Category: Tech

Posted on
by

CNET posted an article today, Concern grows over browser security, about the rise in browser-based attacks (mostly spoofed sites for phishing, but also attempts to install viruses and other malware through web browser security holes).

What’s interesting about the article is that nowhere does it mention Mozilla, Opera or Safari.

Could it be that attacks through these browsers are less common than attacks through Internet Explorer, even adjusted for market share? (Sure, IE has more than 90%, but there are a lot of people using the others.)

Or could it be that the author has succumbed to the “Web Browser = MSIE” belief?

If nothing else, you’d think that their statistics would have a bit more information, but it’s a single number for “browser” attacks. Nothing more detailed than that.

To be fair, the press release doesn’t provide any better numbers. In fact, it mentions no browser by name at all. (One can hope their data is a bit more detailed, but the purpose of the study appears to have been to identify trends in types of attacks, not in the software targeted.) And yet IE is the only browser CNET mentions, despite the alternatives’ better security records.

Posted on
by

A few weeks ago I was looking at the website error logs and noticed some attempts to access images with names like /flash/images/%20%20%20%20%20%20%20ans3.jpg. I got around to looking at it today, and all of them are the same name, all of them from browsers looking at my profile of the Teen Titans, which includes an image called teentitans3.jpg.

I finally realized what’s going on. Some moronic filter has broken up the name not as “teen titans” but as “teen tit ans,” decided it must be porn, and replaced the “offending” words with spaces (%20 is the code for a space in a URL).

It really makes me wonder how badly mangled the page looks to these people, especially if it turns out that every instance of the team’s name gets pointlessly erased.

Further reading: The Censorware Project, Peacefire, Electronic Frontier Foundation.

Posted on
by

I just caught a reference to Arve Bersvendsen’s EvilML file. What is it? It’s an HTML document designed to make use of the fact that HTML is, technically, SGML, which has all kinds of strange shortcuts you can use. Of course, no one has ever bothered to make a web browser that actually handles all these shortcuts.

It’s hard to describe it. The code is barely readable. The first line of text looks like this: <body<h1<em>Emphasized</> in &lt;h1&gt;</>. No browser in existence is likely to display it correctly, and yet — amazingly enough — it validates…

I already thought that moving to the more rigidly-defined XHTML was a good idea, but suddenly it makes a lot more sense!

Posted on
by

I found this article on OSNews: A History of Apple’s Operating Systems. The article starts with the Apple II and works its way up to Mac OS X, touching all the various branches in between – as well as Apple OSes that never quite made it out the door, and other OSes – like NeXtStep (whatever the capitalization is) – that influenced it on its way. Hey, where else are you going to find screenshots of the Apple I and Macintosh System 1?

It’s a fascinating read. I suspect the site will be due for another Slashdotting soon…

Posted on
by

In CNN’s report on the discovery that Mars once had liquid water – and thus may have once been hospitable to life – it mentions that the Spirit and Opportunity missions cost about $820 million. The IMDB estimates the budget for Spider-Man 2 at $200 million.

In other words, each mission cost two big-budget summer movies.

Maybe we should get Hollywood to finance space exploration. It might help placate the “We’re wasting too much money in space!” crowd without abandoning the pursuit of knowledge.

Posted on
by

Last month I finally got around to installing antivirus software on the one Windows computer we have at home. While I’ve found Norton Anti-Virus has worked well on my system at work, I ended up choosing McAfee Internet Security Suite for two reasons: (1) unlike Symantec, they don’t use a product activation scheme, and (2) since McAfee bought Deersoft, purchasing a McAfee-related anti-spam product should help fund SpamAssassin development.

Big mistake.

Since installing McAfee, this computer has crashed at least once each time I’ve turned it on (usually with a McAfee dialog box visible). The privacy service adds another login prompt, whether you want it or not. It tends to pop up dialogs when you’re in the middle of, say, running ScanDisk to make sure the system survived the crash McAfee caused five minutes earlier. And, ridiculously, the software and virus definition update runs through Internet Explorer.

By this I don’t mean that it expects you to go to the website and download an installer. That would be inconvenient, but acceptable (since you could choose what web browser to use). No, it pops up a “Check for updates” dialog box which then opens Internet Explorer, goes through a set of redirects until it opens a pop-up that looks like a download manager (but is clearly done using HTML), and then downloads and installs the update.

Now forget any issues you might have with buggy rendering, feature parity, monopoly abuse, antitrust, etc. Just look at IE’s track record on security.

Why would you want a security system to rely on something so notoriously insecure?

Symantec has its own update program that calls out, checks for updates, downloads them and installs. You can run it manually, or you can set it to grab and install virus updates automatically. Nowhere in this whole process does Internet Explorer come into the picture – or if it does, it’s hidden away where the power user won’t see it and say “What the hell do they think they’re doing?”

Posted on
by

Cliches aside, it appears that as a result of the trademark suit by Microsoft, Lindows is now going by the name Lin—s (LinDash) in parts of Europe.

Lindows — or Lin—s if you prefer — is a company that has been selling an ultra-user-friendly version of Linux. Criticized by many for lax security (they’ve chosen many of the same convenience vs. security trade-offs that have made Microsoft products so vulnerable) and for odd business practices [archive.org], they’ve nonetheless managed to get Linux into new places — like on cheap Internet-ready computers sold in Wal-mart, or pre-installed on Seagate hard drives. For all their baiting (face it, picking a name like Lindows is just asking for trouble, like opening a burger restaurant called McDowells), dumbing-down the software to the point of making it dangerous, and (in some people’s views) “tainting” the Linux philosophy with — gasp! — money — they’ve at least come up with new distribution models and gotten some form of Linux out there where “consumers” — the average Joe who just wants a computer and doesn’t care what the OS is, as long as it lets him use the web, email, and a word processor — can see it.

All that said, I’d never actually buy, use, or recommend their product. If I wanted a very-user-friendly Linux, I’d probably end up with Lycoris, or maybe Xandros.

For myself, I’m happy with Fedora Core — though I may take a serious look at the upcoming double-digit Mandrake release and the latest version of SuSE. I’ve tried out earlier versions (mostly of Mandrake), but I just kept coming back to Red Hat.

ยปAll pages site-wide with this tag