Patch Tuesday for December 2016

For 2016’s final set of updates, Microsoft has issued twelve bulletins, with associated patches, affecting the usual software, namely Windows, Internet Explorer, Edge, Office, and the .NET Framework. Forty-seven vulnerabilities in all are addressed by these updates.

Adobe issued updates for several of its products today, but the only one likely to be of interest to most people is, of course, Flash. And I mean ‘interest’ in the sense of “I am very interested in not having my computer infected with malware because I visited a malicious web site while running an out-of-date version of Flash.” The new version of Flash on all platforms is 24.0.0.186. It addresses seventeen vulnerabilities in the still-ubiquitous player. As usual, Flash in Internet Explorer and Chrome will be updated automatically.

Mr. Robot’s realistic depiction of hacking

As I read Cory Doctorow’s recent Technology Review post, “Mr. Robot Killed the Hollywood Hacker“, I found myself nodding my head enthusiastically. Anyone who knows much about computers and watches Mr. Robot will have noticed that the show’s depiction of hacking is very different from what we usually see on TV and in movies. The user interface is a text console. Everything is done with arcane text commands. Nothing is flashing, except the prompt. In other words, it’s accurate.

For as long as computers have been shown in movies and TV, they have been depicted as flashy, noisy, exploding, and otherwise utterly fanciful, almost magical devices. Hollywood obviously took one look at reality and collectively said “no way, that’s boring as hell.” So the vast majority of computer depictions in movies and TV are some art director’s crazy fantasy of how a computer should look.

I long ago stopped complaining about this. Nobody wants to listen to me drone on about how unrealistic a computer is in some TV show. Now, I just allow myself to be amused. I told myself that this was just harmless hyperbole, a layer of pizazz added onto reality to make it more entertaining.

But Doctorow makes an interesting point: the traditional depiction of computers by Hollywood isn’t as harmless as it may seem.

The 1983 film WarGames is about a high school kid who accidentally hacks into a military computer and almost starts a global thermonuclear war. There were – and still are – a lot of reasons why this is an unlikely scenario, but hey, this is entertainment. A lot of people saw the film, and most enjoyed it, including me. One of the least realistic parts of the film shows the WOPR computer smoking and burning when it becomes overloaded. Real computers just stop working when they’re overtaxed. Anyway, I didn’t mind the silliness; it’s all good fun, right?

Wrong. Apparently, Wargames got some people in Washington worried about whether a high school kid really could hack into military systems and start a war. In 1984, one year after the release of WarGames, the US Congress passed the Computer Fraud and Abuse Act (CFAA), which made activities related to hacking illegal. The legislation is ill-defined, and overly-broad, and it’s widely seen as pointlessly destructive. It contributed to the suicide of Aaron Swartz, who was being charged with crimes related to the CFAA.

The next time you’re watching a TV show or movie, and see an inaccurate depiction of something, ask yourself: “is this really just a harmless Hollywood convenience?”

Vivaldi 1.5.658.56

Earlier this week a minor update was released for Vivaldi. A new update mechanism was used (for the first time) to distribute this version to existing Vivaldi clients; according to the release notes for version 1.5.658.56, this reduced the size of the download to 323 kilobytes. The full download for Vivaldi 1.5.658.56 is 38.5 megabytes.

The update itself includes a few minor bug fixes, none related to security.

Chrome 55.0.2883.75

A new version of Chrome fixes at least thirty-six security issues in the browser. Aside from listing the vulnerabilities addressed, the release announcement says only that Chrome 55.0.2883.75 “contains a number of fixes and improvements”. You’ll have to read the change log to figure out what else is different. Sadly, the full change log is another one of those browser-killing monstrosities, with almost 10,000 changes listed. Don’t click that link if you have an older computer.