The difference between Themes and Templates in Blogger

This article explains the difference between themes and templates in Blogger, Google's blogging tool.

What is (was) a Blogger template

How a blog that is made with Blogger is shown to a visitor is controlled by four sets of information:

• The posts which the blogger writes (ie the content)
• A user-editable "configuration file" which records the overall formatting options which the file designer and then the blogger have chosen
• Another configuration file, called the post-template, which records choices that the blogger has made under Layout > Blog posts (edit), but cannot be edited elsewhere.   
• Blogger's own software, which puts the other things together with some internal rules to make "web pages".   Bloggers cannot control the rules in this at all.

Originally, the first "configuration file" was called a template.   In fact, officially it was called a design-template, to distinguish it from the post-template.   However because most people aren't aware of the post template, usually just the word "template" is used to mean design-template.

What is a theme

Other blogging tools (eg Wordpress, Tumblr) called their equivalent file a theme.    Most (or even all) of those tools provide less access to change things in the Theme file, for example if you use a Wordpress free-hosted blog, then you cannot change any of the code in your theme, you can only make formatting changes which are allowed for in the Wordpress front-end.

Many of the Wordpress themes have had a lot of  graphic design work done on them - using them gives a blog-site which looks very attractive (or otherwise suited for their purpose) on a wide range of screens.    Many large websites have been made using Wordpress, and so very many professional designers have created Wordpress themes.    Because of this, many people believe that it's easier to get an excellent-looking website from a theme than from a Blogger template.

Blogger templates have now become themes

Recently - I noticed it in March 2017 - Blogger started calling their templates "themes".  

• They've changed the menu option on their dashboard from "Template" to "Theme".
• They've changed the action button names in the template/theme editor to say things like "Save theme".
• They've written various help articles which refer to themes.

What hasn't changed

• We can still edit our templates themes extensively.
• The Blogger tools that make the changes in our themes haven't changed:  All the items under the Themes tab on the dashboard are the same as the ones on the Templates tab.
• The contents of our existing themes are still much the same  (I cannot guarantees they haven't made any changes, but I haven't seen any)
• The themes that we can choose from when making a new blog, or changing the format of an existing one, are the same.
• There are hundreds of help and how-to articles written by blogger-helpers like myself, which all refer to templates.   (I've started changing mine - but it's going to take a while!)

What else is going to change?   

This is the big question:   Is the rename a precursor to some other changes, eg restricting how much control we have over our themes? - or is it just a cosmetic change to make Blogger seem more modern?

Will there be some new themes released - ones that look better across a range of devices, maybe even some that are optimized for mobile instead of desktop use?

Will there be new theme-editing features introduced into Blogger's interface, to let us control things we cannot control now?

Conclusion / TL-DR

Only Google's Blogger product managers know exactly what the future plans for Blogger are - and they're not known for talking about the future direction  until they're just about to introduce new features.   

But until they do, my conclusion is that there is no difference between templates and themes in Blogger.  They are simply two different words for exactly the same thing.

NB:   Blogger product a announcements are usually made in the Blogger Buzz blog - and I see that template were still called templates in their most recent post in November 2016:

---

Related Articles

How to edit your Theme in Blogger

What types of theme / templates does Blogger have

Editing your blog's template:  advantages and disadvantages

How to turn on a mobile theme for your blog

Blogs, Blogger, bloggers, posts pages and screens - understanding Blogger-basics

How to make a real website, using Blogger

A New Project

Proud to have worked on National Geographic's new series, Origins : The Journey of Humankind. Premieres tonight in the US at 9 pm ET.  I worked on eight languages for it!

• Lydian
• Gaulish
• Proto-Indo-European
• Germanic-flavored Proto-Indo-European
• Nostratic
• Proto-Afro-Asiatic

• Basque-flavored Proto-Dene-Caucasian\\
• Proto Pama-Nyungan

Hopefully (if I get approval from the powers that be), I'll be able to go into some detail here about my work on the show.

Australian Dollar USD 3rd March 2017 monthly Report

Australian Dollar/USD Dollar Primary & Weekly Cycles

AUD looks steady without providing a long term target.

The medium term bias is to go higher and reach the 2017 highs @ .7785, whilst the short term bias is to dip down into the Weekly lows.

Random Support :- .7482  /  . 7513

How to Speak Wenja : Wuga's Scenes

Today we'll look at Wuga's scenes (known as Wogah in the game), a quirky, one-armed crafter who introduces Takkar to Wugas fnagu "Woga's claw" and a whole host of upgrades.

Played by the extremely talented (and extremely kind) Ron Kennell, I smile every time I hear him yell "Fmaygan".  Mi-sharm hadarsh!

Meeting Wuga

Wuga:

Mawra Udam!
Stupid Udam!
Stupid Udam!

Takkar :

Mu Winja!
I Wenja!
I'm Wenja!

Wuga:

Nay! Mu supima Winja! Ta dijam-shanti, fmayga-su tagata. Udam-war-way.
No! I last Wenja! You dirt-face, piss-in covered. Udam-just-like.
No! I'm the last Wenja! You're a dirt face, covered in piss. Just like Udam.

Smarka, Fmaygan.
Bye, Pisser/Pissee.
Bye, Piss-man.
(Fun fact : the suffix -an can mark an agent noun, equivalent to the -er suffix in English. So, shaja "lead" + -an = shajan "leader".  BUT it also marks the recipient of an action, so technically shajan can mean "leadee; the one who is lead". This is much less common in Wenja. But this is precisely what the -an in Fmaygan is doing. Wuga is really drawing attention to the fact that he peed on Takkar) 

Confronting Wuga

Wuga:

Sharm-hadan. Udam. Mawra sharm-hadan. Ay!
Arm-eaters. Udam. Stupid arm-eaters. Ah!

Arm-eaters. Udam. Stupid arm-eaters. Ah!

Na-ta Udam.
Not-you Udam.

You're not an Udam.

(*sniffs*)

Fmaygan!
Pissee!

Piss-man!

Winja! Mu Winja!
Wenja! I Wenja!

Wenja! I'm a Wenja!

Ku-na Winja marwa?
QUESTION-not Wenja dead?

Are the Wenja not dead?

Takkar :

Palhu gwayfarsh, na mayta ti-way.
Many live-they, not crazy you-like
Many live, not crazy like you.

Wuga:

Nam mayta. Winja sakwim!
Not-I crazy. Wenja help-I!
I'm not crazy. I help Wenja!

Pashta? Kala. Saywa shash-way. Hasar Urusis. 
See-you? Pretty. Hard rock-like. Blood Oros-of.
You see?  Pretty. Hard as a rock. Blood of Oros.

Bal Winja tachisla dahay su. Ma Hasar Urusis mibi chawda.
Strong Wenja weapons make-for good. But Blood Oros-of me-from hides.
Good for making strong Wenja weapons. But Blood of Oros hides from me.

Takkar :

Shash waydam. U nartar hay - u Winja-ha gwayfa.
Rocks find-I. COMMAND west go - COMMAND Wenja-with live.
I find the stones. You go west - live with Wenja.

Wuga:

Buda Fmaygan. Sashwalsu dayshan Hasar Urusis sansha. Hay miyi.
Smart Pissee. Sun-in shining Blood Oros-of Seek. This me-for.
Smart Piss-man. Look for the Blood of Oros shining in the sun. This one's mine.
(You can see that -an also is equivalent to -ing in English : daysha "to shine" : dayshan "shining". Very useful suffix)

Peak of Oros

Wuga:

Fmaygan! Mu bal damshi tatishta. Nu-ta bal fnagu taticham!
Pissee! Me strong hut build-you. Now-you strong claw build-I!

Piss-man! You built me a strong hut. Now I build a strong claw for you!

Kwayda shanchim, u apa gwam. Tu kwarkwar shwaldata darfata-kwa!
When stop-I, COMMAND back come. Then wherewhere climb-you jump-you-and!

When I finish, you come back. Then you climb and jump anywhere!

(If you haven't noticed already, the basic word for "and" is -kwa and it comes after the 2nd thing it's conjoining.  So: Winja Izila-kwa = "Wenja & Izila". Nu can also mean "and", though it only occurs at the beginning of a sentence: Nu shawsi Ulls hinacha "And take Ull's ear!")

Takkar :

Hay-ha shwaldam darfam-kwa.
This-with climb-I jump-I-and. 
I climb and jump with this.

Wuga:

Wugas fnagu! Waydata!
Woga-of claw! Found-it!

Woga's claw! You found it!

Su fnagu! U barju yaha, shwalda.
Good claw! COMMAND high throw, climb.

A good claw. Throw high, climb up.

Faran parkun! U-ra fnagu bawga, ha farun parkun shwalda. Su ha nawa kwarwi taticha.
Eagle feather! COMMAND-REFLEXIVE claw be.useful, so.that eagle feather climb. Good so.that new tool make.

Eagle feather! Use claw to climb eagle cliff. Good to make new tools.

Na kwarwi bal Wugas fnagu-way!
Not tool strong Woga-of claw-like!

(But) no tool strong like Wogah's claw!

The Lost Totem

Wuga:

Udam gwar jarshna Winja damsha waykarsh, chwanta drawbarsh - mi-sharm hadarsh!
Udam beasts old Wenja home attack-they, totem break-they - my-arm eat-they!

Udam beasts attack old Wenja home, break totem - eat my arm!

Na sharm yakam, ma chwanta yakam!
Not arm fix-I, but totem fix-I!

I didn't fix my arm, but I did fix the totem.

Udam gwan, Fmaygan. Chwanta sakman hinacha. Tu nawa Winja chwanta damsham!
Udam kill, Pissee. Totem scraps take. Then new Wenja totem build-I!
Kill Udam, Piss Man. Take back totem scraps. Then I build new Wenja totem.

Wuga:

Apa, apa! Kuswa dashta!
Back, Back! Almost done!

Back, back! Almost done!

Kakura, piki, Udam hasar!

Dung, tar, Udam blood!
Dung, tar, Udam blood!

Chwanta saywa daha, darwa-way.
Totem hard make, tree-as.

Makes totem hard as tree.

Dashta!
Done!

Done!

Takkar :

Bal. Winja shayu-way.
Strong. Wenja spirit-like
Strong. Like Wenja spirit.

Wuga:

Bal. Fmaygan-way.
Strong. Pissee-like.

Strong. Like Piss-man!

Winja damsha prapa. 
Wenja home seems

Feels like Wenja home.

Android malware on the rise

Recently, a friend of mine encountered an interesting phishing attempt:

Don't often see this delivery method #phising #mobile #malware #apk pic.twitter.com/HgqtCUAox6

— Cristian Iankovszky (@cizky) January 31, 2017

The message reads:

DHL has attempted to deliver the parcel no.: 1993747, but nobody was available. Please arrange re-delivery using our mobile app: http://dhl-tracking[.]online/app.apk

In this blog post, we'll analyse the malware in question (Marcher, banking trojan) and provide disinfection and prevention advice. Click on any of the relevant links below according to your needs:

Analysis
Disinfection
Prevention
Conclusion
Resources


Analysis

When you visit the link, a file called app.apk gets downloaded with the following characteristics:

MD5	80c797acf9bdbe225e877520275e15f5
SHA1	f255de54ffbff87067cfa7bc30d6d87a00aded8f
SHA256	fcd18a2b174a9ef22cd74bb3b727a11b4c072fcef316aefbb989267d21d8bf7d
Package name	ijrtc.jwieuvxpjavuklczxdqecvhrjcvuho

The application presents itself as 'DHL Express Mobile' while being installed and will ask for device administrator rights:

Figure 1 - System service

Basically, the app can do anything it desires:

Figure 2 - Permissions; this includes & reading text messages

Figure 3 - Permissions; note the 'modify system settings'

The payload, or the actual malware that is installed, is the Marcher banking trojan. Recently, it has been masquerading as applications for package delivery, such as DHL in the example above, Posta Online or an app called Alza.

Marcher checks if any of the following antivirus or security products are installed:

Figure 4 - AV list

... And targets the following applications:

Figure 5 - Targeted apps

Besides targeting antivirus applications, Marcher also uses some nasty tricks to avoid removal:

• Marcher installs itself as Device Administrator, effectively making the user unable to force the process to stop or uninstall the application normally;
• When you attempt to force uninstall the application, it will show you the device administrator prompt, as seen in Figure 1, which will continue to pop-up.

All in all, the malware isn't obfuscated much, but still proves to have particular persistence mechanisms. One does not exclude the other.

If you are only here for Indicators of Compromise, please find below:



You may also want to check out my blog post which provides a plethora of options and software/tools on how to analyze Android malware:
Analysing Android files


Disinfection

Marcher proves more difficult to remove as outlined above. The best way in this case is to back up your files and reinstall your operating system.

There is an excellent article on MakeUseOf on how to get to your phone's 'safe mode', create a back-up and finally factory restore or reinstall your operating system:
Dealing with System Problems in Android: Safe Mode, Factory Reset & Restoring Backups

Alternatively, you may try the following steps to remove Marcher, which also involves going into safe mode:

• Hold down the Power button on the side of your phone until a popup appears.
• On the menu that shows up, hold down the Power Off option until a popup appears.
• Tap OK to reboot into Safe Mode.
• You should now be in Safe Mode.
• Go to Settings > Security > Device administration > Device administrators or Phone administrators.
• Tap on the malicious application.
• Tap Deactivate in the next screen. In our example:

Figure 6 - deactive the app

• Now, go to  Settings > Applications or Apps > Manage applications > tap the malicious app > Uninstall.

For normal applications that don't have device administrator rights, only the last step is sufficient.

Afterwards, change all your passwords and notify your bank to be on lookout for any fraudulent transactions. Do this also if your bank is not listed (affected banks pictured in Figure 5).

Additionally, you may want to run a scan with an antivirus or antimalware product for Android. If you're unsure which antivirus to run, you can try Avast (it also detects the Marcher version discussed in this blog post).

You may want to have a look at other antivirus products if Avast does not suit your needs. A good comparison can be found on AV-test's website: The best antivirus software for Android.

Note that the best course, in any case, is to backup your files and reinstall your device! Don't forget to change passwords and notify your bank.



Prevention

• Don't root your Android device(s).
• Don't just install any app. Use common sense. When in doubt, do not install the app.
• Be wary of suspicious-looking apps even when they have a lot of positive feedback. These may be fake comments. Ask friends, colleagues or Google. Still not sure? Do not install the app.
• Download from official app stores only. Even though malware may exist on Google's Play store, chances are less likely.
• Use the default, built-in security in Android. For example, do not allow installation of apps from unknown sources and Encrypt Device.
• Always verify app permissions. Depending on the app, it should not be able to directly call other phone numbers.
• Back up your files. If something like this ever happens to you, simply reinstall and restore.
• Install an antivirus. This may be a resident one, meaning no active protection and scanning only.

More useful links are listed below in the Resources section.


Conclusion

While Windows malware still takes the biggest portion, malware for other operating systems is becoming more and more common. In regards to Android, make sure to follow the prevention tips above to stay safe.

Worth noting that, as always, prevention is better than disinfection. Create (and test) back-ups.



Resources

Analysing Android files - Blaze's Security Blog
Dealing with System Problems in Android: Safe Mode, Factory Reset & Restoring Backups - MakeUseOf
DevicePolicyManager - Android developer area
F-Secure Freedome VPN  - F-Secure
How Do I Delete Applications from My Android Device? - Lifewire
The best antivirus software for Android - AV-Test
What Is A Nandroid Backup and How Exactly Does It Work?  - MakeUseOf

IOCs