SFF Net Newsgroup Archive
sff.discuss.heinlein-forum

Index of Articles for this Newsgroup

 [3-2503]    [2504-3255]    [3256-3756]    [3757-4956]    [4957-5560]    [5561-6211]    [6212-6540]   
 [6541-6821]    [6822-7179]    [7180-7403]    [7404-7884]    [7885-8133]    [8134-8404]    [8405-8634]   
 [8635-8704]    [8705-9004]    [9005-9434]    [9435-9687]    [9688-9766]    [9767-10157]    [10159-10298]   
 [10299-10451]    [10452-10801]    [10802-11023]    [11024-11316]    [11317-11554]    [11555-11772]    [11773-12112]   
 [12113-12294]    [12295-12386]    [12387-12459]    [12460-12540]    [12541-12597]    [12598-12751]    [12752-12789]   
 [12791-13027]    [13028-13277]    [13278-13413]    [13414-13571]    [13572-13579]    [13581-13621]    [13623-14127]   
 [14128-14563]    [14564-14947]    [14948-15129]    [15130-15187]    [15188-15294]    [15295-15642]    [15643-15840]   
 [15841-16230]    [16231-16608]    [16609-16645]    [16647-17506]    [17507-18252]    [18253-18468]    [18469-18614]   
 [18615-18889]    [18890-19019]    [19020-19147]    [19020-19413]    [19414-19417]    [19418-19454]    [19456-20203]   
 [20204-20236]    [20238-20581]    [20582-20675]    [20676-20691]    [20692-20729]    [20730-20781]    [20782-20877]   
 [20878-20929]    [20930-21011]    [21012-21035]    [21036-21058]    [21059-21086]    [21087-21106]    [21107-21118]   
 [21119-21137]    [21138-21281]    [21282-21374]    [21375-21486]    [21487-21558]    [21559-21587]    [21588-21634]   
 [21635-21692]    [21693-21713]    [21714-21739]    [21740-21784]    [21785-21811]    [21812-21834]    [21835-21897]   
 [21898-21920]    [21921-21950]    [21951-21981]    [21982-21988]    [21989-22009]    [22010-22029]    [22030-22044]   
 [22045-22049]    [22050-22086]    [22087-22492]    [22493-22536]    [22537-22574]    [22575-22595]    [22596-22618]   
 [22619-22657]    [22658-22708]    [22709-22759]    [22760-22779]    [22780-22809]    [22810-22863]    [22864-23010]   
 [23011-23067]    [23068-23083]    [23084-23109]    [23110-23127]    [23128-23138]    [23139-23172]    [23173-23247]   
 [23248-23298]    [23299-23312]    [23313-23352]    [23353-23432]    [23433-23451]    [23452-23463]    [23464-23476]   
 [23477-23490]    [23491-23511]    [23512-23525]    [23526-23578]    [23579-23583]    [23584-23608]    [23609-23637]   
 [23638-23648]    [23649-23673]    [23674-23830]    [23831-23856]    [23857-23871]    [23872-23890]    [23891-23907]   
 [23908-24156]    [24157-24194]    [24195-24228]    [24229-24241]    [24242-24252]    [24253-24288]    [24289-24347]   
 [24348-24378]    [5791-5791]   


http://www.sff.net/



Archive of:   sff.discuss.heinlein-forum
Archive desc: The Internet home for the Heinlein Forum
Archived by:  webnews@sff.net
Archive date: Tue, 10 Feb 2004 17:11:59
============================================================

Article 23248
From: David Wright" 
Date: Thu, 18 Dec 2003 08:53:01 -0500
Subject: Re: Privately Funded SpaceShipOne Breaks Sound Barrier
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe14751.0@news.sff.net...
> Almost ready....
>
> They have finally gotten high enough for the X-prize. Now, they just need
to
> do it with three people, and do it again in two weeks. Looks like this one
> might be in the bag.
>
>
http://www.space.com/businesstechnology/technology/rutan_update_031217.html
>
> or
>
> http://shorterlink.com/?6I1S13
>

This quote struck me as being very reminiscent of John Lyle's experiences
when he jumped from the rocket he was piloting to escape from the Prophet's
minions.

" At apogee, SpaceShipOne was in near-weightless conditions, emulating the
characteristics it will later encounter during the planned space flights in
which it will be at zero-g for more than three minutes. "
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23249
From: JT 
Date: Thu, 18 Dec 2003 20:03:52 -0500
Subject: Re: TANSTAAFN...
Newsgroups: sff.discuss.heinlein-forum

On Mon, 15 Dec 2003 20:51:20 -0500, JT <JT@REM0VEsff.net> wrote:

>...otherwise known as There Ain't No Such Thing As A Free Newsgroup.
>
I know it's the Holidays and you are all busy... <G>  For those of you
who didn't act fast enough to be a Patron of the HF in past years,
this is apparently your year.  Pledges in $5 increments still gladly
accepted.  I will definitely post here when we hit $95.

I forgot to mention the benefits.... Helping to keep SFF Net around,
and being listed on the HF Patrons page for a year with whatever kind
of links you want for yourself.  You also get to find out my home
address. ;)  Pledges to J T @ s  f f . n e t .

Happy Happy Merry Merry.

JT

------------------------------------------------------------
Article 23250
From: Bill Dauphin 
Date: Fri, 19 Dec 2003 00:02:55 -0500
Subject: Re: Privately Funded SpaceShipOne Breaks Sound Barrier
Newsgroups: sff.discuss.heinlein-forum

On 12/18/03 1:21 AM, in article 3fe14751.0@news.sff.net, "Filksinger"
<filksinger@earthling.net> wrote:

> Almost ready....
> 
> They have finally gotten high enough for the X-prize.

Would t'were. The X Prize altitude is 100 *km*; SS! has only made it to 68k
*ft* so far. Not surprising, though, as Rutan has always said he'd do it
incrementally. They've got (IMHO) a huge lead on everyone else, and can
afford to take it slow and safe.

> Now, they just need to
> do it with three people, and do it again in two weeks. Looks like this one
> might be in the bag.

Actually, they can carry ballast in place of the "passengers." The rocket
has to be *capable* of carrying 3, but they aren't required to risk 3 actual
lives.

And don't count too many chickens yet: So far, SS1 has been operating as an
experimental aircraft, but for the X Prize flights it'll have to be licensed
as a launch vehicle. So far the FAA has been encouragingly helpful, but the
CATS Prize (which expired unclaimed) pretty well demonstrated that the
regulatory issues are often bigger obstacles than the technical issues.

All that said, I DO think somebody -- probably Rutan -- will win the X Prize
before it expires at the end of 2004.

-JovBill


------------------------------------------------------------
Article 23251
From: Filksinger" 
Date: Fri, 19 Dec 2003 00:53:34 -0800
Subject: Re: Privately Funded SpaceShipOne Breaks Sound Barrier
Newsgroups: sff.discuss.heinlein-forum

Bill Dauphin wrote:
> On 12/18/03 1:21 AM, in article 3fe14751.0@news.sff.net, "Filksinger"
> <filksinger@earthling.net> wrote:
>
> > Almost ready....
> >
> > They have finally gotten high enough for the X-prize.
>
> Would t'were. The X Prize altitude is 100 *km*; SS! has only made it
> to 68k
> *ft* so far. Not surprising, though, as Rutan has always said he'd do
> it incrementally. They've got (IMHO) a huge lead on everyone else,
> and can afford to take it slow and safe.

I forgot to watch the units used. Doh! Good thing real engineers check these
things, or a Mars probe could get lost or something.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23252
From: Filksinger" 
Date: Fri, 19 Dec 2003 00:57:23 -0800
Subject: Man Will Never Fly!
Newsgroups: sff.discuss.heinlein-forum

Sure, you may think the people at www.manwillneverfly.com are joking, or
nutcakes (you'd be right with guess #1), but they did accurately predict the
results of the Kitty Hawk re-enactment:
http://news-observer.com/front/story/3123947p-2828519c.html

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23253
From: Filksinger" 
Date: Fri, 19 Dec 2003 01:16:16 -0800
Subject: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

This one is tricky, folks, and might fool savvy users, or I wouldn't bother
you with it.

There is a new vulnerability in IE, that can be used to spoof almost any
website in a nearly undetectable way. Using it, a web page or HTML-formatted
email can be created that contains a link to any website, but which actually
takes you to any other website (whether the target is involved or not).

You may have received emails telling you to go to some crooked site
pretending to be your ISP and update your credit card, or something equally
crooked. Most of these emails rely on fooling people into thinking that,
say, http://earthlink.creditcardthieves.com is a real Earthlink site. This
one now allows http://myaccount.earthlink.net (the real Earthlink account
page) to be spoofed in a convincing manner.

Say you receive an email from your ISP with a link in it, telling you to
change your credit card number. The link clearly shows the correct page to
change credit card numbers, www.myispcreditcardpage.com, but it actually
takes you to www.creditcardthieves.com. The link will look valid, the lower
left-hand corner of IE's status bar will show it as correct, and, when you
arrive, the address bar will show it as correct.

Keep an eye out.
-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23254
From: William J. Keaton" 
Date: Fri, 19 Dec 2003 12:42:00 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe2c1e7.0@news.sff.net...
> This one is tricky, folks, and might fool savvy users, or I wouldn't
bother
> you with it.
>

Why do you call this an IE vulnerability? Wouldn't this work the same way in
Opera, Mozilla, etc.

This is a social engineering problem, not a vulnerability with IE. While
it's fun to rip Microsoft, this one is browser independent.

WJaKe



------------------------------------------------------------
Article 23255
From: Jeffry Dwight 
Date: 19 Dec 2003 18:58:25 GMT
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

What vulnerability are we talking about? It would make an intelligent reply
easier if we knew that bit of information.

- j.

------------------------------------------------------------
Article 23256
From: MitchW@sff.net (Mitch Wagner)
Date: 19 Dec 2003 19:32:19 GMT
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

We seem to be talking about this vulnerability

IE Flaw Fakes Real Web Sites
http://www.securitypipeline.com/showArticle.jhtml?articleID=16700202

Here's the original alert from a company called Secunia
http://www.secunia.com/advisories/10395/

The vulnerability does indeed appear to be Internet Explorer specific; I
tried it out on Opera and Opera didn't have the problem. 

-- 

Mitch Wagner * +1 (619) 461-4316 * www.InternetWeek.com * www.LinuxPipeline.com
* www.SecurityPipeline.com * http://WagBlog.InternetWeek.com

------------------------------------------------------------
Article 23257
From: Jeffry Dwight 
Date: 19 Dec 2003 19:43:45 GMT
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Oh, that one. It's not new, but seems to be newly-rediscovered.

- j.

------------------------------------------------------------
Article 23258
From: Ed Johnson 
Date: Fri, 19 Dec 2003 14:59:46 -0500
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

Mike:  I am usually a bit slow, so I may have missed something here
<g>.  For copyright infringements, I didn't know there was a fee.
Often authors allows a minimal amount of copying for students,
scholarly articles, etc.  Most software is professionally copied and
then packaged for commercial sale.  The owner of the intellectual
property then gets paid a royalty for each copy sold.  Is there some
other system that I am missing here?
   "Inquiring minds want to know" (tabloid by-line <G>)

Ed J

On Sun, 14 Dec 2003 19:27:19 -0600, Mike Cothran
<cothranm@bellsouth.net> wrote:

>Ed Johnson wrote:
>
>>   JT:
>>     I have burned many, many CD's for work.  I was wondering if you
>> needed some special     right     to     copy     a DVD? ;-)
>> The same idea applies for videogames, I guess.  I don't mean to
>> sound like a the digital-era thought-police.  I just remember about
>> 8 years ago being chided by HF cobbers for copying software without
>> recompense going to the SW authors.  I have learned my lesson by
>> listening to TomStaafl and bytor lecture on intellectual property.
>
>Well, Ed, yes, there is a need to purchase the right, a bit hard to do for
>most common folks. I recommend an escrow account, place twice the value
>into that account for all infractions, pass on half when you can buy the
>rights, let the other half accumulate for a bailbondsman's fee...


------------------------------------------------------------
Article 23259
From: Ed Johnson 
Date: Fri, 19 Dec 2003 15:02:15 -0500
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

Catherine:
    Do you feel the same way about Star Trek TNG as you do about
TOS?  The old 1960's `Trek was OK for it's time (IMHO) but doesn't
compare to some of today's fiction.

Ed J

On Mon, 15 Dec 2003 14:26:20 -0800, Catherine Hampton
<spamtrap@spambouncer.org> wrote:

>On Sun, 14 Dec 2003 10:07:43 GMT, debrule@dahoudek.com (Deb Houdek
>Rule) wrote:
>
>>  Has anyone here seen the tv series "Firefly"? I've been running
>>across mentions of it, and the reviews on Amazon are glowing,
>
>I'm not much of a TV watcher (don't own a TV, never have), but I've
>seen three episodes of Firefly.  (The guy I'm dating is a fan, made me
>watch some episodes.)  It is quite good, intelligent, witty, well
>written, and unlike anything I'd ever seen before. I wouldn't compare
>it to any Star Trek, but that's because I think it's quite a bit
>better than any episode of Star Trek I ever saw. (Even "The Trouble
>with Tribbles", which was fun.) ;>


------------------------------------------------------------
Article 23260
From: Ed Johnson 
Date: Fri, 19 Dec 2003 15:05:17 -0500
Subject: Re: What? No comments on Saddam?
Newsgroups: sff.discuss.heinlein-forum

WJake:     I'd heard that when the rat was cornered in his hole, he
said, in English: "I am Saddam Hussein, the president of Iraq"
(OWTTE).  His captors were reported to have replied: President Bush
sends his regards. <G>
   I loved it!  I haven't seen it confirmed yet, tho.

Ed J

On Sun, 14 Dec 2003 23:09:04 -0500, "William J. Keaton"
<wjake@prodigy.net> wrote:

>Well, I'm suprised we have gone this long without comment onthe capture of
>Saddam Hussein. Cowering like a rat in his little hidey-hole, gun in hand,
>but he didn't try to use it. What a wimp! <g>
>
>So, how will things go in Iraq now?
>
>WJaKe
>


------------------------------------------------------------
Article 23261
From: Ed Johnson 
Date: Fri, 19 Dec 2003 15:13:26 -0500
Subject: Re: Vroooooooooom!!!
Newsgroups: sff.discuss.heinlein-forum

Bill:
   Thanks for this link.  Way Cool!

Ed J
On Wed, 17 Dec 2003 17:35:49 -0500, Bill Dauphin
<dauphinb@ix.netcom.com> wrote:

>Well, the Wright Flyer replica got bogged down in the mud, but I know this
>will warm the cockles of more than one HF heart:
>
>http://www.hobbyspace.com/Links/RLVNews.html
>
>Want somethin' done, get Burt!
>
>-JovBill


------------------------------------------------------------
Article 23262
From: David Wright" 
Date: Fri, 19 Dec 2003 15:04:26 -0500
Subject: Re: What? No comments on Saddam?
Newsgroups: sff.discuss.heinlein-forum


"Ed Johnson" <eljohn2@comcast.spamthis.net > wrote in message
news:5bm6uvs0s39eno6gon9480pbh75uo7fltp@4ax.com...
> WJake:     I'd heard that when the rat was cornered in his hole, he
> said, in English: "I am Saddam Hussein, the president of Iraq"
> (OWTTE).  His captors were reported to have replied: President Bush
> sends his regards. <G>
>    I loved it!  I haven't seen it confirmed yet, tho.
>

In an news interview on one of the major channels, one of the soldiers who
captured him did indeed say that they had said those words to Saddam.
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23263
From: debrule@dahoudek.com (Deb Houdek Rule)
Date: Fri, 19 Dec 2003 20:17:29 GMT
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

>I watched every aired episode, cried when it was cancelled, signed email 
>petitions to keep it going, bought the DVD the day it came out so maybe 
>I'm biased ;-)

  Being the Joss Whedon/Buffy/Angel fan that you are, imagine what it
would say if you _didn't_ like "Firefly"? ;-)  Biased works. Thanks
for the recommendation.


Deb Houdek Rule
http://www.dahoudek.com
http://www.civilwarstlouis.com
http://www.robertaheinlein.com
http://www.heinleinsociety.org
http://www.heinleinprize.com

------------------------------------------------------------
Article 23264
From: debrule@dahoudek.com (Deb Houdek Rule)
Date: Fri, 19 Dec 2003 20:17:29 GMT
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

>It needed a couple
>years to develop the full back story and flesh out both characters and the
>universe.

  Sounds like it has the Joss Whedon signature style of having a huge
amount of background developed that dribbles in over time, but you
know it's there all the time and are just waiting to discover it. 

>Is it worth buying?  I'd like to see it without interruption again, but to
>pay full DVD price ...

  I'm leaning toward it, based on the reviews here. Hard to find good,
new TV shows, and this one I missed entirely because it ran on a
network I don't get paid to watch (this is why tv people can't take
part in the Neilsons, we are totally biased in our viewing habits).
Not too expensive, Firefly is about $35 for the whole series where one
season of Star Trek: TNG runs about $100 (even the bad seasons) and
Babylon 5 is about $75 per season. 


Deb Houdek Rule
http://www.dahoudek.com
http://www.civilwarstlouis.com
http://www.robertaheinlein.com
http://www.heinleinsociety.org
http://www.heinleinprize.com

------------------------------------------------------------
Article 23265
From: debrule@dahoudek.com (Deb Houdek Rule)
Date: Fri, 19 Dec 2003 20:17:30 GMT
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum


>I hope that one of the packages under my little tree is "Firefly". I can't
>wait to watch the series as Joss Wheddon intended it.

  That's a good recommendation. 

  We saw Angel and Buffy largely out of order, too, but just because
we came in in the middle. Watching in order off the DVDs made it clear
how amazingly well-crafted the storylines, and characters were--some
major plot hints dropped in years before the payoff, very rare in tv
story development, yet made for a very rich scenario. 


Deb Houdek Rule
http://www.dahoudek.com
http://www.civilwarstlouis.com
http://www.robertaheinlein.com
http://www.heinleinsociety.org
http://www.heinleinprize.com

------------------------------------------------------------
Article 23266
From: debrule@dahoudek.com (Deb Houdek Rule)
Date: Fri, 19 Dec 2003 20:17:30 GMT
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

>I wouldn't compare
>it to any Star Trek, but that's because I think it's quite a bit
>better than any episode of Star Trek I ever saw.

  Wow. Sounds like a good recommendation, thanks.


Deb Houdek Rule
http://www.dahoudek.com
http://www.civilwarstlouis.com
http://www.robertaheinlein.com
http://www.heinleinsociety.org
http://www.heinleinprize.com

------------------------------------------------------------
Article 23267
From: debrule@dahoudek.com (Deb Houdek Rule)
Date: Fri, 19 Dec 2003 20:17:30 GMT
Subject: Re: What? No comments on Saddam?
Newsgroups: sff.discuss.heinlein-forum

>Well, I'm suprised we have gone this long without comment onthe capture of
>Saddam Hussein. Cowering like a rat in his little hidey-hole, gun in hand,
>but he didn't try to use it. What a wimp! <g>

  It was a clever hiding place, but the Heinleiner in me immediately
saw the obvious flaw--no back door. 

  Must be quite stunning to have climbed so high then have it all be
gone so quickly--the power, wealth, country, sons... all gone. Not
that it wasn't deserved, but who wouldn't look a bit dazed?

  One of the first questions he was asked was about Capt. Scott
Speicher. No answer, sadly, but at least our people still have
Speicher high on their list of those to hunt for.


Deb Houdek Rule
http://www.dahoudek.com
http://www.civilwarstlouis.com
http://www.robertaheinlein.com
http://www.heinleinsociety.org
http://www.heinleinprize.com

------------------------------------------------------------
Article 23268
From: Filksinger" 
Date: Fri, 19 Dec 2003 12:16:36 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Part of my previous message went missing, so I am including links in this
one. In addition, I have attached an HTML file which, if opened in IE, will
demonstrate the problem. When you look at the included link, put your mouse
on it and check the lower left corner of your IE window, then click on it.

William J. Keaton wrote:
> "Filksinger" <filksinger@earthling.net> wrote in message
> news:3fe2c1e7.0@news.sff.net...
> > This one is tricky, folks, and might fool savvy users, or I
> > wouldn't bother you with it.
> >
>
> Why do you call this an IE vulnerability? Wouldn't this work the same
> way in Opera, Mozilla, etc.

No, you misunderstand. It is a strictly IE vulnerability. I apparently cut
and pasted away my links on this, so here are a couple:

http://support.microsoft.com/?id=833786

http://www.informationweek.com/story/showArticle.jhtml?articleID=16700218

> This is a social engineering problem, not a vulnerability with IE.
> While it's fun to rip Microsoft, this one is browser independent.

You misunderstand.

Lets suppose you get an email, telling you that your Earthlink account
credit card has expired, and telling you to go to a link that pretends to be
an Earthlink link, but isn't. You ignore it, or report it, but, if you are
smart, you don't follow the instructions. This can be done with any browser
and any email client.

OTOH, suppose you receive an email that is, in all ways, exactly a copy of
the email that Earthlink would send if there was a problem with your credit
card. In fact, it has a link that sends you to the _correct_ site. The link
is correct, your browser tells you it really is a link to the correct site,
and, if you click on it, your browser tells you that it _is_ the correct
site.

If you received such an email, telling you to go to the correct site, and
the link appeared _in all ways_ to be exactly the correct link, then even a
savvy Internet user can be suckered.

This cannot be done just by creating a fake link. This requires a specific
vulnerability.


-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined


begin 666 spoof.html
M/&AT;6P^#0H@(" @/' ^/&$@:')E9CTB:'1T<#HO+W=W=RYM:6-R;W-O9G0N
M8V]M`24P,$!H;VUE+FUI;F1S<')I;F<N8V]M+WYF:6QK<VEN9V5R+R(@=&%R
M9V5T/2)?8FQA;FLB/CQS=')O;F<^(&AT=' Z+R]W=W<N;6EC<F]S;V9T+F-O
=;2\\+W-T<F]N9SX\+V$^/"]P/B -"CPO:'1M;#X`
`
end


------------------------------------------------------------
Article 23269
From: Ed Johnson 
Date: Fri, 19 Dec 2003 15:18:57 -0500
Subject: Re: Privately Funded SpaceShipOne Breaks Sound Barrier
Newsgroups: sff.discuss.heinlein-forum

On Fri, 19 Dec 2003 00:53:34 -0800, "Filksinger"
<filksinger@earthling.net> wrote:

>
>I forgot to watch the units used. Doh! Good thing real engineers check these
>things, or a Mars probe could get lost or something.
   - Ouch! -   You really know how to hurt those Engineers. <g>.
   Maybe if the US was had gotten serious about converting to Metric
thirty years ago, there would be one less lost Mars robot explorer
(IMHO).

Ed J


------------------------------------------------------------
Article 23270
From: Filksinger" 
Date: Fri, 19 Dec 2003 12:22:47 -0800
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

Deb Houdek Rule wrote:
>   Has anyone here seen the tv series "Firefly"? I've been running
> across mentions of it, and the reviews on Amazon are glowing,
> comparing it to Star Trek: TOS only better. It's by Joss Whedon of
> "Buffy the Vampire Slayer" and "Angel", so I know the writing will be
> first rate, but I'm hesitant to buy the DVDs of an entire tv series
> when I have never seen any of it (couldn't find it to rent).
>
>   Any recommendations or comments on "Firefly"?

Well, it was presented badly, which hurt it. Because of that I didn't take
to it right away. Next, there was the scene where they put a rifle inside a
vacuum suit so it would work in space. I hate bad science. Lastly, there was
the discovery that Joss hadn't even worked out whether or not their ship was
faster than light, apparently initially assuming that all the planets in the
series were in one solar system, then later assuming a globular cluster
apparently so compact that they might not have needed FTL, but so far appart
that all space scenes looked like they were shot from Earth.

However, those are _my_ buttons. The writing and acting were good, and it
was a good story line. I don't know what I would have thought of it in the
long run.
-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23271
From: David Wright" 
Date: Fri, 19 Dec 2003 15:25:24 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe35cc2.0@news.sff.net...
Part of my previous message went missing, so I am including links in this
one. In addition, I have attached an HTML file which, if opened in IE, will
demonstrate the problem. When you look at the included link, put your mouse
on it and check the lower left corner of your IE window, then click on it.

William J. Keaton wrote:
> "Filksinger" <filksinger@earthling.net> wrote in message
> news:3fe2c1e7.0@news.sff.net...
> > This one is tricky, folks, and might fool savvy users, or I
> > wouldn't bother you with it.
> >
>
> Why do you call this an IE vulnerability? Wouldn't this work the same
> way in Opera, Mozilla, etc.

No, you misunderstand. It is a strictly IE vulnerability. I apparently cut
and pasted away my links on this, so here are a couple:

http://support.microsoft.com/?id=833786

http://www.informationweek.com/story/showArticle.jhtml?articleID=16700218

> This is a social engineering problem, not a vulnerability with IE.
> While it's fun to rip Microsoft, this one is browser independent.

You misunderstand.

Lets suppose you get an email, telling you that your Earthlink account
credit card has expired, and telling you to go to a link that pretends to be
an Earthlink link, but isn't. You ignore it, or report it, but, if you are
smart, you don't follow the instructions. This can be done with any browser
and any email client.

OTOH, suppose you receive an email that is, in all ways, exactly a copy of
the email that Earthlink would send if there was a problem with your credit
card. In fact, it has a link that sends you to the _correct_ site. The link
is correct, your browser tells you it really is a link to the correct site,
and, if you click on it, your browser tells you that it _is_ the correct
site.

If you received such an email, telling you to go to the correct site, and
the link appeared _in all ways_ to be exactly the correct link, then even a
savvy Internet user can be suckered.

This cannot be done just by creating a fake link. This requires a specific
vulnerability.

I am assuming that in the example HTML file you gave us, the intent was to
show one link and re-direct instead to your site. If this is indeed what it
is supposed to do, that's precisely what it did using Netscape 7.1. Is that
not what it was supposed to do? and Yes, it showed http://microsoft.com or
whatever in the bottom of the screen
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23272
From: David Wright" 
Date: Fri, 19 Dec 2003 15:25:45 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe35cc2.0@news.sff.net...
Part of my previous message went missing, so I am including links in this
one. In addition, I have attached an HTML file which, if opened in IE, will
demonstrate the problem. When you look at the included link, put your mouse
on it and check the lower left corner of your IE window, then click on it.

William J. Keaton wrote:
> "Filksinger" <filksinger@earthling.net> wrote in message
> news:3fe2c1e7.0@news.sff.net...
> > This one is tricky, folks, and might fool savvy users, or I
> > wouldn't bother you with it.
> >
>
> Why do you call this an IE vulnerability? Wouldn't this work the same
> way in Opera, Mozilla, etc.

No, you misunderstand. It is a strictly IE vulnerability. I apparently cut
and pasted away my links on this, so here are a couple:

http://support.microsoft.com/?id=833786

http://www.informationweek.com/story/showArticle.jhtml?articleID=16700218

> This is a social engineering problem, not a vulnerability with IE.
> While it's fun to rip Microsoft, this one is browser independent.

You misunderstand.

Lets suppose you get an email, telling you that your Earthlink account
credit card has expired, and telling you to go to a link that pretends to be
an Earthlink link, but isn't. You ignore it, or report it, but, if you are
smart, you don't follow the instructions. This can be done with any browser
and any email client.

OTOH, suppose you receive an email that is, in all ways, exactly a copy of
the email that Earthlink would send if there was a problem with your credit
card. In fact, it has a link that sends you to the _correct_ site. The link
is correct, your browser tells you it really is a link to the correct site,
and, if you click on it, your browser tells you that it _is_ the correct
site.

If you received such an email, telling you to go to the correct site, and
the link appeared _in all ways_ to be exactly the correct link, then even a
savvy Internet user can be suckered.

This cannot be done just by creating a fake link. This requires a specific
vulnerability.

I am assuming that in the example HTML file you gave us, the intent was to
show one link and re-direct instead to your site. If this is indeed what it
is supposed to do, that's precisely what it did using Netscape 7.1. Is that
not what it was supposed to do? and Yes, it showed http://microsoft.com or
whatever in the bottom of the screen
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23273
From: David Wright" 
Date: Fri, 19 Dec 2003 15:45:53 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


I check this out on both Opera and Netscape 4.8 as well as Netscape 7.1 and
IE.

Opera gives you a security warning and requires confirmation before loading
the page.

Netscape 7.1 works the same as IE  as I mentioned upthread. Neither gives
any warning overtly or indirectly about the final destination.

Netscape 4.8 shows you the total link including the spoofed address when
hovering over the link and in the link display at the bottom of the page.
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23274
From: David Wright" 
Date: Fri, 19 Dec 2003 15:56:26 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"David Wright" <dwrighsr@alltel.net> wrote in message
news:3fe365b4.0@news.sff.net...
>
I forgot to add that *All* of them redirected to your page.
David



------------------------------------------------------------
Article 23275
From: Mike Cothran 
Date: Fri, 19 Dec 2003 16:41:43 -0600
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

I initially replied:

> Well, Ed, yes, there is a need to purchase the right, a bit hard to do for
> most common folks.

In my subtle way I am saying buy the right granted to the publisher by buying
their copy here.

> I recommend an escrow account, place twice the value
> into that account for all infractions, pass on half when you can buy the
> rights, let the other half accumulate for a bailbondsman's fee...

More on this within the sections below...

Ed Johnson wrote:

> Mike:  I am usually a bit slow, so I may have missed something here
> <g>.  For copyright infringements, I didn't know there was a fee.

I am assuming the <g> means you know, as I know, that there is no legal way to
do what was suggested and you are playing along with my little game, if so here
goes:

For infringement there is a fine, the 'fee' to be in conformation or for single
use license... after the fact.

> Often authors allows a minimal amount of copying for students,
> scholarly articles, etc.

The rights for that type of copying are spelled out within the pub page section
of most written works, i.e., none except "brief passages for review purposes
only" is the most common form of legalese used. Never, or so rarely as to be
never, the entire work, ever. Only in those rare cases, occasions where the
author spells out and the publisher agrees to same, can there be any change to
this common practice (is it 400 years now that publishers have used this clause
or something very similar?). If memory serves me correctly today, Baen is the
only book publisher which allows the free sharing of electronic copies of what
they publish in paper format and they (both author and Baen) retain their
respective copyrights to themselves even in this special case, also, not all
Baen titles are represented in this fashion, check that 'it' is before you
freely share folks.

> Most software is professionally copied and then packaged for commercial sale.

True, a copy of something in that format is (seemingly) what was discussed so
in my reply (very tongue in cheek) I indicated an escrow account with 2x the
value --  the current fine for pirated games software vs pirated video software
(if a difference still exists, which I think is not true anymore; either is
upto $25KUS per title, times the number of copies) x 2 (a fee for illegal copy
in this case, if you will), half to be paid at the time with the remainder
retained for the bailbondsman...

<maybe if I had ALSO included a wry grin smiley the tone would have been more
obvious? ;^>

> The owner of the intellectual property then gets paid a royalty for each copy
> sold.

Usually only after the initial ADVANCE payment is 'bought back' by sales will a
blanket royalty (3 month, 6 month, whatever the contract period specifies) be
paid vs sales to some date prior, as royalties are always paid in arrears,
sometimes many months (or fractional years) after they 'earn out' the advance.
Frequently the initial print run will not cover the advance already in hand,
second runs and sometimes third runs will be required to earn out the advance.
The writer may never see any royalties in most cases.

Where many writers, written word and software types, go wrong in that contract
is the fees paid FROM their expected royalties to the publisher, print shop,
distribution system, advertisement, etc. which serve to reduce or eradicate the
need for the publisher to pay any more than was already advanced. Very sad,
mostly, as the most common advance is a paltry amount in reality.

> Is there some other system that I am missing here?

No, but... if you didn't get the humor --sorry I was not more indicative that
it was humor at the time, I hope it is now as plain as the nose on my face,
else I shall be in need of a wizard rhinoprothesis al la LotR <g>.

--
Mike C

That's politics for you. It's a lot like a violin.
It can make you laugh and cry in the same movement.



------------------------------------------------------------
Article 23276
From: Filksinger" 
Date: Fri, 19 Dec 2003 14:41:34 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

David Wright wrote:
<snip>
> I am assuming that in the example HTML file you gave us, the intent
> was to show one link and re-direct instead to your site. If this is
> indeed what it is supposed to do, that's precisely what it did using
> Netscape 7.1. Is that not what it was supposed to do? and Yes, it
> showed http://microsoft.com or whatever in the bottom of the screen

That's only the first two parts. The most important part is that, when you
get to my site, the address bar says you are actually at
http://www.microsoft.com. That's the new and especially dangerous part. The
mere redirection from a tricky link is minor by comparison.
-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23277
From: Filksinger" 
Date: Fri, 19 Dec 2003 14:45:32 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Jeffry Dwight wrote:
> Oh, that one. It's not new, but seems to be newly-rediscovered.

This one is a new, more dangerous variant.

The old ways of doing this might create a link that says www.microsoft.com,
and might show in the status bar as www.microsoft.com. However, only the new
vulnerability will cause IE to say you have actually _arrived at_
www.microsoft.com in the address bar. Netscape, Firebird, etc., all say you
have arrived at http://home.mindspring.com/~filksinger.


-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23278
From: Jeffry Dwight 
Date: 19 Dec 2003 22:58:26 GMT
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

It's not new to programmers who make mistakes. I discovered it at least
a year ago when failing to expand some variables and leaving them in the
string with percent signs. When I looked around on Google, I saw that it
was already a known problem.

We =are= talking about putting a non-display character in the URL, right?
%01 or %00, that sort of thing?

- j.

------------------------------------------------------------
Article 23279
From: Filksinger" 
Date: Fri, 19 Dec 2003 14:46:46 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum



David Wright wrote:
> "David Wright" <dwrighsr@alltel.net> wrote in message
> news:3fe365b4.0@news.sff.net...
> >
> I forgot to add that *All* of them redirected to your page.
> David

Right. They all will, because that's what the link tells them to do.
However, so far as I know, all the others tell you you have arrived at
http://home.mindspring.com/~filksinger. IE 5 and 6 tell you you have arrived
at www.microsoft.com. That is the real danger.


-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23280
From: Filksinger" 
Date: Fri, 19 Dec 2003 16:14:48 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Jeffry Dwight wrote:
> It's not new to programmers who make mistakes. I discovered it at
> least a year ago when failing to expand some variables and leaving
> them in the string with percent signs. When I looked around on
> Google, I saw that it was already a known problem.
>
> We =are= talking about putting a non-display character in the URL,
> right? %01 or %00, that sort of thing?

Yes, but I wasn't aware that it was already known to send you to a website
_and_ fake the address bar, so the new site claimed to be somewhere it
wasn't. Most variants don't do that.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23281
From: David Wright" 
Date: Fri, 19 Dec 2003 19:28:18 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe37f93.1@news.sff.net...
> Jeffry Dwight wrote:
> > Oh, that one. It's not new, but seems to be newly-rediscovered.
>
> This one is a new, more dangerous variant.
>
> The old ways of doing this might create a link that says
www.microsoft.com,
> and might show in the status bar as www.microsoft.com. However, only the
new
> vulnerability will cause IE to say you have actually _arrived at_
> www.microsoft.com in the address bar. Netscape, Firebird, etc., all say
you
> have arrived at http://home.mindspring.com/~filksinger.
>

Not quite. All of the ones I tested showed not only the www.microsoft.com
but appended to it was
home.mindspring.com/~filksinger with some extra characters between the two.
However, if the location bar is turned off in all of them there is no
indication that you are where you were supposed to go to.

True, IE showed only the www.microsoft.com in the location bar.
-- 
David Wright
Help Us Collect Matching Funds:
http://heinleinsociety.org/news/trustmatchingfund.html
Benefit The Heinlein Society by ordering books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm



------------------------------------------------------------
Article 23282
From: David Wright" 
Date: Fri, 19 Dec 2003 20:23:19 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"David Wright" <dwrighsr@alltel.net> wrote in message
news:3fe39a03.0@news.sff.net...
>
> "Filksinger" <filksinger@earthling.net> wrote in message
> news:3fe37f93.1@news.sff.net...
> > Jeffry Dwight wrote:
> > > Oh, that one. It's not new, but seems to be newly-rediscovered.
> >
> > This one is a new, more dangerous variant.
> >
> > The old ways of doing this might create a link that says
> www.microsoft.com,
> > and might show in the status bar as www.microsoft.com. However, only the
> new
> > vulnerability will cause IE to say you have actually _arrived at_
> > www.microsoft.com in the address bar. Netscape, Firebird, etc., all say
> you
> > have arrived at http://home.mindspring.com/~filksinger.
> >
>
> Not quite. All of the ones I tested showed not only the www.microsoft.com
> but appended to it was
> home.mindspring.com/~filksinger with some extra characters between the
two.
> However, if the location bar is turned off in all of them there is no
> indication that you are where you were supposed to go to.
>
> True, IE showed only the www.microsoft.com in the location bar.

Funny. I made one additional test. I changed the link part of the spoof.html
to point to my own website instead of Filksinger's. When executed IE showed
my site not, www.microsoft.com as having loaded. I can't see any difference
in the two representations.

Ochen strange
David


------------------------------------------------------------
Article 23283
From: David Wright" 
Date: Fri, 19 Dec 2003 20:27:18 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"David Wright" <dwrighsr@alltel.net> wrote in message
news:3fe3a4a1.0@news.sff.net...

(snip)

> Funny. I made one additional test. I changed the link part of the
spoof.html
> to point to my own website instead of Filksinger's. When executed IE
showed
> my site not, www.microsoft.com as having loaded. I can't see any
difference
> in the two representations.
>

Yes, there is one difference. my site doesn't use '~'.  I wonder if that
does it?
DW


------------------------------------------------------------
Article 23284
From: Filksinger" 
Date: Fri, 19 Dec 2003 21:52:53 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

David Wright wrote:
> "David Wright" <dwrighsr@alltel.net> wrote in message
> news:3fe3a4a1.0@news.sff.net...
>
> (snip)
>
> > Funny. I made one additional test. I changed the link part of the
> > spoof.html to point to my own website instead of Filksinger's. When
> > executed IE showed my site not, www.microsoft.com as having loaded.
> > I can't see any difference in the two representations.
> >
>
> Yes, there is one difference. my site doesn't use '~'.  I wonder if
> that does it?
> DW

Shouldn't, no. I have seen www.microsoft.com turned to www.ebay.com,
www.aol.com turned to ww.msn.com, and several others, and they all worked.

One thing that might matter. There is a character in the URL which shows as
a blank box or a space in various text editors. I'm not certain what its
ascii code is; I actually cut and pasted that part to save myself the
trouble of looking it up. Maybe your text editor showed it as a space, and
you deleted it and replaced it with an actual space.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23285
From: MitchW@sff.net (Mitch Wagner)
Date: 20 Dec 2003 20:27:52 GMT
Subject: Re: Firefly
Newsgroups: sff.discuss.heinlein-forum

Deb Houdek Rule: "I'm leaning toward it, based on the reviews here. Hard
to find good,
new TV shows, and this one I missed entirely because it ran on a
network I don't get paid to watch (this is why tv people can't take
part in the Neilsons, we are totally biased in our viewing habits).
Not too expensive, Firefly is about $35 for the whole series where one
season of Star Trek: TNG runs about $100 (even the bad seasons) and
Babylon 5 is about $75 per season."

I'm a big fan of NetFlix, a rent-DVDs-by-mail service, $20/mo. lets you
rent an unlimited number of DVDs.

We've ordered all four Firefly DVDs from them; the first one is scheduled
to arrive on Monday.

------------------------------------------------------------
Article 23286
From: JT 
Date: Sat, 20 Dec 2003 16:00:10 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

On Fri, 19 Dec 2003 12:16:36 -0800, "Filksinger"
<filksinger@earthling.net> wrote:
>
>This cannot be done just by creating a fake link. This requires a specific
>vulnerability.

I have to keep aware of this stuff as a part of my job, and this year
we adopted a different policy than we had before.  Our policy is now:
if they issue it, we get it and roll it out.  We used to be really
worried about the effect of patches on the configuration, but now it
gets basic testing with major apps and then it goes.

It's difficult to keep up at home because I have three machines, only
one of which is really used daily.

Bottom line for Windows users: if you have broadband, there's no real
reason not to patch via Windows Update.  Set it to notify you of
updates, and then get them when they come out.  Dial-up Users, well,
still get them, but do it at the end of your session. <G>

And for you Linux/UNIX people out there: subscribe to a list like
SANS' @RISK, so you hear of the biggies.  There's just as many as for
Windows, they just don't get the publicity because the user base is so
much smaller.

JT



------------------------------------------------------------
Article 23287
From: David Wright" 
Date: Sat, 20 Dec 2003 19:00:04 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe3e449.0@news.sff.net...
> David Wright wrote:
> > "David Wright" <dwrighsr@alltel.net> wrote in message
> > news:3fe3a4a1.0@news.sff.net...
> >
> > (snip)

>
> Shouldn't, no. I have seen www.microsoft.com turned to www.ebay.com,
> www.aol.com turned to ww.msn.com, and several others, and they all worked.
>
> One thing that might matter. There is a character in the URL which shows
as
> a blank box or a space in various text editors. I'm not certain what its
> ascii code is; I actually cut and pasted that part to save myself the
> trouble of looking it up. Maybe your text editor showed it as a space, and
> you deleted it and replaced it with an actual space.
>
Well. It could be that the editor I used to change the link changed that
character to something else. I was careful to only change the link portion
and not what went before it. The redirection still worked, but it always
showed up correctly. I'll have to try it with a different method and check
out that character before and afterwards.

Puts me in mind of another event which occurred the other night. I received
an email which I attempted to print out on my HP printer. Every  time when
it reached page 3, garbage started spewing out. Finally I realized that
there were some extra embedded characters at that point which the printer
treated as control characters and everything went out of whack. This e-mail
had been copied from a website and when I checked the site, there were the
original bad characters, right in the text.

Thanks
--
David Wright
http://heinleinsociety.org
http://home.alltel.net/dwrighsr/
Benefit The Heinlein Society by ordering your books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm


------------------------------------------------------------
Article 23288
From: Filksinger" 
Date: Sat, 20 Dec 2003 19:13:52 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

JT wrote:
<snip>
> It's difficult to keep up at home because I have three machines, only
> one of which is really used daily.
>
> Bottom line for Windows users: if you have broadband, there's no real
> reason not to patch via Windows Update.  Set it to notify you of
> updates, and then get them when they come out.  Dial-up Users, well,
> still get them, but do it at the end of your session. <G>

I agree. I've decided to save myself the trouble and autoinstall the updates
that Windows Update sends to me. It is just easier.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined




------------------------------------------------------------
Article 23289
From: Filksinger" 
Date: Sat, 20 Dec 2003 19:14:52 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Speak of the devil. I write this on the 19th, and on the 20th, I receive one
of these emails, telling me to update my Earthlink credit card.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined


Filksinger wrote:
> This one is tricky, folks, and might fool savvy users, or I wouldn't
> bother you with it.
>
> There is a new vulnerability in IE, that can be used to spoof almost
> any website in a nearly undetectable way. Using it, a web page or
> HTML-formatted email can be created that contains a link to any
> website, but which actually takes you to any other website (whether
> the target is involved or not).
>
> You may have received emails telling you to go to some crooked site
> pretending to be your ISP and update your credit card, or something
> equally crooked. Most of these emails rely on fooling people into
> thinking that, say, http://earthlink.creditcardthieves.com is a real
> Earthlink site. This one now allows http://myaccount.earthlink.net
> (the real Earthlink account page) to be spoofed in a convincing
> manner.
>
> Say you receive an email from your ISP with a link in it, telling you
> to change your credit card number. The link clearly shows the correct
> page to change credit card numbers, www.myispcreditcardpage.com, but
> it actually takes you to www.creditcardthieves.com. The link will
> look valid, the lower left-hand corner of IE's status bar will show
> it as correct, and, when you arrive, the address bar will show it as
> correct.
>
> Keep an eye out.



------------------------------------------------------------
Article 23290
From: David Wright" 
Date: Sun, 21 Dec 2003 09:31:21 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3fe51031.0@news.sff.net...
> Speak of the devil. I write this on the 19th, and on the 20th, I receive
one
> of these emails, telling me to update my Earthlink credit card.

I had one last week telling me that my eBay account may have been
compromised. I don't know what the linked site wanted as I never bothered to
check. I don't have an eBay account.
--
David Wright
http://heinleinsociety.org
http://home.alltel.net/dwrighsr/
Benefit The Heinlein Society by ordering your books thru:
http://home.alltel.net/dwrighsr/heinlein-amazon.htm


------------------------------------------------------------
Article 23291
From: Filksinger" 
Date: Sun, 21 Dec 2003 17:04:47 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

David Wright wrote:
> "Filksinger" <filksinger@earthling.net> wrote in message
> news:3fe51031.0@news.sff.net...
> > Speak of the devil. I write this on the 19th, and on the 20th, I
> > receive one of these emails, telling me to update my Earthlink
> > credit card.
>
> I had one last week telling me that my eBay account may have been
> compromised. I don't know what the linked site wanted as I never
> bothered to check. I don't have an eBay account.

Earthlink customers get them not infrequently, a fact that I learned when I
worked there. This new one did have the spoofed address in the new address
bar upon arrival.

-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined



------------------------------------------------------------
Article 23292
From: JT 
Date: Mon, 22 Dec 2003 22:39:15 -0500
Subject: Re: TANSTAAFN...
Newsgroups: sff.discuss.heinlein-forum

On Thu, 18 Dec 2003 20:03:52 -0500, JT <JT@REM0VEsff.net> wrote:

>I know it's the Holidays and you are all busy... <G>  For those of you
>who didn't act fast enough to be a Patron of the HF in past years,
>this is apparently your year.  Pledges in $5 increments still gladly
>accepted.  I will definitely post here when we hit $95.
>
>I forgot to mention the benefits.... Helping to keep SFF Net around,
>and being listed on the HF Patrons page for a year with whatever kind
>of links you want for yourself.  You also get to find out my home
>address. ;)  Pledges to J T @ s  f f . n e t .
>
>Happy Happy Merry Merry.
>
Tomorrow I am beginning the annual holiday torment ...I mean
travelling to NY to see both sets of relatives.  I believe I had $65
worth of pledges, so there's still room for a few more of you, or a
couple really generous souls.  Those of you who have pledged, I will
send a note out next week sometime with my address, etc.  Those of you
who have already paid, I sincerely thank you.

May your days be peaceful and your nights calm!  (Can you tell I have
young boys? <G>)

JT


------------------------------------------------------------
Article 23293
From: Ed Johnson 
Date: Tue, 23 Dec 2003 08:24:09 -0500
Subject: Re: TANSTAAFN...
Newsgroups: sff.discuss.heinlein-forum

JT:
   I thought that this was the season for giving?  Only $65 in
pledges out of - how many? - cobbers on the Heinlein Forum?  Maybe
the reminder should be, in addition to Heinlein's: "TANSTAAFL",
"Freedom isn't free".  You have provided a free and open arena for
all of us to use, the least we can do is chip in to help defray the
costs. IMHO
  Have a safe and uneventful Christmas.  (Will you be in the
Binghamton area?  I am traveling to North Jersey.  Try looking up
North Jersey on Mapquest <g>.)

Ed J

On Mon, 22 Dec 2003 22:39:15 -0500, JT <JT@REM0VEsff.net> wrote:

>On Thu, 18 Dec 2003 20:03:52 -0500, JT <JT@REM0VEsff.net> wrote:
>
>>I know it's the Holidays and you are all busy... <G>  For those of you
>>who didn't act fast enough to be a Patron of the HF in past years,
>>this is apparently your year.  Pledges in $5 increments still gladly
>>accepted.  I will definitely post here when we hit $95.
>>
>>I forgot to mention the benefits.... Helping to keep SFF Net around,
>>and being listed on the HF Patrons page for a year with whatever kind
>>of links you want for yourself.  You also get to find out my home
>>address. ;)  Pledges to J T @ s  f f . n e t .
>>
>>Happy Happy Merry Merry.
>>
>Tomorrow I am beginning the annual holiday torment ...I mean
>travelling to NY to see both sets of relatives.  I believe I had $65
>worth of pledges, so there's still room for a few more of you, or a
>couple really generous souls.  Those of you who have pledged, I will
>send a note out next week sometime with my address, etc.  Those of you
>who have already paid, I sincerely thank you.
>
>May your days be peaceful and your nights calm!  (Can you tell I have
>young boys? <G>)
>
>JT


------------------------------------------------------------
Article 23294
From: gerald-jonas@sff.net (Gerald Jonas)
Date: 24 Dec 2003 21:20:08 GMT
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Pardon my ignorance, but does the same problem arise if you are using AOL
interface? I ask because the advice on the Microsoft website doesn't seem
to apply to AOL. Thanks.

------------------------------------------------------------
Article 23295
From: fader55@delete.sbcglobal.net (Fader)
Date: Thu, 25 Dec 2003 05:50:52 GMT
Subject: Merry, Merry
Newsgroups: sff.discuss.heinlein-forum

Merry, Happy, Joy to all, (flavor of choice - Christmas, Channuka,
Kwanza, Samhain) & May the New Year bring you all you wish.

Fader & Beth 

------------------------------------------------------------
Article 23296
From: \"gunner\"" 
Date: Thu, 25 Dec 2003 00:50:26 -0500
Subject: Re: Merry, Merry
Newsgroups: sff.discuss.heinlein-forum

and the same to you and all on board from...
"gunner" and "gunner's mate"
---------------------------
"Fader" <fader55@delete.sbcglobal.net> wrote in message
news:3fea796d.60563165@news.sff.net...
> Merry, Happy, Joy to all, (flavor of choice - Christmas, Channuka,
> Kwanza, Samhain) & May the New Year bring you all you wish.
>
> Fader & Beth



------------------------------------------------------------
Article 23297
From: Filksinger" 
Date: Thu, 25 Dec 2003 18:13:00 -0800
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum

Probably not.

To find out, go to http://www.netsquirrel.com/spoof, and try it out. He
gives demo links. Click on www.microsoft.com, and check where you went to
and what the address bar was. If you go to www.ebay.com, your browser is
pretty normal, but if EBay claims to be www.microsoft.com in the address
bar, then you are vulnerable.
-- 
Filksinger
AKA David Nasset, Sr.
Geek Prophet to the Technologically Declined


Gerald Jonas wrote:
> Pardon my ignorance, but does the same problem arise if you are using
> AOL interface? I ask because the advice on the Microsoft website
> doesn't seem to apply to AOL. Thanks.



------------------------------------------------------------
Article 23298
From: David Wright" 
Date: Fri, 26 Dec 2003 08:21:13 -0500
Subject: Re: New IE Vulnerability
Newsgroups: sff.discuss.heinlein-forum


"Filksinger" <filksinger@earthling.net> wrote in message
news:3feb9937.0@news.sff.net...
> Probably not.
>
> To find out, go to http://www.netsquirrel.com/spoof, and try it out. He
> gives demo links. Click on www.microsoft.com, and check where you went to
> and what the address bar was. If you go to www.ebay.com, your browser is
> pretty normal, but if EBay claims to be www.microsoft.com in the address
> bar, then you are vulnerable.

An additional way of spotting the spoofed URL appears to be by checking the
page's properties list under IE.

The properties list for the ebay page arrived at by the spoofed URL in the
netsquirrel site shows

1) an invalid character at the end of the microsoft.com url
2) Type, Date Modified, Date Created and Size as "Not Available".

I assume that since all browsers re-direct using these constructs, that it
is an official HTML specification. I don't know why such would be the case,
but I would think that that specification, (or loophole), whichever is the
case should be corrected and all browsers corrected to not allow it. Just
MHO.

Happy Holidays
--
David Wright
There are only a few days left in which to help The Heinlein Society
make the full matching grant. "Pay If Forward" today.
See: http://heinleinsociety.org/news/matchingupdate.html



------------------------------------------------------------

============================================================
Archive of:   sff.discuss.heinlein-forum
Archive desc: The Internet home for the Heinlein Forum
Archived by:  webnews@sff.net
Archive date: Tue, 10 Feb 2004 17:11:59
First article in this archive:  23248
Last article in this archive:   23298
Oldest article in this archive: Thu, 18 Dec 2003 08:53:01 -0500
Newest article in this archive: Sun, 28 Dec 2003 12:53:30 -0500