February 2004

A WPA story.

I got a D-Link DI-624 802.11g wireless router and a D-Link DWL-G650 card a few months ago. Good price and it runs the Atheros chipset with bonds two channels together to give a max bandwidth of 108Mbps. Supposedly WPA support was available in the router firmware but I could never get it to work. Then, last week, D-Link released firmware revision 2.36. A few people reported on their installs on the D-Link forum on Broadband Reports and, at the time I read them, things didn’t seem too bad. I installed it and it was a disaster! Reboots, disconnects and lost connections and I hadn’t even enabled WPA. So, I backed it off and things still didn’t come around until I’d done about 3 reboots of my laptop. D-Link removed the firmware from their site.

OK, I backed off and decided to wait. Just a few days ago, D-Link posted version 2.37. Good reports in the forums so, after about 24 hours, I installed it. Last night. Before I went to bed. From the wired computer. And then I went to bed.

Got up this morning and the router hadn’t rebooted all night. A good sign as it was rebooting every few minutes on 2.36. So, I connected my wireless laptop. No problems. Ran most of the morning and still no problems. OK, deep breath, take a System Restore point (that was the only thing that rescued me the last time I installed the WPA update). Run InstallWatch so I can see what’s changed on my system and install the WPA update. Things continue to run OK in WEP so I decide to enable WPA-PSK on the router and on the laptop.

Voila!

I’ve been using J. River’s Media Center since, oh, I dunno, maybe version 7. It was called Media Jukebox then, I think. Version 10’s in beta now and I’m very pleased with it. There are a lot of free media managers and taggers out there and I’m always looking. Two that have recently come to my attention are The Godfather and Media Tagger. Doesn’t look like either of them maintain a database like the J. River products but they still look like they can be handy.

Two others that I’ve looked at and am pretty happy with are ID3-TagIT and Mp3 Book Helper.

Got this abbreviated rundown of what’s in SP2 from a friend. He distilled this from the various documents available from this Microsoft page.

The overview White Paper seems to have the most useful info in least amount
of bytes. Major tightening on:
* Firewall (ICF beefed up quite a bit, but still no outgoing protection like ZA does.)
* RIPC – but Firewall has to be on to enforce
* DCOM – better protection from non-authenticated admins lot of safeguards/detection on buffer overruns, other memory protection (enabling hardware protection on Itanium & AMD K8)
* Outlook Express gets most of the Outlook security enhancements (images, HTML, application execution, etc.)
* IE adds a lot of new controls (all URL objects similar to ActiveX controls, no cached scriptable objects, block pop-ups, stop scripts from moving/resizing windows, etc.)
* DirectX and Media Player 9 locked down – details for that in a doc I have not read yet
* Alerter and Messenger services OFF by default

I’ve been taken to task on occasion for only reporting Windows issues. Well, the fact is, that’s what concerns me the most. But this Secunia advisory got my attention because I use Mozilla (well, Firefox) a lot. Not to the exclusion of IE but a lot.

The flaw’s supposedly caused by a race condition which will allow a script from a previous page to be executed in the current page’s context. It’s supposed to be fixed in V1.6b of the Mozilla Suite.

I notice that the Mozilla site doesn’t say anything about the flaw or its resolution and the current full Win32 download is tagged as being version 1.6 (note, no “b”). Matter of fact, 1.6b was released BEFORE the current release, back in December. The bug was reported on December 2 and a fix was submitted on the 3rd but there was a lot of discussion in the bug report about whether it should be “revealed” until all versions are fixed. Then, on Feb. 25, they finally say it’s fixed and we get the security alert. Isn’t that backward? Aren’t we supposed to know about these things earlier?

(OK, Chuck, you happy now?)

Maestro lets you control a virtual Spirit or Opportunity. The site claims the software is a scaled-down version of the software actually used by NASA. Here’s what Chapter 1 of the Online Manual says:

Maestro is a publicly available version of the tool used by scientists to plan daily activities for the 2003 Mars Exploration Rover mission. With Maestro, you can view pictures taken by the rover. You can also select driving destinations and points of interest where you want to take your own pictures.

Also discussed in the current issue of Windows Tricks and Tips Update is how to move objects between domains, how to move users between domains and how to move computer accounts. These 3 items are also listed in their FAQ.

Today’s Windows Tips and Tricks Update (subscribe here) has a good tip for those of us that still use tools that don’t allow UNCs and have to use drive letters for some of our network drives:

Q. Why doesn’t my Windows XP system display drive letters for my network drives, and why can’t I create long filenames and folders?

A. You might receive the error

“The drive that this file or folder is stored on does not allow long file names, or names containing blanks or any of the following characters: \ / : , ; * ? < > |”

You might also notice that no drive letters are assigned to your network drives. These problems can occur if Windows Explorer starts before your network logon script has finished running. A new feature in XP known as Fast Logon Optimization allows faster logon by letting the logon process continue, even while other tasks finish (such as applying Group Policy).

To resolve this error, you can revert the computer to a Windows 2000-style execution by performing the following steps:
1. Open Group Policy Editor (GPE) and locate the Group Policy that affects the client computers (e.g., the Domain Group Policy).
2. Navigate to Computer Configuration, Administrative Templates, System, Logon, then double-click “Always wait for the network at computer startup and logon.”
3. Select Enabled, then click OK.
4. Close GPE.

Saw this on one of the Office (? — yeah, weird, I know) web sites. At this URL, Apple let’s you create an RSS feed to see new releases, top tunes, etc of the genres you specify.

Current issue of Woody’s Windows Watch talks about the FUBAR stuff that MS04-004 has caused a number of people. MS04-004 is the one that removes the ability to include username and password in the URL field and has apparently broken a number of applications and sites. So, MS has released an update to the patch, MSKB 831167. The symptoms are described as follows:

Programs that use Wininet functions to post data (such as a user name or a password) to a Web server retry the POST request with a blank header if the Web server closes (or resets) the initial connection request.

For example, when you submit your user name and password to an SSL-secured Web site by using a form on a HTTPS Web page, Microsoft Internet Explorer may not resend this information to the Web server if the initial connection is closed (or reset).

I like knowing what my system’s doing. Bandwidth utilization, processor and page usage, that kinda stuff. I’ve been using CoolMon from ArsWare for a really long time … like more than a year. But it’s had a couple of bugs that bother me. Not significant problems, just little nuisance ones. Well, last week I came across Serious Samurize and, I’ve gotta tell ya … WOO HOO! It has built-in access to quite a few counters but also gives you access to perfmon counters and WMI stats and plug-ins PLUS console-based programs and VB scripts. You can render things as graphs (line, pie chart, histogram, etc) and/or as text. Comes with a configuration editor that’s very intuitive. It’s donation-ware (free but they ask for a donation) and well worth whatever you wanna throw at ’em. I’m a convert.