Category
IT basics
APIs, CSV files, sign-in, the cloud and security: the IT basics that come up at work, in plain words.
Articles
43 articles
IT basicsFalse information and scams that follow disasters and big news: what to check before you share or donateRight after a major disaster, fake rescue requests, posts reusing old photos and fake donation appeals spread. Drawing on what was seen after the 2024 Noto Peninsula earthquake and on guidance from Japan's communications ministry and Consumer Affairs Agency, here is what to check before sharing and before donating.IT basicsA customer asks for "3 stars": Japan's SCS security rating, explainedOn October 28, 2026, IPA published the assessment guides and commentary for the SCS scheme, which rates supply-chain security with stars. The scheme is due to start in March 2027. How 3 and 4 stars differ, whether it is mandatory, and how to prepare.IT basicsCritical PHP flaws now exploited: what to check on your site and devicesThe two PHP vulnerabilities fixed on October 21, 2026 (PHP2shell) were added to the US list of exploited vulnerabilities. On November 2, IPA added that VPN and other appliances use PHP in their admin screens. What to check, in order.IT basicsIf your business is breached: Japan's help desks and first steps, autumn 2026After a wave of data leaks, IPA opened a special help desk for organisations hit by unauthorised access on October 16, 2026, and the government ordered stronger support on October 26. Who to contact for what, and what to do first.IT basicsExploited flaws in parts of small business websites and online shops: what to ask your vendorIn October 2026, vulnerabilities already being exploited were announced in the AmazonPay plugin for EC-CUBE and in SiteGuard Server Edition, and serious fixes were released for Movable Type. Based on announcements from JVN, JPCERT/CC and IPA, this explains what to ask the company that builds or maintains your site.IT basicsOctober 2026: packages that steal keys on install, and what to ask the people who build your appsIn October 2026, malicious versions of npm packages used in development appeared one after another, stealing credentials as soon as they were installed. One also planted commands in editor and AI coding tool settings files to stay on the machine. Based on GMO Flatt Security's analyses, this explains what happened and what to ask your developers or contractors.IT basicsA certificate authority's weak keys, and how browsers stop trusting a CAIn October 2026, researchers reported that private keys for intermediate CA certificates from the certificate authority eMudhra (emSign) were weak enough to be recovered. Based on Google's announcement, this explains the chain of trust behind the padlock, how browsers withdraw trust, and what individuals and site owners should check.IT basicsOctober 2026: fixes for Node.js, Next.js, PHP and Python, and what to check if someone builds your site or appIn October 2026, serious vulnerabilities were fixed and urgent updates released in Node.js, Next.js, React, PHP and Python, the foundations of many websites and apps. The AI tool LiteLLM also had malicious code inserted into a distributed package. Based on each project's official announcements, this explains what happened and what a company should ask the people who build or run its site or app.IT basicsWhen the site an AI suggests is fake: four checks before you buyFukuoka Prefectural Police in Japan warn that people who ask generative AI where to buy something cheaply can be led to fake shopping sites. This explains why AI answers can include fake sites, how to reach the official site yourself, and what to check before entering anything.IT basicsGot a "data leak" notice? What to watch for when your information was exposedWhat you can do as a user when a service you use tells you your personal information has leaked. Based on October 2026 alerts from Japan's National Police Agency, Financial Services Agency and Personal Information Protection Commission, this covers fake emails posing as the notice, changing reused passwords, and what to watch if you submitted ID documents.IT basicsUpdate notices and cyber attacks: what can wait and what to install nowUpdate notices for operating systems and apps can include fixes for weaknesses (vulnerabilities) that attackers use. Based on public information from IPA, JVN and CISA, this explains how to read update information, why to hurry when a notice says a flaw is being exploited, and how a company can stop updates from being put off.IT basicsWhat Is a Webhook? How It Differs From an API, and What Receivers Should WatchWith an API you go and ask; with a webhook you are told when something happens. Using form submissions and payment notices as examples, this explains the flow, what the receiving side should check (sender, signature, redelivery) and how to notice when notices stop.IT basicsBackup vs Archive: A Copy to Restore, a Store to KeepA backup is a copy for putting things back when they break; an archive keeps records you no longer use but still need. This compares how long you keep each, how you find things, and how you delete them, and shows how to label each folder by purpose.IT basicsWhat Is AdFection? Zero-Click Attacks Through Ads, and Everyday DefencesAdFection uses the display of an ad to target device vulnerabilities. What third-party researchers have reported, why trusted sites can still carry risky ads, and how updates, limiting ads and tracking, and DNS filtering work together for individuals and organisations.IT basicsWhat Is Character Encoding? UTF-8, Shift_JIS and Garbled TextA character encoding is the rule a computer uses to turn characters into numbers. We compare UTF-8 with Shift_JIS, an encoding made for Japanese, explain why text turns garbled when a file is opened with a different encoding from the one it was saved in, and list what to check when you receive one.IT basicsAuthentication vs. Authorization: "Who Are You?" and "What May You Do?"Authentication checks that the person signing in is really who they claim to be; authorization decides what that person is allowed to do. We separate the two in everyday cases such as sign-in, two-step verification, share links and app permissions, and list what to review for each.IT basicsBlurry Right After Upload? Export Problem or Still Processing?YouTube processes a new upload in low quality first, and higher-quality versions such as 4K or 1080p become available later. How to separate the source file, YouTube's processing and the playback setting, and what to check before re-exporting, based on YouTube Help.IT basicsYouTube Unlisted vs Private: What to Check Before Sending a LinkAn unlisted video can be watched by anyone who has the link, and they can pass it on. A private video is visible only to people you choose. A table comparing public, unlisted and private, what to check before sending a link, and why confidential material needs a separate decision.IT basicsVideo Not Getting Views? Where to Look in YouTube StudioWhen a video gets few views, split the question into three: was it shown, was it clicked, did people keep watching. What impressions, click-through rate, average view duration and audience retention mean, how to compare fairly, and a note for changing one thing at a time.IT basicsWhat Do Shorts Views Count? Views vs Engaged ViewsSince March 31, 2025, Shorts views count the times a Short starts playing. Whether people kept watching shows up in engaged views and watch time. A comparison table, a fictional two-Short example, and why the public view count is not the monetization metric.IT basicsFixing Your YouTube Recommendations: History and "Not Interested"When your feed is full of videos you do not want, match the tool to the goal: Not interested, Don't recommend channel, deleting watch or search history, or turning history off. The difference between deleting and pausing, and between hiding from recommendations and blocking.IT basicsNot Getting Notifications From a YouTube Channel? What to CheckSubscribed but not notified? Check, in order, your account, the channel's bell, YouTube's notification settings, device and browser permissions, and Focus or Do Not Disturb modes. Also covers YouTube's own notification limits and what creators should check.IT basicsGot a YouTube Copyright Claim? What to Check Before Deleting the VideoA "copyright" notice on YouTube can be a Content ID claim, a copyright strike or a Community Guidelines strike, and each works differently. How to check the type, the matched section and the claimant in YouTube Studio, how to edit the match out, and when a dispute is appropriate.IT basicsDo AI-Made Videos Need Disclosure? YouTube's Rules ExplainedNot every YouTube video that uses AI needs a disclosure. A table comparing the examples YouTube Help says need disclosure, such as realistic altered or synthetic content, with those that do not, plus the upload setting, where labels appear, and why copyright and monetisation are separate questions.IT basicsA Run of Unauthorised Access in Japan: What Should You Check on Your Own Website?When news of unauthorised access makes you worry about your own website: why it is not enough to see that the site loads, why admin screens and APIs behind it need checking, why an unshared URL is not access control, and four points to confirm with your staff or maintenance company.IT basicsWhat Happens to Your Saved Data When You Cancel a Subscription?Cancel a subscription and how long can you still reach your data? Deleting an app versus cancelling versus deleting an account, cancelling where you signed up, the dates that matter, testing an export, and the effect on people you share with.IT basicsRansomware Protection: Does It Stop at "We Have Backups"?Daily backups do not guarantee you can restore the data you need, in time, and get back to work. What a Japanese IPA handbook for executives says about encryption plus extortion, why data alone does not restore a business, and how to test and record a restore safely.IT basicsIs That QR Code Safe to Open? What to Check After ScanningA QR code is a doorway to a link, and its pattern tells you nothing about the destination. How to read the URL after scanning, why a company name inside an address proves little, what the padlock does and does not mean, and what to do if you entered a password or card details.IT basicsBlacked Out a PDF? What to Check Before You Send ItA black box drawn over a PDF can leave the text and images underneath in the file. The difference between hiding and redacting, why marking, applying and saving are separate steps, what hides outside the main text, and how to check before sending.IT basicsWhy Are Free Apps Free? Reading Ads, Pricing and Data UseFree apps keep going through ads, paid features, donations or support from another business. Rather than judging safety by price, check what is free, when charges start, the store's privacy information, permissions, and whether you can take your data out.IT basicsWhat Is CSV? How It Differs From Excel, and Why It Breaks So EasilyCSV is a table written as plain text. How it differs from an Excel file, why text encodings garble it, why leading zeros, dates and long numbers change on their own, and how to open and hand over CSV files safely.IT basicsWhat Is an API? How Systems Talk to Each OtherAn API is the doorway one piece of software offers so other programs can use its functions and data in an agreed way. Requests and responses, REST, JSON, webhooks, API keys and OAuth, usage limits and pricing, and how a company should look after its keys.IT basicsWhat a WAF Is, and How It Differs From a FirewallA WAF inspects the content of requests arriving at your web application, where a traditional firewall decides which doors are open at all. Here is the difference in plain terms, what a WAF does and does not cover, and what to settle before you buy one.IT basicsYour Site Is Full of Bots. Which Ones Should You Block?Automated traffic in your analytics is unsettling, but bots are not all hostile. Search crawlers, monitoring, AI crawlers, scrapers and probing traffic each need a different answer. Here is how to tell them apart and where rate limits and a WAF fit.IT basicsWhat should a small business build its website with?Static HTML, a site builder, a CMS, WordPress, Astro. The right answer depends on who updates the site, how often, and with what. Decide those first, along with the features you need and the upkeep you can manage, and the shortlist writes itself.IT basicsSecurity basics for a small company, in the order worth doing themWith little budget and no dedicated staff, the question is not what is ideal but what comes first. Updates, multi-factor authentication, backups, passwords, permissions, email and logs, ordered by what can start today and what stops the business if skipped.IT basicsStop making everyone an administrator: least privilege in a small teamThe smaller the company, the more tempting it is to give everybody full rights. That decision sets how far the damage travels when something goes wrong. Here is what least privilege means in practice, and how to split roles between admin, standard user, read-only, finance and HR.IT basicsDo You Really Need IP Address Restrictions?Restricting access by IP address works well when you know where people connect from, and badly when you do not. Here is how to tell the two apart, what dynamic IPs and remote work do to it, and where multi-factor authentication fits.IT basicsWhat HTTPS Does Not Protect You FromHTTPS encrypts the connection between browser and server. It says nothing about vulnerabilities, stolen logins, permission mistakes, injection flaws, bots or server misconfiguration. Here is where the padlock stops, plus a short note on HSTS.IT basicsDoes updating your website too often cause problems?The number of updates is rarely the issue. Caching, builds, CDNs, failed deploys, database changes, broken links and the ability to roll back are what actually break sites. Here is what to put in place.IT basicsAccessibility is not only for a small group of peopleScreen readers, voice input, larger text, high contrast and keyboard-only operation help far more people than the ones they were designed for. Here is what to fix first, and why it pays back immediately.IT basicsCloud or local? You do not have to pick a sideYou do not have to move everything to the cloud, and you do not have to pull everything back in-house. Sharing and syncing belong in the cloud; speed, offline work, privacy and heavy jobs belong on the machine in front of you.IT basicsCloud Sync Is Not a BackupFiles in cloud storage feel safe until someone deletes a folder and the deletion syncs to every machine. Sync keeps things identical; a backup keeps a point in time. Here is how to cover versions, a separate location and restore testing.