Is this issue caused by plus? - Printable Version
-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Skype & Technology (/forumdisplay.php?fid=9)
+---- Forum: Skype & Live Messenger (/forumdisplay.php?fid=10)
+----- Thread: Is this issue caused by plus? (/showthread.php?tid=95843)
Is this issue caused by plus? by kabso 5 on 11-13-2010 at 08:40 PM
Hey, I've been facing a problem lately, I cant see links as a hyperlink, I see them as text. 
![[Image: Untitled_8.jpg]](http://b.imagehost.org/0522/Untitled_8.jpg)
when I type them it looks fine, but I cant access them in the convo window..
so anyone knows how to fix it?
and I've another question, Is it possible to click in the e-mail icon on the messenger, and access the e-mail by firefox instead of IE? 
Firefox is my default explorer 
RE: Is this issue caused by plus? by mynetx on 11-13-2010 at 08:47 PM
Hello Kabso5,
please read the following article about this issue:
http://windowsteamblog.com/windows_live/b/windows...alicious-worm.aspx
quote:
Originally posted by John Scarrow
A particularly malicious worm (a self-replicating computer virus) is currently trying to spread itself through many of the world's largest instant messaging and social networks, including Windows Live Messenger 2009. We’re very serious about protecting our customers, and are pursuing multiple avenues to help stop its progress. The worm spreads by inserting a link into an IM conversation with a person whose computer is already infected. When someone clicks the link, it opens in a browser, downloads the worm on the recipient’s computer, and then repeats this process.
Most notably, we’ve temporarily turned off active hyperlinks for web addresses sent in IM conversations using Windows Live Messenger 2009. You will still be able to copy a web address and paste it into a browser window if you know it to be safe, but by removing active hyperlinks from Messenger 2009, we’re taking a significant step towards stopping the unintentional spreading of this worm.
Hope this helps you.
RE: Is this issue caused by plus? by CookieRevised on 11-13-2010 at 10:42 PM
Note: the above message comes from Microsoft.
Messenger Plus! has got nothing to do with this...
RE: Is this issue caused by plus? by kabso 5 on 11-14-2010 at 06:21 AM
So microsoft turned it off?
how did they do that, I didnt update or anything..
I thought the conversation is P2P? isnt it.. 
So there is isnt a way to risk it and activate they hyperlink?
quote:
and I've another question, Is it possible to click in the e-mail icon on the messenger, and access the e-mail by firefox instead of IE?
Firefox is my default explorer
Note: MSN 8.5
Its fine with MSN 2009..
RE: Is this issue caused by plus? by Chrono on 11-14-2010 at 07:44 AM
quote:server side probably.
Originally posted by kabso 5
how did they do that, I didnt update or anything..
i noticed this too, i thought my wlm was malfunctioning
RE: RE: Is this issue caused by plus? by kabso 5 on 11-14-2010 at 08:32 AM
quote:
Originally posted by Chrono
quote:server side probably.
Originally posted by kabso 5
how did they do that, I didnt update or anything..
i noticed this too, i thought my wlm was malfunctioning
lol ye, I reinstall my WLM twice.. tried to repair it
I was like WTF
They should at least warn us or something omg..
RE: Is this issue caused by plus? by Mike on 11-14-2010 at 02:13 PM
So why didn't they just block messages containing the bad link (you know, like the stupid filter that blocks messages containing "download.php")? Are there many links that link to the virus?
RE: Is this issue caused by plus? by CookieRevised on 11-14-2010 at 04:46 PM
quote:There are extremely many links being send which lead to malware and other shit (think of all those "I saw your picture here" stuff which is around since years). Hence they introduced this method of relay linking some while ago so they can filter out those bad links in a pro-active way (by disabling hotlinking for those links).
Originally posted by Mike
So why didn't they just block messages containing the bad link (you know, like the stupid filter that blocks messages containing "download.php")? Are there many links that link to the virus?
But only now, there seems to be a realy bad thing going around which made them disable this direct hotlinking (that is the active clickable hyperlinks) all together since they haven't found a good solid way to filter out those random worm links and leave the safe links alone (so I've been told though - but it does make some sense).
PS: WLM2011 works in a slithly different way in this regards, so it isn't effected in that links are still clickable, but you'll get a warning in your browser from the Smartscreen filtering.
Although it may seem very annoying, such a protection method is actually a very effective way against the still increasing threat of IM malware/worms/virusses. Most IM malware spreads exactly because people still click without thinking on active links nomatter how they look like.
But, yeah, in certain cases it is extremely annoying and might even brake the links, especially for 'power' users, but those are a minority actually. And as with so many things: the majority dictate the rules.
PS: kabso 5, no, Messenger conversations have never been P2P, they always go thru Messenger's servers.
RE: Is this issue caused by plus? by Chancer on 11-14-2010 at 05:41 PM
quote:I think URL shorteners can technically have any address, so it's harder to block specifc content.
Originally posted by Mike
So why didn't they just block messages containing the bad link (you know, like the stupid filter that blocks messages containing "download.php")? Are there many links that link to the virus?
RE: Is this issue caused by plus? by djdannyp on 11-15-2010 at 02:15 PM
Wow hadn't even noticed this. Fingers crossed it gets re-enabled soon
RE: Is this issue caused by plus? by Amec on 11-16-2010 at 01:17 AM
Has anyone figured out how to hex edit/patch the exe to re-enable links, yet? This is getting REALLY annoying.
RE: Is this issue caused by plus? by Spunky on 11-16-2010 at 06:50 AM
quote:
Originally posted by Amec
Has anyone figured out how to hex edit/patch the exe to re-enable links, yet? This is getting REALLY annoying.
As people are getting this problem without updating anything, it's safe to say that it is happening server-side. There is no way to get around it.
RE: Is this issue caused by plus? by kabso 5 on 11-16-2010 at 06:56 AM
I hate copying it because when we copy it
we get "*" the star char with the url in the convo =(
I hope PLUS5 could get red of that star XD.
I think we can make a script as soon as we see HTTP it automaticly transfer it into a hyperlink right in our convo " the side where we type because its clickable there "
or it'll open a new tab or something like that, idk...
RE: Is this issue caused by plus? by Amec on 11-16-2010 at 07:33 AM
quote:
Originally posted by Spunky
As people are getting this problem without updating anything, it's safe to say that it is happening server-side. There is no way to get around it.
That doesn't mean editing the exe won't work. Yes, there is some stuff going on server side, but there is also something happening client side. Just because no one updated doesn't mean there wasn't already code in place to handle this situation. Perhaps there's a flag sent with every message to tell it not to parse links? I dunno how exactly they implemented it, but it shouldn't be too hard to fix.
(having said that, I don't know anywhere enough assembly to even attempt fixing it >_>)
RE: Is this issue caused by plus? by Spunky on 11-16-2010 at 07:50 AM
It's not as easy as that though either
EDIT:
quote:
Originally posted by kabso 5
I hate copying it because when we copy it
we get "*" the star char with the url in the convo =(
I hope PLUS5 could get red of that star XD.
I think we can make a script as soon as we see HTTP it automaticly transfer it into a hyperlink right in our convo " the side where we type because its clickable there "
or it'll open a new tab or something like that, idk...
This may work for now, although I need to update it to work with newer browsers:
http://www.msgpluslive.net/scripts/view/237-Find-Links/
RE: Is this issue caused by plus? by V@no on 11-17-2010 at 04:37 PM
IMO this nonsense from MS side is the same as to remove door bell so children would not open the door when someone is at the door...
I just hope that this is not a sort of arm twisting technique to make us switch to 2011 crap (in 2011 links work fine) If it is, I'm switching to skype, screw that 2011 bs.
RE: RE: Is this issue caused by plus? by chair on 11-17-2010 at 07:37 PM
quote:
Originally posted by V@no
IMO this nonsense from MS side is the same as to remove door bell so children would not open the door when someone is at the door...
I just hope that this is not a sort of arm twisting technique to make us switch to 2011 crap (in 2011 links work fine) If it is, I'm switching to skype, screw that 2011 bs.
Of course they are trying to force everybody to update or do u rly believe that they disabled such feature to "protect our users"
lol thats the most retarded bs that ive ever read.
Going to use trillian
RE: Is this issue caused by plus? by Spunky on 11-17-2010 at 07:57 PM
quote:
Originally posted by chair
quote:
Originally posted by V@no
IMO this nonsense from MS side is the same as to remove door bell so children would not open the door when someone is at the door...
I just hope that this is not a sort of arm twisting technique to make us switch to 2011 crap (in 2011 links work fine) If it is, I'm switching to skype, screw that 2011 bs.
Of course they are trying to force everybody to update or do u rly believe that they disabled such feature to "protect our users"
lol thats the most retarded bs that ive ever read.
Going to use trillian
No, it really does make sense. You can't accidentally click on a link if the link isn't there. If you want to go to the site, copy and paste it into your browser.
Granted, they should probably add a right click option to open the link. Alternatively, go down the same route as Office where you have to hold CTRL+Click to follow any hyperlinks
RE: Is this issue caused by plus? by CookieRevised on 11-17-2010 at 09:09 PM
quote:tbh, that's actually a good basic protection...
Originally posted by V@no
IMO this nonsense from MS side is the same as to remove door bell so children would not open the door when someone is at the door...
quote:Believe what you want but it actually is to protect the users and it makes a lot of sense if you take into account who the average Messenger user is. You wouldn't believe how many people click on links without thinking.
Originally posted by chair
Of course they are trying to force everybody to update or do u rly believe that they disabled such feature to "protect our users"
And actually it does not make sense to use something like this to let people switch over, since WLM 2011 can only run on Vista/7 to begin with, and since WLM 2009 is still officially supported and downloadable and will be for a long time.
RE: Is this issue caused by plus? by chair on 11-17-2010 at 09:54 PM
Removing such feature w/o even warning the users was the stupidest thing ever.
WLM 2011 is a piece of crap
You cant even change your nickname. Why on earth did they do that !?
RE: Is this issue caused by plus? by Oxy on 11-17-2010 at 10:00 PM
quote:
Originally posted by chair
Removing such feature w/o even warning the users was the stupidest thing ever.
WLM 2011 is a piece of crap
You cant even change your nickname. Why on earth did they do that !?
They changed it with plenty of noise on their live blog (i assume...)
besides, id rather have alittle more work to do than to have malicious attacks spreading
RE: RE: Is this issue caused by plus? by V@no on 11-18-2010 at 01:54 AM
quote:Did you just say that you'd rather work little harder to get the malicious software on your computer? (rhetorical question
Originally posted by Oxy
They changed it with plenty of noise on their live blog (i assume...)
besides, id rather have alittle more work to do than to have malicious attacks spreading
) The result is the same weather you click on the link or drag'n drop it to the browser...What they actually do is insulting tech savy people by leveling them to the "average" users without giving them a choice.
RE: Is this issue caused by plus? by CookieRevised on 11-18-2010 at 10:52 AM
quote:yes, but people are a lot less inclined to copy, open browser and paste the link, than clicking on it directly. Those few extra seconds more work may be enough for people to realise there is maybe something fishy going on.
Originally posted by V@no
The result is the same weather you click on the link or drag'n drop it to the browser...
Even "tech savy" people often have that automatic reflex to click on links without thinking.
(as a matter of fact, I just dealed with somebody asking for help, who is more or less "tech savy", who clicked on a link in an automatic reflex (not in Messenger though) and started a virus. He even knew it was a virus. Having a non-active link would have prevented something like that)
quote:Yes it might be a bit annoying for those few links you'll receive in an average conversation, but I can safely say I'm "tech savy" and I don't feel insulted at all, not even in the slightest way.
Originally posted by V@no
What they actually do is insulting tech savy people by leveling them to the "average" users without giving them a choice.
It is a much quicker way and the 'protection' will be instant for a lot more people, than if they would have waited to create, test, and distribute a new version of Messenger and wait for everybody to update.
I can assure you that they do not take such measures lightly. But in the end, this was the only possible 'protection' for people using the old WLM version.
RE: Is this issue caused by plus? by kabso 5 on 11-18-2010 at 12:11 PM
They should disable file transfer as well then
RE: Is this issue caused by plus? by V@no on 11-18-2010 at 01:53 PM
Is MPL! capable do something about it via script routine? I know we can easily detect web addresses, but is it possible make part of the incoming text clickable or detect when user clicked on part of a text?
Now thinking about it, I'd rather have a script that would handle links (like Spunky mentioned, with CTRL key) then having the old way when it's pain in the ass mark the text if it starts with a link..
RE: Is this issue caused by plus? by CookieRevised on 11-18-2010 at 03:03 PM
quote:Nope, you can't make text clickable (and that's a very good thing btw) via scripting.
Originally posted by V@no
Is MPL! capable do something about it via script routine? I know we can easily detect web addresses, but is it possible make part of the incoming text clickable or detect when user clicked on part of a text?
You also can't detect when a user clicked in the conversation area, at least not with normal scripting. Using some advanced methods (involving subclassing, accessebility features, and what not) it might be possible, but I don't see anybody investing their time in something like that anytime soon.
RE: Is this issue caused by plus? by kabso 5 on 11-18-2010 at 03:47 PM
But, I think this will work
Look at the typing side
its clickable, I can click on www.google.com in the WLM Convo window at the Typing area only
I think we could get an advantage of that
for example, we can fetch http:// or www. in the conversation
and copy it via script to the typing area, and it will be marked or highlighted, so if we typed anything it'll remove the link from the typing area
or what do you think?
RE: Is this issue caused by plus? by Oxy on 11-18-2010 at 05:32 PM
quote:
Originally posted by kabso 5
But, I think this will work
for example, we can fetch http:// or www. in the conversation
and copy it via script to the typing area, and it will be marked or highlighted, so if we typed anything it'll remove the link from the typing area
or what do you think?
By what was said earlier (either in this thread, or another elsewhere) the change was not prompted by an update, heavily suggesting it was a server side flick of a switch if you will.
I can assume from that information, and your image, that the typing box is local (obviously), and that the disable of the hyperlink happens server side (thus why its not clickable in the message box you both share)
if somethings server side, i highly doubt you can manipulate it.
RE: Is this issue caused by plus? by V@no on 11-18-2010 at 05:36 PM
what they suggested is move received text links into input box, WLM automatically will convert them into clickable links. Theoretically it could work, but IMO it would create more problems then solve annoyance...
RE: Is this issue caused by plus? by CookieRevised on 11-18-2010 at 07:47 PM
quote:indeed, that will open a whole lot more problems and (even bigger) annoyances.
Originally posted by V@no
what they suggested is move received text links into input box, WLM automatically will convert them into clickable links. Theoretically it could work, but IMO it would create more problems then solve annoyance...
----------
just make a script which detects urls in messages and which has a keyboard shortcut to open the 'last received' url in that conversation and be done with it.
(note: urls can contain many protocols though, http is just one of many. eg: https, ftp, irc, news, etc...)
Or use Spunky's script:
Spunky's reply to Is this issue caused by plus?
----------
quote:questions/comments added by me for clarification
Originally posted by John Scarrow (General Manager - MS Safety Services) on WindowsTeam Blog on November 16, 2010 as a reply to posts
Thanks for the comments on the post. I’m hearing 3 general concerns here that I’d like to address.
Q: Why disabling and why only just now?
1) It’s true that similar attacks have been out there for some time, and we’ve been monitoring them, which is why we introduced the new Link Safety Feature in Windows Live Messenger 2011. However the difference with this particular variant of SLENfBot.AKD, (which is actually hitting several industry IM clients, and not just Windows Live Messenger), is that it is off the charts in terms of scale. We have work going on now to illuminate this particular threat so we can restore hotlinks, but the volume of attacks was too significant to let continue without any remediation. The number of customers that have been impacted on a daily basis is very significant, and every impacted customer leads to many more customers being hit with spam, and chances are, some percentage of those receiving the spam will click the link and expand the attack further.
Q: Users do not like it / Insulting for 'tech savy' users / etc
2) Folks that spend time on this blog are clearly “better than average drivers” and in some cases feel that removing the hot links is more undesirable that the perceived protection of disabling them. Again, we hope this is a short term issue for older versions of Messenger. We’ve heard your feedback loud and clear on the ability to turn off warnings, and are investigating ways to make this possible in the future.
Q: It is just an attempt to let people update
3) Because we work hard to make our software more and more secure with every release, from a security standpoint we always hope that users will follow us as we release new versions of our software. However, I want to make it very clear that this security response is absolutely not an attempt to nudge folks to upgrade. We understand and respect that with any change to such an ubiquitous IM client as Messenger there will always be changes that some folks don’t like and/or may not be able to take advantage of due to OS versions, etc. We’ll continue to innovate both in features and security and look forward to broader adoption over time, as you see fit.
RE: Is this issue caused by plus? by Spunky on 11-18-2010 at 10:19 PM
quote:
Originally posted by kabso 5
They should disable file transfer as well then
File transfers need to be accepted, then the file needs to be run before any damage is done. This is not the case the with the natural instinct to just click on links that are sent to you over WLM
RE: RE: Is this issue caused by plus? by kabso 5 on 11-19-2010 at 07:29 AM
quote:
Originally posted by Spunky
quote:
Originally posted by kabso 5
They should disable file transfer as well then
File transfers need to be accepted, then the file needs to be run before any damage is done. This is not the case the with the natural instinct to just click on links that are sent to you over WLM
Yeah. but file transfer is still dangerous, Its even more dangerous than hotlinks lol
people just accept the file just like they just click the link
Well, it should be the same in my opinion and don't open any link from any contact that you don't trust and do not accept file transfer from them too.
At least allow links that contain youtube.com google.com /vb/ /forum/.jpg /gif
and about the script how its going to cause any problem, it will be marked so you can click or type, and If you typed, the link will disappear..
anyway, I like the idea of a shortcut key to open the last URL posted in the convo, but I guess it'll make the computer slow because the script will have to search the convo for it and I sometimes talk for hours so it would be a huge convo
Hope we'll see this script soon.
they said that they will still be upgrading WLM 2009 and WLM 2011 and updating their features so is the Plus5! will work in both 09 and 11?
RE: Is this issue caused by plus? by Spunky on 11-19-2010 at 08:55 AM
quote:
Originally posted by kabso 5
At least allow links that contain youtube.com google.com
http://mydomain.com/youtube.com/virus.exe
Can be too easily exploited.
As I said, even if you accept a file transfer without thinking, you still need to open it. You usually also need to confirm a message box that appears with EXE files downloaded from other people or websites. Then your antivirus might make objections about the file when you try to run it.
Most importantly, bots and scripts cannot initiate file transfers, meaning the file HAS to be coming from your contact. If it's a virus, they obviously don't like you very much, or don't know about it themselves. Links can be sent by any script that can send messages over the MSN protocol.
EDIT:
quote:
Originally posted by kabso 5
anyway, I like the idea of a shortcut key to open the last URL posted in the convo, but I guess it'll make the computer slow because the script will have to search the convo for it and I sometimes talk for hours so it would be a huge convo
The script would save the URL to a variable when it is received. You wouldn't have to search through anything.
EDIT2:
Because I can't update the FindLinks script (I'm on WLM 2011), I've made a lite version that can open the last link received. It then shows a confirmation box with the url, the contact that sent it and the browser it will open in. These confirmations can be turned off at the moment by changing a variable at the top of the script. I couldn't test this as I wrote it as scripts aren't accessing the chat windows properly yet in 2011. If there are any problems let me know
EDIT3:
Command is /lurl btw
RE: RE: Is this issue caused by plus? by V@no on 11-19-2010 at 01:21 PM
quote:From MS side, not client side! Do you really believe that people who see such security popups all the time (poor vista users) actually pay attention to them and not automatically clicking accept? really??? When you see someone sends you a file do you go on 10 minutes discussion about the file before you decide to accept and what do you do when you receive it? going through virustotal.com to make sure it's clean? - I doubt it. This argument is so weak...
Originally posted by Spunky
quote:
Originally posted by kabso 5
At least allow links that contain youtube.com google.com
http://mydomain.com/youtube.com/virus.exe
Can be too easily exploited.
As I said, even if you accept a file transfer without thinking, you still need to open it. You usually also need to confirm a message box that appears with EXE files downloaded from other people or websites. Then your antivirus might make objections about the file when you try to run it.
Most importantly, bots and scripts cannot initiate file transfers, meaning the file HAS to be coming from your contact. If it's a virus, they obviously don't like you very much, or don't know about it themselves. Links can be sent by any script that can send messages over the MSN protocol.
And besides, since we already established that the links generated on MS server side, your example of spoof would not work, because program that parses the link would see that it's not youtube. So allowing common/safe websites pass through is a simple solution and would not rise up hell as current solution.
P.S.
several times I've received invalid youtube links since this nonsense started because MS replaced some characters in the url with * - now, this is unacceptable BS!
[EDIT]
Just noticed your script, thank you it is better then nothing. Will test it later though.
Here is another idea for these who's willing to help: A float window (or attached to the chat windows, or accessible via hotkey, whatever) that would show list of links from conversation. I see it as if it would only scan incoming messages and add links to it's own array as more become available. It could be individual list per conversation or one list with identifications from whom a link received.
RE: Is this issue caused by plus? by footose on 11-19-2010 at 04:59 PM
I downloaded wireshark and started searching for packets when you login to MSN Messenger.
It looks like there is a "policy" packet that is fired to MSN when you first login and it has contained in it what I believe the source of the issue is.
![[Image: msn_packet.jpg]](http://www.generationdub.com/temp/msn_packet.jpg)
Unless you go to the trouble of intercepting this packet and changing what it says before it hits the software, I'm not sure there is much we can do. There might be a way to hex edit MSN itself to always make this "enabled" - but again, might not be worth the effort.
BINGO.
![[Image: msn_bingo.jpg]](http://www.generationdub.com/temp/msn_bingo.jpg)
RE: Is this issue caused by plus? by Thor on 11-19-2010 at 06:05 PM
quote:Interesting. I wonder what other policy settings that are available to Microsoft's disposal.
Originally posted by footose
I downloaded wireshark and started searching for packets when you login to MSN Messenger.
It looks like there is a "policy" packet that is fired to MSN when you first login and it has contained in it what I believe the source of the issue is.
Unless you go to the trouble of intercepting this packet and changing what it says before it hits the software, I'm not sure there is much we can do. There might be a way to hex edit MSN itself to always make this "enabled" - but again, might not be worth the effort.
RE: RE: RE: Is this issue caused by plus? by CookieRevised on 11-19-2010 at 07:50 PM
*sigh*
quote:That thought process should be the same, but the reality is that it is certainly not the same for most people. Also, the possible protection methods are not the same. Each feature has its own specific problems and thus needs its own specific solution.
Originally posted by kabso 5
Well, it should be the same in my opinion and don't open any link from any contact that you don't trust and do not accept file transfer from them too.
quote:As said, that would solve absolutely nothing, not in the slightest way.
Originally posted by kabso 5
At least allow links that contain youtube.com google.com /vb/ /forum/.jpg /gif
Second, you are still seriously forgetting that MS can NOT magically make new features and let them materialize out of thin air on your PC. However, disabling the hotlinking is something they can control remotely, without the need for you to update and installing anything new. Anything else you ask for are full fledged features which does require at least a forced update (and which you probably will complain about too). And you seem to still forget that most WLM users are people who are not tech savy, much younger, behave in a different way accordingly, and use WLM differently.
quote:So each time you are typing something, everything will be removed because the contact happened to send you a link? I'm afraid what you suggested isn't going to work and will be even more annoyingly than what it is suppose to fix.
Originally posted by kabso 5
and about the script how its going to cause any problem, it will be marked so you can click or type, and If you typed, the link will disappear..
quote:Even with your proposed method (copying it in the typing area) the script needs to 'search' for the link in each send message too, there is absolutely no difference. The length of the convo doesn't matter either.
Originally posted by kabso 5
anyway, I like the idea of a shortcut key to open the last URL posted in the convo, but I guess it'll make the computer slow because the script will have to search the convo for it and I sometimes talk for hours so it would be a huge convo
But this said, this searching is instant. In fact, the script would need to do quite a lot more when it was created to copying the links in the typing area. Simply grabbing the last received url and making it available for opening in a browser by a shortcut is only a matter of milliseconds and a very few lines of code.
quote:yep, of course, why wouldn't it? You can read all about it in the proper threads.
Originally posted by kabso 5
they said that they will still be upgrading WLM 2009 and WLM 2011 and updating their features so is the Plus5! will work in both 09 and 11?
----------------------------------------------
quote:Errr... you just provided the reason why MS took the decision to disable hotlinking...
Originally posted by V@no
Do you really believe that people who see such security popups all the time (poor vista users) actually pay attention to them and not automatically clicking accept? really??? When you see someone sends you a file do you go on 10 minutes discussion about the file before you decide to accept and what do you do when you receive it? going through virustotal.com to make sure it's clean? - I doubt it. This argument is so weak...
quote:Quite wrong though. That is not a simple solution at all because there is no way to see if a link is good or malicious; a link can look ok, but in fact point to malicious data. That's the whole point of the complete disabling of links... But you aren't seriously suggesting for the MS's servers to download each and every link they come across to check if they file is safe or not prior to sending it to your contact do you??? That would take ages in that case and file transfers would become virtualy useless. Not to mention the problems it can bring with false positives and the massive temporary storage needed and the rediculus amount of processing power needed for all the milions of transfers each day.
Originally posted by V@no
And besides, since we already established that the links generated on MS server side, your example of spoof would not work, because program that parses the link would see that it's not youtube. So allowing common/safe websites pass through is a simple solution and would not rise up hell as current solution.
PS: But Spunky was replying to kabso's suggestion to allow links which contain stuff like "youtube.com" (kabso's own words). Of course Spunky knows that www.something.com/youtube.com/virus.exe is not a real youtube link, but such a link is what kabso suggested (it contains youtube.com, but it can be malicious though).
Either way, links are not checked by Microsoft, all they did (and all they could do without forcing you to do an update (weeks later after the facts no less)) was disabling the hotlinking in conversations.
quote:There is no reason why they would do that, and this is also the very first thing I hear about that and I'm closely following this whole issue, but maybe I'm missing something here...
Originally posted by V@no
P.S.
several times I've received invalid youtube links since this nonsense started because MS replaced some characters in the url with * - now, this is unacceptable BS!
quote:Have you read Spunky's second post in this thread? He already gave the link to an existing script which does that.
Originally posted by V@no
Here is another idea for these who's willing to help: A float window (or attached to the chat windows, or accessible via hotkey, whatever) that would show list of links from conversation.
----------------------------------------------
quote:winks, file transfer, display pictures, dynamic backgrounds, photo sharing, phone, voiceim, voicemail, plugins, camera, audio, sharing folders, signature sounds, location PSM, ... to name most of them, maybe with a few exceptions.
Originally posted by Thor
Interesting. I wonder what other policy settings that are available to Microsoft's disposal.
----------------------------------------------
Don't get me wrong people. Yes, at times I find it annoying too that they are disabled. But you may not forget that the average user is not someone with a very big knowledge about security and what not. So, yes, they do need protection from themselfs in this particular situation. Also, a lot of your rants are based on assumptions, nothing more. The truth is quite often completely different.
Bottom line is that this protection IS the only thing they could have done and it is a very sensible one which hasn't been taken lightly for that matter. In fact, they even did you a favor by not forcing you to upgrade to WLM 2011 or providing you with a forced update for WLM 2009 (which wouldn't be possible to make so quickly anyways <- another thing sometimes forgotten).
So, yes it is annoying, and yes MS sometimes do stupid stuff (imho)... but in this case, taking in account the limitations they have, the severity of the threat, and the average WLM user, I fully support this decision, in all of its aspects.
----------
PS: footose, can you resize your wireshark screenshots a bit? They are screwing up the thread layout.
RE: Is this issue caused by plus? by footose on 11-19-2010 at 08:48 PM
np 
posting a how-to right now.
enjoy. re-enable links in messenger
http://www.generationmediagroup.com/blog/re-enabl...s-in-messenger-09/
RE: RE: Is this issue caused by plus? by V@no on 11-20-2010 at 12:18 AM
quote:
Originally posted by footose
enjoy. re-enable links in messenger
http://www.generationmediagroup.com/blog/re-enabl...s-in-messenger-09/
Works great, thank you!
RE: Is this issue caused by plus? by babygrl22 on 11-20-2010 at 04:00 AM
ohhh so that's why links don't show up hahha...i thought that it was something wrong with my laptop xD or my WLM thnx
RE: Is this issue caused by plus? by Mnjul on 11-20-2010 at 04:48 AM
quote:I'm 50% sure this can also be integrated in a script with process memory manipulation...anyone wants to try? Or I try?
Originally posted by footose
np
posting a how-to right now.
enjoy. re-enable links in messenger
http://www.generationmediagroup.com/blog/re-enabl...s-in-messenger-09/
Edit: script patching the string doesn't seem to work. I'll try to patch the code where the string is matched.
Edit2: OK, it appears that the strings are being copied to somewhere when Messenger is started (that is, when scripts are not initialized to run). It's gonna be hard to dynamically catch where the string is stored that is actually matched against :/ Now I'll search for all MBCS case-insensitive strcmp calls
RE: Is this issue caused by plus? by gaara20 on 11-20-2010 at 08:26 PM
this is just a trick from Microsoft to people download WL2011, well i say: fuck them. I will never use the new live version.
They say it was temporary, but its still the same? If next week this still continues ill use that option footose posted here.
RE: Is this issue caused by plus? by Spunky on 11-20-2010 at 10:50 PM
quote:
Originally posted by gaara20
this is just a trick from Microsoft to people download WL2011, well i say: fuck them. I will never use the new live version.
They say it was temporary, but its still the same? If next week this still continues ill use that option footose posted here.
It's not a trick; read the rest of this thread.
Temporary could mean upto a few months/years. Don't expect a quick fix
RE: RE: Is this issue caused by plus? by gaara20 on 11-21-2010 at 06:29 PM
quote:
Originally posted by Spunky
quote:
Originally posted by gaara20
this is just a trick from Microsoft to people download WL2011, well i say: fuck them. I will never use the new live version.
They say it was temporary, but its still the same? If next week this still continues ill use that option footose posted here.
It's not a trick; read the rest of this thread.
Temporary could mean upto a few months/years. Don't expect a quick fix
It isn't a trick? Well it sounds like one to me, taken from the Live team blog:
"Messenger 2011 is not impacted in the same way, thanks to its Link Safety feature."
Well people, look, WL 2011 still works! You should all upgrade lolololo!
Years? Are you serious? Common...
RE: Is this issue caused by plus? by Oxy on 11-21-2010 at 07:15 PM
quote:
Originally posted by gaara20
Well people, look, WL 2011 still works! You should all upgrade lolololo!
you're right, they should have left that important safety feature out of wlm so they can click harmful links too!.
Seriously. they provide a more long term approach for a newer version because its not easy to implement new code into something thats on your computer (as you refuse to upgrade). And since they had new ideas in mind anyway, it made sense to implement aforementioned safety feature into a newer release.
RE: Is this issue caused by plus? by Menthix on 11-22-2010 at 01:03 PM
TReKiE released Messenger Link Reviver which will restore the ability to click on links in Windows Live Messenger 2009.
It will modify Messenger, probably using the same kind of method footose already described. But Link Reviver makes is easy for everyone with just a few clicks.
RE: RE: Is this issue caused by plus? by kabso 5 on 11-23-2010 at 08:20 PM
quote:
Originally posted by Menthix
TReKiE released Messenger Link Reviver which will restore the ability to click on links in Windows Live Messenger 2009.
It will modify Messenger, probably using the same kind of method footose already described. But Link Reviver makes is easy for everyone with just a few clicks.
Solved, thank you.
RE: Is this issue caused by plus? by compathia on 12-22-2010 at 06:20 PM
Ok.. the Messenger Link Revivel didn't work for me.
It seems that all it does is to give an hyperlink appearence in the chat window (i click on it and it still doesnt work)
and what's more, the hyperlink for seeing a user's profile doesn't work either
and i don't know about the rest of you, but in my computer it's definitely a plus problem: if i uninstall the plus, then everything works just fine; if i install it again, then the problem comes back.
I have the versions of plus (4.9.0.392) and wlmsn (14.0.8117.416), but i had the same problem when with the lastest versions before those.
Oh, and i already tried to uninstall everything and install it again..
ideas? 
ps. sorry for my crappy english!
RE: Is this issue caused by plus? by Spunky on 02-02-2011 at 04:26 PM
When did links get enabled again?
RE: Is this issue caused by plus? by Apatik on 02-02-2011 at 04:29 PM
Noticed this as well maybe a week ago.
RE: Is this issue caused by plus? by kabso 5 on 02-02-2011 at 04:37 PM
When they forced us to update
RE: Is this issue caused by plus? by CookieRevised on 02-02-2011 at 05:11 PM
quote:yup, correct....
Originally posted by kabso 5
When they forced us to update
Which leads me to think the security update was in part for this disabled link issue. As some (incl. me) have said before, they disabled linking because they had to react quickly. The only possible way for them at that time was to disable the feature
(they can enable/disable features on their part. Messenger will always contact the servers first before enabling a feature on your end, winks, sounds, etc can all be disabled by MS on a moment's notice). Since updating the client takes time (everything needs to be programmed -of course- and everything is tested again in all possible scenarios and that takes a long time) and not everybody would update by themselfs it was the only (and quite frankly logic imho) way at that moment.
And now, after some time, they fixed it, tested it and released a mandatory update... It all makes sense...
RE: Is this issue caused by plus? by Mnjul on 02-03-2011 at 10:24 AM
quote:Yeah, but I wish they could've designed it that people already using b8117 wouldn't be affected and could continue using their Messenger with links enabled... I mean, I have been using b8117 since it came out (it's last May isn't it), but my links were still disabled even though b8117 supposedly wouldn't be anything wrong
Originally posted by CookieRevised
quote:yup, correct....
Originally posted by kabso 5
When they forced us to update
Which leads me to think the security update was in part for this disabled link issue. As some (incl. me) have said before, they disabled linking because they had to react quickly. The only possible way for them at that time was to disable the feature
(they can enable/disable features on their part. Messenger will always contact the servers first before enabling a feature on your end, winks, sounds, etc can all be disabled by MS on a moment's notice). Since updating the client takes time (everything needs to be programmed -of course- and everything is tested again in all possible scenarios and that takes a long time) and not everybody would update by themselfs it was the only (and quite frankly logic imho) way at that moment.
And now, after some time, they fixed it, tested it and released a mandatory update... It all makes sense...
RE: Is this issue caused by plus? by mynetx on 02-03-2011 at 10:28 AM
quote:Did you try redownloading and installing 8117?
Originally posted by Mnjul
but my links were still disabled
RE: Is this issue caused by plus? by Mnjul on 02-03-2011 at 10:31 AM
Nah, I mean my links were still disabled for the "period" when everybody's links were disabled.
RE: Is this issue caused by plus? by mynetx on 02-03-2011 at 10:33 AM
Yes, because the global serverside switch was still set to "disable links".
RE: Is this issue caused by plus? by CookieRevised on 02-03-2011 at 04:57 PM
quote:hmmm, that means their 'enable/disable features remotely' thingie isn't version/build specific I guess... They probably thought it was justified since not a lot of people were already using that build. Either disable it all, or have the risk that the worm would spread like wild fire... could be that, maybe not, who knows...
Originally posted by Mnjul
Nah, I mean my links were still disabled for the "period" when everybody's links were disabled.
This said, then I wonder why they didn't force update everybody in that case from the beginning ... hmmm
Or maybe it was just a coincidence then that the links were enabled again and the 'new' build was pushed out?
RE: Is this issue caused by plus? by Arcticwolfx on 02-03-2011 at 05:36 PM
Assuming this was a server-side setting; one could assume that a small part of the Messenger department spent some modest time researching the risks and possible spreading through new versions. By simply initiating a forced update, the security still wouldn't be guaranteed and could cause double the discomfort, not to mention added negative reputation. Perhaps even a server side fix was needed to make sure the reported problem could not manifest itself in different forms. If that happens, it could lead to countless minor "fixes" and new versions of the worm along with it. Seems logical that as soon as they got their malfunction fixed with certainty when the service is used in conjunction with a specific build, they would force everyone to update to that build and re-enable options that caused risks before.
On a side note, I'm not one to trash talk Microsoft where it's not due, but I would say that it's not uncommon for Microsoft's services to be quite delayed when it comes to "minor" bugs. On the other hand, when a fix does arrive, it's usually very effective and not quick to be circumvented by users with malicious intentions.
RE: Is this issue caused by plus? by CookieRevised on 02-03-2011 at 05:48 PM
Makes sense...
PS: quote:
If you mean the enabling/disabling of features, then yes, it is done server-side. Besides hotlinks, these also include winks, file transfer, display pictures, dynamic backgrounds, photo sharing, phone, voiceim, voicemail, plugins, camera, audio, sharing folders, signature sounds, location PSM, ... all can be disabled globally by MS via a server side-setting.
Originally posted by Arcticwolfx
Assuming this was a server-side setting;
RE: Is this issue caused by plus? by Arcticwolfx on 02-03-2011 at 06:16 PM
My bad again, with "server side setting" I meant to say "Global," as in non-version specific, like you've mentioned in your post before.