12.16.07

My New Phone - Blackberry Pearl 8130

Posted in Personal at 1:37 am by Tyler Reguly

Your first thought might be, he just got a new phone in March... and you'd be right.. (See this post). I've been having battery issues with the UTStarcom and even after having the battery replaced under warranty, it just wasn't doing it for me.. On top of that I got an amazing deal.

My setup was as follows:

  •  2 Phones (in use)
    • UT Starcom 6700  (mine)
    • Nokia 3200 (Fiance's)
  • Share Plan (Total:$55)
    • 40 (me)
    • 15 (her)
  • 4MB Data Plan (Total: $25)
  • Total Cost: $80
  • Total Minutes: 425

New Setup:

  • 3 Phones (in use)
    • UT Starcom 6700 (spare)
    • Blackberry Pearl 8130 (mine)
    • Blackberry Pearl 8130 (fiance)
    • The Nokia 3200 (and a Samsung A670) are used as alarm clocks
  • Share Plan (Total: $70)
    • 30 (me)
    • 30 (her)
    • 10 (spare)
  • Unlimited Data Plan (Total: $30)
    • 15 (me)
    • 15 (her)
  • Total Cost: $100
  • Total Minutes: 450

So... we're up a few minutes and we have a spare phone... for $20 + a system access fee... so we'll call it an extra $30/month... Or so it would seem. The fiance had to go to a Share 30 plan in order to get her phone, which would have added $15/month and she would have had her data which would have added $15/month. That makes $30... The same as the difference in my bill will be next month. The difference... I got a new phone and unlimited data for three years out of the deal.

Now I am concerned that when the bill comes in, I'll discover that it didn't actually include web (The contract calls it unlimited email / IM, however I double checked several times that the browser was included). If the web ends up not being included, then I'll get to have some fun at Telus' expense...

Anyways... I've found it pretty addictive already, and I want to go and play some more... just wanted to mention the new phone.

12.14.07

Daily Link List

Posted in Daily Link List at 5:58 pm by Tyler Reguly

Just a few short things that I thought I should mention:

The first has probably been seen by most at this point, it involves Rich Mogull and Chris Hoff... it's a rather funny interaction but requires that you read the following articles in order:

  1. Predicting Peril -- Dark Reading Room
  2. Off Topic: Argh! Smart House Went Stupid
  3. Breaking News:  Successful SCADA Attack Confirmed - Mogull Is pwned!
  4. Never Bring a Knife to a Gun Fight

I'm sure that this will continue for a while, but it's definitely good for a laugh as it stands right now.

Up next, Via SANS ISC, we've got an interesting article on how you can decrypt Cisco Type-7 Password from within the Cisco CLI. Not much to say here, except 'Where's the Security?'

Lastly, an article from RetroThing on the new Canadian DMCA bill. If you are Canadian, make sure you read this and respond appropriately.  No good can come from this bill, but our government would rather cave to pressure from the US than listen to the thoughts of it's own citizen's. I'd like to thank all of the conservatives out there that thought Stephen Harper would be good for this country.

12.10.07

Hackers for Charity: Interview with Johnny Long

Posted in IT, Interesting Stuff, News, Security at 11:51 am by Tyler Reguly

In a previous post, I had reviewed a SecTor presentation done by Johnny Long. I had also mentioned on Hackers for Charity, a charity started by Johnny to link up hackers with charities that require IT/IS assistance. I see this as an incredible contribution and was looking forward to getting involved myself, but at the same time I was receiving feedback from readers who were interested based on the brief mention I had made of it. I decided the best way to follow up was to contact Johnny for a brief interview. I sent him a few questions, in hopes of getting a bit more information out to everyone that reads it, and I've basically inserted the email responses below.

Who is Johnny Long? While most that read this will know who you are, there may be a few that don't...

I'm a hacker by trade, a pirate by blood, a ninja in training, a
family guy and author.

How did you first get involved with charity organizations and what drew you to the IT side of their operations?

My wife went on a mission trip to Uganda last year, and I joined her
in her research about what was going on in Uganda. This led me to
Invisible Children. I mentioned them in my talks, raised some support,
etc but when my wife returned from Uganda, I felt drawn to do more
than raise money. This past may, she returned to Uganda and I went
with her. Several corporations and the hacker community chipped in to
fund our trip. We worked with an organization called AOET (aoet.org)
who is working to help orphans left in the wake of the HIV/AIDS
pandemic.

What is Hackers for Charity?

We exist to connect the skills of the hacking community with charities
that need those skills. We aim to empower charities through the use of
information technology.

At SecTor you had mentioned that it was for 'unemployed hackers', is this true... Does an employment restriction exist?

Not at all. But generally we tend to attract those looking for work.
We have some senior members that are very well-set career-wise, and
those folks are looking for a positive outlet for their skills. We
provide that.

Could you provide an explanation / description of how the "references for work completed" 'thank-you/reward' system works.

It's pretty simple. Successful completion of a project results in a
LinkedIn connection and resume reference from myself and other
professionals that can vouch for the work. The professionals are
well-known in the industry, and their recommendations carry real weigh
to potential employers. Those that are already gainfully employed
receive the same benefits, but can add our organization and the
charity name to their list of professional accomplishments. We're also
working on a link/referral system that provides exposure for companies
that donate time or money.

How successful has Hackers for Charity been so far?

We have a mailing list of 80+ members. We've successfully completed
three projects: a reusable mail system, a reusable blogging system,
and our largest project-- an online child sponsorship system for AOET.
The child sponsorship system is amazing. It was developed by Paul
Madoff in the span of about two weeks, and will literally save the
lives of children in sub-Saharan Africa. Designed for AOET, this
system replaces their old cumbersome system with a streamlined system
that allows potential child sponsors to browse a gallery of children
in need, and select one for sponsorship. The old system was so
cumbersome that many potential sponsors got lost in the process and
often went to more popular and more technically advanced child
sponsorship programs. It could be argued that sponsoring a needy child
anywhere is better than not helping at all, it's heartbreaking to see
the AOET sponsorship system crippled because of technology issues.
This system addresses that, and once it passes a vetting process, it
will be released for public use through the AOET.org web site. Last
but not least, we've raised over $2000 for AOET, most of which went to
supporting their work in Kenya.

Hackers for Charity currently uses a Google Groups mailing list (which is becoming more common) which requires a Google email address. Have you considered moving away from that to a standard mailman list to allow for more accessibility? (Note: This question was asked due to comments received when I had previously mentioned Hackers for Charity)

Uhm, yes.

Hackers for Charity is still young... are there any planned next steps?

We plan on growing. =) Honestly, this thing has taken off so fast that
it's difficult for me to keep my head above water. We won't be able to
do much without some sort of (corporate?) sponsorship that will help
pay the overhead associated with running the organization. There are
only so many hours in the day, and I'd like to devote more of them to
the organization.

Has there been any thought to Hackers for Charity stepping towards a Doctors Without Borders type approach. Where in additional for volunteering to help a charity from the comfort of your own home... volunteers could be sent to third world countries or disaster areas to help implement or rebuild an IT
infrastructure?

Absolutely. I can't go into too much detail right now, but we're in
the planning stages of making that happen next year (2008).

Any words, advice or thoughts for people who have been thinking about volunteering but haven't taken any action yet... for either procrastinators or people who they might not be the type of person (or have the type of skill set) that Hackers for Charity is looking for?

Forget your skills. Come with an eagerness to help those less
fortunate. Heck, just come if you could care less for all that
altruistic crap and are just looking for a bump up on your resume.
Some of the most needed skills are those you may think are useless.
Soft skills, such as business, marketing, management, accounting, etc
are all needed.

12.08.07

Random Links

Posted in Daily Link List at 11:15 am by Tyler Reguly

I haven't done a Daily Link List in a while, but there are a few things I wanted to share.

  • Via Thoughts of a Technocrat, we've got the best Microsoft KB Article every, Computer Randomly Plays Classical Music.
  • From the Secunia Blog, we've got an interesting chain of letters between Secunia and Autonomy in which Autonomy repeatedly threatens legal action in an attempt to prevent Secunia from releasing a security advisory.
  • An interesting write-up from Gadi Evron on taking down spammer on ZDNet's Zero Day Blog. I recently had the opportunity to sit down with Gadi for  a couple of hours and get his insight and thoughts of various things... he's a very interesting guy to talk to.
  • RSnake wrote an interesting post on why PCI is Good for Business.  There was a response that PCI sets the Ceiling Not the Floor... I don't know if I agree that it sets the ceiling, not the floor. You could say that some companies chose to accept it as a ceiling, but at the same time it's also a floor for them.... A minimum bar is set that they have to get that... whether or not they go higher is there choice... before numerous companies wouldn't have even gotten to the point that PCI is setting.
  • Lastly we'll end with some humour, Via the SC Magazine Newsteam Blog, we've got the dumbest criminal of the year.