The net's been slow and cruddy today. Some sites that I normally visit have been inaccessible. I can't get over to New Scientist at all, for example, which is annoying, since I wanted to do some research there on an opinion piece on genetically modified foods for class. (Don't know what my opinion is yet. Gotta read more.)

I thought I was just hitting more than my quota of random 'Net cruddiness, until I visited Making Light today. There's a big Internet Worm on the loose. More info at CERT. It exploits a security hole in Microsoft SQL Server. Why am I not surprised?

In fairness, I'm not sure that Microsoft products have more security holes than anybody else: they just have more people working to exploit them. Older versions of UNIX are pathetically insecure: they were designed in a more trusting age. Back when I was sysadmin for our lab's SGI workstation, I subscribed to SGI's security mailing list, and it seemed like we got two or three e-mails a month which basically said, "Okay, we found another buffer overflow error that lets people execute commands as root." It made me a little nervous, to tell you the truth: there must be thousands of UNIX workstations in academic research labs all over the country, administered by overworked grad students. I doubt that 1 in 10 knows where to find information about security patches, or even knows how to examine the system log for signs of a break-in.

The SGI machine I administered had one succesful break-in (accomplished, I'm embarrased to say, by the oldest trick in the book: coming in through an lp account that had been left without a password) and scores of attempts. At first I was very diligent about tracking down the owner of the system the would-be hacker was coming from, e-mailing them the system logs documenting the break-in, and asking them to take action. I actually helped flush out a hacker who'd hacked several @Home user accounts and got him shut out of the system -- at least until he found another way in. But after a while, I stopped - most system owners never responded to my reports of break-in attempts, and it was too much effort to keep up for no payoff.

Anyway, it's sad that so many computers on the internet are so insecure.

Oh, and I apologize for my use of the term 'hacker' to describe malicious people who break into computers. I know that many people prefer that the term 'hacker' be reserved for the complimentary sense of 'somebody who can make technology do clever cool stuff.' But none of the suggested alternatives to 'hacker' in the negative sense work for me. 'Cracker', for example, has an entirely wrong set of connotations for me. I lived in Florida for too long.