Keeping Safe Online

(Reposted by permission from Slashdot)

There is a tendency to want the government to do something about every problem, and the hassle of online scumbaggery is no exception. Individuals (and their guardians) need to take responsibility for their own protection, and not expect either the government to protect them (which it cannot) or for faceless strangers to be kind to them, which a tiny but significant portion will not.

Each of these steps solves roughly half of the remaining problems not solved by the previous ones.

1. A fool and his unarchived data are soon parted. If you want it, make an offline copy of it.
2. Switch to Linux, a Mac, or Anything But Windows. Most of the following only apply if this one won't work for you.
3. Switch to Mozilla Firefox.
   
4. Buy and install a firewall box. These are very easy to set up, and will save you a ton of trouble.
   
5. Buy and install a virus scanner.
6. Download and install Lavasoft Ad-Aware or similar spyware detector, even if your virus scanner says it provides that protection.
7. Don't open email with attachments you aren't expecting, or respond to spam with so much as a single click. You have been warned.
8. Stay away from porn sites. They're bad for your computer.
9. Stay away from online games except those you know to be crap-free.
10. You don't know that any of them are crap-free.
11. Don't download commercial music except from commercial vendors to whom you pay a fee. Yeah, sucks to be us. But you get what you deserve, and if you're trying to get something for nothing, you'll give something for nothing in return.

So what do you do if your kids download some game, P2P app, or other crapware-laden piece of stupidity? Take away the computer. What if you have several kids, and you don't know who did it? Enlist their aid and hold them all accountable. Tell them that if any of them downloads crapware and the guilty party won't come forward, they all do their homework at the library (for a week or month or whatever).

The Network Should Never Be Down

That a whole country could be DOS'd is evidence of someone doing a bad network install. The network should never be down.

Lots of companies have a root-and-branches approach to Internet connectivity, too, thinking that each site (or the whole corporate intranet) needs only one gateway to the outside. It leverages a small investment in Internet connectivity for an entire organization. Put all your eggs in one basket, and watch the basket. For the family baked bean recipe confidentiality that's good, but for availability that's bad.

It takes a lot of effort to protect a single address against a distributed Denial of Service attack, in which thousands of virus-infected machines send relatively small amounts of traffic against a target. When that target is a single gateway for an organization, the connection leverage is used in reverse, causing a lot of disruption for a little effort.

The "right" way to do it is to have multiple redundant shared trunks with neighbors. That word "shared" is scary to network administrators (or rather, to their pencil-pushing mentors). It means they'll have to carry outside traffic on their pipes (that's a metaphor, Senator), and that has risks: it costs money, and it has the potential to allow someone to see inside the network.

It takes a lot more effort on the part of the bad guys to attack multiple addresses, and with a multi-trunked network, keeping one or two gateways up can keep the whole network working.

The rewards for sharing bandwidth are enormous: multiple ISPs mean allowing TCP/IP to do its job, routing traffic to avoid disasters like DOS attacks, hurricanes, and nuclear bombs. The ISPs and other bandwidth partners know they have an interest in helping to protect your network. The technical risks can be mitigated simply by routing and tunneling.

Is the above realistic? Nope. Not in a corporate environment, anyway. I'd be really surprised if anyone outside academia or pure ISP does shared trunking anymore.

But it can also happen at the leaf nodes: you and your neighbors share cable broadband and DSL connections, routing through wifi. That violates most subscriber agreements, but it's the way the protocols were designed to work. Your network should never be down.

Never.