Who Do You Trust?

We place a large amount of trust in big organisations when we browse to their sites - banks, insurance companies, telecoms + technology companies, etc. We assume that they're doing the right thing and have appropriate security measures in place to prevent breaches and ensure the integrity of their sites.

Two recent episodes have taken place that highlight the problems are the whitepages.com.au banner ad injection and the Trend Micro site compromise on one of their Japanese sites.

Now both of these exploits highlight that large organisations have SNAFU moments too. Unfortunately given their market position, and in Trend's case their security reputation, we can tend to trust them too much.

My take on both these exploits is to:

• regularly review dynamic code injection into your sites (e.g. banner ads); get rid of them where possible and try to restrict the type of content generated.
• perform regular integrity checks on your sites; create MD5 or SHA1 checksums of your site prior to deployment, then check these checksums regularly. Shut down the site if the checksums change.
• make sure you have malware protection software and it's up to date; nothing new in this one really.
• investigate browser add-ons to help prevent malware infection; IE7Pro for Internet Explorer is good, as is NoScript for Firefox

Remember, ultimately you are responsible for the health of your systems. If Trend Micro are able to be compromised, so are you. Don't outsource your security responsibilities. Have a healthy sense of paranoia and apply a "secure by default" mindset when setting up your Web sites and also your Web browser.

Technology Performance Increases - Why Disk Sucks

In a previous life I looked after the FreeBSD port of Firebird. I still check in occasionally to see what the Firebird community is up to.

I remember Jim Starkey announcing his employment by MySQL to write them a new storage engine (codename Falcon). I thought I'd check out the progress of this engine.

One of the articles I came across was Mike Kruckenberg's blog. One of his entries was on Jim Starkey's presentation at the 2006 MySQL Conference.

The bit that caught my eye was the point list for the technology changes that have occurred over the 30-odd years. The stand-out for me was the reduction in disk access speeds - only a mere threefold reduction. Everything else has undergone changes involving an order (or orders) of magnitude.

This speaks volumes to me. The so-called innovation in disk storage has only really been in capacity. We've only really taken the bit of rust, put it on glass or metal and spun it faster. The last ten years has been about how much rust we can put on the platter and how we align it.

I know his is a cynical comment and undermines the engineering and design feats that have occurred, but let's face it, the most common failure points in a computer system nowadays are the mechanical ones.

I'm looking forward to real innovation in storage - that is, breaking away from the traditional rust-on-platter approach and moving to hopefully a non-mechanical process.