How working in IT prepared me for being a dad

I've worked in IT for probably a decade. My wife and I have a 10 month old son. Looking back on the first 10 months of my son's life, and what in store for us in the future has shown me that there are a few parallels that can be drawn.

Troubleshooting:
That's what some IT folks do for a living. I've spent a few years as a sys admin, and that's what I did for a living. I like to think I was pretty good at fixing problems that sometimes seemed illogical. With computers, it's always a logical problem. It's either a "one" or a "zero." But looking at a problem, sometimes it's difficult to see the one or zero. My Bachelor's degree has nothing to do with systems administration. My degree is in Graphic Design and Computer Art -- which believe it or not has helped me see illogical solutions in logical problems. So, I like to think that I was pretty decent at troubleshooting. However, experience helps. The more you've seen, the better prepared you are to fix a problem, and you always do what you know first. Can't get to the Internet? Can't get email? Can't figure out why a server is being 'illogical?'

"Have you tried turning it off and back on again?"

Reboot. If all else fails, call in support.

How in the hell did this help prepare me for being a dad?

Baby won't stop crying. Is he hungry? Is he wet? Did he bump his head? Do what you know first. If that doesn't work, reboot the baby. It's amazing how sometimes the simplest solution is a nap. I wish I could take naps more often. I think I'd be more productive. And if that doesn't work, and you're lucky enough to have a great partner/wife/mother to your child like I do, call in support.

Knowledge:
Being a dad has also given me some insight into my life in IT. No one can fix every problem. No one knows everything. I've been fortunate enough in my profession to be a decent troubleshooter, but I do not kow everything -- far from it. I cannot fix every problem. Not every problem has an easy solution. Patience is key. There will be days when your kid wants to do nothing but be fussy, and there will be days when your servers will be 'illogical.' All you can do is what you can do. After that you're just winging it.

Security:
I've always been security-conscious as a sys admin, and my career path is moving in that direction (Master's degree expected very shortly). I think that's helped me as a father as well. Computer security is all about risk. What vulnerabilities and threats exist that create a risk to your operating environment? Essentially computer security is about risk awareness. While nothing is hack-proof (including your house and your kid), as long as you're aware of the threats to your environment, you're better off -- Remember the "unknown unknowns" comment from a past Defense Secretary?

Hack your kid? WTF!?! Sure (but don't take him apart). Hacking has gotten a bad rap lately, but hacking in its most simple form is about trying to find out how things work. Find out how he works. Find out what makes him laugh/cry/fuss/stare into oblivion. Will your kid hack you and the precautions you've put in place. Absolutely. There's nothing you can do about it. Just be aware of the threats and their associated risks.

My wife mentioned to me recently how every day she sees proof that she's a mom. She recently took our son to a party, and noticed how her priorities have shifted. When you walk into a room with a 10-month old and put him down, you evaluate the potential threats to your son, and what risks they pose. Floor-length curtains? Bad. Accessible wall outlets? Bad. Power cords? Bad. Raised floors / steps? Bad. Unsecured book shelves? Very bad. These all pose a risk to my son, but I'm secure in the knowledge that I'm aware of these risks. I've evaluated them, and I keep a close eye on him to ensure these threats do not interfere with his security.

Education:
I've also learned that whether it's about IT or about my kid, I'm going to be 'in school' for the rest of my life. If you work in IT, especially computer security, and you're not constantly learning, you will go extinct. The same goes for being a dad. You will be learning for the rest of your life, whether you like it or not. As one of my previous bosses put it, "It never gets easier. It just gets different."

Perspective:
Lastly, the most important thing my son has given me is a little perspective. I go to work. I do my job. I won't fix every problem, and that's okay. I'll go home and spend 10 minutes with my son, and completely forget about the dozens of problems I had at work, and how I wasn't able to fix them all. Someone will still not be getting email when I leave. That's okay. It's really not the end of the world.

Why McAfee is making my computer less secure...

So, my last couple of posts have been a little too political. Hopefully there's some info in this post that will come in handy, but what would really be great is if it 'learned you a little...'

Yes. I use McAfee. Yes, it's a pain in the ass. Unfortunately as of this moment in computer security, if you're using Windows (which for the moment I'm forced to), you need some sort of virus scanning software. Why McAfee? I don't know. I guess because I've had a subscription which I keep renewing rather than go out and research other products. (I'm a bit pressed for free time at the moment.)

So a couple of days ago, McAfee started to fail when trying to update definitions. Today, I finally had some time to figure out what the problem was (with a little help from McAfee tech support). The problem was that my computer was too secure to allow McAfee to update properly. Yes, you read that right. My computer was too secure to allow my security software to run properly. Well... that, plus there was an incorrect setting in my local hosts file. I'm not going to go into why I think McAfee needs to hard code IP addresses. I think that's a little ridiculous, but they may have a valid reason. Doubtful, but hey. Anything is possible.

What they don't have a valid reason for is the following options in IE "Internet Properties:"
--Disable "Check for publisher's certificate revocation."
--Disable "Check for server certificate revocation."
--Disable "Check for signatures on downloaded programs."
--Enable "Use SSL 2.0"

The most frightening one is the 3rd one, checking for signatures on downloaded programs. What's a signature? In the simplest of terms, it is a digital way of verifying that the file you're about to download (and possibly execute) comes from a trusted source. If you don't know that downloading and running programs from untrusted sources is a Bad Thing(TM), it would not at all surprise me if you've got a trojan on your computer, and you should stop doing it immediately. So...

First, don't download programs from untrusted sources. Second, if you can, keep this check enabled. At the very least, it may prompt you with an annoying warning banner. At the most, it might save you from having your computer become part of a botnet.

So, what are these certificate revocations you ask? It's simply a way of verifying you are connecting to the web site or server you think you're connecting to. Sometimes after a digital certificate has been issued to a web site or server, it must be marked as invalid, or revoked. Sometimes this is due to unforeseen errors. Sometimes it's due to the company that issued the certificate being hacked. If you are unaware that a certificate has been revoked, you may be redirected to a web site pretending to be a trusted web site, which (if you keep that "Check for signatures of downloaded programs" option disabled) may be able to install software on your computer without your knowledge. That's a Bad Thing(TM)

Lastly, we come to this SSL 2.0 thing. SSL stands for Secure Socket Layer, and it it as the heart of commerce on the Internet today. It's how you can securely log into your banking web site and transfer funds. It's how you can enter your credit card number into Amazon.com without worrying that a Bad Guy(TM) will get it and go buck wild on your dime. Well, there's different versions of SSL. SSL 2.0 is less secure than SSL 3.0. SSL uses weaker mechanisms to set up a secure connection, and is subject to what's called a man-in-the-middle attack. A man-in-the-middle attack is just how it sounds. Some Bad Guy(TM) gets between you and what you think is a trusted web site. What you don't know is that he can read and manipulate every piece of information sent to and from your computer. For the home user, this didn't used to be a big deal. But with the ubiquity of WiFi, a man-in-the-middle attack is very easy. I'll have a post coming up on some WiFi security measures (when I get some more free time).

So, McAfee, the company that I (for now, unwillingly) trust to keep me safe is in fact, making me less safe. Sure, I trust McAfee not to download Bad Things(TM) to my computer, but these settings don't affect just McAfee stuff. They affect every connection I make to any server in the world, and that's a...

Bad Thing(TM)

Sneaky Representatives

So, what is H.R. 1981? Basically it is a bill that would mandate our service providers keep track of nearly everything we do and everywhere we go online.

Who brought us this wonderful bill? It couldn't be the same jackass that brought us SOPA could it?

Wait. What? It is the same jackass? You gotta be kidding.

Nope. Not kidding.

In order to try to get something like this through Congress, the bill is titled "Protecting Children From Internet Pornographers Act of 2011." So, basically what this bill is trying to do is pit privacy against child porn, and if you're against this bill then you must be for child porn, right?

We're all against child porn, but we should also be against having our rights violated. This bill would enable the government to request your data, in secret, without any oversight.

Why can't the congress critters just write sensible bills that can stand on their merits? Write a bill that protects kids and doesn't violate our rights. Why do we continue to elect these people if they're not firing on all cylinders?

Against having your rights violated?

Go here, and write your congress person.
(For those of you in the same state as me, one of our representatives is a cosponsor of this bill.)

What the Eff is the EFF?

The EFF, or Electronic Frontier Foundation is associated by some to 'hackers' and trying to get hackers or other alleged criminals out of jail. However, they have a much more sinister motive -- To protect people just like you and me, and their digital rights. In the world we live in, most of our information whether public or private exists in digital format. Is it protected?

Well, there two ways of looking at protected; the first would be protected from the bad guys, and second would be protected from Big Brother. There's nothing we can do as individuals to help protect our data from the bad guys, so let's concentrate on the other.

The EFF works vigorously to help ensure that your data is protected from Big Brother -- usually by fighting for your 4th and/or 5th (among others) amendment rights. Look them up if you don't know what they are. Really. Look them up right now if you don't know what they are. These are your rights, and you should understand them. I'll wait...

Okay...

Some would say that "if you don't have anything to hide, you shouldn't be concerned by Big Brother looking into your data;" but really that's not the point. The point (as so graciously noted by the founders of this country) is that I should not have to fear anyone searching my data without just cause, nor should I fear torture or other means by which I may utter words to incriminate myself.

I attended a conference this past weekend in which there were two talks given by folks that work at the EFF. They are intelligent and well versed in both law and technology -- oh, and they're nice people too.

Do you have a 'rooted' smart phone? You can thank the people at EFF for working to ensure you're not arrested for playing with something you own. (Which by the way is up for debate again.)

Do you use a Tivo or DVR? You can thank the EFF.

In more complicated matters such as encryption, a woman in colorado (yes, an alleged criminal) is being forced to decrypt data that she encrypted. As I said, it's more complicated than that, but the underlying issue is privacy and encryption, Can we say "Slippery Slope?"

They are also staunchly opposed to SOPA/PIPA.

What's the point I'm getting at? Well. . .

Some of you have probably never heard of this organization, and they fight every day to protect your rights. I know it's easy to throw money at a corporation and get a song, playing device, phone, TV, etc. . . Also, might I ask what your congress critter has done for you lately -- or in the past decade for that matter?

How about giving some to the folks who are trying to help protect us from these corporations and greedy fools in congress.

I know it's a tough economy, but please join or donate to the EFF. They're good folks trying to help protect your rights.

What did the Blackout accomplish?

So, my wife has urged me to blog more, and I can think of no better opportunity than after a massive 'grassroots' effort took place to help show our Congressmen and Representatives we are not a silent mass that can be ignored. Reddit and Wikipedia led the effort to show the citizens how two proposed bills, one in the House, SOPA, and one in the Senate, PIPA. These efforts were also aided by Googles black bar; even Facebook's Mark Zuckerberg and Wil Wheaton weighed in.

In short, I'm amazed by the number of posts I saw from friends on the Social Networking sites. I've signed petitions, and written my Congress critters. In fact, according to EFF over 4.5 million people have signed Google's petition. What's more amazing is that it actually worked (for now). Both PIPA and SOPA have lost support in the House and in the Senate.

However, I'm left wondering, why did it get this far, and why was there such an amazing effect, and do people really understand what they were petitioning against, or were they just hopping on the bandwagon?

To begin, how did we get here? How did it come to Wikipedia putting a roadblock up? Well, To begin with, the Supreme Court of the United States has long upheld the notion that corporations are people, and that money is free speech. What does that really mean? It means corporations are free to lobby, and give 'donations' to the very representatives that are supposed to be looking out for our interests, and who's gonna win that fight, us, or (enter multi-billion dollar corporation here) . Congress is looking out for themselves. They're looking to stay in office. What's the easiest way to do that? Take 'donations' from corporations to aid in 'campaigning.' So. . .

Lamar Smith received over $60,000 in 'campaign contributions' in 2011-2012 from the TV/Movies/Music industry, e.g. "Here's 60k., can you push this legislation through?" This is only minor compared to the alleged $94 million that the MPAA has given to Congress. And I won't even go into the hypocracy of the MPAA's statement about the blackout. It's not worth the strain on my typing fingers.

These bills were introduced in May and October of 2011. Why did it take so long for people to get involved?

My initial guess is because, "ZOMG!11!, Wikipedia is down! I can't find out what a car is; which brings us to the effect the blackout had.

Well, a great effect. It made our congress critters stop and think, and eventually some withdrew their support. They were probably thinking more about staying in office rather than the ridiculous pieces of legilation before them, but hey; the intended outcome was achieved.

YAY!! Woohoo! We win the Internets! But what did we actually accomplish? We let congress know that if they push this legislation through, it might 'break the Internet.' However, Congress doesn't understand the Internet, nor do they have the technical savvy to understand what they were actually proposing. Think about it this way. Ask your parents and grandparents if they know what DNS is. Take a mental note of the blank stare you receive, then picture it on your congress critter, only with a bubble over his/her head that says "Must. Pass. SOPA/PIPA."

How might it 'break the Internet?' What did these bills set out to accomplish? Essentially this bill would allow a coporate entity to pressure the Attorney General to send to online service providers an action to block the 'infringing site.' Unfortunately, the term 'infringing site' is left up to interpretation by the corporate entity, and this 'infringing site' is immediately stricken from the Internet with no due process. There's more tech to it than that, but it's boring to most people.

The intention of the bills are to stop piracy -- which is not a bad thing. I'm against piracy as I'm sure most law abiding citizens are. I wouldn't want my Intellectual Property stolen and distributed to others for free. However, the effect that these bills would have is atrocious, and I'm appalled that any elected official would put forth any type of legislation that may infringe on our rights. Personally, I believe that any person that sponsors this bill should be at the very least voted out of office, and at the very most brought up on charges as should any corporation responsible for helping. What charges? I don't know. I'm not a lawyer. However, the Supreme Court ruled that corporations are people; thus, they should be held accountable to the same laws as people, and if necessary, jailed and fined like people.

So, do people really understand what happened, or were they just hopping on the bandwagon? Quite frankly, I don't care. I believe the overall purpose was to get the word out, and thanks to Reddit, Wikipedia, Google, that was accomplished...

But what's in store for the future? Well, fortunately large corporations like Google and Facebook were on our side this time. What happens next time when it's laws that Google and Facebook have lobbied for? What happens when SOPA and PIPA become riders to important legislation that needs to be passed (like the budget, for example) Will we still be able to get word out to everyone? Will there be legislation already in place that will not let us get word out? Will we hold our Congressmen and women responsible?

This fight isn't over. Corporations will continue to "speak to" (read pay) representatives and try their damnedest to make the Internet a media consumption device rather than the two-way street that it is today.

If that happens, we can say goodby to the most enlightening and educational period the Human race has ever witnessed.

Hacked Again!

So yeah. Both my gmail and facebook accounts were hacked again. And this time they made sure to permanently delete any email received since the first compromise. After the last time, I obviously changed my password, and made sure it was a strong(er) password. I don't think they could have brute forced it in only 5 days.

That got me thinking about how they got access. There are few devices that I access my gmail account from, and it's possible that one of those devices is compromised and contains a keylogger. I've used some of these devices since the second attack, and haven't seen a third...yet.

In a fit of paranoia I uninstalled any new apps on my phone but the more I think about it the more I think that is not the avenue for the second attack. We shall see. I'm in a "hurry up and wait" state at the moment.

What I think happened is that for the first attack it was brute forced offline, either from the leak a couple of weeks ago, or from the massive Sony attack, but in that first attack if you remember, they got access to my facebook friends list. It just happens that my mom is a friend and her maiden name is listed. Well guess what my gmail password reset security question was. D'oh!

I've had my gmail account for many years and was a wee bit of a security newb not so long ago -- not that I know everything, but I have learned quite a bit over the past couple of years. I'm sure that way back when I set this account up I had no idea that someone one day could use information obtained from one web site to compromise my account on another.

This is all still speculation as I have not rooted my phone yet so I don't have access to exactly what each app is trying to access, nor do I have access to gmail log files. It could turn out to be a bad app that I downloaded, and they just haven't attacked me again yet, and that while my cell phone could have saved me from getting my identity stolen, it was also the attack vector. We'll just have to wait and see.

Lesson learned... Don't use any security questions/answers that can be easily obtained online by just about anyone, e.g. birth month, mother's maiden name, pet's/children's names, etc...

How my cell phone may have saved me from getting my identity stolen

I say may have because I'm not quite sure how much damage was done. I'm still cleaning up. Also I'm not sure what these a-holes wanted.

It all started on a Sunday afternoon. I was sitting at home getting ready to head over to a cookout with my family. I noticed that my cell phone had two "!" icons. I clicked on them and noticed that I was no longer syncing with gmail or Facebook. So I tried logging in again on my phone. . . No luck. WTF?!?

I then tried logging in to gmail on my laptop, still no luck. Well, I knew my password was correct, so I tried resetting my password, and was able to log in instantly. Once I logged in, there was a bright red bar at the top of the gmail layout stating that my account had been logged into from a questionable IP. I'm not sure of the algorithm that google uses to detect this, or even if they have a list, but sure enough, the IP was registered in Italy; and unless there had been a shift in the time-space continuum, I was not in Italy.

I then checked my gmail settings to ensure there were no forwarding rules set up, or any other settings out of the ordinary. Good-to-go.

Next, let's concentrate on what the hell happened to my Facebook account. Tried accessing it using what I thought was my "strong" (not a dictionary word, use different charcter sets, etc...) password, which is different from my gmail password. Sure enough, it had been changed. So I reset that password as well, and also ensured there were no odd email addresses associated with my account (Account Settings -> Email, Account Settings -> Security). Good-to-go.

So how did they hack my gmail account? I have a "strong" (not a dictionary word, use different character sets, etc...) password, so I'm not really sure. There was a breach of thousands of email addresses a few weeks back, but if I remember correctly, only a small percentage of them were gmail accounts. So maybe it was brute-forced. I'm not sure if gmail has an account lockout feature -- never needed to try or look into it. Either way, my accounts had been hacked. DAMMIT!

I checked my spam folder in gmail. . . nothing. Checked the deleted items folder. Hmmm. . . There were two deleted messages about a facebook account password reset. I don't remember doing that. WTF?!? Those sneaky bastards had hacked my gmail, changed the password, then sent a Facebook password reset to my gmail account. Since they now had my gmail password, they were able to reset my Facebook account with the link that was happily provided by Facebook, then delete those messages. Luckily, google never really deletes anything.

From the hacking of accounts to me getting "notified" by errors on my cell phone took about 10 minutes, and another 10 minutes for me to figure out what the hell happened and fix it.

All I know for sure is that they had access to my gmail address book and my facebook friends list for about 15-20 minutes. I have not heard from anyone getting spammed by me, and I haven't received any notifications about other account password resets, so for now I think I'm okay.

But what if I didn't have a smart phone that linked to gmail and Facebook? how long would it have taken me to find out my accounts had been hacked? Hours? Days if I was away from a computer or on vacation? My smart phone addiction paid off for once.

Lesson Learned? Change passwords often, make them long and full of different characters. Don't use dictionary words. And don't ever, ever, ever, use the same password for all of your online accounts. Oh, and keep the smart phone data plan!