May 17, 2012

Here's a few fun things to watch

If you haven't seen it

Europe History Time Lapse Map

It's very cool - even if the eyes have a hard time keeping up with the ever changing country boundaries.  (turn up the sound - the music is excellent)

***

Then we have

Breathtaking View of Earth

From a geo-stationary Russian satellite.  Very nice.

Just something to keep you busy until I get a chance to post again.

Posted by: Teresa in FUN at 08:20 PM | No Comments | Add Comment
Post contains 75 words, total size 1 kb.

May 10, 2012

Let's Talk Passwords - now updated with a significant point

I was just reading a lament by a friend on Facebook who had accounts compromised because of weak passwords.  Therefore, you lucky readers now get an entire post on passwords.   Aren't you thrilled!  Okay - don't throw things at me.

Let me first state - this does not begin to cover everything to do with the subject at hand. It's just a blog post not a dissertation (although some of you may be wishing for a simple dissertation before I'm done and others stamping in a rage because I "forgot" something important). Consider it a glancing blow pointing out a few items that might help you stay a bit safer online.  The vast majority of information will be omitted.  That's life.

Passwords.  What can we say about passwords?  Well, the entirety of the username/password type of access system sucks.  Period.  It completely and totally sucks pond water.  That will not change in the near future much as we all hate it.  Until computers evolve enough to find better ways to know "we are who we say we are", we have to deal with it.  This post won't be about better ways to do it.  Those topics are fun to talk about but completely irrelevant to this discussion.   We have to work with what we've got the best way we can.

So what's the number one problem with passwords?  Remembering them.  If you forget, you either give it up in disgust or you have to jump through hoops to get back in the system. We hate hoops. They waste time and cause massive irritation. We just want things to work.  That is the entire problem in a nutshell.

So, what do people do about this?  When they are at home and are not under the tyranny of computer security people at work, they go for the easiest solution.  Pick a password that is memorable and use it everywhere.  This would be what I call: Huge ass mistake number 1.

Here's one list of

The 25 worst passwords of 2011

Do you use any of these?  Yeah? You might want to consider changing things in that case... just sayin'...

Everyone wants things to be easy.  Security is not easy. It's a huge wet smelly blanket thrown over all the fun in life.  If it was easy, this post wouldn't be necessary.

Let us move on to:

Huge ass mistake number 2. No one will know.

Ah yes, the "obscurity factor".  No one will know what I choose for a password, they aren't sitting here, they can't see me type it.  They can't possibly know so how could they guess? There's no way they can figure it out, it's not even a real "dictionary" word.  (here's a hint: the hackers  don't figure it out - they let computer tools figure it out - way easier)

It really is a toss up as to which of the 2 huge ass mistakes listed above are the worst.  Both are parts of human nature and both make it very easy for people to totally ignore any advice that might help keep them safer online. Because... really... can't we all find something better to do with our limited free time?   Like there is always a good excuse not to workout at the gym, there is always a good excuse to not to "worry" about passwords we use. 

Of course, there is another difficulty.  Even if you take as many precautions as possible, bad guys can still manage to make your life a misery.  They have the advantage.  They only need to find one way in, you have to block all ways in.  Not fair and very tiring, but there it is. We're at a disadvantage before we start.  Even people who are very good and try to do everything right can be "gotten" by a bad guy (especially if they are specifically targeted).  So why should you make an effort? Because:

You don't want to be the low hanging fruit.

If the bad guys really want to get you, make them work for it!  You don't want them to steal a username/password database like the RockYou data breach or the Gawker data breach, take that info and start trying to apply it to email accounts, credit card companies, or banks.

Since most username/password combos are email address/password, the first thing an intelligent hacker would do is try to use what they have to log into your email account. If you are a person who uses the same password everywhere - voilà! They're in.  From there they can peruse your email and check out your bills and bank notices to figure out what to hit next.  Simple.

To that end, let's go with some tips to help you fix your passwords.  Let's start with where you'll keep them so you don't forget.

1. A database just for passwords.
Because it's best if you have a different password for every site where you log in, remembering becomes next to impossible.  That's where a password database shines.  You can use apps like 1Password (my preferred)  or LastPass among others to store your passwords safely.  This way you don't have to remember anything except the one password to log into your password database.  The database remembers everything else for you.  The good ones can also generate good random passwords and keep track of password changes among other things.   

2. A homemade spreadsheet option.
Okay you don't want to get a password safe, you can create your own spreadsheet to hold your information. Not exactly the safest way to do it, but certainly doable.  Point in favor, you don't have to pay for anything. You could even use the basic notepad app every system comes with.  However, it won't generate passwords for you and you will have to decide if you want encrypt the document in case your system is compromised or you lose your computer. 

3. Stone Age - paper and pencil.
At the very least, decide what accounts are your most important.  Banks, credit cards, utilities, email, social media (no one wants to try and unravel a breach through "facebook help" now do they?).  List out the places you find the most important and make sure the passwords you use for each are different.  Then you can use another single password for sites you don't consider important. Next, write them down in a notebook.  If you don't leave the notebook at the local coffee shop, this could work for you.

UPDATE (by VW in the comments) The only thing I would add, is that you really should use one of the options you list and make sure your significant other knows what the 1pass is or the location of the spreadsheet or written paper. 

How to create a decent password.  

Ah - therein lies the rub.  If you google it, you will get an endless list of helpful advice on how to create good passwords.  What is unclear is exactly how good any of the advice might be.

Let's just go for an overall set of "rules", for lack of a better word, you can follow to create passwords that aren't quite so guessable by your roving hacker. 

1. Check the website for any directions on what it will allow for passwords including length and types of characters.  Some sites have major restrictions so create your password accordingly.

2. Length is your best bet.  Go for between 10 to 15 characters if you can.

3. Use upper and lower case letters.

4. Use at least a couple of numbers.

5. If they allow it, use at least a couple of special characters such as !@#$%^_ ( or spaces.

But - how to remember it if you don't have a password database handy?  If you create your own, the best thing is to use something like book titles or sentences from a favorite book and then embellish.  (do not use family names, addresses, birthdates, that kind of thing)

A couple of examples might be like these I made up from Douglas Adam's Hitchhiker's Guide to the Galaxy

#D0n't^P4nick!
my_G@laxy-guiD3

Get creative.  Look at it as a fun exercise. 

As for changing passwords.  There is some controversy there too.  Once again it depends on your circumstances, who has access to your computer, that kind of thing.  And let's be realistic, you are not going to change anything on a regular basis are you.  Ha! Yes, I already know this.

If you ever think about changing passwords on important sites, when would be a good time?  Maybe right after you've been traveling, every 6 months to a year, or if one of your accounts is "owned" that would be a good time to go through and change things.  (as long as the attacker doesn't have access to your email account).

I think that covers the very very basics.   It could be made much more complicated, but what would be the point?  No one would do it then, just like they pretty much don't do it now. 

For anyone still reading - congratulations.  You deserve a medal for persevering to the end.  Now that you've read this, think about it. If your current password strategy is the bare minimum, you can always improve it and save yourself some headaches later on.  Or not. Up to you.

Now - you can go find something more fun to read. 

Posted by: Teresa in WebTech at 07:47 PM | Comments (10) | Add Comment
Post contains 1573 words, total size 10 kb.

May 08, 2012

Shocking... Right

Saw this headline earlier on a local news feed

Shocking Find by TSA at RI Airport

TSA officials say the .40 caliber weapon, bullets and other gun parts were artfully packed inside three stuffed animals.

A man traveling with his 4-year-old son from T.F. Green Airport in Warwick, R.I. to Detroit on Monday was stopped at a security checkpoint.


Earlier today the story ended with this... Man and boy got on plane and left.  Left?  They go through security with a gun broken into bits in the luggage and TSA lets them just go on their merry way? 

Now we find out why.

The man, who hasn't been identified, told law enforcement officials he was unaware the firearm was stuffed in his son's carry on. Sources tell NECN that the man told law enforcement officials he believes the boy's mother put it there.


Well, looks like they got off better than this poor girl.

Diabetic teen upset with TSA screeners at Salt Lake City Airport

Not only did they not know what to do about the insulin pump...

She says TSA agents then made the situation worse when they didn't know what to do about her juice and insulin. "She said, because we don't have the machines to scan the juice to make sure this is not an explosive we do have to do a full body pat down and search your through your bags." Of course, that's what she wanted in the first place, but it was too late.


Ya gotta watch out for those 16 year old diabetics... you never know what she'll do. So break her $10K insulin pump BEFORE she does it! 

The guy with the gun parts is no match for her.

In the meantime one has to wonder if they caught anyone really trying to do something bad.  Well... other than the 16 year old girl...

Posted by: Teresa in Ummmmm at 11:02 PM | Comments (4) | Add Comment
Post contains 314 words, total size 2 kb.

Well, you are supposed to learn things while in school

Not sure what is really going on, but here's the story

Principal resigns amid accusations of Facebook spying

And now a story emerges from Missouri of a high school head who is accused of creating a fake Facebook profile in order "friend" her students.


Of course the story is not confirmed.  The school district isn't talking and neither is Ms Losos, the accused.  All evidence is circumstantial and could be completely misleading.  It looks suspicious but she could be resigning for a completely different reason.

However, true or not, it is an excellent lesson for students everywhere. Not only to be careful who you accept as a "friend" but  also, the internet is not ever private.  Not even sites that claim to have privacy. 

Of course we all could stand accused of forgetting this very thing.  It is hard to remember on a daily basis... at least until your facebook posts or emails hit the front page of the newspaper. 

Posted by: Teresa in Current Affairs at 11:47 AM | Comments (2) | Add Comment
Post contains 170 words, total size 1 kb.

May 07, 2012

Customer Service

Last week I was attempting to pay a bill online.  Oh the joy - right?  I don't do auto payments because I want to check the bills as they come in and be sure they are correct before money changes hands.  It usually works out well. 

One particular website has recently undergone an update.  It's pretty.  It is not functional.  The update (whatever they did) will not allow me to copy/paste my password into the account login page.

You see I use 1Password.  I love 1Password.  One of the things I can do on every other site is log in without having to type my credentials.  That's why I have it.  Currently I'm not using the 1Password plugin on my browser as it is giving me problems. Therefore, I'm not even trying for a 1-Click login here, just a copy/paste.

This particular site... no go.  I tried using my Mac with Firefox and Safari.  I tried using my Win7 with Firefox.  None of them allowed me to copy/paste on the login page.  Very annoying. 

So I did what I always do when I find a problem. I emailed them to let them know.  These things happen, but nothing gets fixed if you don't tell them there is a problem. 

I filled out the contact form. Described the problem.  Told them what computers/OS/browsers I used and sent it off.  That was last week. 

Today I received the following email from them:

Hello,
This appears to have been resolved, correct?


BTW - that omits nothing.  The person did not address me by name, even though they replied to my email and my contact info was in the reply.  And best of all, they didn't even sign it!!!  How delightful!

This is a major corporation.  Wow!  Okay. 

I went back to their website and checked. No the problem still exists.  I responded, that this was the first communication I had received and no the problem has not been fixed.

Whoever it is, still not signing a name, now tells me they have passed it on to the IT staff and they are sorry for any inconvenience.  

I expect another email from the IT staff next week saying

Hello,
This appears to have been resolved, correct?


Because I can see they are all about the communication with their customers. 

Posted by: Teresa in Ho-Hum at 12:16 PM | No Comments | Add Comment
Post contains 387 words, total size 3 kb.

May 04, 2012

This is a good thing

Another step closer to text-to-911

Text-to-911 moves ahead in the US as Verizon chooses partner vendor

Can't tell you how many times I could text, but there was not enough bandwidth for voice.  This would be awesome.  Especially here in the wilds of Massachusetts where the idiot natives refuse to have adequate cell phone service.  (there are currently protest signs in our town because Verizon wants to add cell towers... God forbid we move into the 20th century here - geeze)

Posted by: Teresa in Current Affairs at 08:28 PM | Comments (2) | Add Comment
Post contains 86 words, total size 1 kb.

May 02, 2012

Go Read This

I laughed til I cried. 

Life as a linguistically incompetent fool


Posted by: Teresa in FUN at 10:41 PM | Comments (2) | Add Comment
Post contains 14 words, total size 1 kb.

May 01, 2012

Reverse Annoyance

I wish there was a way to use a cattle prod response to telemarketers so they cease and desist without any extra effort on my part (I'm lazy).  The latest annoyance comes to us by way of the March of Dimes. 

Certainly a worthy organization, I have donated to them.  In their little world this means they need to put me on a call list to brow beat me for even more money.  *sigh*  Not just a call list, but a robo-call list where they robo-dial my number several times a day and then don't answer.  Not sure what the goal is here, but there must be logic in it somewhere.

So I see the return number on caller id  914-294-2161.  At first I had no idea who MOD was since that is the "name" on the caller id.  After doing a google search of the number I find the culprit. I always try to find who is calling first.   I don't call back illegal operations like the shady lenders and credit card scammers.  They are already breaking the law and they don't care what you think about their calling habits. 

It's a charity, which means I call back. The same applies to political callers.  They can call as often as they want until I tell them to stop. But once I tell them, they do stop.  However, they don't always make it easy.

I therefore proceed to call the number back and... I get a fast busy signal.  Oh goody.  That means I can't get my number off their stupid list using an easy "please press 3 to have your number removed".  More looking...

Back to the google search - I see other people have dialed the number back and they do get through, but I'm not going to waste my time redialing endlessly.  Nor will I call back other numbers people have reported since that might not get me off the telemarket list or might put me on another one.  Telemarketing is a tricky business.

That leaves me with only one option. I looked up the National March of Dimes and called them.  They were nice about it (and so was I)  All I had to do was tell the man who answered "I'd like to have my phone number removed from your telemarketing calls".  He connected me to someone who took my name and phone number.  She told me it would be 24 hours which is standard.  

All that work, just to get my number off a list. *sigh*  I like it so much better when I don't have to talk to anyone - just give me a way to get off the list automatically.  Oh well, better than listening to the ringing as they call over and over and then don't answer. 

But I still wish for that cattle prod type of responder to companies that use robo-dialers. 

Posted by: Teresa in Ho-Hum at 11:57 AM | Comments (9) | Add Comment
Post contains 484 words, total size 3 kb.

April 30, 2012

Still Here

Pulled a muscle or something in my neck while I was sleeping the other day (btw how does that happen? Weird!).  Kinda ruins my whole "let's sit at the computer and see how many words we can type" attitude. Heh.

If you want to see some pics from the last week, head over to my Posterous page where they've been stacking up.  (It's very easy to post pics over there which is why I've been neglecting the extra work it takes to post them here).

Otherwise, more later once my neck stops hurting.

Posted by: Teresa in Ho-Hum at 10:40 PM | No Comments | Add Comment
Post contains 95 words, total size 1 kb.

April 22, 2012

Can you say: Chicken Little!

Okay, okay, maybe I'm being just a leetle snarky, but there are times when I want to tell the news media to just "get a grip people!".

I've seen the following story floating about for the last couple of days. This morning a friend emailed the following:

Hundreds of thousands may lose Internet in July

In a nutshell, here is what happened:

Hackers infected a network of probably more than 570,000 computers worldwide. They took advantage of vulnerabilities in the Microsoft Windows operating system to install malicious software on the victim computers. This turned off antivirus updates and changed the way the computers reconcile website addresses behind the scenes on the Internet's domain name system.


First let's take a deep breath. A little over half a million computers world wide is a mere drop in the bucket. It's miniscule. However, if you are one of those people who never do updates on your system and therefore have every drive-by virus and trojan known to man, you have far more problems than whether or not you can get online come July.

For those who want to check their systems because they are worried, you can find a nice handy instruction pdf via the FBI that will walk you through checking your system. Although this is a windows problem for the most part, if you get your DNS addresses served up via a router on your network, you'll want to check your DNS even if you're using an Apple or Linux box. The pdf linked above includes instructions on checking your Mac too.

I remember when this first happened. As I recall, there were a number of businesses who had gotten infected. Because it was difficult, for whatever reason, for these businesses for fix their DNS, the FBI set up the safety net DNS for a while to give them time to clean up their systems (sorry... it wasn't because the home user would have problems... that's basically a non-issue for them). So now they are warning these same businesses that the safety net is going to be dropped and they better get on the ball and get things fixed soon.

The thing that bugs me about how this is all presented is this type of statement:

For computer users, a few mouse clicks could mean the difference between staying online and losing Internet connections this summer.


This is so irritating because you DO NOT lose internet connection! The connection is there, it does not go away. What you lose is the "address book" of the internet.

The DNS (Domain Name Server) is the place where your computer goes to find "where exactly is www.yahoo.com?" When your computer asks this, the DNS computer says "today you can find it at 98.139.183.24". And then your computer can go merrily along its way looking for that address. You don't have to remember a set of numbers. If Yahoo needs to change the numbers for some reason, all it has to do is tell the DNS server the new numbers. It's all fixed in the background without you having to even know about it. Makes browsing the web possible for everyone.

Honestly though, the whole "OMG!!! OMG!!! The internet will be killed!!!! OMG!!!" Is just a bit too over the top for me. Can we now get back to worrying about things that really are scary? Like running out of wine to drink with dinner or something... Sheesh!

Last of all. If you aren't using a service like OpenDNS or even GoogleDNS, then you should be. GoogleDNS provides only DNS service but it should be secure enough.  I use OpenDNS but do not have an auto updater running, I set it up much like one would set up GoogleDNS. The links above are to the basic setup instructions for each.

The reason I use OpenDNS is that it provides DNS plus extra security. They blocked the Mac Flashback trojan well before Apple put out a fix for it. They also allow you to control what comes in over your home network if you want to set up a free account with them.

Either of these services is FAR better than most ISP DNS offerings. They are more secure and up to date. They also don't suffer from major outages like Comcast often experiences. So please think about changing how you get your DNS to your computer. It's well worth it. And if you have a very bad DNS provider, you'll find the web browsing way way faster.

Happy surfing.

Posted by: Teresa in Ho-Hum at 01:48 PM | Comments (6) | Add Comment
Post contains 759 words, total size 5 kb.

April 19, 2012

Wherein I explain macro tubes

And I use pictures. It's over on my posterous site.

Kinda like a microscope for cameras

And I show my complete inability to deal with mechanical stuff.

Posted by: Teresa in Photos at 02:08 PM | No Comments | Add Comment
Post contains 32 words, total size 1 kb.

April 17, 2012

A Photo post!

Yes I know it's been a while. I kinda lost the enjoyment of the whole photo thing for a while. But I just bought myself some "macro tubes" for my camera. So I decided to pull the camera out and play.

For $10 I got 3 macro extender tubes delivered to my door from Amazon. Not bad. They let you get up close for real macro shots. This is using the 50mm f1.8 lens.

I posted three on my posterous blog here and here.

Then I thought I should throw a couple on this blog too.



The above is a tiny weed flower taken with 3 macro tubes.

Or maybe this one which I think looks kinda dreamy. It's flowers on my blueberry bush.



You can check out all 8 of them on my Smugmug folder here.

Anyone see one they like best?

Posted by: Teresa in Photos at 06:27 PM | Comments (6) | Add Comment
Post contains 146 words, total size 1 kb.

April 15, 2012

When in doubt start pointing fingers

Well it looks like Google is in a bit of hot water with the government

Google fined $25,000 for impeding FCC investigation

That's it?  Twenty-five thou is not even pocket change for this company, it's more like pocket lint.  They lose more than this between the cracks of the server farm frames every day.

In their infinite wisdom, The Goog has decided they are not turning anything over to the eeeevil US government merely because some of their more zealous employees broke a little bitty law. Pish and tush!

But Google also collected passwords, Internet usage history and other sensitive personal data that was not needed for its location database project, the FCC said.


After all they are only following the dictum of Eric Schmidt their executive chairman.

"If you have something that you don’t want anyone to know maybe you shouldn’t be doing it in the first place”


Which, it seems, the company took to include the collection of your username and password along with other data as they drove by.

However, I guess this bit of government interference has been just a tad too much for the old Goog to tolerate. One of the "don't be evil" founders has taken to the news media to loudly proclaim:

Web freedom facing greatest threat: Google founder

Seriously? Apple, Facebook, and the government are all out to destroy the internet? They are all eeeeevil!!! But the Goog... the Goog is pure of heart and wants only the best for us all!

Right.

While portions of the government seem hell bent on taking away our internet freedom, why do I have the feeling Brin is talking about one particular agency? 

Maybe The Goog should take Eric's advice above.  After all he's one of their top guys. Isn't that why they pay him?

Now, how long before I'm totally delisted form Google for this completely offensive post.  Ha.

Posted by: Teresa in WebTech at 09:47 PM | Comments (2) | Add Comment
Post contains 321 words, total size 2 kb.

April 13, 2012

Tadaa!

I'm giving a new app, called Tadaa, a try.  Not sure whether I'll do anything with it or not.  It's a competitor to Instagram and from what I'm seeing, just about as annoying to try and figure out.  Ha!  Mainly because I can't do stuff on my regular computer only on my phone or tablet.

So far Instagram has one thing I like - it lets me post my photos to Posterous and that post sends out tweets and facebook notices.

Of course for those who are really off facebook and want nothing to do with it, Tadaa will send out tweets for you so it might be what you're looking for.  If you want a free camera app with lots of fun filters and some nice editing tools check it out. 

If you do grab the app for either iphone or android you can find me at teresahummel. 

***
You know I thought of something to add to this post in the middle of the night and now I can't remember what it was.  I need a brain that works better. 

Posted by: Teresa in Photos at 11:29 PM | No Comments | Add Comment
Post contains 183 words, total size 1 kb.

April 12, 2012

I Need a Spellchecker for my Spellchecker

I was writing something today and used the word "leapt".  My spellchecker did not like it at all.  Angry red dashes appeared under the offending word.  Scary!  I looked at it again and thought the spelling was correct. 

Then I began to doubt myself.  I could be wrong. It's been years since I've written the word (maybe dating back to my time in high school)  Perhaps I'm not even using the right word.  Horrors!!!!

Off I went to dictionary.com which indeed confirmed not only did I spell it correctly, I used it correctly too.  Well that's a relief.  I guess I'm not totally drifting into senility yet.

I fixed the spellchecker by adding the word.  It does worry me that a modern day spellchecker would not have a regular everyday type of word I learned back in grade school.

However, the burning question is... how many people are being misled on a daily basis by spellcheckers that don't know their words?  Now that is scary!

Posted by: Teresa in Ummmmm at 10:47 PM | Comments (5) | Add Comment
Post contains 172 words, total size 1 kb.

Weather News You Can Use

I have a Weatherbug widget on my home page. It gives me the cute little weather summary of an icon to show the type of weather then the high/low temps for 3 days. Underneath that is supposed to be weather headlines. Today there is only one and it reads:

Weather news:

California's weather has something for everyone.

So now a travel blog summary of the climate variety in California is "weather news" I need to know.  Not sure why, but Weatherbug tells me so. 

Posted by: Teresa in Ummmmm at 12:20 PM | Comments (2) | Add Comment
Post contains 89 words, total size 1 kb.

Keeping You Informed

Very soon we will know if man can really head out into space for long periods of time.

Malt whiskey experiment aboard the ISS

****

Sometimes you just get lucky

He wasn't wearing a seatbelt

****

Always remember to read carefully before buying something online.

Robot Books: Google this

****

Study confirms not enough sleep raises diabetes, obesity risks

I'm waiting for them to do a study that will tell us "Study confirms: eating raises obesity risk".

****

Sharpen your brain.

Make mine a double

Although I found it interesting they felt the need to add a completely unsubstantiated comment about sleep being just as good at the end of the article. After all, they have to be politically correct - right? heh.

****

And if you ever wondered how a news media mistake along with sloppy attention to detail can mess things up, this is a perfect example.

Update: Texas Fireball was Real After All, NASA Says

You'd think these people might have learned something from playing "telephone" as children... or maybe they didn't and that's the problem. heh.

Now are we ready for Friday?

Posted by: Teresa in FUN at 11:00 AM | No Comments | Add Comment
Post contains 189 words, total size 2 kb.

April 10, 2012

Patchy - Patchy Please

New windows updates came out today.  Time to patch as there are exploits in the wild already

Interestingly enough on reading the article linked above, we're back to nasty stuff being passed along via Windows Office documents.  Please be careful and don't just open stuff that hits your inbox!

You'd think after all these years people would kinda get that.  But apparently such is not the case. 

In Apple news, they will be releasing software to get rid of the Flashback trojan.  They are also trying to take the botnet offline.  Of course as with any botnet, the only way to get rid of it is to get rid of all of it.  Depends on how distributed it is as to whether they can take it down.  We shall see. 

This has been a public service announcement on behalf of your computer.  Thank you for your cooperation.

Posted by: Teresa in WebTech at 08:44 PM | No Comments | Add Comment
Post contains 151 words, total size 1 kb.

Smashing a Record

That would be the Purdue Society of Professional Engineers creating the largest Rube Goldberg machine, smashing their old record.  Using 300 steps to blow up a balloon and pop it.

Excellent!



Posted by: Teresa in FUN at 10:24 AM | No Comments | Add Comment
Post contains 34 words, total size 1 kb.

April 05, 2012

All That Java - small update

I'm a little late blogging this. Sorry about that. But here's a quick tip for everyone browsing about the web. Windows, Mac, it doesn't matter.

If you have Java on your system please disable it!  (instructions on that to follow)

Yes you see it in bold because this has been the week of the Java meltdown and it's not pretty. If you've missed the high drama surrounding this bit malware fun and games you can catch up via this post at F-Secure.

Mac Flashback Infections

If you aren't interested in backtracking through all of it, suffice it to say, Apple left Java unpatched for about 6 months... finally sending out the patch yesterday after the news hit the internet that it was a problem. Guess what happened... the Java hole that had been patched by Oracle but NOT by Apple was exploited on Macs running Java. All people had to do was hit a web site with an infected Java applet and voilà! instant own by the trojan.  Yippee Skippee.

So let's start with the Mac people... did you get owned? (If you are running a new machine with Lion you might not have Java - it does not come on Mac with Lion and would only be there if you downloaded it)

If you are a Mac user, certainly check your updates and make sure you've got it patched. Then open a terminal window (it's in Applications --> Utilities --> Terminal.app). Terminal looks like an old DOS window with cute things like your computer name and $ where you would enter text if you knew what to type.  Well, here you go, enter the following - you can cut and paste from here:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

Hit enter. If it says:

"The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist"

Breathe a small sigh of relief. If you run Firefox, you'll need to change the Safari.app to Firefox.app and do it again. 

Next copy and paste this into the terminal window:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

Hit enter. Once again if you receive:

"The domain/default pair of (/Users/joe/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist"

All is well and you are set. (BTW the "joe" above will be your login name)  If you got anything other than the "does not exist" message for either of these commands, see the F-Secure Disinfection Page  to get rid of it.

Now... on to the fix.  Disable Java!  You can do this in several ways.  Either disable Java in the browser, disable it on the system or remove it from your system.  I would suggest disabling both the system and browser, wait about a month. If you haven't broken anything, remove it from your system.  That should be the least traumatic way to do this. If something is broken, you'll then have to decide if it's worth keeping Java or not.  You could keep it and only enable it when you really need to use it.

So here we go:

Windows:
On the system.  Go to control panel. In the search bar type in "Java". This should bring up the Java entry. Click this to open the Java panel. There are several tabs across the top, click the "Java" tab. Click on "View" it will open a new little window.  Uncheck the "Enable" box and click "OK".  Then "OK" again to close the Java box. 

In IE (this might be different for different versions - I have the latest so I hope you don't have to search too hard to find this).  Open the "Internet Options" box.  In the latest version it's located in the "settings wheel" on the top right of the browser.  Click the "Programs" tab and the the "Manage add-ons" button. Scroll down and you should see the Java plugin(s).  Disable them. 

In Firefox open the "Options" box.  Under the "General" tab (the first tab!) Click the "Manage Add-ons" box.  Disable the Java plugin(s). 

Restart the browser. That should do it for Windows. 

Mac:

Open Finder. Type in "Java Preferences" in the search bar.  You will have to scroll, but it should be in the list of stuff there.  The icon is a cup of coffee with a window background.  Click it to open.  Depending on your system you may have both a 32bit and 64bit Java.  Doesn't really matter, just uncheck the boxes under the "general" tab.  Then you can close the window.

In Safari:
Open Preferences. Go to the Security tab and uncheck "enable Java".  That's it.

In Firefox - go to Tools -- Add-ons and disable Java. 

Now at least you might not pick up any unwelcome little trojans.  Maybe.  At least for a little while.

I hope the instructions make sense.  If not, you can ask, or you can find a local geek who can help.

****

I don't have Chrome, but it looks like you don't have to do anything if you do have it : For Java specifically, Chrome now disables Java by default on all pages and prompts you to allow it to run each time a site needs it. So you should be okay with the browser part.

***
Update 2: I should be clear that Apple didn't patch Java for about 6 months. But the current exploited hole is one that Oracle patched in February.  Be that as it may, there were other Java patches in the meantime just not noted as being exploited on Macs like this one.


Posted by: Teresa in WebTech at 10:30 PM | Comments (5) | Add Comment
Post contains 912 words, total size 6 kb.

<< Page 1 of 149 >>
102kb generated in 0.168 seconds; 77 queries returned 303 records.
Powered by Minx 1.1.4-pink.