Newsletter Archives

  • Which Web browser is the most secure for 2025?

    PUBLIC DEFENDER

    Brian Livingston

    By Brian Livingston

    With all the malware threats we face on the Internet these days, running an antivirus program is a must. But your browser can help, too, warning you about shady websites and preventing your browsing history from being tracked by corporations or governments.

    I most recently wrote about protecting yourself while Web surfing in my AskWoody column titled Browsers with the best security and privacy in 2021.

    Much has changed since that time. We need to question whatever our old choice of browsers may have been and update our knowledge with the latest ratings by security experts.

    Read the full story in our Plus Newsletter (22.17.0, 2025-04-28).

  • MS-DEFCON 4: Mixed bag for March

    alert banner

    ISSUE 22.12.1 • 2025-03-25

    MS-DEFCON 4

    By Susan Bradley

    Although CISA has given businesses who follow its guidance until early April to install updates released in March, I’m urging you to do so now.

    Accordingly, I’m lowering the MS-DEFCON level to 4. You can find CISA’s deadlines in its Known Exploited Vulnerabilities Catalog.

    Note that my recommendations for businesses include some possible exceptions.

    Anyone can read the full MS-DEFCON Alert (22.12.1, 2025-03-25).

  • Debug your browser

    ON SECURITY

    Susan Bradley

    By Susan Bradley

    It all started the other day when the social media website Twitter moved completely to its new domain, x.com.

    Before you shame me for using any sort of social media these days: I have very good reasons.

    One is that it’s still, hands down, the best way to determine whether a problem with a cloud service is your problem or the cloud’s problem. Microsoft still uses 𝕏 as a means to send out status alerts. Thus for many in IT, this continues to be a key way to remain aware of issues in technology.

    Read the full story in our Plus Newsletter (21.22.0, 2024-05-27).

  • Browsers and search engines

    ON SECURITY

    Susan Bradley

    By Susan Bradley

    If you are as old as I am, you will remember the revolutionary changes the browser Netscape Navigator and search engine AltaVista brought to our desktops.

    In what now seems like an overnight event, all those research topics that used to require a trip to our local libraries became a mere dial-up call away, using our light-speed, 9600-baud modems. Okay, a little patience was required in those days, even once those ubiquitous modems reached the dizzying heights of 56K.

    At about the same time, we witnessed the start of what was to become a decades-long browser and search-engine war, during which we all have probably changed allegiances several times.

    Read the full story in our Plus Newsletter (20.44.0, 2023-10-30).

  • Why aren’t you using Edge?

    WINDOWS

    Josh Hendrickson

    By Josh Hendrickson

    You’re probably reading this newsletter from Chrome. But I’m not. I’m using Microsoft Edge.

    I know, I know. It’s pretty easy to take potshots at Microsoft as a whole, let alone a browser that comes from the company. This is the maker of such “fine” products as Windows Vista, Windows 8, and Internet Explorer. Yes, I agree — the tech behemoth has missed the mark plenty of times.

    But let’s also be fair: for every terrible version of Windows you can name, there is a great one you never wanted to leave (Windows XP and 7, anyone?). The company can put out good products, too, and even good hardware these days (hello, Surface). And the Edge browser is something different — it’s Chrome, but better.

    Read the full story in our Plus Newsletter (20.41.0, 2023-10-09).

  • How to manage your browser cookies

    INTERNET

    Lance Whitney

    By Lance Whitney

    Browser cookies can be helpful or harmful, depending on how and why they’re used in your browser. The key lies in taking control of them.

    You probably already know that Web browsers use cookies to save certain information. Over the years, cookies have developed a bad rep because many websites and advertisers use them to track your online activities for the purpose of sending you ads and other targeted content.

    But cookies can also help you by storing key details at websites that you frequently use. The trick here is knowing which cookies are good and which are bad, and how to manage them in general.

    Read the full story in our Plus Newsletter (20.16.0, 2023-04-17).

  • Warren: Google’s experimental change to Chrome crashed the browser

    Lest you think Windows gets all the fun parts…

    Tom Warren at the Verge is reporting:

    Google left thousands of machines in businesses with broken Chrome browsers this week, following a silent experimental change. Business users accessing Chrome through virtual machine environments like Citrix kept seeing white screens on open Chrome tabs, blocking access to the browser and leaving it totally unresponsive.

    Ends up Google flipped a bit on some machines to enable a feature called WebContents Occlusion. Kaboom.

    I really like this quote from an admin who got hit:

    “Do you [Google] see the impact you created for thousands of us without any warning or explanation? We are not your test subjects. We are running professional services for multi million dollar programs.”

    Welcome to my world….

  • Win7 share declining slowly, Edge still in the doldrums

    According to NetMarketShare, Win10 share usage is up from 52% in September to 54% in October. Win7 share went from 29% to 27%.

    Statcounter says that Chrome went from 62 to almost 63% usage share, while Edge went from 3.1 to 3.0%.

    All numbers subject to the usual disclaimers – based on flawed sampling, it ain’t gospel, more like reading tea leaves, and all that really matters is long-term trends.

  • The Chrome vs Edgemium (Chredge?) wars heat up

    With Edge now absorbing the Chromium rendering engine*, I expect all of the Windows-centric bloggers to start explaining, in excruciating detail, why the New Edge is better than the current Google Chrome. The new Edge, it must be noted, is only available in beta preview versions. Even the latest Win10 1903 bits from MSDN contain the old Edge.

    Martin Brinkmann has a detailed side-by-side comparison, and come up with eight significant ways in which the beta Edgemium is better than (or at least different to) the shipping Chrome.

    In the end, I think this sentence hits the nail on the head:

    While you could say that you trade one data-hungry company for another, it boils down to personal preference.

    I think it’s great that Microsoft is getting back into the browser wars. (Deja vu all over again, eh?) It’ll be good for Microsoft, for Google, and most of all for us.

    I think Edgemium’s greatest foe is its pedigree. In my experience, people just don’t want Microsoft products unless they have to use them. But then again, Google’s had plenty of dirty laundry recently.

    Let the best browser win.

    *Good explainer by Gregg Keizer in Computerworld.

  • Google comes clean on that “emergency” security patch – and shows how it was used to trigger a Windows 7 0day

    Now I understand.

    Google releases patches for its Chrome browser all the time. As @b explained about 36 hours ago, Google sent out a special alert to get Chrome updated specifically to head off a 0day attack.

    I didn’t get too excited about it because Chrome automatically updates itself quite reliably, and because the threat didn’t seem to be all that great.

    A few hours ago, Clement Lecigne of the Google Threat Analysis Group added some key details:

    On Wednesday, February 27th, we reported two 0-day vulnerabilities — previously publicly-unknown vulnerabilities — one affecting Google Chrome and another in Microsoft Windows that were being exploited together.

    To remediate the Chrome vulnerability (CVE-2019-5786), Google released an update for all Chrome platforms on March 1; this update was pushed through Chrome auto-update. We encourage users to verify that Chrome auto-update has already updated Chrome to 72.0.3626.121 or later.

    The second vulnerability was in Microsoft Windows. It is a local privilege escalation in the Windows win32k.sys kernel driver that can be used as a security sandbox escape. The vulnerability is a NULL pointer dereference in win32k!MNGetpItemFromIndexwhen NtUserMNDragOver() system call is called under specific circumstances.

    We strongly believe this vulnerability may only be exploitable on Windows 7 due to recent exploit mitigations added in newer versions of Windows. To date, we have only observed active exploitation against Windows 7 32-bit systems.

    Pursuant to Google’s vulnerability disclosure policy, when we discovered the vulnerability we reported it to Microsoft. Today, also in compliance with our policy, we are publicly disclosing its existence, because it is a serious vulnerability in Windows that we know was being actively exploited in targeted attacks. The unpatched Windows vulnerability can still be used to elevate privileges or combined with another browser vulnerability to evade security sandboxes. Microsoft have told us they are working on a fix.

    As mitigation advice for this vulnerability users should consider upgrading to Windows 10 if they are still running an older version of Windows, and to apply Windows patches from Microsoft when they become available. We will update this post when they are available.

    Google’s vulnerability disclosure policy says, to a first approximation, that it gives software manufacturers 90 days to fix a security hole, and if no fix appears, they disclose the details.

    It’ll be interesting to see how Microsoft reacts.

    UPDATE: Catalin Cimpanu has a thorough timeline on ZDNet.

  • Woody’s Windows Watch: Dispatches from the browser-war’s front lines

    Internet Explorer isn’t a web browser. According to Microsoft, it’s been demoted to a “compatibility solution.”

    Edge has some big fans, very few users — and it’s about to get a heart transplant.

    Chrome’s the crowd pleaser, but one hare-brained idea (recently rescinded) has to give you pause.

    Firefox keeps on foxing, but in terms of usage numbers, it can’t get a break.

    What should you do?

    Out this morning in AskWoody Plus Newsletter 16.6.0. Now available – yes, for free — on AskWoody.

  • Keizer: IE and Firefox catch a break last month

    Gregg Keizer has his usual excellent analysis of the monthly browser statistics:

    For the first time since June, Microsoft’s two browsers managed to hold onto their share of the browser market; the same could not be said of Firefox.

    Edge usage share was flat last month, but IE bumped up a little bit. Astounding.

    It’s a dog-eat-dog world. Surprisingly, Firefox is doing very well financially. But Chrome continues to swallow the earth.