how much, if any, RAM is currently installed in each slot, and the maximum amount of RAM your computer supports. It's also smart enough to tell you whether your computer requires equal amounts of RAM in each slot. Obviously, this is a sales tool; it displays the prices for Crucial RAM compatible with your computer.

If the new software requires more hard disk space than the old machine has available, that too is not fatal. In fact, it's a good idea to replace the hard disk in an old computer. Perhaps even an excellent idea. A new hard disk is relatively cheap and sure to be faster than the old one. Plus, hard disks are perhaps the most likely component to fail in the long term.

Any competent computer nerd should be able to replace the hard disk, either in a laptop or a desktop computer. One approach is to connect the new one to the computer using a special adapter cable that plugs into a USB port and then use software to copy the old hard disk to the new one in its entirety. I prefer to use disk-imaging software to back up the entire hard disk to an external hard disk, then install the new hard disk and use the same disk imaging software to restore everything.

There are two things to be aware of when buying a new hard disk for an old computer. First, avoid hard disks with a SATA interface. Older computers use an older interface that goes by the names IDE, ATA and PATA. Second, rather than shop by price alone, I suggest buying a hard disk with the longest warranty you can find.

If an old computer is running slower than it used to, that's not a reason, in and of itself, to replace it. There are many things that can be done to make an old computer run almost as fast as it used to when new, too many to list here. If you can take it to a techie, he should be able to drastically increase the speed just using software. With extra RAM and/or a new hard disk, it should run faster than when it was new.

Finally, a big part of online safety is keeping software up to date, both the operating system and your applications. Even a new computer can be running vulnerable versions of popular programs such as the Adobe Acrobat Reader, QuickTime and Real Player and thus be more vulnerable than an older machine running patched versions of the software (not to pick on these applications, but they all had recent security problems). From what I've been reading about the firewall in the just-released Mac OS X Leopard, even old Windows computers are likely to have better firewall protection than a new Mac.

On October 18th in The Wall Street Journal, Walter Mossberg wrote his annual PC Buyers Guide. Using his article as a springboard, I weigh in on some of the issues faced when buying a new computer.

Vista security

The first choice anyone makes in purchasing a new computer is the operating system. In judging the relative merits of Vista over XP, Mossberg calls Vista "better than prior versions of Windows, because it has a stronger security system under the hood."

But, according to CNET's Security Watch columnist Robert Vamosi, "most of the security enhancements touted in Windows Vista don't appear in the Home Premium and Basic editions" (see "That $200 Windows XP service pack called Vista"). Specifically, Device Lockdown, Network Access Protection, Enhanced Authentication Model and the Encrypting File System (EFS) are missing. Vamosi also takes issue with security features in the Business editions.

A new security feature in Vista is outbound protection in the Windows firewall. Sounds great on the surface, but as Vamosi describes it, it's a sham (my word, not his). A good firewall that provides outbound protection will, by default, deny everything and let you specify the allowable applications. To avoid nagging too often, some firewalls are aware of common Internet applications and allow them to make outbound connections.

In contrast, the Vista firewall requires you to create a rule for each malicious application known to mankind. Outbound connections from applications that don't match an existing rule in the firewall are, by default, allowed. This pretty much renders outbound protection ineffective.

Microsoft is making the same rookie mistake it made when Windows XP was first released. At the time, they could brag that XP came with a firewall, but, by default, it was turned off. Wrong choice (from a Defensive Computing perspective). It took them about four or five years to enable it by default.

The UAC security feature (User Account Control) in Vista probably gets the most publicity. The initial design asks so many questions that some people turn it off entirely. And Vamosi points out that unlike other operating systems, Vista allows an administrator to make system changes without having to enter a password. Thus one wrong OK click and you're infected with malicious software. Are you too busy or too inexperienced with Windows to read or understand the UAC message? There goes your protection.

What Vamosi calls the biggest improvement in Vista over XP is a feature in Internet Explorer 7 that runs ActiveX controls in a sandbox. Still, he says, you are safer using Firefox or Opera, an opinion I agree with.

In making a case for Vista security, Microsoft points to the included Windows Defender anti-spyware program. But it is available as a free download to Windows XP users. More importantly, though, it's not very effective, at least according to CNET. Vamosi says: "In testing done last spring by CNET Download.com, Windows Defender missed some of the test spyware, finishing well behind other antispyware programs on the market today."

FUD

In choosing between XP and Vista, Mossberg says "buying Vista may be the better choice for the long run. Over time, more and more products will be released that are tailored to the new system."

FUD is a term known to many of us computer nerds. It refers to sales practices used when a product is not good enough to sell itself. The letters stand for fear, uncertainty and doubt. If a software vendor resorts to this, it's a red flag their product can't stand up to an objective evaluation. Mossberg here is slinging the FUD for Microsoft.

Since, he says, Vista "may" (note the use of "may" instead of "will") be the better choice in the future, buy it now. In other words, choose Vista now out of fear that XP won't be compatible with future hardware and software. FUD personified.

James Fallows, who writes for The Atlantic, fell victim to this logic. He eventually wiped Vista off his computer and returned to Windows XP.

If the day arrives when Vista is more compatible with hardware and software than XP is, it will be a very long time from now. And a case can be made that such a day will never come.

Windows XP has been around for quite a while now--six years and counting. There are way too many copies of XP in use for any software or hardware vendor to dare come out with a product that works with Vista but not XP. If you ran a hardware or software company, at what point in the future would you produce a Vista-only product?

Consumers

While Vista is the rule at retail computer outlets, Mossberg notes that "PC makers are still offering XP on a few new consumer PCs."

Where is written that a consumer has to buy a computer marketed to consumers? It's not. No matter who you are, you are free to purchase a machine marketed to businesses, and I recommend doing so.

Flavors

Regarding the different flavors of Vista, Mossberg said "the best choice for average consumers is a version called Home Premium." In some ways though, it's a poor choice.

If your needs are simple or money is tight, Vista Home basic has the advantage of being the cheapest option both in terms of paying for the OS and in terms of the necessary hardware horsepower to support it. At a randomly selected Fujitsu notebook computer, Vista Business cost $100 more than Vista Home basic. And, as noted above, there's those missing security features in the home editions of Vista.

The two flavors of Vista business may have an ace in the hole - the ability to fall back to XP, should the need arise. I say "may" because each computer manufacturer has the option, not the requirement to offer this. Many will provide an XP Recovery CD for their customers who purchase, or have purchased, a business version of Vista. See "The XP alternative for Vista PCs."

The charge for the XP Recovery CD varies by manufacturer, but in general it is provided at cost. In the cases I've seen, it is less than purchasing XP at retail and much easier to install too, as it comes with the necessary drivers, is preactivated and lays down a disk image rather than requiring you to actually install XP.

Video

Unlike Windows XP, Vista has two different user interfaces (separate and distinct from the many flavors of the operating system itself). The Home basic edition only supports one interface, the one that requires less computing horsepower to produce. The other flavors of Vista can use a flashier interface known as Aero.

Regarding the hardware needed to support Aero, Mossberg says "Vista's flashy graphical interface works best with a separate, or 'discrete,' graphics card that has its own memory."

There is a hidden gotcha here that he doesn't go into. Graphics cards come with varying amounts of video ram (also referred to as on-board memory), usually 32, 64, 128 or 256 megabytes. To run Aero, Microsoft says in one place that Vista needs at least 64 megabytes of video ram (for resolutions with less than 1.3 million pixels, give or take), but in another place Microsoft says the minimum is 128 megabytes of video RAM. Go figure.

No matter which number you chose to believe, you next have to deal with the labeling and marketing of video cards which is, unquestionably, designed to mislead. Recently Dell sent me a catalog in the mail, and the fine print at the back contains this description of a video card in one of the computers they offer:

In other words, this 128MB video card cannot run Aero because it has only 32 megabytes of video ram. Not to pick on ATI exclusively, Nvidia does the same. The Dell fine print also contained this:

This truth-in-labeling issue seems to apply to ATI Hypermemory cards and to Nvidia TurboCache models.

The Trivial

Another feature Mossberg cites as an advantage for Vista is better integrated searching. This is very much a matter of opinion. Personally, I don't want any integrated searching. But anyone who does want it can chose from many different XP-compatible products, both free and commercial. Either way, I find it hard to imagine someone switching from XP to Vista and citing the ability to find files on your own computer as a big factor in the decision.

Advice

Walter Mossberg would have probably liked to say more on some of these points but he is limited by the space requirements of his column, which literally is a column (how quaint). This does both him and his readers a disservice. Bloggers are fortunate in being able to take as many words as necessary to say what we have to say.

You don't read PC Magazine for mutual fund advice and you shouldn't read The Wall Street Journal for computer advice.

On Thursday August 30th Walter Mossberg repeated his prior recommendation of the Mozy online backup service. While Mozy can fit the needs of some people, there are two sides to every coin and there is a downside to Mozy too. For the rest of the story, see my recent postings:

• Everybody likes Mozy--except me, Part 1
• Everybody likes Mozy--except me. Part 2