Paul Hutchinson's Blog

My Nexus 5X on Google Fi asked me if I wanted to try out the Trusted Voice feature last week so I did. Unfortunately it makes the phone wake and show an invalid lock message when people around me or on TWiT shows say OK Google or sometimes just Google.

Then something happened that showed me how much this feature lowers the secutiy of your phone. I was watching All About Android and Aaron Newcomb said OK Google multiple times during his conversation with Ron Richards. My phone kept showing the bad unlock screen and going back to sleep until one time it unlocked! Oops, I decided that the convenience of this feature was far outweighed by the reduction in security so I turned it off.

Was listening to this weeks episode of This Week in Google on TWiT.tv and beleive I heard more errors than I can remember ever hearing before, three of them in rapid succession.

1. Jeff conflated the still living management consultant Tom Peters (author of In Search of Excellence) and the deceased Professor Laurence J. Peter (creator of the concept named the Peter principle).
2. Then Leo and the group were thinking that an advisory rule about hot tub temperature limits was a law. AFAIK it isn’t a law, the reason that many manufacturers follow the advisory is due to either real problems they have experienced or requirements from their liability insurance providers.
3. The last thing was that Leo claimed that Raspberry Pi’s where susceptible to the recent round of processor flaw security problems. They aren’t, see Eben Upton’s post for details.

They pushed this extension down to most users without warning.

Looks very suspicious and the first time I saw it I clicked Remove immediately. After all a weird extension name that I knew I hadn’t installed with an all caps Lewis Carol quote seems like some kind of malware. For a while I was thinking of uninstalling Firefox because if malware extensions are going to appear without any user action or notification it must be horribly insecure.

After investigating a bit and learning it was not malware simply a Firefox team error, so I clicked the More link.

Two observations, this is a handy list of the incompetent people who did this incredibly stupid act so other companies know not to hire them. Second observation it’s been out for a whole day and the Firefox team hasn’t fixed this yet, not good. Frankly if I didn’t love NoScript I’d dump Firefox since it is not any faster than Chrome in any usage or testing I’ve done.

I’ve been using and promoting Firefox since the beginning when it was named Phoenix back in 2002. When the Firefox team wanted to place a full page ad in the New York Times I even chipped in some cash and had my name included in the list of supporters.

However today a new era has begun for Firefox and it eliminates the only reason I’d still been sticking with Firefox for 15 years. With the loss of NoScript I can’t think of any reason to keep using Firefox. Two other extensions I’ve relied on, TiddlySaver and Zotero, had made stand alone desktop programs to replace the loss of local file saving in Firefox. NoScript doesn’t have that option and I’d hoped it would continue but alas the Firefox team obviously felt it wasn’t worth any effort to help get it working :-(.

So long Firefox it was a great 15 years. see 11/18 update

Update 11/15/2017

I failed to mention that there was a perfectly good security reason for removing some capabilities in Firefox extensions. While the security hole shown at the link would not affect me it could easily have hurt normal users.

The NoScript Author has now published an article originally saying a new Firefox 57 compatible version of NoScript would be available today but now saying by the end of the week and adding some screen shots. Looking at the screen shots the new UI is very poor compared to the old NoScript and poor compared the UI of uBlock Origin. Since I spent quite a bit of time getting to know uBlock Origin on Chrome yesterday, I don’t think I’ll bother trying the new NoScript when it eventually comes out (I never count on time promises from solo free software developers). see below

Update 11/18/2017

Don’t it always seem to go
That you don’t know what you’ve got
Till it’s gone

Joni Mitchell – Big Yellow Taxi

This has proven to be so true, after a few days with uBlock and reading up on alternatives I’ve come to the conclusion that with the single exception of NoScript every script blocker out there is really more of an advertising and web analytics blocker. That is not at all what I want! I always white list all the well known analytics companies because as a webmaster I know how useful it is to know about who is utilizing your site. When ever I visit a site and find useful content I immediately do a temporarily allow all to let through the advertising and let the web owner get there revenue (it ain’t cheap to offer good free stuff on the net).

The one thing I absolutely want to happen when I visit a site for the first time is to block every single last bit of scripting that comes from a source not on my white list. AFAICT NoScript is the one and only script blocking system that does this which makes it the one and only true script blocking tool for security purposes. The loss of NoScript has made my web usage so incredibly slow the last few days because I now have to stop and be think about how much danger is in clicking a link.

I have now installed Firefox 52 ESR and NoScript 5.1.7, removed uBlock from Chrome and plan to re-install Firefox 57 as soon as NoScript is ready.

Update 11/19/2017

The Firefox 52 ESR install screwed up my PC very badly, LastPass, Xmarks and Firefox all become incredibly buggy and unstable. In the end I had to uninstall Firefox and all instances of LastPass, manually remove all Firefox profiles, and manually edit the registry to remove every reference to Firefox. Things got so bad that LastPass in Chrome was no longer working properly. I’ve now got LastPass in Chrome working properly and I’ve got Firefox 57 installed with LastPass working. Hoping a compatible version of NoScript comes out soon.

With everything stable again I ran some timing tests to see if Firefox really is faster in my real world usage. I’m sure the benchmark results mentioned by Mozilla are true but benchmarks are a long way from real life web usage. My tests show Chrome is still slightly faster than Firefox on loading a variety of pages I regularly visit by about 3 tenths of a second. So other than the fact that it is the only browser that has NoScript there is no real reason to prefer it over Chrome for me.

Update 11/20/2017

The new version of Noscript is out!
Also, Xmarks came out of beta and is working well now too!

I’ve been using the Podcasts App on my iPad to play all the TWiT network shows. With previous versions of the App it automatically played the feed in sequence. The new version removed this feature so now each individual episode has to be manually added to the queue. A real productivity killer 😦

Update 10/18/2017:

Found a way to make the app work like the older version. The trick is to create a station with all the podcasts then when you play the station it automatically plays the next podcast without user intervention. See this Apple Forum post by cyberbiker for detailed instructions.

 

Currently Microsoft sets up Windows Defender to automatically perform all of the tasks the vast majority of people need. However some people would prefer to have a regularly scheduled full scan. It used to be just a matter of editing one of the preset tasks to set up this function. It appears Microsoft has made some recent changes that makes obsolete all the instructions on the web that I found. So here is my take on setting up a scheduled full scan.

1. Open Task Scheduler by pressing and releasing the Windows key, or clicking the start menu icon, and then type tas. Then select Task Scheduler from the list.
     
2. In the upper right of the Task Scheduler click on Create Basic Task.
   
3. When the Create Basic Task Wizard opens, enter a Name for the task and optionally a description then click Next.
   
4. Choose the type of trigger you want for the task and click Next.
   
5. Set the specific items for the task’s trigger and click Next.
   
6. Choose the Start a Program option and click Next.
   
7. Enter the Program/script to execute and the argument.
   a. To use the GUI version of Windows Defender enter:

   "%ProgramFiles%\Windows Defender\MSASCui.exe"
   and
   -FullScan

   or
   b. To use the command line version of Windows Defender, enter:

   "%ProgramFiles%\Windows Defender\MpCmdRun.exe"
   and
   -Scan -ScanType 2

   There are other variations you can use, see How to use Windows Defender with Command Prompt on Windows 10 for details.

8. Click Finish to save the task.
   
9. Scroll the list to make sure that the …
   
   task has been scheduled the way you expected.
   
10. Test out the program and argument settings by right clicking the task and selecting Run.
    
11. If you set up for the GUI version to run you should see this.
    
    As of 4/7/2018 Defender on my Win 10 Pro looks like this:
    
    If you set up for the command line version to run you should see this.
    

After setting this up on my always logged in and awake desktop I realized the settings I used will fail if the Windows 10 PC/laptop logs you out and/or goes to sleep. To make this work in that situation edit the following settings.

1. Right click on the task you created and select Properties.
   
2. On the General tab change the Configure for: drop down list to Windows 10. That change is not strictly needed but it emphasizes that I’ve only tested this on Windows 10 so use on other/older versions may not work.
   Now click the Change User or Group… button.
3. In the text box type system and then click the Check Names button.
   
4. The text you entered will change to SYSTEM to indicate it checked out fine. Click the OK button to finish the user change operation.
   
5. You’ll be taken back to the General tab and it will show NT AUTHORITY\SYSTEM and the Run only when user is logged on radio button is selected and grayed out.
   
   If after you finish the next steps you check this setting again you will see it has been changed by Windows to SYSTEM and the Run whether the user is logged on or not.
   
6. Click the Conditions tab and check the box that says Wake the computer to run this task. Then click the OK button to finish changing the settings.
   

That should be all you need to get it working, if you have any questions, comments or suggestions please leave a comment or send me an email.

If you find yourself needing bookmark management features that are still not avaialable in the Edge browser try out this program: Manage Edge Favorites