PaddleWise by thread

From: Craig Jungers <crjungers_at_gmail.com>
subject: [Paddlewise] Firefox Web Browser Plugins
Date: Fri, 5 Mar 2010 21:42:49 -0800
If you use Firefox for your browser (and, trust me, you should.... or any
browser other than the MS version of Internet Explorer that probably came on
your computer) you know that there is a plethora (literally) of "plug-ins"
available for that browser. You can change everything if you want to; or
nothing. But there are a few that you should consider. Two I like are:

1. Ghostery allows you to block many of the "tracking" systems that are so
common now. You can block Google tracking (perhaps the most pervasive) or
tons more.... all selectable.

2. Cool Previews. I generally stay away from anything labeled "cool" but
this caught my attention. As handy as tabbed browsing is, Cool Previews
makes it even handier. By just mousing over an icon next to a link on a web
page you can quickly bring up a small version of that web page to see if
it's pertinent to your search or needs. I was somewhat skeptical of this but
a friend recommended it and I have found it remarkably useful.

Obligatory paddling blurb..... jeez I can't think of any.  :P


Craig Jungers
Moses Lake, WA
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Rich Kulawiec <rsk_at_rockandwater.net>
subject: Re: [Paddlewise] Firefox Web Browser Plugins
Date: Sat, 6 Mar 2010 07:55:18 -0500
On Fri, Mar 05, 2010 at 09:42:49PM -0800, Craig Jungers wrote:
> If you use Firefox for your browser (and, trust me, you should.... or any
> browser other than the MS version of Internet Explorer that probably came on
> your computer) you know that there is a plethora (literally) of "plug-ins"
> available for that browser. You can change everything if you want to; or
> nothing. But there are a few that you should consider.

I (among other security experts) have been telling people for many years
that using IE is suicidal.  It doesn't matter how careful you are, it
doesn't matter how many anti-virus band-aids you use, it doesn't matter
which content-sanitizing proxies you use, your system *will* be compromised.
This is why "using IE" is a termination offense at a growing number of
companies/organizations: it's incredibly dangerous and thus very stupid.
Sadly, there are many supposed "security pros" who number themselves
members of my profession and have a string of laughably worthless
"certifications" after their names who haven't caught on to what the
rest of us have known for many years.  It's embarrassing, frankly.

I recommend Firefox as the best-available alternative, with nods to
Safari, Opera and others, because it's not possible to do worse than IE.
And I have a set of plug-ins/extensions that I recommend as well:

1. AdBlock Plus

This makes nearly all banner ads go away.  Given that banner ads
are highly annoying, this is welcome.  Given that they're being
increasingly used to distribute malware, it's becoming necessary.

2. NoScript

This takes a little bit of work to use, but it is the single biggest
thing you can do to improve your security: it's *more* important
than having anti-virus installed (presuming you're on Windows).
NoScript stops the plethora of JavaScript et.al. attached to web sites
from running *until you permit it to run*.  You can enable it to
run once or every time you visit the site.  Now the good news is
that this stops all kinds of attacks cold. The bad news is that
most web designers are utterly clueless morons who have failed
to grasp what the web is, why it exists, and what problems it was
intended to solve -- and they've designed very poor sites that don't
work at all unless JavaScript is enabled for them.  Still, in practice,
this isn't a big deal: most of us visit the same limited set of web
sites and telling NoScript to permit them every time a single click.

It's also a useful exercise: it highlights those sites which don't
even present a home page or usable navigation without JavaScript.
This is a prima facie indicator of incompetence and should cause
you to seriously question whether the site itself is secure.

3. BugMeNot

There are any number of idiotic sites which, while free, won't let you
look at their content until you surrender a chunk of your privacy by
providing them with a name and an email address.  BugMeNot deals
with these idiots by feeding them the bogus data they deserve.

4. TACO

Targeted Advertising Cookie Opt-Out: this disables persistent
tracking cookies used by any number of spamXXXXadvertisers and
is a good step toward protecting your privacy.

5. CustomizeGoogle

If you use Google as your search engine, this will enable you to
suppress a lot of the cruft and add some useful features.  Unlike
the first four, this isn't a security/privacy measure, but it's
still pretty darn useful.

6. DownloadStatusbar

This allows you to manage downloads much more effectively than the
code that's built into Firefox.  Debate exists about whether this
should subsume existing functionality or not: some of that's a matter
of preference, but there are solid arguments both ways.


Of all these, the first two are the biggest bang for the buck,
so to speak.  I use them, even though I don't run Windows.

---Rsk
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Mark Sanders <marksanders_at_sandmarks.net>
subject: Re: [Paddlewise] Firefox Web Browser Plugins
Date: Sat, 06 Mar 2010 08:38:31 -0800
Thaanks, I like reading about the addons people use. I haven't taken 
advantage of many, although I love FireFTP for managing my website.

Mark
www.sandmarks.net

On 3/6/2010 4:55 AM, Rich Kulawiec wrote:
> On Fri, Mar 05, 2010 at 09:42:49PM -0800, Craig Jungers wrote:
>    
>> If you use Firefox for your browser (and, trust me, you should.... or any
>> browser other than the MS version of Internet Explorer that probably came on
>> your computer) you know that there is a plethora (literally) of "plug-ins"
>> available for that browser. You can change everything if you want to; or
>> nothing. But there are a few that you should consider.
>>      
> I (among other security experts) have been telling people for many years
> that using IE is suicidal.  It doesn't matter how careful you are, it
> doesn't matter how many anti-virus band-aids you use, it doesn't matter
> which content-sanitizing proxies you use, your system *will* be compromised.
> This is why "using IE" is a termination offense at a growing number of
> companies/organizations: it's incredibly dangerous and thus very stupid.
> Sadly, there are many supposed "security pros" who number themselves
> members of my profession and have a string of laughably worthless
> "certifications" after their names who haven't caught on to what the
> rest of us have known for many years.  It's embarrassing, frankly.
>
> I recommend Firefox as the best-available alternative, with nods to
> Safari, Opera and others, because it's not possible to do worse than IE.
> And I have a set of plug-ins/extensions that I recommend as well:
>
> 1. AdBlock Plus
>
> This makes nearly all banner ads go away.  Given that banner ads
> are highly annoying, this is welcome.  Given that they're being
> increasingly used to distribute malware, it's becoming necessary.
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Rich Kulawiec <rsk_at_rockandwater.net>
subject: [Paddlewise] An apropos little tale [was: Firefox Web Browser Plugins]
Date: Sun, 7 Mar 2010 12:45:27 -0500
Please forgive me for following up my own previous message, but I've
<chuckle> taken a little grief offlist for being, hmmm, "unduly alarmist".

So I thought I'd tell you all a little story that might make it
clear why I write things about security as, ummmm, strongly as I do.
(Besides the fact that I've been doing 'net security work for 30
years and can out-curmudgeon *anyone*. ;-) )

Let me begin with a question that I know those of you who enjoy
spy thrillers and such will be able to answer: who is the best spy?

The answer of course, is "one who does not know they are a spy".

So suppose there was A Bad Guy out there who wanted to send spam,
engage in some phishing, run some DoS (denial-of-service) attacks,
and other nasty things.  Should The Bad Guy pay for some server
space at somebody's hosting site and have at it?  Well, maybe:
but that costs money.  And it's traceable.  And it's limited.
And the end result will probably be that he won't get very far
before someone pulls his plug.

Now suppose he had a clever idea: why not hijack someone *else's*
system and use that, without their knowledge?  Better yet: why not
hijack *multiple* systems?  This is much cheaper; it's harder to
shut down (in its entirety); it's more convenient; and it's harder
to defend against because there are multiple systems involved.

Then he might have an even more clever idea: having worked all
this out -- hijacking the systems, putting them to work doing various
kinds of nastiness, etc. -- he could rent them out to others who
had nasty things to do, but didn't have the resources.

Of course none of this would be any good for the users who had their
systems hijacked; we all know the principle "If someone else can
run arbitrary code on your computer, it's not YOUR computer any more".
Not only would every scrap of data stored on their systems be exposed,
not only would every password they type be grabbed by keystroke loggers,
but they would be blamed for the damage done by their systems.

But the clever person we're talking about here would hardly balk
at any of that.  He'd just work out all the myriad technical details,
and hijack 10 or 20 or even 100 systems.  He'd release viruses and
use trojan downloaders on web sites to create more, and he'd figure
out how to manage them all, and life would be pretty good for him
because the chances that he'd be caught -- if even reasonably careful --
would be very, very tiny.  And if he happened to live in certain locales
scattered around the world, then he could forestall that by making
sure that the local authorities were well-paid out of his profits --
well enough to make sure that they stayed bought.  Maybe, in some
cases, he might find it convenient to link up with organized crime,
in order to leverage its organizational savvy, its connections, its
abilities to broker transactions, launder money and enforce discipline.

<cough>

Of course those of you who are chuckling to yourselves already know
that this is not a little work of fiction: it's history.  One species of
the malware used to hijack these systems is dissected in detail here:

	Sobig.a and the Spam You Received Today
	http://www.secureworks.com/research/threats/sobig
										
	Sobig.e - Evolution of the Worm
	http://www.secureworks.com/research/threats/sobig-e/
										
	Sobig.f Examined
	http://www.secureworks.com/research/threats/sobig-f

It's not the only one, but it serves as a general example.

You also know that we're not talking about 10 or 20 or 100 systems
here.  More like, oh, 100-200 MILLION.  (Yes, really.  Vint Cerf, widely
regarded as one of the fathers of the Internet and now at Google, has given
250M as his estimate.  Valdis Kletnieks at VaTech says 140M.  I use 200M
as my current best guess, 150M when I'm being conservative.)

And every now and then one of the clever people behind these screws up
and gets caught, and then we have this:

	Mariposa Botnet beheaded
	http://hosted.ap.org/dynamic/stories/U/US_TEC_BOTNET_BUSTED?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2010-03-02-14-26-32

Supposedly -- 12.7 million systems.  <shrug> Maybe, maybe not.  Does it
really matter if it's half or twice that?  It's still a LOT.

And keep in mind: these were the guys who were dumb enough to get caught.
We're aware of much larger operations -- better-run ones, too.

(Oh, and don't get too excited about this takedown.  All that it means
is that 12.7 million already-compromised systems are sitting out there
waiting for the next person clever enough to take control of them.
My guess is that this has already happened.)

If you know where to look online, you can find places where the owners
of these invisible networks are selling their services: so many dollars/euros
for many systems for so many days, and so on.  They're quite happy to
provide consulting and programming services if you need those -- just
pay up.  They can show you how to set up your whole operation so that
it's completely hosted on one (or more) of these botnets, which is really
handy if you're doing something very nasty like peddling kiddie porn,
or selling credit card datasets for $1.75 each (more if credit limit
above $10K), or collecting unfortunate photographs of people who probably
should not be naked at the same time in the same place (for possible future
use in extortion).

And they're always looking for more systems.  Including yours.  So if
you think that your firewall and your anti-virus and your anti-spyware
will protect you: that's very nice.  A pretty good chunk of the 200M
people whose systems now belong to someone else thought that too.

The fix?  The best fix is "don't run Windows", although that's not a
panacea.  Still, it's an excellent first step.  I don't permit Windows
systems on my network.  Period, full stop.

Next best is "never use IE" and "never use Outlook": you can't do worse,
so pick anything else, like Firefox and Thunderbird.

Get a firewall -- a REAL firewall, which means a dedicated box, not
some junk piece of software that runs under Windows and is more like
a screen door than a bank vault.   They're under $100.  Use AdBlock
and NoScript with Firefox.  Think about what the hell you're doing
before you click.  Turn your system off or physically disconnect it
when you're not using it.  (Many laptops have a "wireless off" hardware
switch.  Use it.)

Bookmark your bank, your credit union, etc., all the sites that you provide
critical information too and ALWAYS USE THE BOOKMARKS to go to them --
that is, NEVER click on a link in a mail message  that claims to be
from them.  (If you're using the bookmarks, and you set them up properly
to begin with, you're going to be pretty much phish-immune...unless an
attacker already owns your system, in which case you're hosed anyway.)

( Incidentally, here's something that will give you pause: those 200M
compromised systems out there?  They're not all sitting in folks'
homes.  They're in corporations and universities, they're desktops
and laptops and servers, and even cell phones (some of which run
versions of Windows).  A few years back we caught one on a US ship.
So there is absolutely no reason to think that all the Windows systems
at your bank or your credit card company are secure.  After all, it's only
*your* private data they're dealing with: why should they bother?
It's much cheaper to just have a spokesliar stand up at the press
conference after the next dataloss incident and say "We take the
privacy of our customers seriously" while the CEO spends more on
carpet for his/her office than on actually-useful IT security. )

Anyway: Don't install any software you don't need.  Don't ever reply
to spam or phishes, no matter how pissed off you are: if you do, you'll
furnish highly valuable intelligence to the enemy.  Do not indulge
your curiosity to "just take a look" at the spammer's site -- there
are things there that bite.  Hard.

Don't download everything that looks shiny, especially toolbars --
they tend to fall into two categories: (1) those that are spyware and
(2) those that are so badly written that they weaken your security.
Keep your darn programs patched -- Firefox and Thunderbird will notify
you, pay attention!  Clear your browser of personal data often -- again,
Firefox makes this easy.  Make backups.  (You ARE doing backups, aren't you?
For crying out loud, an external USB drive that holds half a terabyte
is available at any office store for $80.  Go.  Now.  Get up, get in
the car, get your butt over there and buy one.)  Don't furnish your
password to anyone who asks for it: real system admins with real clue
will simply *reset* your password to one of their choosing if they
really need to do that.  Do not, do not, do not let your kids use
your computer.  Get them their own.  Make it a Mac or Linux box
unless you want to be scrubbing cruft off it every other week.

Pick strong passwords, and no, you may not use your street, dog,
car, boyfriend, or anything else that you blab about on Facebook
or whatever this month's transient and unimportant site is.  If you're
walking around with your laptop, encrypt the drive with TrueCrypt,
so that when it's stolen by airport baggage handlers and sold, at least
you're only out the hardware.  (Consider keeping your valuable data on
a USB thumb drive that rides in your pocket -- also encrypted in case
you lose it -- and only keeping your programs on your laptop.)
Don't believe any web site that say it's "hacker-safe", "TrustE
certified", "super whizbang protected with extra vitamins": anybody
can buy those labels and slap 'em on.  Use a low-credit-limit card
(under $1K) for routine online purchases, and ONLY for routine
online purchases.

Have you backed up your system yet?

One of the favorite tricks for attackers these days is to compromise a
popular web site and use it to get at everyone who visits.  This works
well with (a) men and (b) sites featuring girl parts because (c) we're
stupid that way.  But it's also been used on ordinary commercial sites,
newspapers, etc.  Which is why I recommended AdBlock a few paragraphs
back.  If you are a customer of paypal.com you are not a customer of
paypa1.com.  If you get a request to fiddle with a webmail account you
don't have you're being phished, don't respond to it.  The nice man who
says he's an attorney in Lagos is not going be sending you millions of
dollars of inheritance you didn't know about.  The other nice man
who says you need to download and install his antiantiantispyware is
not on your side.

Be paranoid.  This is not the 'net of the early 80's when none of
us locked our doors and you could pop in, borrow a cup of sugar,
and leave a note.  This is the wild west, rife with roving gangs
that are smart, ingenious, fast, and ruthless.

Think I'm kidding about any of this?  Or exaggerating?  Go read
the Wikipedia entry on "Russian Business Network":

	http://en.wikipedia.org/wiki/Russian_Business_Network

---Rsk
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Bradford R. Crain <crainb_at_pdx.edu>
subject: Re: [Paddlewise] An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 9 Mar 2010 09:16:39 -0800
    Rich...I have to ask you...what in your opinion is wrong with all those
run-away Toyotas out there?

Brad

Subject: [Paddlewise] An apropos little tale [was: Firefox Web Browser 
Plugins]


> Please forgive me for following up my own previous message, but I've
> <chuckle> taken a little grief offlist for being, hmmm, "unduly alarmist".
>
> So I thought I'd tell you all a little story that might make it
> clear why I write things about security as, ummmm, strongly as I do.
> (Besides the fact that I've been doing 'net security work for 30
> years and can out-curmudgeon *anyone*. ;-) )
>
> Let me begin with a question that I know those of you who enjoy
> spy thrillers and such will be able to answer: who is the best spy?
>
> The answer of course, is "one who does not know they are a spy".
>
> So suppose there was A Bad Guy out there who wanted to send spam,
> engage in some phishing, run some DoS (denial-of-service) attacks,
> and other nasty things.  Should The Bad Guy pay for some server
> space at somebody's hosting site and have at it?  Well, maybe:
> but that costs money.  And it's traceable.  And it's limited.
> And the end result will probably be that he won't get very far
> before someone pulls his plug.
>
> Now suppose he had a clever idea: why not hijack someone *else's*
> system and use that, without their knowledge?  Better yet: why not
> hijack *multiple* systems?  This is much cheaper; it's harder to
> shut down (in its entirety); it's more convenient; and it's harder
> to defend against because there are multiple systems involved.
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] An apropos little tale [was: Firefox Web Browser Plugins]
Date: Wed, 10 Mar 2010 07:35:06 -0800
I'm not Rich... but I saw an interview with Steve Wozniak a couple of weeks
ago when the Toyota runaway stuff was just starting back up and he mentioned
that his Prius had run away a few times. Woz seemed convinced that the
problem was in software and that he could "almost" duplicate it.

The "floor mat" solution was, frankly, ludicrous. What could they have been
thinking?

Even so, I would like a Prius... but I want a plug-in version (4 cents a
kw/hour here).


Craig Jungers
Moses Lake, WA
www.nwkayaking.net

On Tue, Mar 9, 2010 at 9:16 AM, Bradford R. Crain <crainb_at_pdx.edu> wrote:

>   Rich...I have to ask you...what in your opinion is wrong with all those
> run-away Toyotas out there?
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Bradford R. Crain <crainb_at_pdx.edu>
subject: Re: [Paddlewise] An apropos little tale [was: Firefox Web Browser Plugins]
Date: Wed, 10 Mar 2010 08:57:32 -0800
     Craig:   I think Toyota is engaged in a gigantic coverup, Floor mats
and brake pedals don't begin to address the recent erratic behavior of their
cars. Almost all of my kayaking buddies drive Toyotas, and I'd hate to
see them accelerate uncontrollably to 100 mph on our narrow, winding roads.
The consequence would be undeniable.

Brad


  I'm not Rich... but I saw an interview with Steve Wozniak a couple of weeks
ago when the Toyota runaway stuff was just starting back up and he mentioned
that his Prius had run away a few times. Woz seemed convinced that the problem
was in software and that he could "almost" duplicate it.

  The "floor mat" solution was, frankly, ludicrous. What could they have been
thinking?

  Even so, I would like a Prius... but I want a plug-in version (4 cents a
kw/hour here).


  Craig Jungers
  Moses Lake, WA
  www.nwkayaking.net


  On Tue, Mar 9, 2010 at 9:16 AM, Bradford R. Crain <crainb_at_pdx.edu> wrote:

      Rich...I have to ask you...what in your opinion is wrong with all those
    run-away Toyotas out there?
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] An apropos little tale [was: Firefox Web Browser Plugins]
Date: Wed, 10 Mar 2010 09:10:24 -0800
On Wed, Mar 10, 2010 at 8:57 AM, Bradford R. Crain <crainb_at_pdx.edu> wrote:

>
>      Craig:   I think Toyota is engaged in a gigantic coverup, Floor mats
> and brake pedals don't begin to address the recent erratic behavior of
> their
> cars. Almost all of my kayaking buddies drive Toyotas, and I'd hate to
> see them accelerate uncontrollably to 100 mph on our narrow, winding roads.
>
> The consequence would be undeniable.
>

I know a little bit about software controlling hardware and it can be very
difficult to find a bug that only shows up under certain combinations of
circumstances but it sure seems like Toyota is flailing around.

We used Honeywell 316 computers (with 128K of 32bit core RAM) to control the
positioning and power monitoring on dynamically positioned drill rigs back
in the 1970s and 1980s. They were programmed by a machine-code genius from
Seattle named Mario who would occasionally come out and manage to cram one
more function into that scanty memory. It was very interesting to chat with
Mario.

That system had two complete computer systems with one of them actually
controlling the hardware and the other one comparing its output with the
on-line output. Every now and then, with exactly the same program and
exactly the same data input, they would disagree wildly. At that point I had
to determine which one was likely correct. The consequences were a US$1
million drive-off. It was a fun job. A combination of computer engineer and
merchant marine deck officer.

I suspect Woz is correct about the software glitch. I only wonder why Toyota
is so adamant at refusing to address it.


Craig Jungers
Moses Lake, WA
www.nwkayaking.net
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Gary J. MacDonald <garyj_at_rogers.com>
subject: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Mon, 12 Apr 2010 19:16:28 -0400
http://www.canadiandriver.com/2010/03/22/feature-not-so-fast-toyota%E2%80%99s-unintended-acceleration.htm?page=all

I think this is a pretty good analysis of the "runaway" situation by an 
independent and experienced analyst.
It might in fact happen once in a long while, but I think a lot of it is 
"pedal misapplication" as suggested.

Gary

On 10/03/2010 11:57 AM, Bradford R. Crain wrote:
>       Craig:   I think Toyota is engaged in a gigantic coverup, Floor mats
> and brake pedals don't begin to address the recent erratic behavior of their
> cars. Almost all of my kayaking buddies drive Toyotas, and I'd hate to
> see them accelerate uncontrollably to 100 mph on our narrow, winding roads.
> The consequence would be undeniable.
>
> Brad
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Mark Sanders <marksanders_at_sandmarks.net>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Mon, 12 Apr 2010 17:42:23 -0700
Bring back the Tin Lizzies, Dagnabit!

On 4/12/2010 4:16 PM, Gary J. MacDonald wrote:
> http://www.canadiandriver.com/2010/03/22/feature-not-so-fast-toyota%E2%80%99s-unintended-acceleration.htm?page=all 
>
>
> I think this is a pretty good analysis of the "runaway" situation by 
> an independent and experienced analyst.
> It might in fact happen once in a long while, but I think a lot of it 
> is "pedal misapplication" as suggested.
>
> Gary
>
> On 10/03/2010 11:57 AM, Bradford R. Crain wrote:
>>       Craig:   I think Toyota is engaged in a gigantic coverup, Floor 
>> mats
>> and brake pedals don't begin to address the recent erratic behavior 
>> of their
>> cars. Almost all of my kayaking buddies drive Toyotas, and I'd hate to
>> see them accelerate uncontrollably to 100 mph on our narrow, winding 
>> roads.
>> The consequence would be undeniable.
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Mon, 12 Apr 2010 18:09:49 -0700
On Mon, Apr 12, 2010 at 5:42 PM, Mark Sanders <marksanders_at_sandmarks.net>wrote:

> Bring back the Tin Lizzies, Dagnabit!
>
>
>  BUY KIA!!!   :P
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Mon, 12 Apr 2010 17:40:28 -0700
OMon, Apr 12, 2010 at 4:16 PM, Gary J. MacDonald <garyj_at_rogers.com> wrote:

>
> http://www.canadiandriver.com/2010/03/22/feature-not-so-fast-toyota%E2%80%99s-unintended-acceleration.htm?page=all
>
> I think this is a pretty good analysis of the "runaway" situation by an
> independent and experienced analyst.
> It might in fact happen once in a long while, but I think a lot of it is
> "pedal misapplication" as suggested.
>
> Gary
>

I read the Canadian Driver story and I think it's BS. At least with the
modern cases. And possibly BS with regard to the cases the author cites from
the 1970s and 1980s (pre "drive-by-wire").

The author is claiming that the modern problems stem from people
inadvertently stepping on the accelerator pedal (instead of the brake)
before shifting the automatic transmission from "park" to "drive". Then,
when the car moves more than the driver expects he/she steps harder on the
accelerator thinking that it's the brake. You can demonstrate this on your
own vehicle if you like.

This may have worked in the 1970s and 1980s but it doesn't wash with modern
vehicles because there is a lockout in these systems that will not allow the
vehicle to shift into "drive" from "park" unless the brake is depressed. The
locking system is not fooled by the driver depressing the accelerator pedal
instead.

Further, it does not account for sudden acceleration of a vehicle while it
has been operating in a normal manner on the roadway. Nor does it account
for the several instances of Toyotas being driven into a dealership with the
engine racing by people who managed to get the vehicle into neutral (which
is not always possible, from some reports).

I also noticed that the author is an expert in human ergonomics. Maybe it's
a case of only knowing how to use a hammer so that becomes the tool of
choice for everything. He understands human frailties and therefore suspects
human frailty.

If a California State Patrol officer can get involved in a sudden
acceleration incident (which kills him and his family at an intersection
they cannot stop for) then I suspect it's not a human problem. And Steve
Wozniak, a guy who may know a little something about computers, says that
his Toyota has run away with him several times but he's always managed to
fiddle with enough things to make it stop.

Tord's remarks about a complete shut-off system that they installed on the
buses he drives seems like a reasonable idea to me. It won't solve the
problem of runaway vehicles but it will certainly stop *that* runaway
vehicle.

Also notice that none of these problems have been reported in vehicles with
manual transmissions. Interesting, no?

Craig Jungers
Moses Lake, WA
www.nwkayaking.net
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Paul Hayward <pdh_at_mmcl.co.nz>
subject: RE: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 13 Apr 2010 20:17:13 +1200
> Canadian Driver story and I think it's BS

Craig - you may be right, the guy may be a shill for Audi (or Toyota) - but
he made a surprising amount of sense to me (and I'm not uncritical of
Psychology).

Assuming he's on the level with the research (if not, he can prove anything
;-), he has one very compelling argument. To me, the biggest argument for
the validity of the 1980's Audi analysis is the disappearance of the problem
when Audi invented the brake pedal / transmission interlock switch. 

That is the sort of solution that really appeals to me. Make people step on
the correct pedal before they can engage a gear to drive away and suddenly
all the scary Audi stories stop... All the run-away Audi accelerators
magically stop running away with people - because the people are forced to
do it correctly. 

Humans make mistakes. They are also very resistant to the idea that they can
make mistakes. A quick look at the history of table saws - which are mostly
free of software - will demonstrate both those principles pretty well. There
are lots of missing digits and lots of missing blade guards (removed by the
operators).

If you want to make a machine safe - the hardest part is idiot-proofing it.
Software errors are much, much easier to get right. 

I say that after many years of work with machinery, small computers and
designing what we used to call 'the man-machine interface' - to draw on for
all the examples you could ask for.

So Dr Schmidt may well be extrapolating incorrectly into 2010 - I've no
proof either way. If I had to bet, I'd probably put my money on him rather
than on the quality of analysis of our modern hyped-up media... I also don't
believe in the infallibility of California State Police officers - hell,
even aircraft captains get it wrong from time to time and the selection &
training processes they face are somewhat more careful.

Best Regards
Paul Hayward, Auckland, New Zealand
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Chuck Holst <cholst_at_bitstream.net>
subject: RE: [Paddlewise] Toyota Problems
Date: Tue, 13 Apr 2010 09:18:02 -0500
Human error is certainly possible, but one of the Toyotas that went out of
control in California was had plenty of evidence afterward that the driver
was applying the brakes as hard as he could. 

Here in Minnesota, a man was sentenced to five years in prison for
manslaughter after his Toyota failed to stop, and hit another vehicle. With
no evidence that the car was faulty, the jury concluded he had stepped on
the accelerator instead of the brake pedal. The case is now being reviewed
in light of the recall. Imagine being sent to prison because your car acted
up!

Chuck Holst


 

__________ Information from ESET NOD32 Antivirus, version of virus signature
database 5025 (20100413) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Mark Sanders <marksanders_at_sandmarks.net>
subject: Re: [Paddlewise] Toyota Problems
Date: Tue, 13 Apr 2010 08:00:09 -0700
When you read a story like this, it's not so hard to believe pilot error 
in the Toyotas...
At least she'll look young and fresh at her next hearing.

*http://tinyurl.com/yzj9tz5

*
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] Toyota Problems
Date: Tue, 13 Apr 2010 08:36:31 -0700
She should have taken a bit more time and touched up the bleach job on her
hair while she was at it. But I'm not sure anything will make her look
"young and fresh".



On Tue, Apr 13, 2010 at 8:00 AM, Mark Sanders <marksanders_at_sandmarks.net>wrote:

> When you read a story like this, it's not so hard to believe pilot error
> in the Toyotas...
> At least she'll look young and fresh at her next hearing.
>
> *http://tinyurl.com/yzj9tz5
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Craig Jungers <crjungers_at_gmail.com>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 13 Apr 2010 07:22:11 -0700
On Tue, Apr 13, 2010 at 1:17 AM, Paul Hayward <pdh_at_mmcl.co.nz> wrote:

>
> So Dr Schmidt may well be extrapolating incorrectly into 2010 - I've no
> proof either way. If I had to bet, I'd probably put my money on him rather
> than on the quality of analysis of our modern hyped-up media... I also
> don't
> believe in the infallibility of California State Police officers - hell,
> even aircraft captains get it wrong from time to time and the selection &
> training processes they face are somewhat more careful.
>
> I have lots of problems with psychology, actually. My experience with psych
was mainly when I was an undergrad engineer and I was left less than
impressed. I think that Dr. Schmidt (who is "emeritus" by the way) is
probably still living in 1980. Most of those incidents happened at start-up
and involved vehicles hitting the garage wall or the vehicle in front of
them. The 2000 incidents seem to be happening during operation when the
driver has already been moving for some period of time.

And if the 1980 Audi cars were designed so that a significant number of
drivers could not tell whether their foot was on the accelerator or the
brake then I submit that there just might have been a design problem. Never
having owned an Audi I couldn't say. It doesn't seem to me to be *that*
complicated getting a car started and into gear.

The Calif. State Patrol officer was actually on the cell phone going through
procedures to try to shut the car down and couldn't. I can understand a
brief, momentary lapse where someone might confuse stepping on the
accelerator pedal for stepping on the brake but I can't see a steady state
incident unless the driver were too stupid to understand "turn off the key".
Airplane pilots can get overloaded with information and make mistakes or can
get distracted and make mistakes but they don't very often make mistakes
going through the check list.

And, anyway, the California cop was not the only one to have a problem.
Steve Wozniak, the co-founder of Apple (actually the guy who designed and
built the first few versions) had something to say about his Prius and
unintended acceleration. In a short interview (or at least the portion I saw
was short) he mentioned that it had happened to him more than once and while
he couldn't reproduce the problem he had figured out a way to get out of it.
Unfortunately he left that part out.

Then there has been at least one incident of unintended acceleration in
which the driver drove his vehicle into a Toyota dealership and left it
sitting in neutral at full engine speed while the floor mats were in the
trunk.

If I were to speculate I'd guess that the problem will resolve down to a
combination of design problems compounded by circumstances not easily
recognizable by the average driver.

Either that or stray cosmic rays. Don't laugh.


Craig Jungers
Moses Lake, WA
www.nwkayaking.net
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Steve Cramer <cramersec_at_charter.net>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 13 Apr 2010 11:31:30 -0400
Pardon me, I thought I was subscribing to a paddling discussion group. 
Well, as long as I'm here, I'll make a comment or two.

On 4/13/2010 10:22 AM, Craig Jungers wrote:
>> I have lots of problems with psychology, actually. My experience with psych
> was mainly when I was an undergrad engineer and I was left less than
> impressed. I think that Dr. Schmidt (who is "emeritus" by the way) is
> probably still living in 1980.

I think that Craig is going out on a limb expressing opinions about 
psychology if all he knows is Psych 101 from the 1960's. Full 
disclosure: I have 2 degrees in psychology. "Emeritus" is the word we in 
the academic world use to mean "He's retired, but still working and 
doing important enough stuff that we'll provide him with an office, 
phone, secretary, and computer."

> And if the 1980 Audi cars were designed so that a significant number of
> drivers could not tell whether their foot was on the accelerator or the
> brake then I submit that there just might have been a design problem. Never
> having owned an Audi I couldn't say. It doesn't seem to me to be *that*
> complicated getting a car started and into gear.

But in fact it was, or at least people _thought_ it was. And the 49 
other models from 19 other manufacturers were all poorly designed as 
well? I used to own a VW Beetle that I could heel-and-toe with the edge 
of my foot. Those pedals were close. Ever hear about unintended 
accelleration with a Beetle? Stop snickering.

> The Calif. State Patrol officer was actually on the cell phone going through
> procedures to try to shut the car down and couldn't. I can understand a
> brief, momentary lapse where someone might confuse stepping on the
> accelerator pedal for stepping on the brake but I can't see a steady state
> incident unless the driver were too stupid to understand "turn off the key".

The guy on the phone was the CSPO's brother in law, and I didn't hear 
any evidence that he was doing anything besides praying. Nobody used the 
words "turn off the key" on the tape. One would think CSPOs would not 
panic in that kind of situation, but apparently this one did. Panic, 
you'll recall, is one of the factors that Schmidt points to as a cause.

> Airplane pilots can get overloaded with information and make mistakes or can
> get distracted and make mistakes but they don't very often make mistakes
> going through the check list.

Check list? For cars?


> If I were to speculate I'd guess that the problem will resolve down to a
> combination of design problems compounded by circumstances not easily
> recognizable by the average driver.

Yup. There seems to be evidence that some Toyotas have throttle 
problems, but really none that Audis did

> Either that or stray cosmic rays. Don't laugh.

Not laughing.

Steve
-- 
Steve Cramer
Athens, GA
http://www.savvypaddler.com
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Jackie Myers <jackie_at_muddypuppies.com>
subject: Re: [Paddlewise] Toyota Problems WAS=> x WAS ?
Date: Tue, 13 Apr 2010 12:33:19 -0700
Steve Cramer wrote:

> Pardon me, I thought I was subscribing to a paddling discussion group. 


Jokes on us, I guess.

Jackie
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Paul Montgomery <paul_at_paddleandoar.com>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 13 Apr 2010 15:38:26 -0700
On Apr 13, 2010, at 8:31 AM, Steve Cramer wrote:

> Pardon me, I thought I was subscribing to a paddling discussion group.

It is and you are. If this were any other kind of internet discussion  
group it would have fallen into flame wars and Toyota would have been  
compared to Hitler long ago.


Paul Montgomery
paul_at_paddleandoar.com
http://paddleandoar.com
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************
From: Steve Cramer <cramersec_at_charter.net>
subject: Re: [Paddlewise] Toyota Problems WAS=> Re: An apropos little tale [was: Firefox Web Browser Plugins]
Date: Tue, 13 Apr 2010 20:56:22 -0400
Touche.

On 4/13/2010 6:38 PM, Paul Montgomery wrote:
> On Apr 13, 2010, at 8:31 AM, Steve Cramer wrote:
>
>> Pardon me, I thought I was subscribing to a paddling discussion group.
>
> It is and you are. If this were any other kind of internet discussion
> group it would have fallen into flame wars and Toyota would have been
> compared to Hitler long ago.

-- 
Steve Cramer
Athens, GA
http://www.savvypaddler.com
***************************************************************************
PaddleWise Paddling Mailing List - Any opinions or suggestions expressed
here are solely those of the writer(s). You must assume the entire
responsibility for reliance upon them. All postings copyright the author.
Submissions:     PaddleWise_at_PaddleWise.net
Subscriptions:   PaddleWise-request_at_PaddleWise.net
Website:         http://www.paddlewise.net/
***************************************************************************

This archive was generated by hypermail 2.4.0 : Thu Aug 21 2025 - 16:33:53 PDT