Hard to believe, but get a load of BT Irelands policy on DNS changes…

1. Fax a request into them on company headed paper (“for security, don’t you know?!”)
2. Wait for 24 hours (“we only reload our DNS twice a day”).

In fact they are so protective of their DNS servers that they will not break their 2-reloads-a-day rule even in cases where they have made a mistake.

Exercise for the reader:

Figure out how to spoof a DNS change request to BT Ireland using nothing but a PC, a screen grabber and an Internet connection (you shouldn’t even need a physical fax machine).

The ultimate irony: Security guru Bruce Schneier is the Chief Security Technology Officer for BT (but I bet he doesn’t know about the fax-on-headed-paper security initiative)!

Update on getting stale DNS entries removed:

Four days! After becoming frustrated with tech support drones, I had to escalate it to the complaints department.

Delivery and packaging

I opted for the self-install option which is delivered by courier in a large jiffy envelope. Inside was an Imagine banded Motorola Wi-Max unit, a telephone handset adapter and a network cable.

The box itself is about the size of a hard-back novel (think a John Grisham airport edition), with a small swivel foot on the base to facilitate standing the device upright. It feels solid and well built. All antennae are internal, and there a series of four green LEDs on the front to show Wi-Max signal strength and one for Wi-Fi operation.

Connectivity: 1 x RJ-54 (Ethernet), 2 x Telecom (RJ-11), Wi-Fi. Disappointingly there is no hub built into the device.

Initial Set-up

Plug in and go (almost). According to the manual, as long as you have two of four signal strength LEDs lit, you are good to go. I had four, so I cannot comment on what performance would be like in marginally serviced areas.

Once up and running you plug in your PC (using the supplied network cable), open a web browser and you are automatically redirected to a set-up screen. From there you go through a series of five screens to confirm your PIN number (supplied by Imagine) and confirm your email address and activate the service. After that you are set up for Internet access. There is an additional step to activate and secure the Wi-Fi connection.

Annoyingly, the device kept dropping its’ Internet connection during the browser set-up phase and I was forced to start again from step 1. It took me several attempts to get through this step. This is a major irritation – I am in an area of high signal strength, so if you live in a marginally serviced area this step might get very frustrating.

Wi-Fi set-up was painless – just pick an SSID, a Wi-Fi radio channel and add a security password/key. However the limited access that Imagine give you to the device doesn’t really allow you to make a mistake here (See LAN Set-up).

Once I was through the set-up the device settled down and I was getting 7.5MB down and 0.5MB up with ping times of about 100ms. I’ll do a more rigorous test of this later.

I did not have a telephone handset to try out the VoIP service.

LAN Set-up

This is a major disappointment – if you want to customise anything for your local network, well, you just can’t. This includes setting your LAN network subnet (set to 192.168.15.x with no indication of what subnet mask is in use), port-forwarding, DMZ set-up, DHCP server settings.

I queried this with Imagine technical support and received two conflicting responses:

Access to the control panel and other features is restricted as changing some of these settings can cause the Wimax unit to cease functioning correctly.

and

There is proprietary technology there that we can’t let you see…

In my opinion both of these statements smell of bullshit – look at this review of Wi-Max and you can see screen shots of the Motorola browser interface.

What concerns me is that I see screen shots in that review for things like uPnP, firewall, enabling administrator access to the device  (“Enable web login from Internet”) and port forwarding, but no indication from Imagine as to what the default settings are.

The rather idiotic response from Imagine is:

If you wish any ports forwarded please contact us either via email or phone and we can arrange that.

Seeing as you have very basic access to your own LAN using Imagine Wi-Max, this raises questions of liability if your network is compromised – especially in light of recent legal news over the “three strikes” agreement between Eircom and IMRA.

From a privacy and security standpoint there is no way of knowing what access to your LAN Imagine have given themselves.

Initial Conclusion

For a home user Imagine Wi-Max shows great promise. However the retarded attitude Imagine have towards the control panel, and the uncertain security set-up, make this of little use to the business or the technical user.

To be fair calling it a vulnerability is being overly generous – the method used to generate the passwords was totally flawed. I would expect more from a 16 year old script kiddie with a Corn Flakes packet code wheel.

As an academic exercise and to publicise the vulnerability we converted some Perl scripts to PHP and published them to our web site. Believe it or not, almost four years hence, there are still a load of routers that are vulnerable. You can even get an iPhone app for it!

If you suspect you are affected, then follow the link below and see if we can deduce your password. If you are affected contact us and we will be happy to help. You can also find DIY instructions on how to secure your Netopia router here.

Go to the Eircom WEP password cracker page here.

Did you know:

Eurolinux collected over 400,000 signatures supporting a petition for a software patent-free Europe

• That petition has now expired and they need your support
• Our own EU-Commissioner, Charlie McCreevy, is completely misinformed about software patents
• The EU-Commission is now obliged (post-Lisbon) to present a legislative proposal when a critical mass of citizens demands it

I strongly urge you to read on and see what the EU patent office is approving – your support is needed.

Read about it here…

Again and again get a very similar request:

Can you move/fix/migrate/upgrade our web site please?

… and every time I get a similar reason for the request:

There was a bloke who used to look after us, but he’s gone now…

This is (un)commonly known as SFO Syndrome – Supplier Fecked Off!

Cleaning up after SFO is a service we regularly perform for clients, and sometimes it is quite shocking to see the mess that a previous supplier has left behind. (I am often led to muse that the provider may have disappeared because they may have realised that the game was up!) I have written before about this (see ‘Open Source and Open Standards’) but it is worth restating:

If a quote is to good to be true, then it usually is!

This applies to all aspects of you IT project, not just coding and design of a web site. We have seen people invest reasonable amounts of time and effort to implement an online presence only to ruin it all by choosing a cheap and nasty web hosting provider.

If the provider is selling you a hosted solution, then watch out.

Not that there is anything wrong with them (I am a big fan of GMail), but very few companies have the infrastructure that Google has, and hosting is something that must be done right.

You should also ask the question, what happens to my hosted solution if the host goes out of business? Do I have access to my data? Who owns the code?

We use our own solution based on [insert proprietary solution here]

All our greatest successes in fixing/moving an hospitalised/hacked/broken/out of date application came about because it was based on open standards and/or open source software. The minute you go the proprietary route, you run the risk of being involved with a one person show.

Ask about support

What happens when the web site goes down? Remember, nothing is 100% perfect. Support is critical. Ironically, you may not notice this as much – after all support is generally most needed when something goes wrong, so if all is running well, you may well ask yourself why you need your support contract at all.

However support is more important that just fixing problems. Make sure that preventative maintenance is included in your support contract. All software has bugs, and bugs get discovered all the time. It is how they are managed that makes the difference.

We stand over everything we do, make sure your supplier does…

So, watch out – there’s Muppets about!

I am not fond of Joomla, but that is my personal opinion and don’t let it colour yours. As a programmer I find it heavyweight and overly complex. Lots and lots of code means frequent discoveries of bugs and frequent updates. As my friend Alan Kennedy says “every line of code is a liability” and he is spot on. However we aren’t all programmers and for someone who wants an “out of the box” experience Joomla may well fit the bill. Personally I prefer the excellent Wordpress – it may be a ‘only’ a blog system, but it is fantastic for static web sites too and uses a much simpler database schema, although it doesn’t have the extended functionality of Joomla.

Open Standards – your data, your way

Where am I going with all this? Well what happens when the person you used to create your web site disappears, or when you just want to migrate? If you are stuck into a commercial, closed source and/or proprietary model, you are at the mercy of whatever commercial provider will take you on. If, on the other hand, you are using open standards, then at the very least you have access to all the code and data in your web site.

Recently that is exactly what happened to a client. To make matters worst, his web hosting company had suspended his account because the Joomla installation he was using was old and insecure and had been exploited. We had no access to the old server. What he did have was a backup of his web server directory structure and his database content.

We were able to recreate the exploited and insecure web site on a private/firewalled server and then patch the Joomla installation to an up to date version. Once that was done we could migrate the whole lot to his new server. The complete process took several hours and was only possible because web site was stored in a non-proprietary format.

I’ve been an Open Source advocate for a long time now, but people tend to miss the point of Open Standards. Some more examples:

Microsoft and their new DOCX format.

I’m all for innovation but not for obfuscation. What Microsoft did when they introduced their new format was pretty low.

Notwithstanding the fact that we don’t really need a new document standard (there are several mature open standards out there already), Microsoft made the new format the default file format when you save documents in Office 2007. They then decided to offer free, time-limited demo versions of Office which various PC manufactures started to bundle onto cheap machines as part of the pre-installed crapware that comes on most new PCs.

The real problem happens when the time-limit for your Office demo runs out after 60 days. If you choose not to pay, you can open and view your documents, but there is no simple (and I mean simple for an average user) way to print, copy & paste content or save your document in an alternative format once your demo period expires. I have met plenty of bright people (they aren’t geeks, but you don’t need to be a mechanical engineer to drive a car, do you?) who have been bitten by this.

Solution: Avoid the DOCX format – use RTF, an older Office DOC format or even ditch Office altogether and go for the free and Open Source/Open Standards OpenOffice instead.

Novell Groupwise

I cut my networking teeth with Novell Netware. Groupwise is an email and collaboration system that comes bundled with the Small Business Editions of Novell Netware.

There was (and I don’t know if this has changed) no Novell supported way to migrate from Groupwise to another email system and keep your sent items (and I’m talking about an Open Standard like IMAP here). There were various third party tools available at the time I came across this issue, but there shouldn’t be a need for them – POP and IMAP were allegedly supported in Groupwise. In the end the decision was made just to dump the sent items and learn a valuable lesson about proprietary formats.

The client now uses IMAP to access email on a Linux server and they have since migrated their email server twice and nobody even noticed (apart from the fact that email became more responsive each time).

So buyer beware, Open Standards mean something. They mean your data remains yours and you can never be blackmailed into paying to have access to your own data.

One pleasant surprise was how modern browsers behave with standards compliant HTML and CSS (as long as you don’t get too funky with your layout).

I remember my last foray into HTML and CSS… it would have been several years ago now and I was delighted to leave it behind. I’m an engineer and I understand technical specifications. Specs are good – they specify how something should behave, you follow them and voila, job done! That’s grand until you consider the browser.

Now a web page is just some plain text, including some HTML codes telling you (really your browser) how to style and position the text, images and whatever else is on the web page. It is up to the browser to actually do the positioning and styling and to present you with the web page as the designer intended. And herein lies the problem… browser support for CSS is pretty poor and browsers have bugs in how they render your page, sometimes catastrophic.

There is no greater frustration than killing yourself to get your web page looking perfect in Mozilla Firefox, only to find out that you’ve found one of the many browser bugs that would cause your page to fall over in Internet Explorer. You fix it in Internet Explorer and Safari throws a wobbly… fix it there and… you get the idea!

Things have improved lately and browser support for CSS has improved beyond belief… however only really if you stick to CSS2.1 – a 6 year old standard! CSS3, which will allow designers do all sorts of cool stuff, is around 3 years now as a working draft, but you can forget about relying on it for a while yet! Lots left for the browser companies to do yet.

It was a pleasant surprise that this web site template was so easy to put together. I’m using no browser hacks, everything is in CSS (unless it is generated by code) and it all worked first time (even IE6). I’ll still be leaving the HTML to others in general, but it is great to see how things have changed for the better for people.

An added benefit is that you don’t have to worry about text readers, small screen devices like mobile telephones and even text based browsers – it all degrades the way it should. (If you don’t believe me, try using Ctrl+ and Ctrl- to resize this page, or try switching off your stylesheet View Menu -> Page Style -> No Style in Mozilla Firefox and see what this page looks like.)

Essential tools:

• PSPad – A general purpose editor. Does a lovely job syntax highlighting your code – making sure you close all those tags and keep your HTML and CSS compliant.
• TopStyle – I still use the lite version of this software (shame on me I know). If you only need simple CSS editing I highly recommend it. If you need something more heavyweight, do check out the demo of the full version.
• Browsers – All of them! Check your layout in as many browsers as you can.

And some handy links:

• W3C – the HTML and CSS standards people. Make sure your pages pass the CSS Validation Service and the Markup Validation Service or you’ll be chasing your tail forever trying to get your page to work.
• A List Apart – A superb collection of articles, tutorials and resources for web designers. This is where you’ll get lots of help and information.
• glish.com – ‘CSS Layout Techniques: for Fun and Profit’ or ‘Look Ma, No Tables’. This is a great starting place for those looking to understand CSS layouts.
• Eric Meyer’s CSS pages – some excellent positioning and CSS effects demonstrations.

And finally, to be avoided:

• Dreamweaver – the work of the devil… unless you happen to RTFM and actually learn how the package works. Unfortunately too many people just dive straight in without considering what all that WISYWIG functionality is doing to your HTML and CSS code. You’d be better off spending the time to look at the CSS resources above and actually understanding what is going on rather than point-and-click and hope-for-the-best.