Friday, January 14, 2005

Description of Internet Explorer security zones registry entries

Description of Internet Explorer security zones registry entries:

“This article describes how and where Internet Explorer security zones and privacy settings are stored and managed in the registry. You can use Group Policy or the Microsoft Internet Explorer Administration Kit (IEAK) to set security zones and privacy settings. If you are using Group Policy or IEAK on a Microsoft Windows 2000-based computer, you may have to install several hotfixes to set security zones and privacy settings.


For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 316116 You cannot manage Internet Explorer 6 Group Policies on a Windows 2000-based computer

Microsoft Knowledge Base:182569

http://support.microsoft.com/default.aspx?scid=kb;en-us;182569

Using a Least-Privileged User Account

Using a Least-Privileged User Account:

“Anyone who has been a victim of viruses, worms, and other malicious software (malware) will appreciate the security principle of “least privilege.” If all processes ran with the smallest set of privileges needed to perform the user's tasks, it would be more difficult for malicious and annoying software to infect a machine and propagate to other machines. Today, due to awkward complications that arise when it is employed, least privilege is not in active use on most Microsoft Windows–based systems. However, with the release of the next Windows operating system, codenamed “Longhorn,” almost every user will be able to make regular, daily use of this important security principle.

The Security Principle of Least Privilege

If low-privileged processes are compromised, they will do a lot less damage to a system than high-privileged processes are capable of doing. Consequently, using a non-administrator account instead of an administrator account while completing daily tasks offers the user added protection against infection from a host of malware, external or internal security attacks, accidental or intentional modifications to system setup and configurations, and accidental or intentional access to confidential programs or documents.

Given the obvious security benefits, there is a huge desire, both in home and corporate environments, to run Windows using non-administrator accounts. Unfortunately, almost all Windows users today continue to use an administrator account for their daily tasks. A host of nefarious users and applications rely on being able to use the victim's administrator privileges for such dirty work as destroying or stealing data, reconfiguring another application, or installing a key logger that sends each of the unsuspecting user's keystrokes off to some unknown location on the other side of the Internet.…”

http://www.microsoft.com/technet/security/secnews/articles/lpuseacc.mspx


Running with an administrative account is dangerous to the health of your computer and your data

Running with an administrative account is dangerous to the health of your computer and your data:
Michael Howard
Microsoft Security Engineering
“So, whenever someone says they must operate their computers as administrators, I always try to persuade them it's not the correct thing to do from a security perspective. That said, every once in a while I meet someone who has a valid reason. For example, I use one of the computers in my office to install the latest daily build of Windows, and I need to be an administrator to install the OS. However, and this is a big point, I do not read e-mail, browse the Web, or access the Internet in any form when running as an administrator on that machine. And I do not do so because the Web is the source of most of the nasty attacks today.

What if someone does want to browse the Web? Or read e-mail? Or do Instant Messaging and so on, and for some reason must run in an administrative context? If you look at the major threats to computers, they are from user interaction with the Web through tools like browsers and e-mail clients. Sure, there are non-user interaction attacks, such as Blaster (http://www.cert.org/advisories/CA-2003-20.html) and Lion (http://www.sans.org/y2k/lion.htm), but that's in part why we turned on the firewall in Windows XP SP2!”

Note For Best practices on running as a non-admin, I urge you to look over Aaron Margosis' blog to glean tips on running as a non-admin in Windows.


http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure11152004.asp

OnlineAuction.com Makes Bid for eBay Sellers

OnlineAuction.com Makes Bid for eBay Sellers:

“Tired of high listing fees on eBay? So was Chris Fain. That's why he created OnlineAuction.com, the newest competitor to the online auction giant. The new service was officially launched on Monday.

"We are sure OnlineAuction.com buyers will love the true competitive bidding without the fear of getting sniped. Our sellers will love the billing structure of one low $8monthly fee, with no individual listing or final value fees. Why? Because we know what it is like trying to decipher a listing bill that looks so complex you need a 'New York lawyer' to figure it out," the company claims on its Web site.

Seven years in the making, OnlineAuction.com's selling point is its low all-inclusive monthly fee.

"At OnlineAuction.com, no matter how much you sell or how much you sell it for, the fee is still only $8 a month, period," said Fain, CEO of OnlineAuction.com on Monday during an interview with Car and Driver Radio where he unveiled the new service. "There's no place else you can get worldwide advertising for $96 a year -- not print, not radio and certainly not television."

Fain made a living selling millions of dollars in merchandise on eBay for several years. However, he still paid approximately $20,000 in listing fees, which ate into his profits.

OnlineAuction.com takes aim at what it sees as frustrating and unnecessary flaws in the eBay world. For example, eBay charges sellers a re-listing fee for items that do not sell. OnlineAuction.com does not. In fact, unsold items are automatically re-listed on the site. In addition to listing fees, eBay also takes a percentage of each sale or charges "transaction fees" once an item is bid on, even if the item doesn't sell.

For example, selling a car on eBay would cost $40 for the listing and an additional $40 once a bid is made. On OnlineAuction.com, you still only pay the $8 monthly fee.

OnlineAuction.com also vows never to shut down auctions and restrict verified, legitimate sellers from selling, unlike Ebay, which can shut down a seller's ability to function for more than a week if it thinks the seller is operating in bad faith. eBay has been criticized for being difficult to contact, The company offers no customer service phone numbers and communicates via an automated response system.”


http://www.ecommerce-guide.com/news/news/article.php/3458131

CSS Tooltips - Part One

CSS Tooltips - Part One:
By: John Gallant , Holly Bergevin ,

“This tutorial is meant for those familiar with basic CSS syntax and usage. If this is not you, The following discussion will make more sense after you have studied these articles:

Tooltip Talk

A common part of modern web pages and applications are those handy little text boxes that pop up when some elements are moused over. In web pages these tooltips are usually generated via the title attribute, which can display a small bit of explanatory text for that page element, without otherwise cluttering up the page. This is often quite helpful, but the display of the title attribute is in the hands of the browser, and they all have different ideas about how to handle them, particularly when the text is long enough to need more than one line.

Other than depending on browsers' displays, there is no author accessible mechanism to style these attribute-based "tooltips." There are oodles of JavaScripts that will dynamically create "faux tooltips," but if one wishes to avoid JavaScript, then it's been the boring title attribute "tooltips" or nothing at all. If only there was some way of forcing CSS to style those "tooltips"!

Well, CSS can't actually style browser-based "tooltips," but CSS can create "faux tooltips" much the same as the JavaScript ones, but without all the (possibly) undesirable scripting. There are a few in's and out's involved, but surprisingly, the methods are rather easy to accomplish.”


http://www.communitymx.com/content/article.cfm?cid=4E2C0

Thursday, January 13, 2005

Will Microsoft's monoculture take the 'pod' out of podcasting?

Will Microsoft's monoculture take the 'pod' out of podcasting?:

“Connecting the dots between the current state of podcasting and Microsoft's joint announcements with TiVo coming out of CES last week results in a picture worth viewing by any technologist (enterprise, consumer, vendor, and podcaster).

Podcasting is a marriage of the TiVo concept (though TiVo itself is not involved) to Internet-delivered audio. In broadcaster-speak, TiVo facilitates "time-shifted consumption." As with the VCR, broadcasts get recorded and digital video recorders (DVRs) like the TiVo facilitate the consumption of these broadcasts at your convenience. Originally, consumption of time-shifted broadcasts required the DVR. But, in the case of TiVo, technologies like TiVoToGo that promise to burn those broadcasts onto DVDs will mobilize those time-shifted broadcasts. In the context of podcasting, the DVR experience is vastly superior to that of the VCR for two reasons. First, it greatly simplifies the notion of broadcast subscription because you get to pick the specific programs you want to record as opposed to picking a channel and setting the recording start and end times. From the TV Guide in our DVR, my wife simply finds the listing for Desperate Housewives and presses the record button. Second, the way the DVR digitally records the broadcasts onto a hard drive makes the messy business of VCR tapes a thing of the past.

What's in a name? Why is it called "Podcasting?" The first time that Internet-accessible MP3-based broadcasts turned up on the hard drive of a portable MP3 player -- without a middleman like Audible.com -- was with Apple's iPod. As a recent press release from the WNYC affiliate of cost-conscious National Public Radio put it, "Distinct from fee-based services like audible.com, podcasts are free and can be saved to iPods (hence, the name) or any other MP3 player." WNYC announced that NPR's On the Media is being made available as a podcast.

It is primarily two technologies that made podcasting possible. First, an AppleScript written by ex-MTV video jockey-cum podcasting poster child Adam Curry whisked an audio file off the Internet and into an iPod. The second was the RSS protocol, which, under the stewardship of Dave Winer, is not only what facilitates the ability to subscribe to a specific podcaster's program (much the same way you can subscribe to blogs or ZDNet's news feeds), but also supports the notion of enclosures. As can be seen from one of Winer's very recent postings, the work of incorporating enclosures into RSS feeds is far from over.

With a blog authoring platform like Userland's Radio that gives users a way to attach an audio file's URI to a blog entry as though it were an enclosure, the resulting RSS feed goes out with an enclosure field that can be parsed by an enclosure-aware RSS client like iPodder (an open-source successor to Curry's AppleScript that's the result of a collaboration between Winer and Curry). The audio file itself is not part of the feed. Only its URI is. What this means for the producers of podcasts is that they still must find a Web accessible host like the storage locker that AOL is testing to store their audio files -- which can be sizeable. Our first podcast was 22.6 MB and Curry's files routinely run in the 15- to 20MB range. As an enclosure-aware client, iPodder knows exactly what to do when it encounters the URI to an audio file in a blog entry's enclosure field. As an aside, enclosure-aware blog hosts (like Userland's Radio) will also know what to do with the enclosure. As can be seen from ZDNet's podcast test center, any blog entry that has an audio file enclosure with it also gets an icon (resembling a bullhorn) that is linked directly to the audio file.

Now that TiVo-like time-shifted consumption of the "audio Web" is built, will content authors and consumers come? They're already here. Hundreds if not thousands of podcasters are producing content and, as exemplified by WNYC's announcement, more are coming on-line every day. According to Release 1.0 (a CNET Networks sister outfit to ZDNet), Googling the term "podcast" yielded 300 search results in October 2004. Already, in early January 2005, that number is up to 1 million (having climbed by 150,000 results in just one week). By all accounts, the podosphere appears destined for a presence in digirati culture comparable to the blogosphere.

But, as also indicated by WNYC's press release, despite the art still being referred to as podcasting, Apple's iPod is no longer the only last stop for the circuitous route that a podcast travels before it gets consumed. The software has evolved to the point that podcasts are easily consumed by other MP3 players as well, and through other synchronization conduits such as Windows Media Player.

Such evolution was only natural. (Microsoft did nothing to make that happen.) However, Apple failed to seize the natural advantage that was gifted to it by Adam Curry when his first AppleScript changed the course of the audio Web. Had I been Steve Jobs, I would have marshaled every engineer needed to produce the GarageBand equivalent of a podcast authoring tool for the Mac and to turn the iPod into the ultimate podcast endpoint. Not only would I make them capable of reading the Outline Processor Markup Language-based (OPML) outlines that podcasters are using to describe the content (known as "shownotes") within their podcasts (for example, this outline for one of Adam Curry's podcasts) , but I'd also make them capable of managing podcast subscriptions without the need for a middleman like iPodder. At the very least, I'd fund the open source iPodder project, try to take on Dave Winer and Adam Curry as consultants (not that they'd accept), and build all of the functionality of iPodder into iTunes (turning iTunes into an enclosure-aware RSS client).

Recipes for creating podcasts with the Mac and Windows get the job done, but they basically involve a handful of technologies that must be alligator-clipped together.

Not only doesn't Apple seem interested in greasing the wheels of the podosphere, it doesn't appear interested in what big content publishers like ZDNet would like to see happen. So far, I've received no response from Apple to an e-mail inquiry regarding ideas for how podcast authoring and consumption (on the Mac platforms) could be vastly improved.… ”



http://news.zdnet.com/2100-9588_22-5519810.html?tag=nl.e539

Gmail Bug Exposes E-mails to Hackers

Gmail Bug Exposes E-mails to Hackers :
“UNIX developers HBX Networks have stumbled upon a bug within Google's Gmail that allows access to other users' personal e-mails.

By altering the "From" address field of an e-mail sent to the service, hackers could potentially find out a user's personal information, including passwords.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field.

The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

Quick to respond, Google acknowledged the problem late Wednesday and has since corrected the problem for all users, a company source said.

At first glance, to the average user the e-mail would appear normal. But by clicking "show options" within the Gmail interface, the "Reply-To" field will show HTML code that is actually a formatted version of another user's e-mail, HBX wrote on its Web site.

HBX said that they think a missing character is tripping up Gmail and causing it to print whatever is in its cache, or memory, into the Reply-To field. The group did say much of what they saw was spam. However, what troubled them was in at least one case they were able to see a user's password.

“Regardless of the specific failure, the result is a compromise of the privacy of communications over Gmail,” the organization said. “Usually, this only permits an attacker to examine recently-arrived spam in random user's inboxes - but message content does occasionally become more interesting.””


http://www.betanews.com/article/Gmail_Bug_Exposes_Emails_to_Hackers/1105561408

http://www.eweek.com/article2/0,1759,1750785,00.asp?kc=ewnws011305dtx1k0000599

Red Hat, SuSE release Linux patches

Red Hat, SuSE release Linux patches:
“Linux vendors Red Hat, Novell and Mandrakesoft on Wednesday released patches for several vulnerabilities, ranging from flaws that could allow denial-of-service attacks to buffer overflows.

Five of the updates released were rated "highly critical" on Thursday by security information company Secunia. Red Hat released three of the updates, Novell's SuSE one and Mandrakesoft one.

SuSE issued updates to resolve flaws including a vulnerability that could allow malicious code to cause a local denial-of-service attack using a specially created Acrobat document. The vulnerabilities would affect most SuSE Linux-based products.

Another vulnerability in the Linux system components used to route network traffic could allow a malicious person to execute a local denial-of-service attack by inserting erroneous information into the netfilter data stream, according to SuSE.

Red Hat, meanwhile, issued a package of updates for its desktop, enterprise and advanced-workstation software.

An updated libtiff package was released to address vulnerabilities involving various integer overflows. The vulnerabilities would enable an attacker who has tricked a user into opening a malicious image file in the TIFF format to make a libtiff-related application crash or have the potential to compromise the computer with arbitrary code.

Red Hat also released updates for Xpdf packages to address a vulnerability to a potential buffer overflow. Xpdf is a stand-alone application for reading Portable Document Format documents and is also used by many Linux programs to process PDF files. This vulnerability could enable an attacker to create a PDF file that would crash Xpdf and possibility execute arbitrary code when opened, according to Red Hat's update.

Red Hat also released multiple patches to resolve flaws in its Xpm library. The XPixMap (XPM) format enables color images to be stored in an easily portable file.

Several stack overflow flaws and an integer overflow vulnerability were found in the libXpm library, which, in turn, is used to decode XPM images. If an attacker creates an XPM file that causes an application to crash, a computer system could be compromised.

Mandrakesoft also released an update for Imlib, a standard set of code used by older versions of the GNOME desktop to process graphics.”

http://news.zdnet.com/2100-1009_22-5535228.html?tag=nl.e589

Hackers Tune In to Windows Media Player

Hackers Tune In to Windows Media Player :

“Hackers are using the newest DRM technology in Microsoft's Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users.

Security researchers have detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, in video files circulating on P2P (peer-to-peer) networks.

According to Panda Software, both Trojans take advantage of the new Windows anti-piracy technology to trick users into downloading spyware and adware applications.

"When a user tries to play a protected Windows media file, this technology demands a valid license. If the license is not stored on the computer, the application will look for it on the Internet, so that the user can acquire it directly or buy it," Panda Software explained.

An unsuspecting user attempting to download the DRM (digital rights management) license will instead be redirected to a Web site that loads a large quantity of adware, spyware, modem dialers and other viruses, the company said in an advisory.

"It's pretty ingenious," said Patrick Hinojasa, chief technical officer at Panda Software. "To take an anti-piracy feature and use it to feed spyware is extremely ironic."

"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys," he said.

Even though these Trojans have been detected in video files on P2P networks such as Kazaa or eMule, Hinojasa warned that these files can be distributed via e-mail, FTP or other Internet download avenues.”


http://www.eweek.com/article2/0,1759,1749948,00.asp


Monday, January 10, 2005

High-Risk Flaws Flagged in IE, Mozilla

High-Risk Flaws Flagged in IE, Mozilla :
“Security researchers have raised the alarm for a series of unrelated, high-risk vulnerabilities in Microsoft Corp.'s Internet Explorer and the open-source Mozilla browsers.

According to a Secunia advisory, the most serious IE flaw could be exploited by a malicious hacker to hijack a vulnerable machine, conduct cross-site/zone scripting and bypass a security feature in Microsoft Windows XP SP2.

For its part, Microsoft has confirmed it is investigating a "Click and Scroll" issue in IE and has posted a temporary workaround to protect users from the flaw.

In a Knowledge Base article, the software company said the bug could make it possible for an attacker to put a malicious file on a PC if a user visits a Web site.

Microsoft recommends that users install the most recent cumulative fix for IE and disable the "drag-and-drop" or "copy-and-paste files" option across a domain.

Another unpatched IE flaw could allow an embedded HTML Help control on a malicious Web site to execute local HTML documents or inject arbitrary script code.

A third vulnerability exists in the handling of the "Related Topics" command in an embedded HTML Help control. Secunia said this bug can be exploited to launch harmful script code in the context of arbitrary sites or zones.

Secunia has posted a vulnerability test online to demonstrate the flaws.

The updated IE warning comes on the heels of a Bugtraq advisory for multiple flaws in Mozilla, Firefox and Thunderbird products.

The Mozilla Foundation has rolled out new versions to patch the holes, which range from a potential buffer overflow and temporary files disclosure to anti-spoofing issues.

According to the advisory, a potentially exploitable buffer overflow was discovered in the way Mozilla and Firefox handle NNTP URLs.

Also fixed is a way of spoofing filenames in the "What should Firefox do with this file" dialog-box option.

"A remote attacker could craft a malicious NNTP link and entice a user to click it, potentially resulting in the execution of arbitrary code with the rights of the user running the browser," the advisory read.”


http://www.eweek.com/article2/0,1759,1749293,00.asp?kc=ewnws011005dtx1k0000599


Saturday, January 08, 2005

Microsoft to Serve Up Monthly Virus Zapper :
“Microsoft Corp. on Thursday said it plans to release a virus detection and removal tool on Jan. 11. The antivirus fighter will be updated on the second Tuesday of every month as part of the company's scheduled software patching cycle.

Meanwhile, exactly three weeks after acquiring anti-spyware startup Giant Company, Redmond released the first public beta as a free Windows download through July 31.

Redmond also plans to release a virus detection and removal tool on Jan. 11, which will be updated on the second Tuesday of every month as part of the company's scheduled software patching cycle.

As previously reported, the spyware zapper is an exact replica of the Giant Company application acquired late last year.

Microsoft has retained all of the key Giant AntiSpyware features, including RealTime Detection, AutoUpdater, Spyware Scan and the widely hailed SpyNet Community network, which provides an early-warning mechanism.

Microsoft officials declined to discuss what happens after the beta expires in July, but analysts expect the company to start charging for definition updates once the spyware detection and removal tool goes gold.

The addition of a worm zapper to the monthly Patch Day schedule is a change from the previous policy of releasing individual removal tools after a major virus outbreak.

Using expertise and technology acquired from anti-virus vendor GeCAD, Microsoft's malicious software removal tools will consolidate previously released tools for the Blaster, MyDoom and Download.Ject attacks.”

http://www.eweek.com/article2/0,1759,1748869,00.asp


Three unpatched flaws in Internet Explorer

Three unpatched flaws in Internet Explorer:

“Secunia said Friday that it had raised its rating of the vulnerabilities in Microsoft's browser to "extremely critical," its highest rating. The flaws, which affect IE 6, could enable attackers to place and execute programs such as spyware and pornography dialers on victims' computers without their knowledge, said Thomas Kristensen, Secunia's chief technology officer.

Exploit code for one of the vulnerabilities, a flaw in an HTML Help control, was published on the Internet on Dec. 21 in an advisory by GreyHats Security Group.

"In order for us to rate a vulnerability as extremely critical, there has to be a working exploit out there and one that doesn't require user interaction," Kristensen said. "This is our highest rating and is the last warning for users to fix their systems."

The exploit code can be used to attack computers running Windows XP even if Microsoft's Service Pack 2 patch has been installed, Secunia said. The company is advising people to disable IE's Active X support as a preventative measure, until Microsoft develops a patch for the problem. It also suggests using another browser product.

The Secunia advisory also warns of another HTML Help control vulnerability that, when used in combination with a drag-and-drop flaw, could be used to attack PCs--though in that case, it would have to be with the interaction of the victim. The company first issued an alert about the three security holes in October.”

Microsoft said it was investigating the public reports of the exploit, adding that the delay in fixing the IE patch was related to the extensive work needed to produce an effective patch.

The company is advising people to check its safe browsing guidelines and to set their Internet security zone settings to "high." It also suggests that people continue installing automatic security updates from Service Pack 2.

Secunia also offers users the ability to conduct an online test of their systems to see if they are vulnerable.

http://dw.com.com/redir?destUrl=http%3A%2F%2Fsecunia.com%2Finternet_explorer_command_execution_vulnerability_test%2F&siteId=22&oId=2100-1009-5517457&ontId=1009&lop=nl.ex

http://news.zdnet.com/2100-1009_22-5517457.html?tag=nl.e589

Wednesday, January 05, 2005

CSS Crib Sheet

CSS Crib Sheet:

“You will no doubt come across many quirky layout issues when building a site with CSS. You'll end up banging your head against a wall time and again. This is an attempt to make the design process easier, and provide a quick reference to check when you run into trouble.”

Translations are available in Français, Deutsch, Italiano, Magyar, Finnish, Norwegian, Russian, Portuguese, Japanese and Simplified Chinese.

CSS Problem-Solving http://www.mezzoblue.com/archives/2004/03/10/css_problems/index.php

http://www.mezzoblue.com/css/cribsheet/

Tuesday, January 04, 2005

Firefox has much to learn

Firefox has much to learn:
by George Ou

“It is widely asserted as "fact" that Firefox is more secure, but does that assertion really hold up under intense scrutiny? Peter Torr of Microsoft doesn’t seem to think so. I can hear the howling now to the effect of "but the guy is just a Microsoft lackey on Bill Gate’s payroll". While it is certainly true that he works for Microsoft and is clearly giving a point of view favorable to Microsoft, no one can deny any of the serious criticisms that he lays on Firefox. Here is a list of Peter’s grievances that show a pretty flagrant disregard for the most basic of security principles.”

  • Installing Firefox requires downloading an unsigned binary from a random web server
  • Installing unsigned extensions is the default action in the Extensions dialog
  • There is no way to check the signature on downloaded program files
  • There is no obvious way to turn off plug-ins once they are installed
  • There is an easy way to bypass the "This might be a virus" dialog

Since the initial posting and much "fanfare" from Slashdot, someone pointed how you can turn off plug-ins so Peter has since then conceded the fourth point. While there has been a huge firestorm of responses on the other points, I haven’t heard any acceptable explanations on any of the other four points that Peter has raised. The most serious issue is the first where Firefox might even send you to a raw IP address link (the favorite tactic of phishers) to download unsigned code.


http://blogs.zdnet.com/Ou/index.php?p=22&tag=nl.e539

Podcasting: Evolution or Revolution?

Podcasting: Evolution or Revolution?:
“Podcasting is getting all kinds of press. The buzz generated from this so-called phenomenon harkens back to the pre-2000 Internet, when the next big thing solved problems yet to be realized by the people in need of the solution. Is podcasting to iPods really what Tivo is to television? .”

Jake Ludington explores
  1. Podcast Basics
  2. How Do I Subscribe to a Podcast?
  3. Podcasting and Windows Media Player
  4. Join the Podcast Revolution

http://www.informit.com/articles/article.asp?p=360067

The Basics of Cascading Style Sheets

The Basics of Cascading Style Sheets:
“CSS, if used correctly, can greatly extend your ability to create attractive Web designs. Learn how you can use styles to enhance your Dreamweaver MX 2004 web page. ”

In this article
  • A Brief Introduction to Styles
  • Designing with CSS
  • Style Properties
  • Working with CSS Styles
  • Editing CSS in Code View

The cascading style sheets (CSS) language is a way to describe the appearance of Web pages by assigning styles to specific HTML tags and portions of the page. These styles allow a designer greater range of presentational effects than can be achieved by using only HTML styles. Dreamweaver MX 2004 makes it easy to edit and apply style sheets to new or existing Web documents.

If you're already familiar with CSS, you can skip over the following introduction and go directly to "Designing with CSS" to use Dreamweaver MX 2004 to build Web pages using styles.


http://www.informit.com/articles/article.asp?p=355339

Thursday, December 30, 2004

Download boot disks for all your needs from these Web sites

Download boot disks for all your needs from these Web sites:
“You no longer have to create your own boot disks--others have done the work for you and uploaded their files to the Internet.

Why create a custom boot disk yourself when you can download one quickly and hassle free from a Web site? Many Web sites offer downloadable programs for creating custom boot disks, but of course, some are better than others in terms of their content and page layout. A quick look at some of the most popular of these sites will help you decide where you can find the best one-stop shop for your boot disk needs.”

Free Registration

http://techrepublic.com.com/5102-6270-5034303.html

How Does Google Figure out What Pages are More Relevant? Pagerank

How Does Google Figure out What Pages are More Relevant? Pagerank:

“A core question for anyone on the Web, and certainly a question you should be asking if you're trying to monetize your Web site, is how the heck does Google figure out what sites are more relevant to a given search than others?

Dave Taylor helps you understand Pagerank, a critical first step in increasing the visibility of your website in Google searches.”

http://www.informit.com/articles/article.asp?p=360068

Clean HTML from Word: Can It Be Done?

Clean HTML from Word: Can It Be Done?:
“Laurie Rowell's short answer to the question above: Yes, with a bit of effort. With a number of utilities available at relatively low cost, you can finagle Microsoft Word's output to something that resembles clean HTML. You might need to roll up your sleeves and dig around in the code or the formatting (depending on the application you choose), but you should end up with something you can put on the web without shame.”

Free membership available

http://www.informit.com/articles/article.asp?p=359433

Thursday, December 23, 2004

Browsers as test platforms

Browsers as test platforms:
“Browsers from a developer's point of view. When developing for the web, it is inevitable that we need to debug and test our work. How easy or how hard is it to find the problems causing errors and how easy is it to replicate certain environment changes? Once we identified the steps we need to take to test properly, we will see if there is a chance to extend the browser to make these steps a lot easier.”

The development environment is an PC running Windows XP, in this case a IBM Thinkpad T40 with 1GB of Ram and a Centrino 1300MHz processor.

We will take a look at Microsoft Internet Explorer 6, Mozilla Firefox 1.0 preview release and Opera 7.50.

For testing, we will use a web site template with some HTML errors and a Javascript error.

What we want to test is:

  • Why is the Javascript not working (i.e. why is the menu not collapsing)?
  • Why is the site not being displayed correctly?
  • Why does the form not get sent off?
  • How does the design behave with different font sizes?
  • How does the page work without CSS, or Javascript or images?

Debugging the HTML

We will check how comfortable the source view is in the browser, and if it provides us with extra tools to check the HTML structure.

Debugging the Javascript

We will test how easy it is to trace back Javascript errors. Does the browser tell us the error? How easy is it to see the error messages?

Debugging the CSS

When using CSS seriously, we need to avoid Quirksmode at all costs. Quirksmode is a feature that was added into modern browsers to ensure backward compatibility and forces it to render pages like its predecessor. This makes it nearly impossible to predict the outcome, and forces us to keep developing for the past rather than for the future. We can force browsers to render web sites properly - in standards mode - by giving them the correct DOCTYPE [1]. To see what went wrong with our CSS, we need to find out whether the browser renders in Quirksmode or not.

Testing the accessibility of our page

To test how accessible our page is, we can take a quick look to see how it renders without CSS, Javascript or any of them. Furthermore, we want to resize the font of the browser to check if that breaks our design.


http://icant.co.uk/forreview/browsertests/

Wednesday, December 22, 2004

Windows Security Updates Summary for December 2004

Windows Security Updates Summary for December 2004:

“The Microsoft Windows security updates for December 2004 include several important updates and a critical cumulative update for Microsoft Internet Explorer 6 Service Pack 1 (SP1), a component of Windows. If you have any of the software listed on this page installed on your computer, you should visit the Windows Update Web site to install related updates.

Supported software affected
  • Internet Explorer 6 SP1 on Windows 2000 SP3, Windows 2000 SP4, or Windows XP SP1
  • Internet Explorer 6 SP1 on Windows NT Server 4.0 SP6a; Windows NT Server 4.0, Terminal Service Edition SP6; Windows 98; Windows 98 SE; or Windows Me
  • Internet Explorer 6 for Windows XP 64-Bit Edition SP1

Note Updates for Windows Millennium Edition, Windows 98, and Windows 98 Second Edition are being made available under extended support for critical security issues.”


http://www.microsoft.com/security/bulletins/200412_windows.mspx

Net worm using Google to spread

Net worm using Google to spread:

“A Web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday.

The Santy worm uses a flaw in the widely used community forum software known as the PHP Bulletin Board (phpBB) to spread, according to updated analyses. The worm searches Google for sites using a vulnerable version of the software, antivirus firm Kaspersky said in a statement.

Almost 40,000 sites may have already been infected. Using Microsoft's Search engine to scan for the phrase "NeverEverNoSanity"--part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits.

"Santy.a is spreading rapidly," antivirus firm Kaspersky stated in a new release published Tuesday. "However, this does not directly affect users. Although the worm infects Web sites, it does not infect computers used to view those sites."

The worm sends Google a specific search request, essentially asking for a list of vulnerable sites. Armed with the list, the worm then attempts to spread to those sites using a PHP request designed to exploit the phpBB bulletin board software.

The worm is the latest twist on using Google as an attack tool, a practice known as Google hacking. It may also be the first time a program used Google to identify victims for an attack.…”


http://news.zdnet.com/2100-1009_22-5499725.html

Tuesday, December 21, 2004

Producing a High-Definition Windows Media Video File

Producing a High-Definition Windows Media Video File:
“This document provides information about creating high-definition Microsoft Windows Media Video files. Topics covered include an overview of the content creation process, a list of acceptable video sources, information about the capturing and encoding processes, and system requirements for encoding and playing a high-definition Windows Media Video file.

By using Microsoft Windows Media Encoder 9 Series, you can create high-definition Windows Media Video files in the high-definition television (HDTV) standard formats, such as 1280 x 720 progressive (720p), 1920 x 1080 interlaced (1080i), or 1920 x 1080 progressive at 23.976 fps (1080Psf). The process of creating a high-definition Windows Media Video file consists of the following steps:
  1. Capture the content from a high-definition source.
  2. Edit the content (optional).
  3. Convert the content to an .avi file.
  4. Encode the content.

Note that you can use software, such as Sonic Foundry Vegas or Discreet CleanerXL, to combine the four steps into a single step. For more information about these programs, see the Sonic Foundry Web site http://go.microsoft.com/fwlink/?LinkId=14986 or the Discreet Web site http://go.microsoft.com/fwlink/?LinkId=15004.”

http://www.microsoft.com/windows/windowsmedia/
howto/articles/ProducingHDVideo.aspx

Monday, December 20, 2004

Web Design: A Decade Under the Influence

Web Design: A Decade Under the Influence:

“Full streaming video feeds of some of most noteworthy sessions at this month's Web Design World 2004 have been published for your education and entertainment.

Keynotes from Jeffrey Zeldman and Kelly Goto are joined by sessions on rich media web apps (Tom Green), defensive web design (37signal's Jason Fried), as well as sessions on accessibility, XML and more.”


http://www.ftponline.com/reports/wdwboston/2004/




Crop Images Contextually

Crop Images Contextually:

“Cropping and resizing your images for the Web is a common technique for creating smaller thumbnail images that download quickly. However, we've seen many sites that either use HTML's width and height attributes to resize larger images, or minimally crop and resize their images to lose vital information (see Figure 1). A better way to create images optimized for the Web is to crop them contextually.”

What is cropping contextually? Many times digital images shot for Web use have a border of useless space around the object(s) of interest. Rather than crop to just the film or chip's border, crop contextually down to the minimum dimensions that still convey the meaning or context of your image…

http://www.websiteoptimization.com/speed/tweak/crop/

Saturday, December 18, 2004

The Podcast.net Directory

The Podcast.net Directory:
“Podcast.net is a directory of RSS feeds that feature podcasts sorted by category. Like Yahoo, but for podcasts.”

http://www.podcaster.net/

Friday, December 17, 2004

Build Your Own Windows Media Center PC

Build Your Own Windows Media Center PC :
“In the past year, a number of interesting, pre-configured "media PCs" have arrived on the scene. The boutique PC makers, such as VoodooPC with its Voodoo Vibe and Alienware's DHS series, offer examples of the craft. But even mainstream PC manufacturers have jumped on the bandwagon—Sony with its VAIO RA-810G and HP with its Digital Entertainment Center.

All of them are certainly fine products in their own right, but it seemed to us that we could build something equivalent, or maybe even a little better. At the top of our list was the ability to seamlessly integrate this rig into our home-theater system. Secondarily, it had to look like it belonged in a rack with A/V components. Finally, the system had to support HDTV viewing and recording.… ”


http://www.extremetech.com/article2/0,1558,1742236,00.asp

E-Card Holiday Virus Packs Ugly Punch

E-Card Holiday Virus Packs Ugly Punch:
“A new virus strain masquerading as electronic Christmas cards is accounting for one in every 10 e-mails hitting in-boxes, security experts warned Wednesday.

The W32/Zafi-D worm, which originated in Hungary, is using mass-mailing and P2P (peer-to-peer) techniques to squirm through in-boxes and slow network traffic to a crawl.

The worm, which poses as a Christmas greeting, has the ability to replicate in as many as 19 languages, which makes it a "very serious threat" to computer users worldwide, said Graham Cluley, a senior technology consultant at Sophos Inc.

Cluley told eWEEK.com the Zafi-D mutant accounts for 75 percent of all virus reports at coming into the company's monitoring stations in the past 24 hours.

A spokeswoman for e-mail security services firm MessageLabs said the company had intercepted more than 1 million copies of Zafi-D since it first started squirming Tuesday.…”

According to a Sophos advisory, the worm arrives with the subject line "Merry Christmas," "Buon Natale!" or "Joyeux Noel!," depending on the location of the recipient.

The body of the e-mail contains a "Happy Hollydays" greeting in green text with a yellow emoticon. The virus arrives as an attachment with the following extensions: ZIP, CMD, PIF, BAT or COM.

Once executed, Zafi-D copies itself to the Windows system folder with the filename "Norton Update.exe." It then creates a number of files in the Windows system folder with filenames consisting of eight random characters and a DLL extension.…


http://www.eweek.com/article2/0,1759,1742085,00.asp

Thursday, December 16, 2004

How to identity SIMMs

How to identity SIMMs:
You’ve found some old SIMMs in a desk drawer or extracted them from an unwanted PC. Are they fit only for the bin, or are they suitable for use in a user’s PC? Guy Clapperton shows how to find out.

http://www.techsupportalert.com/search/h0831.pdf

http://64.233.167.104/search?q=cache:wM4uSCKnGdsJ:www.techsupportalert.com/search/h0831.pdf identify 72 pin SIMM&hl=en

Tuesday, December 14, 2004

WindowsXP-Drivers.com

WindowsXP-Drivers.com:
“This site maintains listings of windows xp driver files available on the web, organized by company.”

Looking for hardware device drivers for XP can really be a problem if you have a computer that came with a different operating system and now you're upgrading to XP. Here's one of the largest sources of XP drivers.

http://www.windowsxp-drivers.com/

Monday, December 13, 2004

Browser injection flaws affect multiple browsers and platforms

Browser injection flaws affect multiple browsers and platforms:
Two newly-revealed Web browser vulnerabilities, a window-injection flaw and a frame-injection flaw, could allow attackers to steal sensitive information. Unfortunately, IT pros will have a hard time mitigating the threats.

Secunia Research has announced a newly discovered a window-injection vulnerability that can let attackers inject information into an open browser window. The most important concern is that this vulnerability can be used to spoof secure sites.

This is especially dangerous because it doesn't just affect Microsoft's Internet Explorer (CAN-2004-1155), but also KDE Konqueror (CAN-2004-1158), Opera (CAN-2004-1157), Mozilla FireFox (CAN-2004-1156), and even Apple Safari (CAN-2004-1122). Those are the links to SecurityTracker.com reports.

Some initial reports caused confusion over which browsers are affected and whether there is more than one very similar threat, but there are definitely two different vulnerabilities that pose similar dangers.

Making things more difficult for IT professionals, there was also a similar-sounding frame-injection vulnerability reported in June 2004. As a result, some IT pros may think they have already addressed this new threat. Secunia Research reported that the frame-injection vulnerability also affects most brands and versions of Internet browsers. That earlier vulnerability also allows a remote attacker to cause the browser window to display arbitrary content and can therefore be used to spoof sites.

Secunia lists different Mitre vulnerability codes for the frame-injection threat in addition to those listed above and this was a different vulnerability. The following links relate to the earlier frame-injection vulnerability, which has similar dangers: Internet Explorer (CAN-2004-0719); Opera (CAN-2004-0717); Mozilla, FireFox, and Netscape (CAN-2004-0718); Safari (CAN-2004-0720); and KDE Konquerer (CAN-2004-0721).

Secunia has made available a demonstration site to help you determine if your browser version is vulnerable. Go here for the test and more details about the new threat.”


From TechRepublic — free membership
http://techrepublic.com.com/5100-6264_11-5487760.html?tag=fdnew

Friday, December 10, 2004

Most Browsers Buggy

Most Browsers Buggy:
A European security vendor warned Wednesday that most browsers sport a bug that hackers can exploit to spoof a Web site and trick users into trusting bogus pop-up windows.

The vulnerability, which Danish security firm Secunia rated as "moderately critical" is similar to previous bugs in browsers that was disclosed in July and September of 2004. Attackers could use it to add content into a trusted Web site's window by, for instance, inserting a fake form in a pop-up window seemingly opened by that site.

Affected browsers, said Secunia, include the popular Internet Explorer and the up-and-coming Firefox, as well as third-tier alternatives like Mozilla, Opera, Apple's Safari, and the open-source Konqueror.

IE 5.01, 5.5, and 6.x are vulnerable, claimed Secunia, and the "vulnerability has been confirmed on a fully patched system with Microsoft Windows XP SP1/SP2."

Secunia has posted a test that users can run to determine if their browser's got the bug”

http://www.crn.com/sections/breakingnews/dailyarchives.jhtml?articleId=55300447

Laptop Use Can Damage Male Fertility

Laptop Use Can Damage Male Fertility

http://www.eweek.com/article2/0,1759,1738419,00.asp?kc=ewnws121004dtx1k0000599

Microsoft Security Bulletin Advance Notification

Microsoft Security Bulletin Advance Notification:

“On December 14, 2004 the Microsoft Security Response Center is planning to release:

5 Microsoft Security Bulletins affecting Microsoft Windows

The greatest maximum severity rating for these security updates is Important

Some of these security updates may require a restart

No additional details about bulletin severities or vulnerabilities will be made available until December 14 , 2004.”


http://www.microsoft.com/technet/security/bulletin/advance.mspx

Thursday, December 09, 2004

Using the Windows Firewall INF File in Microsoft Windows XP Service Pack 2

Using the Windows Firewall INF File in Microsoft Windows XP Service Pack 2:
“Microsoft Windows XP Service Pack 2 (SP2) includes the Windows Firewall, a replacement for the Internet Connection Firewall component in previous versions of Windows XP. Windows Firewall is a stateful host firewall that discards unsolicited incoming traffic, providing a level of protection for computers against malicious users or programs. To provide better protection for computers connected to any kind of network (such as the Internet, a home network, or an organization network), Windows XP SP2 enables Windows Firewall on all network connections by default. Network administrators can use the Windows Firewall INF file (Netfw.inf) to modify default settings either before installation or after installation. This article describes the usage of the Windows Firewall INF file.”

System Requirements

  • Supported Operating Systems: Windows XP

Microsoft Word

File Name:

WFINF_Guide.doc

Download Size:

109 KB

Date Published:

11/16/2004

Version:

1.4


http://www.microsoft.com/downloads/details.aspx?familyid=cb307a1d-2f97-4e63-a581-bf25685b4c43&displaylang=en

Wednesday, December 08, 2004

The Hidden Risks of Demo Discs

The Hidden Risks of Demo Discs :
“In mid-November, members of Sony's PlayStation Underground received the Holiday Demo Disc and discovered that after executing one of the game demos on the disc, their PS2 memory cards were completely erased. While that doesn't mean much to nongamers, for anyone who has spent 40-plus hours building a character in a role-playing game or playing through a season of football—well, it's a huge boot in the trousers.

The sampler disc was sent via mail to members of the PlayStation Underground, an opt-in promotional group that Sony calls a ‘personal link to all the insider info from the PlayStation world.’”

There's more to the story than a handful of gamers losing their saved game files. The implications of such a glitch can be huge, especially as consumers start to set up networked computing systems in their homes, complete with routers, networks and servers. Minus cubicles and a water cooler, it's the equivalent of a small enterprise network.

Rick Fleming, chief technology officer at Digital Defense Inc., said that although most consumers don't realize it, game consoles are computers that run off their own proprietary operating systems. As a result, a bug in a demo CD, CD-ROM or DVD-ROM could affect the rest of a home network and spread to an enterprise network through a VPN connection or portable storage devices.

"PlayStation and Xbox are being networked with home computers … so I can easily see how something like that would spread across a network," Fleming said. "Every time you connect to something else, there's another opportunity for something to go wrong."


http://www.eweek.com/article2/0,1759,1735609,00.asp?rsDis=The_Hidden_Risks_of_Demo_Discs-Page001-140370

Java stir puts Sun in a spot

Java stir puts Sun in a spot:

“A flaw in Sun Microsystems' Java software has highlighted the difficulty the company faces as flocks of tech novices start to turn to it for support.

Sun disclosed a serious security flaw in its Java virtual machine (JVM) software last month. The rare problem, which affects Sun's plug-in for running Java on a variety of Web browsers and operating systems, could allow a virus to spread through PCs running both Microsoft Windows and Linux.

A flaw-free version of the JVM software is available on Sun's Web site, and the company is encouraging people to swap it out. But some users of the Firefox Web browser who attempted to download the new software received a version that contained the vulnerability, Sun representatives told CNET News.com.

On Tuesday, Sun was in the process of updating the download pages on Java.com and its download site to fix that problem, having previously said it would make the change on Dec. 13.

Sun said the mix-up in support arose because it had not had a chance to update the download features for Firefox. It also said that it first concentrated on developing a patch for the more pervasive browsers--Microsoft's Internet Explorer, Netscape and Mozilla.…”


http://news.zdnet.com/2100-9593_22-5482023.html

Monday, December 06, 2004

Colly's CSS rollover generator

Colly's CSS rollover generator:
“By removing the advanced fields, you can simply create a standard "sliding doors" rollover, or use the extra fields to create an advanced rollover with background and text elements. The CSS produced is lean and clean”

http://www.collylogic.com/index.php?/weblog/comments/
collys_advanced_css_rollover_generator/

The Ten Commandments of Keyword Selection

The Ten Commandments of Keyword Selection :
“Is your website getting a lot of traffic, but not a lot of sales? Maybe you need to take a look at the keywords you're using. Praveen Viswanath walks you through keyword selection process, and sums it up with ten keyword selection commandments to help keep you on track.

A term or a phrase used by a searcher to find information on a particular topic is called a "keyword." "Keyword selection" is the process of scrutinizing different prospective keywords to select the right ones for your campaign. It is the stepping stone to your success in the Web world. Find the right keyword, and you strike gold. Make a mistake, and you've just punched yourself in the face.

There are two categories of people interested in keyword selection: those trying to get more website traffic in general, and those trying to get more ‘qualified’ traffic. This article is for the latter type. What is the use, if you have some 10,000 hits a day but the business conversion is just 0.1%? Wouldn't it be better to have only 1000 visitors with a 30% conversion rate? After all, 300 is better than 10. From here on, whatever we do, our final aim shall be to get more "qualified" traffic.”



The Ten Commandments
http://www.seochat.com/c/a/Choosing-Keywords-Help/The-Ten-Commandments-of-Keyword-Selection/3/

http://www.seochat.com/c/a/Choosing-Keywords-Help/The-Ten-Commandments-of-Keyword-Selection/

Thursday, December 02, 2004

Semantic (X)HTML Markup: Using Tables Appropriately

Semantic (X)HTML Markup: Using Tables Appropriately

This is the seventh article in the Semantic (X)HTML Markup series. Before we begin, you'll want to read the previous articles:

  1. Semantic (X)HTML Markup: An Introduction
  2. Semantic (X)HTML Markup: Headings and Paragraphs
  3. Semantic (X)HTML Markup: Creating Emphasis
  4. Semantic (X)HTML Markup: Blockquote, Q, and Cite
  5. Semantic (X)HTML Markup: Structuring Lists
  6. Semantic (X)HTML Markup: Styling Lists

In this article we'll learn how to use perhaps the most misused semantic element: the table element. Like all the other (X)HTML elements we've learned about, there's a right and wrong way to use tables. The W3C created the HTML table model to "arrange data — text, preformatted text, images, links, forms, form fields, other tables, etc. — into rows and columns of cells." They specifically state that tables are not to be used for layout:

Tables should not be used purely as a means to layout document content as this may present problems when rendering to non-visual media. Additionally, when used with graphics, these tables may force users to scroll horizontally to view a table designed on a system with a larger display. To minimize these problems, authors should use style sheets to control layout rather than tables.

The accessibility problems of layout tables are why avoiding tables for layout is checkpoint 5.3 of the Web Content Accessibility Guidelines (WCAG). Using tables for layout can also rob you of one of the greatest benefits of CSS: its flexibility. Using CSS, the entire look of a site can be changed with a few edits to one style sheet. If complicated, nested tables were used instead, creating even minor layout changes can become a huge undertaking.

In recent years, many web developers have begun listening to the guideline to avoid layout tables and now use CSS to lay out their web pages. Instead of fitting sections of the page into rigid table grids, this new layout method involves placing content (marked up with semantic headings, paragraphs, and lists, of course) into div elements for each section of the page and then using CSS to position and style these divs.

Unfortunately, many forgot that tables still have a valid and valuable place in web design and tried to get rid of tables in their designs altogether. This is not the correct approach either. The table is still a valid (X)HTML element, and when you are trying to mark up tabular data, it is incorrect to use anything else!

Since the Semantic (X)HTML series is focused on how to use and mark up semantic elements, not about how to not use certain elements, this article will focus on the proper use of tables for data rather than on how to create layouts without tables.

http://www.communitymx.com/content/article.cfm?cid=0BEA6


Tuesday, November 30, 2004

How To Install and Configure Handwriting Recognition in Windows XP

How To Install and Configure Handwriting Recognition in Windows XP:
“This article explains, step-by-step, how to install and configure handwriting recognition in Windows XP. You can use handwriting recognition to enter text by writing instead of by typing. To use this feature, the Microsoft handwriting-recognition engine must be installed.

With the handwriting-recognition feature, you can use your handwriting instead of a keyboard to enter text. You can write by using a handwriting input device, such as a digital pen or stylus, or by moving your mouse pointer. The computer converts your handwritten words to typed characters, and then inserts the text exactly where you want it. ”

The handwriting-recognition engine is language-specific. The engine is currently available for the following languages: Simplified Chinese, Traditional Chinese, English, Japanese, and Korean. Engines for other languages will become available.

To use handwriting recognition, you need the following:
A writing tool. The minimum requirement for a writing tool is a mouse. To write with your mouse, press and hold down the primary mouse button, and then move the mouse pointer to form characters. The recommended tool is a handwriting input device, such as a pen stylus and tablet, connected to your computer through a serial port or USB port. Graphics tablets that are used with three-dimensional (3-D) drawing or computer-aided design (CAD) programs can also be used.
The Microsoft handwriting-recognition engine installed on a Windows XP-based computer.


http://support.microsoft.com/?scid=kb;en-us;306906

5 safety tips for using a public computer

5 safety tips for using a public computer:
Public computers at libraries, Internet cafes, airports, and copy shops are convenient, cheaper than buying your own laptop, and sometimes even free to use. But are they safe? Depends on how you use them.

Here are 5 tips on using public computers without compromising your personal or financial information.”

http://www.microsoft.com/nz/athome/security/
onthego/publiccomputer.mspx

Sunday, November 21, 2004

Two Cities, Two Gatherings for Two Kinds of Content Creators

Two Cities, Two Gatherings for Two Kinds of Content Creators:
"A good mix of different types of bloggers ranging from hobby/personal to professional/commercial. Also a number of journalist bloggers. Enthusiasts who don't blog but wanted to know more about it or wanted to have an influence on the direction software, services and organization. Would-be bloggers. Vendors. All ages from hip to former hippie and beyond. Multiple countries. A larger tech crowd than the last two because of proximity to Silicon Valley. More women than the last two but still a male majority. Some people complained that there weren't enough conservative bloggers but since anyone can register as long as space is available it's not like they were being kept away. Still, BloggerCon could do a better job of reaching out to the wider blogging community. Those who want more diversity in any area should do their share. "

Sometimes brainstorms work. BloggerCon III was Nov. 6 in Palo Alto; the Online News Association was holding its fifth national conference in Los Angeles the following weekend. For someone flying in from St. Louis, that was as good as next door. Why not do both?

The result is the kind of compare-and-contrast assignment English composition teachers love: Attend two disparate conferences with overlapping interests a week and a few hundred miles apart. Meet very different people with widely varying goals. Learn.

Then explain what works and what doesn't, keeping in mind that you know the people who put on each conference and that you hope to be back next year.


Hot TopicPodcasting (session audio)



Takeaway

Free MP3s of every session are being posted by ITConversations.com; a morning-after thread; posts from discussion leaders summing up their sessions; conversations in the blogosphere as people digest the experience.



http://209.200.80.136/ojr/stories/041119kramer/

Wednesday, November 17, 2004

Free MP3s from the Creative Commons

Free MP3s from the Creative Commons:
“…this column includes 16 free MP3s. But before we get to them, I'm hoping you'll read about what the availability of these tracks means to you, your music, and the Internet in general because this is all very important stuff.”

Last year, the Ninth U.S. Circuit Court of Appeals ruled that P2P file-sharing applications are legal because they can be used in substantial, noninfringing ways. The reasoning behind this goes all the way to Sony vs. Universal, back in 1984, when Universal sued Sony for selling the first Betamax machines. Universal said that because VCRs could be used to pirate movies, they should be strictly verboten. Sony replied that because VCRs have legit uses (storing video for later viewing, making a backup copy of a purchased movie), they're perfectly OK. The Supreme Court sided with Sony and consumers, and while Betamax later lost out to the VHS format, peoples' ability to copy media for personal use was preserved.

http://reviews-zdnet.com.com/AnchorDesk/4520-7298_16-5575644.html?tag=adss&tag=nl.e501-2

Friday, November 12, 2004

Thursday, November 11, 2004

MSN Search (beta)

It isn't google, but it's surprisingly good

http://beta.search.msn.com/
http://beta.search.msn.com/images/results.aspx?FORM=IRHP&q
http://beta.search.msn.com/news/results.aspx?FORM=NRIR&q

The trouble with using ems and percents for font sizing

The trouble with using ems and percents for font sizing:
"When good intentions fail

Relative font sizing is a great idea that fails to live up to its promises of user accessibility or design flexibility for the Web builder. In order to use relative font sizing successfully, you need to plan your page design and CSS styles very carefully to avoid the potential problems of nesting elements. You can do it, but it's not easy and it imposes significant restrictions on your design options. Otherwise, you need to rely on keywords or absolute measurements for font sizing. "

Free registration

http://builder.com.com/5100-6371_14-5210803.html?tag=nl.e601

Monday, November 08, 2004

US-CERT Vulnerability Note VU#842160 IE contains a buffer overflow vulnerability

US-CERT Vulnerability Note VU#842160:
"Microsoft Internet Explorer (IE) contains a buffer overflow vulnerability that can be exploited to execute arbitrary code with the privileges of the user running IE. "

A heap buffer overflow vulnerability exists in the way IE handles the SRC and NAME attributes of FRAME and IFRAME elements. Publicly available exploit code uses JavaScript to prepare heap memory with blocks that consist of NOP slides and shell code. After mishandling overly long SRC and NAME attributes, IE dereferences a memory address that may fall within one of the prepared heap blocks, running through the NOP slide and executing the attacker's shell code. Without the ability to prepare the heap blocks, this attack become significantly more difficult.

Other programs (e.g., Outlook, Outlook Express, AOL, Lotus Notes) that use the WebBrowser ActiveX control could be affected by this vulnerability

Install Windows XP Service Pack 2 (SP2)

Microsoft Windows XP SP2 does not appear to be affected by this vulnerability.

Disable Active scripting

Disabling Active scripting makes it more difficult for an attacker to prepare the heap to easily execute arbitrary code. At a minimum, disable Active scripting in the Internet zone and the zone used by Outlook, Outlook Express, or any other software that uses the WebBrowser ActiveX control. Instructions for disabling Active scripting can be found in the Malicious Web Scripts FAQ.

Do not follow unsolicited links

http://www.kb.cert.org/vuls/id/842160

Thursday, November 04, 2004

Apple disables iTunes plug-in | Tech News on ZDNet

Apple disables iTunes plug-in Tech News on ZDNet:
"With the latest version of iTunes, Apple Computer has disabled an add-on program that let people transfer songs off of their iPod. "

Apple introduced iTunes 4.7 last week, announcing new features such as support for the iPod Photo and the ability to find and delete duplicate tracks in a music library. But this week, Apple confirmed that version 4.7 does break compatibility with iPodDownload. The iTunes plug-in is designed to enable iPod owners to copy songs from the music player to an iTunes library, a feature that Apple has not supported.

Apple has in the past used new versions of iTunes to disable support for third-party software that adds unintended file-sharing abilities to the popular jukebox software. The company has also been pushing users to continue moving to more current versions of iTunes.

An Apple representative did not say why the company had disabled support for iPodDownload. The program's creator had already stopped distributing the software after Apple's lawyers contacted the company that housed its Web hosting.

"After Apple threatened my Web-hosting company, and my site was shut down for more than one hour, I had to withdraw the plug-in," Sylvain Demongeot said on the iPodDownload Web site. Demongeot did not return an e-mail.

http://news.zdnet.com/2100-1040_22-5436447.html


IE exploit is top of the hacks | Tech News on ZDNet

IE exploit is top of the hacks Tech News on ZDNet:
"A Microsoft Internet Explorer exploit represented the highest number of hacking attacks in the second quarter, according to figures from ScanSafe. "

The London-based security company said that the No. 1 hack was Exploit.HTML.Mht, which attempts to download and install a malicious program on a computer by using a security breach in Microsoft's IE browser software. The exploit was used to target almost twice as many organizations as other exploits, ScanSafe said.

"One of the things we've been surprised at is the growth rate of threats," said Roy Tuvey, director of ScanSafe. "There's been a 15 percent rise every quarter, and the threat is really rising. The first thing exploited are browser vulnerabilities."

Twenty-one percent of virus attacks occurred on Wednesdays and 6 percent at the weekend, ScanSafe found. The managed Web security company said the reason was that most viruses were launched at weekends and spread during the week.

http://news.zdnet.com/2100-1009_22-5436186.html


Monday, November 01, 2004

Flaws found in non-Microsoft Windows media players

Flaws found in non-Microsoft Windows media players:
Microsoft Windows users need to watch out for several flaws in non-Microsoft media players, security experts said.

Apple Computer and RealNetworks have both issued fixes for their Windows software to patch serious security vulnerabilities. Apple released Quicktime 6.5.2 on Wednesday to plug two holes in its Windows media player. On Tuesday RealNetworks advised users of its RealPlayer 10, RealPlayer 10.5 and RealOne Player software to use the "Check for Updates" feature to download the latest patch.

One of the flaws in Apple's Quicktime player affects Mac OS X users as well, but the company patched the problems at the end of September.

http://news.zdnet.com/2100-1009_22-5430912.html?tag=adnews


Reheated Bagle smokes out antivirus defenses

Reheated Bagle smokes out antivirus defenses:
A new version of the fast-spreading Bagle mass-mailing worm was discovered Friday, with its threat level quickly rising to a moderate level, according to security experts.

Bagle.BB, also known as W32/Bagle.bb@MM, was raised to a medium risk assessment by security company McAfee. The virus had triggered more than 100 reports to McAfee's antivirus and vulnerability emergency response team by early morning in Europe. Antivirus software makers have also identified two other variants of the Bagle virus that are successfully spreading.

Other security experts noted that there are specific challenges with the latest variant of Bagle.

"This version tries to block the Netsky virus on users' machines, which seems like retaliation on Netsky," said Stefana Ribaudo, a security management product manager for Computer Associates International. The authors of the Bagle and Netsky variants have taken to taunting each other in the worms' software code.

Ribaudo added that the Bagle virus, which is also known as Bagel AX and W32.Beagle.AV, tries to disable antivirus software loaded on people's computers.

Increasingly, computer viruses are serving as a tool to surreptitiously use another person's computer to send out spam or collect personal financial information.

Security experts note that the profit that can be made from these activities is driving the rapid rise in virus and hacker attacks.”

The most recent version of the Bagle virus is another in a long list of variants of the virus, which began infecting computers in January.

BitDefender Labs noted that the new Bagel variant creates copies of itself in varying lengths, in a move to make it harder to filter out of e-mails using antivirus software.

Bagle.BB harvests addresses from local files and then uses those addresses in the "from" field to send itself, according to McAfee.

As a result, the recipient of Bagle.BB receives a bogus e-mail with a spoofed sender address, which, for example, may appear to come from a legitimate friend, business associate or family member.

http://news.zdnet.com/2100-1009_22-5432334.html?tag=adnews


Saturday, October 30, 2004

ICANN Board OKs New Internet Domain Names

ICANN Board OKs New Internet Domain Names :
“Two new Internet domain names—“.post” and “.travel”—could appear online as early as next year as the Internet's key oversight board announced preliminary approval on Wednesday.

The Internet Corporation for Assigned Names and Numbers, in advancing the applications for postal services and the travel industry, said they were still considering eight other proposals including “.asia,” “.jobs,” and “.xxx.” Separately, “.eu” for the European Union also is in the works.”

http://www.eweek.com/article2/0,1759,1684461,00.asp?kc=ewnws102804dtx1k0000599