Posted on
by

Some potentially nasty browser security vulnerabilities found this weekend in Mozilla and in Safari. Both involve software update mechanisms. The Firefox one tricks the browser into thinking it’s installing from a trusted update site (the maintainers of updates.mozilla.org and addons.mozilla.org—the only trusted sites by default—have made some changes on their server to prevent the exploit from working). The Safari one takes advantage of the Macintosh tradition of automatically opening archives. This one just happens to unzip itself into the location where Dashboard stores its widgets.

IEBlog has weighed in with a balanced (i.e. non-fanboyish) comment on just who “us” vs. “them” should mean: responsible developers & security researchers vs. the malicious ones. It won’t happen—people are too hunkered down in their own trenches—and even with Mozilla, Opera and Apple collaborating on specs, I don’t expect to see much in the way of collaboration on security except in the actual open-source world. (Even then, I suspect there’s too much rivalry between Gecko and KHTML developers to do much collaboration.) Continue reading →

Posted on
by

When we arrived in Hawaii, I posted this photo taken from our hotel room balcony:

View from hotel

What I didn’t mention was that that shot was carefully cropped. The view really looked like this:

Less artfully cropped view

Well, hey, we got the cheap rooms, so you kind of expect that. Still, there was a lot to see right on the hotel grounds. First of all, we stayed at the Outrigger Keauhou Beach Resort south of Kailua-Kona. Outrigger had recently taken over the hotel, and they were in the midst of remodeling. They had to block off part of the parking lot for a couple of days in order to bring in a crane and replace the air conditioner. So I expect any review of the facilities themselves is going to be outdated within a couple of months.

The hotel grounds include a couple of heiau ruins, some tide pools, and a small garden area. Continue reading →

Posted on
by

Two weeks ago (April 25, specifically) we went to a Tori Amos concert in LA. It was a vastly different experience from the others we’ve been to. You see, she started out as basically her and a piano, and each album has added more and more layers of instruments. It always reminds me of a scene in Death: The Time of Your Life (Neil Gaiman has been friends with Tori since she was working on Little Earthquakes) in which Foxglove’s manager(?) is explaining that as she gets more popular, they have to book bigger and bigger venues, and beyond a certain size just a girl and her guitar isn’t going to cut it: she needs to hire a band.

Well, the “Original Sinsuality” tour provided some clues going in: It was a short tour, the venues—in this case UCLA’s Royce Hall—were comparatively small (which is why the show sold out in 10 minutes), and it was named after a “quiet Tori” song. She dispensed with the band entirely. It was just Tori Amos, a grand piano, two kinds of organs and another keyboard I couldn’t quite identify. We heard songs you never hear in concert (“Yes Anastasia,” “Doughnut Song”) or wouldn’t expect to (“Toast”), even when she takes a break from the band and does a piano set.

So, onto a review: Continue reading →

Posted on
by

Looking at the list of “most popular” links on Del.icio.us, it seems someone has scanned the entire Book of Bunny Suicides and its sequel, both by Andy Riley.

Good grief, people—you can pick up the book for $7.00 at any bookstore. I can understand posting a couple of excerpts, but from what I can tell, these people have scanned and posted the entire book. They haven’t even credited the source! In the blog postings that show up on a “bunny suicides” search, most of them don’t even seem to know where the cartoons are from. Heck, even with pirated MP3s you usually know who sang the song.

Google has pulled a few of the sites from their index in response to a DMCA complaint. (Interestingly, Google themselves linked to the Chilling Effects entry.)

It always amazes me how rude people can be.

Book of Bunny Suicides Return of the Bunny Suicides

Posted on
by

Maybe it’s the housing costs, but people in San Francisco need a little extra incentive to give out their computer password than people in Liverpool. Last year a survey found that 71% would reveal their password for a chocolate bar. A similar survey this month in San Francisco found that 66% would give it up for a coffee.

At least Verisign made good on the offer—with a $3 Starbucks gift card.

Posted on
by

Too bad it’s the bad guys.

As reported on DailyDave and picked up at SANS, Email Battles and elsewhere, there are phishers out there using a botnet (a network of infected “zombie” computers) not just to send emails, but to host the websites and the DNS for their scam.

Imagine what this technology could do for legitimate sites. It could potentially surpass Akamai’s system of worldwide mirrors. You could set up something like BitTorrent that would automatically mirror sites you’re looking at. Getting Slashdotted would actually improve a site’s response!

Posted on
by

A new Angel comic book mini-series (from IDW, rather than Dark Horse), Angel: The Curse, picks up after the end of the TV series.

In this first issue of a new Angel tale, Angel has survived the conclusion of his TV show and finds himself in a mysterious Romanian forest. There, his search for the Gypsy tribe that cursed him years ago takes a turn for the worse.

I suspect we’ll get a “once out of the pit…” explanation (i.e. no explanation at all) and the cliffhanger’s resolution will remain open for Joss to deal with in a movie-of-the-week or something.

But what galls me is that the book is supposed to have four covers. OK, one variant every once in a while is nice, and I can even go for Dark Horse’s early efforts to have one drawn cover and one photo cover to get the newsstand audience (is there such a thing anymore?)… but the only reason to do four covers for one book is to get collectors to buy four copies. It was an insulting gimmick in the early 1990s, and it annoys me that the practice never quite went away. Worse, TV Guide took it mainstream. I guess we’ll know we’re in trouble when Time or National Geographic starts doing multiple collectors’ covers.

*grumble*