It's interesting to see Charlie Schick, one of my Nokia colleagues discuss--on the corporate blog no less--a subject that has gotten a lot of attention thanks how well the Nokia E71 was kept secret before it's launch. And like Charlie, I'm going to drag out some thoughts from Nokia's internal blogosphere--my own specifically. However, unlike Charlie, I don't work in marketing and, obviously, am not speaking for the company here.

I am not opposed to the policy of not discussing publicly announced products. I understand the reasoning. That being said, it's frustrating at times to not be able to participate in a particular conversation about something everyone knows about thanks to a product leak. I think pretending the leak didn't happen is simply silly, which is the corporate policy today.

When a product leak does occur--and let's face it, it's going to happen despite our best efforts--we need to have a communications plan in-place for dealing with it. Immediately, not when the product releases. Somewhere between the current "stonewall" policy and "spilling the beans." I'm not sure how realistic that is, but at least that way we might have some control over the messaging versus in the current regime where the blogosphere has already told all before anyone inside Nokia has had a chance to say word one.

Of course, even if every Nokia employee keeps their lips tight about upcoming products, the mobile phones themselves leak information. Whenever you visit a web site, or upload a picture to Share on Ovi or Flickr, the phone will leave bits of information indicating what kind of device it is as well as certain capabilities. For example, look at the number of photos on Ovi taken with the E71. All of the pictures here right now were taken with a pre-production E71. I can tell you from personal experience that pre-production units are somewhat different than production ones, both in terms of hardware and software. Using this sample to judge picture quality will give misleading results.

While this isn't the same as leaking a picture or sending a damned prototype to a reviewer, it's information none the less. It's the kind of information that shouldn't be out there--especially if we can't actually talk about an unreleased device. Our devices--at least in their pre-production form--should not inadvertently leak information about themselves.

I actually think there might be an interesting "security" feature here: relay as little about the end user device as possible with these service, or even provide the facility change it to something else entirely. I know this is possible to do. Why not make this a built-in feature, along with changing EXIF data and other identifying information?

I have more thoughts on this, but most of them are not well formed or not well suited for outside consumption. What do you think about product leaks and what should be done about them, if any?

To the average person, the number of computers in my home is appalling. There are three computers downstairs alone, one for the other members of my family. Then there's my office.

One problem with the downstairs computers is that they all, without exception, have web filtering software on them. I am not under the delusion that they are a substitute for parental oversight--there's a reason the kids computers are in a public room--but it's nice to have something around to catch most accidental exposures to inappropriate material. Let's face it, when the kids are old enough, if they want to get around the filters, they'll figure out a way.

Meanwhile, I occasionally use the kids computers. Mostly it's because I like to go downstairs when the kids are trying to go to sleep. It's also nice to have a change of environment. However, the web filters end up creating problems for me when I try to, say, read my RSS feeds and people link to the latest cool video on YouTube. Or I want to check what's happening on Plurk or Twitter. Unfortunately, it means fighting with the web filter.

Now I suppose I cold buy a "better" web filter rather than rely on K9 Web Protection from Blue Coat, but I like the filter. It generally works, it's free, does a fairly good job of catching inappropriate or questionable websites, and doesn't try and do everything. It also helps that their CEO used to be in charge of the part of Nokia I worked for many, many moons ago, and I thought he was a nice guy.

The solution: a portable computing environment embedded in a flash drive. I could dual boot the computers, but that creates other problems. The flash drive solution is clean.

Linux is the only feasible OS one can install on a flash drive--at least easily. There are actually a number of different distributions you can install on a USB flash drive, many of which are featured--complete with step-by-step instructions on how to install it--on a site called Pen Drive Linux.

I wasted an evening on trying to get Ubuntu (along with various derivatives) installed on a flash drive, but ran into a problem where the distribution was failing to boot because it was trying to find the non-existent floppy drive on this IBM ThinkPad T43 I am using.

What ended up working the best for me, at least, was Slax. It is based on Slackware Linux, which has been around forever. It was one of the first Linux distributions I started playing with in the mid-1990s. It includes a number of modules, including a relatively recent build of Firefox 2 complete with Adobe Flash integrated. It's not set up the most optimally out of the box--for example, the default user runs as root, which is almost as bad as the default Windows behavior--but with a little bit of hacking, it works just fine without needing to run as root.

I now have my own environment complete with some local storage on a older 1 gigabit flash drive. I can stick it into any computer that is able to boot off of USB, and it should give me access to the Internet and a few other programs. Works pretty well for me.

Creative Commons Licensephoto credit: boredzo

As someone who spends an inordinate amount of time working from home, I always have to know where my SecurID token is. Without it and the six digits it provides, I will pound sand trying to get into the corporate network.

But the SecurID token is lame. Sure, it comes in a number of form factors, but I'd rather not mess with it at all. That being said, as a security person, I think it is a necessary evil.

I was excited when I initially read this article on SMS Text News about using SecurID with something I also need to know where is at all times--my mobile phone! Clickatell offers a service that sends those 6 digit codes over SMS to your mobile phone when you need to authenticate some place requiring strong authentication. You then provide that number--along with your PIN--to the remote server.

I like this solution because it requiers no software to be installed on the phone. It can be problematic when your provider has delays with SMS--happens more often than I care to think about, actually. That being said, it appeals to me greatly.

Every once in a while, the part of Nokia I work for announces new stuff. Today, it's a new piece of gear: the Nokia IP1280. Excuse the marketing speak, but I occasionally like to promote the things my part of Nokia is doing. :)

For some reason, I found the phrase "dealt deep layer enterprise security threats another blow" found in the press release announcing the Nokia IP1280 funny. I suppose it does that, since this 2U, quad-core Intel CPU powerhose can handle 24 ports, up to 14 Gbps of throughput with optional ADP modules, hot-swappable components, and a starting price of $39,995 USD. Yes, the IP1280 runs Check Point VPN-1, as most of the Nokia Appliances do.

As someone who works for the group that supports the Nokia Appliances, I would certainly appreciate it if when your company buys one of these platforms, you'd avail yourself of Nokia's First Call, Final Resolution support. At least that's what the marketing types have been calling it for many moons now.

I will admit to not testing the "forced" upgrade aspect of this, but I did download and install the upgraded iSkoot for my Nokia N95 this morning. While there is some information floating around in the clear, at least in my case, none of it was personally identifyable.

The vast majority of the communication between the iSkoot client and server now uses TCP port 443 and is encrypted with SSL. Visual inspection of the packet traces confirm that it's SSL traffic. No personal information in the clear anymore.

Nice job, iSkoot. Considering I zero-dayed you on a weekend, you did a great job of getting it fixed!