Whoever next? We’ve intercepted a load of spam sent by French company EmailVision on behalf of WH Smith to honeypot addresses – i.e. definitely not opt-in and definitely not legal in the UK. EmailVision is getting quite a reputation for this kind of thing, with PayDay loan spam and suchlike. W H Smith – I’m surprised at you! Or perhaps I’m not.
Windows 10 – just say no
I’ve had a lot of people ask me about Windows 10. Here’s the simple answer: No thanks.
Apparently it’s a bit faster than Windows 7 on the same hardware, although I’m not convinced people who say this have tested it scientifically. In other words, it may have been faster as a clean install compared with a crufty old Windows 7 installation, and in theory it could have been written to be fundamentally faster, but actually writing code that’s more efficient that previous versions isn’t really Microsoft’s style. Although the new web browser (Edge) is promising. But will it still be faster when it fully functional (i.e. supports HTML5 and suchlike properly).
That’s the good bit. Everything else is bad compared to Windows 7. Compared to Windows 8, yes, it’s better. That’s from a user’s perspective. From my perspective, it’s a big “no thanks” to the added spyware, telling Redmond exactly what you’re up to all the time and the enforced software updates, that I have an nasty suspicion are going to end up mandatory even on the business (Pro) version. Basically I don’t see what Microsoft has done to restore any trust I once had in them.
If you’ve got Windows 7, stick with it. If you’re on Windows 8 it’s swings and roundabouts but you might want to take a serious look at a Linux instead.
Unfortunately, because this is Microsoft, there’s a good chance that we’ll all be forced to use Windows 10 whether we like it or not. They had the sense to keep Windows 7 for serious users when they rebelled against Windows 8; I somehow see them fighting hard to force the issue when it comes to Windows 10.
Stagefright on Android
This is a quick post as I’m a but busy at the moment, but it’s worth saying something about it this serious Android security flaw.
As I understand it, there is a buffer over run problem with the decoder for MMS messages. On receipt and decoding of a specially crafted MMS an attacker can get control of the process,
which on Android 4 or later means access to SD card data, your camera and microphone and other awkward stuff. On Android 2 they get the whole phone. I’ve yet to be convinced that this is a game over type problem on Android 4 but it bad enough. On earlier versions of Android, it’s a complete disaster.
The solution, of course, is to get a software update from your phone manufacturer. Good luck waiting for that to arrive.
My advice in the meantime is to disable MMS messages completely. I do this by default, because I think they are ridiculously overpriced and there are plenty of other alternatives such as email or even Instagram (so I’m told buy the teenagers hereabouts).
If you want to disable MMS, proceed as follows:
Go to phone settings. The last entry under Wireless and Networks will be More…
Here you will find “Mobile networks”, and under there will be ” Access point names”. On dual SIM phones you will now have to choose each SIM in turn, otherwise you’ll go straight to a list of profiles. This list may contain only one entry.
Choose the entry that is selected, i.e the one you are using. What you will find next depends on the version of Android you have. However somewhere down the list there will be an MMS service centre URL, beginning with HTTP and looking like a web address. Simply delete the contents of this field, and while you are at it, remove the entry for MMS proxy if you have one. This tends to be a dotted quad i.e. an IP address.
Just save this, and you will not be able to send or receive MMS messages from your phone.
Problems with Thunderbird 38.0.1 and SSL
Thunderbird used to be my mail client of choice, but suddenly I’m not so sure! The latest update on the release channel (version 38.0.1) seems to have broken completely when using self-signed certificates for SSL.
A self-signed certificate makes sense when you know you can trust it; otherwise you get a signing authority you do trust to verify your certificate (for loadsamoney). If you’re talking to your own servers, there’s not point in doing this as there are other ways to check you’re talking to who you think you are. Thunderbird used to warn you that it didn’t recognise a self-signed certificate the first time it saw it, but if you told it to go ahead anyway it would add it to the trusted list and go on encrypting your data for you quite happily.
Since “upgrading” to version 38 it suddenly stopped working. No more email. No more sending email. It just failed silently (that’s bad, for a start), the only clue was that I couldn’t send an email or copy it to the drafts folder.
On examining the logs at the server end I found stuff like this:
Jul 7 23:17:54 dovecot: imap-login: Disconnected (no auth attempts):
rip=###.###.###.###, lip=###.###.###.###, TLS handshaking: SSL_accept()
failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Suspicious! So I turned off SSL in Thunderbird and it all worked again. This is NOT a sensible solution. Unfortunately, I have yet to solve this one, other to simply not upgrade Thunderbird beyond 31.7.
Fortunately, you can still download the previous non-beta version from here, (assuming Mozilla don’t move it). You actually want 31.7.0, because the intervening releases were betas, and 31.7.0 is as recent as May 2015 so it’s not ancient. Just navigate around the site you don’t want the English version. Simply install it everything comes back the way it used to be, or at least it did for me.
Update 15-Jul-2015:
It appears that Thunderbird may have decided not to accept TLS with less that 1024-bit DH keys without telling anyone. Even if they had mentioned it, there’s not a lot users can do with it. This means that if you’re using a 512-bit key (which is considered export-grade) then it’s going to refuse to talk. Worse than that, it doesn’t pop up a message saying WHY it’s not going to talk. It’s just going to fail the connection. Presumably, as my friend Graham put it, this indicates that the Thunderbird open-source developers are hoping to get a job with Apple.
I hope this nonsense will be resolved in 38.1! In the mean time, turn off auto-update.
Update 30-Jul-2015:
I’ve now updated the server certificates being in-date (which doesn’t actually matter), and made sure they were 1024-bit (which they were) and apart from upsetting everyone who has had to accept the new certificate, Thunderbird still barfs.
Update 15-Aug-2015:
It get’s worse – there has been an update to the 31.x branch to 31.8.0, and this has the same problem. Use the link above and make sure you’re using 31.7.0
Does the iZettle card reader work on Android 5.0 (Lollipop)?
The iZettle card payment system is well worth a look. The company is very SME friendly, unlike the traditional card handlers. There’s no standing charge or transaction charge and the their percentage cut is fair.
Unfortunately they’re all Apple Fanbois, in spite of Android having 90% of the mobile market, and functionality on the most important platform lags. Everyone complains about it. But they’re such nice people when I speak to them on the phone, I still like them.
One case in point is that iZettle have finally launched a contactless reader. Yeah! Unfortunately the contactless feature only works on Apple, although my sources say that an Android upgrade is in development.
The contactless reader replaces the bluetooth-connected Pro version. In fact it’s the Pro version with a NFC reader built in, and it costs an extra £10, at £80+VAT (bargain).
If you’re a real tightwad there’s the £30+VAT (or free) blue keypad, which is actually quite a solid piece of kit, but it connects to the device using the headphone connector and modulating it’s data with burst of audio carrier (from listening to it). What could possibly go wrong?
Well, having tried it with Android 5.0 (Lollipop) I can tell you that it’s not going to work beyond Android 4.x until they fix the App. Version 2.5.1 of the iZettle App was supposed to support Lollipop, but take it from me, the support is far from complete.
Bluetooth Reader does work
I gave up and ordered the Reader Pro Contactless, the current bluetooth-connected unit, and I’m happy to report that seems to work perfectly. I was up and running within a minute; just pair it and off you go. For what it’s worth, this was with a Doogee DG700 with Android 5.0. iZettle is planning to release an update so it will make contactless payments, and (in theory), this will work.
Note that iZettle replaced the Reader Pro with the Reader Pro Contactless recently. They look the same. I have a hunch the older one will also work.