Jeff Rivett has worked with and written about computers since the early 1980s. His first computer was an Apple II+, built by his father and heavily customized. Jeff's writing appeared in Computist Magazine in the 1980s, and he created and sold a game utility (Ultimaker 2, reviewed in the December 1983 Washington Apple Pi Journal) to international markets during the same period. Proceeds from writing, software sales, and contract programming gigs paid his way through university, earning him a Bachelor of Science (Computer Science) degree at UWO. Jeff went on to work as a programmer, sysadmin, and manager in various industries. There's more on the About page, and on the Jeff Rivett Consulting site.

All posts by jrivett


Firefox, Patches and updates, Security

Firefox version 21 released

1 Comment

Another new version of Firefox was released today. Version 21.0 fixes several security vulnerabilities and other bugs.

As usual, the release notes for version 21 don’t mention the version except in a note about contributors, but the list of fixes seems to be relevant to the new version.

Clicking the ‘complete list of changes‘ link on the release notes page now goes to the Firefox bug tracking site, but the list of bugs shown includes issues that were resolved long before version 21 appeared, which is still very confusing.

On a brighter note, the release notes page now includes this entry:
21.0: Security fixes can be found here
Clicking the associated link shows a page titled “Known Vulnerabilities”, which clearly shows the version in which particular security vulnerabilities were fixed.

Adobe, Flash, Patches and updates, Security

Update for Adobe Flash

Leave a comment

Adobe just announced an update for Flash, version 11.7.700.202. As usual, the update fixes vulnerabilities in Flash that could cause instability or allow remote control of affected computers.

Microsoft, which maintains Flash separately for Internet Explorer 10, released an update for that browser with the latest fixes. The patch is available from Windows Update.

Likewise for Google, which released a corresponding patch for its Chrome browser. Chrome will update itself automatically.

Internet Explorer, Microsoft, Patches and updates, Security, Windows

Patch Tuesday for May 2013

Leave a comment

The month’s updates include fixes for vulnerabilities in Windows, Internet Explorer, .NET and Office. The main bulletin has all the technical details, and the Microsoft Security Response Center has a more reader-friendly summary, entitled “Microsoft Customer Protections for May 2013”.

The expected patch for recently-discovered vulnerabilities in Internet Explorer 8 is included in this month’s patches as MS13-038. According to Microsoft, you can install this patch whether or not you previously installed the emergency “Fix-It” released by Microsoft.

Microsoft, Patches and updates, Security, Windows

Advance notification for May 2013 Patch Tuesday

Leave a comment

As usual, Microsoft has issued an advance notification for this month’s Patch Tuesday. The updates will become available on Tuesday, May 14 at about 10am PST.

There are ten bulletins this month, two of them flagged Critical. In total, 34 vulnerabilities in Windows, Office, Internet Explorer, .NET and server software will be addressed.

Update 2013May11: The upcoming patches will include a fix for the Internet Explorer 8 vulnerability recently discovered.

Internet Explorer, Microsoft, Security, Windows

Internet Explorer 8 vulnerable to new web-based attack

1 Comment

Update 2013May09: Microsoft has issued a ‘Fix-It’ for this problem. This is a temporary, band-aid solution to the problem. It will be superseded by an actual patch at some point. The original bulletin about this issue has been updated to include information about the ‘Fix-It’.

Microsoft recently announced a new attack, targeted at a specific version of Internet Explorer, being exploited in the wild. More details are provided in the associated security advisory from Microsoft.

Only Internet Explorer version 8 is vulnerable to this attack, which begins when someone using IE8 is tricked into visiting a compromised web site. Once infected, the user’s computer can be remotely controlled by the attacker.

Anyone using Internet Explorer 8 is strongly urged to upgrade to IE9, or – if using Windows 7 or 8 – to IE10. If upgrading Internet Explorer is not an option, you can reduce the risk of infection by increasing the level of protection provided by the browser, as follows:

Set Internet and local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting in these zones. This will help prevent exploitation but may affect usability; therefore, trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.

Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zones. This will help prevent exploitation but can affect usability, so trusted sites should be added to the Internet Explorer Trusted Sites zone to minimize disruption.

Ars Technica has additional details.

Google

I talked to Google Support! (but didn’t like what I heard)

Leave a comment

One of the most common complaints about Google has always been that it’s almost impossible to get real live in-person support from them. Sure, they have support forums and feedback links, and occasionally you’ll even hear back from them when you report a problem. Clearly they do have support staff. But actually talking to Google support on the phone? No way.

Don’t get me wrong – I understand why Google has chosen not to have a general support call center: it’s expensive. Just ask Microsoft. When most of the services you offer are free, providing live support is going to kill your bottom line. As long as Google’s services are both excellent and free, and there are useful alternatives to live support, I’m happy to let Google slide on this.

So imagine my surprise, this morning, at being offered an option to have Google support staff call me on my phone and provide live, in-person assistance!

Here’s what happened: if you run a business and you care about your online presence, you are almost certainly familiar with Google Places. It’s a Google service that allows business owners to create listings that then appear on Google Maps and elsewhere. Recently, Google moved the public side of these listings to Google+, calling it Google+ Local. This is where your business listing now appears. Okay, I can live with that.

Or not. I recently discovered that not all of the details entered on a Google Places page end up on the public Google+ Local page. Missing items for me include images (in particular, the company logo), payment types accepted, email address, and additional details (free wireless, parking, etc.) What’s going on?

I poked around in the Google Places help for a while, but didn’t find anything about this problem. What I did see surprised me: an offer to speak with Google support staff about a problem with my Places listing. Recognizing that this was a rare opportunity (akin to sighting an extinct animal), I jumped at the offer. Within seconds, my cell rang, and I was talking to an actual Google support person.

I quickly explained the problem. I was told the following:

  • Some elements of the Places listing don’t appear in Google+ Local; apparently a mysterious Google algorithm decides what is relevant and shows only that.
  • Suggested workarounds:
    • Submit changes using the public page (Google+ Local).
    • Just wait to see what happens.
    • Stuff all the details into the business description.

Really? None of that makes any sense. If not all the Places information gets to the public listing, shouldn’t that be obvious when you’re filling it out? And what’s the point of entering something if it never appears anywhere? What criteria are used to decide what appears in my listing, and why should that decision be anyone’s but mine? If it’s easier (and much faster, apparently) for a random Internet user to update my business listing than it is for me to do it myself, something is seriously broken. If I stuff the missing information into the description, then it magically appears later on where it should have been in the first place, the information will be redundant. Worse still, the description is limited to 200 characters.

So my first ever conversation with Google Support left me with mixed emotions: happy to talk to a real live Googler, but dismayed at the mess that Google Places has now officially become.

Microsoft, Patches and updates, Windows

Problematic update re-issued by Microsoft

Leave a comment

Microsoft today released a new version of the update that caused so many problems this past Patch Tuesday, MS013-036.

The new version is KB2840149, and it replaces the update originally associated with MS013-036, KB2823324.

The new update will be installed automatically on computers with auto-update enabled. Anyone using manual updates should install the new version by visiting the Windows Update site or the KB2840149 page.

Java, Patches and updates, Security

Latest Java still vulnerable

Leave a comment

According to Adam Gowdiak of Security Explorations, many of the Java vulnerabilities he reported to Oracle in recent months were fixed in the April update (Java 7, Update 21).

However, several of the reported vulnerabilities remain, and Oracle has confirmed that they are working on fixes for those issues.

On April 22, Mr. Gowdiak reported another new Java vulnerability to Oracle:

The new flaw was verified to affect all versions of Java SE 7 (including the recently released 1.7.0_21-b11). It can be used to achieve a complete Java security sandbox bypass on a target system. Successful exploitation in a web browser scenario requires proper user interaction (a user needs to accept the risk of executing a potentially malicious Java application when a security warning window is displayed).

Current Java status: vulnerable.

Details are on the Security Explorations web site (scroll to the end).

Update 2013Apr27: Ars Technica reports that exploits for the just-patched Java vulnerabilities are showing up in attack kits and being seen in the wild. If you use Java, patch it ASAP!