Editor's Choice Article

Overcome the Trust Center nuisance
By MacroShadow

Today we will discuss a problem that most Microsoft Office (2007 and up) developers have (or are very likely to) encountered while deploying a new application to their users.

The problem
A new security feature was introduced in the Microsoft Office 2007 suite, the Trust Center. It is meant to prevent malicious code from running on the machine of an unsuspecting user, on the opening of an office file via an AutoExec macro, or code in the "OnLoad"/"OnOpen" events of the startup form.

Every time a Microsoft Office file that was created on a different machine is opened, it is checked by the Trust Center, to insure that the file doesn't contain malicious content. The Trust Center doesn't have database of malicious code nor does it have heuristic scanning capabilities. Since the Trust Center doesn't have a way of identifying which macros are legitimate, it will check for any of the following:

• Microsoft Visual Basic for Application (VBA) macros
• COM add-ins (in a non-trusted folder)
• Smart tags
• Smart Documents
• Extensible Style sheet Language (XSL) documents

Read more...

Nata's Corner

There may be hope for us all yet when it comes to stopping robocalls, catching thieves and hunting down malware writers.

When I first started doing this column, I never imagined that I would be telling you that one of the most dangerous threats to keeping your personal information yours and not everyone else's is your friends -- the people who you choose to let see your information on Facebook. Graham Cluley of Sophos must be getting a little tired of saying the same thing over and over: check your privacy settings, because it's not just the apps you install that can see your data, but the apps the people on your friends list install as well. You'll find the setting under Apps, then Apps Others Use under the privacy options.

The big news out of Facebook is their new non-phone phone, Facebook Home, which is really just a way of skinning your phone so that you spend all your time on Facebook. It's only available for Android devices -- Apple isn't about to give Mark Zuckerberg the keys to its kingdom -- but the thing that would worry me most is that on one device, you have both Facebook -- which is famous for being a little lax about your privacy and for doing all kinds of things to put ads in front of you -- and Google, which is only a little better about privacy (and the European Union doesn't think Google has gone far enough). The question is... who's gonna win?

This is definitely low tech, but if you live anywhere that has mosquitos, this seems to actually work. Take a 2-liter soda bottle and cut it in half. Mix 3/4 cup of hot water (200 ml) with about 1/4 cup (50 grams) of brown sugar. When it has cooled, add 1 gram of yeast (there are about 7 grams to your average yeast envelope), and pour the mix into the bottom half of the bottle. Turn the top part of the bottle (without the cap) upside down and wedge it into the bottom, and then seal it with electrician's tape (or black duct tape). Put it someplace near the house, and let it collect mosquitos. The yeast produces carbon dioxide, which is the same thing that attracts mosquitos to you.

Finally, one of the more interesting websites I've come across lately is Sell It Forward, a partnership between ebay and Goodwill. We've accumulated a lot of extra "stuff" -- a lot of it clothing that doesn't fit any more -- that normally, we would have to bag up and take to a local hospice- or crisis center-second hand store. They'd give us a receipt so we can deduct it on taxes. This new partnership is a neat idea, though. You sign up, and they send you a mailer that you can put the clothing into. You send it back, and they try to sell your stuff on ebay for a couple of weeks. You get paid for what sells, and a receipt for what doesn't -- and that gets donated to Goodwill.

In Brief

I think I did pretty well under the circumstances. We're not going to bother with all of the April Fool's Day alterations to various sites, but we will give you a few that were worth chuckling about (and link to ZDNet's screenshots:

• YouTube's "we're ready to pick a winner" video (thanks, Gerry!)
• Microsoft's right jabs at Google, along with Google's left hook back
• Mark Zuckerberg's first website. More interesting is the fact that Gizmodo felt compelled to do a story about it.
• Volvo's External Vehicle Protection system.
• TechCrunch's take on Apple's iWatch
• From Sophos, a new take on the old "Bill Gates will give you $100 for forwarding this email" nonsense.
• Best one: Twttr gng bck 2 bscs.

Rosebud... In requiem: Film critic Roger Ebert; if only we could all write half as well. Also, Britain's Lady Margaret Thatcher and Disney's Annette Funicello.

The news goes on for 24 hours a day. Simple, elegant ideas: Civility, please; Google Note -- except that in the case of the latter, you can expect advertising to be eventually served; the New York Times in haiku; and BreakupText.me.

I always gagged on the silver spoon. First world problems: calculating redshift.

Don't believe everything you hear on the radio. Just after we put our most recent issue to bed, Spamhaus, the non-profit organization that identifies and keeps track of ISPs that allow spamming, was hit by a massive DDoS attack when it blacklisted a Dutch ISP called Cyberburnker, who first retaliated and then denied being responsible for the attack. There's a lot that both businesses and IT folks can learn, since the one thing they haven't learned is that procrastination won't make the danger of open DNS resolvers go away.

I am not a gentleman. I don't even know what a gentleman is. We knew it all along: Facebook leads to a life of crime.

it's no trick to make a lot of money... if what you want to do is make a lot of money. There are a number of reasons to like T-Mobile's new "no contract" service -- notably that it lifts the veil from what the big two (AT&pT and Verizon) charge for subsidizing new phones -- but the one we like best is that they sell iPhones cheaper than Apple does.

I don't think there's one word that can describe a mans life. Now we know why AT&T won't let you say what you think of them as a password.

We never lost as much as we made. Bubble or no bubble, our old econ prof is probably turning over in his grave over Bitcoin. Security companies are worried about it too.

You don't care about anything except you. Are we the only people who got a giggle out of what the DEA has to say about Apple's chat service?

I can't do this to you? Oh, yes I can. Just when web developers thought things were going to get a little easier, Google and Apple are going their separate ways in developing their web browsers.

I guess that'll show you. California is considering legislation that would strengthen laws about who knows what about you and who they told. Some people might get nervous, and there's no doubt that the government would be exempt.

I don't know how to run a newspaper, Mr. Thatcher; I just try everything I can think of. Some code injection by Comcast touched a few nerves, because it hijacks your web traffic, routes it through Comcast servers and sends up a nice little message saying "you've been spending too much time watching YouTube videos". It's not so much that Comcast is inserting the code into one's pages that has people upset, though; rather, it's that it's

• "...beyond awful - it fails to display, makes endless AJAX requests, and more..."
• "...a company writing JS that bad would probably screw up the rest of the process too..."
• "Oh, it's just awful. It's worse than just "not knowing JavaScript." This is code from someone who has no idea how to program..."
• "Where the hell did they find the coder to make this?" [Editor's note: the reply is priceless.]

The point to the code -- which already has a blocker for Chrome and (of course) an applicable meme -- is to tell the user that s/he is approaching the limit of his/her allowed bandwidth.

Some people can sing, some people cannot. Happy birthday, cell phone.

Maybe I'll make some teeth and whiskers... (AKA Signs of the Apocalypse): Two words: Manatee Gray. Just wait'll it comes out in invisible. All six Star Wars movies at the same time, since the video games will soon be long, long ago. Ads that have a conversation with you.

Milestones

My First Million: Reaching the 1,000,000 point level at Experts Exchange in March were RainerJ, robert_schutt, RolandDeschain and _jesper_. Congratulations!

Milestones:

• CPColin is the first employee of Experts Exchange to earn a Guru certificate, in Java Programming.
• nobus's 2 million points in Miscellaneos Hardware is the second topic area in which he has reached that level. He also has at least 1,000,000 points in ten other TAs.
• By reaching 4,000,000 points in SQL Server 2005, aneeshattingal has become the fifth member of EE to reach that level in two different topic areas.