A new painting program for Windows and Linux has been added to the Free Drawing and Painting Software, Image and Photo Editing Programs page. This program, mtPaint, supports layers, undo, pressure-sensitive graphics tablets, a variety of effects, brush patterns, user-defined gradients, as well as the usual assortment of features such programs have. Check it out, or any of the other (numerous) free image editors listed on that page.
The Microsoft Security Essentials, a free antivirus software from Microsoft, has just been released, and has been added to the Free Antivirus Software and Free Online Virus Scans. The software is reported to be lightweight and unobtrusive by many testers.
Note: even if you don't like this program, there are numerous other free antivirus programs listed on that page, including free versions from commercial antivirus vendors, so there's no reason for you not to have some sort of antivirus program protecting your system.
Google Sites has been added to the Free Web Hosts with Site Builders or Free Web Templates page. They provide free web hosting with a rudimentary online web editor, and may be useful if you want to create a hobby website. It doesn't allow the use of a domain name, though, so it probably isn't all that useful if you want your site to last. (See my article on Is it Possible to Create a Website Without Buying a Domain Name? The High Price of "Free". if you don't know why this is so.)
A new clipboard history manager has been added to the Free Clipboard History Managers and Extenders page. Clipboard extenders like these are useful if you are a programmer or webmaster, since they make your job of cutting and pasting snippets of code or text very much easier, allowing you not only to use the standard cut and paste but also to copy multiple separate chunks of text (or whatever) for later pasting. They are also very handy for normal computer use, and you'll soon wonder how you ever lived without them.
The MAKE software on this new page allow programmers to automate the building of their computer programs in a convenient and efficient way. As usual, they're all free.
A new utility to back up and restore the device drivers on your computer system has been added to the Free Device Driver Backup and Extraction Utilities. Such a program is useful if you ever want to reinstall Windows and your computer manufacturer did not give you a CD containing all the drivers for your system, a very common situation if you bought a pre-built system like a notebook.
(That is, you can use the program to make a copy of your drivers before reformatting or upgrading the hard disk or whatever, then allow your newly reinstalled Windows to install those drivers, giving you a working system again.)
A new duplicate file finder has been added to the Free Find / Delete Duplicate Files Utilities page. This program lets you search your hard disk for files that have identical content, even if they are given different names, so that you can free up wasted hard disk space. If you have many digital photos, ripped audio CDs or downloaded music, etc, and are not sure if you have duplicates littered across your hard disk, these are the programs to use.
(Deleting the files is optional; sometimes, you just want to know.)
Do you have advertisements for your website that you want to alternate between? Or do you want to put a photo slideshow on your website? The free JavaScripts on this new page will automatically rotate the banners, pictures, photos, images, Flash files that are displayed on your website between a set of pictures/banners of your choice. This allows you to automatically vary your advertisements without having to manually adjust them yourself. They are also useful for putting on a slideshow of your photos.
A stitch in time saves nine. I couldn’t sew my way out of a bag, but it’s true advice for bloggers as well — a little bit of work on an upgrade now saves a lot of work fixing something later.
Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts.
The tactics are new, but the strategy is not. Where this particular worm messes up is in the “clean up” phase: it doesn’t hide itself well and the blogger notices that all his links are broken, which causes him to dig deeper and notice the extent of the damage. Where worms of old would do childish things like defacing your site, the new ones are silent and invisible, so you only notice them when they screw up (as this one did) or your site gets removed from Google for having spam and malware on it.
I’m talking about this not to scare you, but to highlight that this is something that has happened before, and that will more than likely happen again.
A stitch in time saves nine. Upgrading is a known quantity of work, and one that the WordPress community has tried its darndest to make as easy as possible with one-click upgrades. Fixing a hacked blog, on the other hand, is quite hard. Upgrading is taking your vitamins; fixing a hack is open heart surgery. (This is true of cost, as well.)
2.8.4, the current version of WordPress, is immune to this worm. (So was the release before this one.) If you’ve been thinking about upgrading but haven’t gotten around to it yet, now would be a really good time. If you’ve already upgraded your blogs, maybe check out the blogs of your friends or that you read and see if they need any help. A stitch in time saves nine.
Whenever a worm makes the rounds, everyone becomes a security expert and peddles one of three types of advice: snake oil, Club solutions, or real solutions. Snake oil you’ll be able to spot right away because it’s easy. Hide the WordPress version, they say, and you’ll be fine. Uh, duh, the worm writers thought of that. Where their 1.0 might have checked for version numbers, 2.0 just tests capabilities, version number be damned.
The second type of advice is Club solutions; to illustrate, I’ll quote from Mark Pilgrim’s excellent essay on spam 7 years ago, before WordPress even existed:
The really interesting thing about these approaches, from a game theory perspective, is that they are all Club solutions, not Lojack solutions. There are two basic approaches to protecting your car from theft: The Club (or The Shield, or a car alarm, or something similar), and Lojack. The Club isn’t much protection against a thief who is determined to steal your car (it’s easy enough to drill the lock, or just cut the steering wheel and slide The Club off). But it is effective protection against a thief who wants to steal a car (not necessarily your car), because thieves are generally in a hurry and will go for the easiest target, the low-hanging fruit. The Club works as long as not everyone has it, since if everyone had it, thieves would have an equally difficult time stealing any car, their choice will be based on other factors, and your car is back to being as vulnerable as anyone else’s. The Club doesn’t deter theft, it only deflects it.
Club blog security solutions can be simple (like an .htaccess file) or incredibly complex (like two-factor authentication), and they can work, especially for known exploits. Club solutions can be useful, like using a strong or complex password for your login — no one would recommend against that. (Another club solution is switching to less-used software on the assumption or more like the software’s claim that it’s perfect and more secure. This is why BeOS is more secure than Linux, ahem.)
In the car world, if someone figured out how to teleport entire cars to chop shops, The Club wouldn’t be so useful anymore. Luckily for manufacturers of The Club, this hasn’t happened. Online and in the software world, though, the equivalent happens almost daily. There is only one real solution. The only thing that I can promise will keep your blog secure today and in the future is upgrading.
WordPress is a community of hundreds of people that read the code every day, audit it, update it, and care enough about keeping your blog safe that we do things like release updates weeks apart from each other even though it makes us look bad, because updating is going to keep your blog safe from the bad guys. I’m not clairvoyant and I can’t predict what schemes spammers, hackers, crackers, and tricksters will come up with with in the future to harm your blog, but I do know for certain that as long as WordPress is around we’ll do everything in our power to make sure the software is safe. We’ve already made upgrading core and plugins a one-click procedure. If we find something broken, we’ll release a fix. Please upgrade, it’s the only way we can help each other.
I've added another free electronic postcard PHP script to the Free Electronic Greeting Cards PHP Scripts page. Such a script allows your visitors to send their friends electronic greeting cards from your site.