A new version of Opera was announced on November 2. Version 33.0.1990.58 is mostly about fixing a few user interface and stability (i.e crashing) issues. The change log has all the details.
Oddly, the version of Opera running on the computer I’m using right now is 33.0.1990.43. I have no record at all of that version, and there’s no mention of it on the version 33 change log page.
Microsoft Corporate Vice President Joe Belfiore has finally admitted what we’ve known all along: Windows 10 talks to Microsoft servers even if you’ve disabled every available privacy-related setting.
Of course, Belfiore says that this is nothing to worry about, since it’s being done to make Windows 10 work better for everyone. He’s probably not lying about Microsoft’s intentions, but all the same, I don’t want my O/S to do this kind of thing. And I don’t care if blocking this unwanted communication makes Microsoft’s work more difficult.
Unless Microsoft relents and provides a method for disabling all of this anti-privacy communication, your choices are: a) give up and stop worrying about it; b) avoid Windows 10 completely; or c) use one of the available third-party methods, such as Spybot Anti-Beacon, to block all of this ‘phone home’ behaviour.
Normally, I’d go for option C. But I’m running Windows 10 as part of the Insider Preview program, and blocking all communication to Microsoft would almost certainly result in my being kicked from the program. So it’s option A for me.
Mozilla seems determined to keep us guessing with new versions of Firefox. New versions that are not assigned a major new version number (e.g. 41, 42) are not announced in any way. When a new version is (apparently arbitrarily) assigned a major new version number, Mozilla publishes a post on the Mozilla blog. This post never includes any mention of the new version identifier, and typically doesn’t even say that there’s a new version.
For example, the post associated with Firefox 42 says this: “We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection” and “We hope you enjoy the new Firefox!” What new version? When will it be released? We’re left guessing the answers to these rather obvious questions.
According to the release notes for Firefox 42, it was released on November 3. The Mozilla blog post describes changes to Firefox’s Private Browsing mode, including the new Tracking Protection, which “actively blocks content like ads, analytics trackers and social share buttons that may record your behavior without your knowledge across sites.”
Firefox 42 adds a small speaker icon that appears next to the caption for any tab that’s currently playing audio. You can mute a tab’s audio by clicking the speaker icon. The Login Manager has been improved in several ways. Performance has also been beefed up for sites that perform a lot of restyling. HTML5 support was improved.
Firefox 42 includes fixes for at least eighteen security bugs, according to the Security Advisories page. Recommendation: update Firefox to version 42 as soon as possible.
You probably shouldn’t rely on the security of your encrypted email. Even if you’re using current encryption technologies, certain conditions may arise during transit that cause your message to be transmitted in plain text.
There’s a well-reasoned response to a common question about the responsibility of Certificate Authorities over on the Let’s Encrypt blog. These fine folks will soon be providing free HTTPS certificates to the world, so they’ve been answering a lot of questions about how their service will work.
There’s going to be a minor apocalypse, starting January 1, 2016. On that date, Certificate Authorities will stop issuing certificates that use SHA1 encryption. SHA1 is now considered too weak for use, and is being phased out in favour of SHA2, which is much stronger. Just one problem: people stuck using older browser software and devices will lose their ability to access secure web sites and use those devices. There’s more technical nitty-gritty over at Ars Technica.
Symantec hasn’t done enough to clean up its Certificate Authority activities, according to Google. This follows the discovery that Symantec employees were issuing unauthorized certificates. Google has warned Symantec to provide a proper accounting of its CA activities or face the consequences.
A critical vulnerability in the blogging platform Joomla was discovered in October. The bug exists in all versions of Joomla from 3.2 onward. A patch was developed and made available, and anyone who manages a Joomla 3.x -based site is strongly advised to install the patched version (3.4.5) as soon as possible.
It’s increasingly dangerous to be a computer security researcher. New agreements could even make the work illegal in some regions.
Flaws in many self-encrypting external hard drives from Western Digital mean their encryption can be bypassed, according to researchers.
Google made it easier to determine why a site is flagged as unsafe, adding a Safe Browsing Site Status feature to their Transparency Report tools.
Mozilla is following the lead of Google and Microsoft, and plans to all but eliminate support for binary plugins in Firefox by the end of 2016. Binary browser plugins for Java, Flash, and Silverlight provide convenience but are a never-ending security headache. There’s one exception: Mozilla will continue to support Flash as a Firefox plugin for the foreseeable future.
The FBI teamed up with security vendors to take down another botnet in October. The Dridex botnet mainly targeted banking and corporate institutions, gathering private data and uploading it to control servers.
Cisco researchers, working with Limestone Networks, disrupted a lucrative ransomware operation in October.
A stash of thirteen million user names and plain text passwords was recently obtained by a security researcher. The records were traced to 000Webhost, an Internet services provider.
The Patreon funding web site was breached, and private information about subscribers, including encrypted passwords and donation records, was published online. Source code was also stolen, which may make decrypting the passwords much easier.
Researchers discovered numerous iPhone applications that collect and transmit private user information, in violation of Apple’s privacy policies. These apps apparently made it into the App Store because of a loophole in the validation process.
87% of Android-based devices are vulnerable to security exploits. Google develops Android updates quickly enough, but phone makers are typically very slow to make updates available to users.
New Android vulnerabilities, dubbed ‘Stagefright 2.0’ by researchers, were announced in early October. As many as a billion Android devices are vulnerable, and although patches were made available by Google, they may take weeks or months to find their way to individual devices.
A malicious Android adware campaign tricks unwary users into installing apps that appear to be from trusted vendors. These apps use slightly-modified icons of legitimate apps to fool users.
Microsoft is really ramping up the annoyance factor lately. The latest is that some time in 2016, Windows 7 and 8.x computers will start seeing Windows 10 as a ‘Recommended’ update in Windows Update. If you have Windows Automatic Updates enabled, your computer will be upgraded to Windows 10 on some arbitrary night in early 2016, while you’re asleep.
This is bad for several reasons. Here are a few:
The Verge has more.
I just ran Edge – Microsoft’s new web browser – on my Windows 10 test computer, and the ‘Favorites’ bar went berserk for a few seconds. At first I thought there was some kind of display bug, but then I clicked the arrow at the far right end of the bar, and could see a lot of new Favorites, including many in folders. Some of those favorites were familiar, and some were not.
I eventually realized that Edge had automatically imported all the Chrome bookmarks from every Google account that had ever logged into Google, using Chrome, while logged into Windows with my Microsoft account. I leave the computer logged in, which is normally not recommended, but this is also my main media computer, and there’s nothing personal on any of its drives. Also I trust my roommate.
Chrome knows when you’re logged in to Google, and shows bookmarks and other settings specific to the current Google user. These settings are stored locally, keeping each Google user’s settings separate, but storing the data in the profile of whichever Windows user is currently logged in.
There are two problems with this. First, I don’t think this import process should be automatic. It’s the kind of thing that I want to do strictly on demand, and in fact you can do that: in Edge’s Settings dialog, click the ‘View favorites settings’ button to see the import feature. Second, Edge should not assume I want to import Chrome bookmarks for all Google profiles. Now I’ve got a mess to clean up, and I can’t be sure it won’t happen again. So I’ll stop using Edge.
I’m running Windows 10 Insider Preview build 10576, which just installed itself earlier this morning. I can’t be sure the Edge problem is related, but it seems likely.
If you’ve ever chosen a default Windows web browser that wasn’t Internet Explorer, you know that Microsoft has an annoying habit of resetting that choice to Internet Explorer when updates are installed.
Microsoft upped the annoyance level with Windows 10, in which changing default applications can no longer be automated. This is good from a security standpoint, but makes it more difficult for competing applications to get a foothold on user systems, and browser developers aren’t exactly thrilled.
A new build of Windows 10 adds another layer of annoyance to this ongoing battle for application dominance: when you try to change the default browser to something other than Edge, you’ll now see a message asking you to give Edge a chance. Granted, that’s much less annoying than unilaterally forcing the default, but it’s still not going to give anyone warm fuzzy feelings.
Adobe finally noticed all the warnings about Shockwave using an old, less-secure version of Flash. The latest new version of Shockwave (12.2.1.171) fixes one specific security issue, while also adding support for the latest Flash using a new feature called ‘Flash Asset Xtra’.
The release notes for Shockwave 12.2.1.171 and the corresponding security bulletin have additional details.
If you use a web browser with a Shockwave plugin, you should install Shockwave 12.2.1.171 as soon as possible. You should also configure the plugin to prompt you before displaying any content, as long as your browser supports doing so.
Chrome has been updated to include the latest Flash, itself recently updated (outside the normal monthly update cycle) to fix a critical vulnerability. Luckily, if you use Chrome with Flash enabled, you don’t have to do anything; it will update itself.
Version 46.0.2490.80’s release notes don’t add much to the conversation, but predictably, the full change log is loaded with useless details. Nothing much of interest there, anyway.
On October 20, Oracle released Java 8 Update 65. Hours later, they apparently released Java 8 Update 66.
It looks like there may have been some kind of screwup at Oracle, because the two versions seem to address many of the same issues. When I use the Java control panel to update to the most recent version, I end up with 8u65, and I’m never prompted to install 8u66. Presumably this confusion will be cleared up by Oracle in the next day or so.
Meanwhile, if you’re still using a web browser with Java enabled, you should install Java 8u65 as soon as you can. Java 8 Update 65 fixes a few bugs, including some related to security.
References:
Update 2015Nov05: According to a post on The Java Source, a Java blog maintained by Oracle, “Java SE 8u66 is a patch-set update, including all of 8u65 plus additional features.” If you want the new features, you’ll have to download and install 8u66 manually, because Java’s own internal updater won’t do it.
boot13