The update is already installed on this system

The update is already installed on this system

I had an update on my system in a partially installed state. Our vulnerability scanner determined one file, MSO.dll, was still out of date. It recommended a patch to apply. Running it gave me an error message. Here’s what to do when Windows says the update is already installed on this system and refuses to let you do anything but click OK.

Because hey, from a security analyst’s point of view, this is anything but OK. I get questions about patches in a partially deployed state all the time, so I figured I’d write about it. Here’s what I do when security updates fail to apply with this error.

Read more

EMET protects against what your antivirus cannot–and it’s free

A few years ago, Microsoft quietly released a security tool called EMET–the Enhanced Mitigation Experience Toolkit. EMET is now in version 4.0, and it’s probably the best security tool you’ve never heard of. And that’s a real shame.

Modern versions of Windows and modern CPUs include several security-enhancing technologies that aren’t necessarily switched on by default. EMET is a wrapper that forces software to use these technologies, even if they weren’t designed from the get-go to use them. The idea, then, is that if a badly behaving data file tries to exploit a traditional vulnerability in one of these programs, EMET steps in and shuts it down. A real-world example would be if you visit a web page that’s playing a malicious Flash video, or that contains a malicious Acrobat PDF. The malicious data loads, starts to execute, and the minute it misbehaves, EMET slams the browser tab shut. You won’t know right away what happened, but your computer didn’t get infected, either. Read more

And the most security-riddled program of 2012 was….

Secunia released its annual vulnerability review, a study of the 50 most vulnerable pieces of software in 2012. It was a fairly tight-three way race at the top, and the distance between #3 and #4 was huge.

I was actually surprised at who the top three were. They weren’t the three usual suspects. But in the case of the top two, they did, to their credit, roll out fixes within 30 days of disclosure.

So now that I’m killing you with suspense….
Read more

Happy Patch Tuesday, September 2011

Microsoft has five updates and Adobe has two for us on this fine Patch Tuesday, in addition to a patch Mozilla pushed out for Firefox last week.

Don’t get too complacent if you run something other than Windows. If you run Microsoft Office on a Mac, or Adobe Reader or Acrobat on a Mac, or Adobe Reader on Unix or Linux, you’re vulnerable. The vulnerabilities in those affected products are more serious than the vulnerabilities for Windows. So keep that in mind. Don’t be smug about security. It’ll bite you.

Read more

How to check your downloaded files’ integrity

On some web pages offering programs to download, you may have seen something called an MD5 near the program link, consisting of a long, weird code like 6cbfd919baa7c9e03c8471ae4d8f8bb.

You can use that code to make sure the file you downloaded is what the author intended you to get and wasn’t corrupted during the download process or, worse yet, booby-trapped by someone else. Here’s how.

Read more

How to use compression to help life with an SSD

Since pretty much everyone thinks my love of SSDs is insane, I’ll throw another insane idea on top of it: using data compression. It makes sense. Doing it selectively, you help performance, while saving space. At a much higher cost per gig, that saved space is very nice to have.

Here’s why compression makes sense. Under many circumstances, an SSD can saturate your IDE bus. Then you run into the 56K modem problem. The bus is saturated, but you want more speed, so what do you do? Compress the data. Although data compression makes people nervous (shades of DoubleSpace I’m sure), modems have been doing this for two decades. Why? Because it works.

So while your drive is happily shoving 200 megs per second through your IDE bus, if you can compress that file by 20 percent, guess what? You’ll get 20% better throughput.

CPU usage is the main objection to this. But in my experience, NTFS compression uses 20-40% of a recent (P4-class or newer) CPU when compressing. That’s the hard part. When decompressing, overhead is a lot less. The objections to NTFS compression really date to the days when 200 MHz was a fast CPU.

I don’t recommend just compressing your whole disk. Selective compression is a lot better. There’s no use trying to compress data that’s already compressed, and a lot of our data is.

Use the command COMPACT to do the job for you. Here’s my sequence of commands:

CD \
COMPACT /S /C *.doc *.xls *.rtf *.txt *.1st *.log readme* *.bmp *.wav *.wmf *.bat *.cmd *.htm *.html *.xml *.css *.hlp *.chm *.inf *.pnf *.cat

If you have other compressible files, of course you can add those.

This is a one-time event, but you can schedule it to happen daily or weekly if you want. Just put the two lines in a batch file and create a scheduled task to run it. The command will skip any files that are already compressed. While the compression itself doesn’t take a lot of CPU time, scanning the drive does, so you might want to run it while you’re away if you’re going to schedule it.

Don’t bother trying to compress your My Music or My Pictures directories; that data is all highly compressed already, so all you do is tax your CPU for no reason when you compress that kind of data. Of course the main reason people buy 1 TB drives is because they have hundreds of gigabytes of music and movie files. It’ll be a while before storing that kind of data on SSD is practical. In that case, buy an SSD to hold the operating system and apps, and a conventional drive to hold all that data.

Some people compress their C:\Program Files directory. This can work, but some programs are already compressed. I would be more inclined to experiment with subdirectories on a case-by-case basis. Try compressing one program directory, see if it packs down any, and if it does, great. If not, uncompress it and move on.

UPX does an outstanding job of packing down program files but it’s not completely transparent. I found enough programs didn’t run afterward that I gave up on it. NTFS compression is a lot less effective, but a lot more transparent. As long as you don’t compress your swap file or hibernation file (and Windows will warn you incessantly if you even try to do that), you won’t break anything with it.

If you enjoy tinkering with things, by all means feel free to experiment with UPX. There was a time when I would have probably done it, but given a choice today between playing with data compression or playing with metalworking tools, I’d rather play with my metalworking tools.

But I do really like this SSD. For the first time in a very long time, I can sit down at a computer running modern software and it still feels fast.

Sitting in the lap of luxury with an SSD

OK, it finally works. I have my OCZ Vertex running in my Compaq Evo D510 using a Rosewill RC-203 IDE-SATA bridge adapter.

It’s fast and quiet. I haven’t had it working for long but I really wouldn’t want to give it up. I’m not looking forward to that clunker with spinning disks on my desk at work tomorrow.Windows boots in well under 30 seconds. You barely see the Windows XP splash screen. And once you get to the desktop, you can start loading programs even though the disk light is still blinking a little. The system doesn’t care.

Firefox loads in about three seconds. I could probably reduce that some if I cut down on the amount of history I made it remember. But since I keep it loaded all the time, I probably won’t bother.

Excel loads in a second. I think it spends as long displaying its stupid splash screen as it does actual work now. You can disable that, and it might be worthwhile to. There’s no perceptible difference between loading it the first time or loading it the second time.

Word loads in about a second too. Like Excel, the first launch is about the same speed as launching it from cache.

Photoshop Elements is still a slow pig. It loads about five seconds faster than off my old Seagate drive, but takes about 20 seconds to load. That’s not bad, but it’s about as long as Windows itself.

It’s quiet and cool. The system fans on this Compaq adjust themselves as necessary, and they’re spinning very slow. A bird singing outside your window drowns it out. The drive isn’t completely silent, but without putting my ear right up to it, I can’t hear it.

With no more worries about physical wear, shutting the computer off at night (or at least hibernating it) becomes more feasible. And while it’s on, the system’s power usage will drop a few watts.

I had problems cloning to my new drive with Ghost. If you want to clone rather than rebuild, Drive Image XML looks like a better bet. The downside with it, as I found out, is that your new drive has to be the same size, or larger, than your old one. Even though I had 18 GB free on my 40 GB drive, it wouldn’t let me clone to a 30 GB drive.

Why did I buy a 30 GB drive? Because I expect prices to continue to drop. 30 gigs is enough to be useful, so if I decide to buy a larger drive this year or next, I can move this 30 GB drive into another system.

This is a big deal. If you can’t afford an Intel SSD, buy the OCZ Vertex. You won’t regret it.

How to get your RSS/RDF feed working with Mozilla Firefox\’s Live Bookmarks

As soon as I upgraded to Mozilla Firefox 1.0, I started noticing that when I visited certain sites that had RSS/RDF feeds, a big orange “RSS” icon showed up in the lower right hand portion of the window.

That’s cool. Click on that, and you can instantly see that site’s current headlines, and know if the site has changed, just by looking in your bookmarks.

Except my site has an RSS feed and that icon didn’t show up. Here’s how I fixed it.At first I figured Firefox was looking for the standard “XML” icon everyone uses. So I added that. No go.

So I investigated. A Google search didn’t tell me anything useful. So I went to Slashdot’s page and viewed the source. Four lines down, I found my answer.

In your section, you need to add a line. In my case, since I run GeekLog, it was this:

LINK REL=”alternate” TITLE=”Silicon Underground RSS” HREF=”//” TYPE=”application/rss+xml”

Just substitute the URL for your RSS feed for mine. The two slashes at the beginning are necessary. The whole line has to be enclosed in , of course. (I can’t show them here because my blogging software is trying to protect me from myself.)

But since Geeklog doesn’t have an index.html file, and its index.php file is mostly programming logic, where do you add your code?

In your themes directory, in the file header.thtml, that’s where. I put mine right after the line that indicates the stylesheet.

The location for other blogging systems will vary, of course. But I notice some seem to do it automatically.

Now your readers can keep track of you without constantly refreshing your page (which they probably won’t do) and without having to run a separate RSS aggregator. Pretty cool, huh?

Rethinking Movable Type and b2

A very interesting discussion today made me re-think the importance of a content management system such as Movable Type or b2.
I was talking with two people whom I expected would be among the last to even consider dropping their long-standing practice of creating their daily writings with FrontPage and moving to a CMS approach. (Saying their names would be name dropping and it’s irrelevant.) Their questions made me really question what the advantages to this system are. That’s good.

Products like Radio Userland and Trellix are really just a step beyond FrontPage, in my estimation. They’re designed for journals, rather than general purpose Web design, which probably makes them faster and easier to use and certainly cheaper. But you still get flat, static files. Radio will allow readers to navigate by date, so they can quickly get to last Tuesday’s entry–assuming that for some reason they already know they want to read last Tuesday’s entry. (Sometimes they will, sometimes they won’t.)

Manila and Blogger move all of Radio Userland’s work to the server and gives you an integrated search engine, which is one more step in the right direction.

But a true content management system takes a reader’s daily entries, stores them in a database, and then when a reader asks for the content, generates HTML to send them. Movable Type does this generation in advance; b2 does it on the fly. There are advantages and disadvantages to both approaches; it’s not worth dwelling on.

What b2 and Movable Type give you over static pages is significant. Maybe you like what I wrote Thursday about video editing and you want to read more stuff like it. Well, I happen to have a category called video. Click on it and you get everything I’ve ever written and put into that category. When I post new content, I just tell the system what category to put it in, and it does the rest of the work for me.

Also, b2 and Movable Type make it significantly easier to gain traffic from search engines like Google. Once an entry falls off the current front page (usually set to show a week’s worth of entries), it gets its own page for time and eternity. One day’s entry is much easier for a visitor to make sense of than seven days’ worth. Individual entries can be titled appropriately, which makes Google rank it higher than pages that aren’t titled. Both of these make a reader more likely to visit.

Since b2 and Movable Type use databases, it’s easy to query the database for similar content. It’s easy to display current content. When someone visits this page, even if they grab a story that’s four years old, they get the same sidebar as my current page, which contains recent stories of note. If one of those stories grabs the visitor’s attention, I’m more likely to turn that visitor into a regular reader.

It’s also fairly easy to make b2 or Movable Type display links to the last few entries in the same category at the bottom of an entry. (I really need to implement this.) Imagine if someone likes my video editing story, gets to the end, and sees links to five more stories like it? Do you think the reader is more likely to click on one of those links than s/he is to go looking for something else like it? If the reader has to go looking on his or her own, I’m probably out of the picture. It’s easier to go back to Google. But if the reader reads another story or two of mine, I get more chances to get my hook in.

One advantage for me–this was a terrible turn-off for one of the others, as he keeps tight control on other people’s content on his site, and that’s one of the things his readers really like–is the comments system. I like leaving all of my content open to all for comment. I get very little e-mail and sometimes other people answer questions for me. That’s not necessarily a plus. At least it’s easy to turn off the feature entirely.

There are some less-obvious benefits as well. Both b2 and Movable Type offer newsfeeds–small, downloadable XML files that programs can download and use to display headlines off your site, complete with links to the full story. News aggregators are becoming popular among certain segments of the Internet community; already a significant portion of my traffic is newsfeed-related. This allows people to keep my newest stuff on their desktop or display it on their own Web pages–almost like the ill-fated PointCast, only this time likely to succeed just because there isn’t a necessary business model. This feature makes keeping up with my site, or a large number of sites like mine, trivial.

One advantage to me since I spent a weekend or so setting up a CMS for the first time has been that I don’t spend any time editing HTML anymore, short of inserting hyperlinks and inserting emphasis. I write, and that’s it. Some days I can write my entry in 15-20 minutes. On those days, I spend about 15-20 minutes on my site, unless it’s been a heavy comments day, because I just write in my preferred tool of the day, copy and paste it into b2, click a button, and within a few seconds, my new stuff is live.

Another advantage to me is traffic. Having entries small enough for people to link to and small enough to facilitate locating search terms quickly, Google treats me very well. This month, over 26% of my total traffic is coming from Google. (By comparison, 31% of my traffic comes from bookmarks.) And I’m not even doing everything I can–yet–to kiss up to Google. And since there are plenty of links on the sidebar to content that’s either fresh or compelling by some past measure, chances are someone will click on at least one other entry here, which gives me two chances–not just one–to turn that visitor into a regular reader.

If you’re currently using a tool like FrontPage or Trellix or Radio Userland to create your daily journal/blog/whatever you want to call it, you ought to give a full, complete, content management system-type program like Movable Type or b2 a look. Movable Type is easier to set up, but if you have programming ability, b2’s setup will allow you more flexibility on your site output.

Migrating a lot of existing content can be a pain. You can look at doing what I did–operating the sites in parallel, leaving the old content up and running but putting the new content in b2/Movable Type–or you can try to enlist some help in getting the old content moved in. Even if the old content stays put, it remains no less accessible than it is now. The new content just becomes much easier to navigate and cross-reference and mine for the juiciest bits.

But no matter how painful the changeover, I believe the categorization, the dynamic nature of the front page, and the ease in finding older content of interest will only increase your readership. It certainly has for me.

Roll your own news aggregator in PHP

M.Kelley: I’m also wondering how hard would it be to pull a PHP/MySQL (or .Net like BH uses) tool to scrape the syndicated feeds off of websites and put together a dynamic, constantly updated website.
It’s almost trivial. So simple that I hesitate to even call it “programming.” And there’s no need for MySQL at all–it can be done with a tiny bit of PHP. Since it’s so simple, and potentially so useful, it’s a great first project in PHP.

It’s also terribly addictive–I quickly found myself assembling my favorite news sources and creating my own online newspaper. To a former newspaper editor (hey, they were student papers, but one of them was at Mizzou, and in my book, if you can be sued for libel and anyone will care, it counts), it’s great fun.

All you need is a little web space and a writable directory. If you administer your own Linux webserver, you’re golden. If you have a shell account on a Unix system somewhere, you’re golden.

First, grab ShowRDF.php by Ian Monroe, a simple GPL-licensed PHP script that does all the work of grabbing and decoding an RDF or RSS file. There are tons of tutorials online that tell you how to code your own solution to do this, but I like this one because you can pass options to it to limit the number of entries, and the length of time to cache the feed. Many RDF decoders fetch the file every time you call them, and some feeds impose a once-an-hour limit and yell at you (or just flat ban you) if you go over. Using existing code is a good way to get started; you can write your own decoder that works the way you want at some later date.

ShowRDF includes a PHP function called InsertRDF that uses the following syntax:
InsertRDF("feed URL", "name of file to cache to", TRUE, number of entries to show, number of seconds to cache feed);

Given that, here’s a simple PHP page that grabs my newsfeed:


<?php include("showrdf.php"); ?>


// Gimme 5 entries and update once an hour (3600 seconds)

InsertRDF("", "~/farquhar.cache", TRUE, 5, 3600);



And that’s literally all there is to it. That’ll give you a very simple HTML page with a bulleted list of my five most recent entries. Unfortunately it gives you the entries in their entirety, but that’s b2’s fault, and my fault for not modifying it. I’ll be doing that soon.

You can see the script in action by copying and pasting it into your Web server. It’s not very impressive, but it also wasn’t any effort either.

You can pretty it up by making yourself a nice table, or you can grab a nice CSS layout from

I can actually code tables without stealing even more code, so here’s an example of a fluid three-column layout using tables that’ll make a CSS advocate’s skin crawl. But this’ll get you started, even if that’s the only useful purpose it serves.


<?php include("showrdf.php"); ?>

<table width="99%" border="0" cellpadding="6">


<td colspan="3" align="left">
<h1>My personal newspaper</h1>



<td width="25%">

<!--- This is the leftmost column's contents -->

<!--- Hey, how about a navigation bar? -->

<?php include("navigationbar.html"); ?>


<!--- Middle column -->

<td width="50%">

<p><h1>Dave Farquhar</h1></p>


// Gimme 5 entries and update once an hour (3600 seconds)

InsertRDF("", "~/farquhar.cache", TRUE, 5, 3600);



<!--- Right sidebar column -->

<td width="25%">



InsertRDF("", "~/fm.cache", TRUE, 10, 3600);




InsertRDF("", "~/slash.cache", TRUE, 10, 3600);






Pretty it up to suit your tastes by adding color elements to the <td> tags and using font tags. Better yet, use the knowledge you just gained to sprinkle PHP statements into a pleasing CSS layout you find somewhere.

Finding newsfeeds is easy. You can find everything you ever wanted and then some at

Using something like this, you can create multiple pages, just like a newspaper, and put links to each of your files in a file called navigationbar.html. Every time you create a new page containing a set of feeds, link to it in navigationbar.html, and all of your other pages will reflect the change. This shows another nice, novel use of PHP’s niceties–managing things like navigation bars is one of the worst things about static HTML pages. PHP makes it very convenient.

WordPress Appliance - Powered by TurnKey Linux