WordPress 3.0.4 security fix

WordPress founder Matt Mullenweg is advising all self-hosted WordPress users to apply the update to 3.0.4 immediately.

In a statement, Mullenweg says:

[This] is a very important update to apply to your sites as soon as possible because it fixes a core security bug in our HTML sanitation library, called KSES. I would rate this release as “critical.”

Bloggers using WordPress.com hosted blogs will automatically have this update applied and need take no further action.  However, if you use a self hosted version of WordPress, it’s highly recommended that you upgrade to 3.0.4 as soon as you can.

As always, make sure you back-up your blog’s files before you apply the update.  You can download the WordPress update here.

The browser is currently wide open to attacks from web pages exploiting the code, which will allow attackers to take control of their machines.  Microsoft has released a workaround, via it’s Enhanced Mitigation Experience Toolkit, which you can download from Microsoft.  However, this workaround will not provide a full solution for users of Windows XP and earlier versions of the OS.

At the time of writing this, a fix is still not available.

Almost everyone who has been hands-on with a Windows Phone 7 device has been impressed to a lesser or greater degree.  However, many established technology writers seemed to report the same conflicting story: That Windows Phone 7 looked great, offered something genuinely different from what’s currently available BUT that it would fail.

It’s also important and relevant to point out that the exact same type of biased reporting was aimed at Apple when it launched the iPad.

Of course, the real value of these blatantly biased reports against brands like Apple or Microsoft, is that they serve as a useful indicator of where many of the so-called independent tech news outlets really stand.  Whilst the bigger tech news providers claim to be unbiased, there are clear differences in how they treat the big tech brands.

The traditional news outlets have well established political biases, with viewers / readers aware upfront if they are consuming left or right based opinion.  When you know up front that you are consuming biased reporting, you can run what you read or listen to through the appropriate filter.

Sadly, it seems there is no clear way to see which biases the leading tech news providers have.  As people base buying decisions on what they read on these sites, isn’t it time there was some honesty here?

So, why did Google announce yesterday that they were ceasing development of Google Wave?

The simple answer from Google, was that “we have not seen the level of adoption we would have liked.”  In other words, it attracted very few regular users.

The bigger question, and one that I believe a lesson can be gained from, is why did so few people use such a powerful, free service?

The Google Wave demo video was over an hour long!

Google Wave, like Google Buzz, came out of the blocks with a problem, which lost it a huge amount of early traction.  The initial Google Wave demo video, ran for over an hour – which was stupid.  People wanted to see something that showed them how to get started with Wave quickly, yet they had to wade through a shockingly poor, over long presentation instead.

By the time the problem was fixed, and the dumb-ass video replaced with something more appropriate, Wave had already lost millions of early adopters.

These early adopters (people like you and me) are the one’s who typically open new online services up to the non-geeks.

Google Wave User Interface was poor

The initial user interface was also far from instinctive, making it a lot harder to get things done, than needed to be the case.  In fact, lifehacker co-founder Gina Trapani was so frustrated by the lack of user information available, that she wrote a very useful book; The Complete Google Wave Guide – Which I’m guessing you will be able to get at a very reduced rate soon!

The worst part about the demise of Google Wave, is that it genuinely was a very good tool, which failed largely because of piss-poor launch marketing and a badly designed user interface.

So, a legal and easy way to reliably jailbreak your devices and free them from the bullshit DRM that has driven users nuts for years – right?

Err, no, not exactly!

Jailbreaking your iPhone or iPad with jailbreakme 2.0

A new app called jailbreakme 2.0 has just been released, promising users of iOS4 devices the chance to easily jailbreak them.  Easily?  Yep, unlike previous jailbreak apps, which required you to hook your device up to a computer, jailbreakme runs from mobile Safari.  At the time of writing this, their servers are down due to high traffic, hardly surprising with all the coverage jailbreakme is getting right now.

The perfect way to jailbreak your iPhone?

Unfortunately, there are widespread media reports today, saying that users are reporting various faults after liberating their iPhones and iPads with jailbreakme.  FaceTime problems and faults to MMS services seem to be the most common issues.  That said, I would be extremely surprised if a fix was not in the mix very soon.

I fully expect we shall see a surge in apps like jailbreakme, over the coming weeks/months.  Maybe, just maybe, this will see enough users running non-DRM’ed iOS4 devices that Apple will reconsider their approach to DRM?

OK, OK – I only said MAYBE!

Photo: Myuibe

Android users can relax again, in the knowledge that the Android OS is just as safe today as ever; despite yesterday’s incorrect reports of a malicious app that was on millions of Android users devices!

Yesterday, the blogosphere was full of stories about an Android wallpaper app, which was reportedly collecting sensitive user data and sending it off to a server in China.  LookOut (the firm who reported this supposed security problem) has since issued a statement saying that in fact, the app was NOT showing any malicious behaviour.

The problem here is that those stories are all still out there, indexed and searchable – Just waiting for potential, new Android users to find them and be wrongly alarmed.

Unbelievably, Venturebeat, The Wall Street Journal, CNET, Yahoo News, Fast Company and scores of other BIG outlets carried this story, even though it was based on the findings of a single security company.  In fact, such was the traction generated by this story, that The Inquirer is still reporting it as news today!

Of course, anything related to Android is big news, so there was a rush to get that story out there.  As a result, the news went viral and the toothpaste was well and truly out of the tube, by the time it became obvious there was nothing malicious to report.

If I were Jackeey Wu (the app developer) or Google, I’d be REALLY pissed right now.

Windows Phone 7: Not the game-changer we were promised?

Just a few weeks ago, the tech news jungle was buzzing with reports of a new “game-changing” phone OS.  Then, suddenly, reports started to come out slamming it!  Maybe the strongest post came from InfoWorld, with Windows Phone 7 – Don’t bother with this disaster.  This is to be expected, right?  Even the original iPhone drew some negatives for lack of certain features, like cut-n-paste (remember?).

But now it seems that even the most vocal supporters of Microsoft, like respected Microsoft blogger Paul Thurrott, have started preparing us for a far less game-changing OS than we were originally promised.  When people like Thurrott start preparing us to be underwhelmed, I take notice.  He is extremely well connected with Microsoft and is currently writing “Windows Phone Secrets” having been given a device by Microsoft for the book.

I’m guessing here, but I believe Microsoft’s PR people (the worst in the industry) saw all the buzz about how revolutionary the Windows 7 Phone OS would be, and knew they needed to crank it down a bit.  If I am correct, (1st time for everything) this is not a good scenario for any of us!

Why?

Because you don’t have to be a Microsoft fan to want this device to be a success.  When a new OS comes out, which raises the bar, it causes everyone else to up their game.  Look at the speed of the developments to the iPhone OS, since Android started being taken seriously.  Equally, iPhone 4 is causing Android developers to up their game too.  With a new, truly revolutionary OS in the game, iPhone and Android would benefit (as well as Windows users, of course.)

What do you think?  Will Windows Phone 7 fly or flop?

DSGi, one of the UK’s biggest computer retailers, said that they have had more pre-orders for Windows 7 in the past 3 weeks than they had for Windows Vista in a year!

Windows 7 free upgrade from Vista – The argument

As long time readers will know, I believe Windows 7 should be given to Windows Vista users, as a free upgrade.

Many Windows Vista users feel they were unpaid beta testers and that Microsoft has used their time and their error reporting with Vista, to help them produce Windows 7.  I agree!  In fact, many people have suggested that Windows 7 should have been rolled out as a Service pack for Vista.

These users should either get a free copy of Windows 7 OR AT LEAST a massively discounted copy.

Microsoft’s Windows 7 PR blunder

Microsoft’s latest OS is superb and if you are a Widows user, you will almost certainly love it.  It’s just a pity that Microsoft didn’t use the launch of Windows 7, to win back some good faith from millions of angry Vista users.  These people are now using an inferior OS and have to cough-up if they want to use an OS, which I believe they deserve for free.  I blogged about this here.

What do you think?

Should you have to pay for Windows 7, if you already own Vista?

Here’s what she says:

There are strange additions to the pretty permalinks, such as example.com/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFERER%5D))%7D%7D|.+)&%/. The keywords are “eval” and “base64_decode.”

The second clue is that a “back door” was created by a “hidden” Administrator. Check your site users for “Administrator (2)” or a name you do not recognize.

We are strongly recommending self-hosted WordPress bloggers, who are not already running the most up-to-date version to update their WordPress software as soon as possible.

WordPress.com blogs

If you have a WordPress blog hosted at WordPress.com, your blog will be fine.  Blogs hosted at WordPress.com auto-update to the most recent software build and thus, are not vulnerable to this particular attack.

At the time of writing this, Automattic (the owners of WordPress) have not commented on the threat.  If you have any additional news regarding this, please share it in the comments section.

UPDATE:

Here’s some great advice from WordPress.org regarding this issue.

So, with Windows 7 being so well received, here’s my question;

“Is Microsoft deliberately trying to screw up Windows 7?”

Let me explain.

Windows 7 upgrade

The marketplace has been asking for a single version of Windows for a long time – so the user gets the ability to turn on or off the features they need.  A single version of Windows 32 bit and one for 64bit users.  Nice and simple.  After all, this approach works fine for other operating systems. However, even though people have been demanding a single OS since the first beta of Windows 7, it’s not going to happen.  That’s right, instead of using the launch of Windows 7 as a chance to give their users what they want, Microsoft decided to create 6 different editions of the same OS.

To give you an example of how unnecessarily complicated this makes buying the correct version, Windows blogger Paul Thurrott has written a post that’s 2,600 words long, trying to explain the differences between each edition. Of course, these versions are all priced differently too.

By the way – Once you have decided which of the 6 editions of Windows 7 to get, you have to make another decision. Do you do an upgrade (from Vista), which Microsoft recommends – or do you do as everyone outside Microsoft recommends (including Paul Thurrott ironically) and do a clean install?

Here’s my point: Windows 7 was Microsoft’s chance to win back some of the good faith it lost, after releasing Vista. Yes, Vista today is not as sucky an OS as it was, (still sluggish though) but the original release was horrible.  This angered a lot of loyal Windows users; people who have stuck with the OS since Windows 3.1 or earlier.

I find it amazing that Microsoft is not better able to tap into the needs and demands of it’s users.  Many are so mad after their Vista experiences, that they wanted a FREE Windows 7 upgrade. This was clearly never going to happen.  But by shipping Windows 7 for almost the same price as Vista AND with the same version problems as Vista, Microsoft are showing that they are either not listening to their customers or that they don’t care.

With Apple and Google breathing down their neck, they might just want to reconsider that approach.