ReaProducer | Accessible Audio and Midi Production with Reaper DAW and OSARA

This is an episode of the Aussie Mac Zone podcast which I regularly participate in. It is a weekly news show, and covers mainstream Apple stories from an Aussie point of view. If you’re interested in subscribing click here

Although Kayaker's cove could be described as a quaint, warm inlet with calm lapping waves, the ocean can be a dark, violent place with giant rogue waves and swashbucklers and pirates just over the horizon. As is the sea, so goes technology.

Every week there are new stories of data breaches and new security exploits putting your data at risk. You will never be safe. But don't go off the grid yet or pull that boat into dry dock. There are easy things you can do to help reduce your exposure on the high-tech seas, so let's get started! Here's my top ten security tips and best practices list for you.

They still call it a personal computer, and many of us still think of it that way. It's my computer, so why would I have more than one account set up on it? Well, that's probably your biggest security risk, and it started from the moment you booted your Mac for the very first time and it asked you to create a username and password. That initial account has what is called admin level privileges and has the potential to tweak just about every file on your computer. Any application you run will have admin privileges, and thus any application you run can change about anything on your system. A malicious piece of software would love to have that chance. I always recommend two accounts on your Mac, one that is your admin account that you set up when you first set up a new Mac, and then a standard account, which is your main account you use every day. I use the user MacAdmin as my admin account, and kayaker as my main account. You would set this up by going to System Preferences, Users and Groups. From there, you should see the Users table and ideally you want to see that you have an account with admin privileges and another with standard privileges. The way you can tell which is which is in the user account info section, where you should find a checkbox that says something like Allow this user to administer this computer. There has to be at least one account that has this ability. If you only have an account with admin privileges, you need to correct the situation. To do this, create a new account called MacAdmin and give it the ability to administer the computer. Then, go to your personal account name and remove your main account's ability to administer the computer by unchecking the checkbox.

So what does this mean for your day-to-day life? Not much. If you ever are prompted with a dialog to enter admin credentials, instead of just typing your password, you instead need to enter the MacAdmin username and the MacAdmin password. That's about it. This simple step has now prevented what we call an escalation of privileges attack, one of the most common attack vectors for malware.

If you keep the key to your treasure chest on top of the chest, well, I'm certain Captain Jack will thank you. You are only as safe as your passwords. This is the weakest link in any security system. So you need to make it strong. In fact, you can google “most common passwords” and get a list. Your password better not be on it. So, how do you make a password strong? I suggest that whatever you use, it not be in a dictionary, or in the script of any Star Trek or Star Wars movie. Mixing numbers and symbols in is always a good thing. I also suggest you make it at least 12 characters long.

Now that you have a strong password, make sure you use it for one purpose. If you have another account, use a different strong password. Hope you just didn't make your admin password the same as your main user password just now. A sad but true fact is that Web developers are lazy. Anyone who stores your password should be saving not the password, but a hash of your password. And I won't go geeky technical here, but in general, a hash cannot be used to figure out your actual password. It is just like what Apple does with your touch ID info: they hash your fingerprint and save the hash, not the fingerprint. Unfortunately, you have no insight as to how any site you visit saves your credentials. So, if bad guys steal data from your favourite gossip site, and that site saved your password as text, and that's the password you use all over the Web, well, there goes your bank account balance.

I know, I know, you have passwords for every site out there. How on earth can you keep track? There are some great applications out there to help you manage all your credentials. I personally use 1Password by Agile Bits. It's cross platform and secure. Despite the recent news of data being potentially compromised from LastPass, that's another good option. LastPass keeps your data very secure and even if bad guys had their entire database, it's so heavily encrypted that it would be impossible to crack it in your lifetime and that of your great-great-great-grandkids' lifetime as well.

It doesn't take a ghost to haunt your computer with malware. You can accidentally run an app that installs a demon of a daemon onto your Mac. Fortunately, MacOS has a security feature called Gatekeeper that will warn you if it thinks you might be running an app that you shouldn't. You can find Gatekeeper in the General tab of the Security and Privacy System Preference pane. There, you will find a radio button to complete the sentence: Allow only downloaded apps from, and suggest you use the second radio button, from the app store and identified developers. This is the default setting. But even if you want to run an app that Gatekeeper doesn't know about, fear not. You can easily override the warning by right clicking on the app and choosing open, and then confirming you want to open it on the next dialog box.

This is an easy one. Never never never install Flash on your Mac or PC. That's it. Flash is probably the single largest attack vector of virus and malware out there today. And you can get infected by just visiting any site that uses an ad service that has an infected ad. Bang. Your computer is now compromised. Did I mention to never never never use Flash? But if there is a site that needs Flash that your life depends on, use the Chrome browser and make certain you've done everything else on this list to help mitigate potential damage. Did I mention to never never never use Flash?

Safari tries to be helpful and will automatically open safe files. Sorry, there is simply no such thing. A clever JPEG file can infect your computer; a clever PDF file can infect your computer. There is no such thing as a safe file. So go to your Safari preferences and uncheck "Open safe files after downloading." This will mean you will have to go to your downloads folder to open files you have downloaded, but it also means you won't accidentally download and run a maliciously crafted "safe" file from a bad guy.

You don't sail off the coast of Somalia with a sign that says we will pay ransoms; nor should you make it easy for someone to steal your data. If you turn on your Mac and are brought right to your desktop without having to enter your username and password, you're giving anyone easy physical access to your computer. It's just like leaving your house keys hanging in the lock of your front door. It's easy to fix this in System Preferences, Security and Privacy, General tab. Make certain that your settings are not set to auto login. In earlier versions of MacOS X, this option was found in the Users and Groups or Accounts System Preference pane in the login options section.

This is analogous to don't call me, I'll call you. The majority of malware infections are done by phishing attempts. These are e-mails or pop-ups asking you to click on something or install something that will take you to a fraudulent website where bad things will happen. Never click on a link in an e‑mail or click on a pop-up from a browser that asks you to update something. The simple rule is that if you did not initiate the contact, then don't click on any link, even from your mother. But if you signed up for something like a new account from a particular site, and they send you a confirmation e‑mail in the time frame of your interaction with that site maybe asking you to verify your e‑mail by clicking on a link, then that's probably OK since you initiated the contact. If you are uncertain about the validity of an e‑mail, then go to the website not by clicking on the link in the e‑mail, but by typing the address in your browser directly. And don't forget to look for that https protocol, not just http. That S is for ‘securer.’

Public WIFI access points are just that: public. Be very careful about sending or doing anything critical over them. This goes for hotels and coffee shops. The risk here is about man in the middle attacks. If you can join a WIFI network, then a bad guy can join a WIFI network. If a bad guy can join, then a bad guy can see all traffic, and if he can see all traffic, he can spoof an extenuation of the network and force you to connect to his computer as your access point. He can then see any nonsecure traffic leaving your machine, and could possibly trick you into letting him see encrypted traffic as well, by issuing you a non-validated certificate. I could do a whole podcast on certificates, but for now, think of certificates as ways to encrypt your data and verify the identity of the website you are connecting to. If you ever see a dialog saying your browser cannot verify the identity or validity of a certificate, do not click Continue or OK if you are using a public access point or are connecting to an important website. The exception to this rule is if you are connecting to a small or personal website. These certificates are often just used for encryption and are what we call self-signed certificates. I have a self-signed certificate for my domain because certificates cost a lot of money to get, and I'm only interested in using it for encryption. Just be very, very mindful of any certificate warning you receive from your browser.

The advent of security questions was to solve one problem only: too many support calls about a forgotten password. It's not about security. Besides, your Facebook page and Google could probably give a bad guy all the answers he needs to take over your account, so don't let it happen. Those answers may be required to set up an account, but you need not be truthful. Make your answers as random as your passwords. Use your password manager to store your answers. Don't make it easy for social engineering to steal your identity.

This may be obvious, but make sure the software you run is up-to-date. That goes for your Mac OS version as well as your apps. If exploits are discovered and then fixed, you need to update to get that fix. But if you are not using the built-in software update mechanism or the app store, just be careful about how you get your updates by making sure you are going to the developer's site directly.

We want to tell you about a petite young lady, Alexa, who recently came ashore at Kayaker’s Cove. You may have heard the Echo of her voice already. However, if you’re still on the fence, and not sure if you should invite her in to your own life, take a listen to Kayaker’s experiences.

Along with the device, Amazon makes available an iOS app. The app is not completely accessible however you can certainly use it to get your new Echo connected and ready to respond to your every whim, well at least some of them.

On this episode I take an introductory look at the iOS app Voice Dream Mail. This app is free and from within you can purchase a subscription to unlock further features. Read on to see what the developer has to say about the app…

Voice Dream Mail works by speech and touch, so you can efficiently go through your email inbox without having to use your eyes. How It Works The app reads your email out loud using text-to-speech. You control it using the entire screen of your iPhone or iPad as a touchpad. For example, swipe right anywhere to advance to the next email, and swipe down to trash. Why It's Efficient Once you learn the handful of gestures, you will be able to triage your inbox very quickly. You know what to do with most emails after hearing the sender and subject. Because all commands can interrupt reading, it only takes a few seconds to handle each email. Plus, you can gradually increase speech rate: most people can listen at a higher speed than they can read visually.

Check out the app on the App Store to learn more and download.

I had the pleasure of talking to Subs and Amanda from the Project Starfish team. This is the second time I’ve had the opportunity to interview them and both times I’ve been personally inspired by the project and members.

Project Starfish is an inclusive, professional, experiential, learning platform. And if you want to know what that means or how they help blind and vision impaired people gain the skills and experiences required for work in the contemporary business world, take a listen to the show.

Get in touch with the Project here..

Following up on my demo of the Shortcuts Keyboard App the developer has offered to drop the price to free again on March 3. If you haven’t already taken the opportunity to pick up the app, then I recommend grabbing it. If 3 March 2015 is history when you’re reading this and the price is back to it’s normal price , then pick it up anyway, it’s worth it.

You can visit Shortcuts Keyboard on the App Store to find out more about the app and get the app.

I speak to Tom Dekker from iHabilitation Canada in this show. Tom tells us about the release of his latest tactile diagram book and gives us some insight on why he first started creating these fantastic resources for blind and low vision users of iOS devices. We also discuss the companion videos that have been created to use in conjunction with the book. The videos are freely available from Tom’s site by clicking here.

Other topics touched on in the show include The benefits of using the SpeedDots screen protectors, and Tom’s upcoming potential collaborations with Fedora Outlier and Blind Alive.

In this episode I take a look at the iOS app Shortcuts Keyboard.

An extremely useful third party keyboard for iOS 8.

Shortcuts Keyboard is a keyboard that allows you to add text based shortcuts to use in your favourite apps. It's great for quickly sharing an address of the party you're going to, your email address, and so much more! – Add your own text-based shortcuts – Works in your other apps such as Messages, email, and facebook messenger! Create shortcuts for quick access to sharing your email address, directions to your house, helpful information, or quick status updates such as, "Hey, I'm on my way, I'll be there soon!" or "There's a party tonight at 1 infinite loop around 7pm, think you can make it?"

Visit Shortcuts Keyboard on the App Store to read more and get the app.

Welcome back to the iBlindTech Democast. The iOS app iTired is the subject of this episode. It’s a simple app which solves a simple yet annoying problem, simply and effectively.

Listen to audiobooks or podcasts in bed? Tired of waking up hours later and having to spend minutes to find out where you nodded off? iTired solves this problem by doing an alertness check every few minutes. If you don't respond, it stops playback and optionally rewinds to the time you were last alert. A simple solution to an annoying problem.

You can read the rest of the description and purchase iTired by clicking here.

Hugo’s back with another jail break episode. He shows us iSounds and iFile. If you’ve ever wanted to use the new Siri voices for Voice Over, than this is the episode. Take a listen.