Category: General

Earlier I posted about my “tanstaafl” related issues in getting filtering and proxy services set up.

Good news: I finally got it all to start reliably. It’s still a bit quirky about restarts for log turnovers though.

Nevertheless, I stumbled into something else incredibly useful, and after a few weeks of trying it out I will be shutting down my own filtering.

The service is called openDNS. Their purpose is to replace the sometimes flaky DNS service that comes with your ISP (Hi, Comcast!) and provide an alternate means to look up addresses on the internet. This means that every time you try to look up www.apple.com, their computer takes the web address and sends back the numerical address, much like looking up phone numbers in a phonebook by name.

The side benefit of this is that you can also specify corrections of typos, define what kind of websites you don’t want visited from your household or office, and specify what exceptions you want to allow, because they control what computer you connect to when you ask for a website.

Specifying what you want to block follows the same categories used in DansGuardian, and the logs give you a nice list of sites that have been denied. What it doesn’t do is let you know who in your network made the request, give you a weight for how strict to be within a category, or let you see what sites have been visited that were not blocked.

I can deal with those weaknesses, as it simplifies my computer setup and makes it a little more difficult for the kids to work around the restraints (I still make sure I eyeball their activity and computers on a regular basis). It has one other “plus” – the instructions. They have excellent documentation that should go a long way in helping you set up your router or computer to use their DNS servers as well as tracking changes in the IP address your ISP hands you.

Best of all, it’s “free.”

Well, not completely. They make money by sending mistyped or flat-out wrong domain names to their own search and ad results. 

 

A client of mine recently received an email purporting to be from the Department of Justice (and another one from “the IRS” ) relating to claims made against their business. It had some official-looking language about case numbers and claims filed by so-and-so, and noted that a copy of the complaint was included “in the pdf below.” They were suspicious for several reasons, and asked me to check it out.

Even if you expect the IRS or DOJ to email you out of the blue with this kind of thing, addressing the recipient by the wrong gender is a big red flag. The other thing that made me immediately suspicious was the “pdf” file was zipped.

The ZIP format is an incredibly useful compression and archiving standard that was even more important back when internet access was typically via modem. The downside is that if the package is really a virus installer it will not only unpack the virus files but execute them, infecting your system. For this reason any decent virus scanner will search through .zip files as they come in, but some viruses still slip through, especially in email. Also, PDF files are already compressed so there is little benefit from further compressing them (technically speaking – the graphics are already compressed. You may save some space by compressing the text more). Someone legitimately sending a PDF – or any document small enough to reasonably email (a word DOC file, etc.) – will almost never go out of their way to zip it up. Laziness, if nothing else, practically guarantees this.

As a matter of nettiquette, never email someone a .zip file without warning them ahead of time, and if you receive one without a prior heads up from a known, trusted source, be very suspicious. One of the nastiest infections I cleaned out looked like it came from a trusted source so the client opened it up without checking with the sender.

To wrap the story up, I took a snapshot of my virtual Vista installation under VMWare Fusion so I could restore to that earlier point, and looked at the zip file.  As expected, the antivirus software immediately caught it and archived it.