From Slashdot...

Microsoft Says, Don't Press the F1 Key In XP

I guess there's a bug in XP that lets a bad guy take over your computer.  They have to send you a dialog box that says something like "Computer error - hit your F1 key".

So Don't hit the F1 key in XP ( especially if your computer tells you to ).  

Ugh.  Well, I've realized a while ago that Windows 7 ( Or Mac or Linux ) has replaced XP ( or should for everybody ), and Microsoft might make it happen faster, even unintentionally, with things like this.  How fast will they fix it?  Will there be some subtle ( or not-so-subtle ) nudges to change?  Maybe it's time to go for a Mac? 

 Apropos of nothing in particular, Did you know there's an expression called The Sony Timer?

Oh I just got a Sony Blue-Ray BDP-460 (w00t!), and an Optoma HD-20 projector (Double W00t!)

Perry

Has Facebook Turned Evil? (OK, it always was)

The ACLU(!) thinks so.  I'm not so sure.  Their new privacy policy opens up a *LOT* of information about the users, and the "privacy wizard" is really hard to understand for privacy experts - what's a normal user to do?

Right now, I'm begging you, review your Facebook privacy settings, including search, log out of facebook, and do a google search of yourself.  And prepare to be shocked.

Here's a good analysis from Jason Calacanis and the ACLU was already writing about their AWFUL privacy policy regarding quizzes (DON'T TAKE QUIZZES ON FACEBOOK!) You're giving out both your own and your friends's information.

Update 3-20-2010: 
From Business Insider - Mark Zuckerberg is a really sleazy guy.  All signs point to the fact that he stole lots of ideas from his classmates and (sorta) employers at Harvard, and bragged about it.  When they sued him, the judge didn't look at all the evidence and still gave them $65 Million.  If that figure is true, that's a lot, but they might get more based on the fact that Zuck hacked their web sites, stole their logins and passwords from Facebook records, etc.  Nice guy, huh?  And everybody keeps their private data with him?  I'm not sure how I feel about that.

Next: Read You Tube is Evil a and Google knew it when they bought them.

Perry

Antivirus Programs are not Perfect

Sounds silly when said this way, huh?  Well, it's true, and its sometimes surprising when people think otherwise.  This means that when you do dangerous things, like go to dangerous-type web sites (gambling, warez, porn), click on suspicious email attachments (even after scanning them), you could get into trouble.

For proof., look at this (safe) link created by Adrien at the from Internet Storm Center.  He analyzed a message that said it was an security message from Facebook notifying customers of a password change.  We all know this never happens, and the attachment contained malware.

The link above, here again, shows multiple virus scanners against the file, and while my favorites (except one) all found it, there were a troubling number who didn't - 20 out of 41 - technically less than half.

This does not mean that you should completely stop clicking on attachments.  Just that you should think, and do a quick risk analysis.  Don't click on every "this is funny" when send by a friend of a friend when it's an attachment, don't click on ANY attachment that's sent by a bank or financial institution unless it's generated by a transaction you made yourself.

Use Mozilla Firefox for browsing,  Use Noscript, stay off bad sites, be internet safe.

Perry

LaLa is a really cool music service

I started using LaLa a couple of weeks ago, and actually bought a bunch of songs.  It was when we saw the Trans-Siberian-Orchestra, and I wanted to get some of their music.  LaLa has lower prices than iTunes for downloads, and wicked cheap web-listen prices - like $.10 per song without download.

This just in - too late - Apple bought them , let's see if iTunes is the Borg and assimilates (kills) them - Oh Well

Perry

Do you have a jailbroken iPhone?

It looks like iPhones that are jailbroken can be accessed by from the internet using ssh with the root password "alpine".

Instructions for changing the password are here. Please change the password now, you don't want your beautiful iPhone to change into a nice, shiny brick.

Perry

UPDATE 12/1/2009

It's not rickrolling now, the newest one actually steals information, like passwords, and changes your ssh password so you have to wipe the phone to remove it.  Luckily it's really easy to tell if there - The battery usage is so high you'll want to wipe the phone anyway.  Lucky the battery isn't replaceable, huh?   Change those passwords, folks.

Facebook Apps are really Insecure (and their creators know it)

The architecture of Facebook apps has some security problems, and according to this article, companies like Zynga (Farmville, Mafiawars) know about it and exploit it.

That means that you, the user take it in the chin ( and wallet ).

The problem is that when you load Facebook apps, they have access to your whole Facebook account, not just the piece they need. The app makers take advantage of this, or least point to people who do. This means extra charges on your credit cards at best, or identity theft at worst.

Moral of the story - be discreet when you load Facebook apps - do you really want to know which Anne Rice Character you are?

I don't. And I don't want to join MyCalendar, so no birthday requests(sorry), etc etc. I'm not sure about groups. Or Lists.

 Facebook is working on it - making your information disclosures selectable - no ETA though, I don't think.

Update 11/14/09 - ValleyWag says that there might be a class action suit in the works.  Zynga is going to have fun defending the "every horrible thing in the book"quote from their CEO, especially when it's on tape (nice touch).  Let's see how that IPO goes, huh?

Oh, another thing:  Do you use Facebook and care about your privacy settings? Are they all set to friends only?  I did a google search for myself (AKA vanity search) and found out my whole friends list was available to everyone.  I hadn't increased privacy on "search settings" - Click here to make those changes to your profile

Perry

Flash is really Evil

A post today on Slashdot describes how Adobe flash basically breaks the security of the Internet.

Unfortunately it's really complicated but the author maintains ( and shows ), that when a server sends an Adobe Flash object to a users browser, that object can execute code that's in a file in the originating domain, regardless of whether the file is a flash object. The executing flash object may not even have to be a flash object, it can be something else, like an image.

This opens up the web to a ton of attacks. Basically, any web site that allows file uploads ( like photo sites ), can only be partially resistant to this of they have a different domain for user uploaded content. So pbase.com would need to move all their files to pbase-img.com, or something similar. Some big sites like Yahoo are already doing this.

That means its bad news because it's really hard for anyone to fix other than Adobe, and the worse news is that Adobe says it's not their problem.

What's a poor user to do?

It's easy for a Security Goon to say:

1. Use Firefox. I already do this, as does my wife and kids. Really.
2. Use the NoScript add-on. I do this, but haven't got my wife or kids started(yet). This prevents flash from most sites, unless manually turned on. (I gotta pay him something). It's brilliant and improves the net experience if only because I haven't seen punch the monkey in years.
3. According to a comment in the above referenced article it's even better if you run the FlashBlock extension. This sounds good but I haven't tried it yet
   

If you insist on running Internet Explorer (bad), the above article mentions something called Toggle Flash which sounds really cool, but I haven't tried it.

Perry