Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #67621 > unrolled thread

New error/warning : Blocked Plug-in

Back to article view | Back to comp.sys.mac.system

Contents

  New error/warning : Blocked Plug-in briang@panix.com (Brian Gordon) - 2014-12-14 18:25 -0500
    Re: New error/warning : Blocked Plug-in dempson@actrix.gen.nz (David Empson) - 2014-12-15 13:59 +1300
      Re: New error/warning : Blocked Plug-in bill van <billvan@delete.shaw.ca> - 2014-12-14 20:04 -0800
        Re: New error/warning : Blocked Plug-in dempson@actrix.gen.nz (David Empson) - 2014-12-15 18:11 +1300
          Re: New error/warning : Blocked Plug-in bill van <billvan@delete.shaw.ca> - 2014-12-14 23:16 -0800
            Re: New error/warning : Blocked Plug-in Your Name <YourName@YourISP.com> - 2014-12-16 09:16 +1300
              Re: New error/warning : Blocked Plug-in bill van <billvan@delete.shaw.ca> - 2014-12-15 16:36 -0800
                Re: New error/warning : Blocked Plug-in Your Name <YourName@YourISP.com> - 2014-12-16 14:08 +1300
                  Re: New error/warning : Blocked Plug-in nospam <nospam@nospam.invalid> - 2014-12-15 20:40 -0500
      Re: New error/warning : Blocked Plug-in briang@panix.com (Brian Gordon) - 2014-12-15 19:54 +0000

#67621 — New error/warning : Blocked Plug-in

Running the latest versions of everything, under several browsers, I am now
seeing this "Blocked Plug-in" report when bringing up news articles.  There
would normally be a picture there, and this is new behavior.

Since this seems to be consistent accross multiple browsers, I presume it is
some system level setting, but I don't see where it is controlled.  I have
pop-ups blocked in individual browswers, but nothing for plug-ins.

Suggestions?  TIA.

-- 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
| Brian Gordon     -->briang@panix.com<--     brian dot gordon at cox dot net |
+ brianggordon@hotmail.com   Bass: Lexington "Main Street Harmonizers" chorus +
-------------------------------------------------------------------------------

[toc] | [next] | [standalone]

#67623

Brian Gordon <briang@panix.com> wrote:

> Running the latest versions of everything, under several browsers, I am now
> seeing this "Blocked Plug-in" report when bringing up news articles.  There
> would normally be a picture there, and this is new behavior.

Most likely to be Flash, which Apple blocked last week via the
automatically updated system-level XProtect mechanism.

To access Flash content on OS X with Safari and other web browsers which
use the Flash plugin, you now need Flash 16.0.0.235 (or 13.0.0.259).

Chrome is a special case: it has a built-in copy of Flash, which is
updated independently as part of Chrome updates (which should be done
automatically).

> Since this seems to be consistent accross multiple browsers, I presume it is
> some system level setting, but I don't see where it is controlled.  I have
> pop-ups blocked in individual browswers, but nothing for plug-ins.

XProtect blocks web plugins which have known security exploits (so far,
only Flash and Java are checked); for Flash this usually results in old
versions being blocked within a few days of Adobe releasing one of its
frequent "critical" security updates.
 
XProtect also blocks a few trojan horses and other known malicious
software from launching, so it is generally a good idea to let it do its
thing.

XProtect checks with Apple on a daily basis for updates to its set of
rules. This check is controlled by the option "Install system data files
and security updates" in System Preferences > App Store for OS X 10.9
and later; it is in System Preferences > Software Update for OS X 10.6.8
to 10.8.5 (10.6.8 needs a recent security update to enable the
mechanism).

"Automatically check for updates" (in the same place) must also be
enabled, but the various other options can be disabled without
interfering with XProtect.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#67626

In article <1lwp78z.1qcjf2o1hzr09xN%dempson@actrix.gen.nz>,
 dempson@actrix.gen.nz (David Empson) wrote:

> 
> XProtect checks with Apple on a daily basis for updates to its set of
> rules. This check is controlled by the option "Install system data files
> and security updates" in System Preferences > App Store for OS X 10.9
> and later; it is in System Preferences > Software Update for OS X 10.6.8
> to 10.8.5 (10.6.8 needs a recent security update to enable the
> mechanism).
> 
Tell me more, please, about this recent security update. Software Update 
for 10.6.8 stopped providing all but a few updates a year ago this 
month; the only things it has updated since are ones that could affect 
Apple's income stream: iTunes and the App Store. Running Software Update 
manually doesn't make any difference. In short, I haven't seen a 
security update in roughly a year. I've been assuming Snow Leopard is 
basically unsupported now, and I've been dithering about upgrading 
because there are a few old apps I don't want to lose.

The finder can't locate XProtect/File Quarantine for me and when I try 
to drill down to it in the systems folder I run into a permissions 
block. So, how can I find out whether there are updates for XProtect in 
10.6.8, and how can I apply them?

Thanks for any help.
-- 
bill

[toc] | [prev] | [next] | [standalone]

#67627

bill van <billvan@delete.shaw.ca> wrote:

> In article <1lwp78z.1qcjf2o1hzr09xN%dempson@actrix.gen.nz>,
>  dempson@actrix.gen.nz (David Empson) wrote:
> 
> > 
> > XProtect checks with Apple on a daily basis for updates to its set of
> > rules. This check is controlled by the option "Install system data files
> > and security updates" in System Preferences > App Store for OS X 10.9
> > and later; it is in System Preferences > Software Update for OS X 10.6.8
> > to 10.8.5 (10.6.8 needs a recent security update to enable the
> > mechanism).
> > 
> Tell me more, please, about this recent security update.

Sorry, I misremembered some of the details for older systems.

Checking online, XProtect was a feature of Snow Leopard from its initial
release, but it had functionality updates along the way.

What I partly remembered was that the last security update for Snow
Leopard (2013-004, in September 2013) changed the wording for the option
in System Preferences.

Prior to that security update, the option was described as
"Automatically update safe downloads list".

After that security update, the option was described as "Automatically
install important security updates".

For Snow Leopard, this option is located in System Preferences >
Security.

In a fully updated Lion system, the option is in System Preferences >
Security > (unlock via the padlock) > Advanced button > "Automatically
install important security updates". I haven't checked whether it got
renamed for Lion at some earlier point.

In a fully updated Mountain Lion system, the option is in System
Preferences > Software Update > "Install system data files and security
updates".

In Mavericks and Yosemite, the option is in System Preferences > App
Store > "Install system data files and security updates".

> Software Update for 10.6.8 stopped providing all but a few updates a year
> ago this month; the only things it has updated since are ones that could
> affect Apple's income stream: iTunes and the App Store.

Snow Leopard has also stopped getting iTunes updates recently - iTunes
12 (and later) require Lion. The final version of iTunes for Snow
Leopard is 11.4, which is required for iOS 8 compatibility.

This almost certainly means Snow Leopard won't be able to sync with or
manage devices running iOS 9 late next year.

Snow Leopard is still getting XProtect updates automatically, but who
knows how much longer Apple will continue doing that (possibly until
Adobe stops supporting Snow Leopard for Flash).

> Running Software Update manually doesn't make any difference. In short, I
> haven't seen a security update in roughly a year. I've been assuming Snow
> Leopard is basically unsupported now,

Yes.

Lion has also reached that point (apart from iTunes updates, which will
presumably continue supporting Lion until around the release of iOS 9
late next year).

> and I've been dithering about upgrading because there are a few old apps I
> don't want to lose.
> 
> The finder can't locate XProtect/File Quarantine for me and when I try
> to drill down to it in the systems folder I run into a permissions 
> block.

The files in question are located in this folder:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/

(If using Finder, you need to secondary/right-click on CoreTypes.bundle
and choose Show Package Contents to go deeper.)

There are two files, which are XML files in text format, readible from
any user account.

XProtect.meta.plist
XProtect.plist

The first one controls web browser plugins, the second has signatures
for malware.

On all of the systems I've checked (Yosemite, Lion and Snow Leopard),
they were updated on 2014-12-13 (probably 2014-12-12 for those in the
US, as I'm in a time zone which is most of a day ahead).

On my Snow Leopard system, XProtect.meta.plist says it is version 80
(the Version tag is at the end). It is clearly different to the files on
later OS X versions: my Lion and Yosemite systems have version 2055 of
that file. The XProtect.plist files are also quite different between
Snow Leopard and later versions.

My Lion and Yosemite XProtect files are identical apart from the
addition of a "LastModification" key in the Lion XProtect.meta.plist.

It therefore looks like Apple is still maintaining a special version of
the XProtect data files for Snow Leopard.

> So, how can I find out whether there are updates for XProtect in 
> 10.6.8, and how can I apply them?

To ensure you have the latest version of these files, the simple way is
to uncheck the "Automatically install important security updates" option
in System Preferences, then check it again, which should trigger an
update (if necessary).

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#67629

In article <1lwphkb.s89y4u18owaswN%dempson@actrix.gen.nz>,
 dempson@actrix.gen.nz (David Empson) wrote:

> bill van <billvan@delete.shaw.ca> wrote:
> 

> > Tell me more, please, about this recent security update.
> 
> Sorry, I misremembered some of the details for older systems.
> 
(big snip)

Thank you for a very responsive reply. I will follow up on your 
suggestions, but it appears that the sun will set pretty soon on my 
happy days with Snow Leopard.
-- 
bill

[toc] | [prev] | [next] | [standalone]

#67637

In article <billvan-CC4937.23163114122014@shawnews.vc.shawcable.net>,
bill van <billvan@delete.shaw.ca> wrote:
> In article <1lwphkb.s89y4u18owaswN%dempson@actrix.gen.nz>,
>  dempson@actrix.gen.nz (David Empson) wrote:
> > bill van <billvan@delete.shaw.ca> wrote:
> > > 
> > > Tell me more, please, about this recent security update.
> > 
> > Sorry, I misremembered some of the details for older systems.
> > 
> (big snip)
> 
> Thank you for a very responsive reply. I will follow up on your 
> suggestions, but it appears that the sun will set pretty soon on my 
> happy days with Snow Leopard.

Why?!?! I'm still using Mac OS X 10.2 and our white MacBook is runniong
10.5. 

There's only a few websites that my old browser versions don't work
properly with, mostly badly made or overly fancy ones. I haven't found
any that don't work on the MacBook (other than those that insist on a
newer version of crappy Flash).

[toc] | [prev] | [next] | [standalone]

#67643

In article <161220140916289838%YourName@YourISP.com>,
 Your Name <YourName@YourISP.com> wrote:

> In article <billvan-CC4937.23163114122014@shawnews.vc.shawcable.net>,
> bill van <billvan@delete.shaw.ca> wrote:
> > In article <1lwphkb.s89y4u18owaswN%dempson@actrix.gen.nz>,
> >  dempson@actrix.gen.nz (David Empson) wrote:
> > > bill van <billvan@delete.shaw.ca> wrote:
> > > > 
> > > > Tell me more, please, about this recent security update.
> > > 
> > > Sorry, I misremembered some of the details for older systems.
> > > 
> > (big snip)
> > 
> > Thank you for a very responsive reply. I will follow up on your 
> > suggestions, but it appears that the sun will set pretty soon on my 
> > happy days with Snow Leopard.
> 
> Why?!?! I'm still using Mac OS X 10.2 and our white MacBook is runniong
> 10.5. 
> 
> There's only a few websites that my old browser versions don't work
> properly with, mostly badly made or overly fancy ones. I haven't found
> any that don't work on the MacBook (other than those that insist on a
> newer version of crappy Flash).

I'm concerned about the lack of support by Apple and especially the lack 
of security updates, although the foregoing conversation suggests that 
File Quarantine may be doing some of that automatically. I'm trying to 
confirm that is the case. If I can confirm that, I'll probably 
procrastinate some more.
-- 
bill

[toc] | [prev] | [next] | [standalone]

#67644

In article <billvan-8FFBE5.16361115122014@shawnews.vc.shawcable.net>,
bill van <billvan@delete.shaw.ca> wrote:
> In article <161220140916289838%YourName@YourISP.com>,
>  Your Name <YourName@YourISP.com> wrote:
> > In article <billvan-CC4937.23163114122014@shawnews.vc.shawcable.net>,
> > bill van <billvan@delete.shaw.ca> wrote:
> > > In article <1lwphkb.s89y4u18owaswN%dempson@actrix.gen.nz>,
> > >  dempson@actrix.gen.nz (David Empson) wrote:
> > > > bill van <billvan@delete.shaw.ca> wrote:
> > > > > 
> > > > > Tell me more, please, about this recent security update.
> > > > 
> > > > Sorry, I misremembered some of the details for older systems.
> > > > 
> > > (big snip)
> > > 
> > > Thank you for a very responsive reply. I will follow up on your 
> > > suggestions, but it appears that the sun will set pretty soon on my 
> > > happy days with Snow Leopard.
> > 
> > Why?!?! I'm still using Mac OS X 10.2 and our white MacBook is running
> > 10.5. 
> > 
> > There's only a few websites that my old browser versions don't work
> > properly with, mostly badly made or overly fancy ones. I haven't found
> > any that don't work on the MacBook (other than those that insist on a
> > newer version of crappy Flash).
> 
> I'm concerned about the lack of support by Apple and especially the lack 
> of security updates, although the foregoing conversation suggests that 
> File Quarantine may be doing some of that automatically. I'm trying to 
> confirm that is the case. If I can confirm that, I'll probably 
> procrastinate some more.

Unless you visit porn and pirate websites, or download and install
software from dodgy websites or strange emails, the chances of you ever
getting malware on a Mac are basically nil.

Despite all the silly reports and scaremongering by anti-malware
sellers, I don't think any real person in normal Mac use has ever had
an infected Mac.

As long as the Mac works for what you need, then keep using it.

[toc] | [prev] | [next] | [standalone]

#67645

In article <161220141408547644%YourName@YourISP.com>, Your Name
<YourName@YourISP.com> wrote:

> > 
> > I'm concerned about the lack of support by Apple and especially the lack 
> > of security updates, although the foregoing conversation suggests that 
> > File Quarantine may be doing some of that automatically. I'm trying to 
> > confirm that is the case. If I can confirm that, I'll probably 
> > procrastinate some more.
> 
> Unless you visit porn and pirate websites, or download and install
> software from dodgy websites or strange emails, the chances of you ever
> getting malware on a Mac are basically nil.

the risk is definitely lower than with windows, but it's definitely not
nil and it's not just from porn/warez sites either. 

you keep spewing this nonsense and it's dangerously misleading.

two years go, a visit to an ios developer site was all it took and it
even infected apple employees.

<http://www.reuters.com/article/2013/02/19/us-apple-hackers-idUSBRE91I10
920130219>
  Unknown hackers infected the computers of some Apple workers when
  they visited a website for software developers that had been infected
  with malicious software. The malware had been designed to attack Mac
  computers.

> Despite all the silly reports and scaremongering by anti-malware
> sellers, I don't think any real person in normal Mac use has ever had
> an infected Mac.

you're ignorant.

[toc] | [prev] | [next] | [standalone]

#67635

In article <1lwp78z.1qcjf2o1hzr09xN%dempson@actrix.gen.nz>,
David Empson <dempson@actrix.gen.nz> wrote:
>Brian Gordon <briang@panix.com> wrote:
>
>> Running the latest versions of everything, under several browsers, I am now
>> seeing this "Blocked Plug-in" report when bringing up news articles.  There
>> would normally be a picture there, and this is new behavior.
>
>Most likely to be Flash, which Apple blocked last week via the
>automatically updated system-level XProtect mechanism.
>
>To access Flash content on OS X with Safari and other web browsers which
>use the Flash plugin, you now need Flash 16.0.0.235 (or 13.0.0.259).
>

Not that easy, I guess :-(  Installed the latest Flash, same problem.
Rebooted, just in case.  Still there.

-- 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
| Brian Gordon     -->briang@panix.com<--     brian dot gordon at cox dot net |
+ brianggordon@hotmail.com   Bass: Lexington "Main Street Harmonizers" chorus +
-------------------------------------------------------------------------------

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web