All posts by Jerry Stern

Definition: Hacker

Definitions, microISV How-To's

Another software developer question:

I’m wondering if the term Hacker means different things to different people. When most people hear the word hacker what are the first things that come to mind?

Hacker, back in the early days of PCs, originally meant someone who climbed into the internals of technology to make it do more stuff. In hardware, we would take an IBM diskette drive, test what happened with every jumper setting, maybe add a DIPP switch to make testing easier, and then hook up the result to a Texas Instruments 99/4a computer, where it was never designed to go. Or read program files from diskettes in pure binary format and match up numbered commands with programming symbols to make programs that could modify programs, usually to add formatting and fix line numbering. Then, it was all positive, and “no reverse engineering allowed” statements hadn’t evolved yet.

NOW, hacker is used more in the negative sense, like cracker, which generally includes creation of cheat codes, bypassing sections of code for various reasons, and so on.

The way technology words enter the mainstream vocabulary is mostly through television and movies, and Hollywood is nearly as sloppy with tech words as the evening news, so ‘hacker’ is mostly used in the negative sense by most of the mainstream media. But a hacker isn’t inherently evil.

Jerry Stern
Chief Technology Officer, PC410.com

What are the major challenges you face as a micro-ISV?

microISV How-To's

Another question from a software developer:

As a one-person independent software developer, what are the major challenges you faced? How did you
overcome these challenges?

There was a time before the internet, yes, even before it was still ‘The Internet’, when being a one-person development company meant you worked alone. Wrote code, wrote letters to customers, on actual paper and snail mail, did your own artwork, everything. The result was a very real reluctance to allow ANY part of a project to be done elsewhere.

That’s over. Now, our programs & apps have to run alongside other programs, share data with other users of the same apps, check for updates, sell upgrades (and power-ups), and be visually stunning and immediately obvious to use without a bound instruction manual. It’s too much. You can’t do that alone; you can’t even visualize it without loads of feedback from experts in each area.

We can outsource graphics. Or web sites, animation, speech recording, writing, even blocks of code, if it gets the project done. Now, it’s a management job, rather than doing every little piece of the project in-house. You don’t need employees, but you do need trusted partners to do the tasks you will (reluctantly) admit that you can’t do yourself in a reasonable time. Or just don’t wanna.

So does that mean hire outsource help? You could. Or if you work with other programmers, or know programmers from the ASP, you can offer to trade technical expertise for help in other areas.

Jerry Stern
Chief Technology Officer, PC410.com

Computer Security Errors 101

Newsletter Reprints

A reprint from the PC410 Security Newsletter:

password isn't a password

I’m asked “is this safe?” over and over again. Usually, it’s a link in an email. And congratulations to those of you who stopped long enough to recognize a suspicious link, or asked before clicking your way to the web site of some Nigerian Prince with millions in oil money to give you, but who also wants to encrypt your hard drive for ransom and steal your bitcoins while capturing your email passwords so that he can send out a few million more Nigerian Prince letters from your email account.

OK, it’s usually not that obvious. Here are the security errors I see most often.

Passwords in plain sight.

No, don’t write your passwords on the monitor, or a Post-it note, or a label on the bottom of your keyboard. And don’t leave a file called ‘Passwords’ on the desktop, either. It’s really not the Windows login password that’s at risk here: anyone with physical access to your computer can read all the data without the password, by erasing the passwords with a program loaded from a bootable USB stick, or by removing the drive and connecting it to any other computer.

The passwords that should never be visible are banking passwords, email account passwords, QuickBooks passwords, any account that has payment information stored. That includes logins at Amazon and iTunes. Security issues at online merchants have occurred because, well, “someone contacted us, with your password, so we shipped them what they wanted, where they wanted it. And then they reset the password. Wasn’t that you?”

Re-using Passwords

Passwords should be unique. If you have a “usual password” for everything online, stop it. Change it everywhere. When online merchants and service companies have security issues, they invalidate millions of passwords, and make you reset your password, by making it look like you forgot it. You didn’t, they gave it away, so now they’re asking for a new one, because they couldn’t take care of the last one.

So all those sets of millions of hacked passwords from the recent online “We were hacked” events, containing both login names and emails, is ‘out there’, where other hackers will assume that if your password at Amazon was ‘i-want-it-now’, then your password at any of a hundred other sites is likely the same. So they try it, in bulk, and take over some percentage of those accounts. Worse, they take over accounts at multiple web sites from the same victim at once; that’s havoc multiplied into identity theft.

Now, if your password is the same everywhere, when one site says something that means, in real life, “we lost it, give us another,” that means that you have to reset it everywhere you used it. If each site had a unique password to start with, that risk is avoided.

Only One User Account in Windows

So what’s the risk of only one Windows login account? There are two:

1) When there’s just one Windows user, that user is an administrator, with full install rights, and any malware that arrives on the computer can run an install program without any need to enter a password–sometimes, there is no on-screen indication of new software at all. The account used to surf the web and open email should be a ‘limited’ or ‘standard’ account, which can’t install software. In addition, there should be an account with administrator rights, used for installing software and updates, and nothing else; it’s not for web surfing.

2) With only one account on the computer, it’s harder to repair that account if it’s damaged. This is a problem that didn’t happen much until Windows Vista came along, but since then, user profiles, also known as Windows user accounts, can become corrupted, and after login, there’s one of these messages on-screen:

  • The User Profile Service service failed the logon. (That error message is courtesy of Microsoft’s Department of Redundancy Department.)
  • You have been logged on with a temporary profile.

In both cases, you can’t reach your desktop or your files. If there is a second account to log into, a remote fix is usually possible. If not, especially with the “Service service” message, the repair can’t be done remotely.

Jerry Stern
Chief Technology Officer, PC410.com