Just because I am paranoid doesn't mean that they aren't out to get me

My system is dog slow.

Microsoft RootkitRevealer indicates suspicious stuff. (Hmm... maybe a good reason not to upgrade to a newer CPU with VT support.)

My system got slow all of a sudden, when an IP issue came up.

Part of me wonders if my employer is monitoring me. It is, after all, their legal right. (But if they are, I wish it didn't impact my productivity so much.)

Part of me wonders if other miscellaneous bad guys have taken over my PC.

Part of me wonders how embarassing it will be if my PC is infected. Since I work in security.

But I have never pretended to be an expert about the ecosystem of PC viruses, worms, and other malware. I have never pretended to be an expert in detecting malware on my PC.

I have reasonably good, standard, knowledge and practices for how to keep a PC clean of malware. Those rules begin "no active content". Unfortunately, the very fact that I am using a Windows PC means that much of such standard BKMs for security do not apply. E.g. I used the preview pane in Outlook, back when various preview pane related security holes became evident. E.g. I tried for years to send only plain text email, but eventually gave up because of the number of people I correspond with who complained.

Yes, I will be embarassed if my PC has been taken over. But not unduly so. The very fact that a reasonably conscientious and security aware guy like me has to worry about this highlights WHY I want to make security easier to use.

Standby Exit Speed

Continuing occasional notes about excess slowness coming out of standby:

This morning, at home while "hurrying" to find a phone conference number: 13 minutes from standby to where I could use Outlook to see the phone bridhe number salad.

Today, at work, after lunch: 14 minutes.

All these times are from standby, not hibernate.

Fear and Loathing of ... Powering up my PC to see my Outlook calendar

I positively dread having to check my Outlook calendar on my company PC.

This evening it took 12 minutes to get from standby to the point where I could see my calendar - and that 12 minutes was read off the PC clock, so missed 1-2 minutes of boot time.

---

It was better, briefly, when I was using my AT&T Tilt SmartPhone.

"Better", but only a bit - because I was never able to get Bluetooth synch working, and because IT doesn't allow peons like me to use push - it often was out of date. Everyone talks about synchronizing regularly, but only the truly obsessive do so, unless it requires no user action.

"Was", because my SmartPhone fell circa 26" from desktop to carpeted floor - and broke its display, which now displays a rainbow like collection of colors. ATT provides no support, apart from saying "Well, you could not even have bought a warranty from us when you bought the phone, but sometime this summer we will sell warranties for your next phone."
I have not even begun the process of gettingf the manufacturer, HTC, to homor its warranty.
Pity, because I liked the machine. This may be what I get for buying refurbed instead of new.

Toshiba TabletPC back from Repair Depot

I've decided to continue recording every step of my travail with my Toshiba Porteger M400 TabletPC, in case others have similar issues.

Calendar

Today, May 4 2008, I finally got around to working on my Toshiba Tablet PC, which I shipped back to Toshiba's repair depot 4/6/2008, and which UPS says they delivered to me on 04/18/2008. (Leaving it on my doorstep unsecured, I might add.)

12 days for Toshiba to turn it around.

16 days for me to get around to testing it out.

Why so long a delay on my side?

a) after wasting so many days on this machine, I am reluctant to waste more

b) I can't waste any more weekday time, which I must devote all to work (yes, even when I am nit at work). (Originally I had hoped to use this TabletPC as a machine that i could do both work and personal stuff on - a hope that I have almost abandoned).

c) the free time that I was willing to devote to PC maintenance was largely spent on my wife's TabletPC, installing a MIDI keyboard and Sibelius.

d) Basically, the amount of time I have to devote to maintaining personal computers is limited and quantized. When a PC doesn't work out of the box, it is annoying.

So far, this Toshiba has been the most annoying computer I have ever had.

Repair Summary

The Toshiba Laptop Repair Summary (filled in by the Toshiba Technician, shipped back to me) reads:

Date Repaired: April 16, 2008
Technician: MXD4

(other form stuff)

Symptoms:

Unit had defective System Board and CPU. System Board and CPU were replaced, hard drive re-imaged to factory settings. Unit passed all tests. BIOS set, DMI updated.

tech - VistaU,Wifi,bt,2048 Ram,120g hdd,IT Signed,Missing Screws,Stickers,Worn Plastics,Scatches,has stylus,no acc.,S/N Correct on IT,Has System Guard (Last used:Never used),scr lcd mask/lcd top,stkrs faded/frayed,dust under lcd mask,paperwork,Warranty [...]

Glew comments:

"Missing Screws" - not me, probably from the Toshiba recommended repair shop (Northwest Computer Support). I have never opened this computer up - I don't want to mess up warranty.

Worn Plastics - ditto (I think he means the plastic parts inside the case, and/or the case. Given how often this PC has been in the shop for repairs, hardly surprising.)

Stkrs faded/frayed - none of the stickers I can see outside the box seem faded or frayed to me; if he is talking about stickers inside the box, well, again, not me, must be Tishiba or Toshiba recommended service.

Dust under lcd mask - once again, this was either done by Toshiba, the Toshiba recommended technician, or it indicates a design flaw that allows dust to get in.

"scr lcd mask/lcd" - I suppose I might have scratched these in normal use, but if so it almost definitely indicates a design flaw, SINCE I HAVE NOT BEEN ABLE TO EVEN START USING THIS MACHINE YET. If it gets scratched when it has spent most of its time sitting idle, with only a couple of trips to work, ensconced in my Air Targus pneumatically padded bag, and where it sat on my desk unused at work because of these problems- well, again, this indicates a design defect, if it cannot stand up to such modest use.

Clicking Better ; Fan Still Loud

I am happy to report that the horrible, incessant, clicking (as if the keyboard was stuck), no longer seems to be occurring.

At first, I had some hope that the excessively loud fan problem might have gone away: it was quiet, no fan, while Vista asked me the initial questions "What is your username? Password? Etc."

Unfortunately, somewhere in that sequence - around the time I set the desktop background or the timezone - the fan once again went into hyperdrive, and has remained loud ever since.

Time Spent Re-installing for the 3rd or 4th Time

I started "re-installing" this system at 12:57 - actually a bit earlier, that's the fist time I entered. I wonder how much time overall it will take?

---+++ Create Recovery Disks

At the moment, I am creating new system recovery disks (just in case Toshina installed a slightly different OS image than the first time). 3 DVDs; done at 2:26 pm. I.e. roughy 1.5 hours for *that* task.


---+++ WiFi

That was fast... (Now that I keep my WiFi access code on my telephone).

---+++ Backup

I wasted circa half an hour trying to persuade the default Windows Backup to save a backup to my Buffalo Terastation. No luck - I seem to recall that a patch for Vista is needed, probably to disable Vista's quite reasonable new security for backups. Sigh.

I'll skip on this, while moving on to other necessary tasks.

---+++ Software Updates and Configuration

In this day and age, one of the first things you have to do is install all software updates and security patches.

Now, which should I do first? My Virusscanner, or Windows? ...

---++++ Virusscanner - McAfee

McAfee updates itself almost as soon as connected. Then requires a reboot.

Unfortunately, this is the Adware McAfee that comes preinstalled - 60 day trial, pay later. I'll have to uninstall it and install the virusscanner I get free from my ISP. Unfortunately^2, my company's "free to employees" virusscanner does not support Vista.

It is rather sad that McAfee's user registration does not allow you to have special characters and punctuation in your password.

Grrr... I follishly logged in with my "existing" McAfee account - which, of course, expired. So now I am naked on the Internet, courtesy of Toshiba reinstalling my system. I wonder if I can sue Toshiba if I am hacked before I get properly secured.

I'll install Windows security updates, and then go and find my real virusscanner.

Time: 3:09pm.

---+++ Windows Updates

On this new fresh system: 55 updates, 113.3 MB total, need to be installed right away.

GLEW IDEA: I'm pretty sure I've discussed this in public already: we are fast approaching the day when a newly installed computer should start off with all Internet access disabled, except for a dedicated path to download updates as quickly as possible, with nothing else able to access the net.

E.g. it should be running a mini-OS at this point.

Hey, wow! it looks like Comcast has decided to ration my bandwidth - since downloading these security patches makes me look like a net.bw.abuser. I'm still downloading, but really slowly.

3:44pm - restarting after Windows update completed. 35 minutes to do this upgrade :-(

---+++ McAfee Try #2

Uninstalled the adware McAfee,
installed (again) the free McAfee available through Comcast.

(Urgh: have I made myself a target by confessing that I use this version of McAfee?)

4:19pm: I have finally got a virusscanner running.

Looking through various security alerts: should I be running both McAfee and Windows Defender? I don't know. What's the harm? Slowness...

4:42pm: ok, all the security and virusscanning stuff is on.

Moving on ...


---++ Create User Accounts

As soon as the basic install is done, I create an unprivileged user account for normal access.

4:52 - that's done. On to installing the software I usually use.

---++ Installing Software

Software I depend on:
* Cygwin
* Firefox
* mozex plugin
* Quicken
* some sort of Office software - probably OpenOffice, since Microsoft Office is too expensive to buy yet another licence for

Software I am thinking about using
* Thunderbird (had installed it for first time just before TabletPC started misbehaving)

Software that I want to install:
* VmWare

Software I may need to work on my TabletPC:
* Microsoft Visual Studio
* the chip company's /C++ compiler

It is rather sad that admin privileges are required to install so many of these.

Urgh: McAfee decides to deny access to Mozilla Thunderbird. Now how do I persuade it not to do this?

Installing Cygwin, of course, takes hours and hours.

Why Wiki Collaboration Beats Email Collaboration

The local group of wiki evangelists mailed this around.

Comments and wishes:

a) I wish that I had quantitative data on time saved by the faster wiki collaboration cycle compared to the slower email collaboration cycle.

b) Email collaboration can be done off-line - e.g. by an executive (or a Joe Engineer, like me) on an airplane without net access.

c) Email has a built-in gateway function - useful when you are compelled to include organizational enemies in your review list.

d) I suspect something similar applies to SharePoint vs. Wiki. To a first order, you cannot collaborate on SharePoint pages, since the SharePoint editor is so klugey. But SharePoint supports collaboration on documents posted to SharePoint pages, and is better than Wikis (at least lacking WebDAV).
I.e. Wiki wins on collaboration throgh the pages itself.
SharePoint wins on collaboration through documents / attachments.

Version Control Checkout and Sharing of *Partially Populated* Subtrees

I'm on the version control tool warpath again.

I'm a damned good example of why VC tools need subprojects, nested trees, whatever... Never you mind Keith Packard (Mr X Consortium) saying that I shouldn't bother.

At the moment I am messing around with
a) at least 2 diverged CVS trees for my home directory, one on my laptop, one on Linux.
b) a simulator, which uses BitKeeper
c) my own main project, which uses CVS (fortunately, one site only)
d) various other tools at work, using CVS and SVN
e) my TWiki site at work, which uses RCS (although I can make it look like CVS if necessary)
f) friends and coworkers who use GIT

My contributions to b), c), d), and e) make extensive use of stuff from my personal library. But, these other projects do not want to import my whole personal library - rather, they want to import just the modules they need, and their dependences.

Part of my personal source tree is structured as follows:

~/src:

include
" debug.h
" lprintf.h
" MathConst.h
" ag.h
" debug.h
" lfile.h
" libag.h
" simplelock.h
" strfamily.h*
libag
" assert
" bitpattern
" bitvector
" builtin_initialization
" class_name
" code_location
" compile " component
" " SimpleScalar-libag-component
" error
" error_stream
" File_Slurp
" file_slurp
" fmt
" getopt
" getter_setter
" indented_ostream
" Inherit
" interval
" IO_converter
" libuarch
" " cache-array
" " " examples
" " memory_image
" " multilevel_cache
" " SimpleScalar-libag-libuarch
" Memory_Object
" misc
" new-libag-ideas
" " quantiles
" number
" old-stuff-trying-to-reuse
" regd_ptr
" smart_ptr
" stack_trace
" stdio-stream
" test
" thisprintf
" to_bitstring
" to_string
" typename
" types
" unindent
" xml

You get the picture: lots of little modules, each in their own directories or directory trees.

Way back when I started, I put multiple header files in the same directory, like include/debug.h, include/lfile.h. I also created "utility" files like ag.h and libag.h. Over time I learned that it was best to put each module, each header file, in a directory of its own. Such a directory gives you a place to place tests, etc. There is a pattern of repeating the directory name and the include name #include "libag/test/test.h"

Above I have excerpted "header-only" libraries. I also have some C/C+ libraries that need to be compiled, but I have learned that "header only" lubraries, that only need to be #included, are a lot more convenient to use.

Some of my libraries have interdependencies. For example, libag/test/test.hh includes ../code_location/codelocation.hh.
First thing to note: the use of includer relative paths. If I simply copy (cp -R) libag/{test,code_location}, and #include "import/libag/test/test.hh", everything works.

Second, and most important thing to note: a typical user of some (but not all) of my libraries might want a pruned subtree:

import/libag
" test
" code_location

Importing all of libag is just clutter.

I.e. they do not want to import just complete subtrees.

They want to import a pruned subtree - stuff that is in the parent directory, libag, as well as subdirectories such as libag/test and libag/code_location.

I no longer put actual library functions at such parent-root directories. (Alright, I still have some files there, libag/stralloc.h, mainly dating back before I decided to use the "directory per module" pattern.) But I still have metadata there - libag/README.libag, explaining library organization. I also have tools like SConstruct files and files that guide test jig runners, so that I can simply say "make test" or "scons test" in libag, and all the tests run. (My test runner does NOT require a list of all the subdirectories.)
I would like to keep some of that metadata in libag when it is checked out for use by other projects.
I.e. I want all of the file contents of libag, but only a subset of the subdirectories.
I say again: I want a PRUNED SUBTREE of the source.

---

Really, what I want is a version control that makes it easy to share small modules. Not heavyweight subprojects, a la git. Not projects that I have to define in advance, like git or CVSROOT/modules. I want really lightweight modules. Directory subtrees seem to be a very natural way of specifying submodules.
I.e. at the very least I want to be able to do "vcs co libag/test libag/code_location".
Unfortunately, this least thing that I want to do is barely supported by any of the modern version control tools (git, hg, bzr). cvs, oronically, supports it fairly well.

But I want to do better than this least.

Ultimately, I want automatic dependency tracking. I want to be able to say "vcs co libag/test", and have something automatically recognize that I need to checdk out libag/code-location as well. Perl CPAN does it - I want it everywhere.

But I also want to be able to check out libag, with local files, and a pruned set of subdirectories.

---

OK, say I have gotten that far: I can check out just the modules I want.

Next, I want to be able to work in a single workspace - and check things into multiple version control repositories.
E.g. I want to be able to use CVS to check changes made to my libraries back into my personal epositories.
But the other projects that are importing my stuff also want to check things into their repositories. E.g. keiko/imprt/libag/test/test.hh gets BitKeepered, as well as CVS'ed.

Years ago, I gave the CVS community patches to allow this: I allowed there to be multiple CVS metadata directories, e.g. CVS1 and CVS2, and I allowed the user to specify which to use, CVS1 to check into repository 1, CVS2 for repository 2.

I've done similar kluges with BitKeeper and Subversion. E.g. I have checked CVS subdirectories, containg CVS/Root, CVS/Repository, and CVS/Entries files into BitKeeper - so that a bk clone or bk pull can always be kept in synch with CVS.
It is hard to go the other way: distributed version control systems such as git and BitKeeper, that clone an entire repository, *can* be checked into other VC systems, but don't behave nicely, wrt disk space and other issues. The problem: they do not clearly separate the concept of repository and workspace and links between the two.
AMD's "buildlist" methodology - basically a list of all files, and their RCS/CVS versions - lent itself well to this.


---

Reading through some of the interminable "Bzr versus Git versus Hg" comparisons, I see people asking "Who cares about history? You only need the last few years of changes."
Well, I care about history. I have been accumulating code snippets, library functions, and tools for more than 20 years. Some may date back to 1980. I probably have SCCS (!) files dating back to 1985-1987, copied and/or checked into RCS, and then CVS. There are some big gaps in the record, corresponding to periods where changes I made to my libraries were owned by companies, not me --- but I have a long history. Not very dense - some of these tools may sit unaffected for years, e.g. I am just now brushing off PerlSQL - but long lived.
But why care about this history? Well, I *have* on several occasions had to back up to 10 year old versions of some of my library functions, when the flavors of UNIX/Linux changed under me.

More Toshiba TabletPC Woes - the Continuing Story

I still don't have a working Toshiba M400 TabletPC - more than 4 months after I purchased it. I purchased it in part to do my taxes and accounting on, but instead I had to use my wife's HP Pavilion tx1420us Entertainment Notebook PC - another Vista TabletPC.

I swear, I will never again buy a machine site unseen over the Internet!!!! And I will return the machine the moment there is a problem, within the return deadline. Unfortunately, I bought this machine for Xmas, and did not open it up within the requisite 15 days.

I am tempted to say that I will never again buy a Toshiba - but I had a great experience with my last Toshiba TabletPC, a Portege 3505.

I really wish that I could return this new Toshiba TabletPC. Preferably with a refund. Or replace it with a new comparable model of comparable price - although after this experience I am shy of the top end Toshiba/Core 2 Duos. Or even replaced with a working PC of the same model.

I hope that Toshiba will eventually get it all working --- but even so, I have not had any use of it for 4 months, and I would be buying a different model. (E.g. delay repairing a new computer, and the value of the repaired computer plummets.)

I probably just have a lemon. I hope it gets fixed by this trip to the repair depot, as opposed to sending it to the local repair shop.

---

The latest installment: Toshiba authorized return to depot for service. But the shipping container did not arrive before I left for spring break vacation, and there was a 10 day timeout. Reset by a phone call.

One thing that is becoming obvious: I don't have time to deal with this. With work, plus personal computer work using my wife's working computer (taxes, etc.) the times I can pay attention to this Toshiba are quantized, at particular weekend days or timeslots.

---

New fillip: after reinstalling the OS, per Toshiba's recommendation, I now am asked for a power-on password. I am unsure whether it is a hard disk password or a BIOS password, or what.

No matter - I don't think I set such a password. I wonder if the power or keyboard problems I suspect are plaguing this machine are causing this password manifestation?

I will just have to rely on the depot service guys zorching the whole thing.