The Malware Cometh

It’s official: Macs are finally vulnerable to nasty viruses. There are malicious programs that can infect a Mac without the user having to do anything accidental or unwise. It ain’t an apocalypse, but we should be increasingly careful.

Last week saw the emergence of a version of the Flashback trojan. This bad bug sneaks into your web browser when you visit an infected web site, and starts reporting things like your browsing history and logins.

There are really good writeups about Flashback, like these from TidBITS, MacWorld, All Things D, and this nerdy one from Basics4Mac, with plenty of technical details and descriptions of the . For the purpose of this article, I’ll simply say that Flashback uses the programming environments Flash and Java to run. (These names may sound familiar, from discussions about how the iPhone has neither of them.)

Apple has also now, for the first time, posted a response to an emergent Mac malware. It’s brief and worth a glance.

So now I am going to try to distill, in as few words as possible, what the average Mac user should do about the virus.

What Now?

1. Run Software Update from the Apple menu.

Apple has released a patch to Java that prevents Flashback from infecting your Mac.

2. Don’t click on unknown or untrusted links to web sites.

Even some legit web sites have been infected, but they will be cleaned up. When you see a link in an email, before you click, hover your cursor over the link and read the address that pops up. If it doesn’t look right, don’t click.

3. Don’t enter your password…

…unless you know why you’re being asked to do so.

4. Test your Mac for infection.

This takes just a bit of effort, but is not hard. You have three reasonable options:

Download this small app by long-time Mac nerd Mark Zeedar. Once the file test4flashback.zip (lowercase) is in your downloads folder, double-click it to “unzip” it, and then double-click the resulting file called Test4Flashback (with capital letters).
Go to this web page by security firm Kaspersky. It can supposedly compare your Mac’s unique ID against a database of known infected machines.
Open the app called Terminal. You can find it using Spotlight or in the /Applications/Utilities folder. Copy and paste each of the following commands into the Terminal, hitting return after each.

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

defaults read /Applications/Google Chrome.app/Contents/Info LSEnvironment

defaults read /Applications/Firefox.app/Contents/Info LSEnvironment

defaults read /Applications/iCab 4/iCab.app/Contents/Info LSEnvironment

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

The result should look like the screen shot below, with the words “does not exist” after each line.

Terminal screenshot: Flashback not detected

5. Remove the infection.

If one of the above techniques revealed that your Mac is infected, you have three options:

Call us and we’ll take care of it.
Download this removal tool from Kaspersky.
Or follow these brief-but-nerdy instructions posted by F-Secure.

What Next?

But what then? How should Mac-o-philes stay vigilant against these intruders?

Please understand that all of the following are just suggestions, not prescriptions. All of us want our Macs to just keep working, without the tinkering and worrying characteristic of Windows users. But to that end, I have myself adopted the following methods, and I believe they help protect my computers and my data from the bad guys.

1. Uninstall Adobe Flash from your Mac

Adobe has this page, from which you can download the Flash uninstaller for Mac.

I know, I know, you’re saying it’s going to break your internet. Read on, dear reader.

2. Use Google Chrome instead of Apple Safari for web browsing

Chrome is a fantastic, free web browser that Google created to make the web better and faster.

Google built their own version of Flash into Chrome, and Chrome updates itself on a regular basis behind the scenes. So you don’t have to keep up with Flash updates, and you’ll never be tricked into downloading a fake version of Flash.

Sometimes I browse in Safari, but mostly I use Chrome.

3. Should I disable Java?

You can read in the other articles how you can disable Java entirely, both for your browser and on your whole Mac. The problem is that, as of this moment, Java is even more important than Flash. Many of our clients are using CrashPlan for internet backups, or LogMeIn for remote access to their computers. Both services rely on Java.

As an experiment, I have disabled Java on Safari, in Safari menu > Preferences > Security. Ping me if you’re curious whether that has affected my experience on the web.

Back up, and be vigilant

If you follow the 3–2–1 rule of backups, then you can recover from anything that happens to your computer.

And from here on out, it behooves us to keep an eye on what goes on on our computers. The days of cavalier surfing are over for Mac users.

Ditch Quicken and QuickBooks, save time and aspirin

I thought y’all might be interested in a a couple of online services to help with bookkeeping and potentially replace Quicken.
1) The first is a free service called Mint.com.

It was purchased a while ago by Intuit, the makers of Quicken. It’s an online portfolio of all your financial accounts—banks, investments, credit cards, loans, everything. It shows it all to you all at once, and lets you configure alerts and reminders and budgets. I started using Mint a few years ago, and it’s really fantastic and easy.

And the iPad app is gorgeous.

2) The second is a more complete accounting package called Xero.com, which I’ve used to replace QuickBooks entirely. They have a personal plan for $35/year. It can pull transaction feeds from your banks automatically. It makes the whole process of bookkeeping so much quicker and simpler.

If you get squeamish about entering your banking user names and passwords into a 3rd-party service, it’s worth understanding that Mint draws its information from clearing houses to which banks already publish our data. As with any online service, it’s crucial that you choose a good, strong password for Mint, Xero, and your banking.

Should I backup my computer?

Every computer owner must keep active, daily backups of all of their data. We like to use the 3-2-1 Commandment of Backups:

Thou shalt keep: 3 copies of any data, on 2 different media on-site, and 1 copy offsite.

Put another way:

A file doesn’t exist unless it exists in three places.

The 3-2-1 rule applies to any piece of digital data, however minor, small, or seemingly unimportant.

Copy 1 is the drive inside your Mac,
Copy 2 is an external hard drive in your home or office, which gets backups via the Time Machine software, connected either directly to your computer or over your internal network,
And the 3rd copy happens across the internet, frequently to a service such as Carbonite or our current favorite, Crashplan.

We have established easy, elegant, and cost-effective methods to achieve 3-2-1, and we will work with you to find the solutions that best fit your business.

Here’s a scenario:

Let’s say you are maintaining good, solid, daily 3-2-1 backups. And then, in normal use, your Mac’s hard drive fills up, and you need to free up space. Before we do that, we just need to consider 3-2-1: if you delete something from your Mac, that means that you have to copy that stuff to a 3rd destination.

The easiest solution for that is simply another external drive. Think of it as an archive—you know you’ve got the data on Time Machine and Crashplan, so you can either do a manual, organized copy to the Archive Drive, or set some different software to automatically build the archive as you go, depending on your workflow.

It’s worth noting that Apple will release Mountain Lion this summer, which will let you set Time Machine copying to multiple drives. That’s going to ease a lot of our decisions in this arena.

Give us a call. We’ll help you choose the right devices, at the price that fits.

Was Jobs right about Dropbox?

On Feb 27, Colleen Pence wrote:

Thought you might find this article interesting:

Steve Jobs was right: Dropbox is a feature, not a product | PandoDaily

Man, that's spot-on in some ways. It's becoming a distinct possibility that Apple is going to make (or get closer to making) the "continuous client" idea happen with Mountain Lion. And I will be well glad for it.

But I don't see Dropbox failing anytime soon. The writer misses a crucial point, the difference between the Dropbox model and that of Apple and Microsoft. The major OS developers desire to keep you and your working environments within that company's ecosystem; Dropbox, on the other hand, wants to help you distribute your data across ecosystems.

This is Dropbox's killer feature: your stuff, everywhere.

Posted via email from J2 Tech Blog

Guessing at iPad 3 arrival + Re: Idea Sketch

Can I use Idea Sketch on my Mac or is it only a mobile app?

http://itunes.apple.com/us/app/idea-sketch/id367246522?mt=8

Mobile only, but with the paid upgrade to it, you can export the project files, which are openable in OmniOutliner, an amazing and long-standing app on the Mac.

Cool. Thanks. I think I’ll wait til I get an iPad. The 3 is coming out in like March, right?

I wish we knew about the iPad, but best guess based on rumors is March. Definitely don’t buy a 2. I’m recommending those with itchy fingers should look at a used or refurbished unit, especially a 1st gen, on craigslist.org or store.apple.com.

Posted via email from J2 Tech Blog

New Google privacy policy won’t affect Apps for business, government

On Jan 26, 2012, bill wrote:

Twice I have had job interviews were I was presented with a document that states, “You will be fined and fired if we find out you are using Google for any services for data or email.” This is a very big deal for clients that do not not want their data mined and sold (investor-types and media folks, for example).

http://arstechnica.com/#!/business/news/2012/01/new-google-privacy-policy-wont-affect-apps-for-business-government.ars

As you might guess, I’m not bothered by this, and I suspect that Google will do a bunch of clarifying like this article talks about, and maybe even plain ol’ backpedaling, before Mar 1. Regardless, I think those contracts are ridiculous. But I’m glad the nonprofs and the FTC are around to watch this stuff before it explodes.

Posted via email from J2 Tech Blog

Web and email hosting

I would really like to switch from GoDaddy for our email and Web hosting services. I believe you told me that Google can also handle this. Is that correct, and if so, can you point me to the Web page that will explain it?

I definitely believe that Google Apps is the best choice for email hosting. It also includes Google Docs and Calendar hosting, as well as Google Sites, for building ad hoc web sites that can be shared strictly internally or to the world. These are good for things like individual projects, or quick reference documentation.

Google does not offer conventional web hosting, but there are lots of possibilities for that. If you are going to design a new site, the go-to platform for web sites is currently WordPress, but I am building my new site in Squarespace. It’s simply fantastic.

If you are keeping your current design, I could recommend staying with GoDaddy just for web hosting. Some folks take issues with GoDaddy, regarding everything from business practices to aesthetics to animal rights and gender roles. Because of their recent support of the impossibly stupid Stop Online Piracy Act, I will likely move my own domains to another registrar such as NameCheap or Hover.

There are lots of excellent alternatives. Lemme know more about your needs.

Posted via email from J2 Tech Blog

How to dispose of old technology

How do I properly dispose of an old CPU? It has no useful info on it. I just don’t want to throw it in the trash.

You can get rid of that machine a number of ways, including:

Best Buy will take recyclable technology, requiring neither a fee nor an appointment.
You can give stuff away at craigslist or Freecycle.
You can take any non-trashable material or items — from batteries to paint to televisions — to the hazardous materials disposal depot over at Culebra and 410 (dial 311 in San Antonio for details).

Posted via email from J2 Tech Blog

Instapaper sine qua non

I’d hate to live in a world without Instapaper. It has changed my reading life, and my productivity. More than merely bookmarking an article, I put it on my reading list that shows up on all my devices. And the new version is so darn pretty. Bonus tip for nerds: check out Marco’s podcast on 5 by 5: http://5by5.tv/buildanalyze.

Instapaper

Marco Arment

Category: News

Updated: Oct 27, 2011

291 Ratings

Posted via email from J2 Tech Blog

Can I simplify the process of writing a blog post?

A conversation with Matt S. on Friday sparked a little research. The goal was to simplify the WordPress dashboard, so that new users would see only what they needed, and not be distracted or confused by the other bells and whistles WordPress scatters around the admin page.

My initial thought was to find a browser plug-in that isolated the functional part of a web page, darkening or obscuring the rest of the page. Or, failing that, to find just one easy option for authors who prefer to minimize distraction.

After meandering down a couple of paths, I concluded that:

The only browser plugins that do what I was describing only work on video or flash sites.
I tried to get Safari’s web-clip feature to do this. I had disabled Mac Dashboard a while back, ‘cos widgets hog memory. I turned it back on, and created a web clip with the “Add New Post” interface. The first two attempts didn’t work, only giving me the WP admin login page, but then I tried it again, resulting in the screenshots at the end of this article. So, that kind of does the trick, but it also seems completely random and unreliable, and thus impossible to recommend to a novice user.
I have definitely found desktop blogging tools such as MarsEdit and Blogo helpful, especially when they can accept formatting in Markdown. But I think those apps put too much remove between a novice user and their end product; the process takes time to explain, and most folks are just going to want to get started posting.
I’m not sure if Colleen P. has officially changed her mind about this, but I really love Posterous. All I have to do is send an email to post@posterous.com — with formatting, images, links, the whole shebang — and my post goes on my blog, the link to it goes on Delicious, Twitter and Facebook pull it in, etc. (If you send an email to Posterous right now, you will create a new blog.

Option 5, however, might be the best place to start: There are a few WordPress plug-ins that simplify the WP Dashboard. I have already heard good things about Fluency Admin [pictured above], and this Easy Blogging thing looks OK (though there’s a fee to that one that makes me skittish).

I guess that’s where it stands at the moment. There are also a couple of iOS apps that making blogging easy. Certainly emailing to Posterous works well enough from anywhere. I need to see how mobile blogging from Squarespace will happen.