Pale Moon browser 20.2 released

Here is the list from palemoon.org

• (CVE-2013-1692) Fix for the inclusion of body data in an XMLHttpRequest HEAD request, making cross-site request forgery (CSRF) attacks via a crafted web site more difficult.
• (CVE-2013-1697) Fix to restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges.
• (CVE-2013-1694) Fix to properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code.
• Fix to prevent arbitrary code execution from the profiler developer tool.
• Fix for a crash when rapidly reloading pages.
• Fix for cross-document selections.
• Fixes for several crashes in JavaScript.
• Fixes for several memory safety hazards and uncommon memory leaks.

The best browser for Penzu.com journals on Windows 7 ?

---

Java JMX MBean flaw

CERT says

Due to the number and severity of this and prior Java vulnerabilities, it is recommended that Java be disabled temporarily in web browsers

http://www.us-cert.gov/current/#us_cert_releases_oracle_java

http://www.kb.cert.org/vuls/id/625617

http://www.us-cert.gov/cas/techalerts/TA13-010A.html

---

XP update

When Windows is done applying security updates, I do not accept their prompt to RESTART.  I accept the CLOSE option instead. Why?

Because Process Explorer shows a great deal of MS activity and it continues for some time.  As those processes complete and terminate and all goes quiet, then I do a restart from the PE menu.

Springpad security

While trying to get Springpad to run this morning, I made an error in my passphrase on the penultimate attempt. Now running, Springpad came back wiith "Incorrect password for user tel-et-tel". Wrong ! 

The correct response would be  "Incorrect user name or password."   OR.

What can a private notebook be worth if the vendor is that slack?

HTTP HTTPS

(my last two Facebook posts today – after Tweets on same ...)

How can a PRIVATE notebook on the web open in HTTP and not HTTPS ? But it did and does. Is this why we are to rely on Google and/or Microsoft ? The problem here is not "browser plugins" but something rather more obvious. SpringPad.

Death of the plugin ? SpringPad page in Firefox 13 web browser does not even know that I have their plugin running ! More like a plugin coma. Time for wake-up call? ( see SimpleNoteapp.com for alternative API ) Oh, death of the API's ? End of the programmer ? The End of design, too, I suppose ? Imagination dead. Imagine.

---

Linkedin passwords

My two twitter posts this A.M. were the question:

Q  is http://linkedin.com still accepting dumb passwords from users ?

#linkedin

and the answer:

G. Robert Shiplett ‏@rshifflet

linkedin rejected 2 moronic efforts but allowed me 'password~2' Do any pass-phrases begin with 'pass' + 'word' ?

#linkedin

HTTPS defeated by Google

More bad news:

https://search.google.com/ is redirecting to http://www.google.ca/ for my own good, naturally ...

But hey,  https://mail.google.com/mail has been over-llooked for now up at the view from the mountain ...

But Google will find a way to defeat your choice to use that HTTPS URL in personal home page links - and it is for your own good, after all.  Google knows best.

---

IE Updates

Oddly, the Windows Update option for Microsoft XP as found in the IE8 Tools menu (Internet Explorer 8) does NOT go to an HTTPS site but instead to http://www.update.microsoft.com/microsoftupdate even though just going to https://www.update.microsoft.com/ provides the XP user of IE an HTTPS site for updates!

Why does MS even keep that HTTP target on-line?

What would such a minor update to IE8 have cost the accidental collosus?

SONY PlayStation network user credit card info hacked

 
The SONY admission that a hacker may have accessed all user info short of credit card 4-digit CSC's should lead to a class-action lawsuit in the USA.

Users should have had the option to use their hardware as the basis for a public-private key encryption of personal information.

The main reason not to do so is greed: SONY required access to pursue fraud and non-payment.  Let SONY now balance this against their present plight.

In all likelihood Oracle relational databases were used by SONY.  Storing strings in relational tables is easy for the developer and a joy for the hacker.  But what functionality could have required relational tables for the personal information of users? Well, it may have made things easier, faster and cheaper for the SONY info tech folks.  Manager gets bonus but users get ...

Sadly, the focus now is likely to be on network security.  And a Master appointed to advise a judge would likely come from the world in which Oracle DB tables are the norm for any and all data.

Access to data should have been on a process basis and no hacker should have been able to fork such a process: only such a process should have been able to convert that data into readable and usable information.

So ... had SONY used Erlang, would their customers be in this sad situation today?  And that is only one option from their asset stables.

Users will have a different view: regardless, of the technology in play, they should have been notified pronto.  Forget KISS, CRUD and ACID. The term of the day is PRONTO.

With any luck, the hacker was in for cred and not credit cards.  But SONY is a giant and this should be a sobering moment for corp IT that is public-facing.  And for users? Well, caveat emptor.  And then get a lawyer with a proven record in class actions.