The software visionaries at the Mozilla Corporation, which makes the popular Firefox web browser, have taken the approach that creativity and functionality is king -- even if security has to take a back-seat. Case in point: The widely praised 'Ubiquity' software add-on, which brings an amazingly rich and extensible new form of interaction to the Firefox web browser.

The technology press have showered praise upon the developers of this software tool. However, in prioritizing functionality over security, Mozilla Labs punted complex trust choices to end users -- the vast majority of whom are ill-equipped to make such decisions. The end result is that the hundreds of thousands of users of Ubiquity face a significant risk of browser hijacking by attackers, which could result in the theft of email and online banking account information.

Mozilla's Ubiquity in Action

The Ubiquity add-on brings a new form of command-driven interaction to the Firefox web browser. Using the tool, a user can perform actions based on the contents of a page -- such as translating the foreign text on a page into English, or generating a Google map of a highlighted address. While this is certainly cool, it is the extreme extendability of Ubiquity that makes it a truly compelling tool.

One of the main design goals for Ubiquity was that it should be extremely easy for users to be able to create their own commands, which they could then share with others. As a result, a useful command can be whipped together in a couple lines of javascript -- for example, allowing a user to send a twitter message from within the browser. Aza Raskin, the head of User Experience at Mozilla Labs summed up the goals of Ubiquity in a blog post introducing the tool:

The fundamental problem is that extending the browser, and hence the web, is too difficult. The closer new browser functionality can be packaged to look like standard HTML and [Javascript], the larger and more diverse a community will create it. The desktop paradigm for extension development, while powerful, has a high cost of adoption. Right now we have a short tail of browser functionality with thousands of add-ons. There should be millions. We can get to that long tail using a more web-like model for functionality development -- tools that are accessible to hobbyists and tinkerers, but that scales to professionals.

Mozilla Labs was hugely successful, and within a week of the first public beta release of Ubiquity, over 100,000 users downloaded and installed the tool. Even more telling, is the number of commands that have been created and shared by users. The Ubiquity Wiki lists 300+ different commands, while Mozilla's Raskin wrote in his blog that "thousands of commands [have been] written for Ubiquity" and that "in under a week, we have a roughly comparable number of Ubiquity commands as there are Firefox extensions."

Mozilla does not release stats on the number of downloads, but given the rapid adoption of the browser add-on, it is quite reasonable to assume that by now it has been installed by at least 250,000 users, if not far more.

The Ubiquity command installation screen

No security, no problem

The success of Ubiquity has come at a high cost -- the Mozilla Labs team completely punted on the issue of security, and made users responsible for judging the safety of downloadable Javascript, something that few of the hundreds of thousands of its users are likely able to do.

When a user wishes to install one of the thousands of publicly available Ubiquity commands, they are first taken to bright red warning screen. The user is clearly told the risks that they face should they accidentally install a malicious command, and then they are given the opportunity to read through the command's javascript source code in order to see if it is good or evil.

The vast majority of the users on the web are not able to read javascript. Even those skilled users that know enough to throw together a Ubiquity command or two are unlikely to be able to properly assess the security of someone else's code. This point can be clearly driven home by looking at the success of the Underhanded C Programming Contest, in which users submit code that "looks" clean and safe, but which actually performs evil actions.

Furthermore, while Mozilla has been surprisingly frank with users about the risks that they face when installing commands, this approach of education and disclaimers is simply not enough. It is totally unreasonable to offer a shiny, awesome and powerful new tool to the Internet at large if clicking on a wrong link could result in a user suffering identity theft or worse. Bruce Schneier has often said that humans are really bad at judging risk, and so of course, the vast majority of Ubiquity's users are going to install foreign and unknown commands, simply because they offer awesome functionality.

Security Warnings in Ubiquity

In addition to the general problems of untrusted Javascript, Ubiquity also suffers from significant security issues due to the ability to auto-update commands. By checking a box, a user can permit the browser to automatically upgrade commands whenever the author releases a new version. This option creates two major issues.

First, a developer could release a legitimately useful command, wait until thousands of users have subscribed to it, and then send out a malicious update to those users that have enabled auto-updates. Since users only get to see the Javascript at the time of first install, they face significant risks from future malicious updates.

Second, command updates are currently served via non-encrypted HTTP connections, and the Ubiquity infrastructure lacks the code-signing functionality that is provided to Mozilla add-ons. This creates a significant potential for man-in-the-middle attacks against the Ubiquity update process, particularly when users are connected to the Internet via a public wireless network. Last year, I revealed that a number of toolbars for the Firefox 2.0 browser were vulnerable to this same type of attack. This flaw was eventually fixed by moving the distribution of commercial browser-addon updates to SSL-encrypted servers.

The Mozilla Labs team have recognized these risks, and have plans to fix them at some point in the future. However, for now, users of Ubquity remain vulnerable to attackers, particularly those who have opted to allow automatic updates of commands.

In releasing Ubiquity, the Mozilla team also created a website they call the Herd, which enables users to opt-in to reporting which commands they have installed. Thus, one assumes, if 20,000 other users have installed a command, it is probably safer than one that 5 other people are using. While better than nothing, Herd is still very new, and due to the pro-privacy opt-in model chosen for data reporting, it only captures a small slice of the Ubiquity user base.

When asked to comment on some of the security issues, Aza Raskin issued the following statement regarding security issues in Ubiquity:

Mozilla Labs is a shared space for exploration for future user experiences on the open Web. It's a place where we, as a part of larger community, can experiment and iterate on new ways of interacting with the Web, having the Web fundamentally enhance the browsing experience. It's also a place where we can safely explore new security and trust models among a technically savvy group, before bringing them to a wider audience.

The Herd is one way of trying to involve the community as a corner-stone of solving the security problem. It's still in it's infancy. We are working towards creating an open API so that everyone can pitch in to create a safe place for everyday users to get commands. Just like Ubiquity UI not being right yet, neither is the Herd.

Eventually, I expect there to be hybrid models. Mozilla, and other trusted sources (think folks like Bruce Schneier), will vet core and recommended commands. The Herd, enhanced by numerous metrics of "browser health," will constantly be watching for bad actors. Clearly, we don't expect end users to need to read code -- and we do plan on adding manifests of some form to sandbox certain types of commands. Right now, however, the emphasis is on empowering verb authors to be generative.

Raskin did not answer specific questions posed by this blogger, and neither he nor Dan Veditz, Mozilla's security lead, would confirm if the Ubiquity code base was audited by members of Mozilla's security team before being released to hundreds of thousands of users. I'd be willing to bet a few beers that it hasn't.

There is of course a legitimate reason to release beta software, even when it has known security flaws. Were Ubiquity available only to those web-programmers proficient in javascript, this wouldn't be an issue. However, when hundreds of thousands of people are using your product, you can no longer reasonably hide behind the claim of "beta."

Visit Evil Player 1.27 at Daily Freeware Download to get the actual content of this post, or to ask for permission to redistribute that content.

Sed vel lectus lacinia neque

Protect your WordPress content from theft with the AntiLeech plugin, written by Owen, and provided for free.

ShareThis

Google Knol

So you might not think it’s worth your while. And substantively, it may not be. But can Wikipedia speak to you? Knol can. Sometimes.

If you browse Knol’s catalogue of user-submitted articles (a number of which duplicate content from Wikipedia, but that’s another item for another day), you will find that audio tracks are few and far between. Yet, when you do encounter one or two or more, as Alex Chitu of Google Operating System discovered, you’ll find that the computer-generated vocal portrayal of test on a page is surprisingly tolerable. Noticeably fake, yes, but not terrible.

Where the pace of a text-to-speech rendition goes most awry is with abbreviations and acronyms and so forth. Also, the speech system doesn’t make very noticeable distinctions between paragraphs, sections, or chapters. Otherwise, it’s not half-bad.

It’s important to note that the audio is only as good as the text interpreted, both in terms of characters used as well factual content, but Google has, technically speaking, produced something here that could be quite useful down the line. Just as long as graphs and tables aren’t critical to the story.

---
Related Articles at Mashable | All That's New on the Web:

Google Knol Launches; More Like Squidoo than Wikipedia
The Daily Poll: Is Google Knol a Wikipedia Killer?
16 More Years (at least) of Brin, Page, and Schmidt at Google
The Daily Poll: Which of Google’s New Products Will Be the Most Successful?
Google’s Knol: Evil and Doomed.
Google Knol - More Of The Same
Knol Deathwatch Day 3: Splog Invasion

Enter Xpy, to take care of your tweaking needs!

Xpy allows you to tweak a number of Windows settings easily. All you have to do is place a check mark next to the setting you wish to change and then hit “next” and Xpy will take care of the rest. There are a number of other features that make Xpy a tool worth having, however first le’ts have a look at some of the settings you can tweak with Xpy.

The tweaks are classified into several categories:

1. General
2. Services
3. Internet Explorer
4. Windows Media Player
5. Windows Messenger
6. Windows Desktop Search
7. Usability
8. Delete Files

And they range from “Enable delete pagefile at shutdown” to “disable selected services” to “Increase maximum connections in Internet Explorer” to “Disable DRM for imported music in WMP” to “Disable balloon popups, Autorun, Desktop Cleanup” to “Deleting Recycle Bin, My Documents, My Computer shortcuts” and much much more.

There are a couple of interesting features that I really like in Xpy.

It allows you to save all the tweaks that you made on the system in a file. Just use Xpy with /file switch and it creates a settings file on the desktop. Next time provide the file as an argument and boom all your settings are applied! This is especially useful if you have to re-install the system or you are responsible for maintaining a number of computers.

Secondly it allows you to restore any changes you made to the system using Xpy. When you run Xpy, after you have applied the tweaks, it gives you the option to restore previous settings or go ahead with further tweaking.

Thirdly it’s portable (doesn’t require an install) and always ready to use!

A Mention: The Xpy icon looks scary. It looks as if double-clicking the icon will unleash a wrath of the Devil on your system.  Some anti-virus programs may also show it as a suspicious file but as the Xpy page says: “Xpy is not evil, it’s a problem with all NSIS compiled software, but if you are the suspicious type you can always have a look at the source code (SourceForge and Google Code) and build a binary yourself!”

Do you use such software to tweak your system?  Or do you prefer editing the registry manually instead? Know of other similar tools? Let us know in the comments!

(By) Varun Kashyap - Programmer, Blogger and Tech enthusiast, who blogs about tips, tricks, tutorials, latest on the web on his TechCrazy Blog

New subscriber? Get your freebies at MakeUseOf Downloads. Enjoy!

Related posts

• WinHack - Speed Up Your Computer (Part 1) (3)
• Windows Registry Tweaks (Part 2) (3)
• Virtualization-Free In-Windows Linux Installation (13)
• Using Keepass to Secure Your Online Accounts (9)
• USB Office Showdown: Tiny USB Office vs. Portable Apps (8)

If the king doesn't move, then his subjects won't follow.

Lelouch Vi Britannia

The world won't change with pretty words alone

Lelouch Vi Britannia

If being powerless is evil, is having power justice? Is revenge evil? Can friendship coexist with justice?

Lelouch Vi Britannia

Those with power, fear us! Those without power, seek us! The world should be judge by us, The Order of the Black Knights.

Lelouch Vi Britannia

Will there be sacrifice? Yes and not just soldiers, but innocent bystanders, as well. Even so ... no ... because of that, I cannot stop. Even if I need to cheat and hurt others, I must persevere. To that end I must become carnage incarnate. I must spill yet more blood, so that the blood already spilt will not be in vain.

Lelouch Vi Britannia

Inequality is not an evil. Equality itself is evil

Emperor Charles Di Britannia

Good and evil are simply different sides of the card

Emperor Charles Di Britannia

Those who may shoot are only those who are prepared to get shot themselves

Lelouch Vi Britannia

The power of the web has created the golden age of the individual. Social Media tools provide us with more opportunities than ever to shine. But these days it takes much more than a website and a business card to get attention. It’s all about creating a strategic plan for the most important brand around: YOU.

How do you want your audience to think about you? Are you going to dive in right in, fly by the seat of your pants, and deal with potential backlash as it comes? Or will you carefully plot out your meteoric rise to stardom? Whichever path you choose, personal branding has two essential requirements: passion and authenticity.

Join mediabistro.com to talk about the art of personal branding with three mavericks of the DIY branding revolution:

• Julia Allison (TimeOut NY, Nonsociety.com): Her adoption of technology and mastery of spectacle got her on the cover of Wired this summer.
• Loren Feldman (1938 Media): His unfiltered opinions and comic chops have made him the de facto satirist of web culture (with help from some puppet friends).
• Gary Vaynerchuk (Wine Library TV): His wild personality, scholarly knowledge of wine, and video camera helped create a 45 million-a-year empire.
• Suzie Ivelich (moderator) is an expert on brand creation & development, and has worked across a myriad of industries. Some of her clients include GE, Charles Schwab, Suzuki, and The New Museum.

Twitter or Email mediabistro.com with questions for Julia, Loren, Gary or Suzie! Twitter.com/mediabistro or email: events@mediabistro.com, subject: brand yourself

Get $25 off through October 6th with code MASH25.

---
Related Articles at Mashable | All That's New on the Web:

1938Media Doesn’t Acquire CNet
Verizon Reportedly Drops Loren Feldman Over TechNigga
SoccerGirl Due For IRS Audit Very Soon
Shel Israel (The Puppet) Goes Out On A Sour Note
Loren Feldman, The New Yorker, and Social Media Evil
Can’t Go to Web 2.0 Expo? Network with Technology Influencers on Tuesday Night, 9/16
5 Twitter Tactics for Building a Stellar Brand

It’s not really rocket science. Malwaremongers are simply checking out top news stories from Google Trends Labs, then creating fake blogs with a bunch of keyword-heavy texts related to those terms. When an unsuspecting victim stumbles onto such a site, he/she will be greeted with a malware cake instead of the info they’ve sought. Usually, it’s a link to a video; but alas, the site prompts you to first download a codec to see the video. The codec is, of course, malware/spyware or worse.

An example of this trend is the recent wave of phishing emails which aren’t masking as PayPal or eBay, but as media sites such as CNN. Phishers just want your data, and if no one is gullible enough to give out their credit card number any more, they’ll at least try to lure you into installing trojans by posing as blogs or news sites, which will ultimately result in the same thing.

All of this is not new practice, says Webroot’s senior vice president Paul Lipman. “However, the fact that these hackers are now manipulating Google’s methods for relevance to increase the ranking of these sites is new and greatly increases the number of people exposed to this threat.”

Unfortunately I don’t see what can really be done about this; Google’s tools are out there for anyone to use, even for evil. We can only hope that Google will eventually get better at ditching fake blogs out of their index.

---
Related Articles at Mashable | All That's New on the Web:

Google Checkout Trends Knows Your Shopping Habits
Google Trends Now Updates Daily
Google Trends Thinks I’m Hot
Google Trends Adds Another Way to Inaccurately Track Website Traffic
Blogger Visitors Under Attack by Malware
Google Mobile Apps Reverse Summer Slump Trends
Google to Introduce New Ad Buying Software for Demographic Targeting

1. DRM
OK, why the hell are we still talking about this thing? Everyone knows that the idea of digital rights management which tries to artificially remove your rights to use a product you’ve legally purchased is preposterous, idiotic, and should be abandoned. Hell, even the record companies got it, and heaven knows they’re at the bottom of the food chain when it comes to not screwing up your customers. Yes, I know it still exists; could the suits who are still pushing it in their products *cough* Spore *cough* stop doing that crap before they a) get fired and b) their companies go bankrupt? Thank you.

2. Linux replacing Windows
Every now and then I still see this topic popping up, together with the inevitable praise for the latest version of Ubuntu (what is it nowadays, Obese Ostrich?) and detailed how-to descriptions on how to do absolutely everything you do on Windows under Linux, only 100x cooler.

Guess what? It ain’t gonna happen. Decades have passed, folks, and it hasn’t happened. Microsoft sat on its ass for 6 years, and then they came up with Vista, which sucks, and it hasn’t happened. Hell, if anything is going to replace Windows, it’s going to be Mac OS, or some yet undetermined weird OS from Google.

3. The death of e-mail
Yes, it sucks. Yes, 90% of it is spam. But unfortunately, it’s not going away, despite the fact that every now and then someone proclaims it dead. As much as we’d all like a better, safer, less restricted and more intelligent e-mail, we’re going to be stuck with this one for quite a long time.

Is it cause for grief and despair? Not really: there are plenty ways to communicate on the internet, most of which are far more advanced than e-mail, and that’s probably precisely the reason why no one is trying to replace e-mail as such. We use it only for what it’s good for, and we’ve moved as far as everything else goes.

4. RIAA lawsuits

Ok, I know why we’re talking about these. Because the RIAA is evil, and because the insane “john doe” lawsuits still keep coming. What I wonder is how long this charade will go on until the legislature wakes up? Let’s repeat, in short, what these lawsuits are. Here’s a handy quote:

“A complainant may first attempt to get the subscriber information by simply asking the ISP for it. However, most ISPs will be reluctant to give out this information without a court order. The complainant will then have to issue a claim against “John Doe” (at which point they become a “plaintiff”), and will then have to ask the court for an order requiring the ISP to disclose the identity of “John Doe”“.

Yes, that makes sense. We can’t coerce ISPs into giving them personal user info, so we’ll first just sue no one in particular, then we’ll get court orders for these yet undetermined people, and then the ISP will give us all the data we need to sue their pants off. Talk about gaping loopholes in the law. I sincerely hope that these lawsuits will soon be an ugly memory of the past, never to be repeated again.

5. Microsoft/Yahoo/AOL merger

Yes, it’s the biggest IT news of the year. And no, it didn’t actually happen. So, us IT bloggers and journalists are forever bound to write about it without any real news happening, a job not entirely unlike that of Sisyphus. Trust me, if I never read another story about Microsoft buying Yahoo or merging with AOL, or any similar combination, it’ll be too soon.

And, you know what? Every young interesting Web startup brings more good to the world than the possible mating of these tired dinosaurs probably ever will. Everyone pretty much agrees that no option is good for any company, but this is what big business comes down to today: eat or be eaten, even if whatever you’re eating tastes like crap.

6. Apple rumors

Apple holds several yearly conferences in which they announce new products and services. Due to their extreme secrecy, it’s pretty much safe to assume that no one will be sure of what any new product will exactly be like until it’s officially out. Apple’s products are almost always very exciting, so one would expect that they will spark rumors several days or weeks before these events, right? Right. Nothing wrong with it so far.

But not every god damn day! The insane frequency of Apple-related rumors and their signal to noise ratio makes it totally useless for anyone to follow any of it except the hardcore Mac fans! And yet, every slightest detail visible in (obviously fake) “spy shots” of Macbooks and iPhones is analyzed to the latest detail and reported upon ad nauseam. Sometimes I wish other companies were as cool as Apple so we’d at least get a little variety here.

Have any particular tech topics you’re sick of? Please, share them in the comments!

---
Related Articles at Mashable | All That's New on the Web:

Technorati Launches Useless “Topics” Section
Yahoo Tech - Tech Portal, Web 2.0-Style!
Digg Shouldn’t Compete with Yahoo Buzz
The Rise of the Memetrackers
O’Reilly Money:Tech Conference - 2 Free Passes and Discounts
FuckedCompany, For Sale
Announcing TECH Cocktail Event Series

At a Software plus Services partner event in London Ballmer said the following “We need a new operating system designed for the cloud and we will introduce one in about four weeks, we’ll even have a name to give you by then. But let’s just call it for the purposes of today ‘Windows Cloud.” Essentially, it should be a bunch of services and products from Microsoft available in your browser in a simplified form. “We’re not driving an agenda towards being service providers but we’ve gotta build a service that is Windows in the cloud,” Ballmer added.

First of all, this sounds like a big deal, and Ballmer is just casually saying they’ll have it out in a couple of weeks? Not Microsoft’s style. For example, they announced their Live Mesh initiative (which is, btw, in many ways related to the concept of cloud computing) 5 months ago, and there’s still not a word about a public or even a closed beta, let alone a finished product. (*correction: to clarify things further, a technical preview of Live Mesh is accessible to the general public. It is very far from a finished product. Furthermore, only users from a select few countries (I’m not in one of them) can get in without a wait list. More here.) Microsoft is big and slow, they announce stuff like this months before it’s ready; so my guesstimate is that Ballmer’s four weeks will turn into months really soon.

This is reiterated by the fact that they don’t even yet have a name for the product. It’s due out in a month, but it has no name? Again, it’s simply not Microsoft’s style, especially when it comes to an ambitious product like this; one that may very well prove if Microsoft is capable of competing with Google or not.

In a nutshell, it seems to me that Ballmer was simply reckless, talking about something that’s most probably set in the distant future as it were an almost finished product coming to our browsers in a week or three. I expect it to go through long stages of alpha and beta testing before it’s actually useful to the end user. Perhaps that’s what Ballmer meant when he said it’ll be out in a couple of weeks, but giving Google enough time to prepare countermeasures (if needed) is probably not the best course of action for Microsoft. In any case, we should hear more about it at the end of October at the Professional Developers Conference in Los Angeles.

Ballmer pulled out another interesting observation at the event. According to him, Google is directly competing with Windows and they are building a browser-based OS. “If you talk to Google they’ll say it’s thin client computing but then they’ll issue a new browser that’s basically a big fat operating system designed to compete with Windows but running on top of it,” he said. Whoa, Steve, are you sure about this? Because, from what I’ve heard, most developers think of the idea as preposterous.

---
Related Articles at Mashable | All That's New on the Web:

Windows Live Hints at an Upcoming Events Feature
Windows Live Installer Launches this Week
IE7 Update Available for Download
Microsoft Releases Media Player Plugin for Firefox
Opera To EU: Boo-Hoo, Microsoft Is Evil
Windows 7 on a Diet - Thank Goodness
Microsoft Makes Windows Live Contact Info Portable

The town of Molfsee near Kiel has taken up to resist Google’s idea to organize the world with its Street View. The town with its 5,000 inhabitants doesn’t like the idea of being photographed by Google and letting the world have an eye at every nook and corner with its 360 street mapping and imaging that is accessible via Google Maps.

Reinhold Hartwart, leader of the CDU town council considered the Street View to be a threat to the privacy of its town people, stating:

You can see everything in those photos! That is opening house and home to criminals!

This isn’t really the first time Street View has been alleged  of attacking the privacy of people and Google as always isn’t really concerned with these accusations. Kay Oberbeck, Google’s spokeswoman for the North and Central Europe stated:

You can’t really see anything more than a person walking down the street would. But, whereas that person can look over the hedge, our cameras can’t.

The Street View does blur out the faces of people and other things that can be used against a person’s privacy. Well it’s all controversy with Google and its related services, let’s just hope and see how successful is this resistance from the German town be.

---
Related Articles at Startup Meme: