Not Windoze

world's largest error message




The only billboard in Times Square that's not animated. Two stories high.

I got a spam yesterday, sent from a compromised MS-Windoze computer on a DSL line. It had a real domain name so I left the guy a message and he called me back.

He was pretty angry, but it wasn't at me in particular. He's trying to run email service for three hundred customers on that computer, using some commercial mail-server-in-a-box product. He'd already fielded four trouble calls on it that day, and that was a typical day. It's keeping him from running his web design business. He didn't know it was spamming.

He couldn't believe it was spamming, either. He's spending hundreds of dollars per year on "antivirus" products, and they'd given him a powerful false sense of security. And he was using one of the "professional" antivirus things, not that stuff Symantec and McAfee sell to consumers.

When I want to watch the log from my mail server, I type "tail -f /var/log/mail.log". Usually it's in the shell history so I just call it up from that last time I typed it. Apparently the "user friendly" mail-server-in-a-box product has no equivalent functionality. He can't watch its activity in real time. Windoze has a task manager, but the spam bot was hiding from it. He's in the dark. But it does let him look in its mailboxes and queues, and he found a few hundred of the spams in there.

Now, I've been reading email headers and logs for a while. The only thing you can really trust is the IP address of the sender that your email software recorded. Practically everything else in the incoming spam is trivially easy to fake, and the spammers fake it. I'm not an expert on TCP/IP but I know faking the source IP address is so hard the spammers don't bother. Here's why: the spammer's software needs to hear back from my server to complete its transmission, and my server is going to reply to the fake address. So he has to control the computer at the fake address as well as the real one. There was one spammer doing that for a while. His fake address was a throw-away dial-up account, and the fakery protected his real, expensive Internet connection.

The poor guy couldn't believe his system could be compromised because he is doing everything right, according to the advice computer owners get from commercial sources. I explained the problem known as zero day threat. It is impossible to inspect the source code of the Microsoft system, because it's a trade secret. Also because it's way more complex than it needs to be. Therefore, when a new Microsoft system (or "security patch") comes out, we have to wait for an exploit to appear "in the wild" and then we have to wait some more while the antivirus venders figure out how to detect and remove the thing. There is no way to discover vulnerabilities before they are exposed to the hostile Internet environment. Therefore the most dangerous "virus" or intrusion technique is any brand new virus or intrusion technique. That's called the zero day threat. In all the self-training this guy had done to get a mail server going for three hundred people, he'd never come across the term.

The toughest cage to break out of is your own mind. One reason so many people think they can't live without MSFT products is they have never seen a Windows-compatible PC run anything but MS-Windows. We can fix that right now, with no risk and no commitment. You need a blank CD.

Go to http://www.damnsmalllinux.org/download.html and choose a nearby download site, and download the file dsl-3.2.iso (or whatever version it's up to) from the "current" directory. This 50 MB file took six minutes on my ADSL line.

Burn this CD image onto a CD with your favorite CD burning program. I picked Damn Small Linux because it fits on a business card CD, but you can put it on a regular CD if you like. I burn CDs with K3B (from www.K3B.org) but you might use Nero. The file you downloaded is a raw, bootable disk image. It needs to be written to CD that way. Copying it as a file into a new CD file system will not work. It's a whole file system, itself.

Insert the CD in the computer to boot (or reboot) the computer. If you bought a generic PC locally made, or someone has reinstalled its operating system since it left the factory, the computer's motherboard "CMOS settings" (BIOS settings) are probably correct already. If you bought the PC by mail from Dell or Gateway, it will probably just boot into MSFT Windows without looking for a bootable CD first. You'll have to go into the BIOS settings (watch the screen during a reboot. It will say something like "F2 for SETUP" and you have to hit F2 right then. It could be DEL or ESC.) and find the boot settings, or "boot priority." Set your BIOS to look for a CD-ROM before trying the hard drive. When the computer boots off the Damn Small Linux CD, you'll know it. It goes straight from the motherboard BIOS into Damn Small Linux. MSFT never runs.

There is a Damn Small Linux "splash screen" with a boot prompt boot: in the lower left. Hit Enter and sit back and watch.

Durn Small Linux takes a little while to scan your computer and figure out how to run there. It prints a bunch of chatty messages about a bunch of modules it can't find. Ignore all of that. Then the screen goes dark, and comes back on with a fine crosshatch with a big X in the middle. That's the X Window System from MIT. Damn Small Linux' desktop takes over. A lightweight Web browser called Dillo opens to a page about getting started.

You can safely explore this system. It won't touch your hard drive until you tell it to. If you have DSL or cable TV Internet access, you may already be connected. Try Firefox. It's got a launcher on the desktop.

When you're tired of Damn Small Linux, click the right mouse button to get a pop up menu. Click on "Power down" and select Shutdown or Reboot. Damn Small Linux will shut down its desktop and eject the CD. When you boot again, there's no trace that Damn Small Linux was ever there. But you'll never see that MSFT splash screen (with the clouds and the giant Windows logo) quite the same way.

When a job ad says "basic computer literacy" they mean you can do simple tasks with Microsoft (stock ticker symbol MSFT) Office. But that's a fairly recent side effect of the MSFT monopoly.

Before the monopoly, "basic computer literacy" meant you knew what files and directories (aka "folders") are. It meant you could copy files between removable media (floppy disk or tape) and the file system on the computer. Maybe you could copy files from one computer to another with FTP or UUCP. It meant you could create and edit files containing characters in the American Standard Code for Information Interchange alphabet, US-ASCII. You could probably create simple "batch files" (programs written in the language used to issue commands on the computer) for tasks you do over and over. And you probably knew the customary behavior of word processors and spreadsheets well enough that you could learn a new one pretty fast. US-ASCII turns out to have lasting importance in this world of international alphabets, because it's the alphabet of the Internet Protocols, and of most scripting and programming languages. HTML (and XML) files and Perl and shell programs are written in US-ASCII.

A string of characters in the US-ASCII alphabet is called "plain text." It was called that decades before there were cell phones and "text messaging." A file containing that string, which might be really, really long, a novel or a screenplay, is a plain text file. (A word processor file with all the words set in 12 point courier is not plain text. Plain text doesn't have fonts and sizes.) Programs that are used to create plain text files are called text editors.

I hope you can see the old "computer literacy" was much more fundamental than the new one. The new kind means you have memorized the visual cues presented by MS-Office and its desktop. The old kind means you understand enough about what's going on to be in control. Knowledge is power. Power is freedom.

Strike a blow for freedom, for yourself and your community. Get a text editor and learn to create and edit plain text files. These days my favorite text editor is Vi Improved. Also known as vim. I use it to compose email, computer programs, and web pages. It runs on MS-Windoze, all flavors of unix including Linux and Mac OS X, and every other computer system still in use today. Go to the site and get vim, if you don't already have it. (Most Linux distributions include it.)

But don't read Vim's instructions yet. If you already know the original Berkeley unix text editor vi, you can use Vim as if it were vi. And (here's the weird part) you'll be more efficient and less confused than someone who just picked up Vim and figured it out from its books and guides and tutorials.

So get the paper An Introduction to Display Editing with Vi (that's online in HTML) (here it is in PDF so you can print it and read it on the bus) by Bill Joy and Mark Horton and skim it, first. Ignore all that stuff about antique user interface equipment like teletypes and slow, dumb terminals. Joy and Horton explain vi as a simple, regular language. It makes sense. Every other tutorial I have seen make it look like a pile of cryptic and arbitrary commands and modes, and it's a lot harder to learn that way. Learn to use Vim a little bit as if it were vi.

Then poke around the Vim tutorial a little. Just a little. In fact, ignore all of it except the part where you make Vim aware of your mouse by setting the variable mouse to the value a. A for aware, I suppose. Maybe look a little farther to discover you can put that command (set mouse=a) in your vim startup file. If you're running vim on a server far away, and you logged in through PuTTY or any modern unix terminal program, mouse click becomes just one more cursor motion command, and select (left drag) and paste (middle click) work.

Even if you use Vim's snazzy graphical user interface you will still be faster and work smarter if you grok what the heck Bill was thinking when he made vi the way it is. And speaking of that, the very first step to learning vi, and to learning quite a lot of other computer culture, is FORGIVENESS! You have to forgive vi for being the way it is. There are really good reasons for it to be that way, and you will come to appreciate them over time, but I promise you will not see it right away unless you are a whole lot smarter than I am.

As you migrate out of the MSFT trap and learn to really use computers, you will discover the editing commands introduced with vi work in quite a few other programs. If you've got a shell (the dreaded command line interface) on a modern unix server, you can edit the command you're typing. The maze game nethack uses them to steer your hero. The file browser/pager less knows a lot of vi commands.