• We’re still at MS-DEFCON 2: Don’t install any patches just yet

    For those of you who are asking: It’s much, much too early to tell if all of the patches that have come out since Patch Tuesday are worthy. At least one is causing problems.

    Hold off. There’s nothing on offer that you need – providing you don’t use Internet Explorer, and don’t use Flash.

    Also, note this comment from JC Denton – which is absolutely spot-on:

    Woody, I am deeply disappointed in how you have fumbled and dropped the ball on this Flash issue.

    1 โ€“ People who need to use Flash should only ever use PPAPI flash (aka the Pepper Flash included with Chrome/Chromium).

    2 โ€“ Some people are still using the unsandboxed NPAPI version and that is dangerous. No mention of this in your posts even though you have a responsibility to inform your audience.

    3 โ€“ The best possible way to handle mandatory-flash websites is to download and use a PORTABLE browser such as Portable Firefox or Portable Chrome. Run the website in that browser and when you are done, just delete that entire browser folder and extract yourself a new/virgin copy of it whenever you need to access it. This method minimizes your attack surface and is a good computing practice. Once again ZERO mention of portable browsers being a thing or where to download them on your end.

    http://portableapps.com/apps/internet/firefox_portable
    http://portableapps.com/apps/internet/google_chrome_portable
    http://crportable.sourceforge.net/

    What a shame. I asked for orange security and got nothing but lemon-lime fumbles.

    You can do better than this. So do it!