Blogger I.Q.

Blogger and WordPress Tips

Tech Talks

Matt Cutts Videos – a shortcut to all of Matt’s videos

by 3 Comments

Matt Cutts, (bio) the head of the web spam team at Google has provided a number of videos talking about SEO, blogging best practices and answering questions from bloggers worldwide. His videos are not only informative but are very short and precise.
 

That being said, what if you still want to lessen the time spent – instead of watching all his videos how would you feel if there is a Summarized Solution given for every question asked in the Google Webmaster videos series? Awesome, right? That’s how even I felt when I came across this website which is aptly named as:-

The Short Cutts. The Short Answers to every Matt Cutts Video

This website provides a simple, sweet, precise answer to all the questions asked to Matt Cutts by humans worldwide. The website is a simple one which you’ll definitely find useful, if you are a regular follower of the Google Webmaster Videos YouTube Channel.

The website also offers four guides as freely downloadable after we sign up on their contact form page. Though, I wouldn’t sign up unless I really want to read their guides – they are useful but I chose I would pass them for the time-being and revisit them later.

One funny feature about the website is that they provide different colored T-Shirt pictures which when clicked filters the webmaster videos that has Matt Cutts wearing that colored T-Shirt which was clicked!

Give it a try and please let me know your comments below if you found this useful.

How to map a Network Drive within My Computer in Windows 7

by Leave a Comment

A quick setting to map your local folder/network drive

Let’s say you have a frequently used folder in your Windows PC or Laptop which you open frequently.

 

There are 3 traditional options which I’ve used so far to get to my frequently used folders:

 

  • First I go to my folder – right click on it – and ‘Send To Desktop (Create Shortcut)’. Or
  • I copy the full path of my folder, keep it in ‘Run’ utility command box and open it from there. Or
  • Add it to my favorite folders inside an Explorer window.

Though all of the above works equally well, here is a geeky way to get this job done, using the Command Prompt Window. Using this trick you can assign an unused drive letter to your frequently used folder, making it an entry within your ‘My Computer’. I guess this stays inside My Computer until you logoff or shut down your computer.

Example:
Let’s say you want to have a folder called ‘Source’ within your C drive, assigned to a drive letter called ‘Q’.
Open Command Prompt Window. (Type CMD in Run command window) (Win key + R to open your Run command) and type the following command:
SUBST Q: “C:SOURCE”
 
That’s it. Now you will have a folder added within My Computer window like this one:
How to remove the drive letter assignment:
If you want to remove that folder from the assigned drive letter then simply type in this command:
SUBST Q:   /D
 

Hit enter to free your drive letter assignment within My Computer.

How to map a network drive in Windows 7

  1. Open Computer by clicking the Start button – click on Computer.
  2. Click the Tools menu, and then click Map Network Drive.
  3. In the drive list, click a drive letter which is unused so far.
  4. In the Folder box, type the path of the folder or computer you want to map or click Browse to find the folder or computer.
  5. Click Finish.

Find this tip useful? Please let me know your comments below.

13 Questions To Understand The Bug “Heartbleed” Better – A Definitive Guide To Know What Exactly Is The Heartbleed Bug In OpenSSL

by Leave a Comment


What is Heartbleed?

It is one of the most wide spread vulnerabilities in internet.

This is one of the biggest flaws today’s internet has faced. The core of heartbleed is encryption and encryption standards used in the design of HTTPS. SSL and TSL – Security Sockets Layers and Transport Security Layer. These toolkits are commonly known as OpenSSL – toolkits to frame cryptography. A flaw in this toolkit is called Heartbleed – something which the human user nor the server side platforms have any clue that a security flaw exists – which can be taken advantage of by anyone.

heartbleed thekeyponderer


When was this discovered?

Around Monday, the 8th of April, 2014. Severe implications for the entire web community were foreseen. This bug can leak sensitive user information and personally identifiable information like usernames, passwords, SSNs, credit card numbers, bank account details and transactions. This bug has been in place since 2011. And all this bug does is compromise 64K of information from a piece of the storage. That’s well enough to steal sufficient user personal information – more importantly that’s also enough to get a private key and decrypt that to find the rest of the information.

Who found the bug first?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team (source:heartbleed.com). While this is not essentially a bug but a simple programming error that led to Heartbleed, Neel Mehta from the Google research community needs a big thanks for another reason – he also donated a $15,000 bounty he received as an award for discovering this bug to the Freedom of the Press Foundation’s campaign for development of better encryption tools. According to LATimes, “Both teams found that OpenSSL, an open-sourced security encryption program used by 66% of Internet servers, had a flaw that would allow any hacker using a simple script to gain access to a treasure trove of personal information”.

Who is responsible for this Heartbleed bug?

According to the Guardian, the programmer behind this code glitch was Robin Seggelmann who worked on the OpenSSL project for the Heartbeat extension. This extension is just an additional feature and is not the core part of the OpenSSL project. And since this was an open source in itself, one person cannot be blamed.

Nomenclature. Why is it called as Heartbleed, what’s the reason behind this nickname?

An engineer in Codenomicon coined it. The technical name, CVE-2014-0160 was named for the particular line of code that contained the vulnerable code. According to the systems administrator at Codenomicon who coined the term, he just played on the words ‘heartbeat’ which is an extension in the OpenSSL Toolkit. Ossi Herrala – the Codenomicon employee “thought it was fitting to call it Heartbleed because it was bleeding out the important information from the memory”. They even went ahead and bought the domain heartbleed.com from a group who owned it as a music lyrics site, so as to spread this security flaw among the IT community and they are quite happy with the outcome and the way the IT community has responded quickly to correct the flaw. Basically they just had to upgrade the OpenSSL toolkit version to the latest one to overcome this security flaw.


Why only few sites are affected?

Since the core problem was in the extension of OpenSSL toolkit called ‘Heartbeat’, which is the central point of vulnerability – any website which used this feature got affected. Although OpenSSL is popular, some websites used other SSL/TLS features and options. Some websites used an upgraded version or an earlier version of this toolkit, that’s why they escaped this vulnerability. While this doesn’t completely solve the problem at hand, not all companies use PFS or Perfect Forward Secrecy, a key agreement protocol in Cryptography. PFS keys are the most secured ones as on today as it ensures that the compromise of a single key permits access only to data protected by that single key. These have short shelf life, hence one key leak will not allow the leak of all data.

Am I really affected? Why should I care?

This is simply not another virus or bug wherein an antivirus can help you on your computer or smartphone. This is a more complicated bug (actually a programming error) on the services you use like hosting providers, bank servers and email service providers. Technically speaking this is not a client-end problem but a server-end issue.

Every user who uses email, browse internet, conduct business and ecommerce and every normal prudent surfer who cares for a secured browsing experience and have signed up for services, free or paid, online should care about this flaw and take corrective measures. More importantly if you have visited a website with HTTPS, trusting that it was a secured one all these days in the last few years, then you sure will be interested in knowing and learning about this further. And as an example, if you are a Gmail, Facebook or Yahoo email user, you better change your password now – for it is a suggested solution even by Google.

According to EFF (Electronic Frontier Foundation), this flaw allows an attacker who connects to an HTTPS server running a vulnerable version of OpenSSL to access up to 64KB of private memory space. Doing the attack once can easily cause the server to leak cookies, emails, and passwords. Doing the attack repeatedly can potentially leak entire encryption keys, such as the private SSL keys used to protect HTTPS traffic. If an attacker has access to a website’s private SSL key, they can run a fake version of the website and/or steal any information that users send, including passwords, private messages, and credit card numbers. Neither users nor website owners can detect this attack as it happens.

How do I know if my bank account was also compromised using this flaw?

Most banks use proprietary encryption software instead of the open source OpenSSL. Still, it’s wise to confirm with your bank information security personnel or their website for any press release related to this.

How do I know or check if a website has taken corrective measures or fixed this problem?

Password management companies have come up with ways in testing websites to check if the flaw has been corrected and if the website is safe or not. You can check LastPass – to see if the bug has been corrected by websites. Also, there would be press releases and news from the website themselves stating that the issues are fixed.
For example, The Canada Revenue Agency has extended the filing deadline for tax returns and promised to resume e-services by the end of the weekend for all federal departments using software vulnerable to the Heartbleed bug (Source: www.cbc.ca)

How to protect myself against this security flaw?

Keep an eye on your financial statements and bank accounts physically, not online.
Once you confirm that the bank websites are safeguarded, change your passwords.
Do not login to any sensitive accounts like bank websites and email accounts until you are sure that the flaw has been corrected.

Which websites need a password change right now?

You can first check what websites were affected and if they have taken corrective measures to release a patch. Mashable has collated a quite massive list of websites that need a password change. You can check them out here. These are some of the websites which were affected and corrected. So a password change is suggested, though not a must. As Google puts it, better be safe than sorry. Of course, keep in mind that the specific website must issue a patch to correct the flawed version of OpenSSL. Only then your password change makes sense.

What versions of OpenSSL are affected?



OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
OpenSSL 1.0.1g is NOT vulnerable
OpenSSL 1.0.0 branch is NOT vulnerable
OpenSSL 0.9.8 branch is NOT vulnerable
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.
(Source:heartbleed.com)

How widespread is this flaw in the internet sphere?

Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft’s April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates. (Source: heartbleed.com)





Thanks to……..?

Thanks to Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl at chromium.org> and Bodo Moeller <bmoeller at acm.org> for preparing the fix. (Source:https://www.openssl.org/news/secadv_20140407.txt)
Information collected and posted by Arun Sarathy
Resources: (Information sources)
http://heartbleed.com/

You Ought To Know This Little Secret Within Google Chrome Omnibox

by 2 Comments

Google Chrome – the World’s widely used browser has a tiny little secret.


Searching using the Omnibox – 

which is searching using address bar is the same as searching directly on Google.com. However, if you are not a Google searcher by default, then you might be searching using AOL, Yahoo or Bing – within Google Chrome.


In Internet Explorer you attain this by changing your default search provided in the Settings. Google Chrome too allows to change your default Search Engine settings on their Settings page.

Better still, Google knows that already and has made it even simpler for you – that’s exactly the little secret I was talking about. Here’s how:


How to search Yahoo, Bing, AOL, YouTube or Ask in Google Chrome:

In Google Chrome if you want to search using Bing, Yahoo, but still don’t want to change your default search provider, all you have to do is just this.

To search using AOL search engine within Google Chrome, just prefix the letter ‘a’ before you type your search text in the Google Chrome’s Omnibox. This also applies for searching in Ask.

To search using Bing search engine within Google Chrome, just prefix the letter ‘b’ before you type your search text in the Google Chrome’s Omnibox.

To search using Yahoo search engine within Google Chrome, just prefix the letter ‘y’ before you type your search text in the Google Chrome’s Omnibox. This also applies for searching in YouTube.

Related: Search using the address bar.


Additionally, after you try the above tricks, if you’d watched closely, you would have noticed that when you prefix ‘a’ to search using AOL, Google not only provides AOL as one of the suggestions in their Google Autocomplete feature – but also provides options to search websites from your web browser history.

For example in my screenshot above you will notice Autocomplete suggestion to search my text within Automattic website too.

Did you like this Google Chrome Omnibox trick?

If you know of any other Google Chrome secret trick, please write them in your comments below:

——————————————–
Written by +Arun Sarathy

How to make the best use of Microsoft Developer Network Library

by Leave a Comment

If you are a software developer who uses Microsoft Developer Network often, then you might be well aware of this neat little feature.

A feature which allows you to add certain articles, tips and resources from their portal to a set of pages and then export it to PDF neatly.


As a newbie in to development, I find this feature really useful. It allows me to ‘take-away’ certain really good articles as PDF documents so I can read them in my leisure time, offline.


How to use the export to PDF feature

Let’s see in detail as to how to make use of this feature:
First of all, you must have a Microsoft Windows Live ID to sign in and use this export option. Creating a Live ID is simple and you can use any email address as the user name for your new Microsoft account, including addresses from Outlook.com, Yahoo! or Gmail. If you already sign in to a Windows PC, tablet, or phone, Xbox Live, Outlook.com, or OneDrive, use that account to just directly sign in to the Developer Network.

There if you want to include a page to your set of pages to be exported, just right click on the page link (given on left side of the screen) and select Add this page. This also alerts you before adding – if there are too many pages within that group.
You can also browse to the page you would like to read, select Export on top right side of the screen and within the options given under Export feature, you can click Add this page. You will also find Manage pages on the same options strip. 
Clicking on Manage Pages is where you will find the next steps – especially exporting your added contents to PDF. Here you’ll find Advanced Options section which helps you select what kinds of 
  • Example Code Languages you prefer, 
  • to include community content or not, 
  • if you find any localized content – if you would want that to be translated or not.
Once the content creation is done, the PDF can be downloaded by hitting the download button. This contains neatly organized information with links working within the PDF document.

PDF ready to download

The PDF document looks like this after downloading:

Conclusion

The opportunities and resources in the Microsoft Developer Network are really good and organized, in my opinion. They offer subscription options, code samples, software developer tools and frameworks, app development guidance, cloud and server details, developer access to downloads and builds, innovative options and access to libraries and various other options. Sometimes, you can get access to latest build sets and information, fundamentals, game design aesthetics and promo offers, discounts too.  
Am not that great a fan of Microsoft. I love Apple and their developer programs. However, for Microsoft, this portal definitely is organized and useful – especially for the Microsoft related development purposes. Hence thought of posting this for the benefit of everyone who might be new to the MSDN and aren’t aware of the export to PDF feature.
——————————————–
Written by +Arun Sarathy