Apropos of nothing, Apple's stock price hit an eight-year high yesterday.

Hotmail, Hotmail, Hotmail. What a different odor that name has now versus two weeks ago.

• Holey Hotmail by Scott Rosenberg [Salon]
  If you knew the e-mail address of any of the 40 million accounts that Hotmail claims, you could read that person's messages -- no password needed.
  
  Early statements from [Microsoft] spokesmen declared that you'd need "specific knowledge of advanced Web development languages" to break into Hotmail via this route. In fact, all you needed was someone to point you to a Web page.
  
  Given the sheer scope of the disaster, media coverage was surprisingly muted. It may be that the drumbeat of recent security problems, particularly ones tied to Microsoft, has simply numbed both reporters and readers: [litany of several recent holes in MS products...]
  
  A lot of Hotmail users are going to be very mad about this debacle, and it's not going to make them feel better to tell them that "you get what you pay for."

Consensus among techies seems to be that the problem was introduced after Microsoft bought Hotmail, probably as part of an attempt to enhance the Passport service (where, in theory, you'll only have to log in once and you'll have access to several services across many servers).

What most mainstream media seem to be missing or ignoring, and what I think is crucial to understand about this, is that exploiting this security hole took very little cleverness compared to any other 'security cracks' you hear about.

For fun, let's compare Hotmail to a bank, where all the money's in a vault in the basement. Microsoft, having bought out the bank and the copy shop next to it, digs a massive tunnel between the bank's vault and the copy shop ("for our customers' convenience") with a side branch that permits entrance from the bank's lawn (why? who knows). For security, they plant some bushes and trees so you can't see the hole in the ground from the road or from the main bank entrance.

What the 'crackers' did was look around the bank's grounds a bit, notice the big tunnel, and put up a few signs making it easy for everyone else to see that there was a wide-open path to the vault.

They didn't break any security, there was no security except for the fact that it was a little bit hard to see the entrance at first glance.

You could say they shouldn't have been casing the bank; you could say they shouldn't have put up the flashing signs and blaring music pointing the general public to the tunnel.

But it's still no way to design a bank. Or an e-mail service.

And what's the consequence to Microsoft for their monumentally bad choices? Well, nothing.

• The bug syndrome: Get used to it by Charles Cooper [ZDNet]
  In the Hotmail episode, Microsoft didn't even bother to apologize and the stock price didn't tank. At most, the company suffered a minor public relations setback.
  
  [Companies] blaming hackers for problems in their products is the biggest dodge going and removes any real urgency to fix the bug syndrome.
  
  They might change their tune if you all decided to boycott their products in protest. But of course, that will never happen.

The picture Apple has on their front page of the Power Macintosh G4 is the sweetest-looking computer promo shot I've ever seen.

While the G4's 'supercomputer'-ness is so far only applicable to certain specialized tasks (digital image- and video-editing, complex calculations involving Fast Fourier Transforms, etc.) that doesn't take away from the fact that for customers who use those capabilities, this is a breakthrough machine.

And this time, instead of using Byte's disputed benchmarks to compare it to Pentiums, they used Intel's. See the results at the bottom of their G4 page.

Caution for potential buyers, though: the currently-available 400MHz version has different (slower, less capable) innards than the models shipping in 'a few weeks'. Wait for the better models.

(Personally, while I would dearly love one, I need to save up for a portable first.)

Reader Dave S. corrected my faulty assumption that Amazon's 40%-off price on the Matrix DVD was the best you could get:

Amazon's price on the Matrix DVD is actually pretty high. Reel.com has it for $12.49, and there are a bunch of $5 Reel coupons about that bring it down to $7.49, with free shipping this week.

800.com has it for $11.94, always free shipping. DVDFlix, which I don't know, has it for $9.99.

BTW, If you're interested in saving money on DVDs, I'd highly recommend you head on over to the forum at DVDtalk.com. They've taught me a heck of a lot about paying low prices on discs. ... It's all in using coupons, rebates, pricematching, etc.

Good to know...thanks!

Okay, I'm stuck. What do you do when you want to point to a book or CD but you don't want to appear crassly commercial? At the moment, Amazon is still the only place I'm aware of with decent information keyed to ISBN number, so I'm still going to point to books using their site. I no longer care if you buy anything via an Amazon link of mine. I'm giving such pointers for informational purposes.

For instance, this is a book I want very badly, and I think some members of the audience might find it appealing too. Buy it wherever you like to buy books, but Amazon has some good information on it, including a note from the author and an excerpt:

• A Cure for Gravity : A Musical Pilgrimage by Joe Jackson, coming in November
  (Note from the author:) "If I had to describe this book in one line, I'd say it's a book about music thinly disguised as a memoir.
  
  "On the one hand, it's the story of my life, up to the point when I made my first album. In other words, it's all the stuff no one knows about: the years of struggle and failure and learning; the terrible, embarrassing early gigs; the crazy people I met along the way, and so on. I wanted to get it down because so much of it is bizarre and hilarious.
  
  "On the other hand, my story is a musician's story. I can't separate my life from music, so the book also becomes a series of reflections on many kinds of music from many different angles. It's a philosophical book but definitely not a solemn one. Ultimately I wanted to share some of the passion for music that lifted me out of what might otherwise have been a pretty dismal life. I hope people will find it both fun and inspiring."

Joe Jackson is a fascinating guy with a great mix of skill, wit and soul who has followed a path very different from his fellow popular musicians. I expect this to be a real treat.

JJ has a new recording coming out soon, too:

• Joe Jackson News [official site?]
  Symphony No. 1 - Recording of the Symphony is finished and release is scheduled for October '99 on Sony Classical. The Symphony is 'classical' or traditional only in its basic 4 -movement structure; otherwise it's a radical new slant on an old form. A list of the musicians participating may give some idea...

His last all-instrumental album, Will Power, really grew on me. 'Solitude' and 'Nocturne' in particular are just gorgeous. A new symphony from him is a must-buy for me...

• Online shoppers bid millions for human kidney [CNN]
  ...notice of a "fully functional kidney" put up on [eBay] last week created a stir. It also brought in bids of more than $5.7 million before the company intervened to block the sale.
  
  Trafficking in human organs is a federal felony, punishable by a minimum of five years in prison and fines of $50,000 or more.
  
  Earlier this year, eBay banned the sale of guns and ammunition on the site after people tried to sell a rocket launcher, a missile, a bazooka, and other military weapons.

What kind of idiot even comes up with an idea like this? I've never understood the urge to get smashed, and to try to get this smashed is suicidal:

• A senior at Penn State almost dies celebrating [her] 21st birthday [Post-Gazette, seen at Julienne]
  This was the young woman who, 2 1/2 days earlier, got a rush start on celebrating her 21st birthday by walking into a tavern about the stroke of midnight -- then partying her way through two bars and 21 shots, mostly hard liquor, in two hours. Minutes after the last drink, she crashed into a coma, her blood alcohol content of 0.682 was pretty much off the charts, the kind of number reserved for autopsy reports.
  
  "I've never seen a blood alcohol level that high," Dr. Margaret Spear, Penn State health services director, said yesterday. "And I did some of my medical training in New York City 20 years ago, where we took care of people who drank tons of grain alcohol." ... "She was very close to death," said Penn State spokeswoman Christy Rambeau.

She's lucky to be alive.

[The article's headline says 'his 21st birthday', but it's about a woman... Weird Freudian slip? Habitual assumption that (drunk + stupid) == male? Typo?]

New stuff here: As has been promised on the front page for many months now, I've finally set up the About part of this site. It's, um, about me. With a photo where you can almost make out what I look like. :)

Also, some folks have recommended to me that I go ahead and put a résumé up too, even though I'm doing fairly well in my new situation and not really looking for a job. So I hastily threw one together here, if anybody cares.

Have a good weekend...