Jeff Duntemann's Contrapositive Diary Rotating Header Image

windows

A Viral SSID

First of all, you can stop worrying about me–Carol and I took an intense week-long trip to Chicago tending to family business, and I just couldn’t summon the energy to post while I was there.

But I was reminded of an interesting thing on the trip home, while we waited at the gate for our plane at O’Hare. I opened my new laptop to check for connectivity, and in addition to the airport’s Boingo network, I saw the oft-encountered but poorly understood “Free Public Wifi” SSID. I’ve seen that SSID in airports on almost every trip I’ve taken in the last three or four years, well-aware that it’s not anything like free connectivity. I’ve always assumed that it was a virus running on somebody else’s close-by laptop, because it’s not an infrastructure node like an access point, but an ad-hoc (peer-to-peer) node instead.

Well, it is a virus, but one of a truly fascinating sort. And that may be a little unfair. It’s not malware in the sense of adverse execution on the machine, but a consequence of some Windows foolishness in XP and (possibly) more recent versions. The “Free Public Wifi” SSID spreads virally without the help of anything except Windows itself. I never completely understood the mechanism until I looked it up yesterday. There’s a great writeup here, and I’ll summarize:

Wireless Zero Configuration (WZC) is the part of Windows that manages Wi-Fi connections. When enabled, it will do the following when the machine is booted:

  1. It looks to see if one of your preferred network SSIDs is present in the list of detected infrastructure networks, and will connect if present. Failing that,
  2. It attempts to connect “blind” to infrastructure networks on your preferred list that are not detected, to cover the possibility that your network’s SSID beacon is disabled. This is the Wi-Fi implementation of “security by obscurity,” and no one really uses it anymore. Having failed to connect to a hidden infrastructure node,
  3. WZC will look to see if one of your preferred network SSIDs is present in detected ad-hoc networks, and will connect if it finds one.
  4. Now the weirdness begins: If none of your preferred network SSIDs is present as an ad-hoc node, and if there is an ad-hoc SSID in your preferred networks list, WZC sets your system up as an ad-hoc network with the first ad-hoc SSID it finds in your preferred list.

Hoo-boy. Read that again: If you’ve ever connected to an ad-hoc node and no networks in your preferred list are available, your machine becomes an ad-hoc node. This may not be the worst wireless idea ever, but it’s right up there. Basically, you’ve opened a door to your machine, and (depending on your firewall situation) if somebody connects to your laptop through the ad-hoc node that WZC has created, they can browse your shares.

It didn’t take malware to make this happen. Windows did it all by its lonesome. Here’s a likely scenario explaining why this SSID is so commonly seen in airports:

  1. Somewhere, somewhen, there was a mesh (peer to peer) network named “Free Public WiFi.” It was probably legitimate. I don’t like mesh networks for various technical reasons, but they have their uses, and there’s nothing necessarily scurrilous about them.
  2. An XP user logs into this original “Free Public Wifi” network and connects to the Internet. The SSID is added to their preferred networks list as an ad-hoc node, where it remains. When finished using the mesh network, the XP user breaks the ad-hoc connection and life goes on.
  3. Later on, which could be months or even years, the same user (“User #1”) goes to an airport and while waiting for a plane, boots his or her laptop to do some local spreadsheet work. No connectivity is found, so Wireless Zero Configuration happily establishes an ad-hoc node called “Free Public WiFi.”
  4. A nearby XP user (“User #2”) boots a laptop, looking for connectivity. He or she sees “Free Public Wifi” as an available network, and (naively) clicks to connect. An ad-hoc connection is established to User #1’s laptop. Nothing happens, since neither user is connected to the Internet. However, the “Free Public Wifi” SSID is added to User #2’s preferred networks list. User #2’s plane eventually comes in, and he or she shuts down the laptop, disappointed that no free connection was found.
  5. Later on, User #2 is again at an airport and boots the laptop. WZC establishes an ad-hoc node, and this time, two users see the “Free Public WiFi” SSID and connect. Again, nothing either good or bad happens, but the “Free Public WiFi” ad-hoc SSID is added to the preferred networks list of both User #3 and User #4.
  6. User #3 and User #4 (neither of whom have any idea what’s going on) boot their laptops at other airports, or at conference centers, or some place where laptops tend to congregate. Similarly naive users connect, looking for a free Internet connection, and add “Free Public WiFi” to their preferred networks list.
  7. Contagion continues, as road warriors spread the SSID as explained above.

Although malware isn’t involved, this is far from harmless, since an ad-hoc connection is a door to your machine. Your firewall will probably stop any shenanigans…if you have it working and configured correctly. Some people won’t.

Note well that this only happens if your system has the WZC service running. If you have vendor-specific software installed to manage your wireless subsystem (as all newer Dell laptops do) this craziness won’t occur. Only if Windows and WZC are in charge of wireless are you vulnerable. The solution? Limit your connections to infrastructure networks. There’s a step-by-step at the end of this article.

Other such viral SSIDs exist; I’ve seen “hpsetup” and “default” myself, and others have been reported. Any ad-hoc network SSID can go viral with the help of Windows Wireless Zero Configuration. The “hpsetup” SSID was “contracted” from certain HP printers that connect to laptops via ad-hoc connections. I’ve only confirmed this on XP; the issue may have been resolved with Vista and 7. It’s a fascinating example of unintended consequences in system design, and should become a textbook case in CS coursework. (Why don’t I think that this will ever happen?)

How Necessary Is Windows? Part 5: Crossover

There have been several attempts down the years to make Windows unnecessary. The most audacious is doubtless ReactOS, which cuts to the heart of things and wants to be a complete Windows XP-compatible OS. Needless to say, this is no small project and will take a long time to complete; right now, I’d call it somewhere between completely useless and intriguingly experimental. (It runs Skype, at least.) I’m also concerned that if they ever do get it anywhere near useful completion, Microsoft will stomp on it hard.

That’s certainly the high road. But how necessary is it to clone the whole damned OS? A Windows app, after all, is just a block of x86 machine code that makes calls into one or more APIs. If you can clone the APIs in an acceptably clean-room manner, you don’t need to duplicate the entire architecture, kernel and all.

And that brings us to one of the oldest and oddest ongoing projects in open-source computing: Wine, begun in 1993 by Bob Amstadt and Eric Youngdale. Wine provides a compatibility layer consisting of clean-room DLLs implementing the Win32 APIs, plus whatever magic is necessary to make the deeper host OS machinery look like Windows to the app. This is easier than implementing a whole OS, with the further advantage that if done properly, Wine can act as a Windows compatibility layer over several Unix-like OSes, rather than only Linux. Currently, Wine can operate over Linux, Mac OS X, FreeBSD Unix, and x86 Solaris.

After 16 years of dogged work, Wine actually works pretty well. Part of its success is due to a remarkable cooperation between the Wine project and a commercial software house in St. Paul named Codeweavers. Codeweavers sells a $40 deployment/management utility for Wine called Crossover, which basically makes Wine noob-friendly. (Naked Wine is pretty stark.) Codeweavers also tweaks Wine itself to improve app compatibility, and contributes those tweaks back to the Wine project under LGPL. Some financial support is also provided to the otherwise volunteer-based Wine project. Wine’s founder, Alexandre Julliard, is an employee of Codeweavers, where he works full-time on Wine development.

Codeweavers focuses mostly on big-market apps like Microsoft Office, and doesn’t officially support apps beyond a relatively short list of “gold” software. However, I’ve found that a great many Windows apps install and run just fine under Crossover whether they’re on the list or not. InDesign 2.0 is listed on the site as “known not to work” but apart from a minor display glitch, it seems to work as always. (I haven’t tested it deeply so far.) Most Microsoft apps work beautifully (especially older ones) and I’ve been using Office 2000 and Visio 2000 under it without incident since last fall.

Wine implements a sort of runtime environment emulation for Windows called a “bottle.” More than one bottle may be created on a single host OS, and each bottle has its own emulated C: drive and Registry. By giving each Windows app its own bottle under Wine, apps are prevented from interfering with one another in the dreaded “DLL Hell” effect. Because it’s not a VM, the performance hit for running Wine/Crossover is very small, and most important, you do not need to have a legal copy of Windows running in the VM. On the other hand, a bottle looks enough like Windows to be infectable by Windows malware, though one bottle probably can’t infect other bottles on a Linux system, or the underlying system itself. (From what I’ve heard, the low-level system tricks played by many malware packages keep them from running or at least running completely.) There are known conflicts between WGA and Wine, so don’t install WGA if you can avoid it.

Bottom line: If Wine supports all the Windows apps you absolutely must use, you do not need Windows at all. I haven’t tested all the Windows packages that I use here (next up is MapPoint 2004) but for Office and Visio 2000 it’s been nothing short of magical, and I’m guessing InDesign will come along eventually. In a mature software market, time works in our favor: One by one, existing apps will be installable under Wine, and each time that happens, Windows slips a little bit deeper beneath the waters of irrelevance.

Next up: For the hard cases, there’s always virtualization.

How Necessary Is Windows? Part 4: Format Lock-In

Computing certainly isn’t about operating systems. Nor is it really about apps. It’s about files. Data is what we create, modify, store, and distribute in electronic form, and the ways that our data is stored give shape to almost everything else we do in computing. Being able to move from one platform to another thus depends almost completely on whether or not we can bring our files with us.

I’ve been working in front of a personal computer on an almost daily basis since May of 1979, and over the past thirty years I’ve accumulated thousands of made-by-hand files. Much of that is text, and I’ve had almost complete success bringing document files forward down the years, bouncing from one word processor to another by using various format-conversion tools. SF stories I wrote in CP/M WordStar in 1980 have passed through WordPerfect for DOS and several major releases of Microsoft Word and still live on my writing projects thumb drive. I keep a commercial Windows utility called Quick View Plus on hand to extract text from extinct file formats when necessary, which has been pretty rarely in recent years. Still, it’s there if I need it.

It’s a lot tougher once you get away from text. There are no conversion utilities for Adobe InDesign or Microsoft Visio, and as best I know nothing will import files created on either app. This is probably also the case for QuickBooks, and probably a great many more major applications that I’ve simply had no need for and no experience with.

I don’t think it’s an exaggeration to say that this kind of file format lock-in is the only thing keeping some of these companies profitable, or for some of them simply in business. Computing is mature in terms of the basic mechanisms we use to manipulate data: text editing, page layout, spreadsheeting, presentation, raster drawing and vector drafting, image processing, and database query and display. Small points may be patentable, but the fundamental machinery is now older than any surviving patents. Building an app that could load and edit an InDesign layout file would take some work but no genius, and if done would be a major competitor to InDesign, not only in new projects but (crucially!) in existing projects as well. Adobe guards its file formats with its life because its file formats are its life.

Alas, my files are my life too. And when Adobe’s IP rights bump up against my IP rights, who wins? Adobe, of course. Hence my hatred of activation: I don’t use newer versions of InDesign because Adobe can turn them off remotely and basically hold my work hostage if they choose to, perhaps because they’re too stupid to tell a RAID from a separate machine, or because they’re hungry enough to want to force me to pay for an upgrade that may have no new features that I need…and maybe no new features at all.

I have no general Stallmanesque animus against commercial software. I have a fortune in boxed apps on the shelf, and have never minded paying for them, even when they were upgrades. However, upgrading must be my choice, and migration of software to newer machines as time passes must not require new licenses.

Even commercial software that doesn’t require activation often demands a service and a tray icon, constantly popping up notifiers trying to upsell me to something I neither want nor need. In a mature market, there’s less demand for upgrades, and people can be happy using software for a long, long time. I can understand the vendors’ perspective and their need to be selling all the time to stay alive in a mature market. I think they should recognize my right to find it annoying and turn to software that doesn’t yammer so much and waste my cycles.

The bottom line here is that some apps are difficult to move away from; for me, the two killers are InDesign and Visio. Yours may be different, but I think most people who do creative work at the keyboard have a few. The difficulty lies entirely in proprietary file formats, and leads me to the infuriating conclusion that Windows is necessary only to allow me access to my own files.

The good news (for small values of “good”) is that there are tricks to be played. More in the next installment.

How Necessary Is Windows? Part 3: Apps

I came down with a monster headcold the last couple of days, and whereas this entry was in the can since Sunday, the remaining entries may be a little slower in coming. Bear with me…


We don’t use Windows because it’s Windows. (Most of us use it because it came on the machine and, well, it’s paid for.) Windows is just an operating system, and an OS is a troll living under a bridge. Applications with specific missions lean over the railing and shout orders to the troll, who (mostly) does as they say while keeping order up on the bridge. An OS is 80% facilitator and 20% bodyguard. Our real work happens in the apps. If the apps we use can be run without Windows, then Windows isn’t necessary at all.

There are three ways to break free of an application’s dependence on Windows:

  1. Find a version of a Windows app that runs on your OS of choice;
  2. Switch to a similar app that runs on your OS of choice; or
  3. Coerce a Windows app to run somehow on the OS of your choice.

I’ve done all three, and for the sake of further discussion here, the OS of choice is Linux. Mac OS/X is another worthy option, and all three of these methods are available there too, but for several reasons I hesitate to give Apple my money. (We’ll talk of this at some point; people who know my deep history will understand.)

There is a lot of very good free software to be had for Linux, and it can be had very easily. The Ubuntu Software Center allows easy search for apps via category browsing or keyword search, and any selected apps are downloaded from trusted repositories and installed without further intervention. The Software Center can tell you what packages are already installed, and can uninstall packages you no longer want. This is so uncharacteristic of the ancient Unix culture of pain that I still giggle sometimes when I install something. (“This is easy. Too easy…”)

I was a little surprised at how many Windows apps have almost identical versions running under Linux. This is true of some commercial apps as well as free apps, but free apps are much more likely to have Linux versions. I use the following apps almost identically under both Windows and Linux:

This represents a good deal of what I do in front of the keyboard. (Maybe a third.) I’ve heard that Google Earth can be had in a Linux version but haven’t tested it yet. It’s not available through the Ubuntu Software Center.

Switching to a similar Linux app takes more doing, but for some sorts of work it isn’t difficult. I don’t use newsgroups very much anymore, but using Pan under Linux was relatively pain-free, even though it’s quite different from Forte Agent in many respects. There’s a very useful site called Open Source As Alternative that provides suggestions as to what free apps are reasonable alternatives to many commercial Windows apps. Definitely spend some time there if you haven’t already; the real trick in open source software is often just knowing that it exists, absent pervasive ad campaigns. For example, I’ve known about the Gimp for ten years, but never heard of GimpShop (Gimp reworked to have a menu structure more like Photoshop’s) until I read about it on OSAlt.

KOffice is probably the best of the open-source office suites, though not all the several apps are equally powerful or polished. OpenOffice is even better functionally, but it has some weirdnesses (font management first among them) that probably stem from its Java-centric design. It used to be the only one of the open source word processors I know of that will load a .docx file, but the latest Abiword will do that now. Note that OO will bog anything less muscular than a 2 GHz Pentium, so don’t install it on older machines, and max your memory before you install it on anything.

For generating raw text and editing old Word 2000 files, I now use Abiword routinely. I don’t do much spreadsheeting, but my fairly simple PlanetPlanner spreadsheet loads and runs on Gnumeric, and that’s good enough for me.

Alas, once you get away from the most simple and widespread categories of apps (like word processors and spreadsheets) the news is mostly bad. The real problem with similar-but-not-identical apps isn’t the work it takes to learn them. It’s a phenomenon called file format lock-in, and in some respects is the key issue in this discussion. More about that in the next installment, probably when my nose stops dripping into my keyboard.

How Necessary Is Windows? Part 2: Ubuntu

In the past two week’s I’ve installed Ubuntu Linux 9.10 (Karmic Koala) three times: twice as upgrades, and once as a clean install from a CD. The combo LiveCD/installer ISO came down with uTorrent in 8 minutes 5 seconds (!!) and has given me trouble only once, and that with the partitioner: I tried to install 9.10 on Carol’s old HP laptop, but the partitioner could not determine the size of the existing Windows partition, and thus the resizer slider would not appear. On an SX270 with a similar size hard drive and an existing XP partition, the partioner resized XP without any trouble. (I’m wondering if there’s some weirdness in the HP BIOS, but have not gone after it yet.) I’ve spent a great deal of time in Ubuntu in recent days, and beyond that one little glitch with the laptop, I’d say Karmic is the best one yet.

Apart from its contrarian (and purely optional) brownness, Karmic’s default GNOME desktop is a great deal like Windows XP. The taskbar functionality is divided between two panels, one at the top and one at the bottom. Now that 20″ displays are common, I use two lines for the Windows taskbar as well and don’t begrudge GNOME the extra line–and you can put both panels at the screen bottom if you want to. The Home folder stands well for My Documents, with familiar subfolders for documents, music, pictures, video, and downloads. Nautilus looks enough like Windows Explorer to pass, especially given that most of us custom-configure Explorer after awhile and not everyone’s configuration is identical. Left mouse button selects, right brings up context. In short, all the basic ideas of the Windows UI are present, in recognizable form. There’s some bumping-up-against-habit in switching from one UI to another, but after even a little time exploring in GNOME you won’t be lost anymore.

The Control Center is a great deal like Control Panel, with applets to manage most configurable options. One gripe about the Control Center is that there is a perfectly good applet to manage grub’s boot options, but it’s not installed by default and I only came across mention of it online by accident, while looking for something else. If you want it, go into the Software Center, and search for Startup-Manager. Install it, and you can specify grub’s default OS, the menu time delay, a splash background, and other things. I take back the grouchiness expressed in my entry for November 7, 2009, with the exception that Startup-Manager needs to be installed by default.

I still have a gripe with Linux generally that goes back a long ways: It needs centralized font management. Unless I’m missing it (and I looked pretty hard) no such applet exists for Control Center, and installing fonts is much more fussy than it needs to be. This may not matter much if you’re not a publisher or a graphic artist, but it matters a lot to me. I have a set of expensive Type 1 fonts that I bought in 2001 and use in all of my Copperwood Press books, but getting them into Linux was non-trivial, and not all apps that should recognize them do. Scribus and poor little Abiword picked them up immediately, but OpenOffice still can’t see them and I still can’t figure why. I know that X11 makes font management a little more complex than it is in Windows, but that’s no excuse for not having a font manager in Control Center.

Beyond that, few complaints. There is now a Safely Remove Drive context menu item for thumb drive mount icons that I don’t remember seeing in earlier versions. Videos that play without sound in Windows (due to obscure codec errors) play with full sound in Karmic. Bottom line: Ubuntu 9.10 implements all the fundamental GUI machinery that Windows does, and does it with enough similarity not to drive a newcomer to distraction. From that standpoint, Windows really isn’t necessary at all…but alas, GUI machinery is only one small piece of the larger Windows pie. More tomorrow.

How Necessary Is Windows? Part 1: Overview

Still dealing with neck problems here, but in the background I’ve been pursuing a long-term, low-intensity project aimed at discerning how necessary Windows is for my daily operations. Back in 2001 or so, Keith and I considered publishing a book called Dumping Microsoft, but after I looked closely at the Linux releases of the time, decided it would be premature. Windows 2000 was mighty good, and Linux had yet to break out of its all-hail-the-console, pain-is-good hacker culture. It may be time to reconsider the necessity of Windows (and perhaps that book) which is what my upcoming series here is about.

I’ve changed operating systems often enough in the last 30 years not to get too attached to any of them, and have no tribal/emotional investment in Windows 2000 or XP. An OS is just a workbench, after all: It does very little work by itself, and exists almost entirely to help applications do what they must do in the most productive way possible. Too much of modern OS versions is just gratuitous glitz, which eats machine cycles and doesn’t get a page laid out any faster. My reaction to Windows Vista was pretty simple: What’s in all this for me? The primary purpose of Windows Vista was to make itself harder to steal, which is something of a fetish over there–and all the glitz was tossed in to persuade people to upgrade. Furthermore, the damned thing was slow. No sale.

You’ve heard me say many times here that personal computing is mature. I help out people at our parish with their computers, and an astonishing number of them still use Office 97. They may use the latest IE or Firefox, but they haven’t seen the need to spend more money on word processing or spreadsheets. That’s because the need isn’t there. Office ’97 probably has 90% of everything useful in an office suite; if you want the rest, get Office 2000, which I myself have been using for almost ten years now.

It’s taken Linux longer to reach parity with Win2K/XP because it’s written by volunteer programmers and not highly paid engineers on continuous death-march. It’s also required the vision of a consumer-oriented distro firm to package up a version of Linux amenable to non-technical people. The testing I’ve done over the past year (in parallel with revising my assembly language book for Linux) tells me that Canonical’s Ubuntu Linux is ready for ordinary users, and if it were widely available as a preinstall would be considered no geekier than Windows. (Installing Ubuntu from CD is actually loads easier than installing Windows XP. Microsoft would be perhaps a third its current size if not for Windows preinstalls.)

What makes it urgent now is a creeping suspicion I have that Windows malware is unstoppable. I see articles on tech sites several times a week describing new and increasingly clever exploits of flaws in Microsoft and Adobe software. This is troubling on many fronts, from the technical–Why in hell do we still have buffer overflow exploits after all these years?–to the purely political: How do we know that exploits in closed-source software have really been fixed? Linux is not immune to infection (it’s secure at least in part because of its rarity) but the fact is that infections are difficult and rarely seen in the wild. I want to take advantage of that security, whatever its origins.

Hence the current project. I’ve talked about bits and pieces of it here and there in the past year, and it may be time to present what I’ve learned in more detail. Stay tuned.

Am I Blue?

In a word, no. And yet looking at recent operating system UIs, you’d think blue was the only color there is. Everywhere I look, I see GUIs that look like they were carved from a block of sea ice. (I guess that’s why modern GUI designs are so…cool.)

I’ll be doing an immersion experiment with Kubuntu 9.10 once it’s out and has had a few weeks to yield up its birth booboos, since KDE deserves a second chance. (I tried version 4.0 last year and it gave me no end of trouble.) But…KDE is so damned blue. Ditto Windows 7, which I haven’t seen a lot of yet but will probably be using sooner or later. And Mac OS/X as well. Now, don’t tell me that these OSes can be themed in any color you want. I know that. But why is blue so pervasive in every big-time OS except Ubuntu?

Well, there’s another blue distro out there, which I finally burned onto a livecd and played around with yesterday afternoon. It’s Puppy Linux, which I tried in its first release years back wasn’t impressed with. Puppy is now four, and much improved. It probed the SX270 graphics system and monitor here, and set itself up to use the default 1600 X 900 resolution with nary a whimper.

Puppy is unique in several ways. It’s not derived from any other distro, but was created from scratch by Australian Barry Kauler and is maintained by its own community. It’s a “lightweight” distro and was designed deliberately to make use of the fact that mermory is much cheaper now than it used to be: It loads into memory and mostly stays there. This is true even if you install it on a disk partition (as opposed to running it “without a trace” from the livecd) and includes the major apps as well as the OS itself. When installed on the hard drive it still plays from memory, writing changes to a disk file but avoiding disk access whenever possible. This makes it feel snappy in the extreme: Click on the Abiword icon and pop! Abiword is there in front of you. Other preinstalled apps include the Gnumeric spreadsheet, the Seamonkey email client, paint and draw programs, and a lightweight browser created for Puppy Linux. (There are more; those are the major ones.)

There are some additional FOSS packages available for download from the Puppy respositories, but in truth not nearly as much as you can get for Ubuntu and other major distros. There’s no apt-get; the Puppy installer format (PET) is unique, and if nobody put a FOSS package into Puppy’s PET format, you have to fool with tarballs etc. and do the install manually from the console.

There is also a mechanism (which I didn’t try) for repackaging changes to the Puppy system into distributable derivatives called puplets. Many of these can be had, always free. One makes Puppy look a great deal like Mac OS/X; others are tweaks to look/work well on hardware like the EeePC. Some come with a specific emphasis and preinstalled apps, like composing music or bioinformatics, of all things. In a sense, you’re creating an app installer that includes the OS along with the apps, which is an interesting idea. This can be done with other distros, but the Puppy remastering mechanism makes it trivial. Puppy or its puplets can be installed on a thumbdrive and will thus run on any machine that can boot from a USB device, with configuration changes written to the thumb drive. (Ditto a rewriteable optical drive, if the session wasn’t closed and there’s room on the optical disk for a change file.)

On the downside, certain simple configuation items hid well: I have not yet found the way to run apps from icons with a double click instead of the default single click. Nor did I find the way to add an app shortcut icon to the desktop for newly installed apps. I admit that I didn’t spend a huge amount of time with Puppy and probably won’t, but such simple things should be easily findable and obvious how to use.

So on Puppy I’m lukewarm. I don’t really need it for the sake of old slow hardware, but the idea of a lightweight RAM-based Linux on a bootable keychain thumb drive is fascinating, and I might download one of the puplets and try them in just that way. However, if you’re just looking for an easy-to-use Windows alternative, I think Ubuntu is a much better bet.