Monday, January 15, 2018

Pale Moon Version 27.7.0 Released with Security Updates


Pale Moon
Pale Moon has been updated to Version 27.7.0. This is a stability and bugfix release, as well as adding a number of new features to further improve web compatibility.  Details from the Release Notes:

Security/privacy fixes:

  • Disabled automatic filling in of log-in details by default to prevent potential risks of credentials being abused (e.g. for tracking) or stolen.
  • Added a preference (in the category security) to easily enable or disable automatic filling in of log-in data.
  • Removed the sending of referrers when opening a link in a new private window.
  • Added an option to disable the page visibility Web API (dom.visibilityAPI.enabled), allowing users to prevent pages from knowing whether they are being actively displayed to the user or not.
  • Removed the "ask every time" policy for cookies. For granular control, please use any of the excellent available extensions to regulate cookie use on a per-site or per-url basis.
  • Added support for X-Content-Type-Options: nosniff (for scripts).
  • Changed the resolution of performance timers to a level where any future potential abuse for hardware-timing attacks becomes impractical. DiD
DiD This means that the fix is "Defense-in-Depth": It is a fix that does not apply to a (potentially) actively exploitable vulnerability in Pale Moon, but prevents future vulnerabilities caused by the same code, e.g. when surrounding code changes, exposing the problem, or when new attack vectors are discovered.
Changes/fixes:
  • Reorganized access to preferences (moved to the Tools menu on Linux, and renamed from "Options" to "Preferences" on Windows).
  • Renamed "Restart with add-ons disabled" to "Restart in Safe Mode" to better reflect what it does.
  • Worked around an issue with some improperly-encoded PNG files not decoding after our libpng update.
  • Fixed an issue on Mac builds not properly populating the application menu.
  • Added "My home page" as an option for new tabs.
  • Added an option to disable the 4th and 5th mouse buttons (Windows).
    (mouse.button4.enabled and mouse.button5.enabled, respectively)
  • Improved the resetting of non-default profiles.
  • Fixed an issue with details/summary having the incorrect height if floated, breaking layouts.
  • Made several more improvements to the details/summary tags to align them with the current spec and fix some additional bugs.
  • Implemented support for flex/columnset contents inside buttons to align its behavior with other browsers.
    (this should fix layout issues with Twitch's new web interface)
  • Fixed an issue where CSS clone operations would draw a border.
  • Changed the way fractional border widths are rounded to provide more natural behavior.
  • Fixed an issue where number inputs would incorrectly be flagged as read-only.
  • Added assets for tile display in the Windows start panel.
  • Finished sync infra swapover by adding a one-time pref migration for server used.
  • Improved WebAudio API: Return the connected audio node from AudioNode.connect()
  • Added support for a default playback start position in media elements.
  • Fixed an assert in cubeb-alsa code (Linux).
  • Added support for media cue-change events (e.g. subtitles).
  • Updated SQLite to 3.21.0.
  • Fixed a crash when trying to use the platform embedded.
  • Fixed devtools (gcli) screenshots on vertical-text pages.
  • Fixed devtools copy as cURL for POST requests.
  • Improved the HTML editor component (several bugfixes).
  • Added support for ES7's exponentiation a ** b operator.
  • Fixed an issue with arrow functions incorrectly creating an 'arguments' binding.
  • Added Javascript's ES6 "unscopables".
 Minimum system Requirements (Windows):
  • Windows Vista/Windows 7/8/10/Server 2008 or later
  • Windows Platform Update (Vista/7) strongly recommended
  • A processor with SSE2 instruction support
  • 256 MB of free RAM (512 MB or more recommended)
  • At least 150 MB of free (uncompressed) disk space
Pale Moon includes both 32- and 64-bit versions for Windows:

Update

To get the update now, select "Help" from the Pale Moon menu at the upper left of the browser window.  Select About Pale Moon > Check for Updates.




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...


Sunday, January 14, 2018

HomeGroup Service Retiring

It appears that many people have missed that HomeGroup is on the way out.  Windows 10 provides other ways of connecting devices and sharing files. 

From Feature Deprecation:
"Homegroup: This feature may continue to function on machines with the Creators Update installed; however, Homegroup will sunset in the release that follows. This page can help you troubleshoot problems with Homegroup following installation of Windows 10.
Here are additional resources if you would like to share files and printers without using Homegroup:

The changes began in Windows Insider Preview Build 17063:
"A note about HomeGroup: Easily connecting to and sharing the important pieces of your digital life with those who matter most has never been easier with today’s Modern PCs and the cloud. Whether it’s connecting PCs and printers on your home network via the Share functionality in Windows or using OneDrive to share a photo album of your last vacation, Windows 10 makes connecting multiple devices and sharing content streamlined and simple. And it’s because of that evolution that with today’s build you’ll start to see us retire the HomeGroup service. HomeGroup was terrific for the pre-cloud and pre-mobile era, but today this functionality is built right into Windows 10 and apps. Starting with this build, the HomeGroup service is no longer operational in Windows 10. The user profile used for sharing and the file/folder/printer shares will continue to work.

Here are recommended alternatives to HomeGroup for you to get the best file-sharing experience in Windows 10 going forward:
  • File Storage:
    • OneDrive is a cloud-first, cross-device storage and collaboration platform for all of the pieces of data that matter most in your life – like your files, your photos, your videos, and more.
    • OneDrive Files On-Demand takes cloud file storage a step further, allowing you to access all your files in the cloud without having to download them and use storage space on your device.
  • Share Functionality: For those who prefer not to use the Cloud to connect their devices, the Share functionality for folders and printers allows you to see the available devices and connect them to and from other PCs on your home network.
  • Easier Connection: No more remembering cryptic HomeGroup passwords in order to connect to another PC. You can now simply connect through your Microsoft Account email address across devices."
Home
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Tuesday, January 09, 2018

Microsoft January, 2018 Security Updates



The January security release consists of 56 CVEs, 16 are listed as Critical and 38 are rated Important, 1 is rated Moderate and 1 is rated as Low in severity. The updates address Remote Code Execution, Tampering, Security Feature Bypass, Information Disclosure and Denial of Service.  The release consists of security updates for the following software: 

  • Internet Explorer
  • Microsoft Edge
  • Microsoft Windows
  • Microsoft Office and Microsoft Office Services and Web Apps
  • SQL Server
  • ChakraCore
  • .NET Framework
  • .NET Core
  • ASP.NET Core
  • Adobe Flash


    Known Issues 4056890 4056891 4056892 4056893 4056888 4056895 4056898 4056894 4056897 4056896 4056899


    Important:  Because the out-of-band security update for "Meltdown"/"Spectre" requires the setting of a registry key and not all antivirus software has been updated to include the key, Microsoft updated Important: January 3, 2018, Windows security updates and antivirus software to include the following Note: 
    Note: Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key:
    Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" Value="cadca5fe-87d3-4b96-b7fb-a231484277cc" Type="REG_DWORD”
    Data="0x00000000”

    If your computer has not received the security update, check the status at CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754 (Meltdown and Spectre) Windows antivirus patch compatibility. In the event both "Sets registry key" and "Supported" are not both indicated with the letter "Y", Bleeping Computer has created a .reg file that can be used to create the registry.  However, it should only be used if your antivirus vendor has indicated that a manual install is needed.  For in-depth information, see the Bleeping Computer articles Microsoft Says No More Windows Security Updates Unless AVs Set a Registry Key and How to Check and Update Windows Systems for the Meltdown and Spectre CPU Flaws.

    Further note that some AMD devices are getting into an unbootable state after installing the "Meltdown"/"Spectre" security update. As a result, Microsoft is temporarily pausing sending updates to devices with impacted AMD processors at this time. Further information is available at Windows Meltdown and Spectre patches: Now Microsoft blocks security updates for some AMD based PCs.

    More:  For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

    Also see this month's Zero Day Initiative — The January 2018 Security Update Review by Dustin Childs in which he discusses several of the patches and lincludes a breakdown of the CVE's addressed in the update. 

    Additional Update Notes

    • Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above.
    • MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
    • Windows 10 -- A summary of important product developments included in each update, with links to more details is available at Windows 10 Update History. The page will be regularly refreshed, as new updates are released.

    References


    Remember - "A day without laughter is a day wasted."
    May the wind sing to you and the sun rise in your heart...