Yet Another Adobe Flash Player Update

Another out-of-band (not in the normal release cycle) security update has been released for Adobe's Flash Player. This update moves it to version 10.3.181.26. You should check that you have the latest version and upgrade if you don't.

This one is being exploited to download and install malicious software to peoples computers already so update as soon as you can.

Microsoft Update Tuesday and Adobe Reader Patches

Today is update Tuesday. Microsoft has release several updates that you should install as soon as possible. Just open Windows/Microsoft update from the start menu to get started.

Adobe also released a patch for their Adobe Reader X that updates it to 10.1.0. The Adobe updater should prompt you to install the update from the system tray by the clock or you can download and install the update directly (17.2 MB).

Update for Java(TM) Runtime

There is a new update for the Java(TM) 6 Runtime: 1.6.0 update 26

See which version of java you have installed (if any).

You can update Java by going to Control Panel -> Java -> Update -> Check now or download the latest version directly.

Update for Adobe Flash Player

Time to update your Adobe Flash Player again. You can go to http://www.adobe.com/go/getflash to get the lastest version (10.3.181.22 or 10.3.181.23 depending on which browser you use).

If you use Google Chrome it should update automatically and just need a restart.

Keep your computer software up to date

I've had several family members get hit by drive-by installs of fake "anti-virus" software lately. Here are some tips on avoiding these and some links/instructions to get updates.

Tip 1: Don't install software you don't use.

Most software has vulnerabilities and the more software you have installed the more likely you are to have one of those vulnerabilities exploited. It is hard to know what software you use and don't use sometimes but you can always uninstall it and if you need it you can install it again later.

Commonly installed software that you might want to consider removing:

Java - If you don't use java applications or java applets. If you need it you can always re-install it from the link below.

Apple Quick-time/iTunes - If you don't have an iPod or buy things from the iTunes store. Quicktime player may be required for some web content (but again, you can always re-install if you find that you need it).

Adobe Reader - This is used for viewing PDF content both online and stored on your computer. Most people will want a PDF reader but if you use Google Chrome browser there is a PDF reader built-in. The Adobe Reader supports more features than most other readers so you may want to keep it, be sure to update it regularly.

Tip 2: Use the ad block plugin in Firefox/Chrome.

This removes ads from sites that you browse which are the primary source for most drive-by installs.

http://adblockplus.org

Tip 3: Use the latest version of your web-browser.

The latest version of most web-browsers have features that make it harder to exploit vulnerabilities.

http://www.mozilla.com/en-US/firefox/new/

http://www.google.com/chrome

Or IE 8 (Windows XP) / 9 (Windows Vista/7) via windows update.

Tip 4: Keep your software up-to-date.

Windows (and Microsoft Office): Go to start -> all programs -> Windows/Microsoft update. Microsoft releases updates on the second Tuesday of every month and occasional security updates at any time.

Adobe Flash Player: http://get.adobe.com/flashplayer/ (version 10.3.181.14 as of 5/18/2011)

Flash player should also request an update when your computer reboots (usually).

Adobe Reader: http://get.adobe.com/reader/ (version 10.0.3 as of 5/18/2011)

Reader will also request updates from the system tray (by the clock) if updates are enabled. This will only upgrade the version installed not upgrade to the latest version (Reader 9 to Reader X).

Java: Go to Control Panel -> Java -> Update -> Check now (version 1.6.0 update 25 as of 5/18/2011)

Java will prompt you to update from the system tray but is set to check only once a month by default and will not download the update automatically. I recommend that you change the update settings to check every day and automatically download the update (from the control panel as above).

You can also download the latest version from: http://www.java.com/en/download/index.jsp

Quicktime/iTunes: Use the apple software updater from your start menu (version 7.6.9 for Quicktime and 10.2.2 for iTunes as of 5/18/2011).

Be sure you don't accidentally install extra software that you don't want (Apple sometimes has extra software checked by default).

You can also download the latest version from: http://www.apple.com/quicktime/download/

I hope this has been helpful for people. I'll try and post whenever there are new releases of software that need updating.

Unhelpful IE8 JavaScript Fixups

The following lines of javascript work in every browser that I know of with the exception of IE8.

function e(u,d){
a=u+'@'+d;
document.write('<a href="mailto:'+a+'">'+a+'</a>');
}

The function is designed to obfuscate email addresses, an email harvesting bot would have to run the page through a JavaScript engine or know the layout. However IE8 seems to think that the variable "a" has some special meaning. The code in IE8 produces the following HTML:

<a href="mailto:http://server/dir/user@dom">http://server/dir/user@dom</a>

In every other browser I've tested it produces the following:

<a href="mailto:user@dom">user@dom</a>

Changing the variable a to something else or scoping it with var a; works. It also works in IE8 compatibility mode. I couldn't find any documentation for this "feature" yet.