Windows 10 build 10586

Microsoft is happy with the latest Windows 10 Insider Preview build, designated 10586. That means it will find its way to your Windows 10 computer over the next week or so as the Windows 10 Fall Update. This will roughly coincide with next week’s Patch Tuesday.

My Insider Preview test machine is configured to get the latest updates, so I’ve been using 10586, and the builds that were available in the interim since the last public release (10240) for a while. Now that the test computer is running the new release version, the ‘Insider Preview build’ message is once again gone from the desktop. That will change when Microsoft pushes out the next preview version.

There’s not a lot to talk about here. Most of the changes are fairly minor, including coloured title bars, tab previews in Edge, general cleanup in user interface elements, and improvements to the Start menu. Skype will get several enhancements. Several bugs have also been fixed.

Update 2015Nov15: Ars Technica has a list of changes in the new release, and really, there’s not much of interest.

With this release, Microsoft has also changed the way it identifies Windows 10 versions. The previous release was “Version 10.0 (Build 10240).” The new release is “Version 1511 (OS Build 10586.3)” where “1511” refers to the 11th month of 2015. They like to keep us confused, don’t they?

Windows 10 privacy concerns are legitimate

Microsoft Corporate Vice President Joe Belfiore has finally admitted what we’ve known all along: Windows 10 talks to Microsoft servers even if you’ve disabled every available privacy-related setting.

Of course, Belfiore says that this is nothing to worry about, since it’s being done to make Windows 10 work better for everyone. He’s probably not lying about Microsoft’s intentions, but all the same, I don’t want my O/S to do this kind of thing. And I don’t care if blocking this unwanted communication makes Microsoft’s work more difficult.

Unless Microsoft relents and provides a method for disabling all of this anti-privacy communication, your choices are: a) give up and stop worrying about it; b) avoid Windows 10 completely; or c) use one of the available third-party methods, such as Spybot Anti-Beacon, to block all of this ‘phone home’ behaviour.

Normally, I’d go for option C. But I’m running Windows 10 as part of the Insider Preview program, and blocking all communication to Microsoft would almost certainly result in my being kicked from the program. So it’s option A for me.

Firefox 42 improves private browsing, fixes numerous bugs

Mozilla seems determined to keep us guessing with new versions of Firefox. New versions that are not assigned a major new version number (e.g. 41, 42) are not announced in any way. When a new version is (apparently arbitrarily) assigned a major new version number, Mozilla publishes a post on the Mozilla blog. This post never includes any mention of the new version identifier, and typically doesn’t even say that there’s a new version.

For example, the post associated with Firefox 42 says this: “We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection” and “We hope you enjoy the new Firefox!” What new version? When will it be released? We’re left guessing the answers to these rather obvious questions.

According to the release notes for Firefox 42, it was released on November 3. The Mozilla blog post describes changes to Firefox’s Private Browsing mode, including the new Tracking Protection, which “actively blocks content like ads, analytics trackers and social share buttons that may record your behavior without your knowledge across sites.”

Firefox 42 adds a small speaker icon that appears next to the caption for any tab that’s currently playing audio. You can mute a tab’s audio by clicking the speaker icon. The Login Manager has been improved in several ways. Performance has also been beefed up for sites that perform a lot of restyling. HTML5 support was improved.

Firefox 42 includes fixes for at least eighteen security bugs, according to the Security Advisories page. Recommendation: update Firefox to version 42 as soon as possible.

October Security Roundup

You probably shouldn’t rely on the security of your encrypted email. Even if you’re using current encryption technologies, certain conditions may arise during transit that cause your message to be transmitted in plain text.

There’s a well-reasoned response to a common question about the responsibility of Certificate Authorities over on the Let’s Encrypt blog. These fine folks will soon be providing free HTTPS certificates to the world, so they’ve been answering a lot of questions about how their service will work.

There’s going to be a minor apocalypse, starting January 1, 2016. On that date, Certificate Authorities will stop issuing certificates that use SHA1 encryption. SHA1 is now considered too weak for use, and is being phased out in favour of SHA2, which is much stronger. Just one problem: people stuck using older browser software and devices will lose their ability to access secure web sites and use those devices. There’s more technical nitty-gritty over at Ars Technica.

Symantec hasn’t done enough to clean up its Certificate Authority activities, according to Google. This follows the discovery that Symantec employees were issuing unauthorized certificates. Google has warned Symantec to provide a proper accounting of its CA activities or face the consequences.

A critical vulnerability in the blogging platform Joomla was discovered in October. The bug exists in all versions of Joomla from 3.2 onward. A patch was developed and made available, and anyone who manages a Joomla 3.x -based site is strongly advised to install the patched version (3.4.5) as soon as possible.

It’s increasingly dangerous to be a computer security researcher. New agreements could even make the work illegal in some regions.

Flaws in many self-encrypting external hard drives from Western Digital mean their encryption can be bypassed, according to researchers.

Google made it easier to determine why a site is flagged as unsafe, adding a Safe Browsing Site Status feature to their Transparency Report tools.

Mozilla is following the lead of Google and Microsoft, and plans to all but eliminate support for binary plugins in Firefox by the end of 2016. Binary browser plugins for Java, Flash, and Silverlight provide convenience but are a never-ending security headache. There’s one exception: Mozilla will continue to support Flash as a Firefox plugin for the foreseeable future.

The FBI teamed up with security vendors to take down another botnet in October. The Dridex botnet mainly targeted banking and corporate institutions, gathering private data and uploading it to control servers.

Cisco researchers, working with Limestone Networks, disrupted a lucrative ransomware operation in October.

A stash of thirteen million user names and plain text passwords was recently obtained by a security researcher. The records were traced to 000Webhost, an Internet services provider.

The Patreon funding web site was breached, and private information about subscribers, including encrypted passwords and donation records, was published online. Source code was also stolen, which may make decrypting the passwords much easier.

Researchers discovered numerous iPhone applications that collect and transmit private user information, in violation of Apple’s privacy policies. These apps apparently made it into the App Store because of a loophole in the validation process.

87% of Android-based devices are vulnerable to security exploits. Google develops Android updates quickly enough, but phone makers are typically very slow to make updates available to users.

New Android vulnerabilities, dubbed ‘Stagefright 2.0’ by researchers, were announced in early October. As many as a billion Android devices are vulnerable, and although patches were made available by Google, they may take weeks or months to find their way to individual devices.

A malicious Android adware campaign tricks unwary users into installing apps that appear to be from trusted vendors. These apps use slightly-modified icons of legitimate apps to fool users.

If you don’t want Windows 10, disable Automatic Updates

Microsoft is really ramping up the annoyance factor lately. The latest is that some time in 2016, Windows 7 and 8.x computers will start seeing Windows 10 as a ‘Recommended’ update in Windows Update. If you have Windows Automatic Updates enabled, your computer will be upgraded to Windows 10 on some arbitrary night in early 2016, while you’re asleep.

This is bad for several reasons. Here are a few:

  • For anyone not interested in upgrading to Windows 10, this renders Automatic Updates unusable. Yes, there are people who want to use Automatic Updates, but don’t want to upgrade to Windows 10. Lots of them. Including a lot of grandparents.
  • There have already been reports of problems with Windows 10 being installed when it wasn’t wanted. If Microsoft messes this up somehow, a lot of people are going to be mighty annoyed when they wake up to Windows 10 on their computer.
  • There are loads of reasons not to upgrade to Windows 10, including incompatible software and hardware. An unwanted Windows 10 upgrade could mean a lot of time wasted downgrading or looking for alternatives.
  • Microsoft has started talking about Windows 10 in business and education settings, saying they’ll provide workarounds for these types of problems. But it can’t be very encouraging to business IT folks to hear announcements like this.

The Verge has more.

Edge automatically imports Chrome bookmarks for all users

I just ran Edge – Microsoft’s new web browser – on my Windows 10 test computer, and the ‘Favorites’ bar went berserk for a few seconds. At first I thought there was some kind of display bug, but then I clicked the arrow at the far right end of the bar, and could see a lot of new Favorites, including many in folders. Some of those favorites were familiar, and some were not.

I eventually realized that Edge had automatically imported all the Chrome bookmarks from every Google account that had ever logged into Google, using Chrome, while logged into Windows with my Microsoft account. I leave the computer logged in, which is normally not recommended, but this is also my main media computer, and there’s nothing personal on any of its drives. Also I trust my roommate.

Chrome knows when you’re logged in to Google, and shows bookmarks and other settings specific to the current Google user. These settings are stored locally, keeping each Google user’s settings separate, but storing the data in the profile of whichever Windows user is currently logged in.

There are two problems with this. First, I don’t think this import process should be automatic. It’s the kind of thing that I want to do strictly on demand, and in fact you can do that: in Edge’s Settings dialog, click the ‘View favorites settings’ button to see the import feature. Second, Edge should not assume I want to import Chrome bookmarks for all Google profiles. Now I’ve got a mess to clean up, and I can’t be sure it won’t happen again. So I’ll stop using Edge.

I’m running Windows 10 Insider Preview build 10576, which just installed itself earlier this morning. I can’t be sure the Edge problem is related, but it seems likely.

Microsoft wants you to try Edge

If you’ve ever chosen a default Windows web browser that wasn’t Internet Explorer, you know that Microsoft has an annoying habit of resetting that choice to Internet Explorer when updates are installed.

Microsoft upped the annoyance level with Windows 10, in which changing default applications can no longer be automated. This is good from a security standpoint, but makes it more difficult for competing applications to get a foothold on user systems, and browser developers aren’t exactly thrilled.

A new build of Windows 10 adds another layer of annoyance to this ongoing battle for application dominance: when you try to change the default browser to something other than Edge, you’ll now see a message asking you to give Edge a chance. Granted, that’s much less annoying than unilaterally forcing the default, but it’s still not going to give anyone warm fuzzy feelings.

Shockwave update adds latest Flash

Adobe finally noticed all the warnings about Shockwave using an old, less-secure version of Flash. The latest new version of Shockwave (12.2.1.171) fixes one specific security issue, while also adding support for the latest Flash using a new feature called ‘Flash Asset Xtra’.

The release notes for Shockwave 12.2.1.171 and the corresponding security bulletin have additional details.

If you use a web browser with a Shockwave plugin, you should install Shockwave 12.2.1.171 as soon as possible. You should also configure the plugin to prompt you before displaying any content, as long as your browser supports doing so.

Flash update for Chrome

Chrome has been updated to include the latest Flash, itself recently updated (outside the normal monthly update cycle) to fix a critical vulnerability. Luckily, if you use Chrome with Flash enabled, you don’t have to do anything; it will update itself.

Version 46.0.2490.80’s release notes don’t add much to the conversation, but predictably, the full change log is loaded with useless details. Nothing much of interest there, anyway.

Rants and musings on topics of interest. Sometimes about Windows, Linux, security and cool software.