click-know

Conficker Worm Is Much Ado About Nothing

2009-04-08T03:34:00.003-07:00

The Conficker Worm is like the Paris Hilton of computer security: Famous solely for being famous. Neither has actually ever done anything of note. But, at least Paris has a sense of humor about her celebrity. Conficker just wastes people's time.
Your time and mine, for example. You're reading this because someone--not me--convinced you that Conficker matters. I am writing this because IBM has convinced me that Conficker is a wash. If it turns out differently, I'll owe the worm at apology. Paris can fend for herself.
I may host a daily call-in radio program, but I am not a conspiracy nut. Still, don't you sometimes wonder who is responsible for "threats" that develop such a high profile? I am not saying the industry that protects us against these threats might somehow be in cahoots with the people who create them. No, I am not saying that.
Conficker has once again reminded us that our systems are vulnerable and we need to invest $$$ in protection. Or has it already backfired?
Maybe Conficker will prove that what we already have works pretty well. Maybe Microsoft did a good job dealing with this threat and the anti-malware vendors likewise. Maybe Conficker will send the message that what we are doing is just fine, thank you. Spend more money to counter threats like this? Why?
Watching the news coverage as 12:01am local time on April 1 marches around the globe reminds me of the last time we did this. You remember the Y2K bug, don't you?
Back then, the world's mainframes were supposed to croak as 1999 rolled into 2000. Like today, I watched--only back then I was sitting in an emergency operations center--as countries around the global rang in the New Year with their vital infrastructure intact.
Last time, we were saved from a very real problem by a lot of recoding, necessary to work around the time/date problem. This time, we are saved from a not very significant problem by a Microsoft patch that everyone should already have had as well as wide variety of tools capable of clearing Conficker from our systems.
As I write this, Conficker seems to be passing more or less harmlessly by. The clock is actually working in our favor. IBM estimated that Asia has the largest collection of Infected-infected systems. North America about a third as many as Asia. Europe has more than we do.
If Asia and Europe survive Conficker, we don't have much to worry about. Conficker will pass from our consciousness and I won't owe the worm an apology.
If only Paris Hilton were so easy to protect ourselves against.

Conficker's Zero Hour Arrives Without Event -- Yet

2009-04-08T03:34:00.001-07:00

An expected activation of the Conficker.c worm at midnight on April 1 passed without incident, despite sensationalized fears that the Internet itself might be affected, but security researchers said users aren't out of the woods yet.
"These guys have no designs, I think, on taking down the infrastructure, because that would separate them from their victims," said Paul Ferguson, a threat researcher at antivirus vendor Trend Micro, calling the technology and design of Conficker.c as "pretty much state of the art."
"They want to keep the infrastructure up and in place to make it much harder for good guys to counter and mitigate what they've orchestrated," he said.
The Worm Stirs
Conficker.c was programmed to establish a link from infected host computers with command-and-control servers at midnight GMT on April 1. To reach these control servers, Conficker.c generates a list of 50,000 domain names and then selects 500 domain names to contact. That process has started, researchers said.
Exactly how many computers are infected with Conficker.c is not yet known, but the estimated number of systems infected by all variants of the Conficker worm exceeds 10 million, making this one of the largest botnets ever seen.
While infected computers have started reaching out to command servers as expected, nothing untoward has happened.
"We have observed that Conficker is reaching out, but so far none of the servers they are trying to reach are serving any new malware or any new commands," said Toralv Dirro, a security strategist at McAfee Avert Labs, in Germany.
This may just mean the people who control Conficker are biding their time, waiting for researchers and IT managers to relax their guard and assume the worst is over.
"It would be pretty stupid for the guys running Conficker to use the first possible opportunity, when everybody is very excited about it and looking at it very carefully," Dirro said. "If something was going to happen, it would probably happen in a couple of days."
Detections, Innoculations Increase
Time is not on Conficker's side. The worm can be easily detected and removed by users. For example, if a PC is unable to reach Web sites such as McAfee.com, Microsoft.com, or Trendmicro.com that is an indication that the computer may be infected.
In addition, IT managers can easily spot traffic coming from odd domain names and block access to the computers on their company networks. "The longer criminals wait, the less infected hosts they've got," Dirro said.
Additional help comes from a loose coalition of security vendors and others called the Conficker Working Group, which has banded together to block access to domains that Conficker is trying to communicate with. But it's not immediately clear whether those efforts, which have been successful at blocking earlier versions of the worm, will be effective against the activation of Conficker.c.
"We can't really say how successful the attempts at blocking them or not routing them are," Dirro said. "That's something we'll see when the first domain actually starts serving malware, if at least one starts doing that."
Despite the uneventful passing of the activation deadline, the threat presented by Conficker remains real.
"These guys are very sophisticated, very professional, very determined and very measured in how they implement and make changes to things," Ferguson said, adding that Conficker.c is better defended and more survivable than previous versions of the worm. "This activation on April 1 was probably just arbitrary and picked to cause hysteria."
At some point, the people behind Conficker.c could try to generate revenue from the botnet they've created or they could have other intentions.
"The big mystery is that there's this big loaded gun out there, this network of millions of machines that's under the control of persons unknown," Ferguson said. "They've given no indication of what their motives are other than toying with people."

HP Confirms Considering Android in Netbooks

2009-04-08T03:33:00.000-07:00

Hewlett-Packard confirmed Tuesday that it is testing Google's Android operating system as a possible alternative to Windows in some of its netbook computers.
Analysts said the move would allow HP to develop a low-cost netbook optimized for wireless networks that provides access to Web-based services such as Google Docs, but others questioned whether the Google software is ready for such a task.
"Right now Android is barely finished for phones," said Avi Greengart, an analyst at Current Analysis. While it works well enough for T-Mobile's G1 smartphone, the software was released only last year and "the UI still feels half-finished," he said.
HP stressed that it was still only testing Android, an OS based on the open-source Linux kernel. It has assigned engineers to the task but has made no decision yet whether to offer Android in products, said HP spokeswoman Marlene Somsak. The news was first reported earlier Tuesday by the Wall Street Journal.
"We want to assess the capability it will have for the computing and communications industry," Somsak said. "We remain open to considering various OS options."
Netbooks are small, low-cost computers that are designed primarily for browsing the Web and doing basic computing tasks. The category has proved popular -- about 10 million netbooks shipped in 2008 and the number is expected to double this year, according to IDC.
Android was designed for mobile phones but has been seen by some others besides HP as a potential OS for netbooks. Some enthusiasts have been testing Android on netbooks such as Asustek's Eee PC, and chip makers such as Qualcomm and Freescale hope to bring Android to netbooks running on their Arm-based chips.
HP may have in mind a netbook optimized for use with Web-based services such as the Google Docs hosted applications suite and Google's online storage service, said Roger Kay, president of Endpoint Technologies Associates.
The fact that notebooks are designed to provide quick access to online services, often over wireless networks, makes them in some ways like oversized smartphones.
There are also no license fees for Android, which could allow hardware makers to offer lower-priced computers than those running Windows. However, consumers have been willing to pay extra in the past for netbooks running Windows, analysts noted.
HP already offers some PCs with a choice of Linux or Windows, and introducing another OS choice would come with some risk, said David Daoud, a research manager at IDC. Some end-users don't like Linux because they are unfamiliar with it, he said.
"We've seen a number of netbooks returned as a result of the Linux OS. Consumers are used to the Microsoft Windows world," Daoud said. Linux adoption remains weak on client computers, especially in mature markets like the U.S. and Western Europe, he noted.
Still, there may be an upside for Android if HP were to make it work in netbooks. HP's heft as the world's largest PC maker would widen Android's use, Daoud said. It could see success in emerging markets like India and China, where Linux adoption is growing.
But HP would need to deliver a consumer-friendly product that makes Linux easier to use in PCs, Daoud said.

Will New Tracker Tools for Your Cell Phone Give You Away?

2009-03-27T20:23:00.001-07:00

Cell phone apps like Loopt and the new Google Latitude allow you to track your friends' physical locations, and be tracked in return. That can be a huge boon for meeting up on a Friday night-and a real nightmare for privacy if proper safeguards aren't in place. (Read more on cell phone privacy.)
I checked out both applications. For starters, neither will share your location with anyone until you explicitly agree to such sharing with each individual friend. So you can install either one and see how it looks without divulging where you are.
Also, after inviting a friend to share his or her location, or being invited to do so yourself, you can go back and change the setting to stop sharing your location with a particular friend and continue sharing with others, or stop sharing with anyone.
But what happens if you set up either app to share with friends, and forget about it? Or what if someone else puts it on your phone, without your knowledge, to track you?
In what's usually seen as a limitation, the iPhone doesn't allow running programs in the background--so Loopt can't update your location unless you open the app (Google Latitude, when it becomes available for the iPhone, should work similarly).
But most other cell phone platforms allow background processes to run silently--a potential problem. Within a few days of installing Loopt, however, you'll get an SMS notice so you'll know it's there. Loopt CEO Sam Altman also says that if you don't use Loopt for a while it will automatically stop sharing your location-likely within a week of nonuse. Google Latitude will display a pop-up notification on all phones save Android-based devices (whose users will receive an e-mail, Google says), but it won't automatically shut off.
Google does let you limit sharing to only your city-level location, and in both apps you can enter a (possibly false) location for yourself.
Both Google and Loopt say they do not store historical locations, only your last location. That's important in case someone-the government, say, or a civil litigant-seeks that data. Loopt says it will share that info only under a wiretap or¬¬der. Google hasn't said it will do the same, but it does have a record of fighting government requests for its users' information.
My conclusions? Some things could be improved: First, you should be able to share your location only for a set amount of time-say, the next 2 hours, or from 6 to 9 p.m. on Fridays. Loopt says that ability will come in a future release, but Google isn't planning to announce anything along those lines.
Next, I think Google should have an auto-shutoff after a certain amount of time, in case you become forgetful. And it should explicitly declare it won't share your information without a wiretap order.
Of the two, you might try Loopt (ideally on an iPhone), since it has auto-off and will also come out with time-based controls.
But here's the kicker: As Kevin Bankston of the Electronic Frontier Foundation points out, the safeguards in place are only company policy, not a legal requirement. And policies can change.

IP Issues Could Be Slowing IBM-Sun Talks, Experts Say

2009-03-27T20:22:00.001-07:00

If IBM is in the due diligence phase of acquisition talks with Sun Microsystems, as news reports suggest, then it has an awful lot to be diligent about.
In a merger of this scale, IBM would need to take a hard look not only at Sun's finances but also at any antitrust issues that may arise, as well as potential conflicts related to intellectual property. Those could include compatibility of software licenses and patent agreements with third parties.
"In a deal of this size, there are typically lots of moving parts," said Randall Bowen, an attorney at Grad, Logan and Klewans in Falls Church, Virginia. "Think of a kaleidoscope, where you turn it and everything comes together to form a nice symmetrical shape. Either that happens and everything falls into place, or else it shatters."
The Wall Street Journal reported last Friday that IBM was scouring Sun's business contracts for potential conflicts in a prelude to a possible merger, a process it said was expected to take "a number of days." With another week over and no word about a deal from the companies, some observers are starting to wonder if there's a holdup.
"It's impossible to know what it is they're looking at, but the fact that it's taking this long gives one pause to wonder whether there's just such a volume of contracts to look at that it's occupying all this time, or whether they've found some issues that they're busily chasing down," said Steven Frank, a partner with the law firm Goodwin Procter.
To be sure, the due diligence process for a merger this size could take months to complete. But companies often do a cursory review of the business they hope to acquire in order to announce a preliminary merger agreement. They then take several months before the deal is finalized to pore over the details.
If they do plan to merge, Sun and IBM may simply be haggling over price. But if the due diligence is holding them up, the thorny area of intellectual property could create some sticking points, said Frank, who spoke about IT industry mergers in general and not specifically this one.
Both companies have vast product portfolios governed by a mix of open-source and commercial licenses. They also have numerous patent and cross-licensing deals with third parties, including a byzantine agreement that Sun forged with Microsoft in 2004 that ended a lawsuit between them over the Java software technology.
Sun may be licensing a technology from a third party that is vital to one of its products, for example, and such agreements sometimes have clauses stipulating that the license can't be transferred if the licensee is acquired. IBM would need to approach the third party to extend the license, or decide whether to go ahead with the merger even if it has to find another way to build the product.
That's the issue Intel raised about Advanced Micro Devices' sale of its manufacturing operations to an Abu Dhabi investment group. Intel accused AMD of violating a cross-patent agreement on x86 processors that could not be transferred to a third party, and the companies are in talks with a mediator to resolve the dispute.
Conflicting software licenses can also be a problem. Dozens of Sun's products, including OpenSolaris, NetBeans and its GlassFish Web software, use its Common Development and Distribution License, which is based on the open-source Mozilla Public License. Its MySQL database is offered under the GPL or a Sun commercial license, while still other products use different licenses.
Depending on what IBM has planned for Sun's technologies, the mix of licenses could be a challenge, said Randall Colson, a partner at Haynes and Boone. For example, some industry analysts speculate that IBM wants to merge the best of Solaris into IBM's AIX Unix, which is offered under an IBM commercial license. If Sun has merged a third party's open-source code into Solaris, IBM may find barriers to merging Solaris with its proprietary AIX software.
Perhaps most complex for IBM would be the intricate deal that Sun entered into with Microsoft, which ended a long-standing lawsuit between them over Microsoft's alleged attempts to undermine Java.
The deal netted Sun almost $2 billion from Microsoft, including payments of $700 million for Sun to drop its Java lawsuit, and a further $900 million for a patent-sharing agreement that could be extended for as long as 10 years. IBM, whose software business depends heavily on Java, would need to pull those agreements apart to ensure nothing could interfere with its business or expose it to legal risk from Microsoft.
With reports of the due diligence work only a week old, it would be premature to assume that any talks under way have run into trouble, Bowen said. But the longer they take, the more uncertainty it creates for the customers and investors.
"It's fair to say that with every day that passes, it makes it seem a little less likely that this deal is going to happen," he said.

Fears of a Conficker Meltdown Greatly Exaggerated

2009-03-27T20:20:00.000-07:00

Worries that the notorious Conficker worm will somehow rise up and devastate the Internet on April 1 are misplaced, security experts said Friday.
Conficker is thought to have infected more than 10 million PCs worldwide, and researchers estimate that several million of these machines remain infected. If the criminals who created the network wanted to, they could use this network to launch a very powerful distributed denial of service (DDOS) attack against other computers on the Internet.
April 1 is the day that the worm is set to change the way it updates itself, moving to a system that is much harder to combat, but most security experts say that this will have little effect on most computer users' lives.
Nevertheless, many people are worried, according to Richard Howard, director of iDefense Security Intelligence. "We have been walking customers down from the ledge all day," he said. Often, the problem has been that company executives have read reports of some April 1st incident and then proceed to "get their IT and security staffs spun up," Howard said in an e-mail interview.
That hype will probably intensify when the U.S. TV newsmagazine 60 Minutes airs a report Sunday on Conficker, entitled "The Internet is Infected."
Conficker "could be triggered, maybe on April 1st ... but no one knows whether on April 1st they'll just issue an instruction that says 'Just continue sitting there' or whether it will start stealing our money or creating a spam attack," CBS reporter Lesley Stahl said in a preview interview ahead of the show. "The truth is, nobody knows what it's doing there."
April 1 is what Conficker researchers are calling a trigger date, when the worm will switch the way it looks for software updates. The worm has already had several such trigger dates, including Jan. 1, none of which had any direct impact on IT operations, according to Phil Porras, a program director with SRI International who has studied the worm.
"Technically, we will see a new capability, but it complements a capability that already exists," Porras said. Conficker is currently using peer-to-peer file sharing to download updates, he added.
The worm, which has been spreading since October of last year, uses a special algorithm to determine what Internet domains it will use to download instructions.
Security researchers had tried to clamp down on Conficker by blocking criminals from accessing the 250 Internet domains that Conficker was using each day to look for instructions, but starting April 1, the algorithm will generate 50,000 random domains per day -- far too many for researchers to connect with.
Gradually, the Conficker network will get updated, but this will take time, and nothing dramatic is expected to happen on April 1, according to Porras, Howard, and researchers at Secureworks and Panda Security.
"There is no clear evidence that the Conficker botnet will do anything dramatic," said Andre DiMino, cofounder of The Shadowserver Foundation, a volunteer security group. "It will change its domain usage to the larger pool and may attempt to drop another variant, but so far, that's about it."
"Regular users just need to be sure they are patched and be extra diligent about possible new methods of infection."

Microsoft Disputes Attempt to Reinstate Class in Vista Suit

2009-03-13T20:35:00.000-07:00

Microsoft is disputing an attempt to reinstate class-action status to an ongoing lawsuit against its Windows Vista Capable sticker program, a case that threatens to drag on and is reflective of the difficulties Microsoft has encountered by releasing its disappointing Windows Vista OS.
In court papers filed in a U.S. District Court in Seattle this week, Microsoft asked the court not to reconsider applying class-action status to the suit because people knew exactly which version of Vista they would receive through a coupon program called Express Upgrade Guarantee. The program allowed customers to buy PCs with Windows XP installed on them but then upgrade to Vista when the OS was released.
Microsoft also said that the plaintiffs took too long to ask for a narrowing of the class, even based on "theories known to them for more than a year," according to court papers.
The TechFlash blog Thursday posted a link to a PDF of Microsoft's most recent filing in the case, first brought against the vendor by plaintiff Dianne L. Kelley in April 2007.
Late last month, attorneys in the case asked the court to re-establish class by narrowing the scope of who could participate in the suit. This came a week after the judge in the case granted Microsoft's motion to dismiss the suit's class-action status but allowed it to go forward with six plaintiffs.
Plaintiffs now want the judge to allow the suit to apply to anyone who purchased Windows Vista Capable PCs in Microsoft's Express Upgrade Guarantee program. The Express Upgrade Guarantee program provided coupons to people who purchased Windows Vista Capable PCs so they could upgrade to the appropriate version of Vista either for free or for little cost once the OS was made available.
The overarching claim in the suit is that Microsoft's Windows Vista Capable sticker program, which theoretically let customers know which PCs were capable of running Vista before the OS was made generally available, was an example of deceptive business practices and violated consumer protection laws.
Microsoft's hardware partners began shipping PCs with the "Windows Vista Capable" logo in April 2006. However, the designation was potentially confusing, because a PC with the label was only guaranteed to run the least expensive, most basic version of Vista.
The case is scheduled to go to trial April 13; however, in last month's filing plaintiffs asked that the judge push back the trial date in case class is reinstated to give others time to join the suit. The judge has yet to respond to that filing.

Foreign Web Attacks Change Security Paradigm

2009-03-13T20:34:00.000-07:00

Traditional security systems may be ineffective and become obsolete in warding off Web attacks launched by countries, according to Val Smith, founder of Attack Research. New attack trends include blog spam and SQL injections from Russia and China, Smith said during his talk at the Source Boston Security Showcase on Friday.
"Client-side attacks are where the paradigm is going," Smith said. "Monolithic security systems no longer work."
Hackers use Web browsers as exploitation tools to spread malware and collect sensitive information. Smith used examples from clients of his company, which analyzes and researches computer attacks, to demonstrate the threat posed by blog spam and SQL attacks.
Attackers targeted high-traffic sites with blog spam and posted comments on blogs, he said. The comments looked odd and tended to have non-English phrases placed in large blocks of text with random words hyperlinked, he said. Clicking on such links took users to sites that seemed like blogs but were pages loaded with malware, Smith said.
A Chinese bank owned the domains for each malware site, but the IP (Internet Protocol) addresses traced to Germany. Studying the links revealed that each one contained words in Russian or Romanian, said Smith. By placing an international spin on their nefarious activities, the hackers hoped to confuse anyone investigating their work, he said.
"How are you going to track these back to the bad guys?" he said, noting that tracking is complicated by language barriers, working with foreign law organizations and dealing with countries "that just may not want to talk to us."
While the goals of blog spam attacks remain unclear, Smith said financial incentives serve as motivation. Adware installed after a user visits an infected site nets a hacker money, as does clicking on an advertisement on the page. Other hackers are looking to expand their botnets, or networks of compromised machines used for malevolent purposes.
Smith's investigation traced the attacks to a home DSL account in Russia. The international nature of the incident made prosecution unlikely, he said.
The SQL injection attack Smith discussed originated in China and attempted to steal information on the businesses that visited the Web site of the company, which was Smith's client.
Hackers first launched a SQL injection and uploaded a back door that allowed them to take control of the system.
Additional SQL injections failed, so the hackers searched the system for another exploit. They found a library application that allows images to be uploaded. Hackers uploaded a GIF file with a line of code contained in the image. The computer system read the GIF tag and uploaded the photo and automatically executed the code.
Hackers "targeted an app that is custom-written, in-house, and launched a specific attack against that app," Smith said.
Hackers eventually placed "iFrame" HTML code on every page of the company's Web site. The iFrames redirected the victim's browser to a server that infects the computer using a tool called "MPack." This tool profiled a victim's OS and browser and launched attacks based on that information.
The result is that victims are getting hit with multiple attacks, said Smith.
Today, SQL injection attacks are the top threat to Web security, said Ryan Barnett, director of application security at Breach Security, in an interview separate from the conference.
Last year, cybercriminals began unleashing massive Web attacks that have compromised more than 500,000 Web sites, according to the security vendor.
"They started off in January and went through essentially the whole year," said Barnett. Previously, crafting a SQL injection attack took time, but last year attackers created worm code that could automatically seek out and break into hundreds of thousands of sites very quickly.
Now, instead of stealing data from the hacked Web sites, the bad guys are increasingly turning around and planting malicious scripts that attack the site's visitors. "Now the site is becoming a malware depot," he said.
(Bob McMillan in San Francisco contributed to this report.)

Brocade: Recession Dampens Data-center Trials

2009-02-20T01:15:00.001-08:00

The ailing economy is leading some enterprises to put off transforming their data-center networks with emerging technologies such as FCOE (Fibre Channel over Ethernet), Brocade Communications' CTO said Thursday.
IT managers are delaying transitions to converged networks that use a single protocol across both the storage and server areas of a data center, CTO Dave Stevens said in an interview after the company announced a steep increase in revenue for its first fiscal quarter, which ended Jan. 24.
It was the first quarter since Fibre Channel storage network pioneer Brocade acquired Foundry Networks, an Ethernet LAN vendor. FCoE and Converged Enhanced Ethernet (CEE) are two emerging standards designed to combine the strengths of Fibre Channel and Ethernet.
"People are pushing back on trialing converged infrastructure right now," Stevens said. That reflects a greater selectiveness in pursuing IT projects as enterprises move into a mode of buying just what they need, he said.
However, growing network traffic and collections of data, along with requirements to keep data for longer periods, are forcing enterprises to upgrade their networks, he said. In doing so, they are saving money by consolidating ports in fewer platforms, such as large Ethernet switches that can accommodate as many connections as 10 smaller boxes, Stevens said.
"The FCOE stuff and the CEE stuff seem to be pushing out a little bit, and there seems to be more emphasis on the Ethernet side and the Fibre Channel side to implement high-density switching systems in both of those environments," he said.
Brocade reported revenue of $431.6 million for the quarter, up 8 percent from the previous quarter and 24 percent from a year earlier. That figure included about one month of revenue from Foundry, which was folded into the company in late December. It fell short of the consensus forecast of analysts by Thomson Reuters, which was US$441.7 million.
The company posted a loss of US$26 million, or $0.07 per share, because of one-time items that mostly were associated with the Foundry deal, according to Stevens. Not including those items, Brocade earned US$63.6 million or $0.15 per share, exceeding the consensus forecast of analysts by Thomson Reuters, which was $0.13 per share.
Brocade reported the integration of Foundry is ahead of schedule and that "the vast majority" of Foundry employees have remained on board. Brocade has been reorganized to focus on three market segments: Data center infrastructure, campus networks, and service-provider infrastructure, Stevens said. Engineers from both companies are working together on the next generation of technology, such as FCOE gear, but the traditional Fibre Channel and Ethernet product lines will remain and be updated for the foreseeable future, he said.
The biggest challenge in integrating the businesses has been allocating engineers and funding among the Ethernet, Fibre Channel and converged-infrastructure categories, Stevens said.
For fiscal 2009, Brocade predicted IT spending would continue to be held down by economic conditions but start to pick up in the fiscal fourth quarter and the next fiscal year. It forecast annual revenue of $1.9 billion to $2 billion, up from about $1.5 billion in fiscal 2008. But the company sees revenue rising only slightly in the following fiscal year, giving a revenue range for planning purposes of $2.1 billion to $2.2 billion for fiscal 2010.
In after-hours trading late Thursday, Brocade's shares on the Nasdaq (BRCD) were down $0.10 at $3.28.

How Will the $7.2 Billion Allotted for Broadband Stimulus Be Spent?

2009-02-20T01:14:00.001-08:00

Though a number of details are vague, many people in tech and telecom circles hope that the $7.2 billion allotment for broadband in the newly enacted federal economic stimulus package marks the beginning of a nationwide broadband strategy.
In the American Recovery and Reinvestment Act of 2009, recently enacted by Congress, many details regarding the allocation of funds for high-tech projects remain blurry. Nevertheless, the nation's tech community appears to be encouraged by the $7.2 billion provision for broadband in the near $789 billion economic stimulus package signed into law by President Barack Obama earlier this week. Many observers believe that the allocation is a clear first step toward establishing a nationwide broadband strategy.
Officially known as "Title VI--Broadband Technology Opportunities Program," the $7.2 billion in broadband stimulus money accounts for less than 1 percent (and only five pages) of the entire package. Its purpose is to spur broadband growth in underserved areas of the country.
What the Law Says
The bureaucracy to allocate the money has not been set up yet, and no one can be absolutely sure exactly how the broadband program will work. Still some definite elements have emerged.
First, two entities will issue grants under Title VI: the National Telecommunications & Information Administration (NTIA), and the United States Department of Agriculture (USDA) Rural Utilities Service. Tech companies, telecommunications service providers, and other ISPs large and small will compete for the grant money through a bidding process managed by the two organizations.
But confusion exists even on this point. "There's no clear way to know which government entity they should apply to," says Derek Turner, research director of Free Press, a Washington media-reform think tank.
Urban vs. Rural Broadband
The debate has begun in earnest over how much of the money should go to developing and extending rural broadband service and how much to improving quality and choice in existing urban broadband service. The division of the $7.2 billion between the two agencies provides some clue: The NTIA will be responsible for about $4.7 billion of the money, while USDA will dispense about $2.5 billion of it.
Language in the new law explicitly mentions expanding broadband to rural areas: "The purposes of the program are to (1) provide access to broadband service to consumers residing in underserved areas of the United States; (2) provide improved access to broadband service to consumers residing in underserved areas of the United States."
The law does not define any of those terms, however, nor does it identify the mechanism for issuing funds. Rather, it simply states that "the grant program [will be created] as expeditiously as practicable" and that "if approved, provide the greatest broadband speed possible to the greatest population of users in the area."
The USDA has been operating a Rural Utilities Service since 2002 to help small towns obtain broadband access; but the program, operating with a much smaller budget than the one it will administer under the stimulus act, has achieved only limited success.
We also know something about the timing of the allocations. The new bill states that "all awards are [to be] made before the end of fiscal year 2010."
Many Unknowns in Allocation Plan
While the Obama Administration would like to dole out this money as quickly as possible, many industry experts say that several months--and perhaps a year or more--will pass before any tangible services are up and running. Furthermore, many of the program's details have yet to be determined.
According to Bart Forbes, spokesperson for the National Telecommunications & Information Administration (NTIA), the White House's technology policy arm, and one of main distributors of the new infusion of broadband money, no bureaucratic process is in place yet to move the funds to their needed destinations. "There's no procedure; there's no staff; there's no program," Forbes says. "The key players have not been put into place."
Forbes adds that the NTIA has no permanent head at the moment--and hasn't had one since November 2007. Moreover, the Department of Commerce, of which the NTIA is a component agency, has no secretary either.
Despite these ambiguities, many industry analysts seem hopeful about the broadband initiative's prospects for success. "There's lots of potential for waste, fraud, and abuse [in the new law], but our country is in trouble right now," Turner says. "I'm cautiously optimistic."
How Will It Work?
Once the NTIA and the USDA create a system for distributing stimulus grants, they will work with the various states to outline the states' needs. The resulting proposals could come in the form of wired or wireless projects--the language of the law doesn't specify any particular speed or technology.
Meanwhile, tech companies, nonprofits, and ISPs will submit grant proposals and the Washington, D.C., entities will broker the final arrangements for funding approved proposals.
Each grant must adhere to principles of openness, including generally recognized provisions of Net neutrality, which require an "open access basis."
To counter potential fraud and waste, the law also mandates a "fully searchable database, accessible on the Internet at no cost to the public, that contains at least a list of each entity that has applied for a grant under this section, a description of each application, the status of each such application, the name of each entity receiving funds made available pursuant to this section, the purpose for which such entity is receiving such funds, each quarterly report submitted by the entity pursuant to this section, and such other information sufficient to allow the public to understand and monitor grants awarded under the program."
Will It Ceate Jobs?
Industry watchers say that the new law is crucial if some 20 million Americans are to obtain the broadband Internet access they need.
Craig Settles, president of Successful.com and a longtime telecom industry observer, notes that public discussion of the broadband provision and of the larger stimulus package tends to focus on their similarity to New Deal-era public spending on infrastructure projects; but he says that the parallel is inexact.
"Broadband is as vital as roads and highways, but it isn't as much in the building of the infrastructure as in the job creation that comes out of the more physical, like dams and roads and so forth--those old-school infrastructure projects generate a lot of work," Settles says. "Where you're going to have the greatest impact [with the new projects] is after the network is done. It will draw new businesses to the communities; it will enable the businesses that are there to expand their markets."
What's Next?
In coming weeks, the person appointed as Secretary of Commerce by President Obama will appoint an assistant secretary--and that person will bear primary responsibility for overseeing execution of the provisions of Title VI.
"Over the next 60 days, the Department of Commerce and Department of Agriculture are going to write the [Request for Proposal] that puts the teeth into this bill, and the stipulations that the money gets appropriated to where it's needed and that it's open so it's not just the incumbents that are sucking up the money," Settles says.
Many other industry observers--including Harold Feld, a telecommunications consultant--say that the Obama Administration's attention to broadband indicates its commitment to making technology policy a high priority.
"So far, the Obama people who are going to be running this have shown that they have a drive and an appreciation for what broadband can do to transform people's lives," Feld says. "[Obama] has made a relatively minor part of the stimulus bill something that he talks about in every one of his speeches."

Conficker Worm Gets an Evil Twin

2009-02-20T01:13:00.000-08:00

The criminals behind the widespread Conficker worm have released a new version of the malware that could signal a major shift in the way the worm operates.
The new variant, dubbed Conficker B++, was spotted three days ago by SRI International researchers, who published details of the new code on Thursday. To the untrained eye, the new variant looks almost identical to the previous version of the worm, Conficker B. But the B++ variant uses new techniques to download software, giving its creators more flexibility in what they can do with infected machines.
Conficker-infected machines could be used for nasty stuff -- sending spam, logging keystrokes, or launching denial of service (DoS) attacks, but an ad hoc group calling itself the Conficker Cabal has largely prevented this from happening. They've kept Conficker under control by cracking the algorithm the software uses to find one of thousands of rendezvous points on the Internet where it can look for new code. These rendezvous points use unique domain names, such as pwulrrog.org, that the Conficker Cabal has worked hard to register and keep out of the hands of the criminals.
The new B++ variant uses the same algorithm to look for rendezvous points, but it also gives the creators two new techniques that skip them altogether. That means that the Cabal's most successful technique could be bypassed.
Conficker underwent a major rewrite in December, when the B variant was released. But this latest B++ version includes more subtle changes, according to Phil Porras, a program director with SRI. "This is a more surgical set of changes that they've made," he said.
To put things in perspective: There were 297 subroutines in Conficker B; 39 new routines were added in B++ and three existing subroutines were modified, SRI wrote in a report on the new variant. B++ suggests "the malware authors may be seeking new ways to obviate the need for Internet rendezvous points altogether," the report states.
Porras could not say how long Conficker B++ has been in circulation, but it first appeared on Feb. 6, according to a researcher using the pseudonym Jart Armin, who works on the Hostexploit.com Web site, which has tracked Conficker.
Though he does not know whether B++ was created in response to the Cabal's work, "it does make the botnet more robust and it does mitigate some of the Cabal's work," Support Intelligence CEO Rick Wesson said in an e-mail interview.
Also known as Downadup, Conficker spreads using a variety of techniques. It exploits a dangerous Windows bug to attack computers on a local area network, and it can also spread via USB devices such as cameras or storage devices. All variants of Conficker have now infected about 10.5 million computers, according to SRI.

Scientists Claim Big Leap in Nanoscale Storage

2009-02-20T01:10:00.000-08:00

Nanotechnology researchers say they have achieved a breakthrough that could fit the contents of 250 DVDs on a coin-sized surface and might also have implications for displays and solar cells.
The scientists, from the University of California at Berkeley and the University of Massachusetts Amherst, discovered a way to make certain kinds of molecules line up in perfect arrays over relatively large areas. The results of their work will appear Friday in the journal Science, according to a UC Berkeley press release. One of the researchers said the technology might be commercialized in less than 10 years, if industry is motivated.
More densely packed molecules could mean more data packed into a given space, higher-definition screens and more efficient photovoltaic cells, according to scientists Thomas Russell and Ting Xu. This could transform the microelectronics and storage industries, they said. Russell is director of the Materials Research Science and Engineering Center at Amherst and a visiting professor at Berkeley, and Xu is a Berkeley assistant professor in Chemistry and Materials Sciences and Engineering.
Russell and Xu discovered a new way to create block copolymers, or chemically dissimilar polymer chains that join together by themselves. Polymer chains can join up in a precise pattern equidistant from each other, but research over the past 10 years has found that the patterns break up as scientists try to make the pattern cover a larger area.
Russell and Xu used commercially available, man-made sapphire crystals to guide the polymer chains into precise patterns. Heating the crystals to between 1,300 and 1,500 degrees Celsius (2,372 to 2,732 degrees Fahrenheit) creates a pattern of sawtooth ridges that they used to guide the assembly of the block copolymers. With this technique, the only limit to the size of an array of block copolymers is the size of the sapphire, Xu said.
Once a sapphire is heated up and the pattern is created, the template could be reused. Both the crystals and the polymer chains could be obtained commercially, Xu said.
"Every ingredient we use here is nothing special," Xu said.
The scientists said they achieved a storage density of 10Tb (125GB) per square inch, which is 15 times the density of past solutions, with no defects. With this density, the data stored on 250 DVDs could fit on a surface the size of a U.S. quarter, which is 25.26 millimeters in diameter, the researchers said. It might also be possible to achieve a high-definition picture with 3-nanometer pixels, potentially as large as a stadium JumboTron, Xu said. Another possibility is more dense photovoltaic cells that capture the sun's energy more efficiently.
Russell and Xu's approach differs from how other researchers have been trying to increase storage density. Most have been using optical lithography, which sends light through a mask onto a photosensitive surface. That process creates a pattern to guide the copolymers into assembling.
The new technology could create chip features just 3nm across, far outstripping current microprocessor manufacturing techniques, which at their best create features about 45nm across. Photolithography is running into basic barriers to achieving greater density, and the new approach uses less environmentally harmful chemicals, Xu said. But actually applying the technique to CPUs would pose some challenges, such as the need to create random patterns on a CPU, Xu said.
Among other things, such a leap ahead in storage density could alter either the amount of content that a person could carry with them or the quality of media delivered on discs, said Nathan Brookwood, principal analyst at Insight64. For example, it might allow movies to turn into holograms, he said.
"Just when we think we're so technically sophisticated in what we can do, along comes somebody with a notion like this, which has the potential to fundamentally change economics in so many different areas," Brookwood said.
Ultra-high-definition displays have less practical potential, according to IDC analyst Tom Mainelli. The image and video standards of today, including those used in HDTV, couldn't take advantage of a display with 3nm pixels, he said. And when it comes to monitors, price is king.
"You could see how there would be a value to that level of precision (in an area like medical imaging) ... but are we talking about a [US]$10,000 display?" Mainelli said.
Insight64's Brookwood said the technology, for which Berkeley and Amherst have applied for a patent, harkens back to fundamental breakthroughs that created the IT industry, he said.
"It's this kind of basic materials research that has created the opportunities that have made Silicon Valley and American manufacturing great," Brookwood said. "The last few years (in the U.S.), there have been fewer and fewer people working on this level of basic stuff," he said.

Google, Nvidia Bringing Android to Tegra Chips

2009-02-16T01:49:00.001-08:00

Nvidia on Monday said it is working with Google to build support for Linux applications on smartphones with its upcoming Tegra mobile chips.
The company has allied with Google and the Open Handset Alliance to support the open-source Android software stack, which is increasingly being adopted by smartphone makers including Samsung and HTC.
Primarily known as a graphics card vendor, Nvidia said Tegra chips would bring advanced graphics capabilities to smartphones while drawing less power.
The support for the Android platform is an attempt to drive up Tegra's adoption among smartphone makers. Nvidia is displaying an Android-based phone with a Tegra chip at the GSMA Mobile World Congress being held in Barcelona from Monday to Thursday.
Tegra-based phones will combine advanced graphics, better battery life and always-on Internet access, Nvidia said in a press release. Smartphone makers can now use the Android platform to build Web 2.0 and Internet-based applications for Tegra-based smartphones, the company said.
Tegra chips put an Arm-based processor core, a GeForce graphics core and other components on a single chip. The product lineup includes the Tegra 600 running at 700MHz and Tegra 650 running at 800MHz. It also includes Tegra APX 2500 and APX 2600.
The systems-on-chips will start shipping in mid-2009 for handheld devices like smartphones and mobile Internet devices. Nvidia couldn't immediately name companies that may ship smartphones with the chips. However, an analyst last week speculated that Microsoft would launch a smartphone with Tegra's APX 2600 chip at MWC.
Beyond open-source support, Tegra chips also support Windows-based applications. At last year's MWC, Nvidia announced Tegra would support Windows Mobile and enable 3D user interfaces and high-definition video on smartphones.
Nvidia also wants to help bring about mobile Internet devices (MIDs) for US$100 with Tegra chips. Mobile Internet devices are handheld communication and Internet devices that fall somewhere between a sub-notebook and a smartphone.
A $99 Tegra-based MID is expected to be announced by Nvidia at MWC. The MID includes full high-definition 1080p video playback and full Wi-Fi and 3G mobile broadband connectivity capabilities. The always-on device can go "days" between battery charges, a company spokesman said.
Other than saying similar MIDs would ship in the second half, the company provided no further details about the product.

Adobe to Show off New Flash for Smartphones

2009-02-16T01:46:00.000-08:00

At the Mobile World Congress on Monday, Adobe plans to show off progress on its Flash Player 10 for smartphones and deliver a new software development kit that should make reading documents on small screens easier.
While Adobe has demonstrated Flash Player 10 on the Android G1, at MWC it will also show it running on Nokia S60 and Windows Mobile phones. While Flash Player 10 won't display absolutely everything developed for the Web, even on high-end smartphones, it will come closer than its predecessors, said Anup Muraka, director of technology strategy and partner development in Adobe's platform business unit.
Muraka couldn't add any more details about the possibility of Flash in either form on iPhones, a question that many of the phone's users have wondered about. "I can reiterate what our CEO recently said, that we'll continue our development efforts. There's a fair bit of work to be done, and we're looking forward to completing that and coordinating with Apple to try to make it available," he said.
Adobe also planned to announce that it released a new Adobe Reader Mobile SDK that will replace Reader LE 2.5, the current mobile PDF reader. Licensees will use the new SDK to enable the display of PDF documents in their own readers. Reader LE 2.5 is slightly less flexible, requiring licensees to use an included reader.
The new SDK will fit text to the screen rather than display documents in their full size. "In the existing reader, you have to zoom in and pan around," Muraka said.
Sony is already using the technology in its Reader Digital Book, and e-book readers from Bookeen and iRex Technologies as well as Lexcycle, the maker of the iPhone Stanza book reader, plan to use it.
For developers, Adobe introduced new technology that will automatically detect if users buying their applications have Flash Lite, and if they don't, offer to install it. "A developer no longer has to be dependent on whether a consumer has the latest device or software," said Muraka. The distributable player is now available as a beta.
Adobe will also use Mobile World Congress to push its Open Screen Project, an industry initiative that aims to make it easier for content providers to offer a consistent experience to users across devices including TVs, computers and phones. Nokia and Adobe announced that they plan to award US$10 million to developers who build applications that are based on Adobe Flash and will run on Nokia phones plus other kinds of devices. Developers will submit concepts for their applications, and a group of companies including Adobe and Nokia will review them and decide to award them seed money.

Lenovo Uses BlackBerry to Sync Laptop E-mail

2009-02-16T01:44:00.000-08:00

PC maker Lenovo on Monday is expected to announce a partnership with Research In Motion that will make it easier for laptops to synchronize e-mail with servers with the help of BlackBerry smartphones.
Lenovo is providing a hardware and software bundle that allows ThinkPad laptops to sync e-mail with a server using Research In Motion's BlackBerry phone as an intermediary. This is part of Lenovo's new Constant Connect program, which the company plans to announce at the GSMA Mobile World Congress in Barcelona.
Through Constant Connect, synchronizing e-mail with servers is a two-step process. First, ThinkPad laptops transfer e-mail back and forth with a BlackBerry using Bluetooth wireless technology. The smartphone then synchronizes laptop e-mail with a server using a mobile-phone network.
This could be useful in certain places like airports where users have to pay for Wi-Fi connections to sync e-mail with servers. This technology does not use Wi-Fi networks, said Rich Cheston, distinguished engineer and executive director at Lenovo. Users may also prefer to see their e-mail on a laptop with a bigger screen and full keyboard rather than on a BlackBerry, Cheston said.
The hardware comes in the form of a PCI Express card with its own radio and storage that plugs into a laptop. A user doesn't need to start a laptop, as the card replicates with a RIM device by drawing its own battery power. The real-time syncing can provide quicker access to e-mail where wireless connectivity is spotty, Cheston said.
Users will also have the ability to sort and get alerts when specific e-mails arrive, Cheston said. "Let's suppose I want to be notified when my wife sends me an e-mail. I could have the card start blinking when the e-mail comes," Cheston said.
The bundle costs US$150 and will be available in the second quarter in the U.S., with worldwide availability scheduled for the second half of this year. It works with BlackBerry devices supporting the operating system 4.2 or later.
On laptops, it works with Windows XP and Windows Vista and supports Outlook or other POP (Post Office Protocol) e-mail clients like Gmail, Cheston said. The company plans to add Lotus Notes support in the second half.
The technology works only with ThinkPad laptops based on Intel's Montevina technology, which the company started shipping in the middle of last year. The package syncs only e-mail for now and plans to add calendar- and contact-synchronizing capabilities later this year, Cheston said.

Dell Hurls out Another Adamo Teaser

2009-02-11T01:29:00.000-08:00

Dell has launched a new teaser surrounding its highly anticipated Adamo ultraportable laptop, now inviting users to sign up for the launch of the laptop as its unfolds.
"Prepare to fall in love," says Dell's Adamo laptop Web site, which then invites users to sign up to see how the "love story" unfolds. Though what the e-mail may contain is unclear, the invites may provide an early look at the laptop.
Dell officially unveiled Adamo at the Consumer Electronics Show in Las Vegas, calling it an ultrathin laptop representing the best of the company's craftsmanship, performance and design. An on-stage model held the light laptop with a few fingers, revealing an ultraslim design with a premium finish.
Dell did not reveal technical specifications, but said the laptop would ship later in the first quarter.
Adamo won't be just a laptop, but a whole new brand name of luxury products, said Michael Tatelman, vice president of global consumer sales and marketing at Dell at CES. The word Adamo means to fall in love with, Tatelman said at the time.
Speculation around Adamo heated up late last year when news media and observers said Adamo was Dell's response to Apple's MacBook Air.
Dell also leaked out accessories for an ultraportable laptop called Adamo Thirteen, which pointed to a laptop with a 13-inch screen in line with Dell's branding conventions. The company already offers the Inspiron Mini 9, which has a 9-inch screen, and Inspiron Mini 12, which has a 12-inch screen.

Internet Explorer 8 Offers Improved Privacy and Security

2009-02-11T01:27:00.000-08:00

Internet Explorer has recently been losing market share to upstarts like Mozilla's Firefox, Apple's Safari, and Google's Chrome beta, but Microsoft hopes to reverse the tide with Internet Explorer 8, which is due out this summer. My conclusion after a close examination of the four browsers: As matters stand, IE 8 seems likely to be the easiest to deploy and maintain over a large or small network.
In addition, IE 8's capabilities will either match or exceed those of the other browsers. Here's a comparative look at some of the key features to be included in IE 8, and a discussion of why companies may be better off using IE 8 than one of the other browsers.
Easy to Deploy
IE 8 appears to be especially well suited for companies that want to adopt a browser across large network. In particular, Microsoft has equipped IE 8 with built-in deployment features, based on the company's existing deployment and update platforms. In contrast, Mozilla relies on third-party Firefox client customization add-ons such as FrontMotion Firefox MSI, CCK Wizard, or FirefoxADM; and Safari and Chrome don't as yet offer network-wide client customization deployment options at all.
Microsoft has been hyping IE 8's ability to switch automatically to IE 7 compatibility mode when necessary. But that's because IE versions 7 and earlier often didn't follow Web standards, and this failure to conform forced Web developers to code their pages differently in order to render on IE. Once deployed across a network, IE 8 won't break corporate intranet: Internal or intranet Web sites will automatically default to IE 7 compatibility so that businesses won't have to rewrite their inward-facing corporate pages. Similarly, Web surfing or external browsing in IE 8 will default to the new "standards mode" as well. Since Firefox, Chrome, and Safari have more or less conformed to Web standards over the years, they don't require this compatibility mode.
Taking a page from Google Chrome, IE 8 will offer built-in tab crash protection. In the event of a page fault, only the affected tab and not the entire browser will crash. The current versions of Firefox and Safari lack this isolation feature. Firefox will, however, restore the entire browser session after a browser crash; a similar feature in Safari called 'Reopen All Windows from Last Session' lets you restore previous browser windows whether or not the session ended with a crash.
Better Productivity
Though Microsoft took its time before embracing tabbed browsing, IE 8 is set to make significant strides in this area. As links on a page open new tabs, color-coded related tabs appear alongside the original. Chrome, Firefox, and Safari do not offer this capability. On the other hand, Chrome, Safari, and Firefox 3.1 can pull a tab out of the browser and create a new, stand-alone browser session; IE 8 won't be able to do this. IE 8 will offer some nice features within a tab, though: When you open a new tab, the browser will give you the option to reopen a closed tab or to restore your previous browsing session, among other choices.
Also unique to IE 8 will be "accelerators"--shortcuts to services that open within a given Web page. Instead of cutting and pasting to another tab, you may simply highlight the text and click the blue Accelerator icon to open blog, e-mail, map, search, and even translation services on the page you're currently viewing. This page-within-a-page feature is unavailable as yet from Firefox (without add-ons), Chrome, or Safari.
Web Slices, another unique feature, is designed to monitor a specific section of a Web page--a weather radar image, say, or an eBay auction--without requiring you to revisit the page. You'll simply select the page element and drag it to your toolbar to view as needed. Companies may be able to use Web Slices for intranet messaging and access to company services.
Mozilla dubbed its address bar in Firefox 3 the 'Awesome Bar' because it displays URL suggestions drawn from browser history and bookmarks. IE 8 will have its own awesome bar, with the unique ability to delete these suggestions--something Firefox doesn't offer. Deleting suggestions may help prevent over-the-shoulder snooping and assuage privacy concerns regarding a shared computer.
Private Browsing
If you share a computer with others, you may prefer that sites you visit not be added to your browser's history, or that any new cookies created be deleted when your browsing session ends. Safari was the first browser to offer Private Browsing. Chrome has answered with Incognito, and Firefox plans to add some form of private browsing to its Firefox 3.1 release.
With IE 8, Microsoft will introduce In Private browsing. Both IE 8 (when it is released) and Chrome (now) display visual indicators--icons in the upper lefthand corner--to signal when you're in a private session. Safari offers no visual cues, and Firefox hasn't said what UI changes it plans to make. With private browsing, all client-side evidence of your surfing session should disappear when the session ends, though records of your visits will remain on external Web servers.
The private browsing feature appears to provide secrecy, but both Apple and Microsoft maintain a cache that includes Private Browsing sessions. Is that a contradiction? No. Apple uses a DS cache so that the Safari browser doesn't have to request DNS information continually on frequently accessed sites. IE 8 will save information about your In Private sessions for sites that may be collecting information about your visits. Both Apple and Microsoft say that you can delete these caches through configuration options, however.
Better Security
Perhaps the most vexing aspect of past versions of Internet Explorer has been the browser's poor security. Here, too, Microsoft has made significant gains on the competition, starting with its 'Trustworthy Computing' inspection of lines of code. Both IE 8 (running in Protected Mode) and Chrome will run at low integrity, meaning that they can't launch applications without the user's express permission. And both browsers are designed to use 'Data Execution Prevention' and 'Address Space Layout Representation' to protect against remotely executing malware. Neither Firefox nor Safari offers similar protection.
All of the new browsers support Extended Verification SSL, a way of further establishing trust in a site you are visiting. Only Safari doesn't change its address bar to green to signal the extra security. And all four browsers include antiphishing protection, though Safari 3.2 stops there and doesn't yet offer antimalware protection.
Cross-Site Scripting and Other Demons
Cross-site scripting (aka "XSS") attacks occur when a malicious Web site uses Javascipt to read or write data onto another Web site. Unlike the three competing browsers, IE 8 will offer built-in XSS protection. Firefox recommends that users install No Script, a third-party add-on. So far, Chrome and Safari don't offer XSS-specific protection.
"Clickjacking," a term coined by security researchers Jeremiah Grossman of WhiteHat Security and Robert Hansen of SecTheory, refers to a less common but sinister practice: Bad guys trick a user into clicking a concealed link and performing unknown actions, such as activating a peripheral device like a Webcam or deleting data from a Webmail site. Since the attack uses a common coding procedure, Microsoft says that the best way to defeat it is for developers to add a special tag--X-FRAME-OPTIONS--that IE 8 will use to filter clickjacking attempts. Firefox recommends using the No Script add-on to ward off clickjacking attempts. Chrome and Safari do not offer specific protection against clickjacking.
In light of its robust new features and the ease with which it can be deployed, IE 8 appears poised to be the most network-ready browser of the bunch. Organizations currently running Internet Explorer should definitely upgrade to IE 8 when Microsoft releases it, and those that have migrated away from Internet Explorer should evaluate the productivity and security benefits they stand to gain by returning.

2009-02-06T19:28:00.003-08:00

Removal of OLPC Donation Program Rattles Observers

2009-02-06T19:28:00.001-08:00

One Laptop Per Child's removal of a program that enables small-scale XO laptop deployments has rattled observers, who are concerned that the nonprofit is changing its focus to large-scale deployments.
A program for donors to employ between 100 or more laptops for small-scale deployments, called "Give a School," has been removed from the participation page of the nonprofit's Web site. The nonprofit is now offering options to directly donate laptops or to make corporate purchases.
Designed for use by children in developing countries, the XO laptop has been praised for its innovative hardware features and environmentally friendly design. The Give a School program was defined as a "special program that allows donors to choose the country where the laptops go."
The change was first noted by Morgan Collett, who blogged about it. OLPC's changed focus could affect XO laptop deployments in South Africa that were purchased through the program, he wrote.
"This is a blow to future small deployments in South Africa, as we have over 600 XOs deployed in South Africa through this program with more that were planned," Collett wrote. A nonprofit organization was being set up to raise funds and coordinate deployments, but that will be to "no effect" unless laptops from other vendors are used, Collett wrote.
OLPC's grassroots focus through small deployments generate excitement for the nonprofit's larger efforts, wrote Wayan Vota, an OLPC observer in a blog entry on OLPC News.
"It's pilots that give us guidance for national rollouts. It's the OLPC movements in South Africa, Oceania, and South Asia that are giving OLPC is real successes. And to discount, or outright abandon them, is foolish," Vota wrote.
OLPC officials did not comment on removal of the "Give a School" program, but President and Chief Operating Officer Chuck Kane said OLPC is committed to small-scale deployments. "Would you like to purchase 1,000 computers and change the world?" Kane asked in an e-mail.
He did not provide further comment.
Rumors of OLPC's change of focus started after a message on OLPC's Web site said the nonprofit removed the Give a School program to refocus its efforts on larger deployments.
The authenticity of the e-mail could not be verified, but the Give a School program has been removed by OLPC, which led to concerns among observers.

E-Books Take Center Stage

2009-02-06T19:27:00.000-08:00

New Amazon Kindle rumors and Google's e-book announcement help fuel e-reading furor.
It’s been over a year since the Amazon Kindle e-book reader was introduced. And the electronic-ink-based device--which in many ways has transformed the e-book category--has spent much of that time in high-demand: The Kindle was on backorder and sold out during the holidays. Today the Kindle remains on backorder at Amazon's site, by three to five weeks.
Rumor has it that the second-generation Kindle will be introduced at an Amazon event in New York on Monday. Last fall, images purported to be the Kindle 2 surfaced on The Boy Genius Report.
The first-generation Kindle cost $359--when you could buy it. “The Kindle has spurred much interest in the e-book category, not only because of its wireless capabilities, but also because it extends the footprint of Amazon nearly anywhere," notes Ross Rubin, NPD Group director of industry analysis. "It's been one of the first wirelessly connected consumer electronics products to offer fast connectivity at no end-user cost to the consumer.”
That connectivity--an integrated 3G cellular radio and Kindle’s free, Whispernet EvDO wireless connection provided in partnership with Sprint--allows immediate access to the Kindle store for on-demand e-book purchases. Plus, you can use Whispernet to subscribe to and receive blogs and RSS feeds, as well as to browse basic Web sites (text pages, not graphics-heavy sites, so it's handy for quick news and weather checks, or for Wikipedia lookups).
A second-generation Kindle has the opportunity to correct some of the design flaws of the first-gen model--it was too bulky, and handled PDFs and other document files less than gracefully--while making the device more competitive and appealing, given new competition.
Sony, for example, has added backlighting and a touch screen, on its slim second-generation Sony Reader Digital Book PRS-700BC. Meanwhile, Google announced that the 1.5 million public-domain books in its Google Book Search will be accessible via mobile handsets such as the Apple iPhone 3G and the T-Mobile G1. And Amazon has countered by saying that it is working on making Kindle e-book titles accessible on cell phones as well.
Cell phones could be the ultimate mobile e-book reader, by virtue of their portability and ubiquitous nature. “There's a relatively small market for a dedicated device for reading best-sellers, and we're seeing more development on e-book initiatives for the iPhone, with offerings such as Shortcovers and Zinio for the iPhone,” says Rubin. Add in the Google Book Search and Amazon mobile Kindle initiatives, and cell phones could become the next big platform for e-books, beyond the dedicated electronic-ink screens.
Rubin says that one area Amazon could potentially mine is that of electronic textbooks. “There's a tremendous opportunity for the first e-book provider that can tap into the textbook market,” he says. “At the appropriate price, that could transform these devices from frequent-flyer folios into a staple in the homes of students.”

Groups Push for Broadband Stimulus

2009-02-06T19:19:00.000-08:00

The U.S. Congress should keep money for broadband deployment in a huge economic stimulus package, despite some calls to trim it out of the bill, representatives of three groups said Friday.
As the U.S. Senate debated cuts to a US$890 billion stimulus package, representatives of the Information Technology and Innovation Foundation (ITIF), the Communications Workers of America and Connected Nation, called on the Senate to keep funding for building broadband networks in rural and other underserved areas.
The Senate version of the economic stimulus package originally included $9 billion for broadband deployment, about $3 billion more than a House of Representatives' stimulus bill that passed Jan. 29. Late Friday, senators continued to debate their own stimulus bill, with several lawmakers calling for significant cuts in the spending package. One proposal would cut the broadband spending by $1.5 billion.
Money for broadband is important to help rural and some urban areas realize the economic and social benefits of broadband, said Raquel Noriega, director of strategic partnerships at Connected Nation, a nonprofit group focused on helping communities expand broadband deployment.
"I cannot see a better way" to stimulate the economy, she said during an ITIF forum on broadband stimulus in the U.S. Capitol.
Some groups have questioned whether there's a need for broadband deployment money in the bill. On Jan. 21, New York Times tech columnist Saul Hansell suggested that broadband providers would reach most of the nation without a large amount of stimulus money. Using new cable modem technology, the U.S. should be able to surpass other nations' broadband speeds, he wrote.
"As I look at it, the noise about a broadband gap is hooey," Hansell wrote. "With new cable modem technology becoming available, 19 out of 20 American homes eventually will be able to have Internet service that is faster than any available now anywhere in the world."
Hansell suggested the stimulus package should focus on unserved areas instead of spending tens of billions [b] of dollars to increase speeds in areas already served by broadband providers, as some groups have called for. "It is hardly clear that the country would get an adequate return from subsidizing what is essentially duplicate capacity," he wrote.
Berin Szoka, a fellow at conservative think tank the Progress and Freedom Foundation, also questioned how the government will be able to gauge the effectiveness of any stimulus money for broadband. He suggested the broadband stimulus is "corporate welfare" in a Jan. 20 blog post.
"How would one actually evaluate the efficacy of any proposed government intervention?" Szoka wrote. "As difficult as it is to predict the unintended consequences of intervention, it's even more difficult to do so in high-tech sectors of the economy, where the rate of change is particularly rapid."
But stimulus money will be needed to reach that last 5 percent to 10 percent of U.S. residents who don't have access to broadband, said Robert Atkinson, ITIF's president. Many of those people are in rural areas where broadband providers have been reluctant to provide service because of the cost per customer, he said.
"You can't make the money back at $35 a month," he said. "The numbers don't work."
Atkinson called on Congress to approve a mixture of tax cuts and grants to help broadband providers expand service. While a grant program would take time to set up, tax cuts would encourage providers to expand their networks almost immediately, he said.
He also called on Congress to get rid of open access and net neutrality requirements, as well as speed requirements, in the House version of the stimulus package. The House bill would require the U.S. Federal Communications Commission to define open access rules, and those rules could potentially include requirements for broadband providers to share their networks with competitors, he said.
Proponents of the open access rules say they're needed to keep broadband providers from blocking or slowing access to some Web content. But Atkinson said those requirements could drive away broadband providers from accepting stimulus money. With the requirements in place, "you'll see very little take-up of the grants," he said.

UAC Fix in Windows 7 Creates Security Hole, Blogger Says

2009-01-30T17:16:00.001-08:00

A change that Microsoft made in Windows 7 to improve its controversial User Account Control security feature has left the new OS less secure, according to a blogger who follows Microsoft closely.
Microsoft made the change to UAC, a feature that was introduced with Windows Vista, to make it more user-friendly in Windows 7. But the change has allowed for "a simple but ingenious override" that disables UAC without any action on the part of the user, according to the I Started Something blog written by longtime Microsoft watcher Long Zheng.
Microsoft added UAC to Vista in an effort to improve its security and give people who are the primary users of a PC more control over its applications and settings. UAC prevents users without administrative privileges from making unauthorized changes to a system. But because of how it was set up in Vista, UAC sometimes prevents even authorized users from being able to access applications and features they should normally have access to.
It does this through a series of screen prompts that ask the user to verify privileges, and it may require them to type in a password to perform a task. This can interrupt people's workflow, even during some mundane tasks, unless they are set as Local Administrator. The UAC prompts became so problematic that Apple even spoofed them in a television commercial, and Microsoft vowed to improve the feature in Windows 7.
Windows 7 is still in beta and not expected to ship until late this year or early next. Microsoft released the beta earlier this month and outlined the changes to UAC on the Engineering Windows 7 blog.
The changes revise the UAC's default setting, and that is where the security risk lies, according to Zheng.
As he explained in his post, UAC's default setting in Windows 7 is to "Notify me only when programs try to make changes to my computer" and "Don't notify me when I make changes to Windows settings."
UAC distinguishes between a third-party program and a Windows setting with a security certification, and control-panel items are signed with this certificate so they don't issue prompts if a user changes system settings, he wrote.
However, in Windows 7, changing UAC is considered a "change to Windows settings," according to Zheng. This, coupled with the new default UAC security level, means a user will not be prompted if changes are made to UAC, including if it was disabled.
With a few keyboard shortcuts and some code, Zheng said he can disable UAC remotely without the end-user knowing.
"With the help of my developer side-kick Rafael Rivera, we came up with a fully functional proof-of-concept in VBScript (would be just as easy in C++ EXE) to do that -- emulate a few keyboard inputs -- without prompting UAC," he wrote. "You can download and try it out for yourself here, but bear in mind it actually does disable UAC."
Zheng also posted what he said is a workaround for the problem on his blog.
Microsoft said on Friday through its public relations firm that it was looking into the problem and did not have an immediate comment.

Second Life Profitable Despite Interface Woes

2009-01-30T17:15:00.002-08:00

In exclusive interviews with The Industry Standard, Linden Lab's two top executives have confirmed that the company is still profitable and Second Life is continuing to grow users and expand its enterprise services. However, Linden Lab founder and chair Philip Rosedale and CEO Mark Kingdon admitted that the in-world experience still takes too long for new users to master, an issue that will require significant amounts of technological work to rectify.
The two executives spoke to the Standard at the company's headquarters in San Francisco earlier this month (see Interview with Linden Lab CEO Mark Kingdon and Interview with Second Life creator Philip Rosedale for transcripts).
Kingdon acknowledged an "incredible hype phase" that had introduced lots of people to the potential of virtual worlds, but had also put the spotlight on many negative aspects. He said that the company was in a "comfortable place" in terms of growth in active users, usage hours, and Second Life uptime.
Rosedale said that Second Life had moved beyond an emerging application for technology-savvy users. "There is a lot more diversity in use, demographics and behavior in Second Life today than there was, say, at the end of 2003," he said.
Kingdon echoed this assessment. "I think the world has gotten its head around the fact that virtual worlds are here to stay," Kingdon said. "There is a very compelling set of activities that virtual worlds are incredibly powerful for. They erase geographies, they allow for a type of interaction that you can't get in the real world and they bring with them really interesting economic and business opportunities for users."
Kingdon pointed to several localization projects for countries in Europe, Asia, and South America, and cited in-world training and remote meetings as compelling activities for companies. Both he and Rosedale portrayed Second Life as a competitor to enterprise video conferencing, which they believe is unable to match Second Life's ability to make people feel comfortable interacting with other remote users.
As for competing virtual worlds, Kingdon said he and his team tried to keep abreast of trends, but declined to name any current competitors.
Discussing Google's closure of Lively last year, Kingdon said it was a "natural" outcome, considering Google's focus and the state of the economy. "I don't think that Lively's departure is an invalidation of the market. I think, it's just recognition that, yeah, there is promise [and] a lot of hard work," Kingdon explained. "Google made the right decision and said, 'We need to kind of stick to our knitting in this economic downturn, in this climate, and focus our resources on some of our core properties,' which is quite natural."
Rosedale said There.com had some "unique" aspects and had effectively targeted certain vertical markets, but called it "substantially less interesting" in terms of the content that users can create. "The demographic is tighter, narrower, less diverse," he stated.
Linden Lab's CEO said that despite the recession, the company remained profitable. "We have not felt the same in world economic turmoil that the real world has faced," Kingdon said, noting that Second Life was an affordable entertainment alternative to activities such as going to a movie. "Dollar for dollar, it's high-value entertainment for the casual user," he said.
On the enterprise side, he and Rosedale described uptime improvements and new products, including a hosted service and a behind-the-firewall service nicknamed "Nebraska" aimed at companies with stronger security needs.
However, the Linden executives said that a lot of work remained to be done in terms of making the service easier to use. Rosedale singled out search, the user interface and new user orientation as needing major improvements. "We need to collapse the orientation experience on learning the interface down to a 30-minute timeframe," he declared. "We're not there yet."
Rosedale went on to describe the current interface as "overwhelming."
He said, "the basic UI of the software also needs to change. It has too many pixels," referring to the buttons, numbers, and other data presented to users on the screen. "They're all kind of demanding your attention -- your [Linden] dollar balance, your inventory window, all the buttons on the bottom bar, chat and text that are visible in the window, that's asking something of you, blue pop-ups that are coming up."
Rosedale said that while the work required to make the interface less complex was significant, it would have a huge impact on the adoption rate of virtual worlds. Currently, only 15% of the people who tried out Second Life continued to use the virtual world. "I'd like to triple that number," he stated.
Nevertheless, progress has been made in terms of making the technology more appealing to new users. Kingdon described how the old Second Life registration process -- a seven-page form which he likened to a mortgage application -- had been streamlined. "We've very substantially shortened the registration flow," he said. "We shortened it in July to one page and saw a very substantial increase in registration completions."
Kingdon added that the company has also implemented better email management techniques to increase activations, and was also paying attention to SEO, in order to help users get to helpful Second Life resources via Web search engines.

The Web 2.0 'Conversation' Is Really a Shouting Match

2009-01-30T17:15:00.001-08:00

Web 2.0 wonks like to gush about how the Internet these days is all about "joining the conversation." Lately, though, it's been more like a shouting match.
Today's example: The fall of Michael Arrington.
As Rodrigues & Urlocker (the Captain & Tennille of InfoWorld bloggers) have also noted, Michael Arrington is hanging up his keds at TechCrunch -- at least through the month of February, if not longer. The reason? He's sick of all the haters.
On his most recent blog post, Arrington said death threats he'd received last summer, coupled with recently being spat upon at a conference a few days ago, were key factors in his decision. Hey, nobody should have to endure stuff like that just for expressing their opinions, whether you agree with them or not.
But in true Arrington form, he couldn't just leave it at that. In an interview with the Wall Street Journal, he implicitly blamed popular blog sites Valleywag (now part of Gawker) and AllThingsD -- led by poppa bear Walt Mossberg of the Wall Street Journal and BoomTown's Kara Swisher -- for daring to question his ethics and (thus) inciting the haters. Quoth Mr. TechCrunch:
"Whoever is the top blog will get attacked by everyone else and that'll just be the way it is," Mr. Arrington said. "We really need to think about, the community of bloggers, if we're going to continue to slay our own for competitive reasons."
Apply your own cliche here -- glass houses, stones, heat, kitchen, pot, kettle, black, etc. Just about any of them work. And who exactly anointed TechCrunch "top blog"? I must have missed that press release.
Still, you have to give TechCrunch its due. In a few short years, it's grown from one guy spouting his opinions on startups to one of the most popular (and feared) news sites on the Net. It has broken some real stories -- like Google's acquisition of YouTube -- before the mainstream media had even heard of "viral video." Its reach is impressive. Even the Washington Post deigned to syndicate TechCrunch.
On the other hand, there's still too much of one guy spouting his opinions masquerading as real journalism for my taste. The site seems willing to publish any rumor, which means it's wrong a lot of the time. It's become a running joke that every week or so TechCrunch will post a story saying Google is going to acquire some company, and when it doesn't happen, post a second story saying they walked away from the deal. Rightly or wrongly, questions about Arrington's relationship to the companies he writes about continue to dog him.
(Note: This blog is sometimes guilty of much of the above. But then, I make no claims to be a news source. We're all snark all the time here in Cringeville.)
My real point is, Arrington's right: It has gotten nastier out there. Maybe it's always been this way, and the flame wars that used to be confined to alt.geek.whatever on Usenet have now exploded across the Net.
I see it here in the comments to this blog. All I need to do is pick the right topic -- anti- or pro-Microsoft, Apple, Linux; Scientology vs "Anonymous"; science vs faith; and anything that touches on politics -- and the anonymous posters come out with guns blazing. It's like pushing the flame button; it's automatic.
So far, the worst thing that's happened is people unsubscribing from the e-mail newsletter -- no death threats or spittle yet. But it seems like it's only a matter of time before that kind of thing starts happening to more of us.
Has the Net gotten nastier? Can "love keep us together"? E-mail me direct: cringe@infoworld.com.

AMD Set to Release DDR3-Capable Processors

2009-01-30T17:14:00.000-08:00

Advanced Micro Devices will soon introduce processors that are capable of supporting DDR3 memory, earlier than the company had anticipated.
The company in the next few weeks will launch new processors targeted at desktops that will include DDR3-capable memory controllers, said John Taylor, an AMD spokesman.
Taylor declined comment on specific processors being launched, though a leaked road map suggests the launch of new Phenom II and triple-core processors.
The support for DDR3 memory comes earlier than anticipated. Late last year the company said it aimed to add DDR3-capable Phenom II processors by the middle of 2009, but could push that up depending on factors including pricing of the memory.
Compared to current DDR2-capable processors, the new DDR3-capable chips will allow information from the memory to be communicated to a CPU faster, which translates to better PC performance. To run DDR3-capable processors, the company will introduce the AM3 socket for motherboards.
"The people who want the latest and greatest will want to use DDR3 memory," Taylor said.
AMD's decision to switch to DDR3 memory is to make CPUs faster so it can effectively compete with Intel in the high-end PC and server markets, said Dean McCarron, president of Mercury Research, a market analysis firm.
"When we make changes in PC architecture, it is because it's either faster or cheaper," said McCarron. For AMD, the decision was technical rather than financial, but the enhanced competitiveness could yield a financial benefit to AMD in the long run, McCarron said.
Intel's Core i7 processor for gaming systems, launched in November, already supports DDR3 memory. Intel is also adding DDR3 support to chips for portable products like laptops.
However, given AMD's inherent price advantage compared to Intel's products, price-sensitive buyers may initially oppose the high prices of DDR3 memory modules, McCarron said. As of early January, a 1GB DDR3 memory module running at 1333MHz was priced at $35, versus $12 to $14 per unit for a 1GB DDR2 unit.
"This is completely normal for technology. As the volume ramps [DDR3 memory prices] will come down," McCarron said.
Motherboard companies like Asus have already announced AM3-compatible motherboards, setting the stage for AMD to launch its new DDR3-capable processors, which could include new Phenom II processors. The new CPUs will include a DDR2- and DDR3-capable memory controller, allowing it to work with older motherboards with DDR2 memory.
AMD earlier this year launched new quad-core Phenom II processors, which the company called its "highest-performing" CPUs to date. Aimed at high-end desktop PCs, the chips ran at speeds of up to 3GHz and included 8MB of cache.
However, the Phenom II chips are capable of even faster clock speeds under certain circumstances. For example, the processors have been overclocked to run at speeds of up to 6.5GHz on liquid-cooled systems and up to 4GHz on air-cooled systems.
AMD remains on track to transition to DDR3 memory support for servers with the Maranello platform in 2010, Taylor said. The Maranello platform includes the six-core Sao Paulo and 12-core Magny-Cours chips.

Windows 7 Security Features Get Tough

2009-01-23T19:20:00.001-08:00

Two years after Windows Vista debuted, many companies have yet to upgrade. And in many instances their reluctance to migrate to Vista stemmed from concern about security.
Microsoft hass responded with its latest operating system, Windows 7, currently in public beta and expected to ship later this year. In Windows 7, new security features have been added, popular features expanded, and familiar features enhanced. Here's a look at a dozen or so security improvements that we expect will convince even the most recalcitrant corporate clients to upgrade.
Improved Migration Tools
Microsoft says that Windows 7 will be faster and easier to roll out across an enterprise than previous OS migrations were. Much of the credit for the anticipated improvement goes to new tools such as Dynamic Driver Provisioning, Multicast Multiple Stream Transfer, and Virtual Desktop Infrastructure.
With Dynamic Driver Provisioning, drivers are stored centrally, separate from images. IT professionals can arrange for installation by individual BIOS sets or by the Plug and Play IDs of a PC's hardware. Microsoft says that reducing the number of unnecessary drivers installed will help avoid potential conflicts and will accelerate installation. With Windows 7, as with Windows Vista, IT professionals can update system images offline, and even maintain a library of images that includes different drivers, packages, features, and software updates.
Rolling out any particular image across the entire network--or even installing individual images on desktops--is faster in Windows 7, thanks to the new Multicast Multiple Stream Transfer feature. Instead of individually connecting to each client, deployment servers "broadcast" the images across the network to multiple clients simultaneously.
Virtual Desktop Infrastructure (VDI), another desktop deployment model, allows users to access their desktops remotely, thereby centralizing data, applications, and operating systems. VDI supports Windows Aero, Windows Media Player 11 video, multiple-monitor configurations, and microphone support for voice over IP (VoIP) and speech recognition. New Easy Print technology permits VDI users to print to local printers. But use of VDI requires a special license from Microsoft, and doesn't offer the full functionality of an installed operating system.
Protecting Corporate Assets
Once the OS is installed, organizations may protect their assets with authentication for log-in. Windows Vista included drivers for fingerprint scanners, and Windows 7 makes such devices easier for IT professionals and end-users to set up, configure, and manage. Windows 7 extends the smart card support offered in Windows Vista by automatically installing the drivers required to support smart cards and smart card readers, without administrative permission.
IT professionals may further protect the contents of their Windows 7 volumes with BitLocker, Microsoft's whole-disk encryption system. Windows Vista users have to repartition their hard drive to create the required hidden boot partition, but Windows 7 creates that partition automatically when BitLocker is enabled. In Windows Vista, IT professionals must use a unique recovery key for each protected volume. But Windows 7 extends the Data Recovery Agent (DRA) to include all encrypted volumes; as a result, only one encryption key is needed on any BitLocker-encrypted Windows machine.
BitLocker To Go is a new feature that lets users share BitLocker-protected files with users running Windows Vista and Windows XP. The BitLocker To Go desktop reader provides simple, read-only access to the protected files on non-BitLocker-protected systems. To unlock the protected files, the user must provide the appropriate password (or smart-card credentials).
Application Control
Windows 7 also introduces AppLocker , an enhancement to Group Policy settings that lets organizations specify which versions of which applications users have permission to run. For example, a rule might allow users to install Adobe Acrobat Reader version 9.0 or later, but it might block them from installing legacy versions without specific authorization. AppLocker contains a rule-generation wizard to make the process of creating policies much easier, and it includes automatic rule making for building a custom white list.
System Restore, first introduced in Windows ME, gets a much needed update in Windows 7. First, System Restore displays a list of specific files that will be removed or added at each restore point. Second, restore points are now available in backups, giving IT professionals and others a greater list of options over a longer period of time.
The Action Center is a new, integrated Control Panel feature that gives Windows 7 users a central spot for locating tasks and common notifications under a single icon. The Action Center includes alerts and configuration settings for several existing features, including the Security Center; Problem, Reports, and Solutions; Windows Defender; Windows Update; Diagnostics; Network Access Protection; Backup and Restore; Recovery; and User Account Control. Popup alerts are gone in Windows 7, replaced by a new task tray icon (a flag with an X) that provides streamlined access to the problem directly or to the Action Center for more information.
Perhaps the most famous and most annoying form of Windows Vista notification comes from the User Account Control (UAC) feature, which flashes administrative warnings whenever you need to configure a system setting. In Vista the choices are stark: Endure the messages, or turn off UAC. In Windows 7, you have additional options. A slider bar configures the appropriate notification level for your computer, and by default UAC will notify you only when programs try to make changes to your PC.
Better Performance
Windows Defender, Microsoft's antispyware product, gains a much-needed performance enhancement in Windows 7. But Microsoft has removed the Software Explorer tool, asserting that the utility doesn't affect spyware detection or removal. That might be true, but Software Explorer would allow you to see what programs and processes are running, including ones that you may not know about or want. Perhaps Microsoft will reverse this decision by the final build.
Another new feature of Windows 7 is the Windows Filtering Platform (WFP), a group of APIs and system services that allow third party vendors to tap further into Windows' native firewall resources, thereby improving system performance. Microsoft stresses that WFP is a development platform and not a firewall in itself, but WFP does address a few of Windows Vista's firewall problems.
In Vista, Microsoft introduced the concept of profiles for different types of network connections--home, network, public and domain. This, however, bound corporate IT professionals whenever a remote user accessed their corporate VPN, because the firewall was already set as either "home" or "public," and corporate network settings could not be applied later. Windows 7 and WFP in particular permit multiple firewall policies, so IT professionals can maintain a single set of rules for remote clients and for clients that are physically connected to their networks. Windows 7 also supports Domain Name System Security Extensions (DNSSEC), newly established protocols that give organizations greater confidence that DNS records are not being spoofed.
Features for Mobile Users
Windows 7 has two enhancements designed for mobile users. With DirectAccess, mobile workers can connect to their corporate network any time they have Internet access--without needing a VPN. DirectAccess updates Group Policy settings and distributes software updates whenever the mobile computer has Internet connectivity, whether the user is logged on to a corporate network or not. This ensures that mobile users stay up-to-date with company policies. And with BranchCache, a copy of data accessed from an intranet Web site or from a file server is cached locally within the branch office. Remote users can use BranchCache to access shared data rather than using a connection back to headquarters.
Windows 7 also makes enhancements to event auditing. Regulatory and business requirements are easier to fulfill through management of audit configurations, monitoring of changes made by specific people or groups, and more-granular reporting. For example, Windows 7 reports why someone was granted or denied access to specific information.

Study: Spam Is Getting More Malicious

2009-01-23T19:19:00.002-08:00

Spam, especially junk e-mails with malicious links or attachments, continues to be a huge IT headache. Spammers are also getting more creative in their attempts to find victims, utilizing popular sites such as Facebook and Twitter, according to a report from UK-based security firm Sophos this week.
The consultancy published its latest spam trend report and said new figures reveal that spam is still causing problems for computer users. In the fourth quarter of 2008, Sophos research found one in every 256 e-mails contained a dangerous attachment in October. In November, that figure improved to one in 384. December saw a huge decline: Just one in every 2000 e-mails contained a spam. Graham Cluley, senior technology consultant at Sophos, said it is possible the drop-off may be related to the shut down of the McColo Corp., a Web-hosting firm that security experts believe was responsible for three-quarters of the world's spam.
"It's hard to say exactly what can be causing this," said Cluley. "Certainly that is possible."
Numbers for January have not been assessed yet and Cluley said it is too early to determine if the drop off in spam levels has continued, or if spam is now back at levels seen in earlier months. What is clear, said Cluley, is that more spam is malicious in nature now and often designed to infect users' computers via sophisticated malware attachments or a link to malicious or infected websites, in order to steal sensitive information. Cluley also said social networking venues, such as Facebook and Twitter, are now the hot targets for spammers.
"Spammers really took to using sites like Facebook and Twitter as a vehicle for their spam antics during the last three months of 2008," he said. "Cybercriminals have cottoned onto the fact that social networking users can be more easily fooled into clicking on a link that appears to have come from a trusted Facebook friend, than if it arrived as an unsolicited email in their inbox. The notorious Nigerian 419 scammers have even evolved, masquerading as Facebook friends in order to trick unwary users into parting with valuable sensitive and financial information. Ultimately, while users are still falling for these scams, the fraudsters will continue. And while the authorities are making great progress, everyone must take steps to ensure they don't fall victim."
Death to Spam?
The report also referenced a 2004 prediction by Bill Gates that spam would be a thing of the past in 2 years.
"The rumors of spam's death have been greatly exaggerated over the years the threat remains alive and kicking despite increased legal action against spammers, the occasional takedown of Internet companies which assist the cybercriminals, and constantly improving anti-spam software," said Cluley. "Many IT professionals cast doubt on Bill Gates' assertion back in 2004, deeming the timeframe of his pledge to be unrealistic. Although the latest stats show that the proportion of spam relayed per country may have decreased year-on-year, spammers have turned to more creative, not to mention devious, methods to ensure their messages reach as many unsuspecting computer users as possible."
And the Spam King Crown Goes to...
Between October and December 2008, the United States was responsible for most of the world's spam, according to Sophos. China was in the second spot and Russia was third. Sophos officials pointed to Canada, Japan and France as countries that have made progress in spam prevention. All three, considered "serial offenders" five years ago, are no longer present in the list of spam reprobates.
"Although there's no denying that some countries have significantly reduced their contribution to the spam epidemic over the past five years, the United States still holds the crown," said Cluley. "Though its spam contribution has significantly decreased since Bill Gates' proclamation, falling from almost half of all spam relayed at the end of 2004, to 21.3 percent by the end of 2007, and now resting at 19.8 percent, this shows there's certainly no quick fix."

Mac BitTorrent Users Warned of Trojan

2009-01-23T19:19:00.001-08:00

Mac users ill-advised enough to search for pirated copies of Apple's iWork 09 software could find themselves on the wrong end of an unpleasant and crafty new Trojan.
According to Mac security software company Intego, which has put out the alert, OSX.Trojan.iServices.A allows users to install a fully-working copy of iWork 09 as normal, but only at the price of letting malware bury into OS X using a rogue install add-on.
As with a lot of PC Trojans, the immediate purpose of the software is simply to compromise the OS X system comprehensively enough to allow for the downloading of further malware from a remote host, another way of saying that the user could be opening themselves up to more or less anything the writers fancy putting on the system.
According to Intego, this is no theoretical infection that will affect only a handful of people, having been downloaded at least 20,000 times using the BitTottent file sharing system in recent days.
Apple's iWork software, which would normally set the user back around £70 ($79), is an all-purpose program that includes document, spreadsheet and presentation features. The latest version that is being used as a lure on BitTorrent distributions sites, will be sought after by users of pirated software having been released only weeks ago.
The company stands to benefit from the alert of course - it is currently virtually the only Mac-only software security outfit. The big-name anti-virus products sold for Macs tend to be spin-offs from much more lucrative PC protection programs.
"Intego VirusBarrier X4 and X5 with virus definitions dated January 22, 2009 or later protect against this Trojan horse," the company said in a release.
The number of Trojans affecting Mac users is on a modest upward curve, helped the company said during a recent and separate Mac Trojan outbreak, by the tendency of some Apple users to see their computers as above Windows-like security woes. The number of companies that actively track malware targeting Apple users is also proportionately smaller than for Windows PCs.

RIAA Seeks to Block Streaming Video of Piracy Case

2009-01-23T19:18:00.000-08:00

A federal appeals court in Boston has agreed to hear a motion filed by the Recording Industry Association of America (RIAA) that seeks to prevent courtroom proceedings in a music piracy case from being streamed live on the Internet .
In an order issued Wednesday, a three-judge panel at the First Circuit Court of Appeals noted the public interest in the piracy case and the "substantial and novel questions" raised by the prospect of live streaming. The judges called on both the RIAA and the defense to submit legal arguments on the streaming issue in an expedited fashion. The court will then decide if any oral arguments are needed to "facilitate the decisional process," the order noted.
The RIAA is asking the appeals court to overturn a Jan. 14 ruling by U.S. District Judge Nancy Gertner that authorized live video streaming of an upcoming hearing in the piracy case, which involves several music labels and a 25-year old Boston University doctoral student named Joel Tenenbaum .
Tenenbaum is accused by the RIAA of illegally downloading and distributing hundreds of songs over a peer-to-peer network, although the trade group's lawsuit only lists seven of the songs. The lawsuit was filed in August 2007, but it shot into the public limelight last fall, when Harvard University law professor Charles Nesson began representing Tenenbaum in the case.
In October, Nesson filed a counterclaim challenging both the constitutionality of the federal Digital Theft Deterrence and Copyright Damages Improvement Act and the RIAA's attempted use of that law against Tenenbaum. Nesson also challenged the appropriateness of the massive fines - ranging from $750 to $150,000 per willful infringement - that are available to the music labels under the statute.
Gertner's live-streaming ruling related to a hearing on the counterclaim that originally was scheduled for Thursday in U.S. District Court in Boston. However, the hearing was postponed until Feb. 24 after the RIAA said that it planned to appeal the judge's ruling, which authorized the Courtroom View Network to send a live video of the proceedings to Harvard University's Berkman Center for Internet & Society. The center, in turn, would make the video stream available to the public on its Web site.
Nesson asked Gertner to allow the hearing to be streamed, claiming it would allow a broader Internet audience "to see what's at stake and just how out of proportion the [RIAA's] response is to the supposed infraction."
But in its appeal of the streaming order, the RIAA called Gertner's decision "wrong on its face" and "troubling in its application." The trade group said the fact that the video stream would be distributed by the Berkman Center, which Nesson co-founded, was unfair and prejudicial to the music labels. Such an arrangement "undermines basic principles of fairness and is flatly inconsistent with the public interest," the RIAA said in its motion to the appeals court.
The trade group also took issue with the whole idea of streaming a court hearing on the Internet. "Unlike a trial transcript, the broadcast of a court proceeding through the Internet will take on a life of its own in that forum," the RIAA said. It added that although Gertner's ruling mandates gavel to gavel coverage of the hearing, the feed could easily be edited, "spliced together" and re-broadcast in such a way that comments and legal arguments would be "taken out of context."
Gertner also erred in authorizing the broadcast because it was in violation of the district court's own local rules, which forbid such broadcasts, the RIAA claimed. At a minimum, the trade group said, Gertner should have consulted with the full panel of judges at the district court before authorizing the video transmission.
In a statement, Nesson questioned the RIAA's appeal and said the Berkman Center was "working hard" to ensure that it didn't remain the exclusive distributer of the courtroom video feed. "We welcome the RIAA's help in finding additional Web sites through which the proceedings can be viewed," he said.

A World Without Steve

2009-01-16T19:19:00.001-08:00

The news that Steve Jobs is stepping down as Apple CEO, however temporarily, gives an opportunity to think about what life would be like without Jobs.
No Steve in that Los Altos garage in 1976, no Apple computer. Wozniak alone couldn't have pulled it off.
If Jobs had not come back to rescue Apple in 1997, I sincerely believe there wouldn't be an Apple today. Its hardware operations would have been acquired and slowly subsumed by someone like Sun. The Mac OS would live on in cheap desktops, if it survived at all. More likely though is that it would have been squashed.
No iPods. We'd be forced to use whatever music player Creative or Microsoft came up with -- and it wouldn't be nearly as nimble as the Zune, which does its best to ape the iPod.
No iTunes. The record labels would eventually come up with some onerous, kludgy, unworkable system for buying music online (or they'd hire Microsoft to do it) that would drive even more people onto P2P networks. (Think Sony Connect.) And the TV and movie studios still wouldn't be close to distributing their wares over the wires.
No iPhone, certainly, and no iPhone wannabes flooding the market like there are now. It would be BlackBerrys, Windows Mobile, or bust.
I like to give Jobs as hard a time as the next guy -- OK, maybe the next 700 guys -- but I'm not ready for him to go. Despite the bluster, the arrogance, the Rushmore-sized ego, and the awful fawning that follows him from his army of spittle-licking lackeys, Jobs is a one-of-a-kind corporate leader who will be sorely missed. He gets what people want in a way no other tech CEOs do.
So I'm rooting for him to make yet another triumphant return in six months. Because with Gates gone, Ellison out of the public eye, and Jobs out of commission, who would be left for me to make fun of?
What do you think? Can Apple soldier on without Steve? E-mail me direct: cringe@infoworld.com.

Microsoft Sued Over Unified Communications Deal

2009-01-16T19:18:00.002-08:00

Microsoft has been sued by a small Wisconsin business for allegedly misrepresenting the capabilities of its Live Communications Server product, selling the company more licenses than it needed and not providing a refund or other products to solve its original problem.
Imagineering International filed its lawsuit in December in the Fond de Lac County circuit court in Wisconsin, accusing Microsoft of breach of contract and breach of warranties, among other offenses.
Imagineering claims Microsoft failed to resolve problems the company had with deploying an enterprise version of Live Communications Server, then did not replace the product with a revamped version, Office Communications Server (OCS), as Microsoft had promised.
Microsoft also never provided Imagineering with a refund for the products and licenses it purchased, after requiring Imagineering to destroy its licenses and the software as a condition of receiving a credit toward OCS, said Jeff MacMillan, president and CEO of Imagineering.
Imagineering, a 23-person IT consulting firm and reseller, had been a Microsoft partner for about 10 years at the time it purchased the products and licenses, he said. The company has since terminated its partnership with Microsoft.
Rather than responding in the same court, Microsoft filed papers Wednesday with the U.S. District Court for the Eastern District of Wisconsin in Milwaukee to move the case from the county court to the federal court, citing Imagineering's request for damages that exceed US$50,000 as one reason.
Cases heard in federal courts also tend to take longer to be resolved, and plaintiffs can lose some of their claims in summary judgment, said Michael Kuborn, an attorney representing Imagineering from the Curtis Law Office in Oshkosh, Wisconsin.
A lawyer representing Microsoft did not respond to a phone call requesting comment. A Microsoft spokesperson said via e-mail Friday that Microsoft is reviewing the allegations and will make its response in court.
Imagineering alleges in its complaint that on Oct. 7, 2005, it purchased Microsoft's LCS software, 1,500 Client Access Licenses and 1,500 External Connector Licenses for a total of $70,776. At the time LCS was Microsoft's software for providing a unified communications system, which links a company's voicemail, telephone system, e-mail and other employee communications services on the same software infrastructure.
MacMillan said Friday that Microsoft representatives had informed him that LCS had the capabilities his company needed to create a unified communications platform out of its disparate systems for telephony, voicemail, fax and e-mail. Microsoft also said it would provide remote desktop capability, which was key to Imagineering's deployment, he said.
Imagineering purchased the product and licenses mainly for an in-house deployment, but if that proved successful, the company planned to sell a similar offering to customers, MacMillan said.
The number of licenses his company needed to purchase seemed high for a company with only 23 employees. However, Microsoft employees brokering the deal said Imagineering would need licenses not only for its own employees using the new system but also for any customers who wanted to access it.
After Imagineering secured the product from Microsoft, it had trouble deploying the product, and so in October of 2005 it contacted Microsoft technical support, MacMillan said. "They determined we were given bad presale information and that the product would not work the way we had been told it would," he said.
Microsoft also informed Imagineering that it did not need licenses for its customers and had indeed purchased too many, he said.
The companies worked together to come up with a solution, which MacMillan said was to give Imagineering a credit equal to what it paid Microsoft to purchase the follow-up version of LCS, OCS, from Microsoft distributor TechData once that product was available. TechData also would provide Imagineering with the licenses it would need for its deployment, he said.
Microsoft released OCS in late 2007. Around that time, MacMillan said he contacted TechData about acquiring the product and the licenses, per the company's agreement with Microsoft. TechData informed him that it had no record of such a deal, he said.
MacMillan said he contacted Microsoft and again worked with it to try to resolve the situation. In February 2008 Microsoft informed Imagineering that it would give it "no more than $27,000" in credit to purchase additional hardware it would need to deploy OCS -- a more complex product than LCS -- as well as the license to deploy it, according to court documents and MacMillan. Imagineering was given seven days to accept or reject the offer, according to court documents.
At that point, MacMillan said, he was frustrated and disappointed at how Microsoft handled the situation.
"They've welched on every deal they put into place ... and then said, 'You paid $70,000, we'll give you $20,000, that will have to be good enough, you can accept it or you can reject it,'" he said. "We had to reject that."
Imagineering still has not successfully implemented a unified communications platform, MacMillan said, and does not have the money to do so. "The $70,000 we spent on this was basically what we had for the project," he said. "It's actually an extraordinary amount of money to us."
Imagineering is seeking a refund from Microsoft for the original amount it paid the company, punitive damages and attorney fees.

Conficker Worm Attack Getting Worse: Here's How to Protect Yourself

2009-01-16T19:18:00.001-08:00

Millions of Windows computers have been infected by a new computer worm dubbed "Conficker." The situation is "not getting better," but rather is "getting worse," according to security software vendor F-Secure.
Read how you can protect your PC here.
In a blog post, F-Secure security researchers report that the number of machines infected by the Downadup worm has skyrocketed from roughly 2.4 million to over 8.9 million in the last four days alone.
Downadup is a malicious worm that "uses computer or network resources to make complete copies of itself," according to F-Secure. And it may also include code or other malware that damages both a computer and network. The worm also goes by the names "Kido" and "Conflicker." Details on how it operates and how to remove it are here.
Once executed, Downadup disables a number of system services, including Windows Automatic Update, Windows Security Center, Windows Defender, and Windows Error Reporting. The worm then connects to a malicious server, where it downloads additional malware to install on the infected computer. Computerworld provides a more detailed report on Downadup's potential dangers.
Since Downadup uses random extension names to avoid detection, Windows users should make sure their security software is set to scan all files, rather than checking on specific extensions, F-Secure recommends.
The alarmingly high number of Downadup infections led Microsoft last Tuesday to enable its anti-malware utility, Microsoft Software Removal Tool (MSRT), to detect the worm. So it's important that Windows users, if they haven't already, download the latest Microsoft security patch that went out earlier this week.

Protecting Against the Rampant Conficker Worm

2009-01-16T19:17:00.002-08:00

Businesses worldwide are under attack from a highly infectious computer worm that has infected almost 9 million PCs, according to antivirus company F-Secure.
That number has more than tripled over the last four days alone, says F-Secure, leaping from 2.4 million to 8.9 million infected PCs. Once a machine is infected, the worm can download and install additional malware from attacker-controlled Web sites, according to the company. Since that could mean anything from a password stealer to remote control software, a Conflicker-infected PC is essentially under the complete control of the attackers.
According to the Internet Storm Center, which tracks virus infections and Internet attacks, Conficker can spread in three ways.
First, it attacks a vulnerability in the Microsoft Server service. Computers without the October patch can be remotely attacked and taken over.
Second, Conficker can attempt to guess or 'brute force' Administrator passwords used by local networks and spread through network shares.
And third, the worm infects removable devices and network shares with an autorun file that executes as soon as a USB drive or other infected device is connected to a victim PC.
Conficker and other worms are typically of most concern to businesses that don't regularly update the desktops and servers in their networks. Once one computer in a network is infected, it often has ready access to other vulnerable computers in that network and can spread rapidly.
Home computers, on the other hand, are usually protected by a firewall and are less at risk. However, a home network can suffer as well. For example, a laptop might pick up the worm from a company network and launch attacks at home.
The most critical and obvious protection is to make sure the Microsoft patch is applied. Network administrators can also use a blocklist provided by F-Secure to try and stop the worm's attempts to connect to Web sites.
And finally, you can disable Autorun so that a PC won't suffer automatic attack from an infected USB drive or other removable media when it's connected. The Internet Storm Center links to one method for doing so at http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html, but the instructions involve changing the Windows registry and should only be attempted by adminstrators or tech experts. Comments under those instructions also list other potential methods for disabling autorun.

Steve Jobs and Apple: A Reality Check

2009-01-16T19:17:00.001-08:00

Since Apple announced that Steve Jobs would be taking medical leave until June, I've seen rampant speculation on Steve Jobs' health, and I've seen some wonder if Apple would be able to survive without Jobs. It's all quite understandable; after all, Steve Jobs is by far the biggest figure in the company. But after reading a post by Brian Lam (warning: Lam uses lots of profanity) on Gizmodo where he becomes completely unglued when responding to criticism he and Gizmodo received regarding their coverage of Jobs' health, I really think it's time for us in tech circles to take a step back and get a reality check of the situation.
Apple is not a one-man company.
Ever since Jobs took the reigns of Apple in 1997 he has surrounded himself with a team of executives that reflect his vision for the company. Apple's chief designer Jonathan Ive is recognized as one of the top product designers around. Apple's Chief Operating Officer Tim Cook is a master of logistics. The point is, Apple has plenty of talent at its disposal to weather the storm and continue innovating.
There is only one Steve Jobs. There isn't a person on Earth who could actually replace him. That said, in Jobs' absence, Apple should be fine. There's enough of a brain trust there to be able to carry the company. When Jobs does decide to retire (for health reasons or otherwise), a "What would Steve do?" approach won't cut it of course, so Apple would be a different company without Jobs guiding it, but it wouldn't die.
In fact, since its inception, Apple has been a company that has fostered innovation. Apple innovated without Jobs, but what they lacked was direction. Jobs provided direction and focus to a company that had none in 1997. As long as Apple maintains its zeal for taking risks and pushing the envelope, and can stay focused, Apple should be fine with or without Jobs.
Speculating on Jobs's health is a waste of time and energy.
Let's all be honest: At this point, the only ones who likely know about the true nature of Jobs's condition are Jobs and his family, his doctors, and Apple's board and executives. Everything else at this point is essentially hearsay. Fellow journalists may have their insider sources, but with sources contradicting each other, I'd say there isn't a whole lot of stock we can put into them right now.
Jobs is a human being.
I think it's important to keep this in mind: Jobs is a person just like you and me. And while there should be a reasonable expectation for the CEO of a large corporation like Apple to be forthright about any matters—health or otherwise—that would prevent him or her from effectively running the company, beyond that, Jobs health should not be the matter of public discussion and speculation that it has become. All we know—and all we need to know as of right now—is this: Jobs has some health issues to deal with, he had to take a leave of absence, and he hopes to return to Apple in June. If anything changes, the public should know, but until then, let's give Steve Jobs our best wishes that he'll be back sooner rather than later, and let's let him be.

Advocates Disagree on Broadband Stimulus

2009-01-16T19:10:00.000-08:00

The U.S. government should provide money for broadband deployment in an upcoming stimulus package, several groups said Friday, but the broadband advocates couldn't agree on how the money should be spent.
A couple of speakers at a broadband stimulus forum Friday called for the government to give grants to broadband providers to roll out service to unserved or underserved areas. Another speaker called for tax credits, saying a grant program would take months to set up.
Another speaker suggested that none of the broadband money in the US$825 billion stimulus package being pushed by President-elect Barack Obama should go to large incumbent telecom and cable companies that now provide a huge majority of the broadband connections in the U.S.
"I'm fundamentally opposed to taxpayer dollars going to absentee-owned networks, unless there's no hope of a local, community-based network emerging," said Wally Bowen, executive director of the Mountain Area Information Network, a nonprofit broadband provider in western North Carolina. "Local networks are going to create local jobs; they're not going to outsource their tech support to India."
Bowen and other advocates of government broadband spending spoke at a New America Foundation event the day after the U.S. House of Representatives Appropriations Committee recommended $6 billion in broadband deployment spending as part of the larger economic stimulus package. The House version of the stimulus package bill would include $2.8 billion for the Rural Utilities Service (RUS) of the U.S. Department of Agriculture to give out as grants and loans to broadband providers.
In addition, the House bill would give another $2.8 billion to the U.S. National Telecommunications and Information Administration (NTIA) for broadband deployment grants, with $1 billion of that money going to wireless broadband projects. An additional $350 million would go toward a national program to map areas that don't have broadband.
About 25 percent of the NTIA broadband grants would go to areas without broadband, and 75 percent to areas with limited broadband options, according to the bill. The money going to unserved areas would focus on providing basic broadband service of more than 5Mbps of downstream speed for wired broadband or basic wireless broadband.
In order to quality for the 75 percent of the money going to underserved areas, a wired broadband provider would have to deploy service offering 45Mbps downstream speed, and a wireless broadband provider would have to provide 3Mbps of downstream speed.
Both the NTIA and RUS money would require providers to abide by net neutrality rules, which would prohibit them from blocking or slowing any type of legal Web content.
But the speed and net neutrality rules could limit the number of broadband providers that apply for the grants and loans, said Rob Atkinson, president of the Information Technology and Innovation Foundation (ITIF), a Washington, D.C., think tank. Broadband providers such as AT&T and Qwest aren't currently set up to deliver 45Mbps, he said at the New America Foundation event.
"The more public-interest requirements you put on these networks, the less investment you will get," Atkinson added. "I would not be surprised, by the end of 2009, we could see very little investment that will come out of the stimulus bill as currently structured."
Atkinson also called for tax credits to be part of the package, in addition to grants. Grant programs could take months to set up, while tax credits could kick in immediately, he said. ITIF's broadband proposal would not disqualify large broadband providers from getting stimulus money.
But other panelists said tax credits are difficult to track, and it would be difficult for government auditors to guarantee that tax breaks go directly to broadband deployment in new areas. In addition, speed requirements will be necessary to ensure that the U.S. doesn't have to pay for a new broadband deployment in a few years, said Benjamin Lennett, a senior program associate at the Wireless Future Program at the New America Foundation.
Rural areas, which will use broadband for things such as telemedicine and distance learning, may need higher speeds than many urban and suburban users, he added.
"Do we want to give rural areas ... inferior networks? Do we want to give them second-best networks?" Lennett said. "You're going to need fast speeds and lots of capacity. There's no way we can give a band-aid here and a band-aid there to get them to 5 or 1 megabit. That's just not going to cut it, two, three, five, 10 years down the road."
But Derek Turner, research director at media reform group Free Press, said the net neutrality requirements are even more important than speed requirements. "We don't want to be giving federal dollars to fund networks that are closed and discriminatory," he said.
No large broadband providers were represented at the forum, and some panelists didn't hold back criticism. Like Bowen, Mark Cooper, research director of the Consumer Federation of America, called for community-based broadband projects, instead of money going to the large broadband providers. Broadband stimulus money should go toward wireless broadband projects based in the communities they serve, he said.
"The cozy duopoly of telecos and cable companies has failed to deliver," he said.
• Sponsored Resource:Back up, access, share, and store all your family's digital media. Windows Home Server.

Privacy Groups File Mobile Marketing Complaint With FTC

2009-01-14T02:12:00.003-08:00

Two privacy groups on Tuesday asked the U.S. Federal Trade Commission to regulate how mobile marketers can use consumers' personal information, saying many people don't know when their information is being collected from cell phones and how it's being used.
The mobile industry responded that it already offers enough consumer protection through self-regulation, and one analyst said it is doing a good enough job that government intervention isn't necessary.
In their filing, the Center for Digital Democracy and the U.S. Public Interest Research Group asked the FTC to expand an existing inquiry into online interactive marketing to include mobile marketing.
They said the FTC should identify practices that compromise privacy and consumer welfare; examine opt-in procedures to make sure consumers are aware of what data they are giving up and how it will be used; investigate marketing tactics that target children and "multicultural communities," and create policies to halt abusive practices.
The filing acknowledges the industry's effort to police itself but says it does not go far enough. "Current self-regulatory privacy and marketing policies in the mobile arena are inadequate," the groups said. They also criticized the mobile advertising industry for creating its regulations without meaningful participation from consumers or consumer protection agencies like the FTC.
One of the major concerns is that mobile-phone customers don't know what they're agreeing to when they allow mobile operators to provide them targeted advertising, said Jeffrey Chester, executive director of the Center for Digital Democracy. Customers may not know that their personal data is being "retained, put in a profile and potentially shared" with other companies, Chester said.
The filing cites three examples of mobile marketers including Admob, Bango and Marchex that the privacy groups say collect information from mobile users without adequate notice.
While many companies ask customers for their approval to be part of marketing campaigns, those customers may not take the time to scroll through all the information on "tiny little screens," Chester said. "They don't know what they're getting into."
Mobile marketers and some other experts, however, argued that self-regulation is working. The industry has done a good job of protecting user privacy and probably doesn't need government regulations, said Greg Sterling, an analyst with Sterling Market Intelligence. Mobile operators have been cautious, "some argue overly cautious," about protecting consumer privacy, he said.
All of the operators in the U.S. are part of the Mobile Marketing Association, said Mike Wehrs, president and CEO of the group, which sets best practices for mobile marketers and investigates complaints from consumers. He defended the group's track record and said some of the allegations in the FTC filing are untrue. For example, consumers are welcome to offer input on how mobile marketing works, and anyone is invited to the MMA's open meetings, he said.
In addition, the MMA voluntarily briefs the FTC every six months, keeping it informed about changes in the industry and how the MMA is keeping pace, he said. If a government agency starts setting mobile advertising policy, it probably would struggle to make changes as quickly as an independent group like the MMA, he argued.
Wehrs and Sterling both contended that the advertising industry would not want to abuse the trust of consumers because their businesses depend on them. "This is a case where consumers' interests and the interests of the marketing company are relatively aligned, in the sense that if you get a lot of spam, people will be angry and the marketing company will be unsuccessful," Sterling said.
Google, whose mobile practices are referenced repeatedly in the FTC filing, said it is "keenly aware" of its responsibility to protect user privacy. "Whether it's for a desktop or for a mobile platform or device, we design products that give users meaningful choices about how they use our services and what information they provide to us, and let users know when products may collect personally identifiable information. ... We want to work with industry on developing best practices on privacy and we welcome all efforts to do that," the company said in a statement.
Still, given that the U.S. may be leaning toward a more regulatory environment, in the shadow of a financial crisis that many blame on a lack of regulation, the FTC will likely consider launching an investigation, Sterling said. He expects the FTC to at least hold hearings about mobile marketing, and potentially call for new guidelines. But he doesn't expect the FTC to create any sort of stringent regulatory system.

Bartz Wants 'breathing Room' for Yahoo

2009-01-14T02:12:00.001-08:00

Yahoo has been pushed around by outsiders and needs to chart its own course, incoming CEO Carol Bartz said Tuesday, though she hasn't yet determined what that course should be.
"More than anything, let's give this company some friggin' breathing room," Bartz told reporters during a conference call. "It's been too crazy, everybody on the outside deciding what Yahoo should do, shouldn't do, what's best for them. That's gonna stop."
Bartz took over Yahoo on Tuesday after a year of turmoil in which the company spent much of its time immersed in management upheavals and negotiations with Microsoft and Google. The company's management, especially cofounder and outgoing CEO Jerry Yang, has come under fire for letting opportunities pass by before its stock price plunged along with the wider market in the second half of the year.
Bartz, a former CEO of Autodesk, declined to tell reporters what direction Yahoo should take, saying she needs to first talk with employees, customers and investors to find out more about the company. She wouldn't say how long that would take.
"Let's not put ourselves on some crazy timeline, let's let this process evolve," she said.
Bartz did say Yahoo should focus on being the best company in all its markets, and that it should create new markets, both geographic and vertical.
"Yahoo has unfortunately been battered in the last year, and (this) caused it to look internally and be protective, and that's nonsense for such a great company and such a great franchise," Bartz said. The company should now "get outward-looking and kick some butt," she said.
The Yahoo board approached her about the job in December, Bartz said, and she was excited to jump in.
"I wouldn't have taken the job if I didn't believe there's a huge opportunity here," she said. "I just see this company as a company with enormous assets that, frankly, could use a little management."
Roy Bostock, chairman of Yahoo's board, thanked Yang as well as outgoing President Sue Decker, saying Decker would help to make a smooth transition and Yang would remain "actively involved" with the company. Bartz said she expected to take advantage of Yang's insights. "No one knows more about Yahoo than Jerry," she said.
Bartz may have more to say about the company's direction when she speaks on Yahoo's conference call on its fourth-quarter financial results, set to be announced Jan. 27.

Yahoo Taps Bartz as CEO, Decker Walks

2009-01-14T02:11:00.003-08:00

Yahoo said on Tuesday it has chosen former Autodesk CEO Carol Bartz as its next CEO to replace Jerry Yang, who announced his intention to step down in November.
The company also announced that President Sue Decker, who had been a candidate for the CEO position, has resigned and will leave the company after a transitional period. Decker worked at Yahoo for eight-and-a-half years and was a close supporter of Yang.
In a statement, Yahoo Chairman Roy Bostock said Bartz has the right mix of technology and business savvy to lead Yahoo, as well as a strong leadership style and a proven track record of driving growth, shareholder value and operational excellence.
"She is admired in the Valley as well as on Wall Street for her deep management expertise, strong customer orientation, excellent people skills, and firm understanding of the challenges facing our industry," Bostock said.
In the same statement, Bartz praised Yahoo for its assets, technology, staff and accomplishments. "There is no denying that Yahoo has faced enormous challenges over the last year, but I believe there is now an extraordinary opportunity to create value for our shareholders and new possibilities for our customers, partners and employees. We will seize that opportunity," she said.
Yang also praised Bartz, calling her "the ideal person" to drive Yahoo forward. "I believe Yahoo's best years are still ahead of it," he said in the statement.
Gartner analyst Allen Weiner called Bartz "a very solid pick" who should be an "easy sell" to investors, partners, employees and advertising customers. "She can bring the adult supervision the company has lacked," Weiner said.
He downplayed Bartz's lack of experience in the Web 2.0 world, saying plenty of people at Yahoo have that type of knowledge. Bartz brings a steady hand that will give Yahoo operational direction and strategic focus, just as Eric Schmidt has done at Google, Weiner said.
"She's the person who can come in and put the peanut butter back in the jar," he said, referring to a controversial memo a Yahoo executive penned in late 2006, in which he likened Yahoo's lack of focus to a spread of peanut butter: amorphous and shallow.
Industry analyst Greg Sterling from Sterling Market Intelligence said his initial reaction to Bartz is "cautious." Bartz seems like a solid, competitive manager and a safe choice for Yahoo, which could have gone for a flashier pick from the Web 2.0 ranks.
The question is whether she can lead Yahoo out of its yearslong crisis, given her lack of experience with the Internet and online advertising markets, Sterling said.
Neither analyst believes Bartz was brought in to broker a sale of Yahoo, nor do they expect her to implement major changes in technology strategy.
Bartz will take up her new job immediately. She also gets a seat on the Yahoo board.
Bartz was Autodesk's executive board chairman. She previously served as its chairman, president and CEO for 14 years, stepping down in April 2006.
While at the helm, Autodesk diversified its product line and saw its revenue rise from US$285 million to $1.5 billion, according to Autodesk's corporate Web site.
Before joining Autodesk, Bartz worked at Sun Microsystems, where she was vice president of worldwide field operations and an executive officer, and at Digital and 3M.
President George Bush appointed her to his Council of Advisors on Science and Technology, and she is on the boards of Intel, Cisco Systems, NetApp, and the Foundation for the National Medals of Science and Technology.
Her awards include being named as one of the 50 most powerful women in business by Fortune Magazine in 2005 and one of the world's 30 most respected CEOs by Barron's in 2005.
Bartz, who according to the Journal is 60 years old, will have her hands full as Yahoo CEO. The company has been in a technology and financial slump for several years. Multiple corporate shake-ups and reorganizations have failed to trigger a turnaround.
Yahoo has lagged behind large rivals like Google and small startups, unable to capitalize as much as it should have on many of the hottest Internet opportunities of recent years, like online video, search advertising, social networking and blogging.
There was much hope among industry observers when Yang, a Yahoo cofounder, took over as CEO from Terry Semel in mid-2007, but he failed to deliver on his goals to make Yahoo the preferred starting point for users, the preferred marketing vehicle for online advertisers and the preferred Web application platform for external developers.
His tenure included an unsolicited acquisition attempt by Microsoft, whose failure critics blamed on Yang and the Yahoo board. Later, a deal to let Yahoo run Google search ads collapsed after it became clear the U.S. government planned to challenge it due to antitrust concerns. The deal would have given Yahoo's revenue a significant boost.
Yang's tenure as CEO also featured two big rounds of layoffs, an embarrassing exodus of high-profile managers, disappointing financial results, a tanking stock price, free-falling employee morale and little or no advances in key areas, like search usage and search advertising.
He also oversaw the launch of several ambitious technology projects designed to improve Yahoo's services for end-users, developers, publishers and advertisers. Some have been delivered and others are in progress, like Yahoo Open Strategy (YOS), a project to rearchitect the company's sites and services to tap into the popularity of social networking.
With YOS, Yahoo pledges to open all its sites, online services and Web applications to outside developers, and give users a "social profile" dashboard to unify and manage their Yahoo services.
Yang plans to remain on the Yahoo board and retain his Chief Yahoo title.

Lenovo Puts Atom Chip in Fan-less Desktop

2009-01-14T02:11:00.001-08:00

Lenovo launched its first nettop on Tuesday, reaching out to budget buyers with an inexpensive, fan-less desktop designed for surfing the Web and other basic computing tasks.
The Lenovo H200 uses Intel's low-power Atom CPU to help the system consume less power than traditional desktops. Like netbooks -- the laptop equivalent of nettops -- it's designed for basic tasks like Web surfing and word processing, not to deliver the full multimedia experience of typical PCs.
The fan-less design of the H200 makes it Lenovo's quietest desktop, the company said. It runs the single-core Atom 230 processor with 512KB of cache, can have up to 2GB of RAM and comes with Windows Vista Home Basic. It will also include up to 160GB of hard drive storage, a DVD-R/W drive and Intel integrated graphics controllers.
The H200 is priced at US$399 with a 19-inch monitor and is available now through retailers and on Lenovo's Web site in the U.S. and some parts of Asia, including China.
Some users may wonder why they need a nettop, when netbooks that provide greater mobility and support similar applications can be had for $300 to $500. Kristy Fair, a Lenovo spokeswoman, said some users value a larger screen over the mobility a netbook affords.
"It's an affordable option for people looking for a package that has everything they need -- the desktop and the monitor," she said.
The company has also introduced more powerful desktops. The IdeaCentre K220 and K230 will be able to run Intel's quad-core processors and come with 64-bit editions of Windows Vista for faster computing. The K220 and K230 will support up to 4GB and 8GB of memory, respectively, and optional Blu-ray drives will be available.
The K220 and K230 will be priced at $449 and $499, respectively, and will be available later this month.

Dude, You're Getting a Dell Smart Phone!

2009-01-14T02:10:00.000-08:00

Okay, we're a bit premature here. But that might happen if one analyst's prognostications are true. According to an Electronista report, Shaw Wu of Kaufman Bros. is predicting that Dell is getting closer to launching its first smart phone, although no date has been set for the roll out. While Dell has played down the rumors, industry watchers have noted that the PC maker recently hired a former Motorola mobile phone exec to helm its global consumer products group.
Rumors of Dell's smart phone intentions have been swirling for many months, in fact. Reports from early last year had Dell working with Foxconn Group to develop handsets based on the Windows Mobile OS, and Dell vowed to roll out an iPod competitor. However, those projects may have hit the pause button, as Dell announced last fall that it wouldn't have an MP3 player ready for the holiday season.
Given the stunning success of the Apple's iPhone, the positive buzz generated by Palm's Pre and its clever webOS at last week's Consumer Electronics Show, and a growing number of Google Android devices, Dell knows it had better act-and fast.
But whose mobile OS should Dell use? Apple and RIM have designed their own in-house software-and done an excellent job of it-but building operating systems isn't exactly Dell's forte. Windows Mobile is the odds-on favorite, or Dell may have to go out and purchase a software maker. Whatever it does, Dell will have to launch one impressive handset to stand out in a very competitive market. Whether it can remains to be seen.

Diving Headfirst into Windows Beta 7

2009-01-14T02:09:00.000-08:00

Well, I did it. I made the move. Got off the fence. Took the plunge. Or, as my English language-challenged friend at State Bank of Mauritius would put it, I "did the necessary."
After thoroughly backing up my Vista x64 production laptop -- including redundant, manual copies of my data files, plus a full system image via Complete PC Backup -- I paved over the disk and installed the official Windows 7 Beta (64-bit edition).
[ For more help sorting through the early Win 7 benchmarks, check out InfoWorld's special report. ]
I've actually been sitting on the beta bits since before the Christmas break. However, I didn't want to commit totally until I could snag a working Product ID code or two from the Microsoft servers. Now, with my fully configured and activated Windows 7 environment in place, it's time to survey the landscape...and start complaining.
For starters, when will Microsoft get its act together and deliver ISO image-mounting support in Windows? It seems like anytime the OS is updated (we early Vista users were in this same boat three years ago), all of the best third-party mounting tools get broken.
Daemon Tools? Won't even install.
Virtual Clone Drive? Buggy and unstable (check their forums).
Fortunately, I was able to use VCD just long enough to get my major work titles (SQL Server 2008, Visual Studio 2008, Office 2007, and their respective service packs) installed from my MSDN ISO images. However, after the umpteenth random lock-up, I finally pulled Slysoft's normally well-behaved mounting utility from the system. I may give Alcohol 52% a try, but at this point I'm not optimistic.
And, frankly, I shouldn't have to be. This is the kind of base-level functionality that's supposed to be baked into the OS. Microsoft did it with VHD images. It can do it with ISO images as well. Heaven knows these folks distribute enough software in this format. MSDN and TechNet users pay good money for this stuff. The least Microsoft can do is provide a simple mechanism for mounting the images at runtime.
Note to Microsoft: Put a couple of those supersmart engineers on this, pronto! And while you're at it, have them back-port the solution to Vista and XP. Think of it as a kind of penance for putting us all through this same ISO-mounting hell again.
Also, what's the deal with Skype? Version 3.8 is still completely hosed under Windows 7. It won't connect to the peer-to-peer network and crashes mere seconds after loading. I'm now forced to use the butt-ugly Skype 4 beta. Truly a painful experience!
Finally, who screwed up Internet Explorer's networking? If I have more than one NIC enabled on the system (for example, one of the VMware Workstation virtual adapters or even Microsoft's own Loopback driver), IE takes forever to load. And once it is loaded, opening new tabs is painfully slow. If I then disable the extra adapters (so only my one primary wireless connection remains), the problem disappears. So, it's clearly related to those multiple NIC drivers.
Other nits:
• Chrome (both 1.x and the newer 2.x pre-beta) didn't work at first under the x64-bit edition. I had to add the "—in-process-plugins" parameter to get it to load properly. Given my issues with IE, mentioned above, the inability to run Chrome properly was nearly a deal-breaker for me. Bullet dodged.
• The Intel 5300-series Wi-Fi connection on my Dell Precision M6400 test bed refused to wake up after a suspend/resume cycle. I had to disable power management for the device in order to regain my sanity. Of course, this means the system's battery life takes a hit, but it's better than having my laptop go "deaf" every time I put it to sleep.
• My tray icons keep disappearing! No matter how many times I tell Windows to leave them visible, it inevitably starts hiding one or more of them for no apparent reason. I've had to resort to disabling the notification icon hide function altogether and leaving them all visible, all the time. Very annoying.
• Those snazzy new Task Bar thumbnails don't always show the updated window contents. For example, when I check to see the status of a download in Free Download Manager, I often find that what the thumbnail shows and what's really in the status window (time remaining, bytes downloaded, etc.) are entirely different.
• What's with the hide-and-seek game for legacy features? The Add Hardware Wizard, which I use to install the aforementioned Loopback adapter, is now missing from Device Manager. You have to launch it from the Start Menu search box (filename is hdwwiz.exe). Also, the graphic equalizer in Windows Media Player is now buried in an unmarked, drop-down menu button thingy in the Now Playing view. Had to hit up Google to figure that one out.
On the plus side, Windows 7 definitely feels crisper than Vista. The UI is highly responsive, though I wonder how much of this is just smoke and mirrors (e.g., the Windows animation speed for minimizing/maximizing seems to be set higher under Windows 7) since benchmarks show that the system is actually performing about the same. Regardless, it's a fresh departure from my uneven Vista experience. And I'm really digging the new task bar, especially the various Aero "peek" functions. Definitely one of the more poorly understood features of the new Windows.
Bottom Line: Bugs or no, I think I'll stick around for a while -- if for no other reason than I really like that new task bar. Once you fully embrace it -- and this means using the default configuration with the big, grouped icons and no text labels -- you'll find that it's quite a bit more efficient to use than the old task bar.
I'll talk more about this next week. In the meantime, good luck downloading those beta bits!

Intel-backed Enterprise 2.0 Suite Is Discontinued

2009-01-09T02:16:00.001-08:00

An Intel-backed suite of Enterprise 2.0 software announced with much fanfare a bit over two years ago is being put out to pasture.
SuiteTwo, announced in November 2006 at an O'Reilly Media Web 2.0 show, is no longer being sold, and its maintenance period for existing customers will close at the end of this year.
"We're going through the end-of-life process for SuiteTwo," said Dominic Sartorio, senior director of product management at SpikeSource, Intel's lead partner in the effort.
When it was announced, SuiteTwo was seen as concrete proof that CIOs, IT directors and business managers had begun seriously considering the use of Web 2.0 technology in their workplaces.
In a bundle integrated and maintained by SpikeSource, SuiteTwo included blog publishing software from Six Apart, RSS content syndication software from NewsGator, and SimpleFeed and wiki software from Socialtext.
Backing the project was Intel Capital, Intel's venture capital arm, while Intel's Software and Solutions Group would hawk it through its large OEM (original equipment manufacturer) and reseller channels. Tech Data was later brought in to help with fulfillment. SuiteTwo could be bought as packaged software, hosted software or pre-loaded into a hardware appliance.
SpikeSource has notified the about 80 companies that use SuiteTwo regarding the phaseout and will provide migration assistance to them, Sartorio said. "We're going to be there to help customers, advise them, to do what's right for their deployments and users," he said.
One customer that will seek migration assistance from SpikeSource is Clinical Trial Semantics Inc. CTSi uses SuiteTwo as a key part of its project to build a Web-based system to help cancer patients discuss with their doctors appropriate clinical trials they can consider participating in as part of their treatment.
"We probably over-invested in a platform that clearly didn't have the user base," said CTSi CEO Etienne Taylor.
So far, SpikeSource has been a very responsive vendor to CTSi during the year or so that the nonprofit has been using SuiteTwo.
"Their professional services department has helped us way above and beyond the economics of having us as a customer," Taylor said. "They've been wonderful."
However, one thing SpikeSource didn't do was alert CTSi about its plans to phase out SuiteTwo. "They forgot us. Nothing personal, I'm sure," Taylor said with a chuckle.
For now, SuiteTwo has served its purpose very well in the project's first stage of development, and CTSi, which is working with the American Cancer Society, can see viable migration options, Taylor said. "It's kind of OK. A lot will depend on what we do next with SpikeSource."
The concept behind SuiteTwo was right, said Forrester Research analyst Oliver Young. Companies are adopting blogs, wikis, enterprise RSS and other Web 2.0 technologies to improve collaboration and communication among their employees, partners and customers. "The market has moved in that direction pretty aggressively," he said.
"The problem with SuiteTwo wasn't the idea. The problem was the execution. They were trying to cobble together products from five or six independent companies, and it never looked like anything more than a bunch of applications that were duck-taped together," Young said.
Consequently, after its initial splash, SuiteTwo didn't get nearly as much attention from potential customers as its capabilities would have otherwise merited, and it became a sideshow for the partner vendors involved as well, Young said.
"SuiteTwo had a lot of great ideas [behind it] but there were shortcomings in the implementation and go-to-market strategies," said Brian Kellner, NewsGator's vice president of product management.
SimpleFeed's CEO Mark Carlson concurs. "All of our involvement pretty much stopped three or four months after the initial SuiteTwo announcement," he said.
While SuiteTwo failed to gain traction, vendor partners like NewsGator and Socialtext noticed that demand for a suite like that was real and expanded their own offerings beyond their niche areas to offer more comprehensive collaboration and communication functionality.
"We started seeing that the social side of our solutions had a lot of value to offer and we started going down that path," Kellner said.
For example, in expanding beyond their original niches, SocialText and NewsGator have replicated not only the SuiteTwo components but also newer ones, like workplace social networking, activity notification feeds and Twitter-like microblogging status updates.
"It was difficult for example in the SuiteTwo architecture to get a notification that someone had posted a new blog post, or that someone had updated a wiki page, or to pass information back and forth between the various solutions. It was a lot of work," Kellner said.
There are no hard feelings between the SuiteTwo partners and SpikeSource, whose migration plans for SuiteTwo include steering customers toward the partners. Since SuiteTwo is a superset of partners' software products, migration should be straightforward, he said.
Forrester's Young agrees. "The underlying products in SuiteTwo and their vendors are still here and innovating. It shouldn't be hard for a SuiteTwo customer to go to these vendors and put the thing back together," Young said.
Young's advice is for SuiteTwo customers to identify which component is delivering the most value for them and approach that vendor first.
SpikeSource pulled the plug on SuiteTwo in part because it wasn't in its best interest to focus on any particular software market segment, such as enterprise 2.0 products, CRM (customer relationship management) or content management, but rather to stick to its strengths: to assist ISVs with services like code testing, software maintenance and development.
As such, SpikeSource is focusing on its new Solutions Factory, launched in April 2008 and described as an automated platform for assembling, testing, packaging, certifying and updating software from ISVs. Along with the Solutions Factory launch, SpikeSource also announced that it had closed a new round of funding led by Intel Capital. Intel also uses SpikeSource's Solutions Factory services in its Intel Software Partner Program, Sartorio said.
Ironically, Intel still seems interested in Enterprise 2.0, judging by a demo of a workplace social-networking system that its CEO, Paul Otellini, gave in November at the Web 2.0 Summit in San Francisco, two years after SuiteTwo's introduction.
The demoed system included Web-based enterprise collaboration tools for social networking, blogging, wikis, online meetings and syndicated feeds. A company like Intel, with 86,000 employees worldwide, would put such a system to good use to let staffers better collaborate, obtain training and education, and find the data they need to do their jobs, he said.
Such a social-networking system for the workplace, which would require strong security and control features for IT departments, doesn't exist, he said. "I don't see any company really addressing this," Otellini said.
Maybe Otellini never paid close attention to SuiteTwo, which could have very well become such a system. Intel declined to comment about SuiteTwo.
Actually, if he moves quickly, Otellini might still be able to place an order for SuiteTwo: At press time, SpikeSource hadn't yet updated the SuiteTwo Web site to indicate that the product is being discontinued, and its ordering page remained online as well.
Asked for further information about the enterprise social-networking system Otellini had demoed, an Intel spokesman said in an e-mail that it had been "a mock-up done for the sole purpose of his keynote, with no plans to productize."
At his company's Web 2.0 Summit show floor booth in November, an amused Ross Mayfield, CEO of Socialtext, remarked: "We've had a lot of people rushing to our booth as a result of the Intel presentation."

Lenovo Brings Wii Functionality to PCs

2009-01-05T01:37:00.001-08:00

Taking a page from Nintendo's Wii gaming console, Lenovo on Monday announced an all-in-one PC with a remote control that doubles as a motion-based gaming controller.
Like the iMac, the all-in-one IdeaCentre A600 combines a monitor and CPU in a thin system. It will be on display at the Consumer Electronics Show from January 8 to 11 in Las Vegas.
Its wireless remote control is similar to Nintendo Wii's Wii Remote, which allows users to interact with a video game by waving or pointing the game controller. Using motion-sensing technology, the Wii Remote becomes a racket when swinging during a tennis game, or a weapon when playing a fighting game.
Lenovo's gadget mimics the Wii's approach.
"We have an example of a bowling game [where] you can wave the remote and that actually controls your game," said Ninis Samuel, director of marketing strategy and programs.
The company is bundling some motion-based games with the PC to use with the remote-based gaming controller. Titles of the games weren't immediately available.
Lenovo is trying to capitalize on the trend of entertainment options merging into the PC. Few are able to play motion-based games, which could make this motion-based game controller a pioneer.
In addition to controlling TV functions and video recordings on the PC, the remote control can also be used as an air mouse that moves the mouse pointer when waved. It has some advantages over a conventional mouse -- it can function without being on a surface and be used at a distance -- when sitting on a couch, for example.
If the air mouse wasn't enough, the remote also works as a VOIP (voice over Internet protocol) handset. "If you have telephony software on your PC like Windows Live or Skype, you can use your remote to make those phone calls because it essentially can act as a phone," Samuel said.
The IdeaCentre A600 starts at a price of US$999. The desktop has a 21.5-inch screen that supports 1920 by 1280-pixel resolution for high-definition video playback. It runs on Intel Pentium Dual Core or Core 2 Duo mobile processors, supports up to 4GB of RAM and up to 1TB of storage. It includes Wi-Fi wireless networking and runs on the Windows Vista OS.
Options include the remote control, Blu-ray DVD player, a TV tuner and a Advanced Micro Devices' ATI graphics card. The desktop will be available worldwide by the beginning of March.
The desktop is part of a new portfolio of entertainment PCs that Lenovo plans to show at CES. The company is also rolling out a new laptop line, the IdeaPad Y series, which is targeted at mainstream users looking to create and view multimedia content. Lenovo has added features that can make watching movies an easier and enjoyable experience.
For example, the laptops have the "OneKey" feature, in which pressing one button "optimizes" the experience of watching movies by enhancing the sound and visuals, according to the company.
Another feature includes ambient light sensors that adjusts screen brightness based on the user's surroundings. "[It] uses a sensor on the actual lid of the laptop that senses whether or not you are in a darker or lighter room. Then it adjusts the brightness and the graphics to your environment," Samuel said. The feature is available only in the IdeaPad Y650 laptop, which has a 16-inch screen.
The IdeaPad Y series laptops come with screens ranging from 14 to 16 inches, run on Intel Core 2 Duo processors and include Windows Vista. The weight of the laptops ranges from 4.6 pounds (2.09 kilograms) to 6 pounds. The laptops will become available worldwide by the beginning of March, Lenovo said. Pricing was not immediately available.

How to Succeed in Tech in a Downturn

2009-01-05T01:36:00.001-08:00

The economy is in trouble -- everywhere. Even outsourced providers are nervous. Already under stress, IT staffers see their jobs getting more and more difficult as they must do more with less, all while wondering if they'll keep their jobs at all.
That's why you need a plan for your tech career. The worst thing you can do is give up or panic. Although tech jobs are under increasing pressure, the reality is that the technology jobs market overall is still doing better than the market for other types of jobs. That doesn't mean you're immune from layoffs, stagnant salaries, or increasing workloads, but it does mean you have more options than many other workers -- if you're willing to be flexible.
[ InfoWorld has put together a special package of stories to help IT workers through the current tough times. Among the highlights: * Slideshow: Where IT jobs are headed * Special report: 2009 IT career survival guide * Special report: Where the tech jobs are overseas (and how to get one) * Special report: Tech workers under fire * Special report: IT and the financial crisis * Get sage advice on IT careers and management from Bob Lewis in InfoWorld's Advice Line blog and newsletter. ]
First, the bad news on tech jobs. There's plenty of data to support the fears that many tech workers have about their job security and ability to make ends meet. For example, more than 50,000 tech workers lost their jobs before the financial meltdown hit, and more jobs are in danger.
That trend translates to income pain for even the survivors. According to the 2008 salary survey by our sister publication Computerworld, bonuses for IT workers rose only 0.2 percent from 2007 levels. At a time when 3 to 4 percent salary raises are failing to keep up with inflation rates that are rising above 5 percent, those dwindling bonuses are making tough times even more challenging for IT professionals.
And stress levels are up. That same Computerworld survey shows that only 14 percent of respondents did not feel more stressed than a year earlier. Shrinking budgets are one reason. "Companies are in the mind-set of not spending in the next 3 months and increasing only 1 or 2 percent in the next 12 months. That's quite a change from last year when it was between 7 and 8 percent," notes Steve Minton, vice president of worldwide IT markets at IDC.
Having desirable tech skills is keyThe United States and Europe appear to be especially hard hit, though the downturn is being felt worldwide. Still, tech workers might consider moving to China, Canada, or other stronger markets where the demand for IT skills -- and the opportunities to develop new ones -- remains good. A move abroad may also give you more than technical skills: It can make you more appealing to companies that have global teams, an increasing reality everywhere.
To remain competitive, IT workers need a combination of the 30 essential basic skills -- including, according to one survey, strong ethics and morals -- and abilities in emerging recession-proof areas where demand remains high, such as security, VoIP, and wireless. And don't forget about not-so-hot areas that are critical to companies' abilities to keep running: Cobol skills can be great job insurance, for example. Also, look to certain skills that have been hot for a while and, thus, tend to be neglected, such as open source, .Net, and Java.
Certifications also can help, especially management ones. But beware: Certifications are not equally valuable. Some are simply expected -- and may be necessary to even be considered for a job -- while others are superfluous. That's especially true for technical certifications; outside of security and networking, they're not proving that valuable. Those that tend to give you an edge involve management and business-specific training -- skills that business managers more easily understand than technical ones.

Going Green to Save the Green

2009-01-05T01:35:00.000-08:00

Could saving the Earth -- and your company's bottom line -- be as simple as using fresh air to cool your data center?
It's not quite that simple, but it can be one step toward those goals, because companies that use natural air to cool their facilities are seeing big benefits on both the environmental and financial fronts. In fact, IT leaders, analysts and environmental advocates say there are plenty of opportunities for tech organizations to create more Earth-friendly operations that cut energy needs and slash a company's carbon footprint while saving money, too.
But many organizations still aren't capitalizing on such initiatives -- even the ones that are relatively easy and inexpensive to implement.
IT executives who responded to Computerworld 's annual Forecast survey seem to echo that reluctance. Nearly half (42%) said their IT departments have no plans to launch projects in the next 12 months to reduce energy consumption or carbon emissions, and nearly three quarters reported no plans to create committees to oversee energy-saving initiatives.
Yet experts say organizations that ignore green computing now are going to have to catch up if they want to stay competitive. "The green issue is not going to go away. There's too much at stake," says Rakesh Kumar, an analyst at Gartner Inc.
That's not to say IT leaders don't have their reasons for staying away from green computing. Kumar says some of them think it's a fad. Christopher Mines, an analyst at Forrester Research Inc., says others believe global warming is a crock and that there's no need to act on the issue, or they see green as merely increasing expenses.
Many others are nervous about reworking established systems and processes. "The last thing these people want to do is take a screwdriver to IT processes that work and start re-engineering them to make them more efficient," Mines says.
Early Adopters
Increasingly, however, IT leaders and other executives are putting aside such concerns and pushing for green IT initiatives.
When IDC surveyed 300 CEOs for its September 2008 "U.S. Green IT Survey," 44% of the respondents said that IT will play a very important role in their organizations' efforts to reduce their environmental impact. Compare that to the 2007 survey, in which only 14% of CEOs said they felt that way.
The 2008 survey also showed that energy costs were the most pressing reason for the adoption of green IT.
"We don't see many or indeed any companies that are hesitant to explore green IT projects," IDC analyst Vernon Turner wrote in an e-mail on this topic. "In fact, the scary thing is where to start, and it may be that reason why there is somewhat a feeling of lost souls. There has been a lot of marketing by the IT vendor community around green, and I think that CEOs and CIOs are 'green-washed' by it."
To be sure, developing enterprisewide green policies is a major undertaking. On the other hand, IT departments can implement some green IT initiatives without reworking entire policies, processes and procedures -- and without spending a lot of cash.
Moreover, they can sell management on these projects based not just on the initiatives' environmental merits but on their financial rewards as well.
"A lot of stuff is going to give you a short-term payback," Kumar says. He says that given today's economy, CIOs should focus on green initiatives that will have paybacks well within 18 months. Projects with such quick ROI range from reducing energy demands by enabling more telecommuting and teleconferencing to consolidating data centers, he says.
"These, in our opinion, equal green IT," Kumar says.
With so many focused on reducing energy demand, IT organizations can easily sell initiatives that reduce power consumption -- a quick way to save money and become green, says Katharine Kaplan, product manager at Energy Star for Consumer Electronics and IT at the U.S. Environmental Protection Agency.
"Power management is probably one of the easiest, low-cost ways to get big, big savings," Kaplan says, pointing out that using power management features on desktop PCs can save $50 per computer per year. Enabling power management tools on monitors can save another $12 to $90 annually per monitor.
Becky Blalock, senior vice president and CIO at Southern Co., an Atlanta-based energy company, says her organization is implementing power management technology to ensure that its 26,000 desktops are asleep at night and during other times of inactivity. Although the numbers aren't in yet, Blalock says she expects high savings throughout the organization.
Managing desktops is just the start, says Henry Wong, senior staff technologist in the eco-technology program office at Intel Corp. He points out that better asset management is another simple step that can cut energy demand and costs. Just examine your operations to identify and turn off any device that isn't used or needed.
Mark O'Gara, vice president of infrastructure management at Highmark Inc., a health insurance company in Pittsburgh, says he's examining the need for any device that draws power -- any fax machine, printer or copier -- and figuring how to reduce its energy demands by either using power management tools or getting rid of the device. He says he's working with the company's facilities department to get baseline readings so he'll be able to measure progress.
"You can start to see what energy we use, find opportunities to reduce power costs and find ways to reduce it through capital improvements," O'Gara says.
Another quick way to introduce green benefits that have financial paybacks is through refresh initiatives and procurement policies, says Michelle Erickson, initiative director of the sustainable IT program in global operations and technology at Citigroup Inc. in New York. For example, Citi is looking at implementing thin clients, which, because they have lower power needs, save money and reduce the company's carbon footprint.
Erickson also recommends setting procurement policies that specify that new equipment must be Energy Star-complaint, thereby ensuring that the company is getting more energy-efficient computers. And with new Energy Star standards rolling out in 2009, the policy will apply to servers too.
Similar strategies can be employed in the data center, Wong says. Look at the machines you have, and consolidate where you can to maximize the use of each server -- but make sure that you can still meet the needs of your business units.
"We did this at Intel and had a $3 million cost avoidance," Wong says. The dollar savings came from not having to build a new physical structure and pay for that new building's ongoing maintenance. As for the green benefits, there's less demand for power and new equipment.
"You can see another building that doesn't have to exist anymore. And it's the HVAC system, the people, the maintenance area -- it's not just IT. That's a really big to-do," Wong adds.
But even organizations that aren't ready for those kinds of projects can simply start by controlling the temperature, Wong says. Although it will be necessary to monitor the humidity when doing so, most companies can raise the temperature at least a few degrees and start lowering their air conditioning demands. And don't forget about using that natural air for cooling.
It might not be the biggest step, but it's a start.

Memo to Vendors: Here's How to Build a Winner

2009-01-05T01:34:00.000-08:00

Why do some people prefer Windows XP and Mac OS X over Windows Vista ? After all, Vista is pretty and sleek and much more advanced than XP, and, in many areas, Mac OS X. Why is there so much love for Xbox, but none for Windows Mobile ?
Why do BlackBerry users love their BlackBerrys, but the public is lukewarm about Palm devices?
Why is the Amazon Kindle, which is an unsophisticated, clunky, poorly designed gadget so popular with owners?
Why do people love plain, ugly Gmail?
The answer to these questions is a mystery to most of the companies that make PCs, gadgets, consumer electronics devices and to software makers. The industry spends billions on usability testing and user interface design. Unfortunately, that money is mostly wasted.
The problem is that there are too many technologists in technology. The technology is only half the equation. The other half is the human, that irrational, impulsive, impatient, power-hungry gratification machine.
When you ask someone what they really want, they won't tell you the truth because they're not aware of the truth.
Both users and product designers alike talk about user interface (UI) consistency, usability and simplicity, and system attributes like performance and stability. What's missing is that these attributes are means to an end. The real issue is always the user's physiological feeling of being in control. And control comes in many ways:
Consistency: Designers focus on UI "consistency," but why? Consistency gives predictability, which gives users a feeling that they know what will happen when they do something -- even for the first time. It's a feeling of mastery, of control.
Usability: One of the errors software and hardware designers make is to base their UI decisions on the assumption that the user is an idiot who needs to be protected from himself. Give this moron too much rope and he'll hang himself, the reasoning goes. But instead of taking the Microsoft route -- burying and hiding controls and features, which protects newbies from their own mistakes but frustrates the hell out of experienced users -- it's better to offer a bullet-proof "undo." Give the user control, let them make their own mistakes, then undo the damage if they mess something up.
Simplicity: Simplicity is complex. And there are many ways to achieve it. One way is to insist on top-to-bottom, inside-and-outside simplicity. Extreme examples include the original Palm Pilot organizer, Gmail and RSS feeds. And then there's the illusion of simplicity, which is the Microsoft route. In trying to be the operating system vendor for all people and all tasks, Microsoft Windows and Windows Mobile are extraordinarily complex pieces of software engineering. To "simplify," the company hides features, buries controls and groups features into categories to create the appearance of fewer options, without actually reducing options. (From all accounts, it appears that Windows 7 will offer more of the same.) Both extremes result in something you could call "simplicity." But one version thrills users by putting them in control. The other frustrates them by taking away control.
Performance: Everyone hates slow PCs. It's not the waiting. It's the fact that the PC has wrenched control from the user during the time that the hourglass is displayed. That three seconds of staring at the hourglass is three seconds when you feel utterly powerless. Fast computers are good because they keep the user in control.
Stability: Designers focus on system "stability," but it's not because they worry about time wasted, though that's how users tend to talk a lack of stability. Like the performance issue, instability is about the theft of system control from the user. People waste all kinds of time on all kinds of things, and usually don't mind doing it. What enrages people is when somebody else forces wasted time on you. Blue Screens of Death are more akin to running into unexpected traffic jams or having somebody take away the TV remote control. You're forced into putting your objectives on hold, and left feeling powerless.
One reason for the industry-wide pandemic of frustrating products is that the whole culture of usability testing doesn't emphasize user feelings of control. Microsoft does usability tests, for example, but its tests are flawed. Typically, it sits random people in front of a PC in a usability lab. Victims are directed to do various tasks, and asked what they're doing and thinking as they try to complete those tasks. All of this is monitored, and everything is recorded.Microsoft usability testing tends to focus on enabling users to "accomplish goals." Microsoft categorizes these goals according to their educated preconceptions about what people are trying to do based on their jobs or user categorization are you a student, middle manager, designer, for instance. So Microsoft focuses on results.
My view is that how the user feels during the process is more important than anything else.Here's the problem. In these scenarios, users are using somebody else's PC. They expect and assume that the software is in control. There is no psychological feeling of "ownership" over the equipment or the software or the work or anything. So the most important element -- the sense of control people feel when doing their own work on their own PCs in their own homes -- is missing entirely from the tests.
During usability tests, users are asked constantly about the software. And that's the wrong question. When real people are doing real work, they're focused on their own desires and objectives and are frustrated or not frustrated based on the degree to which they're given what they want.
My advice to Microsoft is to add an additional test: a "Who's In Control?" test. After performing a task, ask the user to rank their experience on a scale with "me in control" on one side, and "software in control" on the other. Try all test methods for completing various tasks, and choose the one ranked with the maximum "me in control" score. And they need the home version for ongoing testing in the "real world."
We've all experienced the full range of emotions while using gadgets, PCs, phones and software. At one end of the spectrum is a kind of thrilling joy, where something "just works." At the other end, there is a consuming rage. The amount of time your emotional state spends at one end of the spectrum rather than the other is the one and only thing that determines how much you "love" the product.
All the factors involved in using a PC -- consistency, usability, simplicity, stability, performance and even the successful completion of tasks -- all come down to control.Give me control, and I will love your product. It's as simple as that.

Tech Jobs May Increase Despite Economic Trends

2009-01-05T01:33:00.000-08:00

The outlook for IT jobs in 2009 may not be as bad as some observers suggest. While some indicators and surveys are showing some declines in tech jobs, none predict a precipitous drop. In fact, a federal economic stimulus package may even add IT positions.
"IT jobs are relatively safe in the aftermath of the economic meltdown compared to jobs in general," said David Foote of Vero Beach Fla.-based Foote Partners LLC , which analyzes IT wages and hiring data.
While 853,000 U.S. jobs in all industries were lost in October and November, 9,000 were gained in the U.S. Bureau of Labor Statistics categories of "Computer Systems Design and Related Services" and "Management and Technical Consulting Services," said Foote.
The IT job market is stable, said Foote, "because a lot has happened to show businesses that IT is really our edge."
Robert J. McGovern, CEO of JobFox Inc., a career site in McLean, Va., is bullish in the belief that hundreds of thousands of tech jobs will be created from the federal stimulus of hundreds of billions of dollars that's expected early next year from President-elect Barack Obama 's administration and Congress.
Major chunks of that federal money may be used to build infrastructure such as roads and bridges, and for expansions of broadband, especially in rural areas, he said. IT pros should focus on showing employers how their skills can be adapted to projects in these areas.
For example, construction companies and engineering firms will likely seek multiple IT skills, including computer-aided design and telecommunications. Companies focused on alternative energy and health care modernization will likely need IT pros who specialize in bioinformatics, information security and software development. "Target your job search in those directions," McGovern suggested.
Regulatory compliance may also be a source of new jobs, he said. The Obama administration is expected to quickly expand regulatory controls, especially in the financial services industry. The industry's response could be similar to its actions after Congress passed the Sarbanes-Oxley Act of 2002. That law, enacted after a series of securities scandals such as the spectacular failures of WorldCom and Enron, drove demand for integration and Web skills.
Some of the hottest areas for jobs over the next two years, according to Foote, will be business analysis, financial and human resources applications, program management and application development.
McGovern believes a stimulus measure could have a fairly rapid impact on new hiring. "What employers need more than anything is confidence," said McGovern. "They have the open positions, but they are reluctant to fill them."

No-Name Power Supplies Can Prove Painful

2008-12-22T01:18:00.001-08:00

Power is the talk of the town in the PC industry, and for good reason. Nobody wants their desktop computer to double their electricity bill. But as much as we throw various power tweaks, myths, and all other kinds of electronic hocus-pocus back-and-forth, it's important to sit back for a moment and think about the core of your system: the power supply. It's the most critical part of your system, and it certainly won't last forever. But this is not a place where you're going to want to scrimp when it comes time to build a new machine or replace the aging power supply in your current rig.
Tech Report ran a pretty comprehensive batch of reviews for seven power supplies recently. While that normally doesn't sound like the kind of article that would draw many eyeballs, given the specificity of the topic, it's worth your while to check out. Spoiler alert: Be careful what you purchase with PSUs. As tempting as it might be to save your pennies on your power supply so you can afford that next tier of processor in your low-budget CPU, you're only going to hurt yourself in the long run.
Unlike grocery store food, Tech Report found that generic power supplies tend to lack proper cabling for all the accessory devices you'll want to plug into the PSU. Worse, their warranties can be shorter than name-brand PSUs--just like their cabling. Tech Report puts it best:
"Generic PSUs may not always be time bombs waiting to take your system down with them, but based on what we've seen, they're not worth the trouble and are poor values, anyway."
So what's a name-brand power supply? Well, if you go by the article, companies like Antec, Corsair, Enermax, and OCZ offer reliable, fault-proof PSUs--at least, more so than generic brands like Coolmax or SolyTech. But this isn't the kind of decision you should be making based on your brand familiarity at the store. If you must, consider the "too good to be true" adage--the cheaper and jankier the power supply away from the competitive average, the greater the likelihood that you're being hoodwinked. That's not to say that the best power supplies are super-expensive, but these generic PSUs can appear the most tempting because of their absurdly low costs.
Your best bet is to treat your power supply purchase like you would any other computer part: Do your research! While power supply reviews can be harder to come by than, say, a new processor or video card, they exist. Don't go to Newegg--find sites that run PSUs through a rigorous testing environment. And if all else fails, at least pick up something that has the longest warranty you can find. Then, when your New Power Supply Of Choice blows up, at least you'll have a wide blanket of coverage.

Tech Centers Go Green Despite Cuts

2008-12-22T01:13:00.000-08:00

The number of firms accelerating their green IT initiatives is double that of those scaling back such projects, according to a survey by Forrester Research.
The report, called 'A slowing economy won't slow down corporate green IT initiatives', found that 10 percent of firms are increasing their green IT expenditure, and 38 percent of firms are maintaining the level of expenditure. But five percent are cutting green spending, and 47 percent expressed uncertainty over the future.
Some 67 percent said the main motivation for pursuing a green agenda was reducing energy bills, up from 55 percent in the same survey one year ago. Regulation prompted 16 percent of businesses to implement greener systems, and nearly a third of companies said they wanted to align IT with business-wide green plans.
Some 52 percent of businesses had a green IT action plan, up from 40 percent last year. One thousand firms were interviewed in October for the survey, of which a third were in Europe, the Middle East and Africa.
Technology buyers were also more aware of manufacturers' green credentials, the survey said. Six in 10 businesses considered factors such as recycling and greener manufacturing when buying technology.
Christopher Mines, the author of the report, said: "Green IT is not a fad or a bubble. ... The slow-but-steady increase in awareness and activity bodes well in our view for continued growth in demand for greener IT products and services."

Three Deals Symbolized Storage Trends in 2008

2008-12-19T20:03:00.001-08:00

The storage story of 2008 was growth: An accelerating explosion of information, much of it in the form of video, led IT administrators to try to make better use of their capacity and staff.
Overall demand for storage capacity is growing by about 60 percent per year, according to IDC. Another research company, Enterprise Strategy Group, pegs the annual growth rate of data between 30 percent and 60 percent.
"Organizations are having a hard time getting their arms around all that data," said ESG analyst Lauren Whitehouse. Economic woes are making it even harder, with frozen or scaled-back budgets, while the downturn isn't expected to significantly slow data growth next year.
Stuck in that bind, organizations don't want to have to roll out a gigabyte of capacity in their own data centers for every new gigabyte that's created, analysts said.
"What we'll see more of in companies is a focus on efficiency," IDC analyst Rick Villars said. They're seeking to increase the utilization of their storage capacity as well as other IT resources.
A big part of that effort is virtualization of storage, which often goes hand in hand with server virtualization and became a mainstream technology in 2008, according to analyst John Webster of Illuminata. Storage vendors are offering more virtualization products and seeing more demand for them, he said. A virtualization capability such as thin provisioning, which lets administrators assign storage capacity to a new application without having to figure out how much it ultimately will need, helps make better use of resources, Webster said.
But in addition to the trend toward disconnecting logical from physical resources, there were a handful of acquisitions this year that signaled other trends in storage world.
1. Brocade-Foundry
On Dec. 19, Brocade Communications and Foundry Networks completed a deal they had announced in July before navigating the roughest waters the financial and credit markets have seen in a generation. The merger, now valued at $2.6 billion, is intended to address a coming merger of SAN (storage area network) and LAN technology.
SAN builders have long relied on Fibre Channel, a specialized networking technology designed not to drop packets. But in most cases, the rest of the enterprise network is based on Ethernet, which is cheaper than Fibre Channel and now available at higher speeds. Maintaining both requires more adapters on storage equipment and adds to an IT department's workload. The two types of networks are headed toward gradual consolidation under the FCOE (Fiber Channel Over Ethernet) standard, which is intended to make Ethernet reliable enough for storage networks. Then, Ethernet can be the network of choice across data centers and keep getting faster.
Brocade wasn't the only company thinking this way. Cisco, which will be the main competitive target of the merged company, bought out Nuova Systems in April and simultaneously announced a line of routing switches designed to connect the whole data center. The flagship Nexus 7000, which Cisco has positioned as one of its most important products ever, is built to scale to 15T bps (bits per second) and has a virtualized version of IOS (Internetwork Operating System) called NX OS. Like the combination of Brocade and Foundry, the Nexus line is likely to help enterprises virtualize their storage and computing resources and eventually streamline networking and management.
EMC and NetApp also introduced FCOE products this year. But the protocol is not expected to be in widespread use until 2010.
2. IBM-Diligent
In April, IBM acquired Diligent Technologies, which specializes in data de-duplication for large enterprise storage systems. The company didn't reveal how much the acquisition cost, but it was a key move in a market that could grow to US$1 billion in annual revenue by 2009, according to research company The 451 Group.
De-duplication systems find identical bits of data in a storage system, treat them as redundant, and eliminate them. So if there are several nearly identical copies of a document, all will be deleted except one copy and the differences that are unique to the other copies.
The Diligent deal was an early move in a year full of de-duplication activity. In June, Hewlett-Packard introduced a suite of de-duplication systems for small and medium-sized businesses and added some features to its HP StorageWorks backup line. And in November, EMC, Quantum and Dell said they would use a common software architecture for data de-duplication products. Dell will enter the de-duplication business next year. It is already a major reseller of EMC gear, under a partnership that in December was extended until 2013.
Data de-duplication can reduce the amount of storage capacity an enterprise requires by as much as two thirds, said ESG's Whitehouse. It has been available before, but this year companies started to integrate it with storage arrays or sell it in appliances, bringing the technology closer to a turnkey solution, she said. They also established data de-duplication as a technology customers could trust, at least for archived material.
"If you eliminate a block of data that somehow negates the value of that data when you recover it ... that's a really scary prospect for some companies," Whitehouse said.
So far, most enterprises are only using it for secondary storage, or the archived information that's backed up for safekeeping, she said. The next step will be to embrace de-duplication for primary storage, the data that applications are using in real time. Users will start to trust the technology enough for that next year, she said. In July, NetApp enhanced its V-Series storage virtualization products so they can perform de-duplication on primary storage systems from third parties such as EMC, Hitachi and HP.
3. EMC-Pi
In late February, enterprise storage giant EMC bought Pi, a provider of software and online services for consumers to keep track of personal information stored locally or online. The deal, which followed the company's 2007 buyout of online backup provider Mozy, was one sign of growing interest in cloud storage.
Handing off personal or corporate data to a third party's hard drives and accessing it via the Internet can be a less expensive alternative to provisioning all that capacity in your data center or home network. It may be used in conjunction with cloud-based applications, but also just for archiving or disaster recovery, Illuminata's Webster said. In many cases, the cloud-storage service can be set up as a target when data is being backed up. The information can be sent to the cloud only or to the cloud and a dedicated tape backup system simultaneously, he said.
With the economy weakening, cloud storage will be big next year, Webster believes. Paying for additional capacity on a monthly basis moves that expense out of the IT department's capital budget and into its operational budget, which tends to be easier to fund when times are tough, he said. It's also relatively quick because nothing needs to be purchased or installed, he added.
A related option, managed services, may also take off in the coming year, Webster said. While keeping their own storage systems in-house, enterprises can pay a vendor such as Brocade or IBM to manage it for them remotely. The vendor can monitor alerts through an appliance at the customer's site and respond if needed. If IT staff needs to be cut back, this may be one way to maintain service levels to the rest of the company, Webster said.

NSA Patents a Way to Spot Network Snoops

2008-12-19T20:01:00.000-08:00

The U.S. National Security Agency has patented a technique for figuring out whether someone is tampering with network communication.
The NSA's software does this by measuring the amount of time the network takes to send different types of data from one computer to another and raising a red flag if something takes too long, according to the patent filing.
Other researchers have looked into this problem in the past and proposed a technique called distance bounding, but the NSA patent takes a different tack, comparing different types of data travelling across the network. "The neat thing about this particular patent is that they look at the differences between the network layers," said Tadayoshi Kohno, an assistant professor of computer science at the University of Washington.
The technique could be used for purposes such as detecting a fake phishing Web site that was intercepting data between users and their legitimate banking sites, he said. "This whole problem space has a lot of potential, [although] I don't know if this is going to be the final solution that people end up using."
IOActive security researcher Dan Kaminsky was less impressed. "Think of it as -- 'if your network gets a little slower, maybe a bad guy has physically inserted a device that is intercepting and retransmitting packets,' " he said via e-mail. "Sure, that's possible. Or perhaps you're routing through a slower path for one of a billion reasons."
Some might think of the secretive NSA, which collects and analyzes foreign communications, as an unlikely source for such research, but the agency also helps the federal government protect its own communications.
The NSA did not answer questions concerning the patent, except to say, via e-mail, that it does make some of its technology available through its Domestic Technology Transfer Program.
The patent, granted Tuesday, was filed with the U.S. Patent and Trademark Office in 2005. It was first reported Thursday on the Cryptome Web site.

Losing the Data Mangement Race

2008-12-19T20:00:00.001-08:00

Storage is bigger and faster than ever, with 1.5TB drives shipping and 8Gbps Fibre Channel, 10Gbps iSCSI, Infiniband becoming affordable. The data to fill those disks and pipes is growing faster than ever, with archiving for e-discovery and legislative requirements growing all the time, audio and video data for surveillance, teleconference archives, video blog posts, Webcasts, and simply more business processes being digitized. By contrast, a unified approach for protecting and managing that data is not really much further along than it was ten years ago, when 10TB was a large amount of data for even big enterprises.
Now that petabytes are becoming commonplace, the problem is much more urgent. If indexing software to build metadata about all the files stored across an enterprise requires a cluster of servers to run, and it still takes days to complete an index, the utility of that metadata is limited. We keep getting hints of potential solutions to this sort of problem, such as Microsoft's promise of a new file system (Windows Future Storage) based on a relational database -- originally promised as part of Windows Server 2008 but now pushed out indefinitely.
Don't blame Microsoft for failing to pull the rabbit out of the hat; it's a difficult problem to solve. To automatically classify data and index it requires a high degree of artificial intelligence. Indexing engines that can run across a LAN and index data on multiple disparate systems are extremely processor and bandwidth intensive.
While some of today's data management applications do a good job, they tend to be isolated silos, tied to a specific vendor's storage or to an application running on a specific platform. An enterprise-wide, multi-platform data management system that can handle all aspects of data management, including indexing, metadata creation, virtualization, migration, data tiering, replication, and so forth does not yet exist.
For such a data management system to become a reality, three key pieces must come together: widely adopted standards for data management, which should come from SNIA, the Storage Networking Industry Alliance; methods for automatically classifying and finding data, which should come from the file system; and cooperation between storage and OS vendors to facilitate single-console management of data across multiple data storage platforms, operating systems, and networks.
Will these pieces fall into place before we're swimming in exabytes? It depends mostly on you. Ask your vendors for these features, and keep asking. Nearly all storage and operating system vendors are members of SNIA. The infrastructure is there to create the standards necessary, but it has taken much longer to make any progress than one might hope.
For more IT analysis and commentary on emerging technologies, visit InfoWorld.com. Story copyright © 2007 InfoWorld Media Group. All rights reserved.

Outsourcing Won't Be a Cure-All in 2009

2008-12-19T19:57:00.000-08:00

Enterprise IT executives looking to cut expenses in 2009 will consider outsourcing, but industry watchers argue moving from fixed to variable costs could also result in unreliable services, unpredictable outcomes and financial woes.
"Throughout the history of outsourcing, we've seen during the tough times that a lot of these decisions are extremely tactical, short-term oriented and present consequences downstream," says Ben Pring, research vice president at Gartner. "An uncertain economy is not a slam dunk for outsourcers, but some very bad deals can be put in place. It's the ugly truth of outsourcing."
Outsourcing in a tight economy can represent a classic case of "You get what you pay for" to enterprise IT executives, analysts say. For instance, companies looking to squeeze costs out of a contract with a service provider can suffer degraded service levels without too much concern from the outsourcer, Pring explains. Passing responsibility for infrastructure, applications or staffing to a third-party -- regardless of the economy -- leaves the customer vulnerable to the whims of the provider and can make outsourcing a risky proposition in tough financial times.
In the short term the deal may help a company's bottom line, but long term, enterprise companies need high-quality services to better compete.
"Oftentimes, you are going to be disappointed with the level of cost reduction you can achieve in an outsourcing deal, and if that is all you are focused on, inevitably, it will produce a bad deal," Pring says. "Historically customers get lousy quality of service when trying to squeeze an outsourcer. . . . Really the service provider has no incentive to invest in better services or staff for a smaller contract."
The trend toward shorter-term contracts and smaller deals will continue in 2009, according to global sourcing advisory firm TPI, and despite the rush to reduce expenses, contract negotiation cycles have lengthened -- which could benefit both customer and provider.
"One of the big concerns for TPI is that in the angst and rush to judgment, decisions could be made without fully evaluating the risk," says Mike Slavin, partner and managing director for CIO Services North America at TPI. "Once a firm has made the decision to outsource, it is a pretty hard decision to come back from in the short term."
Because economic uncertainty for 2009 has reached a fever pitch, enterprise IT executives need to be smarter than ever about signing services contracts. By no means should companies abandon outsourcing as an attractive option, but when looking to strike a deal with a service provider, enterprise IT executives need to take a step back from the need to reduce expenses immediately and think about IT needs a year or more from now, analysts say.
"It's so tumultuous that there is no clear line of sight in terms of when the end of the upset will come. There is still too much we don't know," says Christine Ferrusi Ross, vice president and research director at Forrester Research. "A lot of clients coming up on renewals are being extremely cautious and taking their time to weigh risks and get the right deal for them."
Analysts advise enterprise IT decision makers to research service providers' financials, product road maps, deal flow and turnover. Outsourcers are not safe from the current economic conditions and may not survive the storm any better than others. "There has to be a big focus on vendor risk and vendor viability. The deal may sound great now, but if the vendor goes south in six months, where does that leave you?" Ross says.
Another key factor to investigate is service levels. Talk to providers' current clients and determine if they have begun to slip on service levels or started to reveal gaps in service, analysts say.
"A lot of these outsourcers are not immune to the meltdown that is occurring; many of the bigger ones have been working with financial services institutions, and inevitably that will hurt even the biggest service providers," Gartner's Pring says.

Watchdog Group Asks Google to Create Personal Data "opt-out"

2008-12-19T19:56:00.000-08:00

The nonprofit group Consumer Watchdog asked on Friday that Google give users of its search engine the ability to "opt out" of leaving personal data, such as IP addresses, on Google's servers.
"Many people don't understand that the kind of unnoticed conversations that are going on between them and [Google's servers]," said John Simpson, policy advocate at Consumer Watchdog. "Some of that can provide a useful, helpful service to the user, but people need to know what they're providing and made informed judgments about whether they want to or not."
Search vendors have of late moved in varying degrees to assuage user privacy concerns, albeit not to the degree groups like Consumer Watchdog would prefer.
Yahoo recently said it will anonymize most personal data it collects after three months; in September, Google said it would keep such information for nine months, halving its previous policy of 18 months. Microsoft, which now retains the data for 18 months, said recently it would drop that to six months if other search vendors agree.
Consumer Watchdog is targeting Google because the company is such a dominant player in Internet search, Simpson said. "It's really the opportunity for them to become the gold standard for privacy on the Internet. If they can be made to see the light, then others will fall into line too."
Simpson said he recently became aware that Ask.com provides a service called "AskEraser," which allows site users to scrub their personal information from the company's systems.
"That's what prompted us to say [to Google], if these guys can do it, why can't you?" Simpson said.
Consumer Watchdog is also asking Google chairman and CEO Eric Schmidt for an in-person meeting to discuss their request.
"I'm very optimistic that he's sincere about listening to people's concerns," Simpson said. "I fully expect we'll have a meeting at some point."
Google did not immediately respond to a request for comment Friday.

Boost Your Corporate Blog

2008-12-15T01:13:00.002-08:00

Forrester Research analyst Jeremiah Owyang has devised a "health check" to establish whether your corporate blog has the right stuff -- the only problem being that you don't have a corporate blog. Probably. No, almost certainly.
Owyang's checklist is worth reading if you do, however, and it vicariously points out what's missing from most corporate blogs -- that is, trust. But the elephant on the table is the absence of industry leaders prepared to discuss in open forum what's really going on inside their heads.
The PR folks at Sun Microsystems did a tremendous job in persuading CEO Jonathan Schwartz to start a blog that helped make the firm appear less dot-com relic and more relevant computing company, at least for a while. Schwartz lived up to the promise that Robert Scoble and Shel Israel outlined in their book Naked Conversations -- that blogging can bring firms closer to customers, removing the fangs and even (gasp!) humanizing the business by providing direct links to the people behind the decisions.
For a while, corporate blogging -- or 'clogging', as was demanded by the relentless search for neologisms on the web -- was du jour and all the rage but it seems to me that its fling was short-lived. The business blogging community now lacks big names and depends on the egotistical and the occasional. The groundswell was just that, and the big names almost never joined in apart from a select, and perhaps self-serving, few from within the tech sector.
I learned this as part of researching a commission for a forthcoming piece about CIO bloggers (and, by the way, there are too few of those also, although enough to make a feature).
It's not like Twitter or other micro-blah services have replaced the cloggers. It's just that firms seem to have decided that blogging is not worth the candle when it comes to describing what's going on in boardroom and executive decision-making salon.
Call me old-media dinosaur but I'm struggling to find useful naked conversations out there when it comes to blue-chip entities. I love blogging for its access to specialist areas but its effect on the visibility of top people at name-brand companies is negligible. I call that a shame but if I'm being unfair and you know blogs that are business-orientated, written by the bylined author and useful, do let me know and I'll take it all back.

Can Open Source Help the Economy?

2008-12-15T01:13:00.001-08:00

In the last major economic downturn, Linux established itself as a widely-accepted enterprise operating system, benefiting a lively ecosystem of vendors such as Red Hat and Novell. The return of tough economic times puts the open source alternative again front and center, this time with focus on databases and higher-level software applications.
I believe we've entered another era for open-source companies of all stripes. IT decision makers need to fight the financial crisis and they need a more efficient solution for critical enterprise system and IT needs.
As IT costs grow and the economic crisis puts pressure on global IT budgets, open source becomes irresistibly attractive to developers and IT decision makers who are being asked to do more with a whole lot less. Meanwhile, proprietary vendors react by increasing license fees by 15 percent to 45 percent, they continue to lock-in their customers, and they take away independence regarding choice and flexibility across the enterprise technology infrastructure.
That's why open-source solutions are more attractive than ever.
During the last economic downturn in 2001-2002, open-source usage and adoption was on an upward curve. Red Hat, for example, began winning large customer accounts that are now the backbone of their customer base. CIOs and CTOs were on the lookout for innovative ways to save costs both from a technology and people perspective, and open source was a great solution. Just like it is today.
Red Hat began to see the fruits of their labor in late 2002; the company grew revenue 14 percent for the year and that growth improved to 38 percent and 58 percent in 2003 and 2004 respectively. Given the timing of subscription revenues and long sales cycles, it is not hard to conclude that during the 2001-2002 economic downturn, large corporations made the decision to switch to open-source technologies. It also explains why Novell paid $200 million for Suse Linux in late 2003, which at the time, was roughly 20 times its revenues.
Just as in the last downturn, every IT decision maker today is faced with increased license and spiraling support costs for complex proprietary solutions. But business demands critical new capabilities at lower costs. Now is the time for IT leaders to make a loud and clear choice: accept the extraordinary expense and "lock-in" of proprietary vendors, or take advantage of open-source's cost-effectiveness and freedom.
With freedom also comes faster innovation.
My experience at the New York Stock Exchange (NYSE) was that we could innovate more rapidly with open source through rapid technical collaboration and by eliminating the long legal and contractual delays of the proprietary software model.
An open-source user who has worked with both Linux and Ingres agrees. Alan Nidiffer, VP and CIO at C&K Market, a West Coast grocery chain, recently explained why open source offers more innovation and faster development times. According to Nidiffer, the set release schedules of traditional software companies slow down innovation, whereas open-source improvements come at any time. He notes that innovative features can even come from software developers outside of his company; they have fresh ideas on how to continuously improve the applications.
Open source now provides a complete stack of enterprise-grade software backed by excellent support, and rivals the technological strength of traditional proprietary vendor offerings. Successful implementations for mission-critical workloads continue to dismiss concerns about support, security and reliability. As more customers share their open source success stories, first-time open source users now have powerful innovators and role models to follow.
For example, I met recently with a customer who processes more than $100 billion a day in fund transfers for 160 banks using an open source stack that includes the Ingres database and Red Hat's JBoss application server. Meanwhile, customers from diverse industries spanning airlines (Lufthansa) and manufacturing (PPG Industries) to grocery store chains (C&K Market) and government agencies (National Center for Missing & Exploited Children) are embracing open-source solutions to manage millions of pieces of information critical to run and maintain their businesses, and even save lives. These companies trust open source to do the jobs that must get done, and appreciate the accompanying cost savings, innovation and freedom.
These pioneering companies are choosing to forgo proprietary solutions and adopt open source stacks from companies such as Alfresco, JasperSoft and Ingres, from core database systems to emerging open-source stacks that support enterprise content management, document management, transaction processing and business intelligence.
Savings matters.
According to a recent report from Forrester Research, companies can save as much as 25 percent of their database costs by switching to open-source databases and have the potential of an additional 25 percent savings in hardware costs by using open source on commodity servers. C&K Markets' Nidiffer says his company has saved nearly 20 percent using the Ingres open-source database.
In the coming months and years, I predict that many companies will experience open source benefits, including greater innovation and much lower costs, while delivering the enterprise performance that companies require.
More than 10,000 of our worldwide customers, in sectors ranging from financial services through manufacturing and distribution to the public sector, prove this equation each day.
It is a new time for open source to show its true value as the alternative choice to companies that will be hit hard by the financial crisis.

Web 2.0 Tactics for Successful Job-Hunting

2008-12-15T01:10:00.000-08:00

With unemployment at a 14-year high and 240,000 workers laid off in October alone, many Americans are scrambling to update their resumes and turning to job boards and networking sites. Some are panicking as they try to devise new ways to get in front of employers. But even in trying times like these, prospective employees shouldn't completely reinvent their job-seeking styles.
Indeed, much of the tried-and-true career advice we've all heard is relevant in your next job search. To outshine your competitors and win the gig in today's economy , here's a secret to success: Don't abandon the steadfast career tips passed down from generations, but rather, refine them -- with a keen eye for the value in Web 2.0 tools like social networking.
Whether you're one of many IT professionals out of work or among the few making career leaps despite rocky economic times, consider these five ways to express your candidacy with flair.
Self-assess to stand out. Assess your core strengths, as well as qualities that will set you apart from the competition. Then strategize ways to emphasize these qualities in your resume, cover letter and the interviewing process.
For example, tailor the experience, skills and education sections of your resume to the position you're applying for. Use keywords from the job posting, employer's Web site and any related articles on the company.
Also, be specific with numbers. List how many employees you've managed, systems you've administered or applications you've developed.
Letters of reference can also set you apart, if they are particularly compelling and give an accurate description and concrete examples of your talent, work ethic or past successes. Try reaching out to references who have expertise that relates to the field or company you're applying for. Your prospective employer might take confidence in knowing you were trained or mentored by others with similar goals, interests and objectives.
Keep your skills a step ahead. To stand out and stay on the cutting edge, demonstrate fluency in state-of-the-art technical and functional skills as well as the standard competencies a specific role demands.
If you're a Visual Basic programmer, for example, don't settle for expertise in ASP.Net, VB.Net and SQL. Enhance that with experience in data warehouses, OLAP analysis tools and Business Objects reporting. For a Java application developer, Fatwire CMS experience is a plus.
Stay current in your field by reading trade publications, news articles, blogs and market research reports from firms such as Gartner. And attend a conference in your niche to build your knowledge and to network. You might find someone who can connect you to a valuable contact, or even meet your next employer.
It's also important to have the necessary management skills, such as leadership capability, project management knowledge and mentoring experience. According to a March 2007 report from Forrester Research, 55% of the 280 IT decision-makers polled cited project management expertise as a missing skill among techies.
Remember, It's Who You Know
Network out of the box. As tried-and-true career advice suggests, networking is key to landing a gig. Monster.com and HotJobs.com are great starting points, but many positions are never publicly posted.
So don't be embarrassed to spread the word to your friends, former colleagues and contacts. Inform them that you're currently in the market for a new job, and don't be shy about asking them to put you in touch with any of their relevant contacts. It's likely you'll be able to return the favor some day.
But don't stop in the physical world. Social networking sites such as Facebook and LinkedIn , as well as microblogging tools like Twitter , make it easy to initiate relationships with new contacts. Remember, however, that this is just a launching pad. It's up to you to develop and grow these relationships.
When you invite someone to join your social network , include a personalized note. Mention mutual friends or contacts, if any, or call attention to any specific interests that you share.
Think of activities in your past that make building bridges easy, and start with those organizations. Colleges, high schools, former employers and home towns often provide the links that allow an initial conversation to build into a potential referral.
Team up with a staffing firm .Staffing professionals closely follow the job market every day and have extensive knowledge about trends in your field and the most updated inventory of available positions. They know what skills and experience top employers are looking for and can guide you through the entire recruitment process, from searching for a job to negotiating salary and other benefits once the position is yours.
With a trusted and diverse network of hiring managers at their fingertips, staffing firms have the resources to help find suitable placements for job seekers looking for short- or long-term assignments. They have extensive information about employers' backgrounds, enabling them to match a position and company to a job seeker's skills and priorities.
Such firms are increasingly rolling out online resources for job seekers to tap into. At Yoh, for example, our online career database provides over 400 listings of contingent and direct hire jobs, sorted by position and location. In addition, our online career resources provide tips on subjects ranging from preparing for a telephone interview to writing a proper letter of resignation.
Upgrade your online image. Networking online begins with tools such as LinkedIn and Twitter , but there's much more to consider -- such as your digital footprint. Today, it's easy to run a Google search and instantly be connected to your various online posts, personal blog and Flickr page of photos that trace back to your college days.
In fact, according to a 2008 CareerBuilder survey, 22% of employers check candidates' Facebook profiles before hiring them, up from 11% two years ago. What's more, one-third of hiring managers rejected candidates based on what they found, CareerBuilder says.
To ensure you're not one of the candidates that gets rejected prior to an interview, be mindful of what you post online, and continually consider what others might assume or perceive from what you share. You can also protect your online persona by implementing privacy restrictions, such as displaying a limited public profile on Facebook or using invite-only photo-sharing on Flickr.
Also make an effort to connect with others who share your interests. For example, join online networks that directly relate to your personal interests or career field. For IT professionals, this might include SNetBase.com , 9Rules.com or Fark.com .
To take it a step further, visit the blogs of leading experts in your field, and post your comments or reactions. These comments are likely to turn up in a Google search if a prospective employer looks for your name. Your opinions in the comments reflect your knowledge and insights and can increase your credibility and marketability. Moreover, you'll initiate relationships with these bloggers and open yourself up to learn more and grow.
Better yet, publish your own blog, where you can provide expert insight and analysis of your field. This will surely give you a voice among your peers, and you'll be on your way to developing a community of like-minded individuals in the blogosphere.
Negotiate wisely. " What's your salary range? " That can be a loaded question, and there are do's and don'ts when answering it. A number too low can cost you thousands of dollars, but a figure too high might take you out of the running.
Do have a clear range in mind. This involves doing your homework. Since salaries are usually tied to the competitive market, it's important to know the average pay of others in a similar field, position, experience and geographic location. Fortunately, there are a number of reliable sites to keep your salary expectations in line with market offerings.
At Glassdoor.com, visitors can view salaries of more than 14,000 companies for free. The site features candid company reviews, including detailed pros and cons of everything from work hours to culture, as well as opinions about senior management and tips on how to rise through the ranks. All posts are anonymous, but here's the catch: It's a "give-to-get" model, so be willing to share insights about your company in order to receive those about others.
PayScale.com also provides the inside scoop for job seekers, employees and employers. After visitors complete a personal profile and multipage survey, the site delivers a free PayScale Summary Report tailored to the visitor's requested company. Like at Glassdoor, profiles are anonymous and forthright.
So continue to follow that tried-and-true career advice you've relied on for years.But to leverage it for success in today's market, use social networking sites and the wealth of information on the Internet to your advantage.
You can expand your opportunities, differentiate yourself in the talent pool and tap into new resources to more effectively network, apply for positions, interview and, of course, close the deal.

SugarCRM Adds Hooks to Cloud Data Services

2008-12-08T00:25:00.000-08:00

Commercial open-source CRM (customer relationship management) vendor SugarCRM said Monday it will give customers the ability to plug in feeds from third-party data sources like the business social-networking site LinkedIn.
The new "Cloud Connectors" feature is part of the vendor's new SugarCRM 5.2 release, which will be available worldwide this month.
While users could obviously tap such third-party services separately, SugarCRM created the new integration capability because it keeps users in a CRM context, as well as makes the process more convenient and efficient, said Martin Schneider, director of product marketing.
If you're logging into third-party sites "while you're on the phone with someone, you're going to be hemming and hawing and you're not going to have it at your fingertips," he said. "The idea is to drive adoption and keep people in one space, but also give them unfettered access to bringing content into the CRM system."
Windows, which SugarCRM is calling "Cloud Views," will pop up with relevant information, such as which of a user's LinkedIn connections work at a certain company. Users can also import this information into SugarCRM.
The Cloud Connectors are made possible by a new data services framework that Schneider characterized as "a toolkit for developers or really astute users to bring in any type of data source."
Other new features in SugarCRM 5.2 include:
-- "Social Feeds," which provide the types of alerts and status details common to social-networking sites, applied to a CRM milieu. Salespeople could set up alerts to tell team members about newly closed deals, for example. "It's kind of like using an internal Twitter inside Sugar," Schneider said.
-- More granular administration capabilities that can give various department leaders authority to manage specific parts of the system, without the need for IT involvement. For example, a company's director of marketing might be granted admin rights over the campaigns module, Schneider said.
-- "Portal Dashlets," which can display information from third-party Web sites inside SugarCRM.
One industry observer said the Cloud Connectors feature is similar to past efforts by CRM vendors like Salesforce, but is nonetheless "a great idea."
"It seems to me that offering the ability to connect CRM and social apps like LinkedIn makes sense," said Denis Pombriant, managing principal of Beagle Research Group in Stoughton, Massachusetts. "It's essential to the next iteration of CRM that we have good embedded social-networking tools."
451 Group analyst China Martens said via e-mail that SugarCRM has been talking for some time about adding more collaborative features to its software, but "had a couple of other major calls to make before turning its attention to social CRM, notably, the revamping of its on-demand architecture with Sugar 5.0 and then the improvement of its mobile support in Sugar 5.1."
Martens speculated on whether SugarCRM will expand on the Cloud Connectors idea, using information from sources like LinkedIn and Hoover's "to prepopulate its CRM apps from the get-go, so a customer in a given industry can sign up for their own version of Sugar and download it already complete with predefined prospect contact details."
Pricing for on-demand versions of SugarCRM starts at US$40 per user per month, while on-premises edition costs begin at $275 per user per year.

Salesforce Links Force.com to Google App Engine

2008-12-08T00:24:00.000-08:00

Salesforce.com is set to announce Monday that it is connecting its Force.com development platform with Google's App Engine.
The news, which Salesforce CEO Marc Benioff is expected to discuss during a company event in New York, follows Salesforce's recent announcement of a similar arrangement with Amazon Web Services' Elastic Compute Cloud (EC2) and Simple Storage Service (S3).
Google's App Engine, which is still in preview mode, is aimed at developers who want to quickly and easily build scalable Web applications, while AWS is positioned as a more generalized, flexible infrastructure platform for serving all types of programs.
Meanwhile, Force.com provides a database, Java-like programming language, integration and workflow capabilities, and user-interface design tools for creating business applications that run on Salesforce's cloud infrastructure.
The results from this hook up remain to be seen, said Adam Gross, vice president of developer marketing at Salesforce.
"Obviously, it's up to the imagination of developers what they create," Gross said.
In a statement, Google said the integration "will foster the creation of new Web applications and further demonstrate the power of the Web as a platform."
One industry observer is expecting big things to happen over time as cloud platforms merge in this manner.
"We're really talking about the invention of apps that don't exist right now, that will exist at the intersection of CRM [customer relationship management] or more broadly, business applications and front-office applications," said Denis Pombriant, managing principal of Beagle Research in Stoughton, Massachusetts. "Or front-office applications and social-networking applications. This opens up a door, or maybe a couple of doors, to really new innovation."
Monday's announcement is the latest stage in Salesforce and Google's relationship -- which has also resulted in an integration between Salesforce and Google Apps -- and could prompt another round of speculation that the search engine giant will eventually buy Salesforce.
But Pombriant hopes such a deal doesn't materialize.
"I think it's highly important that the two companies remain separate, and that they continue pursuing their own unique paths toward platform integration," he said. "I don't think you can have a cloud computing era happen if all the clouds are owned by the same company."

HP Updates Desktop Virtualization Software

2008-12-08T00:23:00.002-08:00

Hewlett-Packard hopes to widen the use of its desktop virtualization products with new software that will improve video playback and allow the use of USB peripherals such as webcams, the company announced Monday.
HP is also rebranding its desktop virtualization suite as the HP Virtual Client Essentials, and adding Linux support for its broker software, called Session Allocation Manager, which runs only on Windows today, HP said.
Most of the updates concern HP's Virtual Desktop Infrastructure suite, which allows a company to run multiple images of a desktop OS in virtual containers on a server, instead of having to manage a separate OS on each employee's PC.
Virtualized desktops are catching on at some businesses but companies need to provide workers with an experience similar to what they'd expect from a standard desktop PC, and that hasn't always been the case with multimedia content, said industry analyst Roger Kay, president of Endpoint Technologies Associates.
HP said it has solved that problem by developing an enhanced version of Microsoft's Remote Desktop Protocol, which transfers presentation data between thin clients and Windows applications running on a virtualized server.
The existing RDP works fine for relaying basic on-screen data, such as keyboard strokes and mouse movements, but it's not good at carrying rich content such as a training video or webcast, said Manoj Malhotra, product marketing manager for HP's Client Virtualization group.
"The server gets overloaded when it tries to decode a video stream for a large number of users, and some employees end up having a poor experience," he said.
HP's enhanced RDP shifts the burden of decoding video away from the server and onto the thin clients, he said. That will allow companies to stream video to a large number of employees without a deterioration in performance, he said. The new protocol also lets them plug in a wide range of USB peripherals, which don't work well with the existing RDP, according to HP.
The enhanced protocol will be preinstalled starting in January on HP's thin clients running Windows XP Embedded, and on its Linux thin clients later in the first quarter, Malhotra said.
HP said the enhanced RDP is aimed at basic productivity workers. The company also has its own RGS (Remote Graphics Software) protocol, which it positions for applications that use higher end graphics, such as CAD programs, or that multiple users access at once.
While the enhanced RDP will be free, HP charges for its RGS protocol. But on Monday it said it has cut the price of RGS to US$35 per seat, from "between $99 and a few hundred dollars" per seat, Malhotra said. It's also allowing customers to use RGS on non-HP servers, which previously was not permitted, he said.
He predicted that the RGS protocol will become more widely used, but HP still expects the enhanced RDP to be used for about 75 percent of virtual desktop deployments.

Businesses Ban Surfing, Study shows

2008-12-08T00:23:00.001-08:00

Nearly two thirds of UK businesses ban access to inappropriate websites and monitor employees' Internet activity, according to the Chartered Management Institute (CMI).
Research by the CMI in association with Ordnance Survey, also revealed that 18 percent of businesses impose a curfew as to when employees can access the web. However, 72 percent of employees questioned said they relied on the web for "professional development" while 59 percent also claimed it was a "useful research tool."
The CMI also highlighted that many UK organizations are slow to adopt Web 2.0 technology, with only 39 of UK businesses revealing they are happy for employees to use web-based applications such as Google Docs.
Jan Hutchinson, director of HR and corporate services at Ordnance Survey, said: "The low level adoption of new technology is in tandem with employers' belief that internet usage is a 'time waster.' It's something that must be looked at because the longer this situation is allowed to remain unchallenged, the greater the likelihood UK employers will fall behind their international competitors."

Vista Customer Satisfaction Climbs, Microsoft Claims

2008-12-08T00:22:00.000-08:00

Microsoft Asia Pacific has responded to researchers' claims that enterprise chief information officers "have not warmed to the Vista operating system over the past year."
The northern hemisphere researchers said that the CIOs they recently surveyed voted 11 to one against plans to implement Vista. The researchers concluded that "CIOs and other heads of IT still believe there is little business value in migrating from XP to Vista, especially in the current economic climate."
Richard Francis, General Manager, Windows Client Group, Microsoft Asia Pacific, said that, overall, sales of Windows Vista licenses have passed 180 million since launch, and at least 100 million Windows Vista users have actively hit Windows Update.
He said that, in the first half of the calendar year 2008, Windows Vista had 23 per cent fewer vulnerabilities than Windows XP, and 21 per cent fewer high-severity vulnerabilities.
More than 77,000 components and devices are now supported by Windows Vista SP1, triple the number Microsoft supported at launch, says Francis. From the Windows Vista Compatibility Center, Microsoft now has more than 2,000 printers, 220 scanners, 135 webcams, 485 digital cameras, and 180 media players compatible with Windows Vista.
Positive Asia Pacific feedback
"We have received positive feedback from our enterprise and SMB customers in APAC who have experienced the business benefits of Windows Vista," said Francis. "The history of the operating system lifecycle clearly suggests an increase in deployment 18 months into the launch or close to release of SP1. This is the right time and we are seeing customers starting to deploy, especially with Windows Vista SP1.
"Windows Vista satisfaction is actually increasing over time -- research tells us customer satisfaction levels increase among those who bought Windows Vista during just the last six months. This data also shows that favourability increases as people become more familiar with it. We are also on track to a faster rate of deployment in the enterprise compared to past releases including Windows XP and Windows 2000 during the same timeframe.
"As a trusted partner to our customers, we are delivering the technologies they need to optimise the performance of their IT investments during these challenging economic times," he said. "The combination of the Microsoft Desktop Optimization Pack (MDOP) and Windows Vista gives customers the tools to support more flexible work environments for their users, while making it easier and more efficient to manage and maintain their networks.
Francis said that Borneo Motors in Singapore, for example, now saved half an hour per machine using Windows Vista's secure remote deployment, and had reduced desktop support time by 25 per cent with improved Remote Assistance and the Event Viewer in Windows Vista.
Francis said that other Windows Vista customers in the region included Gleneagles and Pernec in Malaysia, Satyam and ONGC in India, Kiwi Bank in New Zealand, and the Australian Customs Service, to name a few.

Networking Glitch Knocks Yahoo Offline for Some

2008-12-05T02:52:00.000-08:00

A networking problem made Yahoo's Web site unreachable for many users on Wednesday.
The problem, first observed at around 11:40 a.m. Pacific Time, appears to have primarily affected users in the eastern United States and Canada who were trying to reach the www.yahoo.com domain.
Network engineers on the NANOG (North American Network Operators Group) discussion list reported that when they tried to reach www.yahoo.com, they were sent on the Internet's version of a wild goose chase. DNS (Domain Name System) servers redirected traffic to another Yahoo domain, www.wa1.b.yahoo.com, which was not associated with an IP address. In other words, computers trying to find Yahoo's Web site were sent nowhere.
The problem appeared to have been resolved by about 1 p.m. Pacific Time.
Yahoo did not have much to say about the outage. The company confirmed in a statement that it had "a disruption in service earlier today that affected users in some geographic areas."
One NANOG poster, apparently a Yahoo employee named Matthew Petach, reported that the problem was triggered by a Juniper T1600 router that "went kablooie."
"This is primarily affecting traffic coming through Ashburn, Virginia," Petach wrote at 1:16 p.m. Pacific Time. "We're aware of the issue and have put workarounds in place; you should be back up and functional for the moment, though not in an optimal state."
The kind of router failure described by Petach could easily have accounted for the problems reported on NANOG Wednesday, if Yahoo's DNS nameservers were behind that faulty router, said Cricket Liu, vice president of architecture with DNS appliance vendor Infoblox.
Yahoo appeared to have fixed the problem by moving some of its DNS services to nameservers run by Akamai, a company that helps sites deliver Web content, Liu said.
"It sounds like maybe they changed ... to Akamai to save their network bacon," he said.

Consolidation May Hit Worldwide PC Market, IDC Says

2008-12-05T02:51:00.000-08:00

Tumbling demand could affect PC makers next year, leading to industry consolidation, IDC said on Wednesday.
Competition among PC makers could intensify as consumers and enterprises tighten budgets during the economic downturn, creating a stagnant market for PC makers, said Richard Shim, personal computing research manager at IDC. That could lead to fewer opportunities for PC makers to sell their products.
The PC market is already pretty mature globally, so the lower-than-expected shipments and falling prices could create consolidation in the PC industry, either through acquisitions or by forcing competitors out, Shim said.
In mature markets like the U.S. and Europe, smaller PC makers may be forced out by larger competitors, Shim said. However, in emerging markets the smaller PC makers are ripe for acquisition, as larger PC makers are always trying to expand their customer base.
PC shipments worldwide are expected to grow by only 3.8 percent in 2009, a dramatic drop from the 13.7 percent growth the firm predicted earlier this year. Growth of PC shipments for 2010 has been lowered to 10.9 percent.
While Dell reported slow growth in PCs shipped for the quarter ended Oct. 31, companies like Hewlett-Packard and Apple have defied the economic downturn, reporting consistent growth in shipments. HP reported a 19 percent rise in unit shipments year-over-year for its most recent financial quarter, while Apple saw 21 percent growth in Mac shipments for the quarter ending Sept. 27.
Apple has a good chance of recording solid growth through the economic downturn compared to other PC makers, Shim said. Historically Apple has outpaced the industry, as it has a loyal customer base willing to pay higher prices for PCs, Shim said.
Consumers will show more preference for laptops over the next few years, with shipments outpacing those of desktops, IDC said. Laptop shipments are expected to grow from 168 million next year to 285.7 million in 2012, compared to desktops, which will grow from 145.8 million in 2009 to 156.6 million in 2012. IDC has not included handhelds like PDAs in the numbers.
The growth in laptop shipments will be driven partly by larger shipments of netbooks, or mini-laptops, which are small, inexpensive laptops with screens of up to 12 inches, Shim said. Netbooks are shipping in larger volumes in emerging markets because of their lower prices. However, consumers in the U.S. haven't figured out how to effectively use netbooks, as 20 percent of buyers return them, Shim said.
After years of double-digit growth, developed countries will see slower PC shipment growth because of the economic downturn. Shipments in the U.S. will decline by 3 percent in 2009 and continue to grow slowly in the coming years, while countries like Japan and Canada will see low single-digit growth. Growth in Western European countries is expected to continue at 6 percent in 2009, driven by increased laptop shipments, but it will be a giant drop from the 20 percent growth it is expected to record in 2008.
PC shipments in emerging Asia-Pacific countries will outpace mature markets, increasing by around 7 percent in 2009 and jumping up by around 18 percent to 20 percent in the following years, IDC said.
After being the fastest-growing markets over the past few years, emerging markets in Latin America and Central Europe will see PC shipment drop through the third quarter of 2009 due to falling prices and currency fluctuations. PC shipments are expected to increase at a slower pace in certain Middle East and African countries compared to recent years.

Facebook, Google Launch Data Portability Programs to All

2008-12-05T02:49:00.000-08:00

Google and Facebook separately announced the general availability of their respective data portability programs on Thursday.
Google Friend Connect and Facebook Connect are generally designed to extend social-networking capabilities broadly across the Web.
In the real world, this means making it possible for people to use their previously created Google and Facebook accounts to sign in to other Web sites that accept them. That way, people don't have to create an account for every Web site that requires one, reducing the number of log-in details they need to remember.
MySpace's Data Availability Initiative has a similar mission.
These programs also aim to let people port elsewhere content they have entered into Google, Facebook and MySpace, like profile information, photos, notes, list of contacts, comments, status updates and the like.
In its announcement on Thursday, Google said Friend Connect is now available to any Web site publisher and that the social features available can be added by copying and pasting snippets of code, so advanced technical knowledge isn't necessary.
To access Friend Connect features on a Web site, people can log in using not only their account information from Google but also from Yahoo, AOL and the industry standard OpenID, Google said.
Meanwhile, Facebook urged its users to contact their favorite Web sites and encourage them to implement Facebook Connect, which is already running on places like Citysearch, CNN's The Forum and CBS' The Insider.
"Obviously our launch partners don't cover all the websites you use on a daily basis, so if you want to see this list grow, get in touch with your favorite websites, developers, and services, and tell them you want to connect. With your help, we can all share more information across the web," wrote Facebook founder and CEO Mark Zuckerberg in a blog posting.
Still, the grand vision of widespread and seamless data portability is far from complete, as these and other initiatives are fairly recent, and important technology and privacy issues remain unsolved.
For example, days after the initial announcements of their data portability programs in May, Google and Facebook promptly locked horns and have been unable to work out their differences. Facebook blocked Google's Friend Connect service from accessing Facebook members' data, saying the Google program violates its terms of services because it redistributes Facebook user information to developers without users' knowledge.

LinkedIn Revamps its Search Tool

2008-12-01T00:56:00.001-08:00

The LinkedIn business social network last week rolled out an overhauled search platform that it says will let users more easily find who they are looking for on the site.
The new search engine uses what Esteban Kozak, a senior product manager at LinkedIn , called a personalized relevance algorithm to pick out the most relevant users in the 31 million-member LinkedIn community.
In a blog post , Kozak noted that the searcher's network is a key factor in ranking search results. Therefore, every matching search result is evaluated based on who is executing the search. "The end result is a personalized relevance algorithm that places the professionals that are most likely to be of interest at the top of the first search results page. We synthesized over a thousand pieces of feedback and analyzed data from over a billion search queries" in creating the engine, he said
New features include an "In Common" field, which lets users find what connections and groups he or she shares with the users listed in search results. In addition, users can customize their views of results. Thus, users can add or remove fields based on their own needs.
"We also saw in the data that many of you use search to get to your connections quickly," Kozak noted. "In order to make it more efficient, we developed a type-ahead widget that recommends connections as you type from any people search box."
Jason Kincaid, a blogger at TechCrunch , noted that the company is looking for the revamped search engine to streamline the most often used features on the network by the LinkedIn community of business users.
"The engine also streamlines advanced search by presenting options in a more accessible menu (some of the features were previously available, but buried so that most users never found them)," he added. " Most of the new features revolve around people-search ... and while there isn't anything particularly exciting from the user's perspective the changes make the engine significantly more convenient (and will hopefully help the recently unemployed get back on their feet that much faster)."
One of the search engine's most powerful new features, he added, is persistent search, which allows users to set up alerts notifying them when a company hires an executive, or when a potential job candidate may be available for hire. "Before now there have been a few ways to create similar notifications but this is the first time that LinkedIn has integrated this functionality," Kincaid noted.

Does E-Mail Really Make You Happy?

2008-12-01T00:54:00.002-08:00

While a survey of Canadian chief information officers showed the preferred mode of communication among IT staff is e-mail, this may not be the best way to gauge employee satisfaction, according to an executive with Robert Half Technology International.
The study by the Toronto-based IT staffing firm, based on interviews with more than 270 CIOs from across Canada, found that 49 per cent of respondents preferred using e-mail to communicate with each other at work.
"I find it sad that it's 49 per cent," said Sandra Lavoy, Ottawa-based regional vice-president with Robert Half Technology. The issue with using e-mail, said Lavoy, is it doesn't allow the reader to assess the sender's tone as easily as it would be on the phone or face-to-face.
E-mail archiving lets businesses manage correspondence.E-mail is, however, a good mode of communication for quick exchanges and maintaining written records of certain decisions, for instance, when deciding the date of a project deadline or arranging a meeting time, said Lavoy. E-mail also works well for following up on previous conversations, she added.
The study also found that the preference for in-person conversations was 34 per cent and phone calls was six per cent.
Lavoy thinks that CIOs probably rank e-mail higher than face-to-face and phone conversations simply because they often rely on mobile devices like Research in Motion Ltd.'s BlackBerry to stay in touch with the office when they're on the road. Besides, she said, it's common now for employees to travel frequently and have to communicate across different time zones, or have flexible work arrangements that allow them to work from home or work an irregular work day.
"But the problem in this volatile market that we're in is it's really important for us as employers to make sure we have these face-to-face discussions," said Lavoy. "The No. 1 reason why employees leave is lack of recognition; that could be something we're not addressing."
Given that the use of mobile devices like BlackBerrys is common across all organizations, the study did not find any variation in attitudes between CIOs from different-sized companies.
Respondents also reported their preference for instant messaging to be on par with phone calls.
Lavoy said that, given the state of the economy, businesses would benefit from face-to-face collaboration channels like videoconferencing and conference calls that allow "if you're going to have a discussion with multiple people and you want to get some resolution quickly."
However, Lavoy acknowledged that even videoconferences and conference calls lack that human touch because often there is a large number of attendees on the call with just one moderator to direct the proceedings.
Despite these findings, however, respondents still found that the prevalence of new technologies like handheld devices, instant messaging and text messaging in the workplace enabled better connectivity overall. Thirty-one per cent of interviewees said they felt much more connected and 26 per cent reported being somewhat more connected.

Malware is Getting Smarter, CA Warns

2008-12-01T00:54:00.001-08:00

Online attacks will be dominated by smarter malware and bots targeting Web users ranging from gamers and social network users to the elderly and unsuspecting parents.
This is according to IT management software company CA, maker of the CA Internet Security Suite, which was recently updated to the Plus 2009 version.
"Families should feel safe and secure when they are online," said Brian Grayek, vice president of product management for CA. "However, there are more online threats than ever before. While it's important for parents to practise general PC safety practices like not placing a PC in a child's room and monitoring social networking profiles, parental control software provides an added layer of protection and additional peace of mind."
CA Internet Security Suite Plus 2009
"Each element of the suite, which includes a personal firewall, anti-virus, anti-spyware, anti-spam and anti-phishing software has been enhanced to provide even stronger protection against a wide range of emerging online threats," said the software company.
The software is in a single console and is easy to use and install, allowing users to monitor the security status of all of the licensed PCs on their home networks, said CA. Other features of the suite include integrated parental controls that help protect children from inappropriate Web content and enable parents to monitor Internet activity. Also, the suite helps users back up and restore their important data and PC settings or transfer them to a new PC.
Grayek continued: "Historically, high-performance users, like gamers, turn off security features because it either slows down their PCs or they get pop-ups that interfere with their experience. This is a huge risk to their PC security. We've focused on developing a product that runs quietly in the background for uninterrupted gaming and movie watching, while keeping the PC secure."
CA Internet Security Suite Plus 2009 is currently available from CA for US$79.99 (MSRP), with a one-year subscription for up to five PCs in the household. More information is available at http://shop.ca.com/.

Adobe Rules in Web Video

2008-12-01T00:53:00.000-08:00

Eighty-one per cent of worldwide online videos are viewed using Adobe Flash technology, making it the number one format for video on the Web. This is according to the independent research firm comScore.
Adobe Flash Player software is already installed on 98 per cent of Internet-connected desktops and a growing number of mobile devices. The company has just released two key components of the Adobe Flash Platform.
New offerings
These are Media Interactive Server 3.5 software and Adobe Flash Media Streaming Server 3.5 software. Adobe Flash Platform delivers interactive content, applications, and video on the Web.
The new servers include new media delivery options, such as: dynamic streaming, enhanced H.264 video and High Efficiency AAC (HE-AAC) audio support, plus the ability to pause and seek within a live stream.
These innovations improve the quality of video delivered over the Web and offer richer interactive experiences for users, the company said.
The new versions advance the company's leadership in rich media and open significant new opportunities for content owners delivering interactive and social media applications, Adobe claims.

Botnets Can Trample Most Anti-Virus Programs

2008-11-28T17:36:00.001-08:00

A new analysis of botnets has come up with a possible reason for their prodigious ability to infect PCs -- many anti-virus programs are near to useless in blocking the binaries used to spread them.
According to FireEye chief scientist Stuart Staniford, detection rates are so poor that, on average, only around 40 percent of security software can detect binaries during the period of greatest infectivity and danger, namely the first few days after a particular variant starts being used by botnet builders.
In a detailed blog, he describes how he uploaded a sample of 217 binaries culled from FireEye appliances in customer premises between September and November to the independent VirusTotal test website. This runs 36 anti-virus programs -- a representative sample of the security programs used by businesses and individuals -- giving researchers access to data on get statistics on how many malware binaries have already been uploaded to the site by other researchers, when they were uploaded and how many were detected by each program.
Roughly half of the binaries picked up by FireEye were unknown to VirusTotal, a result indicative of the core problem of detecting botnet malware -- speed.
Because malware often uses 'polymorphism' -- programs are constantly changed very slightly to evade binary pattern detection -- the problem of detecting and blocking malware quickly is huge. According to Staniford, this makes it important that anti-virus programs can spot malware in the first week of its use.
"The sample is likely to get discarded by the bad guys pretty soon after that," he notes.
During the first three days after initial detection by FireEye, only four in ten anti-virus programs could spot the offending code, which suggests that many bots would evade security software during attacks on real PCs in they happened during this same period.
"The conclusion is that AV works better and better on old stuff -- by the time something has been out for a couple of months, and is still in use, it's likely that 70-80 percent of products will detect it," says Staniford.
FireEye's appliances can be seen as an 'early warning' system because of the way they use behavioural analysis to spot malware in real time, in some cases days or weeks before a program has been formally identified and documented by security companies. By the time it has been spotted and a signature rolled out to anti-virus databases, however, it might already be too late.
Equally, many prominent security vendors will use similar techniques to spot malware as quickly as possible, making it surprising that so many anti-virus programs failed to spot FireEye's sample binaries. The reason might simply be the vast number of samples that appear in any given period.
What nobody doubts is the importance of botnets to the spread of malware and spam, as evidenced by the recent takedown of a US hosting company McColo, which had been accused of hosting botnet controllers. In the hours after the hoster's demise, spam levels were reported to have plummeted dramatically.

Analyst: Mobile Data Will Continue Boom in '09

2008-11-28T17:35:00.003-08:00

There will be more than 36 million laptops connected to mobile data networks in Western Europe in 2009, compared to the 26 million estimated for the end of this year, according to market research company CCS Insight.
"It's a little bit more growth than what we have seen this year. Overall, next year you will see a push by all the carriers, but not just mobile carriers, but also from alternative providers as well," said Paolo Pescatore, analyst at CCS Insight.
For example, in Sweden, cable operator Com Hem is collaborating with 3 to offer subscribers mobile as well as cable broadband. The goal is for them to become one-stop shops for broadband, according to Pescatore.
Another big trend during 2009 will be packaging of mobile broadband in various new ways.
"Many mobile operators also have fixed-line assets, so they are very much in a position to package multiple access technologies and compete quite aggressively," said Pescatore.
The mobile operators will also start to package mobile phones and laptop connectivity.
"We are already seeing that today: whereby 3 here in the U.K are saying that if you take out a contract with us we'll also throw in mobile broadband at a 50 percent discount," said Pescatore.
Mobile broadband will weather the current economic storm, with growth and data-integration plans continuing, according to Pescatore.
For the mobile data operators both browsing on mobile devices and laptop connectivity will become an even more important source of revenue. "We have already seen this year how much of an impact that it's making on total revenue, and this will continue next year given the fact that voice connections are very much saturated, and there aren't many users to connect," said Pescatore.
Laptops will generate a majority of the traffic on a per user basis, but mobile phones will also be an important traffic generator. There are many more phones than laptops in circulation and data browsing from phones will continue to increase for a number of reasons. The industry has only skimmed the surface of what can be done with social networking on the phone, according to Pescatore.
"Social networking will continue to whet consumer appetite for data moving forward and we'll see a lot more collaboration between carriers and social networking sites, as well as social networking sites and device manufacturers," said Pescatore.
Mobile data growth is still a bit of a tricky proposition for operators because more customers mean more revenue but also a larger strain on networks.
So mobile broadband providers hope users will sign up for a mobile broadband deal in the same way they take out membership to a gym: a subscription makes them feel good, even if they take advantage of it less than they intended, according to Pescatore.

Hot Jobs: Software Implementation Analyst

2008-11-28T17:35:00.001-08:00

Job description: The software implementation analyst ensures that deployments of new applications or upgrades are planned and carried out correctly. They act as a bridge between the software developer and the IT infrastructure team that handles installation and maintenance, says Carlo Carbetta, vice president of operations development at CIO Partners, an executive search firm. They determine whether the applications interoperate with existing systems and plan for customization or integration work. This person may be involved in testing, creating documentation and dealing with end users.
Why you need one: When a company buys packaged software, it has to adapt it to its operations and processes. "If you don't have your own staffer involved in that implementation to make sure that the vendors understand your needs, you run the risk of the implementation moving off your business plan," says Eugene Farago, an account executive with the IT and metals division of Hudson, a recruitment and talent management firm. The software implementation analyst also acts as an agent of change for the company, steering it through an often risky but necessary process, he says. This means addressing user concerns while keeping the implementation on track. Finally, with IT environments becoming more heterogeneous, the need for someone with detailed knowledge of a company's business and technology increases, experts say.
Desired skills: Candidates should have computer, technical, engineering or science degrees,and certifications in areas such as project management and software development lifecycle. Experience with and knowledge of a company's business and technology operations are key. "This is a midcareer-plus position," Carbetta says.
How to find them: Software implementation analysts move around a lot and many do contract work, so they network a lot. Try business-oriented social networking sites like LinkedIn.
What to look for: A potential hire should be meticulous, process oriented, methodic and cool under pressure. They should be able to build relationships across the business and IT.
Elimination round: Ask candidates which software platforms they are most familiar with and their experience deploying them, including the environment size. Good candidates will discuss their interaction with the infrastructure team regarding things such as hardware provisioning and bandwidth requirements.
Salary range: $65,000 to $125,000
Growing your own: Groom internal candidates by rotating them through the business to gain expertise in a variety of areas. "They need to understand the bigger picture. A typical issue with implementation consultants is that they were previously a developer only and they get stuck in the details," Farago says. Putting a prospect on a process-improvement team is also a good idea. This allows you to see how quickly someone is at identifying problems and coming up with solutions, and to determine whether or not they are good facilitators.

VoIP: Worth the Effort?

2008-11-28T17:28:00.000-08:00

If product placement for film and TV is as effective as companies hope, Cisco must be rolling in it. If you've seen any scene in the last few years involving some form of office -- no matter whether it's in a high-rise commercial building, a hospital or a morgue -- there's a significant chance you'll see a Cisco-branded, IP-based phone sitting on a desk. If fiction mirrored reality, Voice over IP (VoIP) is ubiquitous already.
Unfortunately for Cisco, that isn't exactly the case. In fact, I think I'm yet to see an entire corporation that has made the switch to VoIP. Sure, there are the odd cases here and there -- small businesses trying to cut costs wherever possible, for example -- but unless you happen to work for a VoIP company, chances are you are on the same traditional PSTN line as everyone else.
So is VoIP really worth the hassle? Sure, there are the cost benefits if it is set up and organised properly, but the idea of adding layer of technology on top of your standard office network is mind-boggling. Load the network bandwidth of VoIP on top of your standard, snail-slow office Internet connection and there's a good chance your employees will find yet another way to remain unproductive, as IT staff struggle to rebuild the IP network in time for that all-important conference call.
For homes, the situation isn't too different. Sure, there are naked DSL plans, Analog Telephone Adaptors and dual-mode VoIP phones, but add VoIP onto your average broadband plan -- already cluttered with BitTorrent and Facebook -- and don't be surprised if it's nightmares ahoy. Not to mention that most naked DSL plans include uploads in the bandwidth quota, making the trip to dial-up town all that much shorter. If you happen to be the resident techie in your household and you feel confident to take the cons with the pros, go for it. For Joe the Plumber, though, VoIP is still a pipe dream.

Sony, IT Stocks Hit Again as Tokyo Market Slides

2008-10-27T02:57:00.001-07:00

Shares in Japan's major electronics companies slid again on Monday, as the benchmark Nikkei 225 index hit its lowest level in 26 years and the yen strengthened against the dollar.
An emergency joint statement issued by the Group of Seven major industrialized nations expressing strong concern over the recent sharp rise in the yen's value did little to halt the currency's climb. It was trading at ¥92.85 to the U.S. dollar at 4 p.m. on Monday afternoon, up ¥2.29 yen since Friday.
The strong yen makes Japanese goods more expensive overseas and also reduces the value of profits made overseas when they are brought back to Japan, hitting companies that are major exporters like Sony. The currency's climb in recent weeks was partly behind the revision Sony made to its financial outlook last week. Sony had assumed an average exchange rate of ¥105 to the U.S. dollar when it originally issued its financial outlook but the revised outlook assumed ¥100 to the U.S. dollar, which is already far away from the currency's current value.
Shares in Sony, which lost 12 percent of their value on Friday, were again hit hard and closed down 8 percent at ¥1,821 (US$19.59).
On Monday Canon revised its financial outlook downwards because of the strong yen. The company said the exchange rate and a slowing global economy hit demand for its products and as a result net profit in the July to September period was down 21 percent against the same period last year. It now expects to record a full year net profit of ¥375 billion, down from its previous target of ¥500 billion.
The results and earnings forecast downgrade were issued after the Tokyo market closed and won't be reflected in the company's stock price until Tuesday at the earliest. In Monday trading Canon shares were down 11 percent.
Other electronics companies saw steeper drops.
Shares in computer memory chip maker Elpida slid 16 percent to an all-time low after investment banks cut their outlook for the shares. Pioneer saw its shares decline 15 percent also after a cut in the share outlook, Mitsubishi Electric dropped 14 percent and Sanyo Electric was off 12 percent.
Shares in computer game maker Nintendo, which also relies on overseas markets for a lot of its sales, were down 11 percent, NEC shares fell 10 percent and single digit declines were recorded by Fujitsu, Panasonic and Toshiba.
This week sees quarterly earnings for the July to September period due from many electronics companies. Panasonic and Ricoh are due to report after the market close on Tuesday. Toshiba, Fujitsu and Sony will report on Wednesday. Thursday will see Sharp, Nintendo, NEC, Hitachi and Kyocera. Cell phone carrier NTT DoCoMo is due to report results on Friday.

IBM Set to Discuss 'Information Agenda

2008-10-27T02:55:00.000-07:00

Attendees of IBM's Information on Demand conference this week in Las Vegas will be bombarded by a rash of product and services announcements and a lot of discussion about how to create an "Information Agenda."
IBM launched the IOD strategy, which pulls together a wide range of data management, storage and analysis technologies, a few years ago. Since then, IBM has made a string of acquisitions to support IOD, including the large BI (business intelligence) vendor Cognos.
Announcements at this year's conference are expected to include:
-- "Foundation Services," which consist of a one-day workshop followed by 12 weeks of follow-up consulting, that are meant to help customers create an "Information Agenda." IBM hatched the phrase in September when it announced a set of tools, services and industry-specific data models for helping companies use information "as a strategic asset across their businesses."
-- The C3000 and C4000 editions of the InfoSphere Balanced Warehouse, which are data-warehousing appliances aimed at small and medium-size businesses, now include Cognos 8 BI.
-- Seven new performance management and financial offerings based on Cognos technology. Among them are Clinical Resource Planning, for pharmaceuticals to perform modeling and forecasting, and Earned Value Management, which federal agencies can use to monitor capital spending.
IBM is also expected to discuss news around MDM (master data management), ECM (enterprise content management) and a range of releases due before the end of the year from its Optim product line, which it acquired through the purchase of Princeton Softech in 2007. Optim products focus on data archiving, classification, data privacy and test data management.
About 7,000 attendees are expected at this year's conference, compared to roughly 6,000 last year, according to IBM.
IBM's IOD strategy is broadly relevant simply because so many companies "have bet the business on a large swath of IBM solutions," said Forrester Research analyst James Kobielus. In a weak economy, customers may consider consolidating their data management technology "down to fewer, but more strategic and comprehensive, vendors, such as IBM," he added.
As far as the BI portion of its arsenal, IBM could be in a better position to innovate in coming years than its rivals Oracle and SAP, according to Forrester analyst Boris Evelson.
Oracle still has a good deal of work to integrate products from its Siebel and Hyperion acquisitions, while SAP, which recently bought BI vendor Business Objects, has "some tough decisions to make on how to help their customers migrate from Netweaver BI to the new product line," Evelson said.
Meanwhile, the IBM-Cognos merger saw few product overlaps and Cognos "already took the time a few years ago to streamline and upgrade the platform," he said.

Intel's Moorestown Platform to Get 3.5G Support

2008-10-20T02:56:00.001-07:00

Intel's upcoming Moorestown chip platform will include optional support for high-speed cellular data services when it hits the market in 2009 or 2010, Intel said Monday.
Moorestown will be based on Lincroft, a system-on-chip that includes an Atom processor core and a memory controller hub, and a chipset called Langwell. Designed for small, handheld computers that Intel calls Mobile Internet Devices, Moorestown will offer optional support for both WiMax and HSPA (High Speed Packet Access) cellular networks.
Intel is heavily pushing WiMax, which it sees as the best option for future wireless broadband services. But WiMax availability is very limited and it will take time for networks to enter commercial operation and expand their coverage areas. The addition of HSPA support to Moorestown hints that Intel recognizes that WiMax may not be extensively deployed as quickly as it would like, and users will want an alternative way of connecting wirelessly outside of Wi-Fi hotspots.
This isn't the first time Intel has flirted with offering 3G (third generation telephony) support to computers. In 2007, the company shelved an agreement with Nokia to provide 3G modules for Centrino laptops, saying customer interest in the technology was lukewarm.
That appears to be changing. At the Intel Developer Forum in San Francisco during August, Belgium's Option showed off HSPA modules it developed for MIDs based on Intel's Atom. On Monday, Intel announced that Option and telecom equipment maker Ericsson will make low-power HSPA modules that will be offered as an option with Moorestown.
Intel is making its own WiMax module for Moorestown. The module, code named Evans Peak, made an appearance at the Ceatec show in Japan during late September.

Tech Economic Woes Don't Rival Dot-Com Bust

2008-10-20T02:53:00.002-07:00

Current economic uncertainty will impact IT budgets in 2009, according to Gartner, but the industry won't experience the extreme cuts it suffered in 2001 as a result of the dot-com bust.
Gartner analysts presenting at Symposium/ITxpo 2008 Monday in Orlando said the research firm is reducing its original forecast of 5.8% global IT spending growth down to 2.3% for 2009. In the United States, the research firm expects existing 2008 budget plans to not change significantly and forecasted spending in 2009 to remain flat.
"In the worst case scenario, our research indicates an IT spending increase of 2.3% in 2009, down from our earlier projection of 5.8%," said Peter Sondergaard, senior vice president at Gartner and global head of research, in a press release. "Developed economies, especially the United States and Western Europe, will be the worst affected, but emerging regions will not be immune. Europe will experience negative growth in 2009; the United States and Japan will be flat."
While the financial events of the past few weeks will impact 2009, Gartner said it doesn't expect the fallout to be as significant as the recession of 2001. Due in part to the "dramatic reductions" made in response to the dot-com bust, Sondergaard said the IT industry is better prepared to respond to today's economic woes. According to Gartner, IT budgets were "slashed from mid-double-digit growth to low single-digit growth" during and after the 2001 recession.
Also IT has been able to shift its position from a back-office cost center, Gartner suggested, to an active partner in the business. For instance, IT is now "embedded in running all aspects of the business" and often employs "multi-year IT programs aligned with the business," which are more difficult to cut in the short term. Gartner also pointed out that IT spending decreases "lag the economy by at least two quarters."
"What [CEOs] want now most of all is agile leadership. Leadership that can guide us through simultaneous cost control and expansion at the same time," Sondergaard said.

Mini Laptops Bolster PC Sales, Gartner Says

2008-10-20T02:53:00.001-07:00

With the economy in turmoil, a lot of people who are looking to buy PCs are increasingly turning to cheap, low-power mini laptops.
And that single move is bolstering what otherwise would be a soft PC industry, according to industry analysts at Gartner Inc. With a strong push from the new slew of mini notebooks hitting the market, worldwide PC shipments reached 80.6 million units in the third quarter this year, marking a 15% increase from the third quarter of 2007.
"The mini-notebook segment experienced strong growth in the global PC [market], led by robust growth in the Europe, Middle East and Africa region," said Mika Kitagawa, a principal analyst with Gartner, in a statement. "In the North America market, the economic crunch created more interest in the sub [US]$500 segment ... At the same time, the global PC market finally felt the impact from the global economic downturn. The U.S. professional market experienced the biggest hit from the economic crunch. The U.S. home market saw definite softness in PC sales after a few quarters of strong growth."
A lot of PC makers are diving into the mini or ultra-portable laptop market.
In August, Lenovo took a run at the fledgling netbook market with a new ultra portable laptop. Scheduled to be available this month, the IdeaPad S10 has a starting price of $399.
Mini laptops, increasingly known as netbooks, are relatively inexpensive, small form-factor notebooks designed for basic applications, such as Web surfing, e-mailing and word processing. They're designed to use less power than traditional PCs and laptops and aren't robust enough for serious power users or gamers.
Intel Corp. announced earlier this year that it was betting heavily on the new market. The chip maker began shipping Atom processors for mobile Internet devices, which are small almost pocket-size machines, in April. Intel spokesman Chris Tulley said at the time that the company expects sales of netbook and "net-top" devices to outpace growth of traditional laptops and desktops.
Early in June, Acer Inc. dove into the mini-laptop market with the Aspire One netbook, which is designed to use Intel's Atom N270 chip. Acer's netbook runs either the Linpus Linux Lite operating system or Windows XP Home.
That move into the netbook market worked out well for Acer, according to Gartner's report. The analyst firm reported that both Acer and ASUS "had a strong focus and acted quickly in the mini-notebook segment." Because of it, both PC makers saw strong third quarter growth.
Gartner reported that Acer, which has scrambled into third place in the worldwide PC shipment market, saw 47.3% year-over-year growth in the third quarter. That's compared to 8.1% for fourth-place Lenovo, 15.1% for market leader Hewlett-Packard Co. and 11.6% for second-place Dell Inc.
Gartner reports that HP was hurt by its slow entry into the netbook market. Dell, which maintained its top position in the U.S. market, was hit by the general weakness in both the enterprise and home markets.
According to the analyst firm, for the U.S.-only market, HP comes in behind Dell, while Apple takes the third spot. Acer is in fourth place and Toshiba rounds out the top five.
PC shipments in the U.S. market grew 4.6% in the third quarter of 2008 compared to the same time last year. Gartner also reported that mini-notebook shipments accounted for about 5% of U.S. mobile PC shipments and added one to two percentage points of year-over-year growth.

Altor Ships Firewall for Virtual Systems

2008-10-20T02:52:00.000-07:00

Altor Networks is announcing the availability of its firewall designed for virtual environments that overcomes some shortcomings of traditional firewalls that have been adapted to run on virtual machines.
Altor VF addresses blindspots that exist with other firewalls deployed in virtual environments. Products outside the physical server on which virtual machines are running have no visibility of traffic among the virtual machines and can take no action on that traffic.
In addition, as virtual machines recreate themselves to meet demand -- known as live migration -- they can wind up on physical machines with other applications they were never intended to be exposed to. Live migration can help propagate infections by expanding the presence of corrupted machines.
Altor VF migrates a virtual firewall and the rules that pertain to a particular virtual machine when it undergoes live migration. Other firewall vendors such as Check Point and Stonesoft offer virtual versions of their firewalls, but they don't address firewall rules for virtual machines that migrate.
Altor includes a tool to define where to place firewalls among virtual machines, automating a multi-step process. It also controls virtual machine sprawl by enabling default settings that can, for example, lock down virtual machines for which no one claims ownership.
The firewalls can also impose security policies on traffic.
Altor VF integrates with Juniper intrusion-detection system (IDS) gear, sharing its logs so the IDS can assess traffic among virtual machines. Altor says it has a similar relationship with ArcSight's security event management platform and Mazu's network behavior analysis products.
Altor VF costs US$2,000 per physical server with discounts for volume purchases.

Exchanging E-mails With a Pirate

2008-10-15T02:52:00.002-07:00

The Pirate Bay (TPB), one of the world's biggest torrent tracker sites, found itself embroiled in controversy last month, when a link to a torrent containing photographs of a grisly child murder in Sweden appeared on the site.
A torrent is a small file that contains information about another file, such as a movie, distributed using the BitTorrent peer-to-peer protocol. The torrent itself doesn't contain the movie, but acts as a marker of sorts, pointing computers to the actual file.
The torrent of the photographs, which were released by a Swedish court presiding over the case, was not posted online by TPB or its founders, but the site nevertheless found itself at the center of a discussion on the limits of free speech on the Internet, and to what extent Web sites should be held responsible for content posted by users.
The controversy was different from that normally faced by TPB, which has made enemies of the music and movie industries, as well as the U.S. government, over allegations its activities violate copyright law -- charges the site denies, citing differences between U.S. and Swedish law.
TPB's view on the pictures was that anger over their release should be directed towards the court that made them public, rather than TPB. The site refused calls to take down the torrent, citing its general commitment to not censor or remove any files posted to the site, regardless of the circumstances.
The controversy came to a head when Peter "brokep" Sunde, one of the founders of TPB, was invited to appear on a Swedish television show for an interview, under an agreement that the father of the murdered children would not be present. According to Sunde, the television station broke the agreement and surprised him by inviting the father to participate in the show with him.
That experience led TPB to declare an end to all contact with the press. "All future interviews are to be considered impossible. We have no longer any interest in participating in traditional media since it's apparent that they are not trustworthy," TPB announced on its blog on Sept. 12.
Sunde and Fredrik "TiAMO" Neij, another TPB founder, will speak at the upcoming Hack In The Box (HITB) security conference in Kuala Lumpur, Malaysia, later this month. Their keynote presentation is called "How to dismantle a billion dollar industry -- as a hobby."
Despite the announced ban on press contact, Sunde agreed to an e-mail interview ahead of the presentation. What follows is an edited version of that exchange.
IDGNS: What can we expect to see in your presentation at HITB? Why did you decide to present at the conference this year? How did that happen?
Peter Sunde: The presentation will probably be a mixture of a tech presentation, some pirate humor and a story about the power of Internet. We usually hold seminars for politicians, so it's going to be very much more interesting doing it in front of people that understand the technology. We will talk about how and why we do what we do! We got in contact with some guys from Hack In The Box who are really good at what they do and they invited us to come over. Going to Asia is never a boring thing so we went for it!
IDGNS: The recent situation in Sweden involving the pictures from the police case and the interview on Swedish television was obviously an emotional experience. The Pirate Bay has said it believes in free speech without restrictions. At a personal level, did this experience cause you to reconsider your stance on this issue?
Sunde: No, we are very sure of what we do. One of the most impressive things for me about TPB when looking back is our consistency towards our goals and ideals. We've always been true to them, even when the winds have been blowing against us rather than with us. And in the end, that's what makes us what we are -- we're honest and have a good ideology behind us. Compare us to our opponents and see what you get -- hint, it's not honesty and ideals.
IDGNS: In an ideal world, do you think copyright should exist? If it should, what do you think is the ideal way to structure copyright laws? What restrictions should be put on consumers, and what rights should copyright owners have?
Sunde: The copyright issue is quite complex -- more complex than just writing an e-mail. But I do see things that can work in a copyright, but for commercial aspects. It's very important to not infringe on personal life due to copyright. Creative Commons and other licenses are a better way than today's copyright laws. However, I do feel that Creative Commons is not reaching far enough.
IDGNS: What do you think is the current state of copyright law and Internet censorship, globally? Are we moving forwards? Backwards? What forces are driving these changes?
Sunde: I think that the people are definitely moving forward. The media industry is fighting, lobbying and bribing their way through the system, which is a really bad thing, both for us and them. In the end, it will show that they are only in this for money and nothing else. What a surprise! It's not good for business.
IDGNS: Can you tell me something about the recent move in Italy to block access to TPB's site? What really happened leading up to when the judge overturned the decision by a lower court to block the site, and what was the ultimate impact from your perspective?
Sunde: IFPI [International Federation of the Phonographic Industry] in Italy -- called FIMA, I think -- decided to sue us personally in a country where we do not live or have any connection. That in itself is not a valid thing in Europe, but the judge however decided to let them do it and to let them win. It was quite crazy. We found some really good lawyers afterwards that helped us with the case and we won it quite easily in the higher level of court.
FIMA had a major setback by that, when even the European Union had rules saying that an EU country is not allowed to block access to a system in another country like that. For some stupid reason they refuse to listen to the judge and the laws (the typical IFPI approach) and have now decided to appeal to the supreme court. It's no chance for them to win but they are losing face if they don't appeal. The interesting part is that we have never done anything illegal, not according to Swedish nor European Union laws. Our opponents have broken hundreds of laws in order to get to us.
IDGNS: What is the latest on The Pirate Bay's other projects, like BayWords and the streaming-video service?
Sunde: Oh yes, we have some projects coming out. A problem is that we're only two to three people in the gang and some are more active than others, so the projects tend to take some time to finish. But we have two very exciting projects that we're working on and we hope to maybe talk more about them at Hack In The Box.

NetSuite Debuts 'SRP' Product Push

2008-10-15T02:52:00.001-07:00

On-demand ERP (enterprise resource planning) vendor NetSuite announced a new product push Tuesday, stemming from its June acquisition of OpenAir, maker of software for project-oriented organizations.
NetSuite has been working to integrate its product and OpenAir's, and is now marketing the combination under the moniker of NetSuite SRP (services resource planning).
The products will work in tandem, with functionality like sales automation and core financials coming from the NetSuite side, and matters such as project task management and timesheets handled by OpenAir, which is also on-demand software.
NetSuite demonstrated the integration work at a company event in Boston Tuesday. An official showed how an employee could create a customer record in NetSuite and push it into OpenAir. Then the representative showed how to assign a consultant to the project and subsequently push information on the hours the person worked back into NetSuite for accounting.
"Sure, you could program all this stuff yourself for products that you use, but then you have to maintain that," said NetSuite CEO Zach Nelson, emphasizing one oft-cited, purported advantage of SaaS (software as a service) products like NetSuite, which sees vendors handle upgrades and integrations.
NetSuite didn't provide pricing information.
Michael Fauscette, an IDC analyst who spoke at NetSuite's event, said the project-based ERP market will grow to $1.5 billion by 2010.
But since many project-based companies actually bought ERP systems geared more for product manufacturing and then customized them, the real size of the project-based market could be much larger, he said.
In other news Tuesday, NetSuite announced a revamped OpenAir product lineup that includes offerings for small, medium and large businesses.
The entry-level Team Edition includes integrations with QuickBooks and NetSuite and, for a fee, Salesforce. The mid-level Professional Edition adds more powerful features, such as a configurable billing rules engine. The high-end Enterprise Edition provides the Professional Edition's features plus additional functionality, like an API (application programming interface) for connecting with other applications, as well as 24-7 customer support.
NetSuite's announcements closely follow Oracle's recent news that it plans to buy Primavera, a vendor Forrester Research analyst Ray Wang termed "the granddaddy of project management." Oracle CEO Larry Ellison is a major investor in NetSuite.

Washington Uses Google Apps to Power New Intranet

2008-10-15T02:51:00.002-07:00

When it came time for Washington, D.C., to create a new intranet for city employees, spending US$4 million on a site based on proprietary portal software just didn't seem like a good idea to CTO Vivek Kundra. But using Google Apps did, he said in an interview Tuesday.
With its Web-based Google Apps suite, Google is currently trying to fashion itself into a worthy competitor to Microsoft Office in enterprise accounts. Washington, D.C., is an example of where the company is making some inroads, thanks to the thinking of 34-year-old Kundra, who believes technology that is open source or based on open standards -- or both -- is the future for the enterprise.
Google Apps is not replacing Microsoft Office entirely for the 38,000 municipal employees in Washington D.C., as some published reports have implied. However, Kundra said he is seeing more and more government employees "migrating to using Google Docs instead of Microsoft Office," and Google's online applications have advantages as far as ease of use and the ability to build new sites for the city's intranet quickly and easily.
The use of Google Apps to power the city's new intranet has its roots in a decision Kundra made soon after he took his job in March 2007. He looked at current IT projects and decided to eliminate one to build an intranet for millions of dollars based on proprietary portal software from Plumtree.
Washington, D.C., has been piloting the intranet with employees since June 2007. The application, which uses Gmail as its e-mail service and Google Apps for documents and spreadsheets, went live earlier this year and is currently in regular use, Kundra said.
Kundra decided to go with Google Apps as the basis for the new intranet not only because it was less expensive -- the city is paying Google about $475,000 a year in licensing fees -- but because new applications and interfaces can be assembled quickly on Google's platform because of its open nature.
"When we looked at integration and deployment costs, what we decided to do [was use Google because] it was at a lower cost and was a faster way of achieving the same goal," he said.
Take for example a new site the city created for its Fall 2008 Job Fair. On it, Kundra has his managers outlining in YouTube videos the positions for which they're hiring, an example of how easy it is on Google Apps to allow for "voice, video and data integration," he said.
Though Google Apps is not entirely replacing Office, it is eliminating the use of Microsoft's suite for certain jobs, Kundra said.
The city's budget planning and procurement process, the way it conducts internal surveys and, as shown by the Job Fair example, the way it goes about posting jobs and hiring employees are now done via Google Apps, he said. Previously, these tasks were largely based on a paper trail of Microsoft Word documents, Kundra said.
Google isn't the only company gunning for Microsoft, which still has the lion's share of the business market for productivity applications. IBM also has a free office productivity suite, Symphony, that it has built into its Lotus collaboration suite. There also is OpenOffice.org, the freely available, open-source productivity suite, the third version of which was released to the Web Monday.

Intel Earnings Up, Future Uncertain

2008-10-15T02:51:00.001-07:00

Despite the ongoing financial crisis that is weighing down some tech companies, Intel earnings were up in the third quarter, narrowly beating analyst expectations.
Net income for the quarter was US$2 billion, or $0.35 per share, up from $1.8 billion, or $0.30 per share, in the same period last year. Analysts polled by Thomson Financial had expected $0.34 per share.
Intel's net revenue was $10.2 billion. Sales in both its microprocessor and chipset units drove revenue for the quarter, which ended Sept. 27.
The third quarter was the first full period in which Intel sold its Atom microprocessors and chipsets for low-cost PCs, and sales of the chips brought down the average selling price of microprocessors for Intel. Overall, the average selling price was lower sequentially, but excluding Atom shipments, the average stayed flat, Intel said.
The results included a number of charges, such as an impairment charge for the Numonyx investment and a restructuring charge.
Intel warned that it is difficult to know how the current economic environment may affect its business in the coming months. The chip giant plans to release a mid-quarter business update on Dec. 4. But for now, it is expecting revenue for the fourth quarter to be between $10.1 billion and $10.9 billion. The fourth quarter will include a charge related to the recent decision by Intel and Micron to close their joint production of NAND flash memory from an Idaho facility.
Intel's results come just a week after competitor AMD said it plans to split into two companies, one to design chips and one to make them, in an effort to compete more effectively with Intel. AMD, which plans to release its third-quarter earnings report on Thursday, has reported losses in the past seven quarters.

US Court Lifts Ban on Qualcomm Phone Imports

2008-10-15T02:50:00.000-07:00

A U.S. appeals court overturned a ruling that prevented Qualcomm's handset-making customers from importing products to the U.S. because they allegedly contain patented technology developed by Broadcom.
The appeals court said the U.S. International Trade Commission had overstepped its bounds when it issued the ban against handset makers who were not named in Broadcom's complaint to the ITC. The appeals court also said the ITC misapplied the legal standard for "induced infringement."
At the same time, the U.S. Court of Appeals for the Federal Circuit agreed with the ITC's finding that the Broadcom patent in question is valid, something Qualcomm had disputed. The appeals court posted the 31-page ruling to its Web site (PDF).
Qualcomm said the court had "disapproved Broadcom's tactic of attacking the wireless industry, including handset manufacturers and wireless operators, without providing them with the opportunity to defend themselves in the action."
But Broadcom also applauded part of the ruling and appeared set to appeal.
"We are pleased that the Court affirmed our patent's validity, the infringement by Qualcomm's customers and the validity of the ITC's claim construction. In light of that, we believe that Qualcomm's continued use of our patented technology would certainly meet the new standard of intent and be found to infringe. We look forward to addressing this issue upon remand to the ITC," Broadcom said.
The ITC's ruling, issued in June last year, applied to new phones developed subsequent to the ruling, and followed an earlier ITC finding that Qualcomm had infringed on Broadcom's patent. The companies that joined Qualcomm in the appeal included Kyocera Wireless, Motorola, LG Electronics and Palm, as well as wireless carriers AT&T Mobility and Sprint Nextel.
The patent in question, U.S. patent number 6,714,983, describes a technology that helps save battery life when a mobile phone can't find a wireless signal. It can be viewed by searching at the U.S. Patent and Trademark Office Web site.

Google in Curious Alliance With Click-fraud Detection Firm

2008-10-11T02:56:00.000-07:00

In a development that would have seemed impossible two years ago, Google is cooperating publicly with Click Forensics, a click-fraud detection company with which it has had a rocky relationship.
Click Forensics said Thursday that Google has agreed to accept the electronically generated click-quality reports generated by the Click Forensics FACTr service. That means the process of documenting click-fraud instances and submitting reports to Google will be significantly automated and simplified for advertisers that use the FACTr service.
Google and Click Forensics make for strange bedfellows. The companies have sparred over the issue of click fraud, and the rhetoric has often approached ugly territory.
Google has accused Click Forensics of being inept in its methodology and misleading in its results in order to make the problem seem bigger than it is. Meanwhile, Click Forensics has charged that Google has purposefully trivialized click fraud and mischaracterized it as a minor problem.
Starring in the skirmishes have been Click Forensics President and Founder Tom Cuthbert and Google's expert on click fraud, Shuman Ghosemajumder.
Click fraud happens when someone clicks on an ad with malicious intent. For example, a competitor may click on a rival's pay-per-click ads in order to drive up their ad spending. Or a publisher may click on pay-per-click ads on its site to trigger more commissions.
Google generates almost all of its revenue from the type of online advertising that is most vulnerable to click fraud -- pay-per-click ads that appear along with relevant search results or in Web pages of relevant content.
Google declined to comment for this article, but Click Forensics CEO Paul Pellman said his company welcomes Google's cooperation in the FACTr (Fully Automated Click Tracking Reconciliation) service.
"From our standpoint, this is the first opportunity in which we've been able to implement something specific with Google, which is great," Pellman said.
Joseph Cowan, senior search strategist at Outrider, a search-engine marketing agency, said it would have been unheard of not long ago for Google to let itself be identified as a Click Forensics collaborator.
"Two years ago, it was a very adversarial relationship," said Cowan, whose company helps advertisers manage campaigns on Google and other search ad networks.
Outrider, which has been in business for 13 years, started offering Click Forensics click-quality services to its clients about two years ago. It realized at the time that click fraud went beyond scammers clicking on pay-per-click ads for malicious purposes, such as inflating their commissions or hurting competitors, he said.
Outrider views click fraud as a broader problem that includes what it calls "unwanted clicks" that aren't maliciously generated but that nonetheless offer advertisers little or no value. For example, a company that only sells in the U.S. gets no benefit from clicks on its ads by people who live abroad, he said.
Gaining this insight, backed up by hard data from Click Forensics, lets Outrider further optimize its clients' campaigns, Cowan said. And the more confident a company is about the effectiveness of its search ad campaigns, the more it will invest in them, which is good for all parties involved, Google included.
"By buying into this, Google is simply accepting the fact that it's good to have a third party review [its ad campaigns] so that someone not connected to their company is also saying 'yes, it's working,'" Cowan said.
Click Forensics' Pellman said his company doesn't need cooperation from Google or any other search ad providers in order to collect their data and track clicks on clients' campaigns.
However, the FACTr service, which focuses on generating automated reports based on the collected data right from the Click Forensics interface, does benefit from cooperation from the search ad providers.
"Customers can now [electronically] submit a detailed evidence report in the format in which Google wants it, which is different from the format in which Yahoo wants it. And Google will accept that report and respond back," Pellman said.
In addition to Google, Click Forensics also announced on Thursday that Miva and LookSmart are now also supporting FACTr.
Click Forensics, which reports on click-fraud incidence every quarter, recently said that the overall industry average for click fraud was 16.2 percent in the second quarter of this year. "We continue to see click fraud as a big challenge for advertisers," Pellman said.
Fraudsters are getting more sophisticated and trying to make their scams harder to detect and track, lately resorting to using botnets to perpetrate click fraud, he said. "Click fraud is a big, consistent problem and it's not going away," Pellman said.

PCI App Security: Who's Guarding the Data Bank?

2008-10-11T02:55:00.004-07:00

While Willy Sutton never really said it, the truth is that people rob banks because that is where the money is. Today's criminals don't walk into banks with loaded guns and get-away drivers. Rather they connect from a remote location using a browser and are armed with hacking tools and spyware.
Where criminals of old targeted the teller behind the counter, today's attackers target banking and e-commerce applications. So, although the targeted infrastructure has changed, not much else has really changed from a threat perspective since Willy Sutton robbed banks. Ask a hacker "where is the money?" They will tell you: behind and within the poorly written and poorly protected banking and e-commerce software applications.
The list of threats and their calamitous consequences targeting banking and payment applications is seemingly endless. Identity theft, data leakage, phishing, SQL injection, worms, application Denial of Service (DoS) attacks, and botnets just scratch the surface, but these are the threats critical applications have to be secured against today. The big problem is that the number of threats as well as the number of applications that need to be secured are increasing on a regular basis.
PCI and Application Security
To date, the industry has given short-shrift to the needs of application security, and we all have paid for it with continuing data breaches. Consider this, Microsoft finally got serious about application security in 2002 with its Trustworthy Computing (TWC) initiative. TWC was an outcome of devastating attacks against Microsoft operating systems with worms such as Code Red and Nimda.
TWC was announced in an all-employee email from Microsoft head Bill Gates. He redirected all software development activities at Microsoft to include a full security review. Even with that directive it still took years to get to the point where Microsoft's code could start to be secure. How many merchants in the PCI space have their founders tell everyone to code securely and that they will stop all development until it is done? The point was, and is, that application security needs to be taken seriously and this means, investing the time, effort, and resources to do it right.
Application security is at the heart of the Payment Card Industry (PCI) security standards and requirements. In the last few years, data breaches have resulted in hundreds of millions of data records being compromised. In most of these cases, the firewalls worked, the encryption worked, the logging worked, but the application contained security holes which obviated much of the security. It's like barring the front doors to the bank and leaving a back window open.
So why has PCI started focusing on web and payment applications? For the very reason that these applications are the most obvious entry point for attackers to gain access to back-end databases containing huge amounts of credit card data.
Within the PCI Data Security Standard (DSS), requirement 6.6 (which became mandatory on June 30, 2008) requires the validated security of web-based applications. PCI DSS requirement 6.6 requires organizations that process credit card transactions to address the security of web applications, either via manual or automated source code reviews or vulnerability scans, or via the installation of a web application firewall between a client and application.
PCI DSS Requirement 6.6
While the applications security requirements in PCI DSS section 6.6 comprise a mere 44 words, don't think that application security compliance is either unimportant or a piece of cake. The specifics of requirement 6.6 are:
Ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
-- Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
-- Installing an application layer firewall in front of web-facing applications
First off, just what is this thing called an application layer firewall? Also termed a web application firewall, it is a network device that is placed in front of a web application to protect against application attacks. An application layer firewall can view and digest all application traffic, but has the enhanced capability to specifically filter session, presentation, and application layer network traffic (OSI model) in real time. This gives it the advantage of protecting the applications and all associated sensitive data from illegitimate access and unauthorized usage.
The security threats mitigated by an application layer firewall are very real. To give you a feel for things and to truly address business risk, note that the range of software security risks is significant. They can be divided into two distinct types; coding vulnerabilities and design flaws/policy violations. According to a leading software application security firm , they view the hierarchy as:
Coding vulnerabilities:
-- Buffer overflows
-- Format string vulnerabilities
-- Race conditions
-- Resource leaks
-- Input/output validation and encoding errors
o SQL injection
o Cross-site scripting
o Operating system S injection
Design flaws and policy violations
-- Cryptography
-- Network communication vulnerabilities
-- Application configuration vulnerabilities
-- Access control
-- Database and file system use
-- Dynamic code
-- Access control and authentication errors
-- Error handling and logging vulnerabilities
Insecure error handling
Insecure or inadequate logging
Native code loading
Data storage vulnerability
-- Insecure components
Malicious code
Unsafe native methods
Unsupported methods
Custom cookies/ hidden fields
While this one of a number of possible attempts at threat codification, the message should be clear that software security is a multifaceted effort that takes a directed and formalized approach.
Insecure Banking Applications
Resting 50 feet below sea level, on the solid bedrock of Wall Street, the Federal Reserve gold vault [links to .pdf] contains hundreds of billions of dollars worth of gold. Besides the extravagant layers of security implemented around, and within, this facility the reality is that gold being quite heavy, bulky, and is difficult to move. Even if an attacker got in, it would be hard to get out with a significant amount of gold.
While getting gold out is difficult, data is light and very fluid. Transferring a gigabyte of data today is almost trivial. The data contained in today's banking applications have the value of gold, yet are light enough to access and move with ease. These applications will contain from tens of thousands to hundreds of millions of records. The application will connect to a database that serves as the repository for sensitive personal data. The hacker's booty will be contained within these applications, and the currency can take many forms; but usually is comprised of customer account information and other personal identifiers that the modern day Willie Sutton can use for ill-gotten gains. And getting the currency out is merely transferring strings of ones and zeros from one computer to another, hardly like attempting a haul of heavy gold bars.
In the case of PCI Data Security Standards (DSS) the 'money' or currency, aka sensitive information that most needs to be protected, includes:
-- primary account numbers (PAN)
-- cardholder name
-- various service codes
-- expiration date
-- other items that are allowed to be digitally stored if suitably protected
-- magnetic card stripe data including security codes and PIN's
In fact, based on merchant compromises, Visa has found that the storage of prohibited data (full track, CVV2, PIN blocks, etc.) was the prime cause for most cardholder information data breaches. Often, the data stored in these databases should have never been stored there in the first place once the requested credit card transaction was authorized. But time and time again there are instances of proprietary and commercial off-the-shelf (COTS) applications being compromised because they are not developed to be in compliance with PCI DSS and secure coding requirements. In some instances the reported code flaws violated just plain common sense application development standards, such as OWASP.
As security professionals and PCI Qualified Security Assessors (QSA) [links to .pdf], based on our own experience and insight into the market, the authors are surprised that in 2008, there are still banking applications that are deployed without a formal security-based SDLC and security code review. Compounding this, far too few organizations have effectively trained their developers in security development practices. It is almost criminal that in late 2008, developers creating such payment processing applications don't even know what the PCI DSS requirements for the proper processing and storage of sensitive information are.
An additional layer of protection should be provided by quality assurance personnel who should be testing these applications. They should do so with respect to all aspects of how sensitive information is handled throughout the information life-cycle and the historical recording of resultant transactions. Yet many application test teams continue to focus their efforts on testing only the functionality, scalability, and loading requirements of application capabilities.
To their credit, some application testers may actually scan the various components with a generic vulnerability scanner, but lack the skill set to properly interpret the scanner output results. They may also be relying on how the application is deployed or on other external controls to provide the necessary security. Those tasks might have been tolerable long ago on non-Internet connected systems, but are vastly inadequate when the application is running on an open, publicly accessible networks.
Fortunately for those who rely on such commerce, which is everyone with a credit card, the PCI Security Standards Council (PCI SSC), the major card brands, card issuers, and Qualified Security Assessors across the industry are working in concert to permanently change things for the better. The posse, if you will, has been formed, and if the necessary fundamental changes can be made, the modern day Willie Sutton and his boys' days are numbered. Payment application security may ultimately become ubiquitous and considered just as important as any other system function.
PCI Application Security Requirements
Currently, there are requirements for custom in-house or out-sourced applications and software that are not commercially re-sold to comply with all relevant requirements of PCI DSS, All custom applications must be developed, deployed, supported and refreshed according to these requirements.
They include the following:
1. Applications must be developed as a part of a well-defined Software Development Life Cycle (SDLC) with security principles incorporated into the development process.
2. Applications should reside on hardened operating systems and with discrete and well defined limitations on unnecessary functionality.
3. Applications should never store sensitive authentication data (card magnetic stripe, security codes, PINs, etc.)
4. Applications should not interfere with cyber-security controls such as antivirus, firewalls, cryptographic protections, secure authentication schemes, IDS/IPS, etc.
5. Web based applications must be developed in accordance with the Open Web Application Security Project (OWASP) guidelines for secure coding.
6. Web-facing applications (i.e.-Internet facing) must be protected either with a source code review by an authorized entity or be protected by application firewalls.
7. Applications should be tested for security vulnerabilities in addition to functionality testing by someone other than the authors of the actual code.
Application Security Action Items
Some business and IT leaders may be just starting to consider the security implications of their banking or commerce applications. There may be lingering uncertainty on what to do first. The following 5 steps are a great first start:
1. Update POS Applications. Visa maintains a list of Payment Application Best Practices compliant POS applications. Ensure that you are running a compliant version of POS.
2. Identify Poorly Coded Web Apps. Perform a code review for known coding flaws. Then follow-up with a vulnerability scan and an application-layer penetration test to ensure application code is PCI complaint and secure.
3. Perform Quarterly Vulnerability Scans. As detailed in DSS section 11.2, run internal and external network vulnerability scans at least quarterly and after any significant change in the network (such as new system component installations, changes in network topology, firewall rule modifications, product upgrades).
4. Perform Annual Penetration Testing. Both internal and external (public facing) applications that process "sensitive" data should be penetration tested at least annually and whenever they undergo significant revision.
5. Create Formal SDLC Processes. Microsoft understood this via Trustworthy Computing. Make sure you formalize a Software Development Life Cycle that incorporates security analysis throughout that life cycle.
Note that these five steps will keep your development teams busy for a while. And make sure you have a good project manager to keep all of the tasks and teams in sync.
Visa PABP Replaced With PCI PA-DSS
COTS payment processing applications that are sold or leased to the public have more stringent requirements for application security compliance. These requirements were originally developed, implemented and enforced by Visa and were known as the Payment Application Best Practices (PABP) standard.
Over the years these requirements served the industry well and have helped to protect Visa credit card commerce wherever compliant applications have been implemented. Unfortunately, however, the PABP was focused primarily upon applications processing Visa payments, and the enhanced security benefits could not be shared across all payment card brands. It became obvious that a broader, more encompassing application security standard was in order; this is where PCI Payment Application Data Security Standard (PA-DSS) came into play.
In November 2007, the PCI Security Standards Council (SSC) announced that PABP will be transcended by the PCI Payment Application Digital Security Standard (PA-DSS). In doing so the PCI SSC became the sole entity to maintain these new card brand independent requirements and oversee compliance with this new security standard. Payment applications that have been previously certified as compliant with the most current versions of the PABP specification will have their certification grandfathered for a limited time, and be given a grace period before they must be recertified under the new PA -DSS.
Newly developed commerce applications, which are sold to the public, will have to be tested and found compliant with PA-DSS requirements starting in October 2008. The two standards are similar and indeed a majority of PA-DSS content is based upon the previously well-defined PABP requirements. There are some distinct differences between two, however, including a very stringent requirement for the PA-DSS QSA to validate the environment which is used for all application security testing.
In addition, the PA-DSS Implementation Guide (similar to PABP's Best Practices Implementation Guide) has detailed references on how to securely implement the payment application and related systems in a specific supported, compliant configuration. It also clearly states that any deviations from specific supported configurations may indeed jeopardize PCI DSS compliance for merchants and businesses who implement the chosen COTS payment application.
Additional Visa Mandates
Beginning in January 2008, Visa raised the bar on application security when they announced a series of new mandates. Ultimately, these mandates are designed to eliminate the use of what are deemed to be vulnerable payment applications from their Visa's payment processing networks. To quote from their announcement, "These mandates require acquirers to ensure their merchants and agents to not use payment applications known to retain prohibited data."
The initial Visa mandates will be focused primarily on new payment applications to be connected to the Visa payment processing system this year. As the other additional mandates are phased in over time, however, their overall objective is to force the eventual de-commissioning of all known vulnerable payment processing systems from Visa networks by July 2010.
In addition, Visa will be publishing a list of current known vulnerable applications and providing that information to acquirers. By doing so, Visa can ensure that acquirers will hold their merchants and agents accountable for using only non-vulnerable payment processing systems.
Conclusion
Web applications have become the backbone of banking and e-commerce. POS and payment processing applications leveraging web and web-like technologies are being deployed as the next generation alternative to similar legacy systems. They connect end-users, customers, merchants, agents, and partners and process sensitive data including personal and financial information which is of the highest value. They do so anywhere, everywhere, anytime, and in real time. The need for significantly enhanced application security becomes paramount, and as a result the importance of PCI DSS and PA-DSS application security requirements become even more focused.
While application security presents some of the most challenging, and possibly the most costly, barriers to compliance with PCI DSS, requires 6.6 is far too important to ignore, no matter how difficult it is, nor how high the cost. Your organization's future depends on securing web applications and the costs of an unauthorized breach will eclipse the costs of doing the right thing by protecting the applications and sensitive data in the first place.
Ben Rothke CISSP, QSA (ben.rothke@bt.com) is a Security Consultant with BT Professional Services and the author of Computer Security: 20 Things Every Employee Should Know (McGraw-Hill Professional Education). David Mundhenk CISSP, PCI-DSS & PA-DSS QSA, QPASP (stratamund@sbcglobal.net) is a Security Consultant with a major professional services firm.

When in Doubt, Consider the Customer

2008-10-11T02:55:00.003-07:00

I have an interesting question for you: How many people are there between your customer and your CEO? Hint: As in golf, lower scores win. And as many of us find ourselves facing bleak numbers in the short term, it's worth thinking about what makes happy customers.
The problem with many businesses is that they have too many customer service firewalls in place. There is no accountability. There are no common complaint-routing protocols, and escalation procedures for getting things resolved are spotty at best. Many businesses think nothing of spending hundreds or even thousands of dollars on customer acquisition, but when it comes to spending on customer retention, there isn't any calculation on what it costs to reduce churn.
[ Check out The Gripe Line, InfoWorld's ongoing effort to expose and resolve reader problems with customer service. ]
Why is this the case? Aren't happy customers the best references for a business? And these days, unhappy customers have powerful tools at their disposal to carpet-bomb the Internet to tell their tales of woe.
How many of you have seen the Dell-laptop-on-fire video or heard the recording of the caller who tried in vain to cancel his AOL account for the better part of 15 minutes? And while there are some ways to defend against a rabid blogger, there is no better mechanism than to provide solid customer service to begin with.
I was reminded of the sad state of affairs with customer service when I tried to order new service from AT&T and DirecTV for a new home. First I tried to order via their Web sites. No go. Then I tried the phone number -- which on AT&T's Web site was outdated. DirecTV makes you hunt down the number. When I finally found the right numbers, I got the wrong department because I was calling from an IP phone that had a 310 area code, yet I live in St. Louis (I guess it is my fault for not having the "right" phone number). The service rep just terminated the call rather than bothering to help me with my DSL service. When dealing with the phone company, data is still a four-letter word.
Is something wrong with this picture? Contrast this with a local retailer who sent my wife a check for $2 because he overcharged her shipping expenses. Or the guy at my local garage, who told me I owed nothing because he could easily fix my car's problem and didn't feel right about charging me anything. When was the last time your mechanic did that? Both of these folks earned my undying loyalty and respect and got us as forever customers. What was the cost of that acquisition? Not a heck of a lot.
Right now many of us are being forced to revise our budgets or make contingency plans based on bleak forecasts. As part of that painful process, consider how many layers you've put in place and whether that structure actually makes your customers happy. A little thought could yield some pretty impressive improvements to your bottom line.

Whoop de Doop for De-Dupe

2008-10-11T02:55:00.001-07:00

De-duplication started out as a way to do backups without having to store mostly the same stuff over and over again. Companies like Data Domain, Diligent Technologies, and NetApp provided de-dupe of virtual tape libraries and direct-to-disk backup targets, providing full backups that stored only the changes since the previous backup. The result: You could reap the same space savings you get with incremental backups but without the necessity for multiple restores to re-create an entire volume.
Now these same companies are advertising de-duplication of near-line storage, and even online storage in NetApp’s case, while other vendors are using de-duplication to reduce WAN traffic, shrink the size of databases, or compress e-mail archives. Yes, de-duping is going gangbusters. Heck, we might even dream of the day when you might never need more than one copy of any file throughout the entire enterprise. Assuming it’s possible, is that something you’d want?
Currently, all storage de-duplication requires a gateway between the server and the storage. Methods of de-duplication vary widely. Some solutions function at the file level, some at the block level, and some work with units of storage even smaller than blocks, variously referred to as segments or chunklets. Processing for de-duplication can occur either "in-line" (i.e., before the data is written to storage) or "post process" (meaning after the data is initially written).
There are applications where de-duplication is extremely effective, and ones where it isn’t. If data is largely the same, such as multiple backups of the same volume or boot images for virtual servers, de-duplication can provide enormous reductions in the storage space required. However, dynamic data, such as transactional databases or swap files, will show very little reduction in size and may also be sensitive to the latency introduced by de-duplication processing. In the case of databases, though, de-duplication can in fact improve I/O performance and speed up some queries (see "Oracle Database 11g Advanced Compression testbed, methodology, and results").
But the biggest issue with de-duplication is that it creates a choke point: All data to be compressed must be saved and retrieved through the de-duplication gateway. This isn't much of an issue with backups or even near-line archives. But for applications where access to the data becomes critical, or usage is heavy, the gateway becomes a hot spot, requiring redundant gateways, dual-path SAN infrastructure, and redundant storage. Given the investment necessary to support live data, where even short interruptions to access would cause major problems, it is typically cheaper to live with multiple copies.
There’s no question that de-duplication can provide great benefits in specialized applications, including backups, e-mail archives, and other cases where data is largely repetitive, such as VMware boot images. However, a fully de-duplicated enterprise, even if feasible, would require a massive and expensive infrastructure. Given that disk capacity continues to grow in leaps and bounds, scaling out de-duplication will be difficult to justify. It’s cheaper to keep buying more local storage than to put all the eggs in one basket.

Forrester: Discontent Persists Over SAP Maintenance Hike

2008-10-11T02:54:00.001-07:00

A new Forrester Research study that polled more than 200 SAP customers found widespread discontent over the vendor's recent decision to shift customers to a pricier Enterprise Support offering, and also provides tips on how customers can mitigate the increased cost.
SAP announced in July that Enterprise Support would replace its basic and premium support options. Enterprise Support costs 22 percent of a customer's license fees, compared to 17 percent for basic support. The additional costs will be phased in over the next few years, and new charges won't begin until Jan. 1.
But Forrester clients voiced a number of common gripes.
Eighty-five percent of the clients interviewed described minimal utilization of the Basic Support offering. "The average customer claims to connect with SAP fewer than six times a year -- the equivalent of buying a comprehensive but expensive insurance policy and rarely utilizing it," the report states.
Customers also complained to Forrester about the time it takes SAP to meet requests for new features.
"Customers believe that the maintenance dollars paid to SAP should go to filling in key functionality gaps in the software. However, there are a plethora of examples where key functionality requested two to four years ago by multiple customers in the same or different industries were not delivered in SAP R/3 4.7, let alone available in SAP ERP 6.0," the report states.
Clients "want to know how much of their support dollars really go back into reinvestment versus profit margins," it adds.
SAP has cited a number of reasons for its decision, such as greater complexity in customer environments, and argues that Enterprise Support provides a higher level of benefits for customers -- points the Forrester report does not dispute.
To mitigate the increased cost of maintenance, customers should seek steeper discounts on licensing deals, according to Forrester.
Another tactic would be to create a long-term "SAP containment strategy," which could include taking a look at other vendors. "Many SAP clients with whom we spoke have begun the process of evaluating Oracle Siebel, Salesforce.com and others for customer relationship management as well as Siperian, Initiate Systems and IBM for master data management."
Customers also should consider third-party options for support. While one company, Rimini Street, has announced plans to provide such support, it has not yet begun doing so, and even when it does will focus on only SAP's R/3 products.
The Forrester report's results stand in contrast to SAP's past contention that while customers may not like to pay more money, they understand the value of the new service.
An SAP spokesman was given a copy of the report on Friday, but did not immediately provide comment on its findings.

Microsoft Joins Study to Gauge Impact of Genetic Testing

2008-10-09T03:17:00.001-07:00

Microsoft is co-sponsoring a study to see if people who undergo genetic testing to identify their risk for developing certain diseases actually change their behavior to mitigate that risk.
San Diego-based research lab Scripps Translational Science Institute (STSI), the study's main sponsor, will offer genetic scans to up to 10,000 employees, family members and friends of Scripps Health that provide a detailed analysis of their risk for more than 20 health conditions. Scripps Health is a US$2 billion nonprofit community health system also based in San Diego.
The conditions -- including diabetes, obesity, heart attack and some forms of cancer -- are ones that can be changed or prevented by people's lifestyle choices. Scripps will then track changes in the participants' behaviors over 20 years to see if people who learn they are at risk for certain diseases or conditions will actually take preventative measures to avoid them, Microsoft said.
Microsoft is contributing its HealthVault service to the study. HealthVault is Microsoft's online repository for storing patient information and allowing it to be shared, at the discretion of patients, with health care providers and other parties they trust with it, such as their insurance companies. Using HealthVault, study participants can store, track and manage health and lifestyle information over the course of the study, Microsoft said.
Genetic testing service provider Navigenics of Redwood Shores, California, and Affymetrix of Santa Clara, California, which provides hardware and software to do genetic testing, also are co-sponsoring the study and contributing technology to it.
Affymetrix will scan the genomes of participants, while Navigenics will interpret the scan results and offer guidance to study participants to help them prevent future health conditions, or at least lessen the negative impact of them.
The ultimate goal is to help researchers better understand ways to prevent, diagnose and treat diseases, Microsoft said.
HealthVault aims to bridge the gap between enterprise companies, such as health-insurance providers, and patients through an online system that allows them to share information securely over the Web. Competitor Google also is developing a similar offering called Google Health.

Nokia, Nuance Aim Voice Features at Developers

2008-10-09T03:16:00.001-07:00

A partnership between Nokia and speech-recognition software vendor Nuance will make the software company's capabilities available to third-party developers as well as to the phone maker itself.
Nokia is already a major customer of Nuance, which provides both speech and predictive text capabilities on a number of Nokia's handsets. The deal announced Wednesday could bring more Nuance technology to Nokia phones but will also produce open protocols that developers can use to build such features into applications for the handsets.
Nuance is a major supplier of speech-recognition software for both PCs and mobile devices, and last year bought the maker of the widely used T9 software for completing words that cell-phone users are trying to type in e-mail or text messages. It has gone beyond basic voice-enabled functions such as dialing and now offers additional capabilities such as text or e-mail dictation and searching for content on a phone or products in an online mobile store. Nokia is the world's largest mobile-phone maker.
Under the new relationship, Nuance will provide Nokia with some of those more advanced features, said Michael Thompson, vice president and general manager of Nuance Mobile Speech. But the implications for third-party applications could be even more significant.
Full details haven't been worked out, but the idea will be to let developers using Nokia's Series 60 and Series 40 software platforms take advantage of Nuance's speech-recognition and other functions in their applications, Thompson said. Rather than having to approach Nuance separately, the developers would get access to those capabilities through the Nokia development platforms. The companies said they would provide developers with open programming interfaces, language models and development tools.
The applications they build could appear on a wide range of phones from low-end devices to smartphones, and Nuance's technology spans functions that take place both on devices and on servers, Thompson said. Server-based speech recognition, accessed over a high-speed mobile network, can leverage much greater processing power and consume less memory and battery life than what is done on the phone itself.
Nokia supports a large community of application developers, especially for its Series 60 smartphone platform, and is in the process of buying out the Symbian OS that forms the basis of Series 60 and making it available as open source through an entity called the Symbian Foundation. That move is part of the wider trend in the mobile industry, accelerated by Apple's iPhone App Store success, of creating and tapping into large developer communities to make devices compelling.
The deal is not exclusive, and the companies didn't reveal any financial details. The primary royalty arrangement would be between Nokia and Nuance, Thompson said.
Making the voice tools available to third-party developers might lead to a flowering of new voice-enabled mobile applications, including games, said analyst Jack Gold of J. Gold Associates. But there's a danger of those third parties implementing the technology poorly, he added.
"Command and control is one thing," Gold said. "Understanding random speech patterns is very hard to do."

Microsoft, Others Seek to Get Paid for Sales to WaMu

2008-10-09T03:15:00.000-07:00

Microsoft got in line with several other organizations that are taking steps to get paid for products and services provided to Washington Mutual, the largest bank to fail in U.S. history.
On Tuesday, Microsoft filed a document with the Delaware bankruptcy court handling the WaMu case asking to be sent copies of all proceedings in the case.
"Microsoft filed a notice of appearance because we have existing contracts for software licenses and consulting services with Washington Mutual and we want to make sure those contracts are properly administered through the bankruptcy process," said David Bowermaster, a Microsoft spokesman, in an e-mailed statement.
Microsoft would not describe the size or duration of its contracts with WaMu. The bank is a beta tester and early user of its products, and last year a WaMu executive joined Microsoft Chairman Bill Gates on stage at a launch event for Windows Vista, Office 2007 and Exchange 2007.
Microsoft isn't alone in its efforts. On Tuesday Siemens filed a motion asking that JP Morgan, which is taking over WaMu, either reject or assume an IT services contract it has with the bank, worth US$5 million to $6 million each month. Siemens said it had supplied about $10 million worth of IT services to WaMu that have not been paid for. Siemens has about 400 employees and contractors providing services to the bank, it said.
And Tata Consultancy Services, the Indian outsourcing and IT services company, filed a motion similar to Microsoft's asking to be kept apprised of proceedings.
Government regulators seized WaMu in late September and let other companies bid to take over the bank. JP Morgan had the winning bid. The economic crisis in the U.S., driven in part by a housing slump, hit WaMu particularly hard because it was one of the country's biggest providers of home mortgages, including risky loans.
Amid the troubles in the financial sector, many analysts say that the surviving financial organizations will still need to rely heavily on technology, so IT vendors may not be hit too hard by banking failures. While the wider economic meltdown is sure to slow IT spending overall, many analysts still say that they expect most of the big vendors to be able to weather the storm.

Yahoo Revamps Calendar Service

2008-10-08T03:02:00.001-07:00

Yahoo has developed a new online calendar that the company said offers significant improvement over the current product because it makes it easier to share items and has a more interactive interface.
Yahoo will begin to offer the new version of Yahoo Calendar on Wednesday in beta in the U.S., Brazil, India, Taiwan and the U.K. General availability is expected in the coming months.
Although Yahoo Calendar and Yahoo Mail are tightly integrated, only about 8.1 million use the former and about 278 million the latter, said John Kremer, Yahoo Mail vice president.
The situation is similar among other major providers of Webmail and online calendar services, said Matt Cain, a Gartner analyst. Only about 3 to 4 percent of consumers also use their preferred Webmail service's companion online calendar, he said.
There are various reasons for this, including continued use of paper-based calendars at home and of desktop calendar software like Outlook and Lotus Notes in the workplace, Cain said.
However, Gartner sees favorable conditions for significantly boosting the use of online calendars among consumers, from around 4 percent in 2008 to 25 percent in 2012, Cain said.
The factors that will drive up usage include increasing industry adoption of open standards that make online calendar services interoperable, he said. This is coupled with an increasing realization among consumers of the benefits of subscribing to public calendars and sharing their online calendars with friends and family. In addition, younger users are all growing up using online calendars, he said.
"There's no question that online calendars will emerge as a very important part of portal collaboration software offerings for Yahoo, Microsoft, Google and AOL," Cain said.
"For anyone with a big e-mail population, there's no doubt that the next big battleground will be at the calendar level," Cain said, adding that online calendars will become prime real estate for advertising.
Yahoo is hoping that the new Yahoo Calendar will prompt more Yahoo Mail subscribers to use it. Yahoo Calendar hasn't gotten a facelift of this magnitude in about 10 years, Kremer said.
Among the features Yahoo is highlighting in the new calendar service is its compatibility with competing products from providers like Mozilla, Apple, Microsoft, AOL and Google.
This compatibility, which will allow Yahoo users to share calendar data with users of those other services, is possible because Yahoo Calendar is built on open standards like iCalendar (iCal) and CalDAV, Kremer said.
Yahoo hopes that open calendar standards are adopted broadly not only among online service providers but also among makers of business desktop and mobile calendar software, so that Yahoo Calendar will become interoperable with those products, Kremer said.
The new Yahoo Calendar allows items to be dragged-and-dropped into the calendar, as well as to be color-coded, and users will be able to call up calendar views as detailed as a single event and as broad as a month. The new Yahoo Calendar also has a "to do" feature for listing pending tasks and the capability to set up reminder alerts that can be delivered via e-mail, instant messaging or SMS.
Future versions of the new Yahoo Calendar will also sync up bi-directionally with Microsoft Outlook's calendar and let users access Yahoo Calendar when they're not connected to the Internet via integration with Zimbra Desktop. The new Yahoo Calendar is based on technology from Zimbra, which Yahoo acquired last year.
In the future, Yahoo also plans to add further integration with other of its services, such as Yahoo Maps, so that users can call up a map from within the calendar, Kremer said.
Users will also be able to subscribe to receive events from public calendars and event services like Yahoo's own Upcoming.org.
The new Yahoo Calendar will also give third-party developers the chance to build applications and extensions for it via APIs and its standards-based architecture, Kremer said.
Yahoo has set up a Web site for those interested in getting more information about the new Yahoo Calendar.

Wikia Search Debuts App Platform to Sharpen Query Answers

2008-10-08T03:01:00.002-07:00

Wikia Search will roll out on Wednesday a platform that developers can use to create applications for this open-source search engine.
Called Wikia Intelligent Search Extensions (WISE), the platform is aimed at letting individuals and organizations create applications that sharpen the search engine's ability to answer queries.
"As we look at what's going on in search, we've realized there's a whole bunch of rules-based mechanisms you can use to map a search query to the exact correct result," said Wikia Inc. founder Jimmy Wales.
Already organizations including Thomson Reuters, The Washington Post, Digg and Twitter have created extensions to allow Wikia Search to provide more relevant results for specific queries.
Wikia Search already allows anyone to participate in building its index by manually adding, deleting and rating Web pages, as well as editing a search result URL by modifying its headline and description. Contributions are reflected immediately and don't go through an approval process.
With WISE, Wikia Search wants to automate this participation. "We'll get a whole new level of user-built search. Instead of having to individually edit one result at a time, which is useful in some contexts, here users can create applications for whole categories or whole rules of searches," Wales said.
The Washington Post's application, for example, delivers articles from the newspaper to Wikia Search results.
Also taking advantage of the WISE platform to create direct links between their site content and Wikia Search are weather information provider AccuWeather.com, job listings site Indeed.com and travel site Kayak.com.
Wikia Search will provide documentation and a sandbox for building and testing the applications, which will be reviewed by the company before going live on the site.
With WISE, Wikia Search wants to increase the frequency with which it is able to answer a query right from the results page, saving users from having to scan Web site links and click around to find the desired information

MySQL Cofounder David Axmark Leaving Sun

2008-10-08T03:01:00.001-07:00

David Axmark, a cofounder and former lead engineer for MySQL, has resigned from Sun Microsystems a few weeks after another cofounder said he may also leave the company.
"I have thought about my role at Sun and decided that I am better off in smaller organisations," Axmark wrote in his resignation letter, according to a blog post Tuesday from Kaj Arno, head of MySQL community relations.
"I HATE all the rules that I need to follow, and I also HATE breaking them. It would be far better for me to 'retire' from employment and work with MySQL and Sun on a less formal basis," Axmark wrote. His last day with Sun will be Nov. 10, Arno said via instant message from Germany.
Axmark filled several important roles at MySQL over the years, including head of engineering, head of internal IT and head of community relations. It's because of Axmark that MySQL is open-source software, according to Arno. Another cofounder, Michael "Monty" Widenius, had planned it to be closed source, he said.
His departure will be a setback for Sun, which acquired MySQL for US$1 billion in January and hopes to attract new developers to the database.
Early last month Arno confirmed that Widenius was also thinking of resigning from Sun. He is still with the company, but his future there is still "hard to predict," Arno said Tuesday.
Axmark is an "important figurehead" at MySQL and someone who recruited many of its top engineers, Arno said. But his role lately has been primarily speaking with the press and liasing with the open-source community, according to Arno. Axmark will continue to do consulting and speaking engagements for Sun, he said.
"Emotionally, it's a sad moment to see a cofounder leave -- but the day-to-day impact is low," Arno said via instant message.
Marten Mickos, MySQL's former CEO, continues to lead the database group within Sun, and Jeffrey Pugh is still head of engineering, Arno said.
Axmark couldn't be reached for comment Tuesday. Arno said the things he disliked about being part of a large company were "mundane things" like having to turn in expense reports, order travel and change his e-mail to "@sun.com."

Facebook Starts Offering Live Search

2008-10-08T03:00:00.000-07:00

Facebook has begun allowing users to search the Web from within Facebook, using Microsoft's Live search service.
The arrangement, first announced in July, offers a revenue opportunity for both companies. But they'll need to convince people to use the search feature, and it's uncertain they will in its current form.
"I'm not sure the experience they offer is optimal," said Greg Sterling, an analyst at Sterling Market Intelligence.
Still, the deal is a coup for Microsoft, which has been struggling to boost its search business. It might be the biggest search agreement for Microsoft in terms of potential users, Sterling said. Microsoft owns a stake in Facebook and has an existing exclusive agreement with the site for banner advertisements.
Starting Tuesday, Facebook users began to notice that when they start typing in the search bar on Facebook, a drop-down menu appears and they can choose to search Facebook or search the Web. If they choose the Web, results appear on a new Facebook page, with advertisements on the right of the screen.
At the top of the results list is a link to do an "Advanced search on Live.com," which launches a new window with results displayed at Live.com. Those results are sometimes slightly different from the ones on the Facebook page and include the ability to expand a search to include images, news, maps and videos.
The results are different because Facebook uses certain filters and doesn't display sponsored results, said Matt Hicks, a Facebook spokesman.
In addition to requiring users to do an advanced search to find image or map results, the results format looks different from other leading search providers, another potential drawback, Sterling said. Each item appears in a box that lists the Web site, a description of it and a link. "The presentation of results is a little strange, it's a little unfamiliar for search results," he said.
However, the companies may view this as the first try, with plans to add more capabilities.
"As we evaluate user feedback and results we'll explore additional ways to integrate Live Search more deeply into the Facebook experience," wrote Angus Norton, senior director of Live Search product management at Microsoft, in a blog post. He called today's service a first step.
In the future, Facebook should look for ways that search results and other content on the site can be more relevant to people in the context of their visit to Facebook, said Jeremiah Owyang, an analyst with Forrester Research. "This is a long-term play," he said.
Facebook was one of the only major social-networking sites that didn't offer search, Sterling said. "That was kind of a major issue and they've rectified that," he said.

Brocade Gets Loan to Fund Foundry Buyout

2008-10-08T02:51:00.000-07:00

Brocade Communications Systems on Tuesday secured a US$1.1 billion loan to fund its acquisition of Foundry Networks despite a tightening of credit markets amid the Wall Street meltdown.
The loan came through even as the Dow Jones Industrial Average fell more than 500 points (5.11 percent), and many technology stocks dropped even more steeply. Among those hardest hit were Sun Microsystems, Nortel Networks, Amazon.com and Qwest Communications International, all down more than 10 percent. Apple shares went down 9.25 percent while Google suffered less damage, falling 6.79 percent. As they did in the bloodbath last Monday, most major tech stocks, including Microsoft and Cisco Systems, outpaced the Dow in their journey down on Tuesday.
Brocade's planned acquisition of Foundry, announced in July, will expand the storage-area-networking pioneer into the Ethernet LAN business for an end-to-end set of offerings. Brocade said in July it would exchange a combination of stock and cash for each Foundry share, partially funding the deal with about $1.5 billion of debt financing from Bank of America and Morgan Stanley.
Such arrangements are common, but by the time Brocade held an analyst meeting in mid-September to lay out its plans for Foundry, Wall Street investment banks were already teetering and stocks were on their way down. Financial analysts at the event repeatedly asked Brocade CEO Michael Klayko about the financing of the deal, and he said each time that he was confident it would come through.
Brocade said Tuesday it got a $1.1 billion term loan facility and a $125 million revolving credit facility. Bank of America N.A. led the funding, joined by Banc of America Securities, Morgan Stanley Senior Funding and other institutions. Brocade also said it expects to raise as much as $400 million in additional financing. Brocade stuck by its forecast that the acquisition would be completed by year's end.
News of the loan, released after the U.S. trading day, perked up both companies' shares. After falling $0.39 to $4.43 at the closing bell, Brocade shares (Nasdaq: BRCD) were up $0.36 in after-hours trading late Tuesday. Foundry (Nasdaq: FDRY), which dropped $0.91 to $16.26 during the day, was up $1.28 after hours.
Also on Tuesday, VoIP (voice over Internet protocol) service provider Vonage Holdings announced new terms for its proposed debt financing with Silver Point Finance. It announced $215 million in private debt financing with Silver Point in July, but has restructured that financing, which now totals $220.3 million. The company expects that deal to close next month. Its stock (VG, on the New York Stock Exchange) had fallen $0.10 to $0.85 in the day's trading but was up almost $0.03 after hours. Vonage has settled a series of patent lawsuits but is still struggling as bigger players, such as cable operators, offer competing VoIP plans packaged with other services.

Is That Keyboard Toxic?

2008-10-01T03:03:00.003-07:00

Warning: Your keyboard could be a danger to you and the environment.
Sound preposterous? Then consider this: Some keyboards contain nanosilver, which, because of its antimicrobial properties, is increasingly being incorporated into everyday items even though studies have questioned its health and environmental safety.
Studies are raising concerns about the proliferation of nanotechnology, which can be found in numerous products, from IT components to cosmetics.
"The biggest issue around nanotechnology is that we don't know [all of its risks]. We're putting things on the market that haven't been fully tested," says Sheila Davis, executive director of the Silicon Valley Toxics Coalition (SVTC), a San Jose-based advocacy group.
Nanotechnology refers to work done on the nanoscale; 1 nanometer equals a billionth of a meter, or about 1/100,000 the thickness of a sheet of paper.
Use of this technology can save resources and energy. Moreover, nanomaterials offer potential benefits that could revolutionize our world. For example, they could be used to track tumors or clean up contaminated water and soil.
But scientific studies have also found potential health and environmental problems with nanomaterials.
"The nanotech boom is generating an unprecedented number of new processes and materials that pose unknown potential environmental and health hazards," the SVTC stated in its April 2008 report on nanotechnology and its risks.
And research published in the May issue of Nature Nanotechnology suggests that carbon nanotubes, which researchers are using to build next-generation circuits, could be as harmful as asbestos.
"We have to consider with new physical properties that there's likely to be a new toxicology profile and do more testing before people are exposed," says Jennifer Sass, a senior scientist at the Natural Resources Defense Council in New York who specializes in toxicology.
Sass' comments bring us back to that keyboard. Does yours contain nanosilver, which studies suggest may damage human cells as well as disrupt the nitrogen balance in freshwater ecosystems? Most likely, you don't know. And you probably can't easily find out because manufacturers aren't required to note that products contain nanomaterials.
The good news, however, is that a number of factors limit the potential dangers posed by nanotechnology. One of the most significant is that humans evolved in the presence of nanoparticles, says R. Stanley Williams, director of information and the quantum systems laboratory at HP Labs in Palo Alto, Calif.
"There is certainly reason to be careful," he says. "But our environment is filled with nanoparticles. We just didn't know it until we had tools that could see them."
Even so, industry is taking steps to minimize exposure. Leading manufacturers follow protocols to contain manufactured nanoparticles, says Mihail Roco, senior adviser for nanotechnology at the National Science Foundation.
For example, workers at Intel Corp. wear protective gear, use HEPP (high-efficiency pleated polypropylene) filters and work under hoods, where air pressure pulls wayward particles away from them and into filters, says Todd Brady, Intel's corporate environmental manager.
Technology users also have a measure of protection against exposure thanks to the very nature of nanotechnology. Nanoparticles are bound with other materials to make final products, and studies show that nanomaterials stay bound and therefore won't harm humans or the environment.
"These are so tightly locked down that there's no way the nanoparticles can get out," Williams says. "You can beat on them with a hammer, and they still won't get out."

Broadcom, Skyhook Join for Better Location Data

2008-10-01T03:03:00.001-07:00

Broadcom will enhance its mobile device chipsets and location-based services (LBS) infrastructure through a partnership with Skyhook Wireless, the company that powers the iPhone's location feature using Wi-Fi access points.
In addition to being a major vendor of communications chips, Broadcom also operates an international infrastructure for location-based services that uses information from GPS (Global Positioning System) to determine where a mobile device is. Skyhook's technology can use signals from Wi-Fi hot spots, as well as cellular base stations and GPS, to do the same thing.
Broadcom will integrate Skyhook's capabilities into its chipsets and its LBS infrastructure, the companies said Tuesday. This will give makers of mobile phones, personal navigation devices and other products a single, integrated hybrid positioning system that can take advantage of GPS, Wi-Fi and cellular base stations, they said.
GPS, which relies on satellites, has a wide coverage area but doesn't work well indoors or in urban settings where there are buildings blocking signals from satellites. Skyhook's Wi-Fi Positioning System can analyze signals from nearby private and public Wi-Fi access points and compare them against a database of geographical points to determine location.
LBS is becoming one of the brightest spots in mobile data as consumers take advantage of the ability to find businesses and even friends nearby, according to industry executives. Skyhook Founder Ted Morgan told the Mobilize conference in mid-September that the company's service had received "billions" of location requests from users and that this volume had spiked up in the previous three months. The GPS-equipped iPhone 3G went on sale in July. The location-enabled version of Google Maps for Mobile, which has been available on the iPhone since earlier this year, gets twice as much use as the previous version, according to Steve Lee, a Google project manager who spoke at the same conference.
Broadcom's LBS system formed the basis of the first nationwide E911 emergency location system in the U.S. in 2002 and today serves more than 20 million active customers in more than 170 countries, according to the company.