Ars Technica reported that the hurry-up fix delivered on 8/30 for Java to address a slew of vulnerabilities reported by Polish infosec firm Security Explorations– namely, Java version 7 update 7 — itself remains vulnerable to possible e-mail or Web-based attacks. As with the previous round of vulnerabilities, the latest discovery also confers complete control over PCs should a successful exploit be launched against this vulnerability. Needless to say, Security Explorations is NOT sharing the exploit details with the general public, for fear that malefactors could turn this vulnerability into a successful exploit in the meantime.
When I reported the initial circumstances that led to Oracle’s hurry-up release of Java version 7 update 7 in my blog entitled “Possible Java Exploits Can Expose PCs to Attack,” I got an e-mail from a very close but not terribly tech-savvy friend who informed me that it’s all well and good to tell readers to disable or uninstall Java, but it’s even better to provide some step-by-step instructions on how to do these things. I did advise readers only to enable Java on trustworthy sites, so I will explain here how to do the following:
(a) how to assess site trustworthiness
(b) how to disable (and re-enable) Java in IE, Chrome, Firefox, and Opera
How to Assess a Site’s Trustworthiness
This is actually pretty easy. You need only use a Web reputation site of some kind to check out any unfamiliar URLs before you go to visit any associated Web pages. For example, here’s McAfee’s rating of the site “Java.com” whence all Java updates come:
You can jump to any of these links to check Web reputation for sites you don’t already know and trust: TrustedSource (McAfee), Web of Trust (WOT), the Trend Micro Site Safety Center, BrightCloud Webroot Reputation Index (Webroot), and the Norton Safe Web (Symantec), among many others. Such checks are highly recommended if you’re jumping anywhere off the well-trodden Internet path to big-name company and information outlet sites.
The only sure-fire way to completely disable Java is to uninstall it. One way to do that is to click Control Panel, Programs and Features, then right-click Java 7 Update 7 (or whatever version you might be running) and select “Uninstall” from the resulting pop-up menu. If you don’t have Java on your PC, it can’t be used against you, either.
But alas, some sites require Java to work properly (including some of my favorites, such as DriverAgent.com) so it may be necessary to turn Java on and off depending on where you plan to take your browser at any given moment. Here are abbreviated instructions for various browsers with links to more detailed (and illustrated) tutorials for those who might need them:
1. Internet Explorer: Click Tools (you may have to turn on the Menu Bar to make this selection visible), Manage Add-ons. then select the Java Plug-in, and click the Disable button. Click Close and OK to accept this change. Reverse the process (Enable) to turn Java back on. Tutorial.
2. Chrome: Type chrome://plugins into the URL address box, then click the Disable link in the Java entry area. Tutorial.
3. Firefox: Click Tools, Add-ons, Plug-ins, then click the disable button to as many Java-related entries as appear (in my browser this was Java Deployment Toolkit and Java Platform; YMMV). Tutorial.
4. Opera: Type opera:plugins into the URL address box, then disable any and all Java plug-ins you may find there (as with Firefox, you’ll often find both the Java Deployment Toolkit and the Java Platform; disable both). Tutorial.
Hopefully, this will help people not only hear the word about Java and spread it further, but also to act on the best methods to turn it off or disable it as circumstances may dictate, or allow.
Earlier this week, I blogged about how Samsung is restoring a Start menu capability to its Windows 8 PCs. I also mentioned (and implicitly recommended) the Start8 startup replacement that returns the traditional Start button to the Win8 desktop and gives users the option to boot straight into the desktop if they so choose. Now that I’ve worked with Start8 for a while, I’ve decided I don’t like it very much. A quick set of visuals will explain why:
Good: Return of the Start Button
And there it is, back again: the old familiar start button as seen in earlier Windows versions. But when you click that button, here’s what you’ll see:
Bad: Back to the Windows 8 (Metro) Start Screen
When I click a Start button, I want to see the old familiar Start menu, not the Windows 8 Start screen which, despite its many visual charms, provides no easy and reliable way for me to launch programs (or Windows utilities) whose names don’t pop up readily when using obvious Search items.
Introducing Classic Shell
As I was reading the hilarious recitations of the encounter between Obi-Vaughn (Steven J Vaughn-Nichols) and Darth Perlow (Jason Perlow), both of whom debated Windows 8 versus Linux on desktops recently, I came across a reference to a SourceForge project named Classic Shell that Perlow off-handedly recommends. Here’s what it looks like from an icon perspective on the desktop:
Indisputably, the Start Icon looks different from its traditional namesake, what with a clamshell-shaped outline instead of simple circle. But what I like about this tool is that it lets you choose a traditional (pre-Windows XP), an XP, or a Vista-7 Start menu look and feel, and then proceeds to deliver what it promises. I chose the Windows Vista-7 variation and am very happy with what resulted, not just in terms or look and feel but also in terms of behavior. I’ll illustrate by showing its Program menu capabilities:
It’s not just what I can use to navigate through the hierarchy of installed items and programs that makes me recommend this program. It’s also the return of the Search box, and more-or-less expected access to typical Start menu items from previous Windows versions.
I’m neither afraid to access nor ignorant of the ways and wiles of Windows 8 “native navigation.” I’ve read rants from others like Peter Bright of Ars Technica, who assert that Start menu replacements are crutches and will retard learning and getting comfortable with Windows 8, and agree to a certain extent that users shouldn’t simply ignore the new-fangled features of Windows 8 altogether. But when I’m working on the desktop — which I do 90+ percent of the time — I don’t want to keep having to jump into the tiled modern/Metro interface just to launch new programs or move from one program to another. That’s what makes Classic Shell valuable to me, and will help me be more productive with Windows 8. If you try it, you may feel the same way, too.
Quick: visit http://www.isjavaexploitable.com/ on any PC close at hand. There are a number of Java exploits rampant in the wild at the moment, so you’ll want to see a resulting screen that looks like this if you do have Java installed:
On the other hand, if you don’t have Java installed, you’ll see something like this:
But if your installed version of Java is vulnerable to the latest zero-day exploits, you’ll see the following warning instead:
What to do if one or more machines shows up as vulnerable? Turn off Java is the safest and simplest response. Instructions for all major browsers are posted on the KrebsOnSecurity site associated with metasploit. This is a bona-fide zero day exploit folks, and may require immediate action!
Note: After a heckuva hullaballo, Oracle posted Version 7 Update 7 for Java today (8/30/2012) and it fixes all of the vulnerabilities that isjavaexploitable can detect. Visit www.java.com/getjava/ to update yours immediately! Now, the only open questions are: 1. Have all 19 vulnerabilities that Polish company Security Explorations reported to Oracle on April 2, 2012, been fixed? and 2. Have the remaining 10 vulnerabilities that they further found and reported after that date been fixed as well? I certainly hope so, but you’ll want to keep an eye on this situation, and read Lucian Constantin’s excellent Computerworld story from August 29 entitled “Oracle knew about zero-day Java vulnerabilities for months, researcher says” for more information, and an explanation as to why I remain to be fully convinced that all the exposures have been handled.
Preston Gralla writes a great blog for Computerworld entitled “Seeing through Windows.” That title can, of course, be interpreted in more than one way — and so very often can his blogs — and those are just some of the things I like about his work. In an 8/28/2012 posting entitled “Samsung Weighs in on Windows 8: Users need the Start button,” Gralla describes three Samsung desktops (all-in-ones, actually) planned for Windows 8, all of which include an optional Start button.
Quoting from an AP report entitled “Samsung previews its 3 Windows 8 desktop computers,” he pulls a fascinating quote that reads as follows:
“In an effort to minimize the potential frustration caused by Windows 8’s new look, Samsung built its own optional start button that can be used to pull up a menu of applications.”
Interestingly, it looks like PC vendors will have a chance to remedy one of the biggest user and pundit complaints about Windows 8 — namely that it lacks the old familiar Start button found in every Windows version since 95, and missing in 8 in favor of the Modern (“Metro”) UI screen instead. I wonder how this capability will differ from Stardock’s free Start8 functionality: this tool puts the old familiar Start button back on the toolbar, but doesn’t offer a set of pull-down menu for all installed non-Metro programs. Instead it throws up the Windows 8 Start screen in a more contained format. It will be interesting to see what Samsung — and possibly also, other vendors — offer up to compensate or correct for this all-too-common Windows 8 complaint.
As is so often the case, after I upgraded from Windows 8 RP to RTM, I had a few drivers to clean up on each of my test machines (right now, they include a Lenovo X220 Tablet and a home-built desktop with an Asus P8Z68-V Pro Gen3 mobo, i7-2600K CPU, 32 GB RAM, and so on). On the RP version, DriverAgent gave me a clean bill of health for each OS before I started the upgrade process to Windows 8 Pro RTM, and left me with three drivers in need of update on the Lenovo notebook and four drivers on the home-built desktop machine.
In both environments, Bluetooth proved the most challenging element to find and fix. I was unable to install the recommended Fujitsu driver on the X220 without first unpacking the contents of the recommended ZIP file, then using Device Manager to forcibly update the drivers using the old, familiar “Update my driver” and “Browse my computer for driver software” menu progression for the affected device on that machine. The same approach didn’t succeed on my Asus homebrew box, because I ran into software compatibility problems simply trying to run the self-installing executable that DriverAgent said I needed for that machine. I used the technique of clicking the left-hand icon on the device line in the DriverAgent scan to see what else was available to me, as show in this screen capture:
With the second software/driver combination I was able to install a working Bluetooth environment on my desktop PC, and jump the driver currency hurdle in DriverAgent for that machine, as this scan display header attests:
On to the next tangle…
With drivers now finally subdued, I used Secunia Personal Software Inspector (PSI) to check software status on the two Win 8 Pro RTM machines. A quick Chrome and Adobe component (Flash, Shockwave, and Air) quickly got the Lenovo X220 Tablet whipped into shape, but I have to chase another chimera with Adobe Flash on the desktop machine. PSI tells me I need a new 64-bit version of the ActiveX Flash Player (it sees that version 11.3.372.94 is installed). But when I try to perform the auto-update, by accessing get.adobe.com/flashplayer, I get this very interesting error message from the site instead of an auto-update:
But when I try to install the standalone installer for Flash version 11.4.402.265 I get an Adobe error message that reads as follows: “Your Microsoft Internet Explorer browser includes the latest version of the Adobe Flash Player built-in. Windows Update will inform you when new versions of the Flash Player are available.” It also provides this explanatory screen:
On the one hand, we clearly see a new version is available, on the other Adobe won’t let me install it, and MS isn’t pushing the latest version through Windows update yet. Even running the Flash uninstall utility, I wasn’t able to force IE 10 to drop the old version and prepare the ground for the new one. I’ll just have to wait and see what happens with this, and live with the older Flash Player version in the meantime, I guess…
As this snippet from Peter Bright’s Ars Technica story from yesterday illustrates, Microsoft’s replacing the corporate logo it’s used for the past 25 years.
I’m not the only one who’s noticed its resemblance to the Windows 7 logo, albeit in “non-wavy,” unshaded rectilinear form. Many other pundits and observers have noted the similarity of colors in the four logo blocks above to the Win7 flag’s layout and position.
It’s very interesting that as the Windows 8 logo adopts a monochrome blue color scheme and a rectilinear layout, the Microsoft logo picks up the rectilinear motif, but drops its “perspective view,” at the same time preserving the four-color theme from Windows 7.
What’s it all mean? I wish I could say for sure, but it does seem to suggest continuity with the Windows brand, while shaking up the established order for something new and different.
Here’s my first report on experiences with Windows 8 Pro RTM, in the wake of two successful upgrade installs: one on my Lenovo X220 Tablet, the other on my i7-2700K.
First things first: Mr. Denny’s tip on modifying the
cversion.ini file in the
.../sources directory in the unpacked ISO files is a gem. I was indeed able to use a modified ISO-based image for Windows 8 Pro to perform an upgrade install on my Windows 8 Release Preview install, and preserve my already-installed applications and tools, as well as settings and preferences while installing the latest and final version of the OS on my Lenovo X220 Tablet and my i7-2600K desktop PC. As you might expect, the installation takes a while longer (over half an hour) when you have various installed elements to port over from an old OS to a new one. I grabbed the Windows 8 Pro ISO from MSDN on Tuesday, and then used the Windows 7 USB DVD Download tool to convert that ISO to a writable install image on an 8 GB UFD (I tried a 4 GB UFD, and the copy process failed to complete properly, so you’ll want to go 8GB or larger). A quick edit to the aforementioned file, and everything worked as I expected it to.
The post-install aftermath came with a couple of unexpected and interesting side effects. I figured the Windows 8 RP drivers would port to Windows 8 RTM without a hiccup, but I figured wrong. For one thing, I had issues across the board with Bluetooth. Before the installer would let me proceed with the Windows 8 Pro install on my desktop, which includes an Asus P8Z68-V Pro Gen3 motherboard with built-in Qualcom Atheros BT circuitry, it required me to uninstall the Asus BT GO! Bluetooth software, citing incompatibility issues with that software. And so far, I’ve been unable to find a replacement BT software suite to run with this motherboard, either. That said, the built-in Windows Bluetooth utilities — namely Add Bluetooth Device, Change Bluetooth Settings, View Devices and Printers, and Set up a connection or network — all work properly with the default driver that Windows 8 Pro RTM installed on that machine. Likewise, I’ve been unable to install and use what DriverAgent insists is the latest and greatest Bluetooth driver on either machine, so there’s something wonky going on with BT that I’m still puzzling my way through.
On the Lenovo X220 Tablet, four drivers needed updating after I upgraded from Windows 8 RP to RTM:
- Intel HD Graphics 3000: I was able to grab and use a Fujitsu driver (they seem to be doing a very good job of keeping up with Windows 8 drivers, and I’ve learned to trust them as a source for solid, stable Windows 8 driver software). But my Windows Experience Index value for this graphics circuitry dropped from 5.1 in Windows 8 RP to 4.6 in Windows 8 Pro RTM.
- Intel 82579LM GbE Network Connection: another Fujitsu driver to the rescue here, thanks very much.
- Intel Display Driver Audio: still one more Fujitsu driver, and thanks again.
- Bluetooth: haven’t yet been able to crack this nut, even using the Fujitsu driver. Instead of a successful install, I get the following error message window, even if I use the Program Compatibility Troubleshooter and try it with various XP, Vista, and Windows 7 settings as well:
I imagine I’m just going to have to wait to get these matters resolved, as Asus and Lenovo (and probably also, the Bluetooth technology vendors such as Qualcom Atheros, Broadcom, and so forth) get their heads around the underlying issues and start to issue newer drivers and software tools for their Bluetooth devices.
Some other observations based on my two days’ of experience with the new OS include:
- Boot-up and shutdown are noticeably faster on both machines as compared to the RP version
- The Aero-free desktop is pretty clean, and easy to work with
- Switching between Windows 8 GUI (the UI formerly known as Metro) and the desktop is easier than before, thanks to easier access to the Start screen by “cornering the cursor” (moving it into the nearest corner on your screen)
- Desktop Gadgets are indeed gone, gone, gone (searching for “Gadget” through the Start screen turns up 0 Apps, 0 Settings, and 0 related Files).
- Gabe Topala’s Siw-x64.exe (the temporary version he produced for Windows 8 beta users) quits working in the RTM version. So far, no news on a replacement 64-bit commercial version for Windows 8 x64 RTM and final versions, either.
- All of my applications still appear to be working: I haven’t made an exhaustive survey of everything yet, but every program I’ve tried has continued to work without issues (except for the Bluetooth stuff the installer asked me to uninstall before I continued on with Windows 8 Pro installation, but since it’s not installed anymore, I can’t exactly try it out — and it won’t install on Windows 8 Pro, either).
My final comment on where things stand is “So far, so good.” I’ll continue to follow up as more things present that appear worthy of reporting and discussion.
Thanks to SQL Server blogger Mr. Denny right here on ITKE, I have a great trick to share with readers who want to upgrade their Windows 8 Release Preview installs to the latest RTM version now available through MSDN, TechNet, and other sources. This blog post of his is entitled “Upgrading Windows RP to RTM” and covers the complete set of actions required to achieve this eminently laudable goal, step-by-step. Apparently, the whole exercise hinges on the contents of a file named
cversion.ini that resides in the
<drv>:\sources\ directory (where <drv> is the drive letter for the UFD onto which you’ve unpacked the Windows 8 RTM install ISO image). I’m guessing that the number that appears in this file usually matches up to whatever release number attaches to the version of Windows installed on your PC. For Windows 8 Release Preview that’s 8508.0. But by changing the number to 7100.0 (a number that corresponds to a version of Windows 7 , though my Windows 7 with SP 1 installed shows up as 7601 when I run the
winver command) you can fool the installer into performing an upgrade install to bring your version up to the RTM version without demur.
Fantastic! Having been out on vacation this past week with family, I plan to try this out later today, as soon as I finish downloading the latest Windows 8 RTM ISO from MDSN.
[Note: Copy added 12:14 PM CST Tuesday 8/21/2012]I’m installing the new OS right now. Without editing the cversion.ini file on the install UFD, I couldn’t access the upgrade option on my Lenovo X220 Tablet. But after editing the UFD as Mr. Denny suggested, the upgrade install is steaming along on that machine quite happily right now. When it finished, I’ll do the same for my home-built i7-2700K desktop and see how that works. Tomorrow, I’ll blog about my upgrade experiences. Stay tuned!
The ongoing Metro flap continues. Yesterday, Mary Jo Foley posted a story entitled “Microsoft: Don’t call it Metro. Call it ‘Windows 8.’” She suggests that the whole dust-up is intended to resolve a naming dispute with a German retailer (and Microsoft partner) named Metro AG. So, from now on anyplace you’ve seen Metro, you’ll now see Windows 8 popping up. Thus anything once called “Metro-Style application” (which sometimes appears without the hyphen) is to be called “Windows 8 application.” Likewise for “Metro Design;” it’s now “Windows 8 design.” She also points to a new promo page from Lenovo for its Windows 8 Thinkpad Tablet 2 that makes use of the new terminology in a bullet that refers to “Desktop and Windows 8 Apps.”
There’s still some apparent confusion within the MS ranks, though: earlier this week the Windows 8 app developer blog featured an entry entitled “Building your own Windows Runtime components to deliver great Metro style apps.” It will probably take a while for this new official word to percolate all the way through the organization and for the necessary string substitutions to take effect globally. Foley also speculates that the same rules will affect Windows Phone as well, itself due for a version 8 of its own software.
Others have speculated that terms such as “Modern UI Style” might possibly replace Metro (Tom Warren, The Verge). Apparently, MS used Modern in connection with the new interface as far back as January 2011, as documented in this article from Paul Thurrot. Who knows? In this rough-and-tumble world of Windows, anything is possible! That said, you can be sure MS won’t call it “Old-fashioned,” “Frustration,” or “No More Start Menu!”
There’s been enough hoopla and unhappiness about the Windows 8 tile-oriented user interface known until now as Metro, that MS has apparently decided to kill the name and call this GUI something else entirely. Too bad I haven’t yet laid hands on the RTM code for Windows 8, because I’d love to find out if the M-word shows up in that version of the OS. On August 2, Mary Jo Foley of ZDNet reported that “…I’ve been hearing from a number of my contacts that Microsoft is trying to slow, if not halt, internal and external use of the term ‘Metro.'” She also produced this marvelous quote from a Microsoft spokesperson about Metro: “We have used Metro style as a code name during the product development cycle across many of our product lines. As we get closer to launch and transition from industry dialog to a broad consumer dialog we will use our commercial names.” Very interesting, and even more interesting is the follow-up work that Ed Bott documents in his recent article entitled “Cleaning Up Microsoft’s Metro Mess.”
Ed performs some fascinating text analysis on the MS corpus, to produce the following information on Metro mentions therein:
- Steve Ballmer mentioned Metro as “our featured attraction” in his 2012 CES keynote address, and then went on to mention the name 27 times in that presentation.
- Microsoft has been encouraging developers to build Metro style apps since 2011, until the end of last week (August 3).
- Microsoft even posed a Windows Metro Style App Challenge to students enrolled in accredited college-level programs.
- He provides a link to a page in the Windows Dev Center entitled “White papers for Metro Style apps” that includes over a dozen entries, plus links to other materials.
- He points to language in the App Developer Agreement that makes repeated references to Metro Style Apps as such, and also points to sessions for MS’s Public Sector Developer Weblog for sessions at a Tampa, FL, DevCamp Public Sector Series, 7 of which use the word “Metro” in their titles.