Friday, December 22, 2006

The 2007 security focus in my world



After reading the various links on the web of 2007 predictions for both IT and Security, I asked myself "What are we going to do in 2007?"



1)It is clear that spam will continue to be a big problem. The new email born threats will be via images and video clips. It makes sense then to strip those images and mpeg files at the email gateway. Users won't like it, but think of it this way: We are saving our users from network death by infection. They don't appreciate losing network services and access to resources and we don't appreciate the clean up efforts.Equal ? We will also be regularly scanning our file servers for files of that type and just blitzing them, no questions asked. Downloading these types of files is forbidden by policy



Let our systems be configured to continually check for updates which is the sole solution. I have not had a virus infection in previous 1 year.



2)We may migrate to Firefox as the web browser of choice.I still believe (see, there's the passion) that Firefox is going to protect my web surfing experience sooner and more reliably than IE. And no, we have not migrated to IE7 because we don't trust it yet. Microsoft still has a consumer confidence problem when it comes to security.



3)And we can include the migration to Vista into the same distrust bucket. If I had my way we would go open source all the way around. However, we are upgrading our hardware (who would've thought you would need 2GB of RAM on a desktop computer?) As much as I love and am passionate about open source on the desktop, it's just not quite ready for enterprise prime time. Not because the product is not great, but because of the end (L)user learning curve we would face.



4)Our biggest focus should be encryption in 2007. We aren't going mobile or doing VoIP. We are just concentrating on the basics and doing those things well. We shall be encrypting network traffic, hard disks, file systems, etc



5)And on the base is security awareness training because we have found that no matter how hard we work, our end users will find a way to unknowingly circumvent security technology. We need the end users in our camp and on our side helping us fight the war against hackers and spammers.



I'd like to hear what your organization is doing to improve security in 2007.

Sunday, December 17, 2006

SSH keys and SSH key generation

SSH keys and SSH key generation

Background and Terminology:

SSH - Secure SHell: SSH is both a program and a network protocol that provides strong authentication and secure encrypted communications between two machines over an insecure network. It is designed for logging into and executing commands on a remote machine, as well as moving files back and forth between the two machines. SSH has various authentication mechanisms and the most secure is based on keys rather than passwords. Using keys, SSH can authenticate you to all your computer accounts securely without the need to memorize many passwords or enter them repeatedly. SSH generates a private and a public key. The public key can be put on the machines you wish to communicate with. SSH will then connect to those machines with keys instead of your standard account password. SSH protocols: SSH1 and the SSH-1 protocol were developed in 1995 by Tatu Ylonen, a researcher at the Helsinki University of Technology in Finland. It is still distributed and maintained, though not actively developed (bug fixes only). SSH2 and the superior SSH-2 protocol were released in 1998. SSH-2 is a commercial product, but is available free for use by qualifying educational entities. Public-Key Algorithms used by SSH: The Digital Signature Algorithm (DSA) was developed by the U.S. National Security Agency (NSA), and promulgated by the U.S. National Institute of Standards and Technology (NIST) as part of the Digital Signature Standard (DSS). DSA can only be used to provide digital signatures and can't be used for encryption. DSA has an intrinsic weakness which makes it very easy to create a signature which contains enough information to give away the private key! The Rivest-Shamir-Adleman public-key algorithm (RSA) is the most widely used asymmetric cipher. RSA can be used for both encryption and digital signatures. It is currently difficult to obtain the private key from the public key.

Generating the SSH key pairs

In this tutorial there will be two machines represented:
[user_name@local_host ~]$
This will represent the user's account on the local machine - the machine that you are physically sitting in front of.
[user_name@remote_host user_name]$
This will represent the user's account on the remote machine - the machine that you will be accessing via ssh. To create the public and a private keys, on the computer from which you will be connecting to various computers, generate SSH key pairs as follows (I recommend using the RSA algorithm):
[user_name@local_host ~]$ ssh-keygen -t rsa -b 2048
Generating public/private rsa key pair.

Note:
The -t option specifies the type of the key to create. The possible values are:
  • rsa1 for SSH-1 protocol
    The file in which you save the keys should be in /home/user_name/.ssh/identity
  • rsa for SSH-2 protocol
    The file in which you save the keys should be in /home/user_name/.ssh/id_rsa
  • dsa for SSH-2 protocol
    The file in which you save the keys should be in /home/user_name/.ssh/id_dsa
The -b option specifies the number of bits in the key to create. The minimum is 512 bits and the default is 1024 bits. Generally, 1024 bits is considered sufficient.
Enter file in which to save the key (/home/user_name/.ssh/id_rsa): [press enter]
If you get the following message after you press enter to save the key:
/home/user_name/.ssh/id_rsa already exists.
Overwrite (y/n)?
It means that an SSH key of that type was previously created. It is up to the user to decide whether or not to overwrite the existing key. It you decide to overwrite the existing key, any machine that you were previously accessing with key authentication will now fail.
Enter passphrase (empty for no passphrase): [press enter]
Enter same passphrase again: [press enter]

Note:
The passphrase is basically the password for your key and the simplest approach is not to set a passphrase. For certain purposes, this is necessary (such as cron jobs) since no opportunity will be presented to provide passwords. Hence a passphrase-less key is called for. There is a problem with this: if your private key is stored unprotected on your own computer (meaning an empty passphrase), then anybody who gains access to it will be able to generate signatures as if they were you. This is the reason your private key is usually encrypted when it is stored on your local machine, using a passphrase.
Your identification has been saved in /home/user_name/.ssh/id_rsa.
Your public key has been saved in /home/user_name/.ssh/id_rsa.pub.
The key fingerprint is:
1a:2b:3c:4d:5e:6f:7a:8b:9c:0d:1e:2f:3a:4b:5c:6d user_name@machine_name.bscb.cornell.edu
[user_name@local_host ~]$
There are two files generated: one with and one without the .pub extension. The one with .pub extension is your public-key and can be safely divulged. The other is your private-key and must be safeguarded from being read by others. Now that you have generated your key, you will need to put your public key in the authorized keys file on all of the machines you want to connect to using ssh. You will do this using scp. SCP (Secure Copy Program) is a utility which copies files between hosts on a network. It uses ssh for data transfer, and uses the same authentication and provides the same security as ssh. The general form of the command is:
[user_name@local_host ~]$ scp source-specification destination-specification
In the case above we will use:
[user_name@local_host ~]$ scp /home/user_name/.ssh/id_rsa.pub remote_host.bscb.cornell.edu:/home/user_name/id_rsa.pub
SCP will prompt you for the password to the remote machine. After entering the password, the public key will be copied into your home directory on the remote machine.
Note:
If this is the first time you have connected to this particular remote_host, you will see something like:
The authenticity of host 'remote_host (132.236.123.102)' can't be established.
RSA key fingerprint is 17:a7:ac:13:07:5b:5d:2b:d7:22:16:c7:61:01:20:33.
Are you sure you want to continue connecting (yes/no)?
Type yes and press enter if you are sure that you are connecting to the proper remote_host.
The next thing that we need to do is connect to the remote machine via ssh:
[user_name@local_host ~]$ ssh -l user_name remote_host.bscb.cornell.edu
user_name@remote_host.bscb.cornell.edu's password: [enter user_name password]
Now that we are on the remote_host, we need to concatenate the contents of the public key to a file called authorized_keys which is located in the .ssh directory of your home directory.
[user_name@remote_host user_name]$ cat /home/username/id_rsa.pub >> /home/username/.ssh/authorized_keys
Be sure to use the double ">>" so you do not overwrite any other authorized keys you may have already added to the authorized_keys file. You can then remove the id_rsa.pub file from your home directory since it is no longer needed.
[user_name@remote_host user_name]$ rm -f id_rsa.pub

Optional:
Your authorized_keys file should now look something like this: ssh-rsa AAAAB3NzaC1y ... gwWhN/sYw== user_name@machine_name.bscb.cornell.edu If you are familiar with editing files using vi or emacs, you can add an additional security feature to the ssh key. By adding the hostname of the local machine from which you will be connecting to the ssh key, you further restrict machine access. First, we need to obtain the hostname of the local machine:
[user_name@local_host ~]$ hostname
machine_name.bscb.cornell.edu
Next, we will add this information to the appropriate entry in the authorized_keys file:
[user_name@remote_host user_name]$ vi /home/user_name/.ssh/authorized_keys
Add the hostname information obtained above to the beginning of the appropriate key as such: from="machine_name.bscb.cornell.edu" The authorized_keys file should now look something like: from="machine_name.bscb.cornell.edu" ssh-rsa AAAAB3NzaC1y ... gwWhN/sYw== user_name@machine_name.bscb.cornell.edu

Setting Permissions:

Lastly, we need to ensure that permissions are set correctly. The .ssh directory should have permissions of 700 and the authorized_keys file should have permissions of 644. SSH will totally ignore the keys if the permissions are not correct.
[user_name@remote_host user_name]$ chmod 700 /home/user_name/.ssh
This will allow read, write and execute permissions on the directory for the owner, and give no permissions to everyone else.
[user_name@remote_host user_name]$ chmod 644 /home/user_name/.ssh/authorized_keys
This will allow read and write permissions on the file for the owner, and give only read permissions to everyone else. At this point, when you ssh into the remote machine you just copied your public (possibly edited) ssh key into, you will no longer be prompted for the user_name password.

From Cornell University Page

Saturday, December 16, 2006

Securing and Hardening Red Hat Linux Production Systems

A Practical Guide to Basic Linux Security in Production Enterprise Environments

Written by Werner Puschitz

This article is a practical step-by-step guide for securing Linux production systems. It discusses basic Linux Security requirements for systems that need to pass various audits in an enterprise environment. If you work on a corporate Linux Security Standard, or if you do Sarbanes-Oxley Act (SOX) or Statement on Auditing Standards No. 70 (SAS 70) related work, then you will find useful and practical information here


Link : http://www.puschitz.com/SecuringLinux.shtml

Monday, December 04, 2006

How to mount your NTFS volume to Linux

This is a handy post for people who have installed linux and WindowsXP side-by-side and want to have interoprability between them.

A linux-ntfs interoperability project has been constituted at http://www.linux-ntfs.org/ .You can get the necessary details from this page.Also the OS forms we are dealing with are Redhat,Ubuntu.

Choose one of the following three options:

1) Linux has an integrated kernel driver. It allows reading of files, and rewriting existing files. It does not support creation of new files or deletion of existing files. It works out of the box in most modern Linux distributions except Redhat/Fedora.The kernel contains the different filesystem supported as modules.By default other legacy filesystems like FAT,DOS etc are supported,but NTFS is not natively supported.

First of all, check your partitions using hardware browser or fdisk utility through command prompt to know exact linux partition number listing

Check mounting using these commands:

# mkdir /mnt/windows
# mount /dev/ (eg: hda5) /mnt/windows -t ntfs -o umask=0002,nls=utf8


If NTFS is not supported, we get error messages.What we have to do is to download approprate NTFS kernel module and install it.We can also issue command for FTP update of kernel module

Open a terminal.Be root user using command

# su -

and issue:

# yum install kmod-ntfs (for uniprocessor)
# yum install kmod-ntfs-smp (for dual core)

Otherwise search for kernel drivers for NTFS in the net and install manually.Once again issue above said commands:

# mkdir /mnt/windows
# mount /dev/hda1 /mnt/windows -t ntfs -o umask=0002,nls=utf8


Add the entry permenantly to fstab file :

/dev/hda1 /mnt/windows ntfs ro,umask=0002,nls=utf8

This is it.Restart the OS for changes.

2) ntfsprogs includes an improved driver, ntfsmount, which provides the same functionality as the kernel driver. Additionally it also supports basic cases of directory, symlink, device and FIFO file creation, deletion and renaming. Note: That doesn't mean it always succeeds, it is still experimental and might just as well refuse to complete an operation in order to prevent corruption. See the ntfsmount page for more details.

3) On 07/14/2006, project member Szabolcs Szakacsits presented a new version of ntfsmount and libntfs, given the project title ntfs-3g. This version has full read/write capabilities, many bug fixes and improved performance. It has already been downloaded over 66,000 times, tested and regularly used by users with satisfaction over the last three months. Despite of that it is still a strong beta, and will upon (in some way or the other) merge also into the linux-ntfs ntfsprogs package.

The beta version of the ntfs-3g driver can be downloaded from http://www.ntfs-3g.org

You can use the abovesaid three methods based on situations.In the first and the normal method, i had elaborated the steps exhaustively.

Sunday, December 03, 2006







Stage6 from Divx

I like this idea, like Youtube, the developers of the divx codec have got a social video site that has full dvd type quality movies... for those with broadband2 (ie ADSL2) it works pretty sweet.


Perhaps Google, having now purchased YouTube, might consider a part of YouTube for high quality video with their massive bandwidth. It is one of the things that currently sucks about Internet video - watching crappy quality in little square - when I can turn on my TV and get a nice large good looking picture (even if in reality it is fairly low resolution... unless you have a HD-TV of course).


From CodeMonkey Blog

Friday, December 01, 2006

Server setup of wireless LAN over the wired LAN as part of Wireless Workshop at IIITMK

Overview: Wireless Local Area Networks (WLAN) are implemented as an extension to wired LANs within a building and can provide the final few meters of connectivity between a wired network and the mobile user. WLANs are based on the IEEE 802.11 standard. Most WLANs operate in the 2.4 GHz license-free frequency band and have throughput rates up to 2 Mbps. WLAN configurations vary from simple, independent, peer-to-peer connections between a set of PCs, to more complex, intra-building infrastructure networks

In a typical WLAN infrastructure configuration, there are two basic components:

  1. Access Points - An access point/base station connects to a LAN by means of Ethernet cable.A building may require several access points to provide complete coverage and allow users to roam seamlessly between access points.
  2. Wireless Client Adapter - A wireless adapter connects users via an access point to the rest of the LAN. A wireless adapter can be a PC card in a laptop, an ISA or PCI adapter in a desktop computer, or can be fully integrated within a handheld device.

Server : rbs.iiitmk.ac.in

Configuration : Adding a host with IP and MAC into the DHCP Pool of IP’s so that is is detected automatically by the DHCP when the wireless LAN is up within the network.

Background : IIITMK is having a wired LAN with 2 proxies at two end-points of service - one at Park Center and one at Nila facility.Wireless routers have been purchased for setting up wireless LAN over the wired LAN in the institution.A wireless test machine has also been set up with a wiki suite running on it for further activities in the wireless area.The first event organized associated with it is a ‘Workshop on Wireless Technologies’ with many international participants with it.The event had the wiki site running and to be accessed by every registered participants having notebook PC’s at the end-point.

Step 1 : First the wireless machine is set with the internal static IP addressing scheme.The wiki is running in it and is to be accessible to the wireless LAN.The static IP should be unassigned in any part of the LAN.For this, we have to lookup on the static IP tables assigned on the dhcp.conf file of the server.

Step 2 : Log on to the server rbs.iiitmk with root-level access privileges obtained from sysadmin and add WLAN host to the DHCP

#vi /etc/dhcp.conf

line 121/22 : host DabbaWLANTestServer { hardware Ethernet ;

fixed address ; }

Step 3 : Add an entry to the forward lookup file describing our wireless domain.The lookup file was in chroot directory as it has been mounted via chroot by sysadmin for backing up.

#vi /var/named/chroot/var/named/iiitmk.forward

EOF > commwireless IN A 192.168.0.70

Step 4 : Restart the dhcp service

# service named restart

Wireless LAN

http://en.wikipedia.org/wiki/Wireless_LAN

Protocol

http://en.wikipedia.org/wiki/IEEE_802.11

DHCP Information

http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

DHCP Reference

http://tldp.org/HOWTO/DHCP/x369.html#AEN382

For information on DNS lookup, refer

http://wireless.about.com/od/workingwithipaddresses/qt/ipaddresslookup.htm

Note : Some information excluded due to confidentiality.Systems and services policy lies with IIITMK System administrator

Wednesday, November 29, 2006

Follow up : Installing a Zwiki instance inside the Plone website for health portal at IIITMK

Introduction: Zwiki is an easy-to-use, fun, and powerful wiki engine based on the Zope web application server; it also works well with the Plone CMS.

Server : health.edugrid.in

IP : 192.168.1.27 B'cast :192.168.1.255

URL : for Zope, Admin interface is at:

http://localhost:/manage

Zwiki can be run as a component of the Plone Website under the Zope server.For adding the Zwiki component for Plone,first we have to check if Zwiki option is there in "Add components" scrollbar.By default,it will not be there.

Then,we have to download the latest zwiki source tarball from the homepage of Zwikihttp://zwiki.org.
Next step is to copy it to the folder Products inside the Clients component of the zope server.For this we have to go to zope install folder,and to the products folder.

In a Plone installation,the products folder can be found inside the zope instance or zeocluster.Remember,we have to configure a zwiki inside the client1 instance and not server instance of zope

Procedure:

# cp Zwiki-ver.tar.gz /~Plone/zeocluster/client1/Products/
# gunzip -c Zwiki-ver.tar.gz | tar xv

1) Logout from Zope Admin interface.Login as admin and choose 'add components' tab from the top right portion of admin interface.Components like Zwiki,Zwiki page,Zwiki outline cache... will be displayed there.

















2) Try selecting Zwiki(first option)as it will have most extensive functionality.We can edit the contents of the wiki page in the admin interface as we like or view the pages in View tab.

































Now the wiki page is functional and ready for customization.

Thursday, November 23, 2006

Installing and configuring Plone version 2.5.1 for Health portal at IIITMK



Introduction : Plone is an open-source content management system built on top of the Python application server Zope and its accompanying Zope Content Management Framework. Plone is free software and is designed to be extensible. It can be used as an intranet or extranet server, document publishing system, and groupware tool for collaboration between separately located entities.High-load production internet sites should not run on a setup without using caching via Apache/Squid in front, combined with CacheFu Plone product.


Requirement 1:Should install Plone with compatible PHP and MySQL version running on a compatible Zope version.



System Configuration : Redhat Enterprise Linux 4(Enterprise Server)

Hostname : health.edugrid.in

IP : 192.168.1.27 B'cast :192.168.1.255



Running servers:



1)Apache 2.0



Configuration file : /etc/httpd/conf/httpd.conf




Port changed to 8000 from 8080




2)Tomcat 5.5.15

Configuration file : /data/tomcat/conf/server.xml



Connector port configured on 80(default localhost)



Scripts : /data/tomcat/bin/*.sh



Installation process



Step 1)Download Plone-2.5.1-UnifiedInstaller.tgz on /data and extracted using command # zcat Plone-2.5.1-UnifiedInstaller.tgz tar xvf -

Step 2)cd to Plone-UnifiedInstaller

vi install.sh



Changed Install dir to /data/Plone-2.5.1 within this file

Step 3)Run the scripts using command ./install.sh



Now a Zope Server is running on 8080 and clients Client1 and Client 2 listening.The particulars of Zope Server are:

Version :



Configuration file : /data/Plone-2.5/adminPassword.txt



/data/Plone-2.5/zeocluster/server/etc/zeo.conf



data/Plone-2.5/zeocluster/client1/etc/zope.conf



/data/Plone-2.5/zeocluster/client2/etc/zope.conf



To start Plone, issue the following commands in a Terminal window:sudo



/data/Plone-2.5/zeocluster/bin/startcluster.sh




To stop Plone, issue the following command in a Terminal window:



sudo /data/Plone-2.5/zeocluster/bin/shutdowncluster.sh



address 8100 but running on 8080

Requirement 2: Contains Apache,MySQL(prerequisites).Doesnt contain Zope or PHP.So selected Plone-UnifiedInstaller which can compile Plone along with Zope and PHP from source.



Python version is 2.3.4



We can access Zope homepage from http://localhost:8080/



Caution : Even if we install Plone as root user in Linux, we should login as an enabled user(eg: zope) so as to access zope management interface.This could be explained as the Zope is installed both as server and client instance.Server instance runs on port 8010 and client instance listens on port 8080 which is a web server port.So, we have to access the client listener interface with the client permissions.







Step 4)We can access Zope management console from http://localhost:8080/manage or http://localhost:8080/manage_main(If password is provided)



























Step 5) From the management console,got to drop down menu having add option.Add Plone site from here having particulars:























Id - Plone

Title - Health Portal Test

Description - This is a test site for Plone Installation in Health Server



Step 6) Go to Homepage option and Enter the welcome message.Now, your Plone instance is ready and displayed.

































Itemwise display of Tests









































































































































Item





Server





Test to be carried out





Test result expected





Status





Port change of apache from 8080 to 8000





health.edugrid.ac.in





Add new port entry to httpd.conf and restart server





Server restart successful with localhost 127.0.1.1





Passed





Download and install Plone source with Zope and Python with root access





health.edugrid.ac.in





Changed port entry in zeo.conf of zope server and tried starting the server





Zope Server started with port as 8080





Passed





Add Plone instance as Test site for health server





health.edugrid.ac.in





From management console,added an instance of Plone





Plone default webpage at http://localhost:8080/manage





Passed





Add user home for Plone site inside test page





health.edugrid.ac.in





From management console,added the user homepage





User page and configuration





Testing underway

Monday, November 20, 2006

Linux Command Reference

The following links can be useful to any one who is working in any form of UNIX and its most sought-after flavour-Linux.I am giving categorized links for those who are starting bottom-up and want to do lots of things in this wonderful open source Operating system including system administration, networking and application development:

  1. Linux Tutorial : "The place where you learn linux" http://www.linux-tutorial.info/index.php
  2. The Linux Documentation Project http://www.tldp.org/
  3. YoLinux Information Portal http://www.yolinux.com/
  4. Linux Command Directory http://www.linuxdevcenter.com/linux/cmd/
  5. Linux.org : Comprehensive linux reference http://www.linux.org/

Geeks Log....

Hi All, this blog space is taking a paradigm shift in content.From now on, i will be updating this with Linux and Java Stuff that i had been working with and which i find relevant to disclose to world.Aim is to make it searchable and easy to follow for those people who are fighting it out there with these issues.With lots of regards !!!

Friday, September 22, 2006


Zune joins the fray as iPod gains the platform



Apple and Microsoft traded punches in a new fight over digital music - but it was rivals who felt the pain.

The gloves are off... almost. After months of waiting, the first real volleys have been fired in the long-anticipated digital music war between Apple(NASDAQ: AAPL)and Microsoft(NASDAQ: MSFT).

It kicked off with Apple, as Steve Jobs unveiled revisions to the iPod range and added some extra features. He finally lifted the curtain on the heavily-trailed movie download service, offering American customers downloaded Disney-produced films such as Pirates of the Caribbean: Dead Man's Chest and Cars.And there has been, unusually, a preview of a set-top box system, temporarily called iTV, which will stream media files sent wirelessly from a Mac or PC to a TV set. Such a gizmo is not a new idea - but where others flopped, industry watchers say Apple could have the market muscle to push forward where predecessors have feared (or failed) to tread.

Microsoft, meanwhile decided it also needed a splash of colour - and, somewhat bizarrely, plumped for brown. It waited until the day after Apple's announcements to lift the lid on Zune, its own attempt to break the music market open. Zune, which will reach US shops by Christmas but still has no confirmed price, exposed itself as a revised version of Toshiba's Gigabeat player with a bigger screen and smoother looks.But it's what's on the inside that counts - and there are a couple of features Steve Ballmer will hope can lift Zune above the crowd. It offers wireless connectivity, though shared files (only of purchased songs, not those ripped from your own CDs) with a very limited lifespan - three days or three plays, whichever is first. Some say Microsoft's restrictions are likely to seriously limit any real impact of the feature, despite indications that young users are increasingly interested in sharing music via their mobile phones.

One blogger summed it up succinctly. "I've often wished I could somehow share full-length sample tracks of select songs," wrote Pauldwaite. "Thank goodness Microsoft is here to help at last."

The other difference inside Zune could be the crucial one, however. In a remarkable change of direction, it ditches Microsoft's long-held faith in the digital rights management (DRM) system that it developed and has promoted for previous Windows-only players. Despite the heavy promotion given to the PlaysForSure format, used by services such as Napster, the Zune for sure won't play tracks protected by that DRM. Instead, it will ape Apple's closed system, hooking into a specific download store for purchases while offering support for unprotected Windows Media Audio (WMA), MP3 and AAC files - the latter meaning that iPod owners can find a new home for any music ripped in Apple's default format, though not any tracks direct from the iTunes Store.

The news was a punch in the gut to many companies supporting PlaysForSure, and even J Allard, the Microsoft vice president who helped mastermind the rise of Xbox and now oversees Zune, struggled to explain the U-turn.

"PlaysForSure is still a program we're going to invest in, we still have a lot of partners there, and for a class of consumers who want to have a handcrafted media experience and maximise their choice, we have an answer," he told the Engadget blog (tinyurl.com/ksgqd). "There's another class of consumers that just want digital media, and they just want to be able to go to one store and have it all just plain, dead simple, and don't want to know what a codec is."

Vendors who had lined up behind PlaysForSure believing it was that simple solution - among them Napster, MTV's Urge, Creative and Samsung - may have been surprised. While Microsoft's decision to pitch into the digital music hardware market - a move as guaranteed to irritate its numerous partners as if it began making PCs - will not have been taken lightly, this battle plan has clearly been coming together for some time. When a parody video about Microsoft packaging the iPod (tinyurl.com/ks8m8) circulated online this year, it drew laughs; now it is obvious the film (leaked from inside the company) underlined a new strategy to fight fire with fire. Ballmer confirmed the development program in an interview with Fortune magazine in March.

"The Zune announcement led to domino-like reactions and repercussions in the industry. On Monday, Real Networks announced a partnership between its Rhapsody service and device maker SanDisk, to try to create another end-to-end solution and include preloaded content on players.Rumours indicate other interested parties as diverse as Nokia, T-Mobile and Sony are poised to follow suit."


Mark Mulligan, an analyst with Jupiter Media, says Redmond's decisions are based on long-term fear that Jobs will turn the iPod and its ecology of add-ons into a much wider platform. "Microsoft doesn't want Apple to develop a strong position in the media player business, and that includes PC," he says. "At a strategic level, they're probably not that concerned at making revenue from music... but the problem is that Apple is beginning to squeeze into Microsoft's digital home strategy."

And while Microsoft closes ranks, some of the features added to the new iPods indicate expansion, albeit limited, of Apple's vision. Aside from iTV's obvious charge into the living room, the addition of games for the iPod, on sale via the iTunes Store in the same way as audio or video content, marks a watershed. Games are software; if non-Apple companies write software for the iPod, it begins to resemble a platform. As Microsoft understands, platforms can emerge where business happens, and vice-versa; it's a virtuous circle.

With the battle focused heavily on music, the danger is that this could be the start of a very painful transition. Despite rapid growth in recent years, digital music accounts for just 6% of music industry revenues, and a scrap between two bloody-minded and well-funded rivals could spell trouble for everybody else caught up in the fight.

"There isn't an infinite market in digital music," Mulligan warns. "But either way, we're a long, long way from the digital home: we're not talking about the Jetsons... this is still the Flintstones."

Tuesday, June 20, 2006

My New Found Love

Get more for less with the eye-catching, yet affordable, Motorola C168. Featuring a color display and packed with the best of the basics for everyday communication, this slim mobile really delivers. Equipped with Multimedia Messaging Service (MMS) to add pizzazz to everyday texts, excellent battery life, a sleek design and FM stereo radio for your listening pleasure via a headset accessory, the Motorola C168 is the perfect phone to meet all your needs – in the office and beyond.

Looking Good
With its stylishly thin design, uncompromised quality and budget-pleasing price tag, the lightweight Motorola C168 makes a sophisticated statement. A brilliant color display on the sleek black and silver face completes the package.

Simple Smarts
If you crave conversations without complications, the Motorola C168 delivers a suite of simple solutions. Use SMS Chat to converse quickly, send an MMS with images and sound or just make a call – it’s all easy with iTAP predictive text entry and a large color screen. Enjoy long talk times – over 8 hours**. What’s more, you won’t worry about your phone making calls when you don’t want to – the keypad can be set to lock automatically between uses.

Work and Play
Throw away your organizer – the Motorola C168 stores up to 600 phonebook entries and 250 SMS messages, and also provides a calculator, calendar and alarm clock. When it’s time to relax, compose your own ringtone, play a pre-loaded game or download new wallpaper and screensavers. Time to groove? Tune into a favorite FM station, plug in your stereo headphones and enjoy.

SUMMARY OF FEATURES:

• Sleek, stylish and affordable
• FM stereo radio
• Downloadable wallpaper, screensaver and ringtones
• MMS and SMS
• Store up to 600 phonebook entries and 250 SMS messages
• Polyphonic ringtones and the ability to compose one-of-a kind ringtones
• Pre-loaded games
• WAP 2.0 and GPRS for Internet access
• Up to 550 minutes of talk time** and up to 340 hours of standby time**
• Multiple letter phonebook search and zoom font during dialing
• Calendar, alarm, calculator and stop watch


MOTOROLA and the Stylized M Logo are registered in the US Patent & Trademark Office. All other product or service names are the property of their respective owners. © Motorola, Inc. 2005.

Friday, June 09, 2006


Dan Brown's holy dreck get the half-assed treatment it deserves

The Da Vinci Code / Jeremy C. Fox

For once in their charmed lives, it’s possible to pity Ron Howard and Tom Hanks. After all the media hype and Christian vitriol, how could their adaptation of Dan Brown’s 40-bazillion-selling thriller The Da Vinci Code be anything but a disappointment? Though the book has apparently entertained about a quarter of the world’s population, it’s nothing more than a slim, overcomplicated premise supported by characters that are about as three-dimensional as the guests at Charles Grodin’s “party” in The Lonely Guy and dressed up in overheated prose that makes Dean Koontz look like Gore Vidal.

I spent the past couple of years inwardly mocking Da Vinci Code readers and loathing Brown for his ignorance — anyone who knows a thing about art history knows that the man’s name was Leonardo, fer Chrissakes; he had no surname; “da Vinci” just tells you that he was from a little town in Tuscany — that is, until I drew the short straw and agreed to review the movie version, and my sense of responsibility required that I at least find out what all the hubbub was about. So I finally read the damn thing — as surreptitiously as possible — thinking that it couldn’t be that bad. Well, it is and it isn’t. From the outset, it’s clear that Brown is a prose stylist like I’m an ice dancer. Here’s the very first paragraph of the prologue:

"Renowned curator Jacques Saunière staggered through the vaulted archway of the museum’s Grand Gallery. He lunged for the nearest painting he could see, a Caravaggio. Grabbing the gilded frame, the seventy-six-year-old man heaved the masterpiece toward himself until it tore from the wall and Saunière collapsed backward in a heap beneath the canvas."

The thing is, while you’re reading the book, it seems very cinematic. Brown builds suspense by constantly cutting back and forth between a variety of situations, building to a series of mini-climaxes that keep you wondering just what bizarre twist he’ll come up with next; it’s a crude technique, but it’s effective at drawing you in. Yet the book is far too talky to be easily adapted for film; it’s all plot and exposition. If you were to take just the speeches that explain its mythology and read them aloud straight through, it would more than fill the movie’s two-and-a-half-hour running time.

The only way to make the movie work would be to somehow stay true enough to the source material to please its millions of fans while rejiggering it sufficiently that the characters had some depth, the dialogue resembled human speech, and the exhausting, headlong rush through two millennia of pseudohistory actually seemed to make sense; if there’s a way to go about that, I’ll be damned if I know what it is. Certainly, I wouldn’t begin by hiring Akiva Goldsman to write the screenplay. Here, in full, are Goldsman’s screenwriting credits to date: The Client; Silent Fall; Batman Forever; A Time to Kill; Batman & Robin; Lost in Space; Practical Magic; A Beautiful Mind; I, Robot; Cinderella Man; The Da Vinci Code. Anyone sensing a trend here? Like maybe a tendency to take existing material that’s already shallow, bland, and conventional and find a way to somehow make it shallower, blander, and so predictable you can guess the ending before the opening titles are over? (I’m willing to exempt parts of The Client, A Beautiful Mind, and Cinderella Man from my excoriation, but only because Susan Sarandon and Russell Crowe can pull off almost anything.) It’s worth noting that there is but one title on the list (Silent Fall) that isn’t an adaptation, and that, on five of the 11, Goldsman had a credited co-writer and — WGA-arbitrated credits being what they are — God knows how many uncredited ones. With a track record like that, an uncharitable person might be tempted to guess that the other writers contributed any parts of those scripts that worked; a more generous soul might just say that Goldsman is an enormous hack. At any rate, it’s safe to assume that it’s been a long time since he’s had a normal, non-Hollywood conversation; his tin ear for dialogue is metallurgically surpassed only by the lead pipe with which he drives home a point, any point.

Then there’s The Ron Howard Problem. Howard has never been a particularly distinctive director — name me a signature Howard touch, I dare you, and excessive schmaltz doesn’t count. Like Robert Zemeckis, he’s strictly Spielberg-lite: all of the boys-with-toys flash and the reactionary fantasies (Why can’t it be the ‘50s again, Mommy?) with none of the master’s flair. Howard has some talent, but he relies too much on cheap audience manipulation; indeed he’s at his best when, like a sleight-of-hand artist, he keeps us too distracted by what’s going on up front for us to notice how willfully he’s gouging at our emotions. Which is not to say that he can’t occasionally deliver a worthwhile film, particularly when he has the right leading man; Crowe was able to offset Cinderella Man’s Horatio Alger corn with enough genuine feeling that it slipped right through my cynicism bubble, and Apollo 13, despite its grueling length, managed to keep me involved in the astronauts’ plight, largely due to Hanks’ engaging Everyman quality. What’s disappointing is that, while Howard was able to maintain suspense in both those films despite our foreknowledge of how everything would come out, in The Da Vinci Code — whose central themes, if not all aspects of its resolution, are almost universally known by now — everything feels slack and uninvolving almost from the get-go. The characters are too blandly inhuman for us to really care about their fates; even the considerable charms of Hanks and Audrey Tautou aren’t enough to compensate for their characters’ limp conceptions. (Though Ian McKellen is just grand, delivering each hambone line with relish — what is it about classically trained British actors that they always have such infectious fun with over-the-top characters?) The endless convolutions of the plot, which were often genuinely thrilling on the page despite Brown’s inept writing, just seem like one damn thing after another, with no real purpose except that Scene H makes no sense without Scene G, which must follow Scenes E and F. Ironically, the film serves as a useful critique of the book: It inadvertently points out weaknesses in the text that I overlooked while reading it because I was actually being entertained.

As for Hanks, well, playing the tiresome pedant Robert Langdon represents perhaps the final step in the Costnerization of his career. You know the story: Likable young actor with a puckish quality charms the public, wins some respect with a few impressive performances in offbeat roles, takes advantage of his newfound clout to play auteur for a little while, then coasts into middle age with a series of truly dull parts in middle-of-the road movies, eroding whatever affection we once had for them. In the book, Langdon is famously described as “Harrison Ford in Harris tweed,” and in fact it’s a perfect Ford role: underwritten and purely functional, more an aspect of the plot than an individual person. It’s a waste of that particular Hanks spark that won us over 20 years ago and a completely unnecessary miscasting — why throw away money on the one superstar-Tom the public actually still likes when the film’s real star is ultimately Brown’s damn novel? Howard could easily have hired a relative unknown — perhaps someone a few years younger who would have matched up better with the gorgeous 29-year-old Tautou — and used the millions he saved to hire a better writer than Goldsman. It’s sad to see Hanks, who usually tackles any role with such earnest enthusiasm, phoning it in, though I suppose it’s to his credit that he can’t quite seem to take Langdon seriously. But his inability to do anything with the role further hobbles the movie; a younger, hungrier actor might have been desperate enough to find a way to energize the flat character; as it is, he’s nothing more than a walking encyclopedia of arcana that occasionally — and all too briefly — exhibits a Hanksian sense of irony.

The film follows the novel pretty closely, even including some of the most godawful passages of dialogue, but, fortunately for the audience, time constraints have led Goldsman to chip away at many of Brown’s longueurs. The protagonists no longer take forever to figure out the simplest clues but, on the other hand, a lot less emphasis is placed on cracking the codes, downplaying the most interesting part of the book, and they sometimes make more exaggerated claims for the secrets that they do suss out. “So dark the con of man” is a silly enough phrase when Brown introduces it as an expedient anagram; when the movie’s Langdon explains that it’s a sort of in-house catch-phrase for the Priory of Sion — a French secret society that, naturally, conducts all formal correspondence and sloganeering in stilted English — it makes my skin crawl. By trying to give meaning and context to Brown’s hokum, Goldsman just makes it all seem that much more ridiculous.

For all the outraged Christians, the good news is that — if they don’t simply find the movie far too bland to get worked up over — Goldsman and Howard have made some changes to the story that allow for a little more doubt about its biblical-historical assertions. They aren’t interested in making the movie a referendum on Christianity; as much as they can, they give it a standard thriller treatment, taking on the religious issues only when Brown’s plot forces their hand, and their attitude toward the book’s blasphemies is straight out of Inherit the Wind, trying to work out how Christianity and apostasy can meet up for a nice cup of tea. The film exonerates the Vatican of any part in the conspiracy plot, showing the conspirators’ fears that they’d be excommunicated if their dirty deeds were ever found out. It also makes it clear early on that the heroes are skeptical about Brown’s premises and that the true believers are, well, less than heroic. When Langdon and Teabing lay out the story of the Holy Grail conspiracy for Sophie, Langdon challenges Teabing’s claims about the Priory of Sion and the Council of Nicaea, noting (accurately) that the P of S myth was discredited decades ago and that the C of N’s affirmation of Christ’s divinity was only an acquiescence to what was already widely believed.

What may be more interesting — and troubling — than the changes to the story’s religious aspects is what Goldsman and Howard do with Tautou’s character. They reduce Sophie to nothing more than the audience’s proxy — not only ignorant of the details of the Grail legend but essentially a spectator through much of the film. Far from being the brilliant cryptographer of the novel, she’s just along for the ride, there only to look pretty and occasionally beat someone over the head. Goldman takes away her intellectual gifts but then tries to beef the part back up by making her short-tempered and violent — more beat cop than codebreaker — while he makes Langdon more superhuman, giving him a near-eidetic memory that allows him to swiftly solve riddles without needing to rely on some silly girl. It’s an unfortunate irony that, in a movie about a 2,000-year conspiracy to repress the power of the “sacred feminine,” the female lead is there merely to be acted upon, never to act. But then, when you think about it, Brown’s supposedly feminist idea of the Magdalene’s specialness is pretty sexist itself, deriving solely from the notion that her womb was the repository for the holy jizz.

Monday, May 29, 2006


Taking Sides

by : SEVANTI NINAN

THE current coverage of the reservation debate in television news would be a media teacher's delight: it is rich in instances of how the media shapes debate. We may have been taught that there are two sides to every story, or every issue, but when one side is overwhelmingly visible, audible, closer at hand, and easier to empathise with in terms of the class background of the reporter and anchor, the other side has no chance of an airing.

First there is the labelling of the issue on the screen. "The Rage over Quotas". "Ghost of Mandal Returns". "The Fire Spreads". "Losing Patience". "Deserve vs. Reserve". "Doctors Defiant". "Death of Merit" and "India Reacts" (For two soundbites-- from Amit Mitra of FICCI and from banker Uday Kotak). All of the above are from CNN-IBN and Times Now. When a channel has a class constitutency, the labels tell the constituency that the channel is with it on this issue.

Playing to the gallery

Then there is the queering of the pitch. If you wanted to know how much TV can fan a fire, you got enough examples of the yeoman efforts that were made last weekend. The lathi charge in Mumbai on Saturday became the equivalent of Jallianwala Bagh, in the age of public opinion via sms. Times Now actually ran two quotes to the effect from the smses it received. First it invited the smses: "Raise your voice — Should the police be held accountable?" Then it said it had received "hundreds". Within seconds this became "hundreds and hundreds". The anchor said, "What has really enraged the country is these visuals. Watch closely, they tell the story." I did, since they were endlessly recycled, right up to Monday night. The footage was interesting: lots of thwacking with sounds that made you flinch, then pushing, hauling, and chasing, but no evidence of anybody suffering any injuries at all. You were tempted to agree with Chagan Bhubbal who wondered why so much fuss was being made over so little damage. But it was manna from heaven for the TV channels, in terms of visuals.

It's not difficult to judge where a channel or its reporter's sympathies lie. Doctors are paralysing hospitals, how much time do you give to them on air, how much to the patients, or to the difficulties of those doctors who have not joined the strike? Neelu Vyas of CNN-IBN, at the All India Institute of Medical Sciences in Delhi, often came across so angry that you thought she had successfully internalised the students' cause. She presented a voice that represented the neglected patients: someone who had brought a relative with brain haemorrhage and paralysis but thought the striking doctors were right. Vyas: "And he has planned to join the hunger strike, which is really overwhelming."

Given the mike, this person told us that if reservations were implemented, of those made doctors, 10 per cent might actually be eligible but what would the remaining 15 per cent do? They would kill patients. "Aaj ka position bahut jyada dangerous ho gaya hai." "OK," said the gratified reporter in response, and went on to present one more voice for the camera. "We also have the parent of a senior resident doctor. Let us see what she has to say." "The future of the children is in the dark," she said. "So there you see Vidhya. This entire mass movement is gaining new (word unintelligible)." Bravo, said Vidhya. "Neelu Vyas you've really done a good round up there of patients and doctors." NDTV, at least on that day, at the same hospital, gave considerably more space to the plight of patients.

Stuck in stereotypes

CNN-IBN has been promising from May 15th detailed coverage of the issue which this column will miss. But when it tried to go beyond the various sites of doctors' strikes in Bangalore, Delhi and Mumbai, what it got was a story on the faking of caste certificates, and another from a village in Bihar on scheduled caste people who do not get the benefits of reservations. If anybody has actually benefited from higher education reservation quotas, they remain invisible.

The Hindi channels might have had a constituency that would be affected by the additional reservations being proposed, but they were on their own trip, as they often are these days, flogging the latest rape/ murder/ suicide or else cricket or a star birthday. On Sunday, May 14, at 9 p.m., Star News gave us an entire hour on Madhuri Dixit because it was her birthday the next day. Aaj Tak was busy with Mother's Day, as was Channel 7, when it was not doing "Gang Rape ka Sach". The Hindi news channels have been depoliticised to such an extent that they are completely redefining the concept of news.

So between them and the English news channels your search for facts and figures on this complex issue is not likely to get very far.