Category: Blog

Royal Wedding viruses hit users

With the royal wedding in full swing here inthe UK, many internet users are searching the latest news, gossip and videos for information.  Unfortunately, we have seen a lot of PCs passing through our repair departments riddled with spyware, viruses and Trojans caused by downloading software that comes from dubious sources.

Royal wedding hoax alerts

The malicious links we have found have so far been marked “William and Kate live interview”, “Royal Wedding called off”, “UK Royal Wedding free programme”, “Kate Middleton Wedding Dress virtual tour” and “Bomb alert spoils royal wedding plans”. There were even less tasteful ones such as “Kate Middleton injured in terrorist attack” and “Sniper attack on Prince William” which, when clicked, both took us to sites proclaiming to have exclusive video footage of the hoax events. Some even more graphic titles are best not repeated here….

 

The remedy for trouble-free royal wedding coverage online?

Don’t believe all you read and stick to major news sources such as bbc.co.uk or news.sky.com

Arm yourself with a fully featured internet security package that alerts you about possible threats from webpages and uses search filtering to avoid malicious webpages.  Don’t download programmes and guides unless from official sources.

 

W3 total cache security and performance issues

There have been a lot of problems recently with this popular WordPress plugin. Many users report that W3 Total Cache was having some serious security and performance issues

Fortunately, it’s still actively developed and there is a new version of W3 Total Cache available for download or auto-update within the WordPress admin console. Here’s a look at what version 0.9.2.7 has to offer:

Fixed config file write in more hosting environments
Fixed legacy config file import on servers with hardened file permissions
Fixed page cache write cache rules in some environments
Fixed retina images
Fixed false positive notifications when permissions are not changed or same
Fixed minify help
Improved upgrade notifications
Improved page cache and minify notifications

This is what version 0.9.2.6 added and fixed:

Added support for grouping cache entries for easier flushing
Added more options for placing minified files on pages. Custom placements using HTML comments.
Added CSS inclusion for auto / manual minify. If present its used:
Added JS inclusion for minify auto mode. If present its used: ,
Added JS inclusion for minify manual mode. If present they are used when selecting correspong location in placement dropdown: , ,
Added new minification inclusion options, async, defer, extsrc and asyncsrc
Added flushing sitemaps
Added flushing custom pages
Added flush the current blog when flushing in MultiSite
Added flushing home page and/or post page if static
Added flushing older pages (page/2, page/3) on purge requests
Added flushing a limited amount of pagenumbers
Added purging caches for deleted blogs in WordPress MultiSite
Added uninstall process to the plugin for easier cleanup
Added upgrade support that cleans up and removes old cache folders
Added message when disk enhanced page caching is not working properly
Added custom wp-content name and locations
Added CDN feature “Dont use CDN for specific roles”
Added “Purge from cache” link on edit post/page pages
Added permalink suffixes (.html, .htm etc)
Added uploading blogs.dir files when using MultiSite and CDN
Added notification about IAM when using Amaz services (SNS, CloudFront, S3 etc)
Added ‘Don’t minify JS files’ ‘Don’t minify CSS files’ options for minify
Added Access-Control-Allow-Origin support for CDNs
Added hooks clean_post_cache and menu changes
Added caching JSON mime-type. Other mime-types can be added using array filter ‘w3tc_is_cacheable_content_type’
Added automatic reloading of config files when APC apc.stat is disabled
Added request reload of APC file over HTTP
Added priming of post on publish
Added single config file (by default) when using WordPress MultiSite
Added switch_to_blog() support
Added wp_cache_decr, wp_cache_incr support
Added wp_cache_switch_to_blog support
Added fragment caching functionality that extends the transient caching methods in WordPress core
Added network activation and network policy management
Added control for comment cookie lifetime
Added Go Daddy SUBDOMAIN_DOCUMENT_ROOT directive support
Added JSON to mod_deflate configuration
Added JavaScript mime-type variations to mod_deflate configuration
Added WP-CLI support for purging cache, purging pull CDNs, reloading APC files, clearing APC, deleting pgcache files, and updating browser query string
Added .htc mime type
Added Rackspace CloudFiles container location selection
Added rejected terms in database cache, to allow for deeper database caching capability
Added Akamai CDN origin pull support
Added system cache purge when apc.stat is disabled
Added origin rel canonical support for CDNs
Added AT&T origin pull CDN
Added full-page mirroring and purging for origin pull CDNs
Added compatibility mode improve disk enhanced page caching performance ~20% for users that don’t care about interoperability
Added nginx example files
Added varnish example files
Added basic application monitoring support using New Relic
Added application monitoring widget using New Relic
Added plugin dashboard page to display widgets etc
Added purge from cache link to admin bar dropdown while browser posts/pages on front-end
Added purge CDN completely link to admin bar dropdown
Added CDN SSL checkbox “Disable CDN on SSL page”
Added pull CDN support to MultiSite
Fixed caching of the “Front Page” and added an option for the same
Fixed w3_url_format function was not included error
Fixed security vulnerability with file cache: disk basic page caching, database or object caching to disk. CVEs: CVE-2012-6077, CVE-2012-6078, CVE-2012-6079
Fixed issue with concurrent writes to single config file
Fixed Preview mode and deploy button
Fixed varnish purging (See varnish config example file in ini folder)
Fixed false positive notification on Page Cache: Disc Enhanced
Fixed broken images for feedburner in dashboard on HTTPS sites
Fixed minify ID generation causing notices
Fixed false positive on minification related to group configuration among other
Fixed default wp-content path and CDN uploads when WordPress is installed in directory
Fixed pages not flushing when making changes in WordPress Admin
Fixed mod_filter being used on unsupported Apache versions
Fixed WordPress upgrade issue caused by W3TC remaining active
Fixed minify path when using WordPress MultiSite and blogs in sub-directories
Fixed user interface for “Dont cache specific roles”
Fixed CDN and minify to file for storage
Fixed feed_link filters interferring with feed purging
Fixed false positive with minify rewrite test and WordPress MultiSite sub-directory mode
Fixed WordPress Multisite in sub-directory mode and minify paths
Fixed caching posts page when using static home page
Fixed object cache not being initialised before getting options
Fixed locating document root for minify in certain environments
Fixed saving settings if permalinks are turned off
Fixed “Install” page displaying rules that is not required
Fixed minify cache being empty while page is cached so no minified files are generated, minified files auto generation no longer depend on pages not being cached
Fixed unnecessary flushing with SSL, user agents and referrer not being activated
Fixed “Purge from Page Cache” not purging varnish or CDN when enabled
Fixed CSS minification and relative paths in external files
Fixed login / logout and compability with BuddyPress
Fixed flushing same posts many times if status is trashed or restored
Fixed handling of .html fancy permalinks with nginx
Fixed handling of missing xcache opcode cache
Fixed Amazon S3 allowing LIST permissions to everyone
Fixed handling of .xml mime type
Fixed numerous object cache compatibility issues
Fixed memcached port support issue
Fixed HTTP_HOST not defined warning issue
Fixed xdebug not configured halt issue
Fixed minified files not being mirrored by push CDNs
Fixed uploading to CDNs multiple times even if force overwrite is disabled
Improved CloudFlare support: purging, dev mode, minification options, automatic IP range updates, rocket loader feature, security levels
Improved support for the Bad Behavior plugin
Improved object cache and MultiSite compability
Improved flushing behavior with better post and pages detection. To change behavior hook into filter ‘w3tc_flushable_post’
Improved XML user interface when using Page Cache Disc: Enhanced
Improved minify filename path generation
Improved minify custom placement usage
Improved PHP 5 compability by removing deprecated functionality
Improved WP 3.4 and 3.5 compability by removing deprecated functions usage
Improved plugin by removing unnecessary ob_starts
Improved minify usage by returning old minify files while generating new
Improved update procedure by removing need to manually deactivate and reactivate plugin
Improved CDN paths and URL generation using both single and multisite installs
Improved Admin Bar menu with more flushing actions
Improved minify auto by adding support for downloading and combining external files
Improved descriptions for various “Do not cache …” textareas
Improved header settings so plugin header settings override WordPress default header where appropriate
Improved debug logging by adding a debug folder constant: W3TC_DEBUG_DIR
Improved support for WPTouch plugin
Improved custom post type support and flushing
Improved cache key format and handling
Improved minify support on Windows
Improved purging functionality for CDN providers
Improved compatibility wp-fb-autoconnect plugin
Improved support of WordPress installed when in a sub-directory
Improved support of non-default WordPress folder setups
Improved use of HTTP API and FileSystem API in WordPress. HTTP API usage improves minify and CDN functionality. FileSystem API integration improves activation, deactivation and configuration changes
Improved execution time across all caching engines
Improved cache miss performance for page caching
Improved notification handling
Improved cache priming algorithm
Improved minify error reporting
Improved varnish purging capability
Improved memory caching logic and purging speed
Improved support for auto minify in more hosting environments
Improved support for use of sockets in memcached
Improved handling of old settings upon update
Improved detection of document root on additional hosting providers
Improved handling of eTags
Improved browser cache policy options
Improved bug submission form implementation
Improved NetDNA / MaxCDN support by using their new API
Disabled minify if CloudFlare is active
Removed PHP 4 support
Removed cookie used for user agent groups unless the feature is used
Removed cookie used for referrer unless the feature is used

Quite a few of my clients reported slowdowns that were attributed to this plugin, which is a shame because in general this plugin can take static WP sites to much faster page load times. In 90% of cases, a simple update resolved their issues, so it’s worth doing if you are having slowdowns that you can’t find the reason for.

Personally, I always remove any caching plugin and htaccess code before attempting to diagnose slowdown or instability issues as it often masks or compounds server and code problems.

Let me know below if you have any issues that W3 caused or that you managed to resolve.

Removed duplicate inclusion of JSON library

Change Windows startup sound to a voice

Change windows startup soundYou know in all those futuristic films where computers speak to their owners? Ever wondered if you can actually get yours to welcome you in this way? Well let’s have a go at doing this and see what we can use it for.

This should work on Windows from XP upwards. If you have security settings a bit high then running scripts may be an issue but it won’t hurt to try this.

Click on Start > All Programs > Accessories > Notepad

In the notepad window, paste the exact code below:

Dim speaks, speech
speaks="Welcome PC Repair Man, what can I do for you today"
Set speech=CreateObject(“sapi.spvoice”)
speech.Speak speaks

Obviously once you have this working, you’ll replace the text with your own!

Save as startmessage.vbs. You can rename this file to anything you like but keep the .vbs on the end. If you can’t see the .vbs then you really should turn on file extensions, it helps you to identify files. Turn on your speakers then double click this file to see if it works.

Copy the saved file and paste it into the following folders (I’m presuming that C is your Windows drive, most are):

  • For XP users: C:\Documents and Settings\All Users\Start Menu\Programs\Startup (in Windows XP)
  • For Windows 7 and Windows Vista: C:\Users\ User-Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

When you next start your computer, it will welcome you!

NOTE: I’d suggest you don’t turn off the Windows startup sound, it’s best to keep the rest of the system as-is.

To remove, simply delete or move the startmessage.vbs out of your startup folder.

Want to trick a friend? Create a personal message and drop it into their startup folder. Watch as their computer reminds them of something they’d rather not be reminded of like “Hey John, bad luck on the driving test” or “Is that a pimple on your nose, Lucy”.

Don’t be evil, or if you do, don’t tell them it was me that told you how to do it….

 

iPhone 4 signal reception problems

iPhone 4 signal reception problem antenna

A pair of dissatisfied customers have filed a class action lawsuit against Apple.  This is because of signal reception problems in the iPhone 4.  More will doubtless follow.

Since the arrival of the latest iPhone Apple’s new baby has been plagued with reports of reception problems.  Apple has even made the terrible mistake of telling users to hold the device differently…..OOPS!

Under the sale of goods act, customers left with a device that cannot be used for its intended purpose are entitled to a full refund.

Kevin McCaffery and Linda Wrinn from Maryland USA filed the complaint against Apple and also AT&T.  They accuse the firms of negligence, defective design and manufacture, breach of warranty, fraud by concealment and deceptive trade practices.

Here’s a summary of the filing:

“Plaintiffs were sold defective iPhone 4 units, which drops calls and data service when held in a manner consistent with normal wireless phone use.”  “Plaintiffs have experienced numerous dropped calls, and as a result, plaintiffs are left with a device that cannot be used for the normal purpose and in the normal manner in which such devices are intended to be used.”

Unlike the US, Apple stores in the UK do not charge a restocking fee and the filing states that the plaintiffs have been “unable to return the phone without incurring a substantial restocking fee”.

Bad publicity like this often hurts sales and the US media have been quick to pickup on this.

I’d love to see the iPhone 4 with its bugs ironed out as quickly as possible as it is making goood headway in innovation, design and style for the mobile market.  As usual, it’s the early adopters getting their fingers burnt…..

[phpbay keywords=”iphone” siteid=”1″ sortorder=”EndTimeSoonest” templatename=”default” paging=”true”]

Stephen Fry on copyright and piracy

Stephen Fry speaks out on piracyI was quite amazed to hear Stephen Fry, one of England’s more prominent figures in the media, talking openly about copyright and piracy. Like him or loathe him, he seems to be doing a lot for the electronic industry and his comments often make sense of confusing situations and grey areas.  Here’s an audio snippet of his views about copyright, eventually leading to the adage that we have all pirated something at some point in time. Not strictly true for many people but not far off for most PC users I visit.

https://youtu.be/nAXKrp8N-AM

I believe that the industry DOES need a shake up (should that read “wake up call”?) and agree that using initiative and modern free delivery mediums can spark sales and growth, but is that within the grasp of most people? Imagination is one thing but I wonder if that may be stifled when the artist or performer requires major funds to create viral campaigns and shameless self-promotion.

 

The above image of Stephen Fry is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported license.

 

Minecraft suffering DOS attacks from hackers

Minecraft servers hacked by DOS attackMinecraft, the multiplayer, block-destroying game has had a serious DOS attack. Although as yet unproven, it is believed to be the work of the hacker group ‘Anonymous’.  The servers did go down but are currently back up and running.

Another group, LulzSec, have been finger-pointed too and they are now taking ‘site hacking requests’!  Their recent attacks include EVE Online and The Escapist amongst others.

Minecraft official release date

Minecraft’s official release date is currently November 2011. It is only available as a beta version until then.

 

LastPass hack causes password problems – offline mode suggested

LastPass has been subject to a serious hack attack. If you are getting errors where LastPass cannot log you in then your first step is to attempt a login via the plugin AND via the website immediately afterwards.

LP stated that significant traffic had left one of its primary servers – traffic that could have included the users’ email addresses, server salt and salted password hashes. Whilst this is often normal, LP couldn’t track down the root cause and elevated this to a high risk level.

As news filters in of the attack, people with LastPass accounts are hitting their servers trying to change their passwords. This is putting a huge strain on the LastPass servers and consequently they are trying to reduce the load while trying to keep security at a maximum.

You should change your LastPass master password if it is not a very secure one immediately. By not secure I mean anything from the dictionary or common passwords like Letmein, L3tM3In, abc123, pa55word etc. The reason for this is that the breach of LastPass’s security systems allowed an attack that could potentially “reverse” the encrypted password stored and generate your password to the attacker. This type of ‘brute-force’ attack works quickly on weak passwords but takes, months, years even decades depending on the complexity of a password. The best type of password contains a mixture of capital letters, numbers, non-alphabetical characters (!, *, $ etc) and is a minimum of eight characters in length.

LastPass have been proactive in this and immediately owned up to the event which I believe is admirable. The fact that they didn’t email every user is a failure though, even if they simply pointed people towards their website with an explanation.

For me, if the system has been breached and the cause unknown, asking for password changes is a very dubious course of action. LP have now changed the method so that you can temporarily authenticate a PC via an email link.

With some users getting a message like “Your account settings have restricted you from logging in from this mobile device.” they have had to resort to exporting contacts and deleting/recreating their LastPass account.

Comments?

Royal wedding Google Street View icon

To celebrate William and Kate Middleton’s royal wedding, Google showed its sense of humour and showed this Street View icon which is normally a little man. The new, temporary icon reveals a miniature bride and groom and gives particular attention to detail on even the most mundane of icons.

You have to admire Google’s persistence at making the web a fun place to be.  Their ever-changing search logo also provided this cleverly illustrated design below. You have to look hard to see the word “Google” but hey, artistic impression and all that….

Akismet charges for access to its anti-spam API

Well, many people will be surprised to hear that Akismet is now charging for accessing its anti-spam database. Lots of users will disagree with the way Akismet handled this too. Bundled with WordPress, all you had to do was create a free account to get your API key. This worked across multiple sites and was pretty seamless.
Now a charge (currently $50) is levied for businesses and affiliate sites. Furthermore the free accounts are throttled with traffic priority going to paid-up subscribers. This from their website:

Free account

If your site is for a business, or if it promotes a product or service, you should pick from one of our paid account options.

Hmm, create a free tool, get subscribers then levy a charge. Whatever way you look at this, it’s going to be big business for Akismet with hundreds of thousands of people ready to subscribe.