Category Archives: commentary

Web archiving and languages

Posted on June 10, 2019 | Comments Off on Web archiving and languages

Web archiving is difficult. Few sites consist entirely of static, self-contained content. Most use JavaScript, often from external sites. Responsive pages are designed to look different in different environments. An archive needs to make a snapshot that reflects its appearance at a given point in time, but what exactly does that mean? Should an archive pick an appearance for one reasonable set of parameters, or should it try to keep the page’s dynamic nature? Will the fact that it’s an archive rather than an interactive browser affect what the server gives it?
Continue reading →

Comments Off on Web archiving and languages

Posted in commentary

Tagged ,

When ebooks die

Posted on April 8, 2019 | Comments Off on When ebooks die

Microsoft’s eBook Store is closing. According to the announcement, “starting July 2019 your ebooks will no longer be available to read, but you’ll get a full refund for all book purchases.” This shows a basic truth about DRM book purchases: you don’t actually own your copy. You can use it only as long as the provider supports it. It was honest of Microsoft to refund all “purchases,” but digital oblivion eventually awaits all DRM-protected materials.

Andy Ihnatko once told me that DRM is safe because “Amazon will be around forever.” It won’t. The fact that a company as big and stable as Microsoft is abandoning support for its DRM-protected products reminds us that all such products exist only as long as the provider has sufficient motivation and ability. It’s questionable whether Amazon’s protected ebooks from today will be readable in 2050, let alone “forever.”
Continue reading →

Comments Off on When ebooks die

Posted in commentary, News

Tagged , ,

HTML mail is a terrible idea — but at least please do it right

Posted on April 4, 2019 | Comments Off on HTML mail is a terrible idea — but at least please do it right

Originally email consisted just of text messages. They were straightforward to read. It was very hard to send malware in a convincing way, since the recipient would have to extract any malicious attachment and run it by hand. There was a hoax in 1994 warning of the alleged “Goodtimes virus”, which caused a lot of merriment among the computer-literate. The only “virus” was the hoax email itself, which the less computer-literate forwarded to all their friends.

Then came HTML mail, a huge advance in email insecurity. Now malicious URLs could hide behind links or even be opened automatically. It could include JavaScript to exploit client weaknesses and trick recipients. Today, almost everyone recognizes these advantages, and malware and phishing by email are multi-billion-dollar businesses.

Doing it right, or not doing it at all

Even so, there are good and bad ways to create HTML mail. Continue reading →

Comments Off on HTML mail is a terrible idea — but at least please do it right

Posted in commentary

Tagged ,

PDF/A-4

Posted on March 14, 2019 | Comments Off on PDF/A-4

It looks as if I’ll have a little input into the upcoming PDF/A-4 standardization process; earlier this month I got an email from the 3D PDF Consortium inviting me to participate, and I responded affirmatively. While waiting for whatever happens next, I should figure out what PDF/A-4 is all about.

ISO has a placeholder for it, where it’s also called “PDF/A-NEXT.” There’s some substantive information on PDFlib. What’s interesting right at the start is that it will build on PDF/A-2, not PDF/A-3. A lot of people in the library and archiving communities thought A-3 jumped the shark when it allowed any kind of attachments without limitation. It’s impossible to establish a document’s archival suitability if it has opaque content.
Continue reading →

Comments Off on PDF/A-4

Posted in commentary

Tagged ,

Path traversal bugs in archive formats

Posted on February 28, 2019 | Comments Off on Path traversal bugs in archive formats

Malware has shown up which takes advantage of a path traversal bug in the WinRAR archiving utility. The bug, which reportedly existed for 19 years, is fixed in the latest version. The problem stems from an old, buggy DLL which WinRAR used. It allowed the expansion of an archive with a file that would be extracted to an absolute path rather than the destination folder. In this case, the path was the system startup folder. The next time the computer was rebooted, it would run the malware file.
Continue reading →

Comments Off on Path traversal bugs in archive formats

Posted in commentary, News

Tagged , ,

What part of “No Flash” doesn’t Microsoft understand?

Posted on February 21, 2019 | 3 comments

If you disable Flash on Microsoft Edge, Microsoft ignores your setting — but only for Facebook’s domains. It sounds too conspiratorial to be true, but a number of generally reliable websites confirm it.

Bleeping Computer: “Microsoft’s Edge web browser comes with a hidden whitelist file designed to allow Facebook to circumvent the built-in click-to-play security policy to autorun Flash content without having to ask for user consent.”

ZDNet: “Microsoft’s Edge browser contains a secret whitelist that lets Facebook run Adobe Flash code behind users’ backs. The whitelist allows Facebook Flash content to bypass Edge security features such as the click-to-play policy that normally prevents websites from running Flash code without user approval beforehand.”
Continue reading →

3 Comments

Posted in commentary, News

Tagged , ,

The police body camera data problem

Posted on January 23, 2019 | Comments Off on The police body camera data problem

The Washington Post reports that some police departments are dropping body camera programs because of the expense. I’ll admit that my first gut reaction on seeing the story was that it’s just an excuse. In some cases it probably is. But it’s a fact that while the cameras are cheap, storing and managing large amounts of video data isn’t. The question needs objective examination.
Continue reading →

Comments Off on The police body camera data problem

Posted in commentary

Tagged ,

Canvas fingerprinting in Web pages

Posted on January 15, 2019 | Comments Off on Canvas fingerprinting in Web pages

The array of sneaky tricks to get past Internet users’ veil of privacy is astonishing. At least it would be, if we weren’t all past the capacity for astonishment. One which has been around for years is Canvas fingerprinting. It lets servers narrow your profile down to a small number of clients. Combined with other measures, it can uniquely identify you.

How Canvas works

Canvas wasn’t designed to spy on you. It’s a way to draw graphics very efficiently in a browser. It supports animation and interaction. In order to get fast performance, it allows hardware acceleration and doesn’t mandate the exact set of pixels to be drawn. The server can then get those pixels back using getImageData() or toDataURL() in the Canvas API.
Continue reading →

Comments Off on Canvas fingerprinting in Web pages

Posted in commentary

Tagged , ,

FUIF: Yet another image format?

Posted on January 8, 2019 | Comments Off on FUIF: Yet another image format?

A tweet led me to a pair of articles about a new file format called FUIF. That stands for “Free Universal Image Format.” Jon Sneyers describes it in a series of articles which so far include a Part 1 and Part 2.

It’s “responsive by design”; a single image file can be truncated at various offsets to produce different resolutions. Sneyers says FUIF meets JPEG’s criteria for a new format that provides “efficient coding of images with text and graphics” and “very low file size image coding.”
Continue reading →

Comments Off on FUIF: Yet another image format?

Posted in commentary, News

Tagged ,

The great GIF pronunciation debate

Posted on January 3, 2019 | Comments Off on The great GIF pronunciation debate

Of all the issues in file formats, the pronunciation of “GIF” is surely close to the bottom in importance. When an issue is that minor, you can be sure everyone has strong opinions on it and will defend them on the barricades. It’s like the way political movements work: the closer together they are in their beliefs, the more ferociously they’ll vilify each other over little differences.

Personally, I always pronounce it my mind with a hard “G,” as in “give” rather than “giraffe.” I’m glad to see some support for this view in “A Linguist’s Guide to Pronouncing ‘GIF’.” One of its arguments matches the main reason in my mind: the “G” stands for “graphics,” which is pronounced with a hard “G.”

Case closed. Now can we agree that “PNG” is pronounced “Pee-Enn-Gee,” and not “Ping”?

Comments Off on The great GIF pronunciation debate

Posted in commentary

Tagged