Audacity is audacious. [updated to Version 1.4]

[...the steps H, I and J were a bit garbled earlier; they're all better now...]

Here, folks, is a real-world case study in which the open source sound recording program AUDACITY is seen to be very, very nice indeed.

Problem: you have 500 vinyl records, a new turntable and you just got an iPod nano onto which to rip songs. The 6-year-old Mac you've dedicated to music projects due to large storage won't run the most recent version of iTunes, which controls the iPod and other Apple devices. And what files do you tell Audacity to convert songs into - and do you need a copy of Audacity on two computers, so that a PC or newer Mac can convert the files from Audacity's .aup file to something the iPod can read? And can you drag/drop onto the iPod or does iTunes control that, too - and which version of iTunes? The old on the music project Mac or on the Mac/PC that has the newer version of iTunes that can talk to the iPod?

First world problems.

The simple way would be to have either a brand new Mac or PC (or even a Linux desktop at the initial burning stage) with outboard storage and do everything on one computer.

However, as John Belushi would say, "Buuuuuuuuuut Noooooooooooooooooooooooooooo".

I insist on using an old Mac for ripping and a Win7 box for loading. Plus there's the issue of how to get out of a vintage stereo receiver into a computer (it's actually not necessary with newer turntables)... here's how I did it.

Preparation -
1. Setup A consists of conventional receiver, speakers and new turntable with both RCA line level connections and USB output.
2. Setup B consists of older Mac with whatever version of iTunes was current when unit was delivered, and newest version of AUDACITY for Mac

(Audacity is available for Windows, Mac or Linux at http://www.audacity.sourceforge.net)

and a USB-to-miniUSB cable (probably provided with the turntable) connected between the turntable and the Mac.
3. Setup C consists of recent Win7 box (with iPod optionally connected) and latest iTunes for Windows downloaded, plus newest version of AUDACITY for Windows.

Stragety -
A. Ignore iTunes on the older computer.
B. Ignore the conventional stereo during recording. Use the powered speaker system on the Mac locally to "monitor" the "live" LP output as the recording's taking place. To do that, switch on the turntable's internal preamp (this would be a modern USB-era turntable - I use an Audio Technica ATLP-120usb) for recording to the computer and switch it off for normal playback to the conventional stereo.
C. Fire up Audacity on the first computer (older Mac dedicated to music production) and hit File / New and hit the record button.
D. Start the turntable (since Audacity has begun recording you can hear, or monitor, the record through the computer speakers now), queue up before the song, scratches and all.
E. Record the song and delete the extra stuff before and after the song (which you can wipe off of the graphic screen with the mouse).
F. Hit File / Save Project, give the rip a name and put it in a file named ".aup files".
G. Put onto thumb drive or push it to the newer PC over a network.
H. Open the ripped file(s) with Audacity on the newer computer (on which iTunes will talk to the iPod).
I. Use Audacity to export the .aup file(s) to some converted file that the iPod likes ("export" is the relevant command). Put exported files into a file named ".aup conversions". I haven't figured out the trick regarding the library for Apple Lossless yet, so I'm using AAC at the moment.
J. Drag/drop a converted file (AAC in this example) from your storage location of ".aup conversions" onto the iTunes playlist window. It will load into iTunes immediately as far as the Windows PC is concerned, and iTunes syncs the song from application to player at the point when it senses that you've hooked up the iPod via its USB line.

Done. Simple, eh? By the way, I went with the iPod as a player since my car stereo has a cable connection for one, and front panel controls for when it's hooked up. So I had to try it. The car system is a bit laggy on the commands (takes almost a second, not really instant) but good enough. The bottom line here is that you can rip on Audacity for Windows, Mac or Linux and maybe other things too - but how to get the ripped file converted and into the player? That's where you have to have any computer that runs the latest iTunes and from there it just syncs the player. Just two steps, really: create the .aup project file on anything, then get that file into the latest Audacity for conversion from project file to preferred music file, and you're pretty much there.

For clarity, let me repeat it another way: To rip LP's to iPod, getting from a USB-capable turntable into a USB-capable computer (monitoring with either phones or computer speakers) can be done on Windows, Mac or Linux, since Audacity is written for those OSs. That gets you as far as the .aup project file. After that, you have to have either a Mac or a Windows computer that runs whatever version of iTunes (preferably latest, probably) talks to the iPod or iWhatever that you just bought, plus it'll need the latest version of Audacity. Once on that newer machine, use Audacity to make MP3, AAC or whatever out of the project files, then drag/drop those new music files onto iTunes' playlist, then hook up the player gizmo and syncing (loading new songs) happens automagically.

Update: I don't yet know how it does it, but you can get from AAC to Apple Lossless by first converting the project file into AAC with Audacity, loading the song via drag/drop into iTunes and THEN right-clicking on the track listing. "Convert To Apple Lossless" is one of the choices. Then delete the earlier cut. Where does it get the extra info in the file? Maybe it just turns off a filter...

Customers Say The Darndest Things! {with apologies to Art Linkletter}

Here's a collection of pithy sayings and desperate pleas from your friend and mine, the Customer. I mean that seriously, since the Customer's money is green, and keeps us employed. My quotations, therefore, have not only a humorous angle, but a serious one, as they reveal the condition and situation of the Customer in ways that conversation with them outside the incident will almost always fail to deliver...

"Find out what's wrong with my network."

"Build me a network."

"See if you can hack into this address." - from a non-customer / member of the general public

"Why won't my virtual switch work?"

"What did you just do?"

"What did I just do?"

"What control panel app would get me around having to know commands?"

"Get me the log of the FSCK."

"Where are my backups?"

"This workstation has been up for months; why won't it log into your web app anymore? It can get everywhere else so the problem must be on your end."

"Fix my API code."

"Fix your API. This code should work."

"I shouldn't have to identify myself. Your security is a waste of my time."

"Why won't my server stay up?"

"What is RDP?"

No, really. All of those quotes reflect a legitimate customer need. They may or may not be needs within the scope of what you or I do, but if you can stretch the scope that restricts you somewhat, word gets around in the user community you serve that your outfit is solid and will help if it can. Word of mouth like that cannot be appraised highly enough. It's an extra mile that your competition probably won't take.

Review: RTFM Red Team Field Manual by Ben Clark with graphic treatment by Joe Vest

I would not have bitten on this had a holder of a security certification not recommended it to me, but I did like the idea of a literal, physical BOOK coming out to serve as a handy reference for one-liners and other CLI needs in a contemporary context. Back in ages past, hand typed or mimeo'd manuals were the only way to transmit such crib sheets (until books like Kirk Waingrow's "Unix Hints And Hacks" came along). I understand that such things go out of date. I also understand that they're more easily available in the portable form of a file. But books don't require batteries, and you can write in them or in back of them, and they don't set off metal detectors.

But is THIS book any good? Yes. There are nine broad categories of hints, but little more organization than that, since not much is needed. There is no narrative; these are merely convenient references. And convenient they are: it immediately made itself useful in helping me memorize common ports with a simple list at about the middle of the book under "Networking" - great for future test scores, which unfairly demand memorization of what one normally finds via search engine these days. Anyway, here are the categories:

*NIX

WINDOWS

NETWORKING

TIPS AND TRICKS

TOOL SYNTAX

WEB

DATABASES

PROGRAMMING

WIRELESS

... along with references, an index and a clever conceit of plain old typewriter font all the way through.

Now, it may be annoying to some of you that elementary matters like the meaning of passwd or man are included among more difficult listings. Indeed, I didn't expect to see, under its own heading of "Updating KALI", the ordinary apt-get update and apt-get upgrade spelled out, but that sort of thing makes the book useful to the novice as well as to the more informed. For the latter group, there's things like, under "Native Windows Port Forward", the netsh one-liners that are hard to remember. There's about 20 Cisco commands all in one place, all of which I'd have to look up. And an awk-loaded nmap idea for reverse DNS lookup, which then organizes the results for clarity. And so on.

I'm happy I bought this one; it's continuing to prove useful to fill in the blanks of stuff I should have known by now, and is presented in a familiar and un-complex paper form. 4 stars out of four.

Minor Antivirus Issues

It's almost too minor to mention, but at work we see it fairly often. Somebody has a Windows Server product like '08 and they can't install some recent Windows Updates. Rather than even try to Google the KB number, they call in (I'm like a cop that assumes everybody's a crook after dealing with crooks daily for 20 years - only the real dummies call in with this one. Most customers can handle it themselves) and complain that the updates won't load. This of course isn't even a Windows issue. The one I'm talking about is the issue which one discovers the second one springs into action and actually Googles the KB number.

If the KB numbers that come back from the update complaint are found to be recent security updates, check and see if the operator is running a popular antivirus product like McAfee. If so, turn the agent to STOP, do all the Windows Update permutations (downloading, installing and multiple rebooting for config passes) and then turn the agent to START. You are the hero.

[My completely unproven explanation for why the KB'z won't load is that the agent sees strings of quotes of bad code, trojans, etc. in the updates, in the act of being described to the OS so it knows what to ignore. McAfee and similar companies then eventually must engineer a way to keep the agent from thinking these strings are infections rather than just descriptions. MS probably would not want to publish how it has updates tell the OS what to ignore, for obvious reasons.]

Here's the interesting part: what enables you to fix the issue here is the ability to turn the antivirus agent off. According to one theory one shouldn't build into the agent any ability to turn off, since that gui (or control of any kind) might be exploitable. By such theory, you should build the agent like ESET Nod32 does it - without any kind of "off" control. This not only removes the danger of outside intervention but keeps the agent running through the next bootup so as to catch boot viruses. Nod32 does indeed give a temporary turnoff control that operates "until next boot", which however I suspect isn't totally off, since you want to catch boot nasties coming back around. Great. But...

I ran into the Windows Security Update KB 2345245345345whatever issue - on a machine with Nod32 on it. Solution: uninstall the A/V, do the updates and reboots, then reinstall the A/V. It was the only way - and I do not fault ESET for this, since the safety is worth the extra trouble.

Just make sure the owner of the box you're working on is buying the Mai Tais. The world is still full of people that can't even handle Windows Update with NO complications, although that thing's been around for, what, 25 years?

Hello and welcome to Medium Tech Computer Rentals... how can we help you today?!

My job is so wonderful. I have experiences that you simply can't make up. Naturally, I'll falsify everything possible to protect the innocent here, but the true horror of the experience will easily remain...

So this call comes in from Customer XYZ with Credentials BR-549 or whatever and the question is about what our policy/position is on the latest discovered vulnerability in CLI tool ABC or something. I reply for the 5th time today that we are not a security organization, but we have heard that the policy of the Frapdoodle Application's maintenance organization is that patch 4524232566655 will be available on the first of the month, at yadayadayada.it or some other place that I just Googled. Call ended.

Then I almost plotzed as I thought about what had just happened. See, I glanced again at the customer credential screen and the organization title sank in. The caller had been with a nationally recognized computer security consultant. A really big name. And he'd just asked about a vulnerability currently in the news, even outside the industry. And I'd gotten the answer from a freaking search engine.

This consultancy doubtless pays the guy that called our outfit two to three times the money I make - in order that he get the answer from somebody else who thought to go to the interwebs and get it for nothing. The guy that called (plus hordes of his co-workers) quite possibly hit the cocktail party circuit advertising themselves as smarter than you or me, yet they may not be able to Google. They possibly have degrees, certifications, years of experience... or something. And got hired. And are morons.

Reminds me of the guy sometime back that took a security class in which the teacher put onto the big screen the activities of somebody in the class logging into their bank account from a school machine, with the snooping app's window up in the corner with the grabbed account and password [OOPS I'VE TOLD THIS STORY BEFORE].

I'd better just stop here, lest we all feel a bit more unsafe, what with all these professionals protecting us...

So some Chief Tech Security people...

... might be scrambling, considering the latest data breaches being reported by Forbes Online. Or maybe they're not.

According to this story, malware, employee misconduct, phishing scams or whatever has recently affected either customers or third party participants in the business activities of JP Morgan Chase, Dairy Queen, Touchstone Medical Imaging and AT&T (in addition to Target and Home Depot a month or two back). What if you were in charge of Information Security at those joints? What would your day have been like this week?

Maybe it would have been crisis mode - or perhaps just another day at the office. If I were one of those people and were reasonably decent at my job, I think I'd be memo-ing quite a bit. My main memo this week would have had an email subject line with a nice version of "I TOLD YOU SO". I'd first list the things that I'd been recommending to management that our people do for best practices, with emphasis on what measures had been overruled, when, why, by whom and hopefully with meeting minutes from the discussion in which I was shot down due to impracticality. Then I'd list or link the emails that had been sent out detailing voluntary or mandatory practices that people were actually supposed to be following and to which management had actually given lip service.

So, contingencies list: call up money for the security consultant outfit to do damage control, get the important password change procedure, pull tested backups from secure or offsite location, reload sensitive systems... and regularly tell certain people "I Told You So". This last only works if one DID tell them.

Job Opportunities

If you have a working knowledge of Linux server and/or Windows server operation (and networking or scripting would be plusses), take a look at the Houston Softlayer offerings at Softlayer's link to the IBM Employment page:

http://www.softlayer.com/careers

Softlayer is a major force in both physical and virtual server rental, second only to Google in number of servers currently under administration, and is now a division of IBM.

If your talents lean toward programming, specifically in Larry Wall's venerable PERL, give

http://cpanel.net/jobs-site

a look. Their Houston office has openings in support and in development.