Jeff Rivett has worked with and written about computers since the early 1980s. His first computer was an Apple II+, built by his father and heavily customized. Jeff's writing appeared in Computist Magazine in the 1980s, and he created and sold a game utility (Ultimaker 2, reviewed in the December 1983 Washington Apple Pi Journal) to international markets during the same period. Proceeds from writing, software sales, and contract programming gigs paid his way through university, earning him a Bachelor of Science (Computer Science) degree at UWO. Jeff went on to work as a programmer, sysadmin, and manager in various industries. There's more on the About page, and on the Jeff Rivett Consulting site.

All posts by jrivett


Adobe, Patches and updates, Shockwave

Shockwave 12.2.5.196

Leave a comment

A new version of Shockwave appeared at some point in recent weeks. There was nothing like an announcement, and version 12.2.5.196 is barely mentioned on the official Shockwave release notes page. In fact, all we get is this: “Current Runtime Release Version: 12.2.5.196”.

Somewhere at Adobe, there’s at least one person who knows why Shockwave 12.2.5.196 was released. It would sure be handy if they said something about it.

If you use a web browser with Shockwave enabled, you should probably install the new version, because it may contain a security fix that Adobe just didn’t bother to mention.

Microsoft, Patches and updates

Microsoft pushes February updates to March

1 Comment

In an unprecedented move, Microsoft has decided to delay all February updates until next Patch Tuesday, which is March 14. It’s still not clear exactly why this is happening, but Microsoft is working on structural changes to the Windows Update system, so presumably something went horribly wrong in testing.

This is bad news for anyone who runs a server that’s vulnerable to a recently-discovered SMB flaw that was expected to be fixed with Tuesday’s updates.

Update 2017Feb23: Meanwhile, Google’s Project Zero went ahead and published the details of another vulnerability (in the GDI graphics library) that was supposed to be fixed this month. This was done in keeping with GPZ’s own policy, but as usual Microsoft isn’t happy about it.

Update 2017Feb28: Yet another vulnerability that was expected to be fixed in the February updates from Microsoft was just revealed by GPZ. This one affects Internet Explorer and Edge, and it’s ranked highly severe.

Adobe, Chrome, Edge, Flash, Internet Explorer, Patches and updates, Security, Windows

Flash update fixes 13 vulnerabilities

Leave a comment

A new version of Flash, released yesterday, addresses at least thirteen vulnerabilities in previous versions.

According to the security bulletin for Flash 24.0.0.221, the new version fixes “critical vulnerabilities that could potentially allow an attacker to take control of the affected system.”

The release notes for Flash 24.0.0.221 describe some new features that are likely only of interest to developers.

As usual, Internet Explorer and Edge will get new versions of their embedded Flash via Windows Update, while Chrome’s embedded Flash will be updated automatically.

Anyone who still uses a web browser with Flash enabled should update it as soon as possible.

Patches and updates, Security, Vivaldi

Vivaldi 1.7

Leave a comment

Apparently the people who develop Vivaldi believe that adding a screen capture feature to the browser is a good use of their time. Perhaps if you don’t use any other web browsers, and you only ever need to capture screenshots of web sites, and never of anything outside the browser, this would be a useful feature. The rest of us will use the much more powerful features of general-purpose screen capture tools like ShareX.

Aside from the arguably pointless addition of screen capture, Vivaldi 1.7 further improves audio handling, and includes tweaks for domain expansion in the address bar. More importantly, Vivaldi now warns users when they navigate to a non-encrypted page that prompts for a password.

You can see the complete list of changes for Vivaldi 1.7 in the official release announcement.

Opera, Patches and updates

Opera 43

Leave a comment

The folks who develop the alternative web browser Opera are working on improving page loading time, and if their own benchmarks are any indication, those efforts have paid off.

Opera 43 shows significant speed gains over Opera 42, due mainly to the introduction of two new technologies: ‘instant page loading’, which predicts the site you’re looking for as you’re typing in the address bar, and PGO, which optimizes the browser code to make it run faster when it’s most important.

The new version also includes improvements to URL highlighting/selecting. Previously, there was no way to highlight linked text. With Opera 43, highlighting linked text works as expected if you use a horizontal motion, and if you use a vertical motion, the entire link is copied, as before.

There are loads of other changes in Opera 43, as you can see from the lengthy change log. However, none of the changes seem to be related to security vulnerabilities.

Microsoft, Security, Windows

Microsoft will patch recently-discovered SMB flaw in February

2 Comments

The flaw itself is not particularly dangerous for most users: it can only be used to crash Windows computers with file shares that are exposed to the Internet. But when an exploit was published on Thursday, the vulnerability was initially assigned the highest risk rating by CERT. That rating has since been downgraded, as details of the flaw became more clear.

In any case, Microsoft’s reaction to the exploit announcement included statements that are demonstrably false, and seem to have been motivated by the company’s frantic efforts to get everyone on the planet to switch to Windows 10.

“Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible.”

This is simply false. The same work is done for Linux and MacOS. The unnamed Microsoft staffer who said this may have borrowed it from this TechNet blog post, without checking its veracity.

“We recommend customers use Windows 10 and the Microsoft Edge browser for the best protection.”

This is totally misleading. Windows 10 is arguably the safest version of Windows yet, but the vulnerability affects all versions of Windows. Worse, the vulnerability is completely unrelated to web browsing.

It looks like Microsoft has issued standing orders to its PR department to push Windows 10 at every opportunity, and not to worry too much about accuracy.

Microsoft is expected to issue an update for the vulnerability on February’s Patch Tuesday.

Patches and updates, Security, WordPress and other CMS

WordPress 4.7.2 – security update

Leave a comment

Most WordPress sites are configured to automatically update themselves when a new version becomes available. Still, anyone who manages any WordPress sites should make sure they are up to date with version 4.7.2, released yesterday.

WordPress 4.7.2 addresses three serious security vulnerabilities. You can find all the details in the release announcement.

Update 2017Feb02: Apparently WordPress 4.7.2 included a fix for a fourth security vulnerability, which wasn’t announced until February 2. The vulnerability is so severe that the WordPress developers didn’t want to risk anyone knowing about it until the majority of WordPress sites were updated.

Firefox, Mozilla, Patches and updates

Firefox 51.0.1

Leave a comment

There were a couple of problems with Firefox 51 that prompted Mozilla to push out another new version yesterday. Firefox 51.0.1 resolves the two problems, one of which was related to the new multiprocess features.

Firefox itself seems to take a few days to notice new versions. Click the ‘hamburger’ menu button at the top right, then click the question mark icon, then click ‘About Firefox’ to see the version you’re running. In my experience, Firefox will usually say ‘Firefox is up to date’ until a couple of days after a new release becomes available. This is potentially confusing, but Mozilla doesn’t seem to understand that.

If you don’t want to wait for Firefox to notice the new version, you’ll have to download it directly from Mozilla.