MrLithic

2011-07-31T11:11:00.001+01:00

Testing out Google 2 Step Verification

2011-07-28T11:52:00.000+01:00

Not posted for a while

Just picked up an iPad which is a brilliant piece of kit. However, while it has all of the fine features of an ipod for filter and working with your music, books seemed to have been left out.

I would love to be able to rate books, organise them using different meta-tags and for these to actually make a different to the way they are presented on the ipad in iBook.

2009-12-08T10:04:00.001Z

Lack of Wireless protection is again in the headlights of security scrutiny.

The line for acceptable wireless security controls is constantly moving. WEP was never considered secure. It arrived broken and just became “brokener”.

WPA is now replaced by WPA2 and that latest version is under attack by dictionary attacks. It is very impressive that a wireless secret key is now worth 34 dollars.

The easiest way to protect yourself from attacks on your wireless device is to work on the elements that go into the encryption process. For the WPA-PSK process that involves the password and the SSID. Having a non-default SSID was always a good idea since it tells the potential attacker nothing about the network that they are sniffing. it is easy to change and can reflect your personality. Since the SSID (and SSID length) are used to slat the algorithm changing these from the default is the first step in securing a wireless connection.

Secondly, you need to choose a passkey of a reasonable length. To avoid repetitive phrases, I tend to use GRC password generator for 63 character keys. This can be a bit of pain for devices where the key has to be entered by hand (sometimes with a wiimote).

These two tasks should leave your wireless access device fairly secure but the other side of the coin (detective controls) should also be in place. More on that later.

2009-08-22T09:49:00.002+01:00

Brilliant resource for those moving from technical careers to more entrepreneurial ventures.

At some point you need to know this stuff. I have used the MIT Computer studies materials before but this Financial courseware fills in a lot of blanks.

2008-04-06T13:49:00.000+01:00

Good to see the old alma mater in the news.

Logo carved onto human hair

2008-03-17T08:10:00.000Z

Sharpening tools.

I started to get the tools I use in order. I updated the ipod, the N95 and got my toolsets setup for the laptop and USB keys.

I have also decided to revert back to an older format of the Moleskine Task book. I had changed it recently by adding context tabs in the book (Online, Home Etc) as described in the GTD system. But it simply created a log of sections I did not refer to. Tasks got lost in the several places that they could be stored. I am going to grab a new Plain Ruled Moleskine and try again. This time I will have one big section for Next Actions and Porjects with a bit of room at the back for new sections that come to mind. A blogging subjects area comes to mind.

2007-12-18T09:41:00.000Z

I am currently going through the "joy" of renewing my Canadian Passport. Unlike the pampered Brits who get 10 years of use out of their passports, Canadians have to go through this every five years.

The passports gods have decided to add a couple new hoops to the process, including two referees and additional documentation. The guarantor must be providing his services free of charge, which means that your GP are out of the question (since they charge for everything)

Finally, there is the pain of trying to find a photographer who meets the criteria of the Canadian Passport Authorities (no photo booths allowed). Size requirmentsand the elusive stamp on the back with photographer's address and space for the guarantor's signature.

Thankfully, I found folks in Glasgow who do this - Venart Photography on Bath Street in Glasgow. So I have an appointment to get this done. Then it is just the Guarantor and getting the documentation together for mailing to London.

2007-12-12T15:21:00.000Z

Perhaps inspired by the 56 Geeks poster, I thought i would document some of the peoplpe who take a single subject and pour hours of devotion into it. If Geeks are not obsessive, then who is?

So this is the first post in the Geeks Community series

Today's Geek Community is - Coffee Addicts

I originally saw the manifestation of this devotion to caffeine back in the old days of the internet. The rec.food.coffee newsgroup was filled with people who were devoted to the ultimate expression of Caffeine (trimethylxanthine coffeine theine mateine guaranine methyltheobromine)and they produced the first online documentation for the ultimate coffee delivery systems .

I guess the ultimate of all devotional coffee sites is CoffeeGeek, a Canadian based site which provides reviews of machines and beans and adulation to all things coffee. They have excellent guides for the novice to extreme caffeine.

The folks at coffeegeeks discuss things that seem very alien to the occasional sipper of the workplace cup of caffeine. At no time would you consider that people compete in Professional Barista Championships or know about Cups of Excellence and the practice of cupping.

There are some great hacks to improve the technology behind a great cup of coffee.

Then we have the purveyors of beans. The well-known supplier to the starter roaster in the states is Sweet Marias, however in the UK Hasbeans seems to have taken up the challenge

Finally, we have those that love the art of the expresso,

- Update January 1st 2008 - What happens when you combine a great expresso machine and the power of the open source Arduino hardware - you get a great coffee hack. This guys adds a PID temperature controller and computer interface to his Gaggia Expresso Machine.

2007-11-21T12:48:00.000Z

Flight thru Instruments is a beautiful example of the power of excellent illustration that explains difficult information in a concise manner.

2007-10-24T07:35:00.000+01:00

Geekstuff have on sale a SATA HDD Stage Rack which suddenyl turns all of those SATA drives that you have hanging around into big metal encased floppies - which hold 100Gb to 200Gb each.

You also use it to test SATA drives - what the thing was originally designed to do.

2007-09-04T10:33:00.000+01:00

I have found the mecca for Geeks in Glasgow.

Parnie Street near the Trongate caters to all Geek Needs. Comic books, sci-fi collectables, absolutely astounding.

View Larger Map

2007-08-31T19:44:00.000+01:00

Well, for those who do not know, my life is taking a major turn.

I am leaving the NHS after a seven year stint, leaving behind the networks and systems that I built.

I am going into a field that I have always been interested in for a while - Information Systems Security. It has the combination of developing systems and networks that are secure while being dynamic and under constant change - both from the types of attack and the rapid developments in new technology. However, one thing I have learned about security is that it is a solid foundation in the IT infrastructure that provides the best defence against any attack.

2007-08-27T11:07:00.000+01:00

Just finished mapping the trip from Leeds to Paisley.

All done with no GPS or Tomtom.

Took about 8 hours with stops and had some lovely bits to drive through.

View Larger Map

2007-08-10T20:20:00.000+01:00

I found this article which is no longer accessible on the Security Techtarget webiste

Thought I would put it up here. It perfectly describes the CISSP exam. Something I have tried to do for friends and co-workers in the past couple days, not very well. What can you do? Other than saying "6 hours of hell".

Frustrating Questions
Anybody who says the CISSP exam is easy isn't telling the whole story. There are plenty of difficult questions--some legitimate, some goofy.
BY Andrew Briney

When taking the CISSP exam, expect to encounter at least a couple dozen questions that will frustrate the hell out of you. (ISC)2 exam designers claim these (and all) questions are psychometrically valid. Annoying or not, they're a useful mechanism for separating qualified candidates (infosecurity professionals who have mastered the CBK to an acceptable level) from unqualified professionals (those without mastery of the material who are simply good at taking multiple-choice exams).

Whether you buy this line of reasoning or not, these questions will drive you nuts if you're not expecting them. For discussion purposes, I've divided these questions into four categories, comprising both the "factual" and "interpretive" question types. With each of these categories, I'll try to explain what makes the question difficult, and offer an example. These examples may be a bit exaggerated to illustrate a point. That said, they're not far from the truth, either.

1. Obscure facts. Several questions require you to recall very specific details from the CBK. These are absolutely legitimate, fact-oriented questions that don't require a lot of interpretation. The problem is that you just don't know or can't remember the answer unless you happened to study it recently, have hands-on experience with it, or have a photographic memory.

Here's an example:

1. Which of the following characterizes the Data Encryption Standard (DES) Electronic Code Book (ECB) mode?
a. "Stream mode" cipher, first ciphertext block is XORed with next text block.
b. "Block mode" cipher, 64-bit plaintext blocks loaded sequentially.
c. "Block mode" cipher, 64-bit data blocks processed individually one at a time.
d. "Stream mode" cipher, keystream is XORed with message stream; simulates one-time pad.

The answer is "C," but it's a really hard question because it's very detailed and technical. Moreover, the options include both legitimate DES modes that aren't ECB (answer B is cipher block chaining (CBC); answer D is output feedback mode (OFB)) and a made-up answer (answer "A" also describes CBC, except CBC is a block mode cipher). You either know the answer here or you don't. It's impossible to dope it out if you didn't study it.

2. Misleading interpretive questions. A chunk of questions ask you to pinpoint the "best" answer or course of action given a scenario or context. Granted, by their very nature, these questions are very difficult to craft, but the CISSP exam seems to have more than its share of doozies.

Selecting the best answer to these questions is problematic because (a) what you would consider "best" isn't one of the options; or (b) you need more context to determine what the exam-creators would consider best. Here's an example question that captures both of these problems:

2. Which of the following is usually considered to be the best type of firewall:
a. Static packet filter
b. Application-layer proxy
c. Circuit-level firewall
d. PC firewall

Many people would consider a dynamic/stateful-inspection firewall to be the "best" general-purpose firewall available today. But that's not one of the answers. So you're left to determine what's best from the list of four "next-best-but-not-really-best" alternatives.

Compounding the problem, you're not given any context in which to make an educated decision. "Best" under what circumstances? What type of access control or traffic filtering are you trying to enforce? What type of network or hosts is the firewall intended to protect?

Moreover, the answers are not "equal" in the sense that they're not all of the same type or quality. Is this on purpose or by accident? Again, you can only guess.

OK, you probably wouldn't select "D," because a PC firewall is a specific example of a host application filter. The other three options are core technologies, not form-factor examples of those technologies.

Option A, static packet filter, is a "first-generation" network-layer firewall that does basic IP address and port filtering. It's probably the widest deployed firewall today, so if "best" means "most accepted," option A would be your answer.

However, if by "best" they mean "most able to filter traffic at a granular application header or payload level," then "application-layer proxy" is your answer. But wait: Circuit-level firewalls are "better" than static packet filters because they filter on Transport layer headers as well as IP headers; and they're "better" than application proxies because they can filter on a wider variety of protocols and are easier to maintain. But do two "betters" add up to one "best"?

You get the point. You have to determine what "best" means before you can select the "best" (er, "next-best") answer. This question is aggravating because it doesn't test your knowledge of firewalls--how they work, how they compare, which one's most applicable to a given scenario--but rather your ability to guess how the exam creators would define "best."

3. Questions where more than one answer is correct. In some questions, more than one answer seems correct. And, indeed, more than one is correct, depending on your perspective.

3. Which OSI layer(s) does SSL operate at?
a. Layer 4
b. Layer 5
c. Layers 4 and 5
d. Layers 5 and 7

Each of these is correct under different scenarios. In preparing for the exam, I came across different sources that actually gave these answers. Which one is correct? More to the point: Which answer would (ISC)2 consider correct? Guess!

With questions like these, it's clearly a matter of interpretation and context, and one would hope the CISSP exam would steer away from them. Unfortunately, it doesn't.

4. Confusing wording in the question itself. Perhaps the most frustrating questions on the CISSP exam are ones that force you to guess at exactly what the question is trying to ask. A sloppily written phrase forces you to interpret the meaning of the question--do they mean this, or do they mean that?--which in turn affects your interpretation of the answers.

4. Which of the following best describes a "protective profile"?
a. Implementation-dependent statement of security needs for a set of general IT products.
b. Management-level description of resources necessary to protect a security domain.
c. General framework of physical security requirements for a data center.
d. Includes the "Target of Evaluation" description of an IT product and its purpose, but not necessarily from a security perspective.

If you studied the Common Criteria security evaluation standard, you know that the "protection profile" is an implementation-independent statement of security requirements within the CC. Ah, but the question says protective profile--and what's worse, it puts the phrase in quotes.

Is this a simple spelling or usage mistake? Or are the exam developers specifically trying to bait you into answering the question as though it specifies "protection profile," when in fact they mean something more generic and completely unrelated to the Common Criteria?

It may seem like I'm picking on (ISC)2 and the exam creators by going into this level of detail. But to be forewarned is to be forearmed, and no book, study guide or boot camp prepared me for these types of questions, and no sample test I came across quite captured the essence of these questions. Everybody talks about how some CISSP exam questions are frustrating. Hopefully, I've illustrated why they can be frustrating.

2007-08-01T05:07:00.000+01:00

So, while I have been here I have discovered a couple things. One of the main problems with the CISSP is the level of knowledge that you need to know for the exam. The number of fields of knowledge involved in the CISSP cover more than any other security certification, so often the question is how much do I need to know in each domain/field.

In the field of encryption, you do not need to know the math involved in the various encryption algorithms, but you do need to know the differences between all of the major encryption systems. For example, you need to know the differences between AES and Diffie-Hellman, in terms of block size, type of algorithm, speed, mechanics, processing ability, etc. Making up a chart of all of the major encryption methods to allow to compare is probably a good way to start. At the end of the exercise, you should be able to recommend the correct encryption system based upon the situation that it will be used in.

2007-07-31T21:47:00.000+01:00

Well, I have two days of CISSP and the the fun does end. We are doing roughly 12 hour days working on some pretty tough security concepts.

The clas is a little large with 27 people in it. The CISA course was alot smaller with 12 people in the class. It seems to limited participation a little. It seems that this course is quite popular considering the timing of this week (school holidays and such).

Today was cryptography with everything covered (except for the math). It was more aimed at knowing all of the aspects of these cryptographic systems in order to choose one for a specific situation.

2007-07-29T20:37:00.000+01:00

So, I have arrived at Training Camp and I thought I would try to do a bit of a running blog during this week. That may be a bit difficult due to the amount of work involved in this course, but I will definitely try.

The course hours are 8am to 8 pm for 6 days and then I write the CISSP six hour exam on the seventh day.

I am really weak on several of the domains, including the policy and application dev stuff but I am hoping that this knowledge will be picked up during the week.

2007-07-08T10:32:00.000+01:00

Liz and I were driving around Glasgow yesterday, getting some magic tricks for her sister's impending trip to Greece. We were thinking of cheap things she could take to give to the kids over there and the tricks from Tam Shepherd's Magic Shop seemed ideal. This place has always been there and I wonder how it stays in operation. The tricks that we bought for the kids were between 50p and 2 quid. The guy behind the counter will always show you some trick that you can do and will impress. Brilliant place.

We get back to the car and Liz starts to head to Tescos, as we get near the Finneston Bridge, loads of cops are lining the street on either side. At the traffic lights we ask a female police officer if the Orange Walk is due soon (the bridge's lamp posts have union jacks tied to them) and she tells us that they left Bellahouston Park about 10 minutes ago. Liz squeals and I remind her that we can turn around and head down to Shawlands. So we go back over the bridge and down to the Tescos at Silverburn, avoiding King Billy and the piccolo players.

2007-06-28T16:48:00.000+01:00

I am not sure if this is a Phishing email but if it is from the National Lottery, then they should review their policies on sending suspicious messages to people on their mailing lists.

2007-06-19T19:58:00.000+01:00

Very impressed by these Pedalite pedals that make your bike very easy to see and are self-charging.

2007-06-18T10:17:00.000+01:00

Great series for Network Newcomers - Networking as a 2nd Language

Sorry if I am plugging up Planet ScotLUG with this stuff. Just trying to get my web resources sorted for the CISSP.

2007-06-16T09:31:00.000+01:00

You want a crypto course and don't want to pay for it?

Check out the University of Washington CSE P 590TU: Practical Aspects of Modern Cryptography with brilliant slides and lecture notes.

MIT's OCW also has some good offerings.

6.897 Selected Topics in Cryptography

2007-06-16T09:15:00.000+01:00

This is Dave Libershal's CISSP page recovered from Google Cache

CISSP Prep Resources

General CISSP Info
Sample CISSP Exam Questions
Domain 1 - Security Management Practices
Domain 2 - Access Control Systems and Methodology
Domain 3 - Telecommunications and Network Security
Domain 4 - Cryptography
Domain 5 - Security Architecture and Models
Domain 6 - Operations Security
Domain 7 - Applications and Systems Development Security
Domain 8 - BCP and Disaster Recovery Planning
Domain 9 - Law, Investigations, and Ethics
Domain 10 - Physical Security

General CISSP Info:

CISSP_ISSA_BALTIMORE
Study Group Yahoo Site

CISSP Yahoo Group
FAQ

About
the CISSP Test & Certification

NIST Computer
Security Publications - from the NIST Computer Security Resources Site.

NIST Computer Security Resource Center
- CSRC.

ISC2 - International Information Systems
Security Certification Consortium.

CISSP Open Study Guide site

Seminal
Papers - from the Computer Security Paper Archive Project.

NSTISSI No. 4009 - 1992 National
Information Systems Security (INFOSEC) Glossary. "Provides standard definitions
for many of the specialized terms relating to the disciplines of communications
security (COMSEC) and automated information systems security (AISS), sometimes
referred to as computer security (COMPUSEC)." The most recent Sept. 2000
version is available as a PDF file at www.nstissc.gov/Assets/4009.pdf.

Wikipedia's
Review of Information Security.

Handbook of Information
Security Management - 1999 edition.

Computer Security Resources

Federation of American Scientists

SecurityManagement Online
extensive news and legal coverage of security issues.

Microsoft
Security Tips

Back to Index

Sample CISSP Exam Questions:

CCCure's Sample CISSP Questions
. Be sure to check their Study
Guides and download materials.

Cert21 practice tests
- but you first need to set up an account with them.

Back to Index

Domain 1 - Security Management Practices:

Note that there is much commonality between this and other domains.

Modelling
Information Risk Elements - by Alan Oliphant (in ITAudit)

Configuration
Management Guides - This material is also useful for Domain 7 review
of applications configuration management.

Risk Management
- from the Handbook of Information Security Management.

Microsoft
Whitepapers on Security Management - This is a recent (9/2002) guide
with set of links to various Microsft papers that cover the management of
site security policies and procedures.

Back to Index

Domain 2 - Access Control Systems and Methodology:

There is much repetition here with other domains - review OPSEC (Domain
6) and Physical Security (Domain 10) in particular. See additional Common
Criteria and Biometrics resources at those Domains.

General Access Control info from
Security Solutions.

NIST Paper on Role-Based
Access Controls - considered to be better than DAC for non-military
sites.

Rainbow Series
Library - with PS and PDF formatted documents.

DOD
5200.28-STD - Orange Book (1983) - DoD Trusted Computer System Evaluation
Criteria (TCSEC).

Evaluated
products List - listed by rating from Orange Book. Since this list only
covers evals in past three years (note the site was last updated in Sept,
2000) Also, be sure to see the Historical
List of all previously evaluated systems (listed by vendor).

NCSC-TG-005
- Trusted Network Interpretation of the TSEC (Red Book) and NCSC-TG-011
- Guidance for Applying the Trusted Network Interpretation. These extend
the Orange Book coverage to networks.

ITSEC
- Information Technology Security Evaluation Criteria - British certification
recognized in Europe. Developed as an international alternative to TCSEC.
In May 1990 France, Germany, the Netherlands and the United Kingdom published
the Information Technology Security Evaluation Criteria (ITSEC) based on
existing work in their respective countries. Following extensive international
review, Version 1.2 was subsequently published in June 1991 by the Commission
of the European Communities for operational use within evaluation and certification
schemes. ITSEC is a structured set of criteria for evaluating computer security
within products and systems. Each evaluation involves a detailed examination
of IT security features culminating in comprehensive and informed functional
and penetration testing. This work is undertaken using an agreed Security
Target as the baseline for ensuring that a product or system meets its security
specification. ITSEC operates the concept of assurance levels E0 to E6.
This scale represents ascending levels of confidence that can be placed
in the TOEs security functions and determines the rigour of the evaluation.
Since the launch of ITSEC in 1990, a number of other European countries
have agreed to recognise the validity of ITSEC evaluations. Both ITSEC and
TCSEC are forerunners of the Common
Criteria - ISO 15408 (1998)- first released in 1996.

CC
EALs - Common Criteria's 7 Evaluation Assurance Levels (EAL 1-7) and
their relationship to ITSEC evaluation levels (E0-6).

Understanding the
Windows EAL4 Evaluation - a useful discussion of how the CC works.

National
Biometric Test Center Publications

Biometrics Links
from the MSU Biometrics Research Site.

Back to Index

Domain 3 - Telecommunications and Network Security:

Telecom & Networks web courses - easy to follow, and a good place to start

Communications Protocols

Cisco Network Terms Glossary

Techweb Networking Terminology

www.whatis.com

Searchable RFC Database

Cisco Documentation

Guide to Network Administration - good coverage of common issues, plus technical info on LANs, VPNs, and network security.

TCP/IP Overview
from ACM.

Intro to TCP/IP -
an old (1995) and brief document. The ACM overview is better.

TCP/IP
Tutorial from Dragonmount

RFC1180 - a TCP/IP
tutorial.

Network Device Presentation - good descriptions and helpful diagrams.

Uri's TCP/IP Resources
List - a massive set of well-organized links. This is THE PLACE to go
for TCP/IP information. Much of what you need to know or want to find about
TCP/IP is at this site.

Understanding Communications - focus on the WAN side - From Ericsson

O'Reilly Network Articles

Data Network Resources - this is good overall coverage

Anritsu
Must-Have Reference for IP - has a very good glossary of IP acronyms.

Webopedia On-line Computer Encyclopedia
- good network coverage

Cable and Connectors - this is an excellent document with helpful drawings and tables.

Cable Products Catalog

Networking Media Course - good overview set of slides, includes wireless.

Fiber Technology

Images of Cisco network devices

Ethernet
Designations - nice chart of the different Ethernet flavors.

Telecommunications Media - Chapter 4 of Stallings' Data and Computer Copmmunications textbook.

CAT7
vs Fiber - discussion of the different cable types and expected usage;
good coverage of fiber technology.

WANs

Google
Searchable Subject Index on Internet Protocols

IANA List of Registered TCP/IP Ports

TCP/IP
Protocols, Ports, and Sockets - good coverage of how they work.

DOD Migration
to IPv6 - 10/14/03 issue of GCN

Security Implications
of IPv6 - ISS paper that discusses how migration to IPv6 may create
security problems.

VoIP

Wireless Tutorial

802.11 Tutorial

Comprehensive list of network monitoring tools

Shomiti Taps - Finistar site

LURHQ's Malware Technical Papers contain some solid info about various worms and viruses, and exploits like DNS cache poisoning.

Access Control and Firewalls

SSL
and IPSec Tutorial - presentation with good coverage and useful diagrams. Also see SSL and TLS description
and thorough IPSec presentation

IPSec Overview from Cisco

IPSec
White Paper - from Cisco, contains a useful summary.

IPSec
Tunneling Described - short Microsoft article with some helpful diagrams

PKI
Tutorial

Radius and TACACS
- Network Computing article.

Secure
RPC - brief overview.
Application Layer Security Protocols

Sniffer tools
and detection article in Linux Journal - brief overview.

packetsniff site by Steve
Gibson.

Packet Storm's alphabetized
download site for sniffer and analyzer software, with descriptions.

High-level Overview of Attacks, Services, and Mechanisms

RAD Network Tutorials
- much easy to find info and a glossary.

Network Security Articles
by Rik Farrow

FAX FAQS - from
FAXIMUM. Very extensive coverage.

ISS Security Center's Underground info

My Network Resourcess

My Security Resources

Back to Index

Domain 4 - Cryptography:

Intro
to Cryptography and PGP - Good intro with useful Glossary - heavy focus
on PGP.

Summary of Cryptographic Techniques

My Crypto
Links - several useful links that I have found are here (part of my
security web page). These include two quality sites that have massive sets
of links to numerous crypto sites. Also, see My
Security Class Links that includes various NIST links.

NIST's
Cryptography Overview - good discussion of symmetric and asymmetric
methods.

Homeland Insecurity
- Atlantic Monthly interview with Bruce Schneier. Some good crypto background
material and a primer
on public-key encryption.

Wikipedia's review
of cryptography

Back to Index

Domain 5 - Security Architecture and Models:

IPSEC
- Charter for IETF's IPSEC with list of relevant RFPs from this group.

The
Anderson Report - Computer Security Technology Planning Study, 1972
for USAF.

Enterprise Security Architecture - Draft document from the NAC Security Architecture Work Group April 2004

The
Design and Evaluation of Infosec Systems - C-TR-32-92.

Security Architecture
- from the Handbook of Information Security Management.

Multics General Info and
FAQ - early mainframe timesharing system, forerunner of UNIX but more
heavily secured.

Matrix
of TCB Divisions - a nice visual aid helping to understand the different
levels of the Trusted Computer Base in TCSEC.

The Complete, Unofficial
TEMPEST Information Page

Back to Index

Domain 6 - Operations Security:

Links to CIRT Sites

http://www.defendamerica.mil/articles/a021202b.html

National Infrastructure Protection Center

RAD Network Tutorials
- much easy to find info and a glossary.

Common Criteria - ISO 15408.
Be sure to read the Introduction
to CC - pdf file for those (like us) who don't need to read the full
document.

FCAPS - Fault,
Configuration, Accounting, Performance, and Security - model for asset management.

Rainbow Series
- online library - note the Configuration Management and Trusted Recovery
documents.

Interagency OPSEC Support
Staff - info about IOSS plus links to other good OPSEC sources such
as NSDD 298, and the OPSEC Professionals Society.

DoD OPSEC Program
- DoD Dir 5205.2.

Andrews
AFB OPSEC Site - has many related organizational and reference links,
including a useful glossary of terms.

Northrop Grumman IT Site

Back to Index

Domain 7 - Applications and Systems Development Security:

Fast
Guide to RAM Types

Objects and Components - OO
resources from I.T. Works.

Relational
Database Concepts - a brief review.

Database Security
- helpful PowerPoint presentation from a college course.

Back to Index

Domain 8 - BCP and Disaster Recovery Planning

http://www.nwfusion.com/research/disasterrecov.html
Network World Fusion Research site on Disaster Recovery with a wide assortment
of links.

Back to Index

Domain 9 - Law, Investigation & Ethics:

US Information Security
Law - Part 1 - from SecurityFocus 2/25/2003.

Federal Laws & Regs
- good set of links from fedlaw site but only thru the late 90's. Some additional
related links as well to federal agencies and other security sites.

Code of Ethics
from various sources including ISC2.

RFC 1087 - the IAB's
"Ethics and the Internet".

LAWSOURCE - American Law Sources
On-Line.

MLAT - Mutual Legal Assistance
Treaties.

Digital Millenium Copyright
Act - many links to resources about the DMCA - from educause.

Computer
Security Act of 1987 - Public Law 100-235

Computer
Fraud and Abuse Act of 1986 - 18 USC 1030

Why the Due Care security
review method is superior to Risk Assessment - Donn Parker's argument
against using Risk Assesssment techniques. CSI's Computer Security Alert,
Number 212, November 2000.

Intellectual Property Law - from
KuesterLaw - The Technology Law Resource with links to many patent, copyright,
and trademark related sites.

Legal & Ethical Issues
from NIPC

Electronic Frontier Foundation

Electronic Privacy Information Center - EPIC

WWW.CYBERCRIME.GOV - US DOJ

Federal
Computer Intrusion Laws - links provided by CCIPS at the cybercrime
site.

Computer
Fraud & Abuse Act of 1986 - 18 USC 1030 w/ 1996 amendments - from the
DOJ cybercrime site.

Computer
Security Act of 1987 - the full text of the law in an easy-to-read format.

Computer Security Act of 1987
- Site at the Electronic Privacy Information Center (www.epic.org) that
contains links to additional related info.

Patriot Act

- at the EPIC site.

USA
Patriot Act - full text (from the EFF site).

USA
Patriot Act analysis by EFF - very thorough.

FIRST - Forum for Incident Response.

CERT Incident Response Team Resources

Glasser LegalWorks - much info (online
newsletters and many links) relating to the legal side of computing.

State Law Search
and State
Computer Laws

more
- additional computer law & forensics resources from my security site.

Back to Index

Domain 10 - Physical Security:

CISSP_ISSA_BALTIMORE
Yahoo Files

The International Biometric Society
is devoted to the mathematical and statistical aspects of biology.

The Biometric Consortium US govt.
focal point for research, development, testing, and evaluation. It is sponsored
by NSA and NIST. See their Introduction
to Biometrics.

NIST Biometrics
Research Center

Common Criteria
-site index for the new international standard for Information Security
- ISO/IEC 15408. Includes a list of products that meet Common Criteria evaluation
requirements.

National Information Assurance Partnership
sponsored by NIST and NSA to disseminate information on the status of all
development efforts associated with new security specs and requirements
that comply with the Common Criteria. See the NSTISSP
No. 11 FAQ that clarifies compliance with this national IA acquisition
policy for deploying IA products at govt. sites.

Halon
1301 FAQ.

Halon
Alternatives FAQ. FM-200
is supposed to be the most effective alternative.

Army
Field Manual of Physical Security - (314 pages). recommended sections
are Physical Barriers (c.4), Lighting (c.5), Security Systems (c.6), Access
Control (c.7), and Lock and Key (c.8)

Back to Index

2007-06-08T08:06:00.000+01:00

I have been thinking of blogging this one for a while. For those who admire the Victorian period but but do not want to lose all of the technology that they use daily.

The Steampunk Workshop is producing the goods for those Victoriana Tech-Heads.

2007-06-05T11:26:00.000+01:00

Best new firefox plugin is Firegpg

Use it with GPG to sign and encrypt your Gmail emails easily.

2007-06-04T22:10:00.000+01:00

This is too good.

It is lovely when the BBC gets done over - now could they start to mention that Bush started the recent nuclear escalation in Europe and not Putin?

2007-05-25T09:10:00.000+01:00

What are you doing this weekend?

Build an bunch of SF AT-AT Snow Walkers and recreate the Battle of Hoth.

2007-05-25T08:10:00.000+01:00

Why not use reCAPTCHA to stop spam on your blog and help the internet archive digitise books?

reCAPTCHA improves the process of digitizing books by sending words that cannot be read by computers to the Web in the form of CAPTCHAs for humans to decipher.

2007-05-07T15:40:00.000+01:00

Well, I had a lovely discussion with the Vodafone technical team who told me that the Vodafone network does not offer VoIP as part of their network. I asked why they had disabled internet telephony on my Nokia N95 and they said that they hadn't.

The salespeople told me that the phone was a standard Nokia N95 with all of the features of this phone.

I love it when they lie.

So, not sure when I can start to use VoIP - this is not over yet.

2007-05-05T06:19:00.000+01:00

2007-04-23T10:05:00.000+01:00

I have trying to develop a way to make the encryption of sensitive documents as seamless and effortless as possible for non-techie people.

There are brilliant applications available for people to use and they are very easy to set-up.

The problem is that secure volumes and folders are set-up as separate areas for the storage of sensitive documents, with the result that either they are not used or some sensitive documents are left out.

The solution is to make the secure volume the default area for these individuals to store all of their data and for most windows users, that means the My Documents folder.

I used Truecrypt to create the secure volume. It was setup using a meaningless file name in a non-descript folder on the C: drive. Normally, I would have used a separate physical disk for this volume but it was a laptop with only a single hard drive.

I then moved the My Documents folders for this user into the secure volume after pruning out some default save folders for iTunes and Google Video.

The trade-off for using the my Documents folder is that a lot of non-secure items will be saved to this location (Christmas lists, letters to family and friends) but it will also be the default folder to hold all of the sensitive items that need to be secured. The user does not need to make a decision whether or not the document being saved is needing encryption.

As long as the TrueCrypt password chosen is of a reasonable length and memorable, this fellow is safe from prying eyes for those items that need to be secured.

2007-04-23T10:03:00.000+01:00

This is very scary.

Can we now discount the U.S. as part of the first world? Move them down the chain to those groups who pray to jeeps in the South Pacific?

2007-04-23T09:26:00.000+01:00

I have just returned to twitter

I joined a couple months ago and let it sit. I have joined and used things like this before and never found them to be beneficial (buddyping comes to mind). I still believe it is a stalker's dream site.

2007-04-20T19:12:00.000+01:00

Been working on the new ScotLUG t-shirts for the Paisley Beer Festival.

It was work acheived through a number of people. Mike Quin took my original idea and refined it into a decent piece of work.

I put the fonts I liked past the folks in IRC and they chose the ones they wanted.

Lucinda Sans and Magik.

The t-shirts will be ready in a week and hopefully Linux Format will run the picture again.

2007-04-17T14:33:00.000+01:00

I have just found Epica leather bound journals, which is serious notebook pr0n. They look fantastic, straight out of a museum or a Myst episode.

The only problem is that I would never write anything in these journals. I have a problem in marking up a ten quid moleskine, with my thoughts. A £1200 leather bound journal would remain pristine.

2007-04-11T15:50:00.000+01:00

Picked up a Nokia N95 from Vodafone. Supposedly Vodafone have killed VoIP on this phone - so it is time to flash the firmware on this puppy and get some functionality back.

2007-04-11T15:24:00.000+01:00

We used the Tomtom One a great deal while holidaying down in South Ayrshire. It worked very well and guided us to a number of places, including the remote cottage that we stayed in.

We put the postcode supplied to us by the owner of the cottage into the Tomtom and it took us within a 100 yards of the place. I think the postcode designated the area rather than the individual buildings. Without it, I doubt we would have been there as quickly.

Another situation was when I tried to find the Sulwath Brewery in Castle Douglas. We found ourselves on King Street and as Liz pulled over to park, we were right beside the brewery. It would not have been easy to find since the brewery is actually not on the street.

2007-03-31T09:48:00.000+01:00

The Sopranos in 7 minutes and 36 seconds

Easy way to catch up on the Sopranos.

2007-03-17T20:03:00.000Z

Is there anything cooler than Astronuat Tools

I did not think so.

2007-03-15T08:50:00.000Z

Combine big ships, large machines and cranes and you have one of my favourite web pages.

What could you do if you filled one of these supertankers with Sun Black Boxes.

Maybe take over the world.

2007-03-10T19:43:00.000Z

What could be better than sitting in the backyard on a summers eve with a belly full of barbeque and then toppping it off with some Liquid Nitrogen Ice Cream

2007-03-10T12:58:00.000Z

This public toiletis a little intimdating. It reminds of the public urinals that they had at the Edinburgh G8 Peace Rally.

2007-03-09T10:43:00.000Z

Gmail Manager allows you to manage multiple Gmail accounts and receive new mail notifications.

2007-03-08T17:34:00.000Z

The OpenSUSE team are conducting a survey.

They want to know how people feel about the 10.2 release of OpenSUSE.

If you are using it - go fill it in.

2007-03-06T16:29:00.000Z

A rear-view mirror made from beercaps and bike spokes that can be attached to your bike helmet.

Beer-view mirror

2007-03-05T11:11:00.000Z

I have been using the Blueye for about two months now and so I thought that a review was in order.

This handy little device operates very similar to the Apple iPod remote with a few differences. In terms of shape, it resembles the old iPod remote. The clip on the old remote sucked and was ineffective in clipping onto things. The Blueye suffers from the same problem. Too often you look down and see the remote hanging a couple feet down your front. You can't lose it but it is a bit of a pain.

One other point, before we get to the main functionality of the device is the radio button. The old apple remote enabled an FM Radio on the iPod which you accessed through the click wheel. The Blueye uses a FM Radio button on the side of the device just below the lock slider. It is too easy to hit when you are trying to clip it to your jacket or fumbling for the play button. Hauling out your iPod to determine why it will not play your music and finding it tuned to 88.9 on the FM dial is inconvenient.

Finally, the main use of the Blueye is to provide Bluetooth connectivity to your mobile phone. You are walking along, listening to tunes on your iPod, and your phones rings. You hear the ringtone through your earbuds and answer the call. When you hang up the call, your music starts up again.

Setup involved a few cryptic key presses, but the two devices were easily paired up. The connectivity is as good as the in-your-ear Bluetooth devices and it does not make you look like a Borg.

The earbud volume is set by the phone's volume, if you use the phone without the Blueye and then reconnect, it can blowout your ears, . I tend to use the phone speaker volume set on high when walking next to city traffic, and then have unpleasant loud volume in my ears when I reconnect the phone to the Blueye.

You can use voice tags to call people (there is a small voice tag button on the Blueye remote), so this is a wasted feature on me. This never really worked for me when I tried it with just the phone. I feel very silly when I shouting people's names into my phone repeatedly while it dailed no one.

I had one problem in that checking your calendar on the phone will stop your music. If you turn off your keypad tones, the phones will send no sounds to the headset and allows you to use your phone without shutting off your iPod.

All in all, the Blueye does what it says on the box. I tend to use it more often than not. I own an Apple iPod remote, which has been replaced by the Blueye.

2007-02-26T11:09:00.000Z

I was thinking of getting an Nokia N80 as an upgrade but it seems that for once I have dodged a Mobile Phone bullet, as N80's are being recalled and discontinued by every major phone supplier.

I guess I now need to wait for the Nokia N95.

2007-02-26T10:20:00.000Z

I found this image of Google’s First Production Server on Flickr, along with a number of decent photoso of amazing technology held at the Computer History Museum.

2007-02-26T10:18:00.000Z

I love this image. The view of the Shuttle is asotounding and the F-15 in the foreground just makes it better.

2007-02-26T10:15:00.000Z

Who would not want to build their own Climbing Wall?

This fellow employed the help of a friend but it seems to use treated lumber so the wall could stay outside, if you combine this with marine board you have a sturdy outside structure. I am sure the costs could be reduced if you built this inside.

2007-02-19T15:55:00.000Z

A Better Method to Decent Coffee

A couple people in ScotLUG have been talking about making coffee.

I thought I would share my current method of Coffee Production.

Maybe I should preface this post with a couple admissions. I have spent a lot of time making and drinking coffee. I have used a variety of machines from large cafeteria coffee makers to smaller domestic models. They all had their faults. Large machines can generate a lot of coffee (usually too much for home consumption) and they teach you a lot about the problems of running hot water through plumbing and then trying to drink it.

Although Scottish kettles are free from scaling, this is a problem in other areas. When I travelled around Canada and the UK, I would come across coffee shop staff that had neglected the cleaning of their coffee machines. Calcium scale on the pipes of coffee makers produces horrible tasting coffee. So the first thing I did when I developed this system was eliminate the plumbing.

I hate two things about home coffee machines: the hot plate and the pause feature. The hot plate slowly produces coffee syrup. Heating coffee after you produce does not improve the taste. In fact, it is the worst thing you can do to this liquid. The volatile substances that produce that unique lovely coffee taste is driven off by heat. So, by heating your coffee you accelerate this process.

The pause feature is a nightmare for two reasons. First it ruins a decent pot of coffee by allowing people to grab a cup halfway through the brewing process. Secondly, it can turn a coffee machine into a flooding device by the coffee grounds plugging up the valve that stops the flow of coffee. The contact time of the water and the coffee grounds is part of the decent coffee equation. It is much more important, than the size of a valve designed to stop the flow of coffee. Coffee machine pause features are evil.

So, this system has eliminated the plumbing that would need to be cleaned, and it removes the hot plate and pause mechanism. It keeps the coffee hot and produces enough for a couple people, or one person all day. It uses readily available components:

One Thermos carafe

One Melita Coffee Cone

Some tools to alter the cone’s base

Coffee and Coffee Filters

This produces a pot of coffee in about 4 minutes, it stays hot all day (especially if you preheat the Thermos), and the clean up process is extremely easy.

There is supposedly a pre-altered Coffee Cone in the states that screws into the Thermos Carafe. Unfortunately if you cannot find one of those you will have to make your own. This involves either a sharp knife, a pair of metal snips, and a file. I just used an Olfa knife and a bastard mill file.

One consideration is the size of the threaded opening on the carafe. If there is not sufficient gap between the internal bottle and the plastic threads, you will never fit the cone base to the thermos.

2007-01-09T23:01:00.000Z

DebConf in Edinburgh from June 17th to the 23rd of June and then Akademy in Glasgow from June 30th to the 7th of July. This summer is promising to be a full one with loads of Linux happening in Scotland.

2007-01-01T11:26:00.000Z

Well, A New Year has begun. I have fairly big plans for this year. It may a tough one but I have defintie ideas on what I want to accomplish.

New Years has never been one of my favourite holidays. Late Night drinking preceded by 14 hours of cleaning has never been my idea of fun. It clashes with my morning person personality. I went to bed at 1am and woke up at 5:30 - my regular start time.

I have some time off for the next two weeks to make up for the lack of time off during Christmas.

2006-12-31T13:31:00.000Z

A project for the new year - Carputer.

Take a Mac Mini and combine a car - you have the Carputer. Or in Paisley, it is known as a Smackhead Target.

2006-12-19T08:43:00.000Z

I have had a bad case of the Lurgie over the last couple days. The worst aspect of it was the bad chills. Whn I would get out of bed or out from some covers, a shiver would over me nd I would be cold to the core my body. Unfortunately, this lurgie comes with some bad depressive aspects. Waves of depression seem to wash over me whn I have this illness.

Last night the chills broke and I soaked the bed in sweat. Three comforters, a mattress and pillows absolutely sopping wet this morning. But the depression has lifted and the chills are gone.

2006-12-14T14:09:00.000Z

My password grid

J,V,w,W,C,c,k,a,n,u,x,2,S,I,6,y
Z,z,l,S,W,t,l,n,p,R,Y,T,4,X,e,8
N,G,t,K,K,B,O,S,F,S,w,p,N,7,A,a
S,k,X,g,K,3,w,H,q,i,F,c,z,Y,9,J
t,x,K,0,S,U,2,r,h,t,q,G,n,q,y,N
B,h,y,w,B,R,N,J,I,9,h,e,A,N,o,9
b,A,b,6,6,1,U,L,A,g,q,G,S,w,9,B
j,x,u,W,Y,Z,T,E,E,s,w,i,6,v,6,d
9,x,7,Y,C,a,C,f,A,J,9,O,A,t,R,D
7,V,g,v,G,V,8,2,N,Y,W,U,Y,s,Q,H
s,p,B,U,y,7,A,f,Y,B,o,U,p,P,l,K
1,U,W,f,7,V,z,P,g,0,f,0,y,D,u,P
B,U,n,X,i,G,s,3,K,K,k,q,G,3,s,3
I,o,Q,7,2,f,E,b,9,b,Q,M,i,V,k,1
Z,M,U,F,5,H,d,N,v,g,W,T,A,Q,Q,K
I,c,m,l,J,y,c,T,R,S,E,l,B,9,j,U

have fun

2006-12-13T10:59:00.000Z

I have tried alot of reflective clothing to keep myself safe on a bike when riding at night and I have been astounded at the number of people cycling at night while wearing dark clothing with only a single reflector or blinking red light on the back. Often the excuse that motorists supply after hitting a cyclist is that they never saw them. Unfortunately while these cyclists continue to dressed like they are about carry out a secret raid for a government agency, I am inclined to believe the motorist.

So far, the best piece of clothing that I have seen on the roads in the dark wet Scottish nights has been these Yellow HiVis Trousers.

I believe that they were being worn by a guy leaving his job at Glasgow Airport but they were unmissable due to the reflective strips on the legs moving as he pedaled. He also had a HiVis jacket on but the first thing that caught my eye was the reflective strips on the legs.

I doubt they are very durable, but for £8.50, you are lit up like a police car.

2006-12-13T10:36:00.000Z

If you know someone with an iPod or another device that recharges from USB, then this little project makes the perfect gift. The MintyBoost! is a small battery-powered USB charger that is fairly easy to make even for beginners. Just a soldering iron and a few tools and you can save that iPod user from the sad dead battery symbol.

2006-11-29T19:49:00.000Z

My 2p.

Google Video failed because it created a bunch of users - I still regularly check out the engedu videos from the Google Lecture series.

But YouTube created a community; people could rate, talk about and respond to videos.

YouTube did not beat Google video on the quality of the video, rather it was the interaction between the creator and and viewer.

If we look at the future of entertainment, then television better beware. The most non-interactive medium ever is big trouble from a lot of different fronts. Television high-quality video presented a one-way experience. YouTube is a bad video with a lot of participation.

2006-11-29T18:46:00.000Z

A new way to "stick" it to the man - the RFID Duct tape Wallet. I have always been a fan of all things duct tape, or my favourite, Gaffer Tape. More colours and easier to work with. Decent gaffer tape is always available where dj supplies are sold.

This is the "tinfoil hat" of the currency carriers, but if it stops people grabbing your RFID details, maybe a bit of paranoia is called for.

2006-11-27T14:57:00.000Z

A Firefox hack

The first two search engines I add on a new Firefox install are Mycroft and Firefox addons.

No need to browse to Mycroft to add any more search engines and the firefox addon page simplifies adding all of your crucial extensions.

2006-11-26T10:10:00.000Z

Feeling like crap today with a screaming head - maybe it was 12 hours of painting the pantry yesterday.

The kitchen is looking good - but it still has nothing in it. The painting of the pantry and such means that until that is done - nothing really can be brought out of boxes.

2006-11-13T12:28:00.000Z

The Scottish Gas Engineer had a
TOUGHBOOK-19 which took two cups of coffee being spilled on it and a tumble from the top of the stove to the plywood floor, while running. failry impressive. Too bad they run like dogs and are twice the price of a more delicate portable.

2006-11-10T11:05:00.000Z

Brilliant Movie transformed into a slaher film trailer.

Liz still does not understand why I like the original.

Office Space - Recut

2006-10-18T14:53:00.000+01:00

Very cool idea.

Project Blackbox by Sun similar to what we heard Google was doing with their shipping containers. but now we get to tak ea virtual tour thorugh one.

Combine an international shipping standardised containers and a lot of racks filled with 250 Sun servers, and things get interesting.

2006-10-06T14:08:00.000+01:00

What coders really think revealed by Google Codesearch.

2006-10-06T14:06:00.000+01:00

What coders really think revealed by Google Codesearch.

2006-09-30T08:12:00.000+01:00

The joy of Cover Browser.

So, I have been playing with iTunes 7 and the new Cover Browser. It has changed the way I look at my music collection.

I guess by using so many digital forms of media, that I lost some of the joy that I experienced in purchasing vinyl. The feel of picking up an album sleeve and looking at the artwork was as much a part of the experience as listening.

Suddenly, obtaining the cover art for an MP3 has become as much a part of the process of encoding a song as getting the album name and track numbers right.

A couple places I have scoured for cover art

Google Images - wide variety of images available, not always the best quality

Amazon - Good selection and fairly consistent quality

AllMusic Guide - Usually have the cover art but it is very slow to search, I usually search with Google using a site: switch

Musicbrainz - They get their art from other sources, usually amazon but, this can be convenient when you are tagging your files, to grab the cover art as well. Musicbrainz Picard occasionally adds album art as a metadata set but this can be a little flaky.

Finally iTunes Get Album Art command - I have found this to be a reasonable way of filling in the majority of album artwork, but it is very dependent on the album name and not very forgiving for slight changes in name. Often I am filling in the gaps where iTunes has found nothing to match the file.

2006-08-28T09:37:00.000+01:00

And people say I am difficult to buy for?

How could not know what to get me when items like this exist?

2006-08-18T17:02:00.000+01:00

Hell Trip

Well, I took on Toronto Airport and almost won.

The trip started early afternoon in Winnipeg. Earl drove me in and stuck around to ensure that there were not any problems with my luggage.

The luggage weight was not a problem and I setlled down to wait for the flight to Toronto. The timing was slightly tight, and I had about an hour and twenty five minutes to get myself between terminals and checked into Zoom.

The flight was delayed out of Winnipeg and a failed approach at Toronto added to the time. I was standing in the baggage claim at Terminal 1 and looked at my watch and thought, "wow, I still have plenty of time", until I reralised that I had lost an hour and I had less than 20 minutes to get to the Zoom Check-in desk. Halfway there the left wheel fell off my suitcase but I made it with 5 minutes to spare, they took my luggage off me and gave me my boarding pass and stuck my baggage claim ticket to it.

Then they sent me to a set of closed security gates - in fact at this time, the whole airport had closed down. I had to walk back past the gibbering idiots at the Zoom Desk and find an open set of gates to get through security. I breezed through that (after taking my belt off) and got myself to the departure gate. The plane had almost fully boarded and I got myself on and was feeling good until a large couple came along and sat in the neighbouring seats. The wife sat next to me and spilled into my seat for the entire journey, pretty well elimiating any chance of sleep. About an hour outside of Glasgow I started to talk to the husband and after finding out he was from Manitoba as well, we traded Prairie Stories.

I thought I had got through this trip relatively unscathed, until I tried to claim my baggage. Half an hour later as I (and about forty others) watched a single unclaimed suitcase wind its way around the baggage claim area, I knew that this story was not over yet. When I filled in the lost luggage form, I doscovered that the idiots at the check-in desk at Zoom had attached my baggage claim ticket to the portion of the ticket that the airport staff had retained in Toronto. Fortunately the lost wheel should be a pretty good identifier.

Liz met me at the airport and after kisses and cuddles, I got myself home to a warm bed and nice snooze, after roughly 24 hours of travelling.

Good to be home

2006-07-19T07:48:00.000+01:00

Cycle Diary

Ride to Work - Paisley to Glasgow, 10 miles, dry roads, good weather, 18C

First ride in a long time. I finally ran out of excuses. The hot weather and the sight of several old guys pedalling towards Glasgow wiped out all weather and danger reasons for not riding into work. The pensioners pedalling was probably the worst, nothing as a cyclist makes you more ashamed than to see a old guy pedal past as you asre trying to explain the dangerous lifestyle of an urban cyclist.

The ride in was uneventful. I left early, so traffic was light. The early morning air had that heat wave crispness to it with none of the heat itself. All in all, a good ride in, too bad that my body has given up. My legs had no power, and my heart while not at its max heart rate was definitely being pushed. The worst aspect though was th feet. My plantar fascia started to scream a couple of blocks into the ride and did not stop until I hit work. I need to stretch this out and hopefully it will settle down with more riding.

2006-05-20T22:00:00.000+01:00

What the Hell?

Is Lordi the type of music being produced out of the country that gave us nul point failures. So the finns decided to give us Orcish musicians playing Melodic Hard Rock. A eurovision Slipknot to challenge the techno status-quo at this politically driven musical contest.

Well they won. The video of their performance is here.

2006-05-18T10:04:00.000+01:00

Kiva lets you loan as little as $25 to a qualified low income entrepreneur in the developing world.

Not sure what controls are available but it sounds like an interesting way to bring folks in the third world out of poverty.

2006-04-22T12:20:00.000+01:00

The Paisley Beer Festival was last night and the incriminating photos are in.

You can find them here

2006-04-19T17:08:00.000+01:00

As a guy who peeked and poked his way around a Commodore PET in the early eighties, this mod is very cool.

I still remember trying to explain reverse polish notation to my Comp Sci teacher who was a bit of a diddy.

His last words to me were "document your code more". I should have followed it.

2006-04-03T17:35:00.000+01:00

Mark Ho's Artistic Metalwork is astounding. He learned his metalwork like I did, working around craftmen who moved and shaped metal.

His current creation looks incredible.

2006-03-12T08:03:00.000Z

It is snowing in Paisley today.

It is Sunday, so I am not sure if tomorrow will be a snow day - instead of a work day.

2006-03-08T19:29:00.000Z

I have been waiting for the arrival of the Google Calendar for a very long time. These screenshots are the first ones leaked.

2006-03-08T10:45:00.000Z

Today, I have a couple good Bike Make projects.

The first one is a 500 Lumen BIKE LIGHT for around 10 bucks and the second one is SpokePOV (a Persistence of Vision Mod for your Bike).

2006-03-06T11:01:00.001Z

A new SNL Digital Short on YouTube.

Starring Natalie Portman, it is probably better than Lazy Sunday - Chronic,les of Narnia.

2006-03-06T11:01:00.000Z

A new SNL Digital Short on YouTube.

Starring Natalie Portman, it is probably better than Lazy Sunday - Chronic,les of Narnia.

2006-03-05T13:53:00.000Z

Make a Bicycle Parts Belt.

Better than huge cowboy belt buckle.

2006-03-01T14:41:00.000Z

My pal MrBen is documenting his Lent this year.

I decided to do something Lent-ish this year, in the same vein of other Lent-esque things I have done in the past. It is more an attempt to remove my dependency on things in my life (ie. a watch, glasses, etc).

This time it is my iPod.

I have been using it quite intensively to listen to Techblogs and IT podcasts and it occasionally is colliding with other things I want to do.

I am hoping not having the iPod will push the studying for the certifications (one of the things that conflicted with listening to Podcasts).

I am not doing all 40 days - instead I plan on doing a Spurlock Lent period and only do the 30. So March 31st, I will get my iPod returned to me and I will have a lot of podcasts to catch up on.

2006-02-25T08:06:00.000Z

This Pot growing setup is very impressive.

2006-02-20T14:34:00.000Z

Who says I am difficult to buy for?

This seems to be the perfect birthday gift.

2006-02-12T08:34:00.000Z

Paper compression techniques

How do you save a a ton of shipping weight transporting soldiers letters back home? Put the letters onto microfilm and then reprint them when they arrive back in North America.

2006-02-02T14:59:00.000Z

Something a Flux Capacitor cannot solve.

It is Brokeback to the Future

Similar to the The Shining Trailer remake that came out recently.

2006-02-02T09:40:00.000Z

Amazon.co.uk: IEE Wiring Regulations: BS7671, 2001 Incorporating Amendments No. 1 & 2, 2004: Books

I have always turned to this book for inspiration and reflection. It is good to see that others feel the same way about this book that defines the the current genre of British Standards.

I am just waiting for it to appear on Oprah's Book Club.

2006-01-14T08:41:00.000Z

This google page is a quick way to get any site on a mobile device.

2006-01-14T08:39:00.000Z

Nextbrick

A great resource for those who remember those wonderful little swedish blocks of joy. I would not spend my entire life collecting or building with them but it is interesting to gaze upon those who do.

2006-01-13T14:05:00.000Z

Combine a Crazy Screaming Lady, a parking lot and a kid with a video camera and hilarity ensues.

2006-01-12T14:33:00.000Z

BTW, I am looking for a new UK Broadband supplier. Zen are good but expensive for limited speed. Any suggestions are welcome.

2006-01-12T14:26:00.000Z

The long awaited announcement of the intel based powerbook were announced this week(I have been hearing rumours of an intel apple for over a decade now).

I heard one disgruntled apple owner complain of a lack of PCMCIA slot. Apple has chosen the new ExpressCard standard. It will deter some people with expensive PCMCIA cards in moving up, but I doubt it will make much of an impact. Apple is famous to being on the front of the curve and more aggressive in adopting new standard physical formats from the 3.5 floppy in the Apple Plus to USB in the iMac. They have occasionally been proven wrong in their choices eg NuBus over ISA. But for the most part they have been on the right trail when everyone else comes over.

So ExpressCard looks like a winner format for physical hardware card expansion.

2006-01-12T14:20:00.000Z

I cycled in a wet cold sleet storm yesterday. It definitely showed the improvements I need to make in the bike and my clothing. I don't think that the bad weather will have cleared up by the time I start commuting at the end of March. So, some mudguards and decent layered clothing may be needed to a make my trip into work a reasonable trip as opposed to the frostbite conditions I had yesterday.

2006-01-12T14:16:00.000Z

Slate have posted the best hack for those milky coffees that are just lactose wastelands.

The short cappucino (8 oz) actually tastes like a decent coffee. If you prefer to order the venti or tall version, then save your money and buy a quart of milk and chuck it in the microwave (for those into wilderness hacks, try just leaving it in the sun).

2006-01-03T09:09:00.000Z

So, I have started the New Year eating roots and and drinking weeds.

Liz has decided that we need to detox, despite the fact that we normally eat vegetarian meals. Yesterday I bought a load of fruit and veg (with most of the fruit out of season) and today I started on the juice and herb teas.

I have experienced the physical effects of caffeine withdrawal and it was not pleasant the last time. I will probably need leads of calcium and selenium to deal with the muscle cramps. No pain killers though on this detox, so it may get interesting.

2005-12-26T12:34:00.000Z

More web based games than is humanly possible to play (all of them rated).

2005-12-22T10:23:00.000Z

The GeekPod 100 from BatteryGeek.net provides 100 hours of iPod goodness.

Only problem is the foreign charger - so I am hoping for a UK version at some point.

Edit - Further to Michael Harrison's comments about Batterygeek. I have started to think that a homemade solution maybe a better way to battery power the iPod.

The solutions offered by Drew Perry and Chris Diclerico (Verson2 and Version3 seems a reasonable way to approach this.

The 8 hours seems a reasonable amount of time to get the iPod back to a power source and extra batteries could always be carried.

2005-12-19T10:09:00.000Z

Sustrans Brochures for the West Coast of Scotland Cyclepaths (all pdfs, so download these links).

Clyde and Loch Lomond Cycleway (NCN 7)
Glasgow to Loch Lomond mainly traffic-free path for cyclists and walkers 20 mls

Lochwinnoch Loop Line (NCN 7)
Paisley to Kilbirnie mainly traffic-free path for cyclists and walkers 14 mls

Hillend Loch Railway Path (NCN 75)
Airdrie to Bathgate mainly traffic-free path for cyclists and walkers 14 mls

Paisley and Clyde Railway Path (NCN 75)
Paisley to Gourock mainly traffic-free path for cyclists and walkers 20 mls

Garnock Valley Cycleway (NCN 7)
Irvine to Kilbirnie 18 mls

Ayrshire Coast Cycleway (NCN 7)
Irvine to Ayr traffic-free route for cyclists and walkers 19 mls

Cunninghame Cycleway (NCN 73)
Kilmarnock to Ardrossan traffic free path for walkers and cyclists 17 mls

Clyde Corridor Cycle Route (NCN 75)
Heart of Glasgow to Uddingston traffic-free walking and cycling route 12 mls

edit one more from the East Coast -
The Esk Valley Cycle Route
Musselburgh to Dalkeith largely traffic-free route 5 mls

2005-12-19T06:48:00.000Z

Perfect for giving this Christmas.

What says love more than handcrafted Duct Tape Wallet.

You can use Gaffer Tape which I find comes in prettier colours than duct tape, has better adhesive qaulities, sticks when it gets cold and stays stuck, and comes off with no adhesive residue (also it does does not remove paint when you remove it). Gaffer Tape comes in more sizes at well from 1" to 4" rolls (the latter is great for sticking cables to carpets).

The alternative Duct Tape cover for a HipsterPDA could also be considered the perfect gift.

edit - more great ideas for the that great tape called Gaffer.

MrLithic

CISSP Prep Resources

Contents