Security 102 - How Secure Is Your Digital Life?

Article 2 of 3

In this multipart series, I will examine the various aspects of what we call "security" in the Digital Age, and how we can protect ourselves from the exploits of others.

The Problem

As noted in the first post in the Security 100 series:

The more you follow patterns, and the simpler those patterns are, the easier it is for someone to hack you.  More specifically, if you use say 5 different passwords for all the hundreds of web sites and software you use, and those passwords are always 8 characters, have an upper-case first letter, and a number at the end, and replace certain letters with certain numbers - voila, that's a simple pattern.  If you use the same password for Google ID, Apple ID, Hertz, Avis, Marriott, Delta, Southwest, American Express, and your bank - well, you get the picture.  Once someone has one password, they have all your passwords!

So, let's dive into passwords and authentication.  Back in the old days, the ancient civilizations had an authentication problem.  Think the Greeks, with thousands in their armies, and they needed to know friend or foe, and trust the carrier of a message.  The first form of authentication is facial recognition - know each other.  But there's only so much you can remember, or what happens if you just haven't met them yet?  So, many different devices have been used - from carved stamps in wax that are hard to reproduce, to some personal token (a ring, an amulet), to passwords.

In the Digital Age, this has become the now ubiquitous "enter your user name and password."  And, what are probably 99% of user names?  E-mail addresses, which of course are public knowledge.  So half of your authentication is public knowledge.  What do we use for passwords?  Something we can remember, something meaningful - so that anyone who knows us probably can guess, and anyone who gets to know us can figure out.

Since we have been inundated with thousands of different systems that don't talk to each other, each one has to have its own authentication - and as users of various systems, we can only keep track of so many in our heads.  This has been helped somewhat with common logons like OpenID, Google, Facebook, and more where systems use those common logons to authenticate - but the problem is, if you have one ID hacked, the hacker is into all those systems.  Have you ever tried to log into your bank site, only to realize you forgot the password?  And, you can't remember the damn security questions you set up to re-establish your password?

What do we do?  If you are like almost everyone, you do the following:

• Use some word that is meaningful to you.
• Change it up a bit - but only a bit, so you can remember the changes!  For example, if your word is puppy, make it "pUppy1" or "p0Ppy" or some such replacement.
• Use the same password on many sites

If you are guilty of any one of the above (that was me, until now!), then your security is at major risk of hacking and identity theft.  Think of the implications - what if your password for your e-mail account is the same as your Apple ID password?  And, if you use "Find My iPhone" iCloud service - then a persistent hacker can find your password, guess that you have Apple devices, and disable your device.  Or, they can call Apple, and with a little persuasion, convince them to change the password on you (I have read blog posts on this happening).  They can download all your synched data.  What if your password is also what you use on Dropbox, Google Drive, Microsoft Skydrive, and more?  Yes, they can access all your data.

General Security Procedures

Some things you can do in general to make your digital life more secure:

1. Use random, complex passwords.  Yes, you won't be able to remember them.
2. They should be 12 characters or longer, be unintelligible, and be different for each system or site you log into.
3. Use a password management system to store your passwords - so you unlock it from a trusted device, with some super-secret master password that you only use for that one purpose.
4. Do some research and find out if the system you log into offers multifactor authentication.  Specifically, there are many forms of this - from a question and answer that you select or make up, to some second password algorithm that is "unguessable" - for example, Google Authenticator generates a number every 30 seconds, and you can enter your name, password, and GA number for a specific logon (say Dropbox or LastPass or Hootsuite).  That way, even if a hacker does gain your password for the 1 system, they don't have your GA code, and thus can not possibly enter the number it generates.
5. Do not write your passwords down anywhere.
6. For a long time I stored my passwords in a Google Drive spreadsheet - but if anyone does hack my Google Drive account, they would then have access to all my passwords.  Plus, I had to manually update the list every time I added a new web site, or the web site changed because the company merged, or updated the password.  A pain!

• Multifactor authentication means more than just a password to authenticate you.  The various forms so far are:
• You can make up or pick a question, and enter an answer.  ("What is your favorite color?"  "Blue")
• A number generator, like RSA SecureID, Google Authenticator, and others to generate a constantly changing number that you use as a password.
• Physical token security like Yubikey, Transakt, Toopher, Duo Security - these make you have a physical key (think the signet ring in the opening paragraph), that you insert into the PC in order to log into a system.
• Biometrics - this refers to reading the unique "signatures" in your body.  Your eye retina pattern, your fingerprints, etc.
• Find out if the system you use offers Multifactor Authentication.  If they do, then use it.  I like Google Authenticator because it is free, and reasonably secure.  It provides you a mobile app (which on iPhone is backed up with system backup) that reads a QR code that the system gives you.  It then uses that QR code to add a number generator for that app, so you can now use your name, password, and the GA code to log in.  Each Google Authenticator number sequence is specific to the system or app you are authenticating to - so my Dropbox Google Authenticator code only works for Dropbox logons - and I need to enter my logon name, password, and GA Dropbox code on a non-trusted device.

The Solution

So what am I saying, to have a different password for every system you log into?  YES.
But, that's impossible, you say.  How can you remember it?  Write it all down?  IN A WAY.

I have been using a system called LastPass for almost a year now.  There are others out there, but LastPass is:

1. A complete solution, covering computers and mobile devices.  The system integrates with all of the most popular browsers, on the top 3 desktop operating systems (Mac, Windows, Linux), and all of the mobile OS's.
2. Secure - they were not affected by Heartbleed because they did not use Open SSL.
3. Inexpensive - it's free unless you want mobile device access - then it is $1 per month.
4. Sharable - for that $1/month Premium upgrade, you can share passwords with your friends/family.  They don't need to have a paid account.  That bank account you share with your wife?  Share the password in LastPass with her LastPass account.  If you or she changes it, it automatically updates in the LastPass vault, and next time you go to log in, it is filled in automatically from your web browser.
5. Helpful - Tools help you identify duplicated passwords, and it has a password generator to generate a random password that is hard to guess by the most advanced hacking techniques.

So, how does it work?  On computers, it has a plug-in that installs in the browsers.  This plug-in handles all different forms of web login - from web pages, to flash apps, to pop-up authentication dialogs.  You give it a master password. You can identify devices (your laptop, your phone, etc.) as Trusted so you don't have to give the master password every time.

On the iPhone, since Apple has secured the rest of the device, they have a web browser in the LastPass Premium app, so that you can go to any web site and your stored authentication will be filled in automatically from your password vault.  Android and Windows devices, of course do not have sandboxed apps and allow LastPass to integrate to their web browsers.  (Side note: This is to me, an inherent security weakness in non-Apple or jailbroken devices.)

What if you use a work computer and can't install any software?  No problem, you can put your LastPass on a USB stick, and run it from there without any installation or administrative rights needed.

Now what happens if someone hacks LastPass?  Good question!  One I don't have a good answer to - because if they do somehow get your master password, then you are ^$#*ed.

Security 101 - How Important Is It to Update Your Devices?

Article 1 of 3

In this multipart series, I will examine the various aspects of what we call "security" in the Digital Age, and how we can protect ourselves from the exploits of others.

The Lessons

MacRumors recently reported that the adoption of iOS 7 has reached 87%.  That is 87% of all Apple devices connected to iTunes - not just the eligible devices new enough to be compatible with 7.  If we are talking just devices that have iOS 7 on them, it approaches close to 100%.  That is a monumental accomplishment if you stop for more than 2 seconds to consider.  Android, as Apple, Inc. is proud to point out, is a smattering of device models and manufacturers, all running various versions of the operating system, with around 10% of the market updating to the latest OS major release - let alone security patches.  This is a monumental flop, as I will point out below.  I am opening this post with a discussion of mobile devices, but let's back up a bit.  What lessons have "we" mobile device junkies learned from computers?

I think it fair to state that we as a society have learned the following lessons.  As individuals, how you understand and apply these lessons are of great importance to you.  It's up to you - learn from someone else's mistakes, or learn from your own.  The latter is more costly.

1. If people can find a way of exploiting a computer, they will; whether for monetary gain, political ambitions, or merely just for the fun of disrupting other people's lives.
2. Every computer depends on Humans to develop the Operating System that gives it its security, and on the Humans who use it to implement that security.  If someone "makes a mistake" or fails to identify and close a loophole, it will be there to exploit.
3. Now that computers are connected to the Internet, the ability to and ease of downloading malicious software (a.k.a. malware) has increased exponentially.  Add to that, the fact that computing has reached every corner of the world, and billions of people have computers at their disposal - people with all kinds of morals, agendas, and abilities.  Multiply the sum of the above by the fact that instructional information (of all types - both helpful and harmful) is available on the Internet on any topic, including hacking and vulnerabilities.
4. Now, let's define what a "computer" is.  This is an electronic device, with processing, memory (typically operating RAM and storage flash/disk memory), that has input and output, and runs a set of software called an Operating System that allows people to interact with it, and run application software.  With this basic definition, that broad brush includes:  Laptop/Notebook computers, Desktop computers, Rack servers, Any mobile phone ever produced, Any tablet, Any Television produced within the last - at least 10 years, your cable set-top box, any other set-top box (Chromecast, Roku, Apple TV, etc.), most alarm clocks (think iHome), any automotive vehicle produced in, say, the past 20 years...the list goes on.  Today, it is almost anything that requires electricity.  My Blendtec blender has a digital readout and buttons - and may be one of the few devices that is on the borderline because it has only physical I/O (buttons and display), and no Internet connectivity - yet!
5. The more you follow patterns, and the simpler those patterns are, the easier it is for someone to hack you.  More specifically, if you use say 5 different passwords for all the hundreds of web sites and software you use, and those passwords are always 8 characters, have an upper-case first letter, and a number at the end, and replace certain letters with certain numbers - voila, that's a simple pattern.  If you use the same password for Google ID, Apple ID, Hertz, Avis, Marriott, Delta, Southwest, American Express, and your bank - well, you get the picture.  Once someone has one password, they have all your passwords!
6. A simple name/password system is the easiest to hack.  Once you add more factors, it becomes very difficult for people to hack.

So, what are the implications of these lessons?  If you have a computer, someone either has or will develop a virus (or malware to be more general) for it, or be able to hack into it.  Why?  Because the systems are developed by Humans and therefore inherently hackable.   These hackers will try to make money off it, they will try to attack you for political gain (think Syrian Electronic Army, think NSA), or just because they can and they have the time and the need to feel excited at seeing the mayhem they created in other peoples' lives.

What are the takeaways from these lessons?  With PC's, we have gotten accustomed to the following security measures:

• Regular security updates from the OS manufacturer (Microsoft, Apple, Ubuntu, Google, etc.)
• Antivirus software that identifies and prevents attacks
• Firewalls to prevent active attacks from the Internet
• Spyware and Adware protection that does the same as Antivirus software against malware that tries to do some not-so-nice but not necessarily catastrophic things to us

In the Post-PC world of today, where the vast majority of devices on the Internet are NOT PC's, have these lessons transferred?  No!  We are all vulnerable, but not helpless.

And, more importantly, what can you do to protect yourself from this?

From Desktop to Mobile

From the definition of computers you can extrapolate the applicability to your mobile devices (note: not just "my" definition, but "the" because bottom line, that is what a computer is - and all devices under that huge genre are susceptible to the faults pointed out here).  Why the emphasis on mobile?

1. The growth rate of mobile market has far outstripped the growth of the PC market.
2. Mobile devices are inherently "personal" across cultures.  As such, we interact with them as if they are our own, personal spheres of computing - much more so than a PC.  However, these "personal" computers are definitely interconnected via many technologies, and always (or most always) "online." Also, it seems we are more willing to install apps and put data on/through them that either we may not on a PC, or is more convenient to deal with than a PC.
3. Other than, to a limited degree Apple, the PC lessons have NOT translated to mobile devices.  What antivirus software are you running on your mobile device?  Yeah, I thought so.
1. I say Apple to a limited degree, because if you go through iTunes to install software, they at least vet the apps.  If you have not jailbroken your device, the OS at least sandboxes each app to limit its ability to conduct malicious activities.  Windows, Android - forget it.  Blackberry?  Too small to even consider.

To Update...Or Not To Update

So, on PC's what dos Update do?  When OS manufacturers identify these security flaws, they let you update your system with their fixes through the Update mechanism.  If you don't use it, then your device remains vulnerable to those ways of causing you harm.  If you don't educate yourself on how to update your device - well, then that's on you.  When you get a car, you have to learn about getting fluid changes (not just oil), tire pressure, battery replacement, and so on.  If not, guess what?  Same thing with your computing world.  Except in this case, it isn't just the parts grinding on each other and wearing them out - it is someone out there intentionally trying to mess you up, and going after you via the Internet, Bluetooth, etc.

If you have a way to turn automatic updates on, do so.  If not, make sure you check - on a weekly or monthly basis at the very least.  Should you update?  AS SOON AS IT COMES OUT.

Why Apple?

While many people love to hate Apple, again you have to think about what it is they have accomplished.  When they put out a product, they don't just put it out there - they offer a complete, "soup to nuts" solution. When an update is available on iOS mobile devices, each device will receive a notification.  Critical updates will actually interrupt the user using the device, and prompt them to install the update.

When I use the cliche "soup to nuts," I do mean that Apple has considered and handles each and every aspect of a device - from the developer network it needs to develop third-party apps to make it successful - to the end consumer and all aspects of delivery, support, training, and service - to all points in between in the supply chain.  They are not fragmented - they are organized, move forward with a plan and determination, and operate with integrity.

Updates do not occur in the same way on Android.  Indeed, since Android is an open OS (meaning Google gave it out to the public for free), many manufacturers have modified it to their own purposes to put their own competitive "flavor" on it.  This makes updates from Google even more iffy, because they could cause unforeseen issues on certain manufacturers or models if applied.

I don't know for sure, but I would guess that Windows Mobile updates the same as Windows.  My whole problem with Windows, though, is that Microsoft developed it.  Microsoft is the king of marketing and making money from products, but not the king of reliability and delivering what consumers really want.  Historically they have convinced everyone that they are the only game in town, but that is crumbling around them because they totally missed the large growth Mobile market and are scrambling to catch up.  Meanwhile, the plethora of security exploits on Windows are well-known, ubiquitous, and persistent.  The recent fiasco discovered in Internet Explorer affects releases 6 through 11 - practically every version of Internet Explorer in use today (see Microsoft bulletin MS14-021).  And Internet Explorer is core to Windows, so if you just install some other browser, you are still not replacing core functionality with the new browser - embedded IE built into Windows and other Microsoft products propagate the inherent security flaws that make the system unstable and insecure.

If anyone has experience with Ubuntu on mobile devices, I would love to know how that fares.  I assume updates are delivered via the Software Centre, but are they pushed automatically (or push notifications so you can pull them)?

What Exactly Is "The Cloud?"

All About The Cloud

"The Cloud" as you can probably guess, at a gross level, refers basically to storage on the Internet.  But many companies and people seem to use it for different meanings, almost like it is a loosey goosey definition that is being exploited, definitely misunderstood in may cases.  In fact, you may at some point ask, what's the difference between the Cloud and the Internet?  So this article will strive to blow away all the smoke, and boil it down to its essence.

The Internet, as you may well be aware, is simply a set of interconnections between computers (and here I use the term "computer" to loosely describe some computing device).  This interconnection is a combination of wires and wireless media, and a collection of "protocols" or methods of communicating for specific purposes.  For example, the web uses the "HTTP" protocol, or "HyperText Transport Protocol."  File Transfer Protocol (FTP) is used to transfer files, and so on.  The Internet allows devices to connect and communicate with each other in an open and standardized (and sometimes secure) fashion.  So, what is "The Cloud" - as the Internet is well-defined, we don't need to call it something else, do we?

Basically, "The Cloud" is an euphemism (look up the definition) for storing your own data on someone else's machine that is accessible through the Internet.  It is a really good marketing ploy, a good single, simple term to describe a set of security protocols defined by whomever wants to define them, to allow you to store and access data (such as music, pictures, Office documents, applications, or whatever).  One example of A Cloud, is Google Drive.  This is a primarily web-based system that allows you to store and access files in folder structures, as well as providing hosted applications to edit these files - all on Google's systems (or someone they contract to hold their data, which is really your data).  Another example is Apple's iCloud, which allows you to not only store and share files and has hosted applications, but provides a secure way of storing application settings and experience preferences (like bookmarks, keyboard shortcuts, passwords, and more).  (By the way, iCloud also has hosted applications to find your devices on a map, and access e-mail, contacts, and calendar.)

So, anyone can define anything as a Cloud, as long as it allows you to store and access data across the Internet, securely.  Last year I bought a Western Digital cloud drive, which sets up Internet access to my files from anywhere on the Internet.  Granted, this is a loose definition of the Cloud, but probably still within the arena.

Many companies have had Cloud solutions for years, and many more are getting into it.

The Good And The Bad

So, what's so great about it?  You don't have to manage backups.  These clouds are typically accessible across devices, across operating systems.  Also, you can easily select certain data to share, and you are not e-mailing that data (which may be mega- or gigabytes), but a link to that data.  Many offer features like hosted applications (word processor, spreadsheet, etc. that you can run from a web browser to edit your data), so you never have to install or upgrade these apps.

So, if it's so great, what's so bad about it?  Once you put your data on someone else's system, you are completely in their hands as far as security and trust.  In the original computer paradigm, you create a file, and you store it on your hard drive.  Your computer has to be on, and connected to the Internet, for someone to remotely gain access to it.  This has been relegated to a set of fairly sophisticated hackers, who would have to know that your system exists, and have some interest in putting forth the effort to hack into it.  But now, with these Cloud services, they are huge - and become a huge known target for hackers.  Hackers know that your data is there, and know where to go to get it, and can assume that hacking is worth the effort.

Do you use QuickBooks online, to store your financial information?  Do you put your company's Intellectual Property, which may contain ITAR-regulated Defense designs, in the hands of some third party to which you can't hold liable if some of that data is stolen by foreign nationals, and the Department of Defense comes after you?  Do you put your personal files, containing personal data, on Dropbox, Drive, Microsoft SkyDrive, Amazon S3, or a myriad of other services?

Nowadays, we are riddled with news stories - and I can see the trend.  Traditional forms of computer security that we have held as acceptable, are easily cracked.  New password cracking algorithms, plus with the ability for computers to utilize the CPU and GPU to compute, plus more and more powerful computers, mean they can break through your encryption in minutes or hours instead of years, decades, or centuries.  The Heartbleed bug identified last week, that has been in place for 2 years, is a prime example of a core technology (Open SSL) that is used by most software to secure data, having a vulnerability that hackers have already exploited.  Chances are, we are probably not even aware of most of the worst hacks and thefts.

But, just as insidious I find, is do you really know or trust the company behind your cloud?  Do you trust Apple, Google, Yahoo, Amazon, or the little-heard-of companies that are contracted to store their data?  Do you trust the NSA's access to these data, should they (or their computer software) deem that they need to investigate you?  Because, the more that you put digitally, and the more you put it in the hands of someone else, the more vulnerable you are to the Science Fiction stories where the police hit a few keystrokes and can cross-reference any private or public information to instantly make a decision on who is "bad" to them (ala Continuum).

If you heard of Heartbleed but have no idea what Open SSL is, here's a 2-sentence primer.  Open SSL is a free set of libraries that most software developers use to secure data, such as encrypt Internet traffic or a file on a Cloud drive.  Heartbleed is a vulnerability that allows hackers to easily break that encryption and see what is encrypted, and was introduced in Open SSL 2 years ago, only now to be discovered.

How does that affect you?  Dude.  Dude!  I can guarantee you that at least 90% of everything you do on the Internet that you think of as secure (credit card purchases, cloud storage, password entry, VPN, etc.) uses Open SSL to encrypt the data.  That means that, if anyone is listening or wading through the data you store on other systems, and they know how to exploit Heartbleed, everything you have is an open book to them.  They can get your logon ID's, passwords, bank account numbers - anything you type into a web page that says it is secure, or indeed even if you don't have a web page, but some application that communicates over the Internet.  There is absolutely no guarantee, and no way for most of these companies who host your data, to even know or track if they have been hacked.  Some of the hacking may just be some third party "listening" in on the traffic between their site and you.

I am almost certain that there are vulnerabilities other than Heartbleed, that have not been or may not ever be found.  Who are the perpetrators?  Who knows.  NSA?  CIA?  Al Quaeda?  Syrian Electronic Army?  China?  Russia?  Could be anyone.  I predict in the next several years, the whole concept and practice of security will undergo an overhaul, an upheaval.  Is a simple name and password sufficient?  Not any longer.  What will replace it?  Multifactor authentication?  Biometrics?  Something else?

Either way, be afraid - be very afraid.  The more we use Cloud, the more vulnerable we are.   And there is nothing we can do about it, either legislatively, or legally.

Poorer Battery Life with iOS 7?

Recently, Apple released iOS 7, the new software for its "newer" mobile devices (devices introduced within the last few years).  As you may know, it is radically different.  And, its battery consumption is greatly improved, if you disable some new features.

I have heard of some few people who really didn't like the new look, and I recently found out that Apple has not signed the old iOS 6 to allow you to "downgrade" if you already upgraded to 7.  However, mostly, the reaction from people that I have seen and talked to is overwhelmingly positive.

There are some new features that utilize the hardware (and thus drain the battery) more, that I feel most people probably don't want.  So, if you are one of those who upgraded, only to find your battery draining faster, hopefully this will help you out.

1.  Per-App Use of Cellular Data
Definitely, go through the Privacy section of the Settings app, and turn off Cellular Data access to the apps you don't care if they use cellular or not.  For example, all those apps that show ads, you don't need to consume your cellular data plan for that.

2.  Multitasking and Background App Refresh
iOS 7 has greater support for background app execution, which of course means more battery chewed up.  Predictive use based on history means iOS 7 will determine, based on how you use your apps, whether it will allocate background processing to running apps.  For example, if you read your news on the NPR app each morning during breakfast, then before breakfast time if the NPR app is running in the background, it will "wake up" and download the latest news, instantly ready for you during breakfast.  Double-tap your home button and swipe up to "throw out" the running apps you are no longer using.

3.  Location Services
Location Services is Apple's way of making GPS location available to the Apps.  Of course, in order to read the GPS satellites, it has to turn on the antenna and this takes up battery.  There are various aspects of Location Services you can control, such as for what functions you want to make it available.  Some new features that take advantage of this are:

• Location-Based iAds.  When you see Apple iAd advertising banners in apps, it now can target based on your location.  Translation: Apple makes more money from advertisers wishing to target their ads, but using up your battery to do so.
• Popular Near Me.  In the App Store, you can now find out apps that are popularly purchased in locations near where you are.  This might be cool, say if you are traveling, don't want to talk to anyone, and just simply find out what people around you buy.  Me, I say who cares.

Scout through the Settings app and see what other tweaks you can find to improve battery life.  One thing I truly love in OS X 10.9 Mavericks is the Energy Consumption calculation.  If you click on the battery icon in the menu bar, you get a list of applications consuming significant energy - so you can close them out.  I wish iOS had something like that!

Who Prints Source Code Anymore?

As I am writing code, of course I find that my style reflects many decades of pet peeves and wants from writing code.  And nowadays, the programming editor is doing the formatting for me.  It adds spaces around the equal signs, indents, capitalizes, and more.  It allows me to build in self-documentation that pops up as I use my own code.  It is really a huge convenience, and greatly speeds up productivity.

But one thing occurred to me, as I type long lines the editor just scrolls around.  No problem, but then I am wont to go back, make the long lines shorter and go onto the next line, so that they are more readable without scrolling.  Great, but where did that come from?

Back in the old days when they came up with conventions for making code lines span multiple lines in the source file, it was primarily to control where the line breaks when you print it out, and also to reduce horizontal scrolling in the editor.  While the latter need is much reduced nowadays with wider screens, it's kind of funny to think the main reason was to make printed-out code more readable.  Thinking back to all my programming days throughout the decades, how many times did I print?  A lot in the old days, and never in the past what, 15 years or more?

So really, this is a fundamental Human trait - creatures of habit, with practices that stick around long after they are not only no longer necessary, but an actual hindrance.

Just Macing Around

First, I'd like to coin a term - Macing.  "Mac" as in Macintosh (and not the round fruit), so not "Macing" like "I am hitting you with my mace" but more like "Macking" - but the "k" is so harsh.

Second, my work computer lives in a house full of Macs, and they accept it just fine and dandy (although I wish it were one).  They branded it so it feels like one of the family, even though it doesn't bear any of the genetic resemblance.  No rounded edges here, Mr. Lenovo!

So I am sending out a document on my work computer, and it hits me - I wonder what people think when they see the Apple logo on a Thinkpad.  That must give people pause.

And as it does every moment of every day I use Windows, the thought comes to me: why do people pay money for this junk?  Lots of money to - apparently all that money they saved buying the hardware.  Clunky touchpad - my thumbs get tired pushing the buttons.  I much appreciate the touchpad on the Macbook Pro - the beautiful, tactile feel of pushing the entire pad as a button, with the audible click.  I can use my finger both for pointing and clicking and dragging (and 3 fingers for lookup definition, 2 fingers for scrolling, 4 for window management...).

I am constantly worried about backups - the backups I am doing for work (which I would think are every bit as important as the ones I do for home) are iffy at best, not restorable or not all-inclusive at worst.

What do the TSA agents think, when they scan 2 laptops for me through security?  Guess I'm a geek.

I get it, I do - I can understand how people can hate Apple as a company, or even the Apple products. I am still struggling to see how people can try other systems, and then like Windows, though.  That's a poser.  (And by "try" I mean immerse themselves in it to the degree they do in Windows.)

So, if anyone wants to take a stab at it, try to explain it to me?  I had Twitter explained to me a couple weeks ago, finally I get it (not what it is - but why and when to use it).  So I'm not totally brain-dead - just mostly.

Reflections on Windows

Yes, I love the pun in the title.  Each day as I use Windows, which I must for work, I am forced to confront the realities of that environment that have plagued us computer users for decades (and the issues that refuse to go away).  My biggest, single largest pet peeve with Windows (and it only seems to be with the OS, but it could also be the PC hardware), is this stupid feature that I am sure not more than 100 people in the world use.

This feature, I don't know exactly what it is called, but it is probably something like Control Lock.  You know how you have a Caps Lock key that locks all keys in capital letter mode?  There is a key combination you can press (after 38 years I still don't know exactly what it is) that locks the Control key down.  I always seem to press it, or it could be that with the combination of Virtual Machines, Remote Desktop, VPN and Web Meeting, the flag gets set in the system.

Anyhow, with this (and other) mysterious key combinations, Control, and sometimes Shift and Control, get turned on.  And, what's worse, I can't figure out how to turn it off, other than to go hog-wild-crazy mashing random combinations of Shift, Fn, Ctrl and Alt in an epileptic fit, until it eventually goes away.

Does anyone else have this?  Today, none of that epilepsy came through for me, I finally rebooted (which means, disconnect from VPN, try to pause VM's with the mouse not responding properly because Ctrl is locked, and more).  Let's try to identify the key sequences to turn this on and off, if anyone knows please post.

And again, why?  Why exactly do people actually pay money (let alone lots of money) for Windows?  I can understand the PC part, that's inexpensive compared to Macs (on a superficial level).