The latest version of Vivaldi includes numerous bug fixes, as well as useful improvements to Reader Mode, and a setting for disabling animated GIFs. It also sports a new icon.
None of the bug fixes in Vivaldi 1.11 are related to security, so this isn’t a particularly urgent update. To update Vivaldi, click its menu icon, then Help > Check for updates...
Besides fixing twenty-nine security vulnerabilities, Firefox 55 adds support for the virtual reality technology WebVR, some new performance-related settings, and improvements to address bar functionality. The sidebar can now be on the right side of the browser, instead of only on the left. The Print Preview function now includes options for simplifying what’s printed. Starting Firefox with multiple tabs is now much faster. The Flash plugin is now ‘click to activate’ and only works with regular web and secure web URLs.
The default installation process has been modified, to simplify and ‘streamline’ installation for most users. Traditional, full installers are still available. The somewhat-less-likely-to-crash 64-bit version of Firefox is now installed by default on 64-bit systems with at least 2 GB of RAM.
Mozilla steadfastly refuses to mention version numbers in Firefox release announcements (including the one for Firefox 55), or to announce all new versions. Their rationale seems to be that the information exists somewhere, therefore they have done their job. Combined with the unpredictability of Firefox’s internal update mechanism, this is an ongoing frustration for some users (possibly only me).
On that subject, I’m still waiting for my installation of Firefox to notice that a new version is available. Firefox 55 includes changes to the browser’s built-in update process, but it’s not clear whether those changes will actually improve things. From the release notes: “Modernized application update UI to be less intrusive and more aligned with the rest of the browser. Only users who have not restarted their browser 8 days after downloading an update or users who opted out of automatic updates will see this change.”
Update 2017Aug13: According to denizens of Mozilla’s official #firefox IRC channel, the Firefox update servers have been disabled because of some problems with Firefox 55. Of course, Firefox will continue to tell you that “Firefox is up to date”, which can mean several different things. There’s no word on when the update servers will be back online, or what the problems are, but a search of the bug list for Firefox shows a likely candidate: Tabs are all restored as blank frequently after restart of [sic] applying Firefox 55 update. Apparently after upgrading to Firefox 55, some users are having problem restoring tabs, and in some cases, profile information is lost. Recommendation: don’t jump the gun and install Firefox 55 manually. Wait for the next version, which will likely be 55.0.1 or 55.0.2.
Update 2017Aug15: A new post on the Mozilla blog (64-bit Firefox is the new default on 64-bit Windows) confirms that 64-bit Firefox is now the default for 64-bit Windows systems, and that the 64-bit version is much more stable than its 32-bit equivalent. It goes on to say that to get the 64-bit version, you can either download and install it manually, or “You can wait. We intend to migrate the remaining 64-bit Windows users to a 64-bit version of Firefox with a future release.” No word on just how long we’ll have to wait.
Update 2017Aug17: Today, my install of Firefox started showing 55.0.2 as the latest version on its Help > About dialog. I went ahead and let it update itself, and now I’m running the 32 bit version of 55.0.2. According to the release notes, Firefox 55.0.1 fixes the bug in the tab restoration process that was introduced in 55.0. Firefox 55.0.2 fixes a problem with profiles that was introduced in 55.0.
It’s once again time for the monthly headache otherwise known as Patch Tuesday.
As you’re no doubt aware from my previous whining, Microsoft no longer publishes a bulletin for each update, and finding useful information in the Security Update Guide is awkward at best. It feels like Microsoft is trying to get everyone to just give up and enable auto-update. Of course with Windows 10 you no longer have a choice: you get updates when Microsoft wants you to have them. Which is one of the reasons I don’t use that particular O/S.
From my analysis of the Security Update Guide‘s entries for August 2017, it appears that we have thirty-nine updates, addressing fifty-three vulnerabilities in Internet Explorer, Edge, Windows, SharePoint, Adobe Flash Player, and SQL Server. Eighteen of the updates are flagged as Critical. Time to fire up Windows Update on all your Windows 8.1 and Windows 7 computers.
Adobe released updates for Flash and Reader today. The Reader update (Reader DC/Continuous: 2017.012.20093; Reader 2017: 2017.011.30059; Reader DC/Classic: 2015.006.30352) addresses sixty-seven vulnerabilities. The Flash update (version 26.0.0.151) addresses two vulnerabilities. Anyone still using Flash or Reader, especially as web browser plugins, should install the new versions as soon as possible.
Flash was a useful gadget at one time. Used by everyone to play animation, games, and other multimedia content, it was on almost every Windows PC and many mobile devices.
At some point, unknown persons took it upon themselves to determine whether this ubiquitous chunk of software had any weaknesses. And boy, were they rewarded. Flash has, at times, seemed like a bottomless well of security vulnerabilities. No sooner was one hole closed, than another was revealed.
In hindsight, one wonders whether Adobe could have saved Flash with a major, security-focused rewrite. But that’s not what happened. Instead, Adobe kept up the little Dutch boy act, plugging each hole as it was discovered. During this time, Adobe’s updates to Flash sometimes seemed to create more problems than they solved.
Which brings us to the present. The major web browsers have either already dumped support for Flash, or are in the process of doing so. According to Adobe, Flash is still scheduled for its trip behind the woodshed in 2020. Prior to its final exit, Flash will gradually disappear from most of its remaining hiding places.
What remains of Flash will exist in systems that are not easily updated: A/V and advertising kiosks, PCs in business and industry running old versions of Windows, and a few dying phones.
That just leaves one question: what’s the next piece of software that will drive us crazy with terrible security and endless updates?
Peter Bright is a bit sad about the impending demise of Flash.
Brian Krebs provides some additional details.
I’m taking a break. Several posts per week over five years is a lot of work, and I think I’ve earned a vacation.
I’ll be back soon.
In a somewhat surprising move, Microsoft is releasing more updates for Windows XP today. To be clear, Microsoft had already created these updates for corporate (paying) clients. All they’re doing is making those updates available to the rest of us. While the updates are welcome to those still running Windows XP, one wonders how paying customers feel about it.
Here’s Microsoft’s explanation: “In reviewing the updates for this month, some vulnerabilities were identified that pose elevated risk of cyber attacks by government organizations, sometimes referred to as nation-state actors or other copycat organizations.” What that probably means is that Microsoft believes — along with the rest of us — that last month’s WannaCry threat was only the beginning of the havoc coming our way in the wake of The Shadow Brokers‘ leaks. The bit about ‘government organizations’ is presumably to get people to take notice.
That announcement is also somewhat misleading, in that it talks about ‘enabling Windows Update’ in supported versions of Windows, when in fact they’re referring to automatic updates. Further, automatic updates in Windows 10 cannot be disabled.
From the June 2017 security update release announcement: “we recommend those on older platforms, such as Windows XP, prioritize downloading and applying these critical updates, which can be found in the Download Center (or alternatively in the Update Catalog).”
The Download Center site doesn’t work particularly well in Internet Explorer 8, the version my poor old Windows XP Virtual Machine is stuck with. The page does show a prompt to try Edge, which is not particularly helpful as Edge won’t run on Windows XP. Okay, how about the Update Catalog? All I get there is ‘The website has encountered a problem’.
The Download Center works a lot better in Chrome, but clicking the Microsoft Update link only tells me that I have to use Internet Explorer for that. Entering the Windows category just invites me to visit the Update Catalog. That site also seems to work with Chrome, but it’s basically just a search form. What do I search for to get the available updates for Windows XP? Searching for ‘Windows XP’ produces 870 results. Sorting the list by date shows the most recent update was in 2014.
A post on the Technet site provides additional information about the vulnerabilities: Microsoft Security Advisory 4025685 – Guidance related to June 2017 security update release. Fifteen vulnerabilities are addressed, almost all of which are flagged as Critical. But there’s nothing on that page about how to install the updates on Windows XP.
The general guidance page links to additional guidance pages, one for supported versions, and another for older versions of Windows.
The page for older versions starts by pointing out that “All security updates Microsoft provides do not check Windows Genuine Advantage status.” That means even people running bootleg copies of Windows XP can install these updates. It goes on to say “For customers on these older platforms, the following table provides information to manually download applicable security updates.”
So installing these updates on Windows XP involves manually downloading them with the links provided on the Microsoft security advisory 4025685: Guidance for older platforms page. Some of the links go to the Update Catalog, and some involve additional navigation, but I was able to use Chrome to download and install all twelve of the updates linked from the guidance page on my WinXP VM. Not exactly convenient, and certainly not fast, but it did work.
Microsoft security advisory 4025685: Guidance for supported platforms includes a summary of the month’s updates for supported software. Numerous vulnerabilities are addressed, affecting the usual software: Windows, Office, Internet Explorer, Edge, Silverlight, Skype and Flash. Extracting the complete details from the Security Update Guide is still annoyingly awkward, and the release notes are rather light on details.
Several hundred bug fixes and enhancements, along with a few new features related to media, were collectively made available earlier this week in the form of WordPress 4.8.
The new version doesn’t include any fixes specifically related to security, so there’s no great urgency to upgrade your web sites. Since this is a major release, most sites will not automatically update themselves.
With thirty security fixes in Chrome 59.0.3071.86, I would expect Google to emphasize the need for users to update as soon as possible. Instead, the release announcement says “This will roll out over the coming days/weeks.” Presumably Google feels that the fixed security issues are too obscure to represent any imminent threat.
To be fair, personal experience has shown that Chrome is great at detecting updates, often very soon after they become available. Visiting the About page is usually enough to trigger an update. Click the three-vertical-dots menu button, then choose Help > About.
If you have several hours to kill, you might want to check out the change log for Chrome 59.0.3071.86, which by my count contains 10,911 entries.
Google is giving web advertisers until the end of the year to comply with the standards set by the Coalition for Better Ads, after which a new ad-blocker in Chrome will start blocking non-compliant ads.
This raises some interesting questions.
Google is the biggest provider of advertising services on the web. Will Google block ads from its own platform if they don’t meet the new standards? That scenario, while interesting to ponder, is unlikely to occur, since Google’s ad creation tools will presumably prevent it.
If Google’s ads are unlikely to be blocked, won’t this be viewed as anti-competitive behaviour by other advertisers? Google will point to the independent standards set up by the CBA, but will that be enough? Less-reputable advertising providers — those allowing the sorts of ads Google wants to block — stand to lose significant revenue. These days it doesn’t take much to trigger a lawsuit, and Google is a favourite target for litigation, because it has enormously deep pockets.
From the user perspective, Chrome’s new ad blocker will be purely beneficial. Opera already has a built-in ad blocker, and it’s likely that the other major browser makers are working on similar features. But there are weird times ahead for Google.
If you’re on the Windows Insider program — the one that gets you early looks at where Windows 10 is heading — you may have noticed some unusual updates in the last day or so.
First, a new development version of Windows 10 was rolled out to some unlucky users. This version was not intended for users, even those on the Insider Preview program. Microsoft caught the error and stopped the update, but if your computer was affected, you may notice some new “issues that impact usability of your PC.” You can roll back to the previous release, or live with any new issues until the next release.
Second, a development version of the mobile variant of Windows 10 was pushed out, again unintentionally. If your mobile device received this unfortunate update, it’s probably no longer usable. Microsoft recommends using their Windows Device Recovery Tool to fix the problem.
Microsoft wants us all to trust them to install updates whenever they want, but mistakes like these are not helping.
boot13