MV Communications Newsletter: May 2004

MV Communications Newsletter: May 2004

In this issue:

Unfamiliar or bizarre terms that you run across might be in the newsletter glossary (-- if not, suggest that we add it.)

 

A Suite of Microsoft Security patches

In mid-April Microsoft released a group of security patches for an assortment of flaws or errors in several of its operating systems and utilities. Many of these bugs were classified as critical; especially affected were the Windows NT, Windows 2000, Windows XP, and Windows Server 2003 platforms. However, some of them had implications for older systems as well (including Windows 98, Windows 98 SE, and Windows ME).

Patches and updates, as well as information, can be found at Microsoft's web site. We provide a direct URL below; however we'd like to point out a few things before getting to it.

Points to consider when applying these or other security patches

  • It's good to secure your system. Critical security updates are not to be brushed aside lightly. These represent flaws that can be exploited to degrade or damage your system. Furthermore, many bugs can be used to turn your system as a tool against others (e.g. by facilitating SPAM or helping to spread viruses).

  • It's good to be cautious of brand new patches. When addressing a security issue, a vendor such as Microsoft is caught between conflicting goals: to release an update as soon as possible but also to make sure that the update itself causes no problems. There are tens (or hundreds) of millions of systems running Microsoft software, and probably millions of combinations of software collections and configurations. It is impossible for a vendor to test every potential combination in such a large installed base, and so it sometimes happens that a patch itself has to be patched. And in fact in this case, several revisions of the patches were introduced after the initial release.

  • It's good to be cautious of big patch collections. If one patch can have unpredictable results across millions of combinations of installed software, a collection of patches can too. Not only that, but where there is a set of multiple patches, the likelihood increases that one or more of them will need to be revised.

  • Patches can have unrelated side-effects. Particularly if you haven't kept up with updates, or you've operated your system for a long time while making tweaks, installing programs, changing configurations, and generally exercising it, it's possible that you have introduced an entirely unique problem with your system that only becomes noticeable what you apply another major change (such as a patch, or even rebooting the system after a long uptime). This can make a person gun-shy about upgrading (or rebooting): but really this calls for frequent system maintenance more than it does avoiding upgrades at all.

  • It's good to apply patches regularly. This seems to contradict the last few points, which said that new or large patch sets can be risks in themselves. In most cases, though, the cure really is better than the disease. Whenever new critical flaws are found, you can bet that there are people out there working hard to make exploits against them (or that they already have done so). In this particular case, there were active viruses taking advantage of at least one of these flaws within just a few days (see the "new worms and viruses" section following).

  • It's good to firewall. At least one recent computer worm was so infectious that it only required a single data packet to be sent to an unprotected system to compromise that system. There were reports of systems being infected within 8 seconds of being connected to the Internet. These days there is just no reason to expose a system to the Internet if that system isn't filtered, or perhaps more importantly no reason to expose the Internet to such a system.

  • We are not Microsoft. Although we're often called on to help with software configuration, especially related to(but not always limited to!) making life on the Internet easier, it probably goes without saying that we don't represent Microsoft or any other operating system vendor. So we aren't making any representations about what patches and upgrades will do to your system. However: we know that running unprotected systems is bad, as is running systems with known security flaws. If you do experience any problems with upgrades, or if the prospect of upgrading makes you nervous, seek out a professional who can help you.

Specific information

With the above points out of the way (and if you skipped the previous section, please do give it a glance): complete information about the patches we talked about above can be found at http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx . Please also continue to pay attention to system updates as they are released -- see the "Keeping up on Updates" subsection below.

Other recent patches

Also in mid-April Microsoft issued a patch against a critical flaw in Outlook Express that could allow remote users to take over control of a computer. Read about it at http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx . There is at least one virus, named "Wallon," that exploits it.

On May 11 Microsoft released an update for an HSC (Help and Support Center) security flaw, for Windows XP and Server 2003 platforms. More information is at: http://www.microsoft.com/technet/security/bulletin/ms04-015.mspx .

We mention these not to provide an exhaustive list, but to illustrate that bugs are found, and exploits created, on a continuing basis.

Keeping up on updates

As for keeping your Windows system up to date: Windows systems have a utility called "Windows Update." Since there are number of different operating system versions, the details depend on which system you have, but in general, Windows Update can be found by accessing the "Start" menu. Click on "Start" and look on that menu for "Windows Update." If you don't find it there, check one of the submenus such as "Programs."

Windows Update will look to see what upgrades are available for the things on your system, things including drivers as well as operating system updates. Be aware that it does not check third party (non-Microsoft) products. For example, if you are running Photoshop, it will not check Adobe for an update.

DSL or other "Always On" customers can have the system check daily, perhaps in the middle of the night, and even download and install the updates automatically so every morning you have an updated system. You do need to have a lot of trust in the process to do this- most if not all of the caveats above apply to the frequent update process.

 

New Worms and Viruses

Once the new Microsoft vulnerabilities were revealed, it didn't take long for exploits to appear, including one particularly nasty and wide-ranging one called "sasser." Sasser and variants took advantage of a Microsoft Windows "Local Security Authority Subsystem" (LSASS) -- thus the name. There were reports of significant outages and disruptions of service in many industries and many parts of the world, purportedly caused by this worm and variants.

(According to press reports, a teenager in Germany was identified as (and confessed to being) the author of the worm, although the whole truth of that is likely yet to be seen. (In an intriguing turn of events, we read that a Microsoft reward offer of $250,000 lead directly to his apprehension.)

The point being: once known, critical security flaws will be taken advantage of, and can cause a lot of damage. Don't wait to be a victim.

 

Specials

Our DSL/V specials (for new DSL customers) continues through the end of June. Additionally, we are adding some fine deals on other services for new subscribers.

And remember that referral credits apply to these specials.

 

DSL Specials still going strong

Free modem, various packages

Our spring DSL specials are still in effect and have gotten a great response. If you haven't checked them out, be sure to do so! More and more areas are opening up for DSL/V all the time, including those served by remote terminals and phone lines that have failed in the past (for example, see the President's DSL Diary below). If you're getting newly installed DSL/V service, you'll get a free modem, and 6-month packages including free installation are available. Check out our dsl.mv.net DSL website for specifics.

 

Server Colocation

Pay setup fee only, get up to 3 months free

Did you know that we have a colocation facility at our offices in downtown Manchester, NH? When you need high bandwidth for your specialized applications running on your own computer, sometimes the best solution is to place your server where the bandwidth is. Our colocation facility provides space for your server along with power, cooling, and access to our Internet bandwidth. You get 24x7 access via cardkey access to this colocation area.

Colocating is less expensive than installing a high-speed leased line (such as a T1) to your location. Even if you do have a high-speed connection, a colocated server has access to much higher bursts of bandwidth than you would get over that kind of link - and a colocated server can augment whatever kind of service you might have.

Sign up now for server colocation-- pay us only the setup fee, and get your 1st, 4th, and 7th months free!

See our colo.mv.net page for details.

 

Dialup Internet

Pay $10, get 3 months standard service

We offer dialup Internet service throughout NH and MA, and in many areas in Maine and Vermont. Through the end of June: sign up for a new standard dialup account; your initial payment of $10 will cover the first three months service. (New customers only, and all other terms and conditions apply.)

See our Standard IP account page for details.

 

President's DSL Diary

[In which we enter first-person mode]

As president and part owner of NH's oldest ISP, and someone who lives in Litchfield, just outside the bustling metropolis of Manchester (the home base of a a lot of telephony and Internet in this state), I've always found it a bit ironic that the best dialup connection I could get was about 26.4Kbps (28.8 on good days). This is just the way it is: I live in an area with telephone service provided through a remote terminal (aka a DLC or SLC). This is a small equipment hut from which copper wires can be run to individual telephone subscribers, but is itself connected to the telephone central office via high-speed digital links. This saves on running a lot of individual copper wires all the way from each subscriber to the central office, but (depending on the way a subscriber is connected to it), it can interfere with the technology that makes "56K" modem connections possible.

Traditional DSL connections have required that you (the DSL customer) have a copper loop connecting you directly to the central office, which is where the DSL equipment is located. Until recently people like me who are connected via remote terminals have been out of luck. However, DSL equipment has been being deployed in many of these remote terminals at a very rapid pace. When DSL equipment arrives in the remote terminal that you are connected to, you may suddenly be able to get DSL where you couldn't before.

This is why we keep suggesting that you continue to check to see if DSL is available on your Verizon phone line, because even if it's failed in the past it may succeed sooner or later. You can check your number by going to our loop qualification page, which you can find at home.mv.net or via our dsl.mv.net DSL page. Also, if you see a notice on your Verizon bill that your number now qualifies for DSL, this means you can get DSL/V from us too.

At any rate, I did keep checking my home number, and lo and behold, one day it qualified, and I put in my order. We got an official notice that my scheduled install date was pushed back a week: nevertheless I tried it on the originally scheduled date and it was up and running. (It often happens that service is installed before the projected date.) As part of my order, I received a DSL modem from MV along with some printed guidelines to get me started (and the knowledge that I could always call MV's Customer Support to help me out). I followed the procedures and was up and running in just a few minutes. The modem told me that my bit rate was 1.5Mbps down and 160Kbps up (I had ordered 1.5Mbps/128Kbps).

I must admit that the first things I did were probably not typical. I had done a new FreeBSD (UNIX) installation on a system to use on the DSL circuit. Once the connection was up and running, I spent some time downloading and installing software packages. Many of these packages were pretty substantial, including web browsers, editors, and the latest "perl" language release. In just about every case I was able to fetch these at a rate of about 185KBs, very near the 1.5Mbps maximum bit rate. (1.5 million bits per second divided by 8 bits per byte: about 187,500 bytes per second.)

Once that rush of geekiness had passed, I settled into a more typical pattern of enjoying high-speed net access. The web sites that I frequent were much faster to access, of course. Being long used to a dialup connection at home and high speed access at the office, I had developed a habit of saving some of the more heavy-duty surfing for office hours. Not so with DSL: in fact it's now the other way around.

Does everyone need or want DSL? Probably not. But:

  • Your line might qualify, now or in the future;
  • It's easy to order;
  • It's easy to get set up;
  • It's easy to use.

 

DSL/V Default Speed Increase

Our basic level DSL/V offering now includes bitrates up to 1.5Mbps/384Kbps -- an increase from 1.5Mbps/128Kbps. Note that the product speeds specify the bitrate on the DSL line; actual transfer speeds depend on a lot of factors. Also there are laws of physics that still apply: if you are quite far away from the central DSL equipment, you may get a lower bitrate in one direction or the other, or both.

For those of you who already have DSL/V service at 1.5Mbps/128kbps, we can convert your service, if your line qualifies, to 1.5Mbps/384Kbps for a $35 one-time service charge. Contact us if you'd like to have this done.

 

Notes About Discounts

Did you know we offer a number of discounts for some of our services? (See our discounts page.)

New: senior discounts

This month we're adding a senior citizens discount (we figure if students qualify, why not seniors?). If you're 60 or older, give us a note and we'll apply the discount to your account.

Updates on student discounts

In reviewing some of our other discounts we find that we never put an end date on many of our student discounts (presumably most students do graduate eventually...). We're going to do a couple of things with student discounts. First, all existing student discounts will expire on June 30. If you're still a student, no problem-- just let us know and we'll extend it. Second, when you sign up for a student discount in the future, we'll also enter an end date based on what you tell us.

 

Interesting Link(s)

This is our sometimes section where we mention one or more sites that we find interesting to one or more of us. Items here do not necessarily have anything to do with MV (and often do not), nor do they necessarily have anything to do with our business or anything else we do. (It should go without saying that we make no representation about anything contained on those web sites.)
www.fathom.com
A very interesting collection of short online courses. But why paraphrase? Here's a quote from the opening page: "This archive, provided by Columbia University, offers access to the complete range of free content developed for Fathom by its member institutions. Columbia encourages you to browse this archive of online learning resources, including lectures, articles, interviews, exhibits and free seminars."

UserFriendly
A well-known little-known comic strip (depending on what circles you run in) that most of us here enjoy, providing commentary on the interaction between the Internet and society (as if the two are separate any more). As we finish up this newsletter, today's strip seems particularly appropriate in a self-referential way, as is this classic. (Warning: not for all tastes.)

 

Your feedback?

Do you have feedback on this newsletter (or past or future newsletters)? If so, please either:
  • Go here to fill out our simple feedback form, or;

  • Send us email at mv-feedback (on our domain, mv.com).

 

Edit History

20040518: posted