Browsing the Web has become like walking down a carnival sideshow. Everywhere you turn, you're bombarded with come-ons. You know there's a catch to each and every pitch because these barkers are pros at separating you from your money.
The people offering free software and Web services appear to be taking lessons from retired carnies. Their offers are too good to be true—literally. Most of these folks are in business, after all, so they have to make money somehow.
And as they say, the most successful cons are the ones where the victim doesn't even know he or she has been conned at all.
Of course, the purveyors of these "free" services assert that there's nothing underhanded about their method of doing business. Many are up-front about their business model, whether it involves placing ads in their products and services, downloading unrelated browser toolbars along with their updates, charging only organizations who use the software while letting individuals have it for free, or offering only dumbed-down versions of the programs for free and requiring payment for access to all the products' features.
Still, sifting through the "free" claims to find the true price you pay for such products can be daunting. Anyone who has used the Internet for any length of time knows it pays to be skeptical. While there are hundreds—perhaps thousands—of truly free programs and services available on the Web, finding the best of them isn't always easy. And clicking the wrong free-download link can be downright dangerous.
One way to determine whether a program is really free is its use of the Free Software Foundation's GNU General Public License (GPL). The GNU GPL stipulates that the software can be used, copied, and distributed verbatim without limitation, though it cannot be changed. While you can usually get the source code of programs that adhere to the GNU GPL, the license differs somewhat from open-source software.
The Open Source Initiative defines 10 criteria that programs must follow to be considered "open source." Among these are that the software can be redistributed—whether sold or given away—without limitation, and that the source code be distributable as well. Such programs must also allow "modifications and derived works" that can be distributed under the same terms.
SourceForge provides the most comprehensive collection of open-source software for Windows, Linux, and other operating systems. The programs listed on the site are often poorly documented and may be labeled as "projects," so you may not want to pin your business's success on one of them.
In fact, you'll often find more complete reviews of the programs listed on SourceForge by searching for them on Download.com. For example, here's the SourceForge entry for the KeePass Password Safe password-management freeware, and the product's entry on Download.com.
Whose bandwidth is it, anyway?
My biggest beef with software vendors—whether they charge for their products or not—is their cavalier attitude toward our system resources. Microsoft ties up our PCs every second Tuesday of the month with multimegabyte Windows updates. But a more recent example is Apple's latest iTunes and QuickTime update, which comes in at a whopping 101.2MB download. Apple, Microsoft, and other software vendors repeatedly expect me to put my workday on hold and turn my system over to their monster updates.
Apple's iTunes + QuickTime updater wants to download more than 100MB of patches in the middle of my workday.
(Credit: Apple)Many antivirus and other security programs let you use them for free but request a donation—sometimes repeatedly. For example, InformAction's popular NoScript add-on for Firefox opens a page after each update that solicits donations.
Other times, the vendor offers a free version of their commercial products, but finding it on the company's site becomes a game of Where's Waldo? If you're looking for AVG Free, you'll find it much faster on Download.com than you would on AVG Technologies' site.
Perhaps the greatest danger when looking for free software is becoming a victim of rogue security programs. This form of malware tricks you into downloading it by promising free protection, and then it claims to have found viruses that aren't actually there. The software holds your system for ransom, requiring that you pay to "remove" the infection that the program itself created.
The best way to avoid such traps is to restrict your software downloads to sites such as Download.com that scan all the files they host for malware prior to offering them for download. Better yet, think twice or even three times before installing any program. Every piece of software you load on your PC comes at a price, even if it's just the time, effort, and bandwidth required to keep it up-to-date so it doesn't become a security weak point.
I usually apply all the Windows updates that Microsoft labels as "Critical" or "Important." However, since Windows patches sometimes cause problems of their own, I often wait a week or more to install those that I determine I don't need right away.
If you have Automatic Updates set to download and install updates automatically, you won't see any Windows Update alerts in the notification area of the taskbar (the area near the clock) or anywhere else. Likewise, if you've disabled Automatic Updates, you won't be prompted to view or download anything, though you may see an icon warning you that you've deactivated Automatic Updates.
To turn off the warning icon, open the Security Center Control Panel applet in XP or Vista, click Change the way Security Center alerts me, and choose Don't notify me and don't display the icon (not recommended).
The safer course is to use either the second AU option—which downloads updates but alerts you before installing them—or the third option—which alerts you that updates are available for download and installation. These two options will generate the AU alert icon in the system tray.
Choosing either Automatic Updates option two (download but don't install) or three (alert before downloading or installing) generates an alert icon in the taskbar's notification area.
(Credit: Microsoft)The most recent Windows update I'm postponing is the .NET Framework 3.5 Service Pack 1 for .NET Framework Assistant 1.0. This is the patch that installed a Firefox extension that initially couldn't be uninstalled without jumping through hoops. Microsoft has subsequently updated the update to make it easier to uninstall.
Unfortunately, unchecking the patch's entry in Windows Update doesn't prevent the system-tray icon and pop-up alert from returning the next time your start your system. Clicking the icon opens Windows Update with the "Important" item you just unchecked rechecked.
Unchecking a Windows Update entry lasts only until the next time Windows starts, which rechecks the option.
(Credit: Microsoft)To remove the entry from the Windows Update list in Vista, right-click it and choose Hide update. In XP, click Custom on the Microsoft Update or Windows Update screen, uncheck the item, and click Don't show this update again.
Right-click the Windows Update you want to postpone and click Hide update to keep it from generating the available-updates icon.
(Credit: Microsoft)When you're ready to install the update you just hid, reopen Windows Update or Microsoft Update, and click Restore hidden updates in the left pane. In Vista, check the update you want to unhide and click Restore. If the "Restore hidden updates" option is grayed out in XP, click Custom and then Restore them now under the Important warning. Check the option and choose Restore and Check Again.
You may have noticed Elinor Mills' story out of this week's RSA security conference on an F-Secure researcher recommending that PC users avoid the Adobe Reader PDF program because of its unpatched vulnerabilities. The story includes a link to PDFreader.org's downloads of free Adobe Reader alternatives.
My favorite Adobe Reader alternative didn't make that list, however. Foxit Software has a reputation for patching its free Foxit Reader PDF program faster than Adobe plugs holes discovered in Reader.
It's starting to feel like keeping your software up-to-date is a full-time job. Last October, I described how to ensure that your copy of Windows is fully patched. That post includes a link to an article by Scott Dunn on troubleshooting Windows Update glitches. (Scroll down to "Tips for installing recalcitrant updates" about halfway through the article.)
Lots of PC experts recommend Secunia's free Online Software Inspector (OSI) and downloadable Personal Software Inspector application (free for home use). Unfortunately, the last time I used OSI, it kept listing my Flash player and Java installation as out-of-date when both were the latest releases. (See this post from last October on Michael Horowitz's Defensive Computing blog for more on problems with OSI.)
While popular programs such Mozilla's Firefox browser, Apple's QuickTime player, and Sun's Java runtime environment can be set to update automatically, the best way to ensure that your PC has the most recent versions of its software is to visit Download.com or the download page on the vendor's site and install any required updates manually. Here's where to find some of them:
• Adobe Flash Player version 10.0.22.87
• Apple QuickTime Player 7.6
• Sun Java Runtime Environment version 6 update 13
• Mozilla Firefox 3.0.9
The best way to update Windows Media Player, Internet Explorer, and other Windows components is via Microsoft's Windows Update service. Likewise, to keep your Office apps patched, browse to Microsoft Office Online's Downloads page and click the Office Update link in the left pane.
Sometimes, it pays to go with your first instinct.
For the last couple of weeks, every time I opened the Firefox browser on my PC, the program attempted to update but failed. I didn't sweat the error message at first, thinking that it was likely a widespread problem that the good folks at Mozilla would address soon enough. And besides, version 3.0.4 opened right after I closed the error message, and everything appeared to be working normally.
I kept, however, getting that same error message every time Firefox loaded. It struck me that one of the things viruses do is block your security and other programs from updating. I didn't think that this failure was a sign of a virus, but I couldn't be sure.
Opening Firefox 3.0.4 generated this cryptic error message after failing to update to version 3.0.5.
(Credit: Mozilla Foundation)My first inclination was to uninstall version 3.0.4 and then install Firefox 3.0.5 manually. But on second thought, this struck me as too extreme. After searching the Internet for information about failed Firefox updates, I chased many a wild goose as I disconnected my Webcam, rechecked my firewall, and followed many other useless pieces of advice recommended by reputable Web sites.
All to no avail. So I opened Vista's Programs and Features (the equivalent of XP's Add or Remove Programs applet) by pressing the Windows key, typing appwiz.cpl, and pressing Enter. I uninstalled Firefox 3.0.4, closed the applet, and opened the Opera browser so I could visit Mozilla.org to download Firefox 3.0.5.
This is where things took a slight detour. I don't use Opera very often, so it wasn't a surprise to see a prompt to download the latest version 9.63. I'm sure that Opera 9.62 would have downloaded the Firefox 3.0.5 executable just fine, but I figured that I might as well keep the update thing rolling.
But then Opera wouldn't update. The error message said something about my G: drive. I opened Windows Explorer and saw that I had no G: drive. Then I remembered that I set Opera to run off a USB thumb drive, which I had recently disconnected. I retrieved that drive and tried the Opera update again. This time, version 9.63 installed without a hitch.
And wouldn't you know it, so did Firefox 3.0.5, once I downloaded it from the Mozilla Foundation site. I suppose that I should be curious about why the browser wasn't able to update itself in the first place, but I'm satisfied just to have the latest version in place.
Three years ago, I attempted to condense PC security into 10 steps you could finish in about an hour. After a recent false-positive on a virus scan, I returned to that advice and realized that those tips are sorely out of date.
I'll re-examine the first three tips here and will cover the rest in posts later this week.
Step one: Set Windows to download and install updates automatically.
I don't do that anymore. Windows updates often cause problems, so I set Windows to download but not install updates. Then I wait a couple of days before actually applying the patches to see whether there are any reports of problems related to the fix. If all is quiet on the update front, I install the patches. I don't have to worry about forgetting because Windows will keep a little update icon in my system tray.
To change your Automatic Update settings in XP, click Start > Control Panel > Security Settings (in Category view) > Automatic Updates. Select "Download updates for me, but let me decide when to install them" and click OK. You'll find more about XP's automatic-update settings on Microsoft's Help site.
To access Vista's update controls, press the Windows key, type windows update, and press Enter. Click "Change settings" in the left pane, choose "Download updates but let me choose whether to install them," and click OK.
Set Vista to download updates but let you decide whether to install them via Windows Update's Change Settings dialog.
(Credit: Microsoft)Step two: Visit the Windows Update site (or Microsoft Update, as the case may be) to download updates manually if the PC has been off for a long while.
Perhaps a better destination for your first stop after an extended period offline is Secunia's Online Software Inspector or free Personal Software Inspector.
Both the online scan and downloaded program will check Windows and many applications on your PC to ensure that you're using the latest versions available. The client-based scan recognizes more programs than the Web-based service.
Step three: Enable Windows' built-in firewall.
This tip is way out-of-date. On the good side, the defenses built into Windows XP and Vista have improved considerably over the last three years. Unfortunately, they haven't improved enough to trust the safety of your system and private information to Windows alone. In my opinion, you simply have to use a security suite.
In the absence of a commercial security suite, you should activate the firewall and other security features in Windows Defender. But that's just not good enough. There are plenty of free antivirus programs, bidirectional firewalls, and anti-spyware programs. You'll also find a lot of security add-ons for the Firefox browser.
The problem is in managing several different security programs, any of which could conflict with some other app on your PC or with Windows itself. That's one of the principal advantages of a security suite: you can be pretty sure the various components will work well together, and you're dealing with only one vendor, for better or worse.
You can compare the virus-detecting ability of various security programs by perusing AVTest's most recent results, which include tests of the 2009 editions of most big-name security apps.
Next up are steps four, five, and six, which include keeping your browser safe. That will be the subject of my next post.
Microsoft usually releases patches for Windows on the second Tuesday of the month. But last Thursday, the company sent out an update that was too important to withhold for two more weeks. If you have your PC set to download and/or install Windows updates automatically, you've already received this patch. (You'll find more on managing Windows updates at this previous Worker's Edge blog post.)
In Vista, you can make sure you've got this update by pressing the Windows key, typing Windows Update, and pressing Enter. Click "View update history" in the left pane and look for an entry labeled Security Update for Windows Vista (KB958644) and dated 10/23/2008.
Make sure Vista has the most recent Windows patch.
(Credit: Microsoft)The patch is even more important for Windows XP PCs, which lack some of Vista's built-in defenses, such as User Access Control (yes, it's good for something). You can open Windows Update by clicking the applet's shortcut on XP's Start menu, or assign the shortcut a key combination to open it from your keyboard .
To do so, right-click the Windows Update shortcut on the Start menu, choose Properties, click in the "Shortcut key" box under the Shortcut tab, and press your desired key combination--I chose Ctrl-Alt-U.
In XP's Windows Update applet, click "Review your update history" on the left and look for an entry with the Knowledgebase (KB) number 958644 (see the screen above).
If you have trouble downloading or installing this or any other Windows update, see Scott Dunn's information on troubleshooting Windows Update. (Scroll down to "Tips for installing recalcitrant updates" about halfway through the article.)
A couple of weeks ago, my notebook lost its ability to connect to AT&T's 3G data network. Downloading and installing the latest version of the company's communications management application restored the network link. (I had to use the notebook's built-in Wi-Fi adapter to download the program, of course.)
Just yesterday, my iPhone started acting up: the screen would freeze, and phone calls wouldn't hang up, among other symptoms. Once I connected the device to a PC and downloaded the most recent release of the iPhone software, the glitches disappeared.
If only all PC problems could be solved simply by reinstalling the software. It may be the shotgun approach to hardware and software troubleshooting, but sometimes a software refresh will clear out whatever cobwebs were futzing up the works.
You don't have to wait until your devices or applications start to act up to update them, however. Scanning your system for out-of-date programs can help you avoid trouble by pointing out the unpatched security holes on your PC.
In the past, I have recommended Secunia's online software scan and the PC-based version, the free Personal Software Inspector. I use Secunia's online scanner to get a snapshot of my software's update status. But rather than applying any necessary patches via Secunia's service, I go to the vendor's site to download the latest version.
Secunia's online software scanner will identify old, vulnerable versions of the applications installed on your PC.
(Credit: Secunia)For example, my most recent Secunia scan indicated that Apple's iTunes and QuickTime, Adobe Systems' Flash player, and Sun Microsystems' Java Platform were out-of-date. I opened the Apple Software Update app to get the latest versions of iTunes, QuickTime, and the Safari browser (which Secunia did not identify as out-of-date).
I also visited Adobe's site to get the latest release of the Flash player and Sun's site for a Java update, but Secunia's scanner still identified these programs as vulnerable. It turns out, the old versions of Flash and Java aren't uninstalled when the new versions are added.
You can remove old versions of the Flash player by downloading and running Adobe's Flash Player Uninstaller (scroll to the bottom of the page to find the uninstaller download).
The Java site claims that you should retain old versions of the Java Runtime Environment because some older apps may be incompatible with more recent releases. Still, if you're running out of disk space, you can remove old Java versions via Windows' Add or Remove Programs Control Panel applet (or Vista's Programs and Features).
On my year-old notebook, there are six different Java versions, each using about 136MB of disk space. To play it safe, keep at least the last two Java releases installed.
Secunia's online scanner gives you the option of checking "Enable thorough system inspection" to have the scanner look for applications in nondefault locations. Using this option can add several minutes to the scan--with the option unchecked, the scan usually takes only a few seconds to complete.
The in-depth scan did uncover a handful of outdated applications on my PC that the online scanner missed, though none posed the same security threat as the old versions of the iTunes/QuickTime and Flash player did. Still, the patches are free, so why not?
For the last couple of months, I have been trying to find the source of an intermittent glitch with my notebook PC's wireless connection. I would often lose Internet access when waking the system from sleep mode: the network icon in the system tray indicated "Local only."
Restarting the machine restored the wireless link, but then why use sleep mode at all? After a little trial-and-error (mostly the latter), I decided to check the age of the device driver for the notebook's wireless adapter. Not surprisingly, the driver was slightly older than the machine itself, which I bought last fall.
I found a newer version of the driver on the notebook vendor's site. It took only a few minutes to download and install the update. After restarting the system, I put the machine to sleep by pressing the Windows key, the right arrow, and Enter. When I woke it up by pressing Enter again, the network icon showed a little blue globe in its bottom-right corner to indicate that I had an Internet connection.
That driver update turned out so well I decided to check the other refreshes available for my notebook. I noticed one for the video adapter that was said to fix a problem with streaming Internet videos. Bonus! I decided to call it quits after those two updates lest something goes wrong and I'm left wondering which update is the cause.
Here are a few other driver-update precautions:
Get your drivers from the PC vendor.
System vendors often customize the drivers for their machines. In fact, when I searched for a driver update on the site of the company that made my notebook's video adapter, I was politely instructed to look on the notebook vendor's site for the appropriate update. A link would've been nice, but I'm not complaining.
Stick with updating only the devices that are acting up.
The old "ain't broke-don't fix" rule applies here. Even a two- or three-year-old PC will likely get along fine with the original driver for its hard drive, though a BIOS refresh might be helpful. As in my case, video cards and wireless-network adapters are likely to benefit most from a new driver.
Create a restore point.
Windows XP and Vista will likely create one for you before the new driver is installed, but to play it safe, set one yourself via System Restore and give it a descriptive name just in case you forget when exactly you loaded the update. Do not rely on Windows' Roll Back Driver function under the Driver tab in the Device Manager Properties dialog box. Likewise, run the update's own installer rather than using Properties' Update Driver button.
Don't count on the "Roll Back Driver" option in Windows' Device Manager Properties dialog; create a restore point instead.
(Credit: Microsoft)
Update your drivers one at a time.
As I mentioned above, if you load several updates in quick succession and something goes wrong, it can be difficult to figure out which update is the troublemaker.
You probably don't need to pay for a software-update service.
This is another one for the "ain't broke-don't fix" category. If you've got so much software on your PC that you need a service to track it, maybe you should think about simplifying your life--or at least the tech part of it. Most PC users can manage their software updates on their own, with a little help from the vendors.
You can get your Microsoft Office updates automatically via the Windows Update service, and other major applications offer similar auto-update functions. Likewise, Flash, QuickTime, and other media players can be set to update automatically, as can Firefox and other browsers (IE 7 updates along with Windows). Last month, I described ways to manage Windows Updates and to keep Apple's Safari from being offered as part of the company's iTunes and QuickTime updates.
I use Apple's Safari browser on my iPhone but don't have much use for it on my Windows PCs. I do run iTunes and QuickTime on the Windows systems, so every time there's an update for one of those apps, I'm prompted to download Safari.
A quick tweak of the Apple Software Update utility makes the Safari prompts history.
Open the Apple Software Update application via its shortcut on the Start menu. To set the updater to stop nagging you about Safari, check the browser's option in the main window, and click Tools > Ignore Selected Updates. Then click Quit.
Set the Apple Software Update utility to ignore the Safari browser.
(Credit: Apple)Alternatively, you can change how frequently the program checks for updates or stop it from checking automatically. Click Edit > Preferences and choose Daily, Weekly, Monthly, or Never. When you're done, click OK and Quit.
Change how frequently Apple Software Update checks for updates, or set it not to check at all.
(Credit: Apple)Now you'll get the Apple updates you need on your schedule without having to uncheck options for programs you don't want.
Microsoft's Internet Explorer remains the most popular browser in the world. This despite report after report calling the program less secure than Mozilla Firefox, Opera, and other free competitors.
Yet IE remains the preferred browser of nearly four out of five people surfing the Web. If you're one of the Web majority, there's one thing you can do to enhance your online security: Update to the latest IE release.
According to Net Applications, IE 6 accounted for more than 26 percent of the browser market in June 2008, while IE 7 was used by over 46 percent of all people on the Web. If your PC runs Windows 2000 or an earlier version of the OS, you can't upgrade to version 7 of IE. Unless your boss insists that you use the older version of the browser on XP or Vista, you've got no excuse for not upgrading to the safer IE 7.
Unfortunately, Microsoft updates the browser only once a month, and even then not all known holes in the browser will be plugged, as Michael Horowitz pointed out in his Defensive Computing blog last week (scroll down to read the updates).
Even with Microsoft's spotty update record, it pays to upgrade to IE 7, and to download and install all available security patches for that version of the browser. If you set Windows to download updates automatically but prompt you to install them, or to alert you when updates are ready to download (as I described in a previous post), click the update-alert icon when it appears in your system tray to open the Windows Update Control Panel applet. In Vista, choose "View available updates" in the right pane under the Install Updates button.
Click "View available updates" under the Install Updates button in Vista's Windows Update applet.
(Credit: Microsoft)Check the updates you want to install. Look specifically for security patches for Internet Explorer. Once you've made your selections, click Install.
Check the Windows (and IE) updates you want to add and click the Install button.
(Credit: Microsoft)As with all Windows updates, you may want to wait a day or two after an IE patch is released before installing it. Then keep an eye on the tech-news sites for reports of update-related glitches. If all appears to be well with the update, add it to your system. Remember what they say about the pioneers being the ones with the arrows in their backs.
