There's lots to cover this week---including a surprising number of significant security problems/bugs that have come to light with Windows software: you may be at risk! I'll tell you about these problems and point you to the fixes in just a moment.

But many of you have written to me, wondering where the LangaList has been for the last few weeks. First, I took my family on a much-needed vacation. Then, I started a major search for a commercial list-serve service to distribute the LangaList because the mailing list has grown simply too large for the vanilla email-based methods I was using.

Some of you had experienced problems such as duplicate messages, or looooong lists of "To:" recipient names that should have been invisible. These were all problems caused by trying to send a too-large list by email.

I tried a variety of list-services, including some interesting and brand-new web-based ones, but they all had one or more "gotchas" that made me wary: I don't want to risk using a service that might cause you email problems, so I ended up buying a list-serve account at a local ISP. I'm paying for this out of my own pocket; your LangaList subscription will remain free.

So you'll know, I'm using "Majordomo," one of the most popular list serve packages. Majordomo is a software robot that lets you manage your subscriptions entirely through email. For example, to subscribe manually to the LangaList, you'd send a message to

Maybe it's the summer weather, but it seems to be Bug Season: reports of software bugs and fixes have been arriving almost daily. Because some of these bugs are quite serious and can compromise your online security, I'll spend most of this LangaList telling you about the worst of them:

In the last LangaList, I told you about a patch for a security bug in the way Outlook handles long file names; hackers could exploit this bug to cause trouble on your system.

Now Microsoft has found a second, related bug. They've posted the patch for both the previous and the new bug together. If you're using Outlook, check out this link:
http://officeupdate.microsoft.com/downloadDetails/outptch2.htm

IE4's handling of JavaScript also turns out to have some security bugs, and Microsoft has posted a fix for that, too. The security hole is serious enough that Microsoft says IE4 users  "should download and apply [the patch] as soon as possible."

The following software is affected by this bug:

• Microsoft Internet Explorer 4.0, 4.01, 4.01 SP1 on Windows 95 and Windows NT 4.0
• Microsoft Windows 98 (with its built-in version of IE4)

or (if you’re running Win98) you can run the Update Wizard, and look for "critical update" items to download.

With all these bug reports, I'm beginning to feel like that guy in the Orkin commercials, but we're not done yet:

More and more readers are encountering the IE4 bug that causes the browser to report the error:

"Cannot find <address>. Make sure the path or Internet address is correct."

Other times, you don't get the error message, but the browser either simply ceases to be able to follow links, or (weirdly) keeps bringing you to the same page no matter what link you're trying to follow. It may do this even on pages and sites you know are valid and operational.

Step-by-step instructions for the three simplest and best fixes for this problem are posted on the BrowserTune98 website (http://www.browsertune.com/bt98/); just follow any of the "Browser Broken?" links.

Those remedies usually work, but reader John Melody's copy of IE4 remained broken even after trying those fixes. He called Microsoft and was told of an additional fix:

"Change the Web page's language to something other than User Defined. To do this, right-click the Web page, point to Language, and then click a command other than User Defined. The western alphabet contains the default character set for English versions of Windows. The English, French, German, Italian, and Spanish languages use the western alphabet."

But this didn't work for John either. Then he tried the total-clean-install instructions found on the Microsoft site at http://support.microsoft.com/support/kb/articles/Q174/2/65.asp but these didn't work either.

John wrote to me: "You know what DID work? I got so frustrated, I went into the registry, armed with the info I got from you about the IE4 beta having left unsavory pieces of itself lying about. I found the high level folder named IE4, and deleted it, with all of its subfolder children! When I reinstalled IE4, it worked beautifully. I wrote back to Microsoft and suggested they add the following fix to their database: "Sumtin' ain't workin'? Hack it outta da registree!"

Microsoft Tech support named John the unofficial "Customer of the Day" for that gem.

Thanks, John, for sharing this info. We now have five separate ways---ranging from simple to drastic---for restoring full functionality to IE4. Thanks!

There probably aren't that many of you who are using the Point-to-Point Tunneling Protocol (PPTP) for Virtual Private Networks (VPN)---it's a fairly new technology that's just starting to come into play. It's cool because it lets you use the public internet as a secure private way: sort of using a public WAN as a private LAN.

Alas, if you are using Microsoft's PPTP, you may be less secure than you thought and Microsoft recommends you grab new patches "as soon as possible."

Affected Software:

• Microsoft Dialup Networking 1.2x and earlier on Windows 95
• Microsoft Remote Access Services on Windows NT 4.0 (both client and server)
• Microsoft Routing and Remote Access Services on Windows NT Server 4.0
• Microsoft Windows 98 Dialup Networking

(NOTE: The above link is actually all one line although it may wrap to two lines in some displays.)

The beta version of IE5 also contains its share of bugs, as you'd expect. Reader Harold Locke was the first to tell me the HotSpots page (http://www.browsertune.com/flanga/hotspots.htm) would not display properly on IE5. Fortunately, this does appear to be a bug in the beta and not in the page itself! 8-)

Reader Sid Moore also found that like IE4 (as discussed earlier), IE5 also can lose the ability to follow perfectly valid links. Let's hope this one gets fixed before IE5 ships.

A long time ago, I ranted about "dribbleware" in my WinMag columns and here. (See http://www.browsertune.com/flanga/dribbleware.htm.) I really disliked the constant stream of updates and patches we all were forced to endure if we wanted to keep our PCs current. And I really, really disliked downloading patches without knowing exactly what they'd do.

Many of you agreed: That piece generated a ton of email and snailmail.

Like Oil Change and several other third-party products, Win98's Update feature is designed to simplify and automate the process of staying up to date with dribbleware patches and bug fixes. You click the Update item in the Start menu, and Win98 launches Internet Explorer, taking you to a special interactive site on the Microsoft servers.

But the Update page doesn't give you the option of downloading the patches and updates to disk; the updating happens live, and in real-time. The problem with this is that if---or rather, when---you have to reinstall Windows, you'll have to return to the Update page for another round of identical downloads. That seems silly.

But I'll admit maybe I'm missing something. Have you tried the Win98 Update feature yet? (And if you haven't, give it a try now: there are significant new patches available there that have come out since Win98 shipped.) What's your reaction to the update process? Have you figured out a way to save the downloaded file so you don't have to re-download it later? Would you prefer a manual update process with a download-to-disk option?

The Update function is a cornerstone of Microsoft's attempts to make Windows self-maintaining: Please share your thoughts on this vital piece of the new OS starting Monday August 31 around noon via the link on the WinMag site at www.winmag.com!

OK, here's the last bug item I'll mention this week: Several weeks ago, on the WinMagWeb's "Dialog Box" section, I asked readers to send in their Win98 bug reports---and we ended up with nearly 2000 submissions!

I'm collating the reports now to see what patterns emerge, and I've been told by Microsoft that they'll help out. All this will end up in a feature article in an upcoming issue of WinMag---so stay tuned!

Want to catch the end of one of the hottest, most outrageous flame wars in recent memory? It's still going on (through Sept 1) at http://www.langa.com/badlink.htm!

In that column, I questioned Apple's deceptive and elitist marketing campaign for the new iMac… and the MacFanatics lit their torches and stormed the chat area! Some amazing stuff has been posted there---check it out!

The whole US justice system is supposed to be based on the presumption of innocence. Still, plaintiffs and defendants often try to spin public opinion to influence or prejudice a legal proceeding. The more high-profile the case, the faster the spinmeisters spin.

The controlled leaking of key pieces of evidence is one of the tools of the spinmeister: a fact or act or utterance, taken out of context, can cast a litigant in either a positive or negative light. It can be nearly impossible not to let these leaked factoids sway you, especially when they’re juicy and seem blatantly incriminating.

Last week, as Bill Gates was about to begin his depositions in the ongoing investigation of Microsoft’s business practices, the Wall Street Journal ran an analysis piece based on snippets of old emails among Microsoft managers. One such email from David Cole to Brad Silverberg appears especially damning, suggesting that Microsoft deliberately planted logic bombs in its products for the sole purpose of disabling competing products. If true, it's over the top: We're not talking "gray area." This, if true, is just plain wrong.

Come read the details of the Journal report, plus what Microsoft's Steve Ballmer told me when similar allegations cropped up once before. Then tell me if you believe Microsoft deliberately planted logic bombs in its products. If they did, what do you think the remedy should be? Or is all the above just another case of an anti-Microsoft spinmeister using the Wall Street Journal to stir up anti-Microsoft sentiment? Where do you think the truth lies? Join in starting Wednesday at http://www.langa.com/badlink.htm!

• Instead of an error message you get a winder covered with a garbage bag and duct tape.
• OK= ats aww-right
• cancel = hail no
• reset = awa shoot
• yes = shore
• no = Naaaa
• find = hunt-fer it
• go to = ovr yonder
• back = back yonder
• help = help me out here
• stop = ternit off
• start = crank it up
• settings = sittins
• programs = stuff at does stuff
• documents = stuff I done done

Also note that winders 98 does not recognize capital letters or punctuation marks. Some programs that are exclusive to winders 98:

• tiperiter...........A word processor
• colering book.......a Graphics program
• addin mershene......calculator
• outhouse paper......notepad
• jupe-box............CD player
• iner-net............Microsoft Explorer
• pichers.............A graphics viewer
• IRS.................M/S accounting software
• IRS2................M/S accounting software with hidden files
• coon dog............American Kennel Club records
• fishin..............Bass Anglers Sportsman Society records
• NRA.................National Rifle Association
• shot gun............Remington Arms price list
• riffel..............Winchester price list
• pisstel.............Smith & Wesson price list
• truck...............Ford & Chevy Dealers in AL by zip code
• car.................same as truck just need two list in Alabama
• cuzzins.............family history usually a 3 meg file
• tax records.........usually an empty file
• shells..............ammunition inventory another 3 meg file
• bud.................Budwiser distributers by zip code
• doc.................veterinarians by zip code

Whew---that's enough for now! See you next week!

Best,

Fred

(fred@langa.com)

An easier-to read formatted HTML version is available in the "what's new" section of http://www.langa.com. All past LangaList issues are also available via the same link.