|
Please note: Older issues may contain information that is now out of date. How To Subscribe
and Unsubscribe is at the end of this note. Mailing List Trouble? See http://www.langa.com/help.txt Want an easier-to read formatted HTML version? See http://www.langa.com/whats_new.htm (The HTML version of each issue normally is available by 9AM EST [GMT-5] of the issue date.) Please recommend the LangaList to a friend! (And maybe win a Palm III !) The LangaList30-Sept-99 In This Issue: --------------( Please Visit This LangaList Sponsor!) ------------
--------------( the above is a paid advertisement )--------------
Internet Explorer Bugs and Security ProblemsOK, it's time for semantic clarity: A "bug" is a software coding error that causes inappropriate or unexpected behavior, usually of the bad sort (crashes, etc.). Analogously, a "bug" in a new car might be a misaligned wheel, a radio that doesn't work, a tendency to stall; etc. A "security problem" isn't necessarily a bug, although it may be. Using the car analogy, if someone else's keys can open your car, that's a bug. But if your car is "vulnerable" to someone getting inside by smashing the windows with a rock or cutting through the roof with a metal saw, that's not really a bug--- the problem isn't necessarily in the design or manufacture of the car, but in the malicious behavior of others. However, with software, all problems often get lumped together as "bugs," even when they're not really the vendor's fault. On the flip side, software vendors often like to speak of "issues" and "vulnerabilities," and hardly ever just come out and say: "We screwed up. It was a bug." Like all software, Microsoft products have bugs. But because they're in the widest use, Microsoft products also get attacked and hacked more often than any other products. Using the car analogy again: More cars get stolen in cities than in the country. That doesn't mean that car locks on urban cars are worse or are more poorly designed than those on rural cars; it's just that there are more car thieves at work in the cities. I offer this not to make excuses for Microsoft, but to offer perspective: Every time I report on a problem with a Microsoft product, I can count on getting mail from some readers claiming it proves how ratty MS products are. Sometimes, they are ratty. But other times, the seemingly high percentage of Microsoft-related problems stems simply from the fact that there are far more people trying to make Microsoft products fail than any others. This week's security news from Microsoft shows both side of the equation: Some of these are bugs; some are problems caused by the malicious behavior of others. You can decide for yourself whether it's a sign of Microsoft ineptitude or of the bad behavior of others. THE IMPORT/EXPORT FAVORITES PROBLEM A malicious person can use Internet Explorer's "Import Favorites" (that is, bookmarks) option to load bad things on your PC if you choose to import their Favorites list. Along with the imported URLs, you may get pointers to malicious code. One solution is simply not to share Favorites with people you don't know. Or, you can download a patch Microsoft has posted; the patch also corrects a bug in some ActiveX controls, so it's a kind of two-in-one deal. You'll need different patches depending in which flavor of IE you're running. Best bet is to click over to a FAQ page and figure out which patch you specifically need: http://www.microsoft.com/security/bulletins/MS99-037faq.asp THE IE5 DOWNLOAD BEHAVIOR PROBLEM A clever hacker can use something called a "server-side redirect" to fool your browser into exposing files on your system that should not be accessible. BigFix.Com ( http://www.bigfix.com ) first brought this to light; Microsoft responded by saying that yes it's true; they're working on a patch; and for now, the only way to prevent this problem is to turn off Active Scripting. Yikes--- that's a draconian measure. There's no patch yet, but I'll
let you know when it arrives. Meanwhile, if you're wondering if you should turn
off your active scripting or not, here's a FAQ and info on the workaround: --------------( Please Visit This LangaList Sponsor!) ------------
--------------(
the above is an advertisement )-------------- This newsletter---and indeed
every bit or byte that I send out via the Internet---gets to you via a fossil,
almost-decade-old PC: a 1991 vintage 486 with just 16MB of RAM. I'm not a masochist; it's not the
machine I work on. But that lowly box has ample power to perform the simple task
of Internet connection sharing. I use it as such---as an access server--- to
share a single Internet connection among the 7 machines here. The PC is set up
with a Windows "compact" installation (so no frills, bells or whistles
are loaded) and essentially runs just one small application: Sygate. Sygate lets all the machines on
my local network share the same connection. It's a cable modem in my case, but
it could be any type of connection, including dial-up. It also serves as a
firewall, keeping potential intruders out of my machines and off my LAN. (BTW,
there's a new version of Sygate out; I'm trying it now and will let you know how
it fares. More info: http://www.sygate.com
) The cash value of that 1991 PC is
near zero--- some of the parts could be re-used, but essentially, it's a
high-mileage junker that's unfit for today's mainstream apps. Yet, I'm getting
great ongoing service out of it by using it as an access server. That's just one of the dozen
different ways I discuss in "What To Do With Your Old PC;" the column
(and discussion area) that's live right now at http://content.techweb.com/winmag//columns/fred/1999/0927.htm Come get all the details, and
then join in the discussion! Last week, I wrote about how
Gateway 2000 was tap-dancing about the future of the Amiga--- a storied machine
that generates such fierce loyalty that some Amigans can make MacFanatics or
rabid Linuxen look positively tame. Gateway bought rights to the
Amiga a couple years ago, and not much happened until this last summer. But just
as it appeared Amiga was going to rise from the grave (OK, it never really died;
but it was awfully close) Gateway announced that the Amiga "wasn't really
about a box." Instead, Gateway issued a statement that Amiga was simply
about "a better way" and that some kind of reconstituted Amiga---one
that wasn't exactly hardware and wasn't exactly software---would be everywhere;
on every OS and platform. Huh? I was deeply dubious, and said so
in this month's Byte column. It seemed to me that Gateway had chickened out
about actually building new Amiga boxes and was trying to weasel out of its past
promises by redefining what was an Amiga into something so vague and nebulous
they could claim to have shipped "an Amiga" by shipping almost any
piece of hardware or software. A lot---and I mean a *lot*---of
Amigans felt likewise. The column was picked up by Amiga organizations
worldwide, and Amigans have flooded Byte's discussion areas. It's fascinating reading: Come
get the full story at http://www.byte.com/column/BYT19990922S0004
and then join in the discussions, which are available two ways: The best way (in my opinion) is
to use your newsgroup or Usenet reader (Outlook, Free Agent, etc.) and click on
over to news://news.cmpnet.com/cmpnet.byte.monitor Or, you can join in via a
standard web browser at http://www.byte.com/nntp/monitor
. I prefer the newsgroup version
because I find that newsgroup readers do a better job of displaying the threads;
plus, if you post a message, your email client will handle the posting for you,
and that usually means you have the benefit of a spell checker and such---
notably absent in the web interface. But either way, join in and see
what's up among the vociferous and worldwide Amigan community! In the last issue, I told you
about a little batch file I use to clean up the TEMP directory, which can get
quite large if left unattended. (See http://www.langa.com/newsletters/sept-27-99.htm#temp
) Several readers had questions or
even better ideas. Here are three example letters: Reader Don Graves writes: Hello Mr.
Langa: I followed
your instructions but, my Prompt is " C:\Windows> " and typing
'cleanup' indicates a bad command.... Type whatever directory the file
is in in front of the file name: For example, if you put the file "Cleanup.bat"
in the c:\ directory, just type c:\cleanup.bat . Reader Michael Murphy suggests an
alternative Cleanup.bat that will work no matter where your TEMP directory is
located. (The default is c:\windows\temp, and that's what I used in my example.
But it can be located elsewhere; and some systems also have a TMP directory,
which is simply an alternate name for TEMP.) I just got your
LangaList & read the article about the temp cleanup batch file. We've
encountered this a few times at work & I thought I'd suggest an alternative. c:\windows\command\deltree
/y %temp%\*.* It's arguable really
since most people will be pointing to the directory that you reference, however,
I've got my temp directory on a different drive & thought you might find
this an interesting alternative. The newsletter is great & I look forward to
reading it. Keep up the good work. Have a great day! ---Michael Murphy Anthony Cassinelli suggests this
automated method of cleanup: In your LangaList
27-Sep-99 under the "cleaning Up Temp Files" I was faced with the same
problem. Problem for me was I would sometimes forget to cleanup the temp files
area. Came up with a few lines that I inserted into my AUTOEXEC.BAT file. This
way I am reminded every time I start or reboot my system & if I'm not around
it will automatically bypass the delete. Obviously I could add more DELTREE
lines (if needed) or make this a separate file & use a @CALL function. I placed these lines at
the bottom of my AUTOEXEC.BAT file. Hope it helps. ---Anthony @ECHO OFF Yet another automation method is
to use Windows Task Scheduler, and tell Windows to run Cleanup.bat at some point
when you're absolutely, positively certain there will be no apps, open files or
installs that may be using the TEMP directories---say Monday mornings at 2AM, or
some equally gawdawful time. 8-) Thanks to all who wrote in! -------------(
Please Visit This LangaList Sponsor!) ------------
--------------(
the above is a paid advertisement )-------------- Most people posting in the
discussion on Snoopware---applications that monitor your actions on a PC or
LAN---seem to hate that kind of software. But it's still in use all over the
place. Some of this software runs invisibly; you may be being monitored even
down to the level of your individual keystrokes and not even know it! For lots
more information on this contentious issue, check out the column and then join
the lively discussion http://www.informationweek.com/langaletter
! Lately, I've been
astonished to see the ratio of new subscribers to unsubscribers soar into the
hundreds--- for every person who unsubscribes from the LangaList, between 200
and 300 new people sign up! The long-term average is a little lower, but still
wonderfully lopsided. Thank you! I suspect that's
because many new subscribers sign up after getting a recommendation from another
reader. If *you* think the LangaList is a worthwhile read, please do use the
following link to recommend the LangaList to a friend. Your friend just may find
a new source of useful information; I just may gain a new subscriber; and you
just may win a Palm III organizer for your trouble (full details also available
via this link): http://www.langa.com/recommend.htm#1 Or, win a Copy of
"Poor Richard's E-Mail Publishing: Creating Newsletters, Bulletins,
Discussion Groups and Other Powerful Communications Tools." This book has
been described as "An excellent, straightforward manual on email
publishing, banner ads, driving traffic and especially ethics." (Full
details also available via this link): http://www.langa.com/recommend.htm#2 Either way, thank
you, and good luck! I've been test driving "ShutDown
Plus," a nice app from WM Software ( http://www.wmsoftware.com/
). It can run whatever programs you want at shutdown, and run them either at
every shutdown, or once a day at shutdown, or on an arbitrary schedule (say,
once a week at shutdown). It's actually a nice way to perform some maintenance
tasks, including periodic wiping of the TEMP files. (See discussion above.) But there are freeware apps that
run programs at shutdown. ShutDown Plus also can automatically shutdown/restart
your PC at preset times. I use it in conjunction with a pile of normal weekly
maintenance chores that automatically run late Sunday night and into Monday
morning: My system wipes out its TEMP and similar files, runs ScanDisk, Aligns
and then Defrags everything. Then, Shutdown Plus reboots the system so when I
sit down to work Monday morning, the system is solid, clean, and probably
readier for the workweek than I am! 8-) You can try ShutDown Plus free
for 30 days via the above link; if you like it, it costs $35. -------------(
Please Visit This LangaList Sponsor!) ------------
--------------(
the above is an advertisement )-------------- Thanks to the many
readers who wrote to tell me that last week's "Humanity, I weep for
thee" item in Just For Grins was (ahem) appropriated without attribution by
the reader who sent it to me. The original source appears to have been none
other than Scott Adams (of Dilbert fame; http://www.comiczone.com/comics/dilbert/
). I love the Dilbert
strips; and I despise plagiarism. My apologies to Scott Adams. And please: If
you're going to send me a bit of humor and have lifted it from another source,
please let me know where it came from. Thnx! Several people sent me versions
of this "Decoding Windows Error Messages." If anyone can tell me the
original author, I'd be happy to offer attribution... 8-) WinErr: 000 Not Errors
found [Retry] [Reboot] See you next issue! Best, -------------( Please Visit This
LangaList Sponsor!) ------------
--------------( the above is a
paid advertisement )-------------- (Please recommend
the LangaList to a friend! (And maybe win a Palm III) An easier-to read formatted HTML version is
available in the "what's new" section of http://www.langa.com.
(The HTML version of each issue normally is available by 9AM EST [GMT-5] of the
issue date.) All past LangaList issues are also available via the same link. Why are you getting this newsletter? There are
only two ways to get on the list (direct email request or via the WinMag mail
list signup page) so if you're getting this newsletter; your name came to me
through one of those channels. SUBSCRIBE (it's free!): Send email to subscribe-langalist@lyris.dundee.net About the advertisers:
Each item marked "the above is a paid
advertisement" is just that: a paid ad. Although Langa Consulting LLC will
never knowingly accept advertising for a fraudulent product, company or service,
Langa Consulting LLC makes no implied or explicit warranty, recommendation or
endorsement of or for the products, companies or services mentioned in the ads.
Treat these ads as you would any other ad in any other medium. Disclaimer:
The tips and other information given in the newsletter are
researched and are as accurate as possible. However, due to the many variables
of hardware and software brand, size, type, age and configuration, plus the
vagaries of user knowledge, skill level and usage accuracy, Langa Consulting LLC
makes no assertion, warranty or guarantee that all the information here will
work on all systems and for all users, all the time. If you're not sure of the
applicability or suitability-to-task of any advice, tips, etc. given here, or
are uncertain of your own ability to perform a described task, seek additional
help or information before proceeding. In any case, all information herein is
offered as-is and without warranty of any kind; neither Langa Consulting LLC, nor
its employees nor contributors are responsible for any loss, injury, or damage,
direct or consequential, resulting from application of any information presented
here. This newsletter is a free service of Langa Consulting LLC and is Copyright © 1999 Langa Consulting LLC. All rights reserved. |
|
Please note: Older issues may contain information that is now out of date. |