[ update: Microsoft has finally released it's Security update for WMF vulnerability. To apply the patch, simply visit the Windows Update web site, automatically scan for updates and install. ] Thanks Fuzzie for bringing this to my attention.

The purpose of this article is to clearly lay out all the information i could find on the recent Windows exploit, namely the WMF (Windows Metafile) vulnerability. Instead of adding to the current state of panic, my hope is that this post will help to clear up some of the apparent contradictions surrounding this issue and provide a kind of reference in the decision making process (ie: overall severity and what actions to take).

I’ll begin with a brief overview of the current state of affairs:

A Windows Metafile (WMF) – is a 16-bit metafile that can be used by all versions of Windows to display a picture. Similar to a .jpeg, .gif or bitmap.

A Metafile – is simply a list of commands that can be executed to draw a graphic. Normally, these commands are used to style objects such as lines, polygon and text. In this case, the WMF is being used to trigger potentially malicious code (ex: trojans).

For more background on Windows Metafile you can read the Wikipedia definition here.

i was also planning on quickly going over the events that have unfolded in reaction to the news about the widespread potential of this type of exploit. However, it turns out that the Wikipedia, once again, has done this job for me (and probably better than i could have done). If you’re late on the scene for this whole thing, i recommend you spend a few minutes reviewing that page as well.

Still, here’s a short list of the key points related to the most recent Windows Metafile Vulnerability:

• First reports of affected computers: December 28, 2005. [more info here and here]
• List of Vulnerable Systems: All versions of Windows. [ see full list here ]
• How it spreads: via email attachments [ although Microsoft is now saying otherwise ] or even just loading a website with WMF graphics. Read more here.

There seems to be some uncertainty surrounding the list of vulnerable systems. Some sources believe that older systems like Win95/98 and even WinME/2K can not easily be exploited in this manner. Read here, here and here for more info.

Protection against this exploit -

• The Workaround according to Microsoft: unregistering the dll [ type: "regsvr32.exe /u shimgvw.dll" in the command prompt ]
• The Unofficial Patch: by Ilfak Guilfanov version1.4 can be found here.
• The Unofficial Patch: based on the fix by Ilfak Guilfanov can be found here. [ .msi installer version 1.4 ]
• The Unofficial Patch: developed by ESET version1.1 can be found here. [ updated: Jan. 05, 2006. ( source: eWEEK.com ) ]

The best description of what these fixes actually do to your system can be found here [.pdf format]

Additional Notes -

• This is not an actual virus outbreak [it is an exploit, meaning just leaving your pc online but unpatched does not guarantee that you will be attacked].
• Some people have reported minor “issues” related to installing this patch such as printing problems.
• There is already a Microsoft patch available that is a pre-release which leaked onto the internet this morning and is said to be tested on Winxp/2k3 systems, but every link i’ve found was broken and had the file taken offline. For those interested, the file was named WindowsXP-KB912919-x86-ENU.exe and i’m sure it will surface again sooner or later.
• McAfee has added WMF exploit detection to its latest DAT file, which can detect exploits created by this tool.
• ESET claims its NOD32 anti-virus stops hackers from using all 206/206 tested WMF vulnerability exploits. They offer a 30-day trial version of their software which would protect you from this exploit “without having to take any special actions”, according to ESET (presumably until Microsoft releases an official fix). [ updated: Jan. 05, 2006. ]

That’s all i could find at this time. Hope it helps in some way.

Here’s a breakdown of all the new features added or upgraded since my previous post:

1. Compatibility with Opera web browser [ December 12, 2005 ]
2. To Do list module – i love this one – [ December 30, 2005 ]
3. Yahoo mail module – similar to the Gmail module – [ January 2, 2006 ]
4. Gmail module upgrade – set a title and no. of items to display – [ January 2, 2006 ]
5. To Do list upgraded – set a title and color, and more – [ January 2, 2006 ]
6. POP IMAP module – secure connections, webmail URL, more – [ January 2, 2006 ]
7. RSS module upgraded – set a color for each feed – [ January 2, 2006 ]

You’ll notice that all but the first 2 features/upgrades were actually added on the same day. i am consistently impressed with the rate at which Netvibes puts out new modules. it seems they’re really on to something here. i’m sure that there’s definitely room for many more interesting modules in the near future.

On a side note, i remember when the Gmail module was first added to Netvibes. At the time, i didn’t even have a Gmail account yet. Back then i was thinking to myself, i wish Netvibes had that feature for Yahoo Mail. It’s funny, because now that they do offer the Yahoo Mail module, i realized that yahoo.com domains don’t get free POP access (although apparently many international yahoo domains do. – ie: yahoo.fr) – so i wouldn’t have been able to use the module even if it was available, and i still can’t use it. Here’s to hoping that Yahoo catches on to this problem, because this is not the first time i’ve had the opportunity to access my POP account from a different web based service/software and haven’t been able to. As i have mentioned before, i am slowly moving over to from Yahoo Mail to Gmail – and no POP access is one of my main reasons for doing this. i know that Yahoo Mail is in the process of getting a complete overhaul, but this is all happening behind the scenes and i’m just not sure how much longer i can wait.

Anyway, i’ll probably set up the POP IMAP module and test it out next. i’ve already been using the To Do list module for a little while and find that this is a great addition to the Netvibes content set. I’ve always felt that a full-blown desktop app for something as trivial as a To Do list was overkill. Here’s the perfect solution. Overall, there are probably a lot more situations like this involving bloated softwares, etc. And i think that if the folks at Netvibes can keep this in mind, they’ll likely find inspiration for many more modules. Nevertheless, from the looks of things, i get the impression they aren’t having too many problems in the inspiration department.

For more info and all the latest news you can visit the Netvibes blog.

As you may have noticed, the title of this post is a deliberate play on Linden’s title. While i agree with him that Kedrosky seems to have totally missed the point of RSS (ie: you don’t blame a data format), i don’t think that all feed readers are the same. And so, Linden’s title still seems a little misleading to me. We both agree that the problem here is definitely software and i know of at least one feed reader that solves most of the problems described in Kedrosky’s post. Again, i’m talking about SearchFox.

As Linden has pointed out:

“RSS is just a data format after all. The problem is that the current generation of feed readers merely reformat RSS for display. They don’t do anything else, no prioritization, no filtering, no help dealing with the flood of information.”

I’m not going to deny the growing problems posed by information overload. But, in my opinion, SearchFox is a “next generation” feed reader designed with machine learning technology that both prioritized and filters information similar to the way Findory learns to assume what articles you’re going to be most interested in. The difference is, and this is why i hesitate to even compare SearchFox to Findory [see previous comments posted between Greg and I], the latter doesn’t let you choose your sources.

So, to go back to a common analogy that surrounds RSS: “We are drowning in information” [borrowed from Greg's post]. To this i would have to say:

i’d rather be drowning in an ocean of my own design.

oh, or maybe i’d also say:

Nobody forced you to swim over to the deep end of the pool. (that one sounds pretty mean though.)

[ For a more in depth comparison of feed readers (including SearchFox) you can read:"3 week shakedown, 2 RSS readers remain.", which is itself a follow up to an earlier post entitled:1 week comparison: SearchFox, Feedster, Pluck, Bloglines, Rojo, and NewsGator", which is itself a follow up to an earlier post entitled: "So you think you can RSS? How", which is itself a follow up to an even earlier post entitled: "So you think you can RSS? Why". ]

So i’m on a new mission: find a web hosting provider that meets my current requirements, test a couple out and slowly move over some of my current domains to said provider. i figured that i’d document my research and post it for any who might be in a similar situation. i’ll begin with a brief list of my requirements, followed by a summary of the hosting services being considered and compared. Lastly, i am going to try and sort out various features and determine which service would likely be the best match for my needs.

Key web hosting features (required):

1. multiple domain add-ons (at least 15)
2. unlimited mysql databases (or minimum 50)
3. 1 Gb disk space or more
4. no restrictions on email addresses, forwarding, autoresponders, mailing lists, etc.
5. cpanel, with file manager, disk usage viewer, directory protection, etc.
6. some type of backup (full site backups as well as individual mysql db backups)
7. general domain management (including unlimited subdomains)
8. lots of stats (site-wide stats, subdomain stats, overall bandwidth usage, etc.)
9. other features: phpmyAdmin, ftp access, ssh shell

Many of the features mentioned above come standard with a mid-range web hosting plan priced at approximately $15.00US per month. Other features such as multiple domain add-ons will likely be harder to find in a plan of this price range. i’ll probably have to make some compromises here and there. The objective is to match as many of these features with one of the following provider’s hosting plans.

Here are the web hosting providers being considered for this comparison:

• IX Web Hosting
• StartLogic
• Globat Web Hosting
• Clear-Data Internet Services
• Yahoo Small Business Web Hosting
• Site5.com
• PagesGarden
• HostGator [ update: added Dec.10/05 ]
• A Small Orange [ update: added Dec.10/05 ]

Final Notes -

Some obvious things to look out for when deciding on a web hosting provider:

• don’t go with a provider who’s own company website appears to be slow. chances are, if their site runs slow, yours will too.
• don’t go with a provider who’s own company website is sometimes unavailable. if you go to their homepage twice in two days and one of the times you get: “The page cannot be displayed”, check that you typed the URL correctly in the address bar. if you did, then it might be time to move on. that’s 50% uptime, since your users are likely not interested in calculating averages over time.
• don’t go with a provider that doesn’t display the prices for their hosting plans until well into the signup process. ask yourself, why would they be trying to hide something that every other company is trying to put directly in your face?

But this morning, something had changed. i go to the TrendMicro site as usual to scan a client’s pc and the whole system seems to have been revamped. The first thing i noticed was that i had been forwarded from the main trendmicro.com domain to trendmicro-europe.com. Odd, but i didn’t think much of it. However, i immediately didn’t like the extra legal jargon, info page, and other nonsense put directly in the path between me and the free antivirus tool.

i got a warning regarding an out of date version of java, yet this didn’t matter since i could still use the activeX version. so far everything seemed more bloated and confusing.. and i’d been to the site many, many times before. i’d hate to think of someone who’s showing up there for the first time. anyway, i made my choice and proceeded to begin the scan.

Then, everything seemed much slower than usual. i later realized that nothing seemed to be happening at all. it seems this new version is completely broken. first it did nothing. then it crashed all my crappy IE browser windows, then i got an awesome server message direct from their servers.

check this out:

not exactly a good message for TrendMicro to be getting from apache at this point in the game.
more disturbingly, why am i (the user) getting this? something’s just not right here.

is anybody out there testing these things before they go live? let me know when it’s working again because i’m tired of checking back every 15 minutes.

In case you where wondering:

“A neologism is a word, term, or phrase which has been recently created (“coined”) —often to apply to new concepts, or to reshape older terms in newer language form.” [Wikipedia definition]

A few popular examples include: podcast, google, folksonomy, slashdot effect, blogosphere, email, spam, and let’s not forget internet (not sure how we ever got anything done without that word). Many other favorites fall entirely outside of the realm of technology. For instance, Made-up words in The Simpsons turns up as one of the most heavily bookmarked pages on del.icio.us for the term “neology“.

Some would say that an increase in neologisms indicates that we are living in a period of extreme innovation where new words are constantly required to keep up with all the unique products and services that are being developed. If so, I wonder whether an increase in the production of neologisms could be used as an indicator of economic growth in the larger sense?

Ingar Roggen identifies the importance of neologisms in his writings about innovation and Gestalt theory. For more on this, you can head over to his site and read his article entitled: Root Knowledge. The part that caught my attention was toward the beginning where he outlines the importance of neology with regards to technological change. He starts out by saying, “No new science is possible without neologisms”. He goes on to say some interesting stuff like, “To reject neologisms, often despicably, is to reject scientific development”, and “everybody wanting to contribute new knowledge must be [a neologist]“.

All this fits in nicely with an earlier post i wrote entitled: “folksonomy, and people’s classification management 101” which discusses the flexibility and power of tagging as an alternative to using traditional categories to organize information. The ever-increasing number of social networking services like del.icio.us and technorati are making heavy use of tagging as a way to get at information in interesting and creative ways. One of the coolest things about tagging is that all of the terms that are used are chosen by the people who use them. Anyone is free to come up with their own made up words to describe something new, provided no other word already exists to describe what it is they’re talking about. But new tags, like all neologisms, also require cultural acceptance to ensure their survival. So, as long as the idea behind the word makes some kind of impact on our culture, people will start to use it, and these new folksonomy based softwares will probably serve to facilitate their dissemination and eventual adoption.

Oddly enough, while there are lots of articles on the web dealing with the word “folksonomy”, there isn’t that much out there being written about neology. This is surprising to me, given the growing importance of choosing unique names for new Web 2.0 products and services, standing out as a start-up, building branding, not to mention ranking well on search engines. Currently, searches for the term “neology” on both tech.memorandum and digg.com turned up no results (although “neologism” turned up 1 result on digg: Made-up words in The Simpsons – mentioned above). The same search on del.icio.us only turned up a mere 73 results, and most of these were either definitions of the term or long lists of popular neologisms (the later of which only furthers my point). Compare that number to the 1255 results returned on del.icio.us for the term “folksonomy” and some interesting questions begin to form.

Why are so many people interested in writing about folksonomies? What does it mean if everyone has a relatively equal shot at creating language? How do societies cope with an exponential growth in language (always adding more and more new words, terms and phrases to our vocabularies every year)? And finally, why is there so little being written about the growing significance of neologisms? or am i the only one who finds it interesting that suddenly everybody and their mother is creatively coming up with awesome made up words for all kinds of things from technical jargon to corporate trademarks.

On the down side, i noticed that the archives page takes a little longer to load initially (i don’t think it takes as long the second time). But the advantage of applying Ajax techniques to the archives is that it eliminates page refreshes, which means that browsing through the archives becomes a lot faster and easier as a whole.

Installing the plugin was fairly easy.

1. Upload the entire “af-extended-live-archive” folder to your wordpress plugins directory.
2. Add < ?php af_ela_super_archive(); ?> to your archives template.
3. Enable the plugin in the wordpress admin.
4. Navigate to the “Options » Ext. Live Archives” tab to recreate the cache.
5. Add the css file (or copy and paste the code) to your site.
6. Optionally, modify the css file to suit your needs.

So far, i’m really happy with it. The only potential problem that i saw was for people browsing the site with javascript disabled. These visitors would see nothing at all. Even though this is a pretty clean default result (as opposed to printing out some nasty error), i wanted everyone to be able to use the archives page.

As a quick solution, and because i had only hidden (commented out) the original code (xhtml) when i added the ajaxified archives code, i decide to simply add < noscript > < / noscript > tags around the old code that was commented out. This would effectively hide the old code from browsers with javascript enabled, while showing it only to visitors with javascript turned off. With the javascript fix in place, i think this plugin might be a keeper..

The Recap:

• RSS? Why. ( evolution of the Net and why RSS is so popular )
• RSS? How. ( how to start using web-based RSS services )
• 1 Week Comparison. ( a look at 6 popular web-based RSS readers )

The Breakdown:

SearchFox -

• Pros: really fast now – with possibly the fastest OPML import i’ve seen. (ironically, you get a message saying it might take 5-10 minutes for all the feeds to show up, 50 or so in my case, but it took about 3 seconds), if adding a feed fails you get a useful link to validate the feed (also there’s a quick link to the actual website to check if it’s online), machine learning technology is really starting to warm up (stories are given a score based on your interests which saves me lots of time)
• Cons: no way to sort by date (sometimes you just want to see the most recent articles for a quick second) [see comments], accident prone one-click delete (individual sites and entire folder of feeds with no warning), “email” this post requires a configured email client like OutlookExpress (sort of works against the idea of being web based)

Rojo -

• Pros: rename feeds (you’re not stuck with default name for any feed you want to add), easily find info on the feeds you’re subscribed to (by clicking the “i” icon), advanced sort capabilities (sort by: feed tags, how frequently read, unread story count, and name), “email this” post (a feature i actually started using regularly)
• Cons: i can’t see what date each post was made (only vague 2 hours ago, 5 hours ago, etc.)[see comments], tagging stories and feeds can get tiresome (time consuming)

Bloglines -

• Pros: tabs help keep things organized (not by much), icons associated with feeds (left sidebar) help when trying to quickly find a site, “email this” post (same as Rojo), organize your favorite clipping into folders (on the fly), preview this feed (just before you add it)
• Cons: favorite clippings are displayed in the sidebar (instead of the main window), clicking on top-level directory in “My feeds” makes all new feeds appear as read (that sucks), “mark all as read” link is kind of useless (see previous con), export OPML feature is unintuitive (file opens in browser instead of downloading the file automatically – user must click “file”>”save as”) and is hard to find because it’s all the way at the bottom of the left sidebar.

Newsgator Online -

• Pros: favorite clippings are displayed in the main window (instead of the sidebar), convenient “email this” post feature (same as Rojo)
• Cons: can’t seem to find any info on each of the feeds i subscribe to (# of subscribers, Feed URL), no way to rename anything (folders or feeds), no way to mark “all posts” as read (only mark “this page” or “this post” as read), no icons associated with feeds (icon save time when trying to find stuff fast), had some css problems with collapsible feed descriptions using Firefox.

The Shakedown: (and why they lost out)

• Bloglines – while it is probably the easiest RSS reader service to get started on, things quickly get disorganized to the point of no return. The result was that i eventually just exported all my feeds as OPML and imported them into SearchFox and Rojo.
• Newsgator Online – is most likely my 3rd favorite service of those mentioned above. And although there aren’t any major problems to speak of, something about the main user-interface just turned me off. For some reason the whole layout just makes me feel like i have less control over everything. Also, the company as a whole seems a lot more corporate; it makes me wonder how dedicated they are to the free “online” version of their software.

Conclusions:

With 2 RSS readers remaining, SearchFox and Rojo stick out as my favorites (so far). Looks like it might take a little longer to decided on just 1 service but i’m not really in any rush to choose. In the meantime, i’ll continue to use both of them regularly and probably post some more of my observations. i might even come up with some sort of wishlist or “things i’d like to see” in new versions of SearchFox and Rojo so stay tuned.

[ This is a follow up to a previous article entitled:"1 week comparison: SearchFox, Feedster, Pluck, Bloglines, Rojo, and NewsGator", which is itself a follow up to an earlier post entitled: "So you think you can RSS? How", which is itself a follow up to an even earlier post entitled: "So you think you can RSS? Why". ]

Both FrSIRT and CNET are reporting a recently discovered security vulnerability affecting all versions of Firefox, including the recently released Firefox 1.5 Beta.

According to FrSIRT, “A vulnerability has been identified in Mozilla Firefox and Mozilla Suite, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to a buffer overflow error in the “NormalizeIDN” function when handling malformed URLs containing “0xAD” characters embedded in HTML tags (e.g. “A HREF”), which could be exploited by remote attackers to take complete control of an affected system via specially crafted Web pages”.

Apparently Netscape 8.0 is also affected by a similar issue.

CNET is claiming that security researcher Tom Ferris mentioned the problem to the Mozilla Foundation as early as Sunday, then decided to publicly disclose the flaw. Mozilla responded by stating that the bug is still under investigation and that “users are currently not at risk because there are no known attacks that take advantage of the flaw”.

The Solution / Temporary Fix: (according to FrSIRT)

Disable IDN support by entering “about:config” in the location bar, and then setting “network.enableIDN” to “false”.

Update: BetaNews is reporting [September 12, 2005, 12:09 PM] that: “Mozilla developers acted fast to patch a new security vulnerability in Firefox, which slipped its way into the first beta build of Firefox 1.5 and exists in earlier versions as well. However, the patch simply disables the buggy feature while a permenant fix is worked out”. Still useful for all those not comfortable with the fix provided above.

Update: Mozilla Firefox 1.0.7 was released [September 21, 2005, 12:09 PM] which addresses several recent security issues, including the one described above. For more info you can visit Mozillazine.

i can’t believe an entire week has gone by..
i wanted to take a couple of hours each day to test out these 6 feed readers, but i gotta say that i still can’t decide which one i feel most comfortable with. looks like i may have seriously underestimated how easy it was going to be to make this choice. in the meantime, let me just say, that i have become a full blown feed junkie, thank you very much (not sure who to point the finger at on this one – but it’s got to be somebody’s fault right?).

anyway, here’s how i’ve been doing it and what i’ve found:

i started by logging in to each service, in 6 different Firefox tabs, all in a single browser. next i began to mess around, but trying to give each feed reader an equal amount of my attention. first i used the directories to browse for new feeds, and the search box to find sites with content i was interested in. then i took a look at the account features provided by each service. could i change my preferences.. did i even have any preferences? there were many things to explore. i did notice that Pluck and NewsGator kept logging me out if i hadn’t used them for more than 10 minutes or so. while this might be a very secure and efficient thing to do, the result was that i ended up spending a lot more time using all the other feed readers – who wants to have to keep logging in over and over again every ten minutes?

once i got bored of that, i tried to import an OPML file, which is essentially just a list of many different feeds all conveniently packed into one file. very useful for quickly moving around all your feeds (ie: import / export). suddenly i had a ton of feeds in my reader (80-120), and things got all cluttered. things were a mess, so i figured this might be a good time to test out how well each feed reader was able to manage large numbers of feeds. i deleted and renamed feeds and folders, reordering them in a way that was most useful to me. options like: display only unread articles, mark as read, and sort by date, are all particularly useful in these respects.

here are some more brief observations i have made over the course of the week:

SearchFox –
Pros: expand/collapse summaries within feeds (Results), easy to navigate/browse feeds (DirBro), sort by day/week/month/favs/all (Results), ability to mark article as unread (Manage), machine learning technology (SpecO)
Cons: slow to add feeds (Manage) [this seems much faster now], no OPML import [see comments] or export (Manage) [this feature was added: 10/21/05], no account preferences (AccSet) – but they’re still just in beta.

My Feedster -
Pros: add feeds really fast (Manage), import/export opml files and urls(Manage)
Cons: feed results page is difficult to view (Results), no way to sort page results (Results)

Pluck Online -
Pros: fast loading pages (Results), import opml files but not urls (Manage), open stories in new window (Results), add bookmarks as well as feeds (SpecO), view Shadow pages (SpecO)
Cons: can’t tell which articles are new or have been read (Manage), no export opml (Manage), weird reloading browser window if you try to do anything (DirBro)

Bloglines -
Pros: sort results differently for each folder/category (Results), expand/collapse feeds (Results), import opml files but not urls (Manage), export opml (Manage), keep articles as new even after they’ve been read (Manage)
Cons: no folder is created when importing new feeds (Manage), saving favorites is a 2-step process (ClipFav)

Rojo -
Pros: import/export opml (Manage), expand/collapse summaries within feeds (Results), many ways to sort (Results), easy one-click save/flag entries (ClipFav)
Cons: no easy way to rename categories (Manage)

NewsGator Online -
Pros: easily mark stories as read (Manage), choice to view only unread items (Results), the only service where you log in on a secure (https) server (SpecO), import/export opml files and urls (Manage)
Cons: can’t keep articles as new once they’ve been read (Manage)

Some of these feed readers have special features that would require more extensive testing in order for me to really say which i liked better. extras like tagging feeds (Rojo), favorites (Pluck), communities (Rojo,Pluck,Bloglines), machine learning (SearchFox), could easily sway my decision. the only service i am sure i would never stick with is Feedster. aside from being fast, i often had problems viewing feeds, organizing anything, uploading my logo/image, and sometimes it just wouldn’t work at all. if i had to pick my favorite 3 out of these 6 readers, i would have to say Rojo, Bloglines, and NewsGator. SearchFox could be up there as well, because of it’s ease of use. but since it is still in beta, and because i am forever intrigued with the idea of machine learning technology, i will keep SearchFox around for another 2 weeks. in that time, hopefully i can narrow these 3 services (actually 4) down to my #1 favorite. wish me luck.

[ This is a follow up to a previous article entitled: "So you think you can RSS? How", which is itself a follow up to an even earlier post entitled: "So you think you can RSS? Why", and looks at the evolution of the internet, why RSS and other feed formats are so popular today, how to use them, and why you might like one service over another. ]