Traditionally, these attacks were targeted towards computers running Windows, which was painfully obvious when you visited one of these sites on a Mac, since you would see a Windows Explorer interface in the web browser, instead of Finder.

It was only a matter of time before attackers would expand this technique to include Mac users, especially as Apple continues to gain market share in the personal computer market. We’ve already started seeing more Mac virus proof of concepts, and many Mac users are under the mistaken impression that Macs are more secure than their windows counterpart. Up until fairly recently, it could be argued that Mac users were less at-risk, but Macs have never been more secure. Mac users were less at-risk simply because there were fewer of them. Bad guys tend to be opportunists, and they knew they’d get more bang for their buck by targeting Windows users.

This has arguably resulted in many less-savvy Mac users being given a false sense of security, when the reality is just that there weren’t enough Mac users for most malware authors to bother with. (Notice I said “most”.) As Macs have become more popular, they’re becoming a more financially viable target.

What we’re seeing now are much more sophisticated attacks, where malicious websites deliver content depending on what OS the target is using while on their page.

I recently stumbled across an infected website that displayed a fake anti-virus “scanner” that informed me that my computer was infected and prompted me to download a zip file called anti-malware.zip. You can see the screencast below:

This is a screenshot of the rogue antivirus page:

As you can see, the layout of the infected page is tailored to a Mac, showing what is meant to look like a Finder interface. A fake alert window pops up with the text:

Apple security alert: To help protect your computer, Apple Web Security have detected Trojans and ready to remove them. Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge.

When a Windows user visits this same infected page, they see a completely different page, tailored to Windows users, displaying a fake Windows Explorer interface:

(Windows screenshot courtesy of Satnam Narang.)

Important to note: According to VirusTotal, the detection of the windows executable version of trojan (named BestAntivirus2011.exe) is very low, which means very few legitimate antivirus programs will currently detect it as malware – only 2 out of 42. At least some email scanners are detecting the Mac version though, as Rackspace rejected my attempt to email it to VirusTotal for scanning and returned it undelivered, stating that a virus had been detected. VirusTotal indicates that 7 out of 42 antivirus programs will detect the Mac version, named MacProtector.mpkg.

If you’re wondering how I came across this page in the first place, I wasn’t researching Mac antivirus – I was googling on the terms “Anime Bleach hollow logo”, looking for a t-shirt with a Hollow skull logo on it from the anime series Bleach. The fourth result on Google displayed a page on a .nl domain, belonging to the Village Council of Molenhoek, Netherlands. (I don’t speak Dutch, so I didn’t realize that right away of course.)

When I clicked on the link, a javascript redirect brought me to a new page hosted on an IP address belonging to Atjeu LLC Website Hosting. With javascript turned off, the source of the page on the Molenhoek website contained the following redirect code:

As you can see, the javascript redirects me to the domain tmfpuion.ce.ms, which has a Romanian IP address. If I access the redirect cgi url directly, I am returned a 404 error coming from UK-owned wolandtraffic.com/default.cgi. The script is checking the referrer header and only forwards the user onto the malware download page if they are coming from Google.

Based on the fact that the Molenhoek website does appear to be a legitimate website, my guess is that the attackers exploited a vulnerability on their website in order to inject the malicious redirect.

The source code of the actual fake antivirus page was a combination of base64 encoded images, javascript and CSS:

Although the increase in Mac-targeted malware isn’t new and some of you may have already encountered this attack in the wild, there have been a few versions of this one going around, called MacDefender, MacSecurity and MacProtector.

Update: Sophos has also posted an update about this issue, specifically with respect to how attackers are using blackhat SEO to poison search engine results on Mother’s Day themed searches.)

Seems most of the bad sub-domains are coming from ce.ms, and some users are reporting particularly high occurrences in Google image search results, according to Brian Krebs.

The social engineering aspect of this kind of attack is the critical piece to understand, as the bad guys are banking on your fear of viruses and malware to trick you into downloading viruses and malware. So as always, never download anything from an untrusted source, regardless of how convincing the page seems to be. If you’re interested in legitimate virus software, stick with well-known names such as Sophos or Kaspersky, but also bear in mind that antivirus is no substitute for common sense, and just because you’re running antivirus software (or you’re on a Mac) doesn’t mean you’re safe.

Also check out:

On Facebook, “like” the Social Media Scam Alerts page to get updates as new Facebook scams and rogue applications are identified. The posts will be short, without a lot of technical jargon to make them easy to share with your less brainy friends and family.

On Twitter, follow @scamdb for tweets about the latest scams, phishing and rogue apps affecting Twitter users.

Social Media Security Tips

In addition to staying informed about bad applications, some better practices and common sense will go a long way here.

We have become completely desensitized to clicking on things in websites, our social networks, on our smartphones and in email – and this is why these types of attacks are so wildly successful, often garnering tends of thousands of “likes” before they are detected and banned by Facebook or Twitter. More often than not on social media websites, the attack is not a technical attack, it’s a social engineering attack, tricking you into clicking on something because what they are offering is something you want and you found the link through a reasonably trusted source (your friends twitter stream or Facebook news feed.)

Be skeptical. If something looks too good to be true, it probably is, even if you trust the person it came from.

Confirm before you click. If you’re not sure, take a moment to email or (gasp!) call your friend and confirm they actually intentionally posted that message. If they didn’t, you’ll be doing them (and all of *their* friends) a favor by bringing it to their attention quickly.

If your friend posted to their Facebook wall that they are stuck in London and need money for passport/plan home/etc – resist the urge to immediately send cash. Be rational, contact them using a different method (email, phone) and confirm that it’s really them. Use common sense. Did your friend even mention they were going to London?

That “stuck in London” scam has made its rounds for several years through email and social networks. I don’t know why it seems to always be London, but that’s almost always the city I’ve seen in these scams.

Use the SSL version of social networking websites when you’re surfing on public or unsecured wifi. As Ashton Kutcher learned this week at TED, non-encrypted sessions + a little Firefox addon called Firesheep = getting pwned in front of your six-and-a-half-million Twitter followers.

Facebook offers a clunky (and currently unreliable) way to switch to HTTPS for your Facebook sessions, but that method resets back to HTTP if you access a non-SSL application. My understanding is that Facebook security is aware of the bug that resets the default preference back to non-SSL, but I don’t think it’s been fixed yet.

An alternative is using something like the Electronic Frontier Foundation’s HTTPS Everywhere addon. The first release of this addon was a little buggy, but the second release seems more stable. (The first version rendered Amazon.Com effectively useless.) You can select which sites you want to use HTTPS Everywhere on, and it will always force the HTTPS (versus the plain HTTP) connection.

Ideally, you should try to avoid public or unsecured wifi connections whenever possible. Make sure your computer and smartphone preferences are to NOT automatically join wifi networks. If you have to be on public wifi, your best bet will be to tunnel your traffic over VPN, but not everyone is going to have that as an option.

In the big, scary internet, there are countless ways your personal information and login credential are at risk. Some of these are technical vulnerabilities in the websites you trust your information to, but the social engineering approach is gaining tremendous momentum. It’s cheap, it’s fast, and it works. Remember that even if you think you have nothing of value, when you are careless with your security, you are also putting your friends and family at risk.

Take a moment to check out the security presentation I posted a few weeks back that covers important information on privacy and password security, and consider joining the new Facebook and Twitter resources.

Also check out:

If you’ve been reading my blog for more than three minutes, you’ve probably come across a post where I strongly recommend (okay, balls-out lecture, harp, nag and preach) that you should back your shit up. For web developers or site owners, that means your web servers, for “normal” people that means, at the very least, your computer.

Apple gives you a reasonably good way of automating your backups, by way of Time Machine. This is made even more effortless if you use Time Capsule, a dedicated network drive that integrates with Time Machine. Thing is, I have never wanted to pony up the cash for a Time Capsule, which starts at $299. Add to that the fact that I spend half my time working from home, half my time at the office, half my time commuting. (I’m very busy, you know.) So a networked drive is a nice enough solution, but backing things up in multiple locations can be a pain in the ass, especially when I’m not always near either of my primary locations. Relying on just one hard drive is scary, since eventually, all hard drives fail, and with my luck, mine will fail at the exact same moment that my Macbook Pro catches on fire, falls out a window into the ocean and is eaten by giant space pandas that can breathe underwater. (What? It happens!)

I had been using Jungledisk, but it’s slow as hell and they charge you a monthly fee for the privilege of using it (plus the AS3 charges). Granted, the $2 a month won’t put me in the poorhouse, but the speed issue has always been frustrating, and it’s always acted a little buggy for me. One of the features Jungledisk boasts is that you can sync multiple computers “effortlessly”. I don’t know if I’d agree with the effortless part, but nowadays, I use my laptop as my primary computer for both work and personal, so syncing is of little importance to me.

Enter Arq. I ran across this little gem in my RSS feed reader, thanks to a post on AppStorm.

According to app author Stefan, “the overhead of S3 PUT requests becomes a big performance problem when uploading many small files, so Arq combines small files together into ‘pack files’ to dramatically improve network performance”, which is why it kicks Jungledisk’s ass when it comes to speediness. (I added that last bit.)

I already have an AS3 account, since I helped out during the Iran elections and set up a proxy server using AS3 to enable the citizens of Iran to continue to communicate with the outside world after the government started shutting off their access to web services. I kept the account to use the fabulous Automatic WordPress Backup plugin, which backs up my (numerous and largely inane) blogs every night.

Simply put, this app couldn’t be more simple. It took me as long to install it and set it up as it did for me to download (it’s less than 4MB).

It comes pre-set to exclude trash, logs and caches, but you can add additional rules for exclusion as well.

By default, it will back up your ~user directory (excluding the aforementioned trash, logs and caches), but you can easily add additional directories as well. Drag and drop a folder into Arq to add it for automatic backup (including network drives). Drag and drop from a backup to immediately start restoring. It really is that easy.

Following the initial backup, Arq automatically makes incremental backups every hour, every day, uploading just the files that have changed since your last backup. Arq keeps hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for everything older than a month.

If you’re worried about getting hit with a huge AS3 account bill, don’t sweat that either. Arq lets you set a maximum budget for backups based on AS3 pricing. Arq also de-dupes your files, so you’re never storing the same files twice. It automatically drops the oldest backups to keep within the budget and keeps backup history for as long as you want.

Arq costs $29, and comes with a free 30-day fully functioning trial. Check it out for yourself by downloading it at the Haystack Software website, or hit them up with questions on their Twitter account.

Sure, one could argue that the AS3 monthly fees would add up to a $299 Time Capsule soon enough – but the ability to access and backup from anywhere is a big plus for me, not to mention the encryption, redundancy, privacy and speed of AS3. Amazon does charge an additional fee for upload/download, but they just extended their free upload pricing until November 1, 2010, so go ahead and give it a try.

Also check out:

UPDATE: Sadly, in April 2010, Facebook shut down FB Lite so this article is now moot. It was a good run while it lasted.

Your Facebook friends are total tools with entirely too much free time on their hands. So are mine. If you want to continue to use Facebook but bypass all of the crap that fills your Facebook homepage newsfeed, you’re in luck.

Facebook Lite?

A few months ago, Facebook introduced Facebook Lite – a pared down version of Facebook for people who were frustrated with the ever-sluggish load time of the normal Facebook homepage. This lite version loads fewer javascript libraries and is blazing fast compared to to dismal experience that regular Facebook.

The speed increase is great – but there is an awesome added bonus that isn’t widely publicized:

Using Facebook Lite, you will never see another application notification again.

That’s right. Facebook Lite does not display application notifications. At all. Which is awesome-covered awesome with awesome filling.

To see it in action, just point your browser to http://lite.facebook.com.

But wait – there’s more.

Kiss Those Application Notifications Goodbye For Good

Even more awesome, there is a way to set Facebook Lite as your default view, so that every time you go to your Facebook homepage newsfeed, it loads the Lite version instead of the Clusterfuck version. Here’s how to do it:

1. Go to http://lite.facebook.com/settings/defaultsite/.
2. Select Facebook Lite from the radio boxes.
3. Click “Save”.
4. Rejoice.

Set Facebook Lite as your default in your settings

That’s all there is to it. Honest. You’re free. You’re welcome.

Granted, this trick won’t stop your friends from posting a thousand pictures of their cat (yeah, guilty) or drunkenly updating their status in horrifyingly graphic detail that makes you want to claw your eyes out – but I don’t think there’s an app for that yet.

Also check out:

Because I am not aging gracefully, and because what I would consider my life’s work lives almost entirely online in the ether, I think about this a lot. Probably more than is healthy, but that’s what booze is for.

This question is more complex than it seems, and becomes increasingly complicated if you have your own independent websites, as I’ll discuss later in this post.

Social Networking Sites

In the case of social networking sites, in most cases, your account will simply linger online with no new posts unless you have given a friend or family member your login information through which they could post a death notice and/or delete your account. In the case of MySpace, there are websites such as MyDeathSpace that allows you to memorialize a recently deceased friend or family member’s MySpace account.

The exception to this (so far) is Facebook. When you join the choir invisible, friends or family can fill out a form to report a profile as deceased, which requires knowledge of the person’s date of birth, email address used for the account, network, and full name. Once a profile has been set to ‘deceased’, friends may continue to post memorial notes on your wall, but you will not (or should not, anyway – I have found this to be buggy) show up in Facebook application invites, etc.

If you have a paid account of any kind, for example with Flickr or LiveJournal, your account will obviously revert to unpaid when the yearly renewal fee is not paid. Even so, unless you have provided instructions and your login information to someone still alive, the accounts will remain available and untouched unless a family member petitions to have them deleted.

Emails from Beyond the Grave

If you’re the kind of control freak that wants to have a say in who gets notified about your death and what that message says (no shame in it – I *am* that freak), services such as GreatGoodbye.Com or MyLastEmail will let you prepare a message (including photos and video) and recipients in advance. A code is generated that you give to a trusted friend or family member, and when you finally lay down for your eternal dirtnap, that person activates the code and the emails get sent.

I’m a little torn on this. While I want to make sure that I get a chance (even if posthumously) to tell the people I love how much I loved them, not all of my loved ones have email, and frankly, it still comes off a little creepy to me.

Of course, if you’re a passive-aggressive dick, you could use a service like this to get the final digs in on someone you weren’t very fond of. You will absolutely have the last word, although honestly, if that kind of thing is worth the cash to you, the world is probably better off without you.

Dead Man’s Switch

A digital dead man’s switch works exactly like the dead man’s switches in movies, only instead of blowing yourself and the hostages up if your finger comes off the button, your carefully crafted post-death plan is triggered.

As Tony Geis explains in an interesting article from NPR entitled Dead Man’s Switch: CC Me From The Other Side:

“I concocted the idea one day when I was almost hit by a car. A program running on a couple of my servers supervises my online presence in various ways. It notices if I post on Facebook, Twitter, my blog, etc., log into any of my servers, send an e-mail, etc. Things like that. If it becomes apparent that I haven’t been around in quite some time, it ‘unlocks’ and a trusted individual can activate it. When it is activated, various trusted individuals will be sent e-mails explaining the situation and be granted access to my accounts.”

Geis rigged his own system as an alternative to using a service like GreatGoodbye, but not everyone will have that level of technical skill, so perhaps a service like GreatGoodbye (or others) would be a good idea if only to email your selected, trusted contacts your login information and instructions in the event of your passing.

According to Forbes magazine, if you’re serious about keeping your online presence going you should appoint an executor, somebody who’ll handle your affairs when you’re gone. Leave him or her your logins and other key information, and if there’s stuff you’d rather the family didn’t see you can arrange for the executor to delete specific content from your computer or online accounts.

Speaking of deleting your social media profiles, website SuicideMachine helps you do just that. It was recently featured on Lifehacker.Com, so if it’s not responding quickly – or at all – that’s why. Just give it a little time and check back when the crushing force of the Lifehacker effect has subsided.

Incidentally, although we’re discussing the topic of actual IRL death it should be noted that SuicideMachine’s name refers to killing off on your social networking profiles. It’s not advocating suicide (that I know of) and isn’t positioned to be a tool to delete your profiles after you’ve passed on, but the combination of SuicideMachine and the Dead Man’s Switch might work in a will to make it easier for your family to delete your online presence if that is your final wish. It works with most of the popular social networks, and can really cut down the time it takes to nuke them all. Sadly, Facebook is being douchey and blocking their IP, so the Facebook integration aspect isn’t functioning right now.

Challenges

As I mentioned, I’ve thought about this a lot. While some of the solutions mentioned above are better than nothing, I think they overlook some less-obvious issues – or at least issues that come up when your online presence is a little more complicated.

Multiple-Personalities

In my case, I have a robust online “persona” on Twitter and other social networks (even this blog) that are very true to my personality. I’m snarky, occasionally funny and mean, and I see my interaction online as a bit of a performance art. I also, however, run a very serious non-profit organization that I founded 8 years ago. Clearly, the messaging I might wish to send to my Twitter friends would likely be different than the messaging I would send to my colleagues through my non-profit work. (Probably slightly less swearing. Probably.) In short, I maintain a professional appearance for the benefit of my organization, as one would expect of the President of any serious company. Trying to sort out the nuances of which group gets what messaging would be complicated and challenging, and the very last thing I would want would be to screw that up and send a message intended for my personal friends to my organization’s list. I can see it now: “See you in hell, bitches! I’ve brought the beer, you bring the hookers and blow!”

Real-Life Friends? Online Friends?

Another interesting challenge is that with social networks evolving to the point where they are used to connect with people you didn’t know before, the lines between “real life friends” and “online friends” becomes more and more blurred. Twitter is a great example of this. The followers on Twitter that I interact with frequently have become as much a part of my life (if not more so) as the “real life” friends I have known for decades but to whom I rarely manage to talk. I don’t even have most of their email addresses, and who knows if we’ll still be in touch by the time I actually kick the bucket. I certainly hope we will, but lives change, priorities change – the same things that make people spend less time with each other in real life get in the way of people spending time with their online friends.

Honestly, I wonder if the terms “online friends” and “real life friends” are even valid anymore. They’re friends. However, because we know each other through a venue that doesn’t provide email addresses, a simple email solution just won’t work if I want to include those friends in my final messages.

But because I know people from all of these different online communities and networks, many of whom are not in my address book, the solution here isn’t necessarily a technical one. Sure, I could create a Facebook/Twitter/MySpace application that allows a trusted family member to trigger your last wishes messaging to your friends in those communities, but what about the Godsmack forums, of which I have been a moderator for 8 years. Or the stone carving listserv I’m on, or the forums for my martial arts school? You get the picture. I would certainly want to include an announcement to them, but those systems don’t have an API that can be tapped into.

Parts of this process would still have to be very manual, which means putting that responsibility on someone I care about, just hours or days after I’ve died.

Passwords and Friends Change

The biggest challenge I see in the automated services solutions is that I change my password often, and use distinct passwords for just about every website I join. I also add new contacts to my address book, friends groups (and friends lists) weekly. Using the automated email workflow concept, I would have to manually update these contact lists every week for the rest of my life. Even as morbid as I am, I don’t want to be reminded of my own mortality that precisely every week for the rest of my life. Even setting website logins aside, the FTP account information for the dozens of websites I run or manage are frequently changed. Which brings me to the most difficult challenge for me, personally.

Non-Technical Friends and Family

As I mentioned, I’m a prolific (one might say habitual) website developer and writer. I can think of at least 10 websites I run that have content that requires constant curating, and probably 15 more that are static that I don’t want to disappear after I’m gone.

FTP login information could be granted to a trusted person by firing off an email with the login to my computer, and then instructions on how to login to my KeePass application that contains the usernames and passwords to my FTP and MySQL sites. But then what? I do not have any close friends or family that even know what FTP is, let alone how to handle creating a new post/page/whatever on each of the proprietary apps I’ve built. It certainly could be done, but that’s a metric assload of work to generate that much documentation, especially when you consider that I may well end up completely changing the software that powers these sites several times before I die. I don’t know about you, but I just don’t have that kind of time.

Moar Monies!

Naturally, hosting costs money. In order for my vast, craptacular works to live on beyond me, someone would have to be paying for it. I currently have it stated in my will that I wish for x amount of money to be allocated towards hosting fees to keep them alive for a specified amount of time.

Relevance and After Life Lifetime

This is less of a challenge than just something to consider while you’re making these types of plans. As much blood, sweat and tears as I’ve devoted to Snipe.Net over the past decade, will it really be relevant enough to keep alive 10 years from now? My tech tips, programing snippets and observations on social media will most likely not be relevant anymore. Keeping that in mind, if I died tomorrow, how long would be appropriate to keep this site alive? A few years maybe? Technology changes so quickly, it’s likely that anything I’ve written here will become obsolete within 6 months, let alone 10 years.

Privacy

In the example I gave above, I would be giving my laptop password to a trusted friend or family member (either informally, or formally by way of an executor), with instructions to access my KeePass file to unlock my other accounts. This also inherently means that the person I entrust with this information has access to all of my files, all of my past emails, all of my social networking private messages, and all of my pr0n. Uhm.. did I say pr0n? I meant banking information. Right.

So short of encrypting large sections of your drive, handing someone the keys to your hard drive is effectively handing them the keys to your entire life, including the bits you may not want to be made available to people you love. Speaking as someone whose step-father once asked her to help him cancel his porn account and remove the malware he got from a porn site, I can tell you there are parts of your private life that really, really, really should follow you to your grave.

Hmmm

As upcoming generations rely more and more on online services and communities and become closer to friends they only know from online who may have no connection to their “real life” friends, I think we’ll see more of this kind of thinking.

Perhaps more importantly, the generation of people whose entire life’s work is purely digital is starting to get older (like me), we will need a more organized, integrated way to handle our online legacies. The most significant, important things I have accomplished in my life so far will disappear if I don’t have a system in place – and right now, that system is kludgey at best, impossible to execute by the technically challenged people I love most at worst.

I do not have children (thank God), and do not want children. My digital creations, self-indulgent and rambling though they may be, are my legacy. They are the only thing I have that has a chance of living on beyond me.

As I’m writing this, I realize that there is currently no solution that does exactly what I need and want. Anyone with some VC capital want to start a company? I’ve already got a plan. Drop me an email if you’ve got some cash to blow.

Your Responsibility?

Is it weird to think about this? I don’t think so. I personally feel that just as it is responsible to have a will, it is responsible to leave your last wishes and instructions for your social networking profiles. Having had a few friends pass away in this digital age, I wish they had considered their social networking profiles in their last wishes. To your friends and family, it can be heartbreaking (and more than a little creepy) to see haunted by your profile on their friends list after you’ve passed. I lost a friend to suicide this time last year, and it took 4 months for Facebook to finally get the memorial status of his profile set up correctly. It was a painful daily reminder to say the very least. Not to mention that neglecting to make formal plans for your eventual death puts the burden of deciding what to do with your social networking accounts on the very people who are already grieving.

Happy New Year to you all. Stay safe, and consider adding a posthumous persona management plan to your resolutions list. What are your thoughts on this? Is it going too far? Not far enough? Do you already have a plan in place, or a pre-recorded “screw you, world!” video set to be published when you kick it? I’d love to hear about it in the comments.

Also check out:

Notice that the beta message specifically asks that you don’t tweet about it, since invites are selective right now. Oops.

Unfortunately, I was so excited about seeing list functionality, I took a screenshot and twitpic’d it and tweeted about it before I even read the whole message. So that’s my bad. Ironically, as far as I know, Twitter has still not fixed the bug where deleted tweets still show up in search, so due to their own issues, I couldn’t even take it back after the cat was out of the bag.

So, to Twitter I say “Sorry dude. My bad.” I also find it hard to believe that they would expect people not to tweet about this, considering its probably the single-most significant change in Twitter since they broke @replies. That said, if they had notified me properly, I would have actually kept my yap shut.

If this was a test Twitter was putting me through to see if I was trustworthy enough to keep my mouth shut, I clearly failed. On the other hand, they should have made the “please don’t tweet this” text a little more prominent, or sent the beta invitees an email or DM explaining the conditions. Twitter is, by their own self-imposed definition, the epitome of the short-attention-span theater that represents people on the internet today, so part of me wonders if there was a little reverse psychology action going on, counting on the buzz that would be created by people not honoring their vow of silence.

I’m really excited about this new feature, and I’m hopeful that the software developers behind the more popular Twitter clients make haste at upgrading their apps to support this. (Ahem. I’m talking to you, Atebits. You’ve been bitching this whole time about how groups should be handled by Twitter and you wouldn’t add them to Tweetie until Twitter supported them. Well, they have. So, hop to it.)

Hopefully we’ll soon see a wave up updates to our favorite Twitter clients, including the ability to sync existing groups from apps like Tweetdeck into the new list functionality on Twitter, saving Tweetdeck users the hassle of having to re-categorize all of their followers all over again.

IMPORTANT NOTE: When you add someone to a public list on Twitter, that user – and everyone else – can see to what lists you’ve added them.

Clicking on the ‘lists’ link will show you the names of the people who have added you to one of their lists, and which lists they’ve added you to. So, keep that in mind as you’re classifying and categorizing the people you follow. You’re obviously welcome to add people to lists like “douchebags”, “asshats”, and “morons I work with”, but don’t come crying to me when they call you on it. You were warned.

(My personal favorite is the “favoritards” group someone added me to.)

I have NO idea what their criteria was for picking people to include. Could be prolific tweeters, could be completely at random.

If you’re not one of the lucky ones to be on their beta list, don’t worry – you’re not alone. Most of the people who follow me don’t have this functionality yet. And if it makes you feel any better, I’m always the last one to get any new Facebook beta features. (I think it’s probably because I talk so much shit about Facebook.)

Also check out:

We’ll be comparing features between Tweetdeck, Tweetie, Nambu, Twhirl, Seesmic Desktop, Eventbox and Destroy Twitter. There are a pile more out there, but if they were not included here, it is because they do what I consider to be the bare minimum for my needs and are not in the same league as the Twitter clients discussed here. (They are perfectly fine for the casual user, but not apps I could even consider using because of feature limitations.)

I have very specific needs in a Twitter client. So far, none of the clients I have found meet every one, but many of them are getting close. The two features that I need most are multiple account support (for @tworgs, @crankyhaiku, @geeksenryu, @evrydayactivist and others) and the ability to group friends in custom groups. I follow almost 3,000 people, so being able to file new followers in specific groups (and edit those groups later) is critical.

Many of these clients are feature-rich, but whether or not the features they offer are the ones you need is obviously going to depend on how you use Twitter. What’s critical to me may not matter to you.

Also bear in mind that many of these apps are built on Adobe AIR, which generally implies cross-platform support, however AIR support on Linux can be buggy and is still in BETA. (I am personally not a big fan of Adobe AIR apps, and would prefer a native OS application instead, which is why that’s listed as a compared feature.)

Tweetdeck – Mac/PC/Linux

Version: 0.26.2
Price: Free
Download: http://www.tweetdeck.com
Rating: ★★★★ (4 stars)

Tweetdeck is arguably one of the most popular desktop Twitter clients to date. It’s written in Adobe AIR, so it’s cross-platform and runs on Mac, PC and Linux. Again, not a fan of AIR, really, but of all the AIR apps, Tweetdeck is one of the more bearable.

One of my biggest peeves with Tweetdeck, besides it not handling multiple accounts, is the fact that you have very limited screen real estate. You can theoretically add an unlimited number of groups, but only a handful will be available to you without scrolling sideways, and for me, that’s a problem. Out of sight, out of mind, as they say. So I end up using only very limited groups so that they’re all on-screen at the same time.

Tweetdeck does support trends as well, which is a nice feature, but I go back to that horizontal scrollbar of doom, where I don’t remember its available because I have to scroll sideways to see it. Same goes for their Facebook status support. It’s a very cool feature that you can see friends’ Facebook status updates right from your Twitter client, but they end up hidden so I forget to even look at them.

One Twitter follower mentioned in the comments that Tweetdeck does support Twitter name autocompletion as of version 0.25, which is nice. I had inaccurately shown it as unavailable in the matrix below.

UPDATE: As of version 0.26.2, Tweetdeck does support multiple accounts. The interface is just as bad as before though.

What I love most: Very stable – can handle high volume easily. Supports groups. Auto-url shortening. Facebook status update integration.
What I hate most: Limited group usability, since you run out of screen space, as there is no list view option for groups. No multiple accounts. No way to customize colors or the way read/unread tweets display.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Tweetie – Mac only

Version: 1.1.1
Price: $19.95 or Free (with ads)
Download: http://www.atebits.com/tweetie-mac
Rating: ★★★★☆ (4.5 stars)

Tweetie is a Mac-only Twitter app with a dead-sexeh interface. It supports multiple accounts, and the whole UI has that native OSX Apple hotness, making it very slick to use. The UI is a little tricky to work with at the very beginning, being minimalist in that sexy Apple way, but once you get a feel for it, it becomes very easy to use. The threaded DM displays also kick a lot of ass.

Alas, no group support, which is a deal-breaker for me. Still, if they ever integrate groups, I could easily see Tweetie being my preferred Twitter client. Also seems a little weird that you can’t specify API usage or update intervals, but it doesn’t seem to be a problem normally.

Seems weird to me that if I force a refresh of my timeline, replies to me are not automatically updated in my replies timeline. I have to do another refresh of the @replies timeline to see the new tweet directed at me. I don’t actually know if that’s making an API call for both refreshes, but either way, when I update my timeline, any @replies should be automagically snagged into the @replies timeline.

Side note: Their iPhone app is pretty badass as well, and I use it as my only iPhone Twitter app.

What I love most: Damn sexy interface. iChat style conversation display. Profile views show whether or not user is following you back.
What I hate most: No group support. No dock badge or account unread badges. A little pricey for a Twitter app. Separate window for composing new tweets and URL preview popup experience are annoying. Character count when composing a tweet is easy to miss.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Nambu – Mac only

Version: 1.1.12
Price: Free
Download: http://nambu.com
Rating: ★★★★ (4 stars)

Nambu is a very clean Twitter client that is very easy to use right out of the box, and supports multiple accounts quite well. Because Nambu offers the ability to view groups in either list or dialog view, it’s easy to have many groups without running out of screen space. Users are easily added to groups right from your stream by clicking on a little “tools” icon. Built-in translation tools make this a nice option for people who tweet with people in languages other than their native tongues.

Here’s the problem: Nambu locks up a lot for me. I mean, a lot. A lot a lot. To the point where it’s basically unusable. People who follow (and are followed by) fewer people report no problems, so I suspect this is a capacity issue – but when it locks up, it sometimes manages to cause Firefox to stop responding too.

Threaded conversations work fairly well, and I like that they’re inline so you don’t have to click to see the convo, but Nambu seems to lose the conversation frequently, meaning it doesn’t always manage to tie related tweets together.

What I love most: List view makes large numbers of groups possible. Integration with Friendfeed. Inline threaded conversations. Dock badge unread count.
What I hate most: Doesn’t seem to handle high volume well at all. I end up force-quitting it every 10 minutes. Also no way to customize what growl notifications you get – you can turn them on for Replies and DMs, or turn them off for Replies and DMs, but cannot turn them off for Replies and on for DMs.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Thwirl – Mac/PC

Version: 0.9.2
Price: Free
Download: http://www.Twhirl.org
Rating: ★★☆ (2.5 stars)

Thwirl is a lightweight little Twitter app that does what I would consider the bare minimum for a Twitter client. I personally do not like the look+feel at all – it feels totally alien to the native Apple OSX environment, and is, I have to admit, just sort of ugly.

Thwirl does support multiple Twitter accounts, but it spawns a new interface for each account (which all stack on top of each other, hiding the one below it when you first launch Thwirl) which is utterly maddening to me, but might be what some people are looking for. No group support is available. It doesn’t integrate with Growl (which is meaningless to PC users, but annoying to most Mac users), and you cannot customize the types of popups. So every 20 seconds, I get a popup telling me I have x new tweets.

Favorites behavior seems weird, showing lots of tweets in my timeline as favorites, even if they are not favorites of mine.

What I love most: Not a lot. Missing too many features for my liking. Notifications when you get a hit on saved search items is nice.
What I hate most: Too limited, with clunky interface. No groups. Spawning multiple windows for multiple accounts.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Seesmic Desktop – Mac/PC/Linux

Version: 0.2.1
Price: Free
Download: http://desktop.seesmic.com
Rating: ★★★★ (4 stars)

Seesmic Desktop is a solid little Twitter client written in Adobe AIR (so it is available for Mac and PC, possibly Linux). It seems to handle high-volume well, and has customizable notifications specific to search results, @replies and DMs, including both window pop-up and sound. Pop-up notifications are Seesmic-specific, and Growl integration isn’t an option.

Seesmic supports multiple accounts and groups, which is a big bonus – but the interface feels a little confusing to me when switching between accounts. For example, groups are Seesmic-wide instead of account-specific. That might be considered a feature to some, but it’s not something I really want. The groups appear in the sidebar as a list, but when you click on them, they overlay the group window over your normal timeline window, which isn’t awesome. Using this day to day, the strange behavior of the columns makes me a little nuts. But then again, I’m pickier and more rigid than most. On the plus side, removing users from a group is very easy.

Seesmic does support Facebook accounts, but it treats them as a separate account, instead of tying them to your Twitter account so you can update both Facebook and Twitter status simultaneously. This doesn’t bother me too much, since I have a Facebook application set up to sync my Facebook status from my Twitter status, but just something to note.

One Twitter follower noticed the fact that you cannot un-favorite a tweet once you’ve fav’d it. I suspect this is more of a bug than anything, but that’s annoying.

One very nice feature is the option to report a tweet/user as SPAM, which makes it very easy to report spammy behavior to Twitter and get those accounts yanked offline. It’s just a quick and clever shortcut to send a DM to @spam, and you’d think more apps would have thought of it.

Seesmic is a solid option for Mac or Windows users who are looking for group and multi-account support – it may just take a little time to get used to the interface. Based on their feedback site (and my own experiences with them on Twitter), they take user’s feedback very seriously, and have lots of good stuff planned.

What I love most: Multiple account and group support. Adorable dock icon. Higher level of customization than many apps. Report SPAM option r0x0rs.
What I hate most: List view and separation between accounts feels ambiguous and clunky.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Eventbox – Mac

Version: 1.0
Price: $15 in beta
Download: http://thecosmicmachine.com
Rating: ★★★☆ (3.5 stars)

To call Eventbox merely a Twitter client would do it an injustice – Eventbox includes an interface to consolidate many of your favorite social networks, including Facebook, Flickr, Google Reader, RSS feeds, Digg and Reddit.

Eventbox supports multiple social network accounts (but only ONE account per network – major drag) and custom groups, although their group behavior is still a little wonky. Once you create a group, you cannot (yet) just drag and drop a user into the group, and cannot edit groups once you’ve created them. Their temporary solution is Smart Groups, which is a little better, but you still need to manually type a user’s name to add them to a Smart Group, which really harshes my mellow.

Eventbox has a handy shortcut to the special characters people often like to use in Tweets, such as stars, hearts, etc. It’s nothing fancy, but nice that they added it. I’d like to see this feature in more Twitter clients.

Notifications are driven through Growl, which is nice, but there is no way to differentiate between what is considered an “event” in Eventbox, so you’ll get Growl notifications for just about everything, which can be aggravating if you follow a lot of people.

Stability-wise, Eventbox seems to be able to handle multi-thousands of users without much trouble at all. The interface reminds me a bit of Nambu, only without all the crashing, and not free.

Honestly, I feel like when Eventbox is “done”, it will be amazing, and worth the $15. Right now, I’m not sure it is. They make a few simple tasks just annoying enough to make me choose another client instead.

What I love most: Multiple social network accounts.
What I hate most: Managing groups is slow and manual.

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

Destroy Twitter – Mac/PC/Linux

Version: 1.6.2 beta
Price: Free
Download: https://destroytwitter.com
Rating: ★★★☆ (3.5 stars)

Destroy Twitter is an Adobe AIR application that supports Groups, but not multiple accounts. It “feels” very much like an AIR application, which may be a selling-point for people who like that. I personally tend to prefer apps that feel like part of my native OS.

Although the interface clearly supports Groups, and it’s very easy to add both keywords and users to the Groups you create, I had a helluva time trying to actually view the groups once I had created them.

Destroy Twitter has quite a rich set of user-configurable options, including a nice setting to customize what shows up in your “home” canvas, but the UI just feels strange to me. It feels strange to use text instead of icons to indicate available user actions, and it seems stranger that the “compose new tweet” button is at the bottom-left. It took me a bit to find it, but I imagine if I used it more often I’d remember where it was.

What I love most: Supports groups. I think. Sort of. Nice set of configurable options.
What I hate most: Not crazy about the UI. Groups didn’t seem to work properly for me. Not clear way to refresh a canvas without going to the application toolbar

High-capacity:		Editable Groups:
@reply nick completion:		Multiple Accounts:
URL Shortening:		Built-in Search:
Threaded conversations:		Image upload:
Twitpic Integration:		Profile Views:
Separate DM/Replies Pane:		Twitter Trends:
Auto-expand URLS:		Read/Unread Colorization:
Native OS support:		Follow/Unfollow:
Tweet Favoriting:		Tweet Deletion:
Follower Blocking:		Facebook Status:
Linked Hashtags:		Saved Searches:
Pop-up/Growl Notifications:		Customizable Notifications:
Spellcheck:		Customizable Colors/Fonts:

^ Back to Top

The Verdict?

As I mentioned, it really depends on what you’re looking for, but the short version is:

Groups but NOT Multiple Accounts: Tweetdeck or Seesmic Desktop.

Groups AND Multiple Accounts: If you can can handle a slight learning curve, Seesmic Desktop is an excellent option.

Neither Groups NOR Multiple Accounts: Look into simple clients like Spaz for Mac/PC, or Blu or Digitweet specifically for Windows.

Mac AND Multiple Accounts but NOT Groups: Tweetie is worth the money.

But wait, there’s more…

Be sure to check out this great list of open-source Twitter clients, too. The article doesn’t go into as much depth on specific features, but there are some lesser-known apps here that might fit your needs. All of the clients there are free and open source.

Also, if you’re fond of the web interface and use Firefox, but just want a few added features, be sure to check out Troynt’s Twitter Script Greasemonkey script that adds all sorts of great stuff like groups, RT option, auto-complete and more, right in your web browser.

Info for Twitter App Developers

In writing this article, I asked my followers what they wanted to see in a Twitter app. Many of the answers included features that some Twitter clients currently offer, but some new ideas came out too. So if you’re building or planning to build a Twitter app, here are some additional things people are looking for:

• Reply-ALL feature – When more than one @ is in a tweet to which you’re replying
• Sync/Cloud data storage, so Tweets show as read/unread across multiple computers/mobile devices
• Ability to see all @replies/DMs from specific individual (outside of search/filter)
• Tabbed interface over columns for multiple accounts
• Settings/Groups sync or export (XML perhaps?)
• Ability to add private notes about a follower
• Unfollow notifications
• Ability to see if follower is following you back
• Statistics
• Customizable font sizes/UI style
• Ability to archive or save tweets/DMs locally
• Shortcut to unicode/special characters (Eventbox does this already)
• Ability to tweet to all of the multiple accounts (as the account) at once

Also check out:

These phishing links ask the users to put in their Facebook Login credentials. Once the mistake of entering Facebook credentials is done, the attack changes the password and sends same phishing link to victim’s contacts. This attack doesn’t install malware and is presumed to be in stage of collecting user credentials for a larger damage in the future.

Please note – for the Mac/Linux users, the fact that it doesn’t install malware means YOU are also vulnerable. Instead of using virus installations to send out these messages, they are are relying simply on the fact that people don’t always pay attention, and have conditioned responses to login prompts. That means everyone on every operating system and every browser are at risk.

Don’t “Look at This”

I’ve received several Facebook messages from friends with either no subject to the message at all, or the subject “Look at this”. The messages contain a note telling me to visit one of a few phishing sites, and the url has been obfuscated so that it’s not clickable in the Facebook message.

The domains I’ve seen so far:

• goldbase.be
• greenbuddy.be
• silvertag.be
• picoband.be
• nudz.ru
• simplemart.be

ALL of the above domains are phishing websites, and you should not under any circumstances click on them. It seems that Facebook has already deleted the harmful messages from my actual Facebook account inbox, but a copy was already sent to me via email notification, so be mindful of what you’re clicking on.

So far, Facebook has been very good about being proactive to protect users, by deleting these phishing scam messages from user accounts, and perhaps even more importantly, notifying Markmonitor. If you’re using FireFox, IE8 or other modern browser that tries to warn you against phishing sites, you should be presented with a big fat warning if you do accidentally click on the urls – however new domain names seem to keep popping up, so you should ALWAYS remember to check the actual url bar to make sure whatever site you’re logging into is the real thing.

Fbaction.Net

Another recent phishing attempt is one that sends messages from an infected account that asks that you click on a url that looks an awful lot like a real Facebook url, but really redirects back to a website called fbaction.net, which is a phishing site. A message would look something like this:

This url redirects to fbaction.net, and prompts the user to enter their Facebook credentials. The page looks exactly like a standard Facebook login, but the url is clearly not Facebook:

Screenshot by TechCrunch

According to an excellent TechCrunch article, Facebook has already taken steps to protect users from falling victim to this scam. Facebook told them:

We are aware of this phishing domain and have already begun to take action. Specifically, we have passed the domain on to Markmonitor who pushes the domain to the browsers for blacklisting. They will also actively try to disable the site at the server/domain level for people who don’t have updated browsers. Our user operations team has blocked the domain from being shared on Facebook and is removing the content retroactively from any messages. They will also be resetting passwords of senders to remove access from an attacker. We’re also reaching out to the ISPs to get information and will attempt to build a civil and/or criminal case against the owners.

This behavior is very similar to the recent attacks tricking users to go to domains like apreps.at (more at TechCrunch), and 151.im (more at TechCrunch).

Keeping yourself safe

One might wonder what the end goal is for collecting millions of Facebook user logins – however many people use the same login credentials for many of their online accounts – even email accounts – which means a malicious website that has obtained the login for a user’s Facebook account could theoretically obtain access to any online account the user has that uses a relatively standard “I forgot my password” emailed password reminder system.

At the risk of overstating the obvious, this means that if a user uses the same login credentials for a social network and for anything else, if they become a victim in one of these phishing attempts, their email, online financial accounts and banking accounts, and so on are vulnerable to being hacked. Plus, if you use Facebook Connect to access any websites, once your Facebook account has been compromised, the malicious sites will have access to those websites under your account as well.

• Always check the url of a site prompting you for a login. Always. Every time. No matter how legit it looks.
• Always use unique passwords for every single website you have an account with. Programs like 1Password for Mac make this very easy to do, generating unique passwords for every sign-up, and storing them in the Mac OSX keychain. If you’re on a PC, consider KeePass or Roboform.
• Switch over or upgrade to a browser (like Firefox, IE8, etc) that supports warning users when they are about to enter a site known for phishing activity.
• Don’t get cocky. The people I have seen fall prey to these phishing attempts are not noobs, and not the type who blindly click on anything. These are reasonably tech savvy people who have become less careful than they should be.

Also check out:

Now that I’m a Mac user, my quest for the perfect laptop bag has been made more complicated: many bags that say they fit “most” 17-inch laptops do not fit my Macbook Pro. I learned this the hard way after falling in love with the OGIO Epic backpack. This bag is so big, you could fit a small child in there with room to spare – but the special side-loading laptop slot that comes with tons of fabulous padding is about a half-inch too short for my Macbook Pro.

OGIO Epic - A 17" MBP EPIC FAIL

I was utterly beside myself with with the possibilities of the oasis of pockets and pouches – and organizational dream come true! And sturdy? You could take this thing backpacking in the Himalayas and it would outlast you – with a lifetime warranty to boot!

But alas – no joy once I tried to fit it into the side-loading slot.To be very clear, so there is no confusion, the OGIO Epic Laptop Backpack DOES NOT fit the 17″ Macbook Pro.

I used it for a month or so anyway, unwilling to divorce myself from the temptation of a place for everything, and everything in it’s place, but instead of using the slot for the laptop, I had to put my MBP in the large main compartment, next to my gym shoes and other crap – completely defeating the purpose of paying for a laptop backpack instead of a regular school backpack.

The stupid thing about the OGIO Epic is that the bag itself is tall enough – they just didn’t make the laptop pocket tall enough. It would have been perfect, if a bit large. I commute 4.5 hours a day, by bus and then subway and then walking, then the same in reverse to get home. I had wanted a larger pack so I could bring a change of clothes with me for bellydance and/or kung-fu classes. If the laptop slot had been just a half-inch taller, I would have finally found my laptop promised land.

Realizing I didn’t want to lug around a giant pack if it wasn’t even going to be able to be used for what I wanted, I started looking around for yet another backpack. I should mention that because of all the walking I have to do in New York City to commute every day, a backpack style bag was necessary. I’ve tried messenger style bags, and although I like them more, my shoulder just can’t handle the weight.

This time, I sat down and did a lot of research (as I would normally do – I had seen the OGIO in Best Buy while in there buying a router to try and fix my stupid %@#!&^% Airport problem.)

I checked the Tom Bihn website, which has a nice variety of interesting bags that will absolutely fit the 17″ Macbook Pro, but nothing there really rocks my socks. I also checked Brenthaven, but the backpack I was interested in was not available for 17″. Bastards.

Ebags.Com is a fabulous site, by the way. They carry such a large range of products, and most have fairly detailed customer reviews, so it really gives you a good idea of what you’re getting into. Even if you don’t buy your bag from them, its a great place to research.

I checked dozens of Mac forums and read probably hundreds of reviews on eBags.Com, and finally came across a bag I liked. I was able to confirm from at least one Mac forum post that it did in fact fit the 17″ Macbook Pro, so I decided to give it a shot.

The bag I had found was the STM Large Convertible, which sounds more like a sports car than a backpack. What I immediately liked about it was the fact that it could switch back and forth from messenger-bag to backpack – which is perfect for me. I can use it as a backpack when I’m commuting, and switch it over to shoulder-bag style when I’m presenting at conferences, etc. And the backpack straps can actually tuck away from view, making it look like a traditional shoulder-bag. (This was less important to me, but a nice perk.)

My price range for laptop bags was in the range of $80-$180, but could be convinced to spend more if I found something truly exceptional. The STM laptop ended up running about $80, and I found it on eBay in brand new condition for about $15 less. So I not only found a bag that looked incredibly promising, but I actually undershot my budget. Woo.

After a week of impatiently waiting (and shooting my OGIO looks of disgust and disappointment when I thought it wasn’t looking) my STM arrived. Its easily half the size of the OGIO, depth-wise, but my Macbook Pro slid easily into the laptop sleeve inside the bag. The flap cover closed just fine. It did, indeed, fit like a glove.

I really like this bag – here’s my take:

Pros

• Small profile, easy to commute with
• Fits the 17″ Macbook Pro perfectly
• Converts from shoulder bag to backpack
• Comes with phone/ipod pouch on the shoulder strap (although I never remember to use it)
• Very sturdy construction
• Nice weight distribution – my laptop feels lighter than it is when it’s on my back

Cons

• Smaller (which is also a ‘pro’, so take that for what its worth)
• Straps are a tad thinner than I prefer – they do not rub or chafe though
• Not as many pockets or compartments as I’d like – which is to be expected considering the small profile

On a final note, I would have preferred the STM use snaps or buckle fasteners instead of Velcro. While Velcro is super-handy (I love it, honestly!), I have a dog, and my dog sheds a lot. Within 10 minutes of the bag being in my house, the Velcro was matted with white dog hair. The Velcro still works fine, but it looks kinda yucky with all the hair in it.

If the STM Large Convertible isn’t your style, or if you need something roomier, check out this post on the Macrumors forums for more suggestions for bags that will fit your 17″ MBP. I found it very helpful in my research.

I don’t know that a perfect laptop bag exists – at least not for me. Sometimes I want slim and low-profile, other times I need something with considerably more room.

Also check out:

I was lucky enough to try out the private beta of Postbox, beginning last week. I should mention that although I am a long-time Thunderbird user, Thunderbird is not perfect. It has been the best fit for me for quite some time, and leagues better than bulky old Outlook, but there has always been room for improvement. Some of these improvements can be faked using addons, but I’ve found addon support for Thunderbird is not nearly as fanatical as it is for addons for Firefox, so I’m always hesitant to come to rely on them too much.

My Setup

My situation (and therefore my needs) may not be the same as yours, so I think it’s helpful if you have some idea how I use my email, and where Thunderbird leaves me wanting. I have around 7 unique IMAP email accounts, totaling well over 400k messages combined. I have emails from the past 9 years or so in these accounts (and if I could find ones from further back, I’d pull them in, too), as I need to maintain access to old emails at all times. I use Thunderbird for all of my non-work email, and I use Mail.App for work stuff. (I like to keep them separate, so I can check personal email on weekends but avoid getting sucked into work in my off-hours.)

Unlike some people, having very old emails at my fingertips is actually a critical issue for me. It is not at all unusual for me to have to search through email to find out if someone with a specific email address has ever sent me an email before, and if they have, it’s not unusual for me to require immediate access to their entire email history. Additionally, I get all of my voicemails emailed to me as mp3, which I hang on to indefinitely for the same reasons I don’t get rid of emails. Since the caller’s phone number comes up in the “from” field, I need to be able to plug in a phone number and quickly determine whether an individual has ever called before, and have immediate access to their voicemail message.

Up until now, that meant either keeping them in my inbox (gah!) or creating special filing folders within my IMAP account and hoping I remember to right+click and move them when I’m (mostly) done with them. What I’ve ended up doing is more or less a combination of the two, filing things when I remember to, but generally letting them pile up in my inbox, where I put them off to come back to them and eventually completely forget about them. Certainly not ideal. (And, uhm, if I was supposed to reply to you and you haven’t heard back – now you know why.)

I also have one IMAP account that is shared between multiple people. This account currently has over 20k messages in the inbox, and as various people deal with messages, the messages get moved to a “completed” folder so that multiple people don’t work on an email that has already been dealt with. It’s sort of like a helpdesk system, only it’s not a helpdesk system, so please don’t give me recommendations on a better way of doing this. I’ve looked into them all, and none fit just right – this system, although it may seem awkward, works very well for my purposes. The unfortunate part is that every time I deal with an email to completion, I have to right+click, go to Move Message, and then pick the IMAP folder from the list of accounts and folders that are set up in Thunderbird. While this doesn’t sound like that big of a deal, it starts to wear on my wrists after handling a hundred or more emails in a day.

Postbox makes my life much easier in this regard. Rather than having a separate, normal IMAP folder called “completed”, I can send completed emails to a special folder called Archive, using just one click – or even a hotkey. Given the fact that marking an email as completed right now costs me 2-3 clicks, this will save me hundreds of mouse-clicks a day, and a lot of wear and tear on my wrists. (Can Postbox save me from the wrist-hurt-disease?)

I am working towards Inbox Zero. I don’t know how long this will last, or whether it will work, but the Postbox features lend themselves nicely to exactly this sort of thing, so I think it’s worth trying. If you’re not familiar with the concept of Inbox Zero and want to learn more, check out these fantastic resources on 43folders. If you’re not familiar with the concept of Inbox Zero and could give a rat’s ass, that’s perfectly fine too. Postbox makes achieving Inbox Zero easier, however the features that make it easier will not prevent you from using it normally if you have no desire to go that route. (I do encourage at least looking into it, however – the idea has a lot of merit.)

Getting my inboxes down to zero won’t happen overnight. I need to go through and tag+archive or delete 400k messages, after all – but I believe it will result in an ability to find things faster and prevent losing track of emails that needed my attention.

Importing from Thunderbird

Importing went off without a hitch, with all accounts, passwords, signatures, and RSS feeds pulled in perfectly. I have seen reports that others have had some issues, but it worked like a charm for me.

Caveat: Not Intended for Exchange Servers

Postbox is not meant to be a replacement for Outlook if you’re using an Exchange server. Postbox supports IMAP, POP, and SMTP protocols, and is set up to grok Gmail settings right out of the box, but it is not an Exchange client replacement. If you’re using Exchange in your office (and intend to continue to do so), I’m afraid you’re still stuck with Outlook (or Entourage if you’re on a Mac).

Postbox does not currently integrate with calendars, but it is a feature that is being discussed by beta testers and employees. Personally, I’d settle for CalDAV support to integrate it with Google Calendar, but they’ve done such a bangup job on the mail aspect, I would welcome an actual calendar module as well.

Cool Features

I’ve included the full feature set from the quickstart guide on the Postbox website (which is fantastic and gives a great primer on features) beneath this section, but here’s my short list of things that rock my socks:

Conversation view - messages can easily be grouped by conversation and displayed within one pane, so you can see an entire conversation from start to finish. This is a big one for me, since I get a lot of email, and have a mind like a sieve. I always request that people include the email history in replies to me, so I can remember wtf we were talking about, but many people don’t listen. With conversation view, I don’t need to rely on them to keep my train of thought.

Conversation View in Postbox

Note the inspector pane to the right of the conversation – this little pane packs a punch, displaying a quick web search box, thumbnails of all of the images used in the entire conversation, a list of attachments, a pin on any addresses mentioned in the conversation, and a list of all of the links used in the conversation. It’s a perfect quick-summary that puts the most important parts of your conversation in one compact place. Nine times out of ten, when I come back to an older email, I’m looking for an attachment, a link, or an address, not the text of a specific message – so this saves loads of time.

Native topic tagging - similar to Thunderbird, you can create custom topics (or labels) for messages, and assign multiple topics to any message.

Tabbed Messages/Inboxes - I can’t stand having 900 windows open – or, to be fair, even 3-4. Postbox allows you to open multiple messages in tabs within the application, or even open each of your account folders in separate tabs for easy access.

“Archive” button/hotkey that allows you to archive messages with one click. The messages are not altered or compacted, simply moved to an archive folder. Without tagging, this would be a disaster, as all of my carefully crafted folders would be lost. This functionality, combined with tagging, allows me to simplify my older messages without losing the ability to find all related messages.

What I’ve done is to go through all of my old IMAP folders, tag them as needed, and then archive them. They now live in one archive folder, which makes searching much easier, but between the robust search features and the tagging, I can instantly pull up all messages related to a particular topic.

Media/Attachment/Contact View - This is seriously very cool… Not only can you search your attachments and images, Postbox gives you a media viewer that allows you to visually scan attachments and images – with the option to upload directly to your Picasa account from your email. (I would suspect they’ll be adding support for additional third-party photo sites in time, but I’m speculating.)

Postbox Media View

To-Dos- Using the quick To-Do button, you can mark messages in any folder as messages that require some sort of additional action, or you can create new to-do items from scratch.

Pending flag - this is another big one for me. You can flag a message as pending, implying it needs some sort of follow-up in order to move forward. When a new reply to that conversation comes in, the flag is automatically removed.

Twitter Integration – I’m a Twitter junkie, that’s no secret, and I’ve written extensively about Twitter here on Snipe.Net, so it’s not a surprise that I really dig this well-hidden but nifty little feature. While it doesn’t work like a standalone Twitter client, what it does is make it incredibly easy for you to take text or links from your email and post them to Twitter without switching apps. Simply highlight the desired text or links in your email message, right+click, and select Post to Twitter. (more info here)

Postbox Twitter Integration

Facebook Integration - Regardless of how I feel about Facebook (and that changes daily, depending on whether or not I’m working on any Facebook applications), there’s no denying that it has become a big part of many people’s lives. To hook Postbox into Facebook, go to Tools > Login to Facebook. The first time you do this, it will pop up a window asking you if you wish to authorize Postbox to be able to access your Facebook account. Once you’ve agreed, click on your contacts tab, and you’ll see the profile photos and status of your friends on Facebook. Spiffy! (more info here)

Contacts Tab

The Full List

Automatic Indexing

When Postbox™ first accesses an existing email account, it lists all the messages in your account for you to see. For those of us with huge amounts of mail, we generally rely on search to find information in those old emails. Postbox enhances search by indexing. Indexing allows Postbox to grab all that basic information about the mail in your email account to make searching fast and accurate.

The Postbox indexer must run before email messages and content can be searched for and used. The indexer will run automatically when it detects that your computer is idle.

Manual Indexing

If you would like your message content to be searchable right away, you can manually start the indexing process by selecting Index All Messages from the Tools menu. Or, you can index the current folder by selecting Index Messages in Folder from the Tools menu.

Please note that Postbox requires messages to be downloaded before they can be indexed. Postbox will automatically download messages when your computer is idle, or when you manually index your messages.

Content Search and Handling

Postbox has made it easy for you to find things like documents, pictures, attachments, URLs and contacts by providing you direct access to these pieces of content

Content Tabs

Now that you’ve indexed your inbox, you can quickly search for content by clicking on a content type within the Tab Strip. When you click on a content type, a new tab opens, and the most relevant content will display. It’s time to start searching!

Searching for Content

You can narrow your content search by entering terms into the Search Bar, located in the toolbar. Or, you can click the Advanced Search button to the right of the Search Bar

to search by specific criteria such as subject, sender, or date.

Clicking on a contact in the message header will bring up a Contacts Panel

where you can search for messages, attachments, images, and links from that person.

Using Content

While viewing attachments, images, or links, you can use the Action Bar at the bottom of the screen to perform actions on selected content.

• Save will save the content to your hard drive
• Send will attach the selected content to a new message
• Upload will connect the selected content to an online service

Rich Message Composition

Finding Mail Content

During message composition, you can search for attachments, images, and links within your mail store by clicking on a content icon within the Compose Sidebar, located on the right-hand side. Use the search bar at the top to narrow your search, or click the advance search button to search by a specific criteria. Attach content that you’ve found by double-clicking on the content element, or through drag-and-drop.

Share Links to Popular Web Resources

You can also search for and share links to popular resources on the Web. Click on a content type, select a service from underneath the search bar, type in a search term, and then drag-and-drop a search result into your message. There’s also a References tab that provides access to an online dictionary and thesaurus.

Inspector Pane

Content Summarization

The Inspector Pane sits to the right of the message preview window, and makes it easy to find and use message content. When Postbox detects a content element, it is summarized within this pane along with a set of useful actions. Selecting two or more messages within a conversation will summarize the content for all selected messages.

Right-click a content element to bring up a contextual menu that contains a set of services to help you to connect your email content element to the Web. For example, right-click an address to perform a search within an online mapping application.

Integrated Web Search Bar

Postbox contains an integrated Web Search Bar, to make it easier to initiate a web searches while viewing message content. Select your preferred search engine, type in a term, and press the Enter/Return key. You can also drag a contact from the message header into the search bar to quickly look up a contact on the Web.

Topics

Assigning Topics

Quickly organize your messages by Topic by selecting a message and clicking the Assign Topic button in the toolbar, clicking the Topics button in the message header, or by pressing the letter “t” when viewing a message. The Topics Panel will allow you to type in a new topic, auto-complete from a set of previously used topics, or select a topic from a list of favorites. When assigning a new topic, check “Make the topic a favorite” to add the topic to your list of favorites.

When you assign a topic in Postbox, all related messages within that conversation inherit the topic as well, in addition to all future replies. Thus, you only need to assign a topic to a conversation one time.

Favorite Topics

Your Favorite Topics will appear in the Folder Pane on the left, just below your mail folders. Select a favorite to view your messages by topic within the selected folder. This allows you to focus on one thing at a time, while minimizing interruptions from new messages, because the only new messages you’ll see are those that relate to the topic in view.

If you compose a new message while viewing a favorite topic, the new message will automatically inherit the currently selected topic. When a reply to your message arrives, it will automatically inherit that topic.

Topics and Content Search

You can also combine topics with content search. Select a favorite topic in the folder pane, then click on a content type within the tab strip, such as attachments. In this view, you’ll only see content that relates to the currently selected topic. Try clicking on Contacts within the tab strip to see a prioritized list of people that you’ve been communicating with inside a topic.

Message Navigation, Viewing, and Handling

Conversation View + Gather

Postbox displays messages in the Thread Pane by Conversation. Each conversation contains a Summary Row, with individual messages displayed below. When the Summary Row is selected, Postbox displays a summary of all messages within the conversation.

For conversations with messages stored in multiple folders (such as Archive, Sent, Inbox, etc.), the Gather button will bring them altogether, independent of location.

Archive

You can move messages from the inbox to a dedicated archive folder by clicking the Archive button in the toolbar, or by typing the letter “a” when viewing a message. Combine the use of the archive folder with advanced search to keep your inbox clean, but quickly find what you need when you need it.

Tabbed Mail Browsing

By default, Postbox opens messages in a new Tab, which allows you to quickly switch between messages and folders. You can open any folder in a new tab by right-clicking the folder, then selecting Open in New Tab from the contextual menu. You can also reorder your tabs via drag-and-drop.

To-Dos

We often leave messages in our inbox because they represent things we have to do. Postbox provides a set of features to help you use your email messages to get things done.

Tagging a Message To-Do

To tag a message a To-Do, select the message and click the To-Do button in the message header. A to-do icon will appear next to the message in your Thread Pane.

Create a New To-Do

Not only can you convert existing messages to To-Dos, but you can create new ones too. Just click the New To-Do button in the toolbar, and enter a subject and note if appropriate. This places a new To-Do in the currently selected folder. Create as many new to-dos as you like.

Annotate

You can also annotate a message by pressing the Annotate button in the message header. This is particularly useful when you wish to update the status of a to-do, without having to send a message to yourself. You can change the message subject or any part of the message body. After you have annotated your message, you’ll have the choice of saving your changes, or creating a copy of the message if you wish to preserve the original.

To-Do Pinning

Click the to-do column header in the Thread Pane to toggle on/off To-Do Pinning Mode. This pins to-dos to the top of your message list, so that new messages to appear below. This helps to keep new messages from pushing important to-dos out of view.

Pending

The Pending flag within the read/unread column can be used to mark messages that are pending a response. Once a reply arrives, the pending flag is removed and the message is marked “unread.”

Quick Tip

Tip: If you prefer to have Postbox advance to the next message after you delete one, instead of the default, where it jumps back to the previous message in the folder, follow these steps (thanks to the Postbox guys, who jumped on this question and gave me a solution within moments of me posting it):

Bring up the Preferences window. Click on Advanced then Config Editor.

Type in: mail.delete_matches_sort_order

in the text box and then toggle that value to false.

Restart Postbox and you should be all set.

Bugs

This software is in BETA – which means there will be bugs. I’ve run into several since I installed it a week or so ago, but none have been bad enough to make me give up. I’ve noticed some hanging issues when trying to take actions on large groups of messages, specifically when trying to tag many messages at once. I’ve reported the bug at their bugtracking site on GetSatisfaction (as should you, if you’re trying out Postbox – that is the whole point of beta testing, after all) and they were understanding of my frustration and quick to open an official bug ticket for me.

None of the bugs have been worse than what I’ve gone through with Thunderbird during testings phases.

Conclusion

I’m seriously in-like with Postbox so far. To me, it brings the best of Thunderbird together with the best of Mail.App and Outlook, in an app that is lightweight and feature-packed, without feeling overwhelming. Each feature is subtley placed, convenient if you want to use it, easily ignored and unobtrusive if you don’t need it.

I’m very curious to see how progress moves on this project, and I congratulate the Postbox developers for a great beta product. I like it enough to actually stick with it, instead of switching back to Thunderbird, despite Postbox’s BETA status.

Want to give Postbox a try? Tough patooties – Postbox is in private beta right now, but you can sign up to be notified when you can download their beta. (I signed up just a few weeks ago, so you likely won’t have to wait long.)

Also check out: