Salesforce Phishing

Ok, I kind of left this alone for a while. I had reached some level of acceptance with the fact that Old Navy, Levis, Dicks Sporting Goods, and bevy of other businesses are too IT stupid to realize the dangers of sending their customer communications through a third-party domain. As in email@companynamehere.rsys1.com. The third party in question is Responsys Inc. Today I received something too stupid too ignore. One of my sales folks got an email from salesforce.com entitled “Urgent 10/29 Security Alert: Do Not Open “FTC” Email”. The source address was email@salesforce.rsys1.com. In other words, they send a fishing alert from a subdomain of an untrusted third-party. Click here for a pdf of the letter.

Passed!

So like I said in my last post, I’m here in Texas trying to earn my MCSE. I just passed the second exam, on the second try. So far I’ve taken the 70-290 and the 70-291. The 291 was hard. It’s a networking test so I thought it would be easy. I already have a CCNA and a Network+. I can subnet in my head faster than a lot of people can use the cheat sheet. This test was still hard. I only got two subnetting questions on the first try, and one on the second. I learned a lot more about DNS and DHCP, I’m definitely going home with some usable information. I also had to study a lot about WINS, IPSec, and Microsoft Network Monitoring. That’s all probably just wasted real-estate in my brain, since I’m never going to give up DNS for WINS, probably never going to use IPSec, for server-client communication, and definitely going to stick to Ethereal for network monitoring. Oh well, point is I passed. It was hard work, but I passed. Now I’ve got to get studying for the 70-293. I’ve got 4 more days here in Texas, and 5 more tests to take.

It’s been a long time, I shouldn’t have left you…

Wow! It’s been like four months since I last blogged. In case there’s anyone still out there, the weight loss thing is still going well. I’m down to less than 215 now, which is a total of over 30 pounds lost. I’ve been staying in hotel since Friday. There’s no scale here, so I have no idea what I weigh today. I’ll be in the hotel until Sunday. I’m in Plano (Plain-Old) Texas for training. Hopefully, I’ll leave here with an MCSE. This isn’t a vacation, so I’m not taking a vacation from my health either. I brought my work out gear, so I can do some running and weight lifting while I’m here. I’m listening to my stomach and not eating beyond satisfaction. Plano, just like the rest of Texas, is very much a car-centric place. It’s not like the cities back east where a few dollars can get you to anyplace in the city. I could rent a car, or use the hotel shuttle to go everywhere, but what fun is that. I just walked a mile to a grocery store. Picked up some uncrustables, V8, stouffers for dinner tonight. Then made the 1 mile return trip in the Texas heat. You can flame me if you want, I know a lot of diet “gurus” who tell me that I’m still not eating healthy, but I’m not hearing it. You can tell it to my new belt, or my new pants that are already feeling a little loose. In other words, whatever I’m doing is working, so I’m going to keep doing it. Whew, I didn’t think I was going to talk that much about the weight loss thing.

Now on to Texas. Texas is a lovely place, but also very strange. I’ll start with the Television. There are at least 3 or 4 channels that have around the clock televangelists. In Jersey, we usually only let crackpots on the TV on Sunday morning. There’s a government channel, that shows 24 hour propaganda about how great the government is. I won’t be convinced until they give me back the $12k I paid those jerks last year. There are about eight spanish channels here, I only speak a little spanish, but it’s a lot better than preachers.

The infrastructure in Texas is weird as hell to me, it seems like conservation is a dirty word here. Even minor roads are 4 lanes with many 6 and 8 lane avenues. Highways everywhere, huge interchanges swooping through the sky. It’s beautiful and grotesque at the same time. It’s as if everything was purposely designed to use as much concrete and gasoline as possible.

Also, it seems like everything is named after George W. Bush. Now I know, he’s from here, and that must be the bee’s knees to most Texans. Aren’t we supposed to wait until someone dies before we start naming all kinds of crap after them?

One last thought before we go. A warning to all you Texans. You are not alone. Everywhere I walked I saw anthills the size of babies. Right beneath your feet, silently, patiently, waiting to spring from the earth victoriously seizing the land as you choke to death on exhaust fumes and whattaburgers. I urge you to run outside, and stamp on them vigorously. As vigorously as you stamp out the notion that your ex-governor is indeed a dumb ass.

Now, let us pray.

Ala Carte TV programming - Small Cable Co. Wants, but can’t have.

According to this article, Bob Gessner, President of MCTV, can’t offer Ala Carte programming, because government regs won’t allow it? The FCC is really overstepping their bounds on this one. That organization was created solely for the purpose of making sure that radio stations didn’t all try to broadcast on the same frequency. They’re not supposed to be protecting old style media outlets from disruptive technologies. The reason I use that term, is because digital cable is a disruptive technology to traditional cable channels. Sure, digital cable offers more choices to consumers. More importantly, it makes ala carte programming technically feasible. The digital channels can simply be turned on or off by the cable provider on a per customer basis. With analog cable the only way to do this would be to install a band pass filter on the cable line, attempting to block the frequency range that carries a specific channel. Anyone who’s ever watched scrambled PPV porn can attest to the successfulness of this approach.

So why are the media providers afraid of ala carte programming? It’s because, business, understandably hates change. Change represents a threat to bottom lines. For decades, they’ve operated in a market sandboxed by regulations and technical feasibility. To enter the free market, where all products must stand on their own, and only the good survive, must be terrifying to them. This is a capitalist country, it is not the government’s job to protect business from the market. If that’s what they want, maybe they should set up shop in Cuba.

Obama for President

Go watch the video.

Thanks, Dick’s.

This morning I received an email from Dick’s Sporting Goods. I get them all the time, so I usually don’t think anything of it. Today was different, because the message was in my deleted items. That shouldn’t have happened, because I blacklist or whitelist most email addresses by domain. Anything ending with @dickssportinggoods.com should be on my safe senders list. This time, the sender was dickssportinggoods.com@dickssportinggoods.rsys1.com. Phishers will use that kind of address to fool consumers into giving up their info. in this case dickssportinggoods is a subdomain of rsys1.com. I did a whois search of rsys1.com and found it’s name server at ns1.responsys.net. I typed responsys.net into my browser, and got what looks like a legitimate marketing company. So here’s my question, is this a really elaborate phishing attempt, or just the result of a bad decision at Dick’s? I’m leaning towards legit, but I sent an email to dick’s anyway.

This is the second time in a couple weeks that legitimate businesses have employed phishy tactics to reach consumers. I can’t find a link to it, but recently Myspace sent an email to users asking them to update their info by clicking a link in the email. This is also a common phishing ploy. I have to support users in my day job. How can I teach them to avoid suspicious email, if legitimate business start sending suspicious email? I’m going to tell them to block it all if that’s what it comes down to. I’d much rather them miss a sale, then become a victim of identity theft.

Additional Resources:

Phishing article on wikipedia.

Subdomain explanation on wikipedia.

Whois

Only an idiot would “Ghost ride the whip”

That said, I fully encourage all idiots to go out and do it right now. Wait, don’t do it now. Do it on a weekday, while people with brains are at work or school. Seriously, removing yourself from the gene pool, is probably the most valuable thing you can do with your life. Just make sure you cancel your car insurance before you go. I’d hate for your death to affect my insurance rate.

I heart iTunes, almost.

Ok, I’m a PC guy (personal-computer, not politically-correct). I hated myself for buying an iPod, but not as much as I hated myself for buying a piece-of-crap mini disc player (you suck sony). I’ve had the thing for almost a year, and I definitely love it. I call it “the best piece of consumer electronics since the microwave”. I figured I wasn’t a total sell-out as long as I never actually bought any songs from iTunes. I first fell in love with iTunes as a music manager. It’s great for that. Then I fell in love with the podcasts. They’re free, infact, it costs apple money to keep a directory of them, so I felt like it was sticking it to the man (Jobs). I know podcasts aren’t native to iTunes, but iTunes makes it so easy to browse and download them. So here’s how I became a paying iTunes customer. The other day, there was a song on the radio Jill Scott - A Long Walk. I dug the song, so I looked her up on Amazon. I previewed some of the other tracks from that album, and didn’t dig a single one of them. I had a dilemma, allofmp3 is dead, do I pay for a whole CD to get one song? Then I decided to look on iTunes. Suddenly 99 cents doesn’t seem like much compared to a whole CD. That opened the floodgates. Since then I’ve purchased the greatest hits albums for Frank Sinatra and Tony Bennett (8 bucks each). I purchased Atari Teenage Riot - Live in Philadelphia 1997 (I was there, it kicked ass!). One of the podcasts I’ve been listening to is the Hospital Records Podcast, hosted by London Elektricity, cofounder. It’s a great podcast, lots of fresh Drum n’ Bass tunes, artist interviews, etc. iTunes has a lot of Hospital releases. So far I’ve purchased a handful of EPs and Singles including Fracture & Neptune - Ventura (oh my gawd, what a track!). It sounds from all this, like I’m totally loving iTunes, well here’s where the almost comes in. iTunes has a power search option, what a joke. I can’t search by record label. I would love it if iTunes would show me every track on that label. I’d probably most, if not all of them. Once again, a company’s failure to provide access to information is making it harder for me to give them my money. I searched and searched on Apple’s web page for a feature request email, but found nothing. I didn’t even find a support address. I’m going to call them and bug them tommorow.

I lost ####################

20 pounds! get it?

Anyway, I officially tip the scales at 225, which puts me 20 pounds leaner than when I started. Trust me folks, this is do able. The most important tool for my weight loss was and still is information. Diet and exercise are important, but if you’re like me, you have no idea how to go about them. I wanna give another big shout out to The Middle Manager, who’s insightful posts, and encouraging comments have been invaluable. A shout out to my co-workers who look at me funny when I order french fries at lunch. A shout out to my friend Tom C. for being such a fitness nut that he even made healthy-eaters self-conscious. Most of all, a shout out to me, for sticking to the program more days than not.

Open letter to my 401k, kind of.

I’m not going to give the name of my 401k, they know who they are. The following is an email I sent them today. I thought it was kind of funny.

Hello,
I just have a few comments about the website.
1. It would be great if there were a tool to allow side-by-side comparison of funds, similar to Best Buy. Even better would be advanced filtering, similar to Newegg.com.

2. The ticker symbol should be included in the fund description. I can get they symbol by typing it into Google or Yahoo Finance, but it would be more convenient to simply copy it from your site.

3. Finally, the links to the funds aren’t html, they’re an annoying little piece of java that prevents me from opening funds in separate browser tabs. I wanted to open each tab in a separate tab, so I could switch back and forth. I was able to do this with some minor manipulation.
1. I copied the link location which looks like this, javascript:FundWindow(”http://www.viewjhfunds.com/usa/c5/pgta/index.html”)
2. Then I pasted it into a word document.
3. I repeated for each fund I was interested in.
4. Then I edited the link to look like this, http://www.viewjhfunds.com/usa/c5/pgta/index.html
5. All I have to do last is click on the link. Firefox automatically opens each one in a separate tab.

All of that work could have been avoided just by using an html link instead of java. If that were the case, I could have simply right-clicked on the link and chosen to “Open link in new Tab”. Of course, you could avoid the need to do that if there were a side-by-side comparison feature.

I was able to get the information I needed to feel good about the decisions I made. Others might not be so resourceful. Help your customers to feel good about giving you their money, and they’ll probably give you more of it.

To the web team:
Thank you for taking the time to examine these matters. Hopefully, your executive managers will give you the budget, and the buy-in to allow for a more robust web site.

To the person who has to sit and read all these emails from people:
Thank you for your patience. My complaint is directed at the company and not you. I’ve been in your shoes. Customers can be annoying; I’m a good example of that. The customer’s not always right, but even when they are, they can still be annoying. Thank you for patience in reading this long complaint, and have a happy new year.

To the Executives:
Please thank the preceding folks for the all the hard work they do. It’s their labor that puts food on your table. They really do have the company’s best interests in mind. Empower them to do the best job they can, be available for them when they need your support, and the rest of the time, try to stay out of their way.

Sincerely,

And this is where I put my name.