Google blocks paid apps for unlocked G1 users

People who bought an unlocked version of the Android G1 phone are no longer allowed to download new paid applications from the Market, after a change Google made late last week.

Google is prohibiting users of the unlocked phones from viewing copy-protected applications, including those that cost to download.

The Developer version of the G1 comes unlocked to any particular mobile operator and is priced at US$400. Anyone who joins the Android developer program for $25 can buy the phone.

Last week, Google employees began replying to questions people posted on the Android Market Help Web site about being unable to see copy protected applications in the store. "If you're using an unlocked, developer phone, you'll be unable to view any copy-protected application," wrote Google employee Ash on the help site in reply to a user's question on Friday. "This is a change that was made recently."

While Google offered only slim details about why it made the change, it could be an attempt to close a loophole that reportedly allows users of the unlocked phone to download paid applications for free. "The Developer version of the G1 is designed to give developers complete flexibility," Google said in a statement. "These phones give developers of handset software full permissions to all aspects of the device... We aren't distributing copy protected applications to these phones in order to minimize unauthorized copy of the applications."

A couple of developers have theories about the issue behind the move. Tim at the Strazzere.com blog discovered that protected applications are automatically downloaded into a private folder on Android phones. Most phone users can't access that file but users of the Developer phone can.

That means a Developer phone user could buy an application, copy it from the private folder, return the application for a refund and then re-download the application to the phone, the developers say. The Android Market allows anyone to return an application within 24 hours.

The Phandroid blog and a few developers commenting on the blog said they were able to download and copy-protected applications. Some developers are surprised that assigning the application to a specific folder is the only copy protection given to applications.

It's unclear how many people have the unlocked version of the phone. But some vocal developers are very annoyed that they paid $400 for the phone and aren't allowed to access all of the apps in the store.

One, who goes by the name bakgwailo, is proposing a "developer revolt," where all developers pull their applications from the store. "It would be the only way to show Google that this is NOT acceptable, and that devs are not second (third?) class citizens on the Market," he wrote. "I do not know about you, but I am beyond angry that I can not even see my own paid app on the Market with my 400 dollar dev phone!"

"This is a big problem for everyone who has a Dev phone," one developer using the name oscillik wrote. "Assuming that we're pirates is very offensive."

Read More

App Store grows, but apps are seldom used

At least that's the conclusion from data collected by Pinch Media, a company that helps developers track the use of their iPhone applications.

Pinch found that of the users who download free applications from the App Store, only 20 percent use the app the next day, and far fewer do as the days pass. For paid applications, the return rate is only slightly better: 30 percent of people use the application the day after they buy it. The drop-off rate for paid applications is about as steep as for free applications after the first day.

Generally, 1 percent of users who download an application turn into long-term users of it, Pinch found. Pinch has noticed some differences based on the kind of application. For example, sports applications get more use than others in the short term, while entertainment applications tend to keep users for longer than others.

Pinch has discovered, or at least confirmed, some other interesting usage trends as well. Developers have a far greater success rate once they rise to the top of the store, which Apple ranks based on popularity. Once applications hit the top 100, the number of daily new users increases by 2.3 times, Pinch said.

Also, free applications tend to get more use than those that cost. Users run free applications, on average, 6.6 times as often as paid applications, Pinch said.

The findings might surprise and disappoint developers, many of whom regard the iPhone's application ecosystem as the first real opportunity to build a business around wireless applications. Prior to the launch of the easy-to-use App Store, few phone users ever downloaded new applications to their phones. That meant that the best way for developers to offer their applications was to convince operators to preload the applications on phones -- an expensive, time-consuming and challenging proposition.

Pinch Media collected data from "a few hundred" applications in the App Store that use its hosted analytics product. Applications that use the analytics offering include those that have been the number-one paid and free applications available in the store, Pinch said. The store currently has more than 15,000 applications, and users have downloaded applications more than 500 million times.

The data from Pinch might be valuable for developers who are also considering building applications for other stores that have been planned following the success of the App Store. Stores for Android, Windows Mobile, BlackBerry and Palm Pre applications have either been announced or are already open.

Read More

Would a server by any other name be as functional?

When I graduated from college, my parents bought me a new computer as a graduation gift (a Power Computing Mac clone, if you remember that odd little interlude in Apple's history). It was an order of magnitude more powerful than my Mac Plus, and I was so thrilled to have it that I decided that it would be auspicious to christen it. Since I was in grad school studying ancient history at the time, I changed the name of the hard drive from whatever the boring default was (it may have actually just been "HARD DRIVE") to "Kleopatra," using the more correct Greek spelling of the ancient queen's name.

Over the next few years -- especially after I fled academia -- I wondered if maybe I should cast aside this little bit of whimsy, but I did like thinking of my computer as more than just another grey-beige box of silicon taking up desk space. So Kleopatra stayed, and when I got a second internal hard drive, I named it after her husband Marc Antony, just to keep her company. I thought that this affectation made me unique and just a little bit weird. But then I got my first real job.

The job was as a copy editor at a San Francisco Web publishing startup, and I quickly learned that all of the Unix servers upon which our internal and external processes depended had names. And not boring names like PRODUCTION_SERVER; these machines were all named after African nations. This didn't exactly turn every trip into the office into an exotic vacation, but dealing every day with machines named Rwanda and Angola at least gave us something concrete to rant about when tech difficulties beset our work. (I hope the good people of Angola weren't hurt by the invectives we hurled when their country's namesake computer went out of commission for good, leaving us in two weeks of limbo before we eventually replaced it with Congo.) But more to the point, it taught me about the feeling of of hominess and community you get from a consistent naming system for your machines.

It's possible to give them too much personality
Photo by c.j.b.

When our business unit was merged with another one back east, and they started foisting their own, non-geographical naming conventions onto us -- well, that's when we knew that an era was ending.

The spy who named me

As it happens, such a naming system wasn't unique to our little office. Sandra Henry-Stocker was our company's Unix admin when I started that job, though she wasn't the originator of the African naming scheme. However, she did once work with a similar server naming scheme at another workplace with a slightly more exciting mission. "When I worked at the CIA," she says, "the office I worked in named its servers after states -- like Alaska and NewHampshire. We'd briefly considered wineries, but figured most of the staff would have no hope of pronouncing them, so we abandoned that idea pretty quickly."

It didn't stop there, though: "Client systems in each subnet were named after cities in the associated states. So we had systems with names like Juneau and Portsmouth. Some analysts grumbled that they wanted to 'move,' but it was easy to tell which subnet a particular analyst was on just by knowing his or her workstation's name and a bit of geography. The funny part was the looks I'd get in the elevator when I'd say to a coworker with a tone of annoyance something like 'I don't know what we're going to do about Maine! We're seeing crashes every day now.'"

It seems that this concept -- giving your servers a naming system that is at once arbitrary and consistent -- is a near-universal one, either passed down from admin to admin or reinvented dozens of times over the years. There are thousand-post Slashdot threads on the subject, and enthusiastic user discussions at O'Reilly and ISP discussion sites. What's really interesting to me is how these arbitrary conventions can take on a life of their own and affect how we think about the machines we use every day, like they did for Henry-Stocker's CIA analysts who wanted to move to better "locations."

Sometimes mere names can get downright philosophical . Lee Mandell, now the president of communications agency Matlin Mandell, recalls, "At a small agency I worked for back in the dot-com days we named our servers after quarks. Thus our file server and its mirrored backup were TRUTH and BEAUTY, because, after all 'Beauty is truth, truth beauty -- that is all Ye know on earth, and all ye need to know.' And our Web server and its mirrored backup were UP and DOWN. Unfortunately I never got the chance to say to my boss that, due to a server crash, UP was down -- but don't worry because DOWN is up.'"

However, naming schemes can go beyond whimsy and enter what strikes me as enabling. "At my current agency," says Mandell, "we name all our computers after playwrights. Notably our main file server was named O'Neill. It was always problematic, given to disk crashes (twice), BSOD lockups and slowness. 'But,' my partner once said to me, 'what else would you expect from a server named after an alcoholic depressive?'" Would a box merely named FILESERVER1 have been so indulged? Fortunately, since O'Neill was just a server after all and not a beloved family member or Nobel-winning playwright, it was not confronted in an elaborate intervention, but eventually merely replaced. Kaufman, the new server, "is doing just fine," Mandell reports.

Method to the madness

Is there something more to this than just whim, and an aid to anthropomorphism that may or may not be healthy? Perhaps. Sandra Henry-Stocker describes the arrangement at her current workplace. "The naming scheme, largely resulting from the fact that one of our prior sysadmins was a diver, started with Caribbean Islands -- like StCroix and StBarts -- and then moved to the Mediterranean with names like Malta and Sicily. One of the other development groups uses a naming scheme that mimics the project and system types. So we have systems named gwx1a and gwx1b where the 'gwx1' stands for 'Gateway Netra X1'. These names are so boring and easily confused (e.g., did you just say 'gwx1b' or 'gwx1d'?) that the users all refer to them by their IP addresses! The islands, on the other hand, seem to invoke some enthusiasm on the users' part. In fact, we often refer to them as 'the islands' rather than 'the servers.'"

I think there's a couple of important data points in this story. The first is that server names that seem "logical" to a particular kind of very systematic and linear computer geek -- like gwx1 -- are actually pretty difficult to remember. Our language-focused brains aren't really built to accommodate them. (It's a really bad sign when your naming scheme is less user-friendly than IP addresses!)

It's also interesting to note that enthusiasm for one scheme -- in this case, the islands -- can inhibit the adoption of another scheme viewed as inferior. Presumably the more enthusiastc you are about one, the less likely you are to brook changes. "Sometimes it seems people pay nearly as much attention to this as to how they name their kids!" says Henry-Stocker. And that reminds me of another situation I heard about second-hand. A former roommate was a research scientist, and in the department where he worked, most of the servers were named after chemical elements; however, my roommate's boss wanted to keep things a little closer to home -- so he named his group's servers after his own theories.

The march of history

And what about Kleopatra? The Egyptian queen died famously of a snakebite suicide; my Power Computing machine went less glamorously, to a tinkerer from a Mac mailing list who volunteered to take her off my hands. She was followed by a series of ancient rulers, with gaps of a few centuries between each; there was Theodosius, then Justinian, and my current laptop is named Heraclius, after the 7th-century Byzantine emperor. I even have a little ecosystem going on at home: my Wi-Fi access points, set up when I had my previous computer, are named Belisarius and Narses (after Justinian's great generals) and my iPhone is named Niketas (after Heraclius's cousin).

When my wife wanted to name her phone Pinky, rather than after some ancient figure, I didn't make too much of a fuss, even though it wounded me inside. I have something bigger to worry about: if I jump forward a few centuries with every new computer, what do I do when I catch up with the present?

Read More

Apple still has 'ideas' for Mac netbook, says analyst

An analyst who met with Apple recently believes the company has "ideas" about producing a Mac netbook, an ultra portable laptop computer.

Analyst Toni Sacconaghi of Sanford C. Bernstein & Co met with Apple's Chief Operating Officer Tim Cook, covering for CEO Steve Jobs during a leave of absence, Apple's Chief Financial Officer Peter Oppenheimer and Apple's marketing chief Phil Schiller.

According to Sacconaghi, Apple's Cook hinted at "ideas" for a netbook as well iPhone price changes, and new smartphone handsets.

"Tim Cook stated that since Steve Jobs announced his leave of absence, he was spending more time on new products, how Apple could take the iPhone into new markets and examining iPhone's business model," said Sacconaghi, who is ranked the top computer analyst by Institutional Investor magazine.

The MacBook Air is Apple's smallest, lightest laptop.

Sanford C. Bernstein & Co manages portfolios for private and institutional investors currently valued at $85 billion.

"Several interesting tidbits point to new iPhones, potentially with different pricing/price points this year," Sacconaghi added.

A Mac netbook has long been rumoured since the success of smaller lighter laptops, typically with a 10" screen, from companies such as Asus, Acer, Dell, HP and MSI Wind.

Last week Asus said they had sold 4.9 million Eee PC netbooks last year despite the economic downturn.

Netbooks are traditionally competitively priced due to their relative lack of power and limited upgradability.

Apple's smallest, lightest laptop the MacBook Air starts at £1,271, which is a long way from what Apple would need to charge to make the a Mac netbook a success.

Apple has also previously said that the iPhone was there netbook, offering email and web surfing on the move.

Analyst Sacconaghi added that he expects Apple's stock to outperform the S&P 500 in the next year.

Sacconaghi also said he expects new Apple iMacs as earlier as next month and an new Apple iPhone in the summer.

Read More

Charge dropped against Pirate Bay four

A Swedish prosecutor on Tuesday dropped a charge levied against four men on trial for running The Pirate Bay, one of the most popular BitTorrent search engines and trackers on the Internet.

Tuesday's proceedings saw Swedish prosecutor Håkan Roswall drop a charge of aiding in the making of copies of works under copyright, said Peter Sunde, one of the four on trial. The charge was dropped due to the inability of the prosecution to prove copies of content were made, he said.

"We have definitely won this round," Sunde said.

One charge -- essentially aiding the making of material under copyright available -- remains. Sunde and the other three defendants, Fredrik Neij, Gottfrid Svartholm Warg and Carl Lundström, could face prison time. Swedish authorities want them to forfeit 1.2 million Swedish kronor (US$140,000) in advertising revenue generated from the site.

A lawyer for the music industry, Peter Danowsky, denied that dropping the charge hurt the overall case.

"It's a largely technical issue that changes nothing in terms of our compensation claims and has no bearing whatsoever on the main case against The Pirate Bay," Danowsky said in a statement published by The Local, a Swedish newspaper published in English. "In fact it simplifies the prosecutor's case by allowing him to focus on the main issue, which is the making available of copyrighted works," he said in a statement.

The Motion Picture Association is seeking 93 million Swedish kronor in damages, and the IFPI (International Federation of the Phonographic Industry) is seeking €1.6 million (US$2.06 million) in damages.

Evidence presented by Roswall on Tuesday included screenshots showing computers were connected to The Pirate Bay's tracker, or software that coordinates P-to-P (peer-to-peer) file sharing.

But a majority of the screenshots show that The Pirate Bay was actually down at the time and that the client connections timed out, Sunde said. The clients, or peers, were still connecting with each other, but through a distributed hash table, another protocol for coordinating downloads unrelated to The Pirate Bay.

The schedule for Wednesday includes testimony from a Swedish antipiracy agency as well as the Motion Picture Association, Sunde said.

Read More

Hackers attack IE7 flaw

Less than a week after the last round of Microsoft Internet Explorer patches, security experts are already warning that exploit code is in circulation.

The particular flaw, MS09-002, is being exploited using a specially crafted Word document which is emailed to users. Once opened it installs malware onto the target system, including a Trojan to allow the malware to update itself.

"Several anti-virus vendors reported MS09-002 exploits in the wild. We can confirm that the exploit for the CVE-2009-0075 vulnerability (Uninitialized Memory Corruption) in Internet Explorer 7 is definitely in the wild and working on an unpatched Windows XP machine," said Bojan Zdrnja of the Sans Internet Storm Center.

"Initially there was some confusion about this attack as most anti-virus vendors mentioned Word documents. The exploit targets Internet Explorer 7, but so far it has been delivered to the end user as a Word document.

"That being said there is absolutely nothing preventing attackers from using the exploit in a drive-by attack and we can, unfortunately, expect that this will happen very soon."

The first malware to try and exploit the flaw looks to have been reverse-engineered rather than being in existence before the patch was announced, experts said. The malware collects information from infected computers, encrypts it and sends it to a server in China.

The short turnaround time from patch to malware will leave IT administrators racing to update corporate servers in time, and they are advised to warn users about potential threats.

Read More

Obama pours billions into IT with recovery package

Obama's economic stimulus package, which was signed into law yesterday, will see billions of dollars poured into technology in the US.
A significant part of the $787bn total will be spent on IT-related measures. A main beneficiary will be healthcare IT, which is set to receive around $19bn.

Obama wants to introduce electronic care records, computerising all health records in the next five years.

The project will be similar to the UK's £12bn national programme for IT, a part of which aims to automate records, which has weathered a few storms since Tony Blair first introduced the plan.

Obama said in a speech yesterday, "It is an investment that will take the long overdue step of computerising America's medical records to reduce the duplication and waste that costs billions of healthcare dollars, and medical errors that cost thousands of lives each year."
ADVERTISEMENT

In addition, $2.5bn has been earmarked for loans for improving broadband infrastructure in the US, $200m will go into expanding public computer capacity at community colleges and public libraries, and $250m will be available in grants for innovative programmes encouraging broadband adoption.

An innovative technology loan guarantee programme, which will provide loan guarantees for renewable technologies and transmission technologies, will receive $6bn.

The US government will also allow some students to claim money for IT equipment used for studying.

A further $30bn will go towards clean energies and an upgrade of the country's electricity grid.

The US government hopes to be able to detail its economic recovery spending on its recently launched website, recovery.gov, although observers have pointed out that collecting and reporting the data will be a difficult task.

Read More

US Congess passes huge economic stimulus bill

The U.S. House of Representatives and Senate have both passed the final version of a huge economic stimulus package, including billions of dollars for broadband deployment and electronic health records.

The House Friday afternoon voted 246-183 to approve a compromise version of the estimated US$787 billion American Recovery and Reinvestment Act. All 176 House Republicans present voted against the bill.

Late Friday evening, the Senate voted 60-38 to approve the bill, with three Republicans joining Democrats in supporting it.

U.S. President Barack Obama pushed for the legislation and he is likely to sign the bill in the next couple of days.

The House and Senate both passed versions of the bill within the past three weeks, and negotiators from both chambers agreed on a compromise version of the bill earlier this week.

The bill includes $7.2 billion to help deploy broadband in rural and other unserved areas, $17 billion for incentives for health care providers to adopt electronic health records, and $11 billion to update the nation's electricity grid by hooking it up to the Internet.

Republicans complained that the bill included so-called pork-barrel spending and that Democrats didn't seek their input in crafting the bill. "A bill that was supposed to be about jobs, jobs, jobs has turned into a bill about spending, spending, spending," said Representative John Boehner, an Ohio Republican and House minority leader. "We owe it to the American people to get this right."

Republicans also complained they had less than 24 hours to digest the final version of the bill, about 1,000 pages long. No lawmaker has had the time to read the entire bill, Boehner said.

"This is a sad day for our country," said Senator John Thune [cq], a South Dakota Republican. "And it's a sad day for future generations who will be left paying for this billion-dollar spending bill."

Democrats argued the bill is necessary to jump-start the U.S. economy. Senator Joe Lieberman [cq], a Connecticut independent who caucuses with Democrats, said he's confident the bill will "begin the turnaround of the American economy."

Senator Amy Klobuchar, a Minnesota Democrat, applauded the bill for including money for grants and loans to broadband providers that deploy in unserved areas. Residents of the rural United States need broadband to train for high-tech jobs of the future, she said.

"Broadband Internet deployment creates jobs," she said. "I want those jobs to go to Thief River Falls, Minnesota ... instead of India or Japan."

Read More

Curiosity drives Twitter "social virus"

If you were hanging out on Twitter today, you probably noticed a lot of very similar Tweets coming through, saying "Don't Click" followed by a shortened URL.

Many people, upon receiving that Tweet, immediately clicked the link, which took them to a page with a "Don't Click" button. And when they clicked on that button (assuming they were logged into Twitter in their web browser) they ended up posting a Tweet from their account. This Tweet repeated the original message: "Don't Click" followed by a shortened URL. Which all their Followers clicked. And so on.

The end result of this was huge numbers of "Don't Click" Tweets, a lot of puzzlement on the part of the Twitter community, and nothing more serious. This time at least.

The security community immediately got to work investigating the event and found that it was accomplished via clickjacking. Chris Shiflett has a done a great job of explaining the exploit, as has Sunlight Labs. This wasn't a case of using clever javascript or any scripting at all. It was just done with an IFrame, pulling the Twitter page into the "Don't Click" page and populating the Status Update box on the Twitter page. However the IFrame was rendered invisible via CSS. You thought you were clicking this "Don't Click" button on the page, but you were actually clicking the (now invisible) Update button on the embedded Twitter page. If that went over your head, the links above step through it much more clearly.

To their credit, the Twitter Engineers blocked the problem very quickly, and no real harm was done. But their fix isn't bulletproof, as Jeff Jones discovered.

In some ways, the most interesting part of this story was the way it was the "virus" was distributed. Apparently the very best way to get people to click on something is to label it "Don't Click"!

Read More

Blockbuster, Inc announced today that it would add video games to its BLOCKBUSTER Total Access online rental service. A pilot program is planned for Q2 of this year with a goal of national availability by the second half of the year.

This puts Blockbuster in competition with online game rental services such as Gamefly, Gamerang and Gottaplay, none of which have the breadth of distribution centers that Blockbuster has. Additionally, renting games will offer a differentiation point from rival Netflix. Game platforms covered include Nintendo Wii, Sony PS & PS3, and Microsoft Xbox & Xbox 360. As with movies, users will be able to return rentals to a brick and mortar Blockbuster store.

Game enthusiast site Joystiq contacted Bob Barr, vice president and general manager of Blockbuster Online, for further details, including the price. A 3-disk Total Access account costs $19.99 per month. During any month that a game is rented, a $5 charge gets added to that price. During the testing phase, a game counts as a disk.

One of the biggest problems with existing game-rental services is availability of new titles; it'll be interesting to see if Blockbuster can overcome this hurdle.

Read More

T-Mobile issues firmware update for G1, adds voice search

T-Mobile began pushing out an update that adds a couple of new features and fixes some glitches in the G1, its phone that runs Google's Android software.

The most notable new capability is voice search. Once G1 users get the firmware update, they'll notice an icon for a microphone in the Google search bar on the home screen. When users hit the button they'll hear a "speak now" prompt, after which they can say their query, said Jeff Hamilton, a software engineer for Android, in a blog post.

If voice search doesn't properly interpret the query, users will be able to hit a "down" arrow next to the search box to find other suggestions, one of which might be correct, he said. G1 users will also be able to dial phone numbers and search in their contacts lists using voice commands.

The voice command capability follows the introduction of Google's voice search application for the iPhone in November.

Another minor addition with the Android update is the ability to save attachments sent via MMS. Users will also start seeing notifications when new software updates are available, including for applications in the Android Market. Phone users will also be able to report offensive comments in the Market as spam.

The update fixes a few glitches as well, such as one that automatically ended an instant messaging session when users turned their Wi-Fi connection on or off. Another glitch caused reminders for calendar items not to be delivered.

T-Mobile started pushing the update out Monday and expects all customers to receive it in two weeks.

On a T-Mobile Forum hosted by the operator, an administrator said the update is not related to "cupcake," the name of another update that will include a wider range of new capabilities and bug fixes.

Read More

Intel to invest $7B on U.S. plants

Intel will spend $7 billion over the next two years to revamp three U.S. manufacturing plants, and the company's CEO called on other companies to also invest in the future as a way to combat an economic recession.

Intel will update manufacturing plants in Arizona, New Mexico and Oregon to build new 32-nanometer processor chips, Paul Otellini, the company's president and CEO announced today.

Intel sees the tough economic times as an opportunity for investment in the future, Otellini told the Economic Club of Washington "Tough as these times are, we are not blinking," he said. "Today, I am pleased to announce our intention to stamp the words, 'made in America,' on even more Intel products in the months and years to come."

He called on other U.S. companies to join Intel, even as dozens of companies are laying off workers. "A secure future requires investment in areas that will give rise to new industries and new ideas," he said. "We can't look to government to do this."

The three U.S. plants will support about 7,000 Intel employees and "multiple thousands" of contractors

Read More

Hackers clone passports in drive-by RFID heist

A British hacker has shown how easy it is to clone US passport cards that use RFID by conducting a drive-by test on the streets of San Francisco.

Chris Paget, director of research and development at Seattle-based IOActive, used a US$250 Motorola RFID reader and an antenna mounted in a car’s side window and drove for 20 minutes around San Francisco, with a colleague videoing the demonstration.

During the demonstration he picked up the details of two US passport cards, which are fitted with RFID chips and can be used instead of traditional passports for travel to Canada, Mexico and the Caribbean.

“I personally believe that RFID is very unsuitable for tagging people,” he said.

“I don’t believe we should have any kind of identity document with RFID tags in them. My ultimate goal here would be, my dream for this research, would be to see the entire Western Hemisphere Travel Initiative be scrapped.”

Using the data gleaned it would be relatively simple to make cloned passport cards he said. Real passport cards also support a ‘kill code’ (which can wipe the card’s data) and a ‘lock code’ that prevents the tag’s data being changed.

However he believes these are not currently being used and even if they were the radio interrogation is done in plain text so is relatively easy for a hacker to collect and analyse.

The ease with which the passport cards were picked up is even more worrying considering that less than a million have been issued to date.

Paget is a renowned ‘white hat’ ethical hacker and has made the study of the security failings of RFID something of a speciality.

In 2007 he was due to present a paper on the security failings of RFID at the Black Hat security conference in Washington but was forced to abandon the plans after an RFID company threatened him with legal action.

He points out that RFID tags are increasingly being used in physical security systems such as building access cards and the technology needs significant security adding before it could be considered safe for commercial use.

Copyright © 2009 vnunet.com

Read More

Mommas don't let their babies grow up to be engineers

More than 85% of students today aren't considering careers in engineering, a new survey found, as more parents encourage girls specifically to become actresses than IT professionals.

The vast majority of students recently polled confirmed that interest in engineering careers has waned significantly, with a majority (44%) of respondents citing a lack of knowledge around engineering as the top reason they would not pursue such jobs. Another top reason kids don't consider a career in high-tech involves the "geek" perception for 30%, who indicated "engineering would be a boring career," according to the American Society for Quality (ASQ).

ASQ commissioned Harris Interactive to conduct an online survey of 1,277 U.S. youths aged 8 to 17 and 2,196 U.S. adults aged 18-plus, of whom 584 reported being parents of children aged 17 or younger. The ASQ kicked off the study in light of forecasts that there will be a shortage of 70,000 engineers by 2010, according to the National Academy of Sciences and National Science Foundation.

Another factor kids surveyed indicated steers them away from a career in engineering is a lack of confidence in math or science skills (21%). Yet 22% of kids polled listed math as their favorite subject and 17% find science the most fun. Additionally, just 20% parents encourage their children to consider an engineering career, despite the fact that 97% of parents said they believe knowledge of math and science will help their children have a successful career.

"It's clear that there is a low level of interest and knowledge about engineering careers for both parents and children," said Maurice Ghysels, chair of ASQ's K-12 Education Advisory Committee. "Educators and engineers need to work more closely together to get students excited about the profession and spotlight interesting role models."

The survey results also revealed a gender divide among students' career aspirations and parental guidance. Among the girls, 21% said their parents encourage them to be actresses vs. 10% hearing about the potential of engineering from their parents. Other careers parents find suitable for their girls include doctor (33%), teacher (31%), lawyer (25%), veterinarian (23%), nurse (20%) and businessperson (17%).

Boys indicated a higher interest in engineering careers than girls: 24% vs. 5%. And parents follow suit. Nearly one-third of boys polled said their parents have encouraged them to consider a career in engineering, vs. just 10% of girls who said the same.

Read More

A New Internet Attack: Parking Tickets

Trojan-pushing parking tickets? Yes, really. The Internet Storm Center, which tracks Internet attacks and threats, documented a case in Grand Forks, North Dakota where someone put yellow fliers on cars that claimed to ticket a parking violation. The fliers named a Web site that purportedly had pictures of your supposed violation.

To see the pictures, according to additional commentary from the McAfee Avert Labs, the site instructs you to download a toolbar named PictureSearchToolbar.exe. Do so, and you end up with a Trojan. That Trojan, called Vundo by Symantec and McAfee and Monder by Kapsersky (according to a Threat Expert report linked by the ISC), displays false infection warning pop-ups that market a fake antivirus product called "Antivirus 360."

I knew that pushing rogue antivirus was becoming a more popular tactic for crooks, who get a cut of the purchase price via shady affiliate marketing deals, but I had no idea the potential profits could justify the time and expense of physically distributing fake parking tickets. Then again, maybe it doesn't: Many Internet crooks aren't exactly known for their excessive brain power.

The ISC post from Lenny Zeltser has more details on the discovery, including some digital sleuthing about the model of the camera used for pictures on the Web site. And keep an eye out for an upcoming PC World story that delves into rogue antivirus, including how to tell a harmless browser-based social engineering attempt from one that can indicate a malware infection like the one described here

Read More

Analyst: Apple making smart moves with next OS, Snow Leopard

Apple has delivered another pre-release build of Snow Leopard, its next operating system, that includes developer tools to mimic the iPhone's location-sensing skills and boost the multi-touch function of the company's laptops, according to reports on the Web.

Both moves would be smart for Apple if they are part of the OS when it is rolled out, an expert said Friday.

According to AppleInsider , developers now have Mac OS X 10.6 build 10A261, which includes a development framework, dubbed "CoreLocation," for triangulating location, as well as access to new APIs (application programming interfaces) for making use of the multi-touch features in the newest MacBook and MacBook Pro notebooks.

CoreLocation debuted in the first-generation iPhone as part of a January 2008 firmware update , which lacks any GPS hardware, and instead uses cellular signal towers to determine an approximate location. According to AppleInsider's sources, Snow Leopard includes support for the feature.
"Apple clearly wants to leverage the portability [features] of its smaller devices, like the iPhone, on its other hardware," said Ezra Gottheil , an analyst with Technology Business Research Inc.

He was also bullish on the idea that Snow Leopard may include more support for multi-touch, the finger gestures available in limited form on Apple's laptop trackpads. The design, which debuted early last year on the MacBook Air and then on the updated MacBook Pro line , was extended to the less expensive MacBooks in Apple's October laptop revamp . Multi-touch, like geo-location, was first found on the iPhone.

"Apple might be able to get more out of the multi-touch touchpads," said Gottheil. He pointed to the four-finger swipe that calls up Leopard's "Expose" screen feature. "Before [multi-touch], I just never used Expose on an Apple laptop ... it was just too hard to do the Function-F9 keypresses."

With Snow Leopard, third-party software developers will be able to call on the operating system's gestures within their own applications, AppleInsider reported.

Last June, Apple confirmed that it was working on Snow Leopard, and at the time said it would ship the update to Mac OS X 10.5, aka Leopard, in about a year. It also stressed both then and later, that Snow Leopard would focus on performance and stability improvements, and lack the kind of flashy interface or feature changes that users have come to expect from the company's operating systems upgrades. Apple's current online marketing materials for Snow Leopard, for example, claim that the OS is "taking a break from adding new features."

Today, Gottheil said everyone should take Apple at its word. "I think that Apple will try to make it as appealing as it can as an upgrade," he said. "But unless they have some brilliant insight that they're hiding, they're basically going to deliver a lot of invisible improvements with Snow Leopard."

And while that may not dampen the enthusiasm of Apple's most fervent fans, it will likely mean less of a benefit to the bottom line. "I don't think they'll get the upgrade revenue that they did before with Leopard," Gottheil said.

According to the retail market research company NPD Group Inc., Apple easily broke its one-month upgrade revenue record in late 2007 when it launched Leopard that October. Unit sales of Leopard were up 20.5% over its predecessor, Mac OS 10.4, also known as Tiger, when both versions' first-month numbers were compared. Leopard's revenue was up even more: 32.8% higher than Tiger's.

Gottheil doesn't see Apple being able to repeat that performance with the lower-key Snow Leopard. "But then, that's sort of where OS system development is heading, isn't it?" he said, pointing to a similar message coming out of Microsoft Corp. . It has said its next operating system, Windows 7, is no full-fledged revamp, but an update to Vista that focuses on boosting performance.

One way Apple could improve its chances of promoting Snow Leopard would be if it launched the new operating system with a redesigned line of iMacs, as some have speculated. "There's been talk of Apple using quad-core processors in the iMac," Gottheil acknowledged, referring to reports by other analysts, primarily Shaw Wu of Kaufman Brothers, who has recently speculated that Apple will soon refresh its main desktop line.

"Apple might have the two [Snow Leopard and iMacs] ready at the same time, although they don't necessarily have to," said Gottheil. Instead, Apple could launch a line of more powerful desktops sooner, including models with quad-core processors or more powerful graphics processors, then later in the year roll out Mac OS 10.6 and promote it as the OS that takes advantage of the new hardware.

Snow Leopard will be optimized for multi-core machines -- the company has promised to "squeeze every last drop of power from multi-core systems" -- and will support OpenCL (Open Computing Language) to allow developers to "steal" computing power from the graphics processor and apply it to general, nongraphics tasks.

Apple has been silent in recent months about its plans for rolling out Snow Leopard. Despite predictions it would announce a timetable at last month's Macworld Expo, it failed to do so.

Read More

The incredible shrinking operating system

Windows, Mac OS, and Linux are all getting smaller. What does that mean for you?
From the software concept called JeOS (pronounced "juice"), the Just Enough OS, to hardware concepts like Celio RedFly, an 8-inch screen and keyboard device running applications off a smartphone via a USB or a Bluetooth connection, there are an increasing number of indications that the center of gravity is shifting away from the traditional massive operating systems of the past.

Even the major OS vendors themselves are saying that the next versions of their OS -- Windows 7, Linux in its many distributions, and Mac OS X 10.6, aka Snow Leopard -- are getting a smaller footprint.

There are many reasons for the traditional OS to shrink and for new OSes to start small, but two stand out:

One, a smaller code base is easier to manage and secure than a large one. For example, estimates for Vista's development costs run around $6 billion, and BusinessWeek has estimated that 10,000 employees spent about five years developing it.

Two, a smaller OS can run on a greater variety of devices, and as netbooks, smartphones, and new devices such as the iPod Touch gain traction, the benefit of a smaller OS becomes hard to ignore. Today, Microsoft's Windows Mobile is a separate code base from the desktop Windows, while Apple's iPhone OS is a both a subset of and extension of the Mac OS. In both cases, that adds a lot of work for their companies and for application developers. And it means that customers must support an unwieldy number of operating systems.

What Microsoft, Apple, and the Linux community are up to
"Ideally, we want to see Windows 7 run across a spectrum of hardware: small, standard, or desktop," says James DeBragga, general manager of Windows Consumer Marketing at Microsoft. Apple hasn't said why it wants Mac OS X to use fewer resources, but a common theory is that it wants future iPhones and perhaps netbook or tablet devices to run the same OS as its beefier Macs do.

DeBragga told InfoWorld that Microsoft designed Windows 7 to reduce the overall memory footprint compared with Windows Vista. It did so by reducing the overall number of services running at boot, improving Desktop Windows Manager memory consumption and reducing the memory requirements for features throughout Windows 7. "Users have no patience for a long boot-up or shut-down time," says Dan Kusnetzky, an independent research analyst.

Linux distribution vendors are also slimming down their versions of Linux. Ubuntu, for example, has stripped out MySQL, CUPS (Common Unix Printing Service), e-mail, and LDAP functionality to bring the size of its OS down from about 700MB to 200MB.

And Red Hat, Novell, and Ubuntu have all delivered stripped-down versions of their Linux distros for use in virtual appliances, several of which often run on one physical computer, so footprint becomes a key issue for them. Red Hat's AOS (Application Operating System), for example, lets you run Linux Enterprise Edition apps unmodified in a portable virtual machine. And JeOS -- which Ubuntu, Novell, and others offer -- builds a stack that is "just enough" to support that application by analyzing what APIs and library components need to be called for what functions.

While Apple always plays it close to the vest, it too has stated publicly that the next Mac OS will be smaller: "Taking a break from adding new features, Snow Leopard ... dramatically reduces the footprint of Mac OS X, making it even more efficient for users and giving them back valuable hard drive."

Not everyone is convinced that the traditional OSes will stay small. Tony Meadow, president of Bear River Associates, says that the current OS footprint reductions are all about pruning, such as removing old graphics APIs. But he believes that new capabilities will pull the OSes to keep growing, despite the periodic pruning.

New devices drive need for a much smaller OS
Beyond making the OSes smaller for physical computers and virtual machines, the major platform providers face a new pressure to reduce their OSes' size: the several new classes of devices, from netbooks to smartphones. Netbooks are a good example: Because their hardware resources are much more limited than regular laptops', Microsoft has had to keep Windows XP available for them, since Vista simply can't run on them.

Much of the latest mobile hardware can be run to good advantage on microprocessors and OSes that require less power. The high-tech rumor mill lately has been abuzz about the possibility of a full-size notebook running a smartphone-oriented processor such as ARM's with an embedded version of Linux; such a device would have a battery life of days, not hours. "To an ARM device, a laptop looks like the Hoover Dam in terms of battery life," says Jim Ready, CTO of MontaVista Software.

Dell has already taken a step in this direction with its "BlackTop" Latitude laptop, which can boot into Linux for e-mail, Web access, and document viewing instead of Windows (which you can also boot into for traditional work).

Smartphones such as the Apple iPhone and the Research in Motion BlackBerry are also increasingly providing computerlike capabilities, creating demand for computerlike OSes to run on them. Witness Celio's RedFly, a smartphone terminal that connects to a cellular phone over Bluetooth or a USB. It weighs just 1.4 pounds and features an 8-inch screen and an 8.3-inch keyboard large enough to do real work. RedFly uses the Windows Mobile OS as an operating system, and its users typically work in their browser, often using Web 2.0 applications.

Time for the browser to supplant the OS?
The dependence on the browser, instead of the OS, in such devices has convinced some that the OS should shrink even further, ceding much of its role to the browser.

One of those believers is Philippe Winthrop, a mobile analyst at Strategy Analytics. He says the notion of cloud computing is a major driver behind the movement away from full-featured OSes and toward having critical functions reside in the browser.

For example, the SDK for the hot new Palm OS provides developers with CSS, JavaScript, and XML, all the tools that are used in a modern browser. These tools let developers write applications as widgets that do not require the support of an onboard OS.

Winthrop also says when back-end and front-end services both use the same Web technologies, the need for a powerful OS is reduced.

Tomi Rauste, president of Movial Creative Technologies, a mobile consultancy, picks up on that idea. Rauste believes combining Web technologies obviates the need for application integration at a deeper level. "Using Web technologies to customize a user interface is far easier than using interface technologies where you have to have native coding skills to change the interface," Rauste says.

Of course, Microsoft is not convinced that the browser will take over much of the OS. While there are a number of embedded versions of Windows, including Windows CE and Windows XP Embedded, where hardware designers use only those components needed for their device, DeBragga says he doesn't see the browser taking over most of operating system chores.

It is true that 50 percent of the time a user is in his or her browser, but the browser is not suited to handle the other applications a computer can handle, DeBragga argues. He cites document editing and video editing as example tasks that don't require a browser but do require a powerful operating system.

Bear River's Meadow agrees. While the OS may get smaller and more users will live in their browsers, he says there is still a lot of competitive advantage to having a fully featured OS that does things other operating systems don't. Case in point: "OS X running on the iPhone gives the iPhone incredible power."

But even that legitimate OS dependence is changing, counters Winthrop. He points to Photoshop.com and Photoshop Express, Web versions of the premier photo-editing package Adobe Photoshop. There was a time when no one would have thought that feature-rich Photoshop would ever be a Web 2.0 application, but to a great extent it is now.

For a growing class of users, notes independent analyst Kusnetzky, a device that presents a Web browser, Internet mail, a word processor, and a calendar is more than sufficient for their needs.

It's certain the OS will continue to shrink, in whatever direction
The incredible shrinking of Windows 7, Mac OS X Snow Leopard, and Linux JeOS are no accidents. The OS center of gravity is indeed shifting away from the large do-it-all operating systems to a far more targeted approach.

The reason for these changes by the major vendors is downright Darwinian. All of them realize that they must adapt or die as virtualization, cloud computing, the explosion of unique devices, and the desire for more efficient, less costly operating systems all drive the next generation of business users toward smaller, less costly, and more efficient operating environments.

Read More

Identity thieves beat Obama to stimulus package punch

Although the U.S. government's economic stimulus package hasn't even gotten out of Congress, scammers aren't waiting; they've launched multiple campaigns that tempt users into revealing personal information, a security researcher warned Thursday.

One spam-and-scam example, said Dermot Harnett, a principal researcher with Symantec Corp., poses as a message from the Internal Revenue Service (IRS) , and claims that the recipient qualifies for something called a "Stimulus Payment."

"After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a Stimulus Payment," the bogus e-mail reads. The message then tells the user to download the attached document, supposedly a form that must be submitted to the IRS.

The document, in fact, is an identity stealing tool, said Harnett, that asks the user to provide personal information, much or all of it data that the actual IRS would presumably have on file.

Another stimulus-related spam campaign Harnett has monitored touts "Economic Stimulus Grants," and tempts the unwary with a link that offers fake testimonials. "I found the grant I needed and filled out the forms and sent them in and in about two weeks I received a check in my hand for [US]$100,000," one reads.

"This one takes people to a marketing type of site," said Harnett, "and after it asks them to answer a few questions, including salary range, e-mail address, mailing address and date of birth, it promises to send out a CD that shows you how to claim one of these grants. They're building up their files on people." Another twist: The CD comes with a postage and handling charge, which the scammers use to collect credit card information.

It's no surprise that such spam is circulating, said Harnett. "People often have news alerts set from various organizations, so they expect to see subject lines about the stimulus package," he said, noting that the tactic of using current events is nothing new.

Given that stimulus scams cranked up as long as two weeks ago -- and President Obama 's $900 billion plan isn't slated to come to a vote in the U.S. Senate until later Thursday

Read More

Free BlackBerry Downloads: 5 (More) Essential Apps

If you're anything like me, you spend entirely too much time poring through Web pages and online search engines seeking the latest and greatest free BlackBerry downloads for your Research In Motion (RIM) smartphone. But today's your lucky day. Today, the search stops right here.

Over the past weeks and months, I've worked hard to deliver to you the best free BlackBerry applications the Internet has to offer. I dug up my top picks for free open source BlackBerry apps, the best mobile Twitter apps, and the highest quality BlackBerry Storm software. I even asked RIM's co-CEO and two additional executives for their favorite free BlackBerry software, then delivered the answers directly to you.

This time around, I picked a handful of new apps that promise to vastly improve your BlackBerry's audio experience, help you rapidly browse the Web, manage your online DVD mailing account, find just about anything from anywhere, and even grab screen captures of your device's display without the need for a PC.

Slacker Radio for BlackBerry: Your New Radio is...Your BlackBerry!?!

It's rare, but every once and a while a new BlackBerry application comes along and single-handedly raises the bar for all other mobile apps. The last such piece of software I can remember to fit this description is Viigo, the ultimate mobile RSS reader and lifestyle app. For a long time, Viigo has been my favorite free BlackBerry app, but today, thanks to Slacker Radio for BlackBerry, I'm just not sure anymore.

Slacker Radio for BlackBerry is an easy to use, personal Internet radio app that brings unlimited free music to your RIM smartphone. More than 100 pre-programmed "genre stations" let you listen to a variety of artists and ensembles for as long as you want--or your battery lasts. And the app works well on just about any BlackBerry device running RIM's handheld OS v4.3 or higher and with at least an EDGE or another 2.5G data connection. The app also works over Wi-Fi. (For best results, employ Slacker for BlackBerry on a device running BlackBerry OS 4.5 or higher.)

The best thing about Slacker for BlackBerry? Why, it's free of course--or at least there's a free option. To employ the new app, simply surf on over to Slacker.com using your BlackBerry browser and follow the on-screen download instructions. Once the app's installed, you can either log in to an existing Slacker account or create a new one. You'll have two options for account creation: 1) a free account, which delivers the occasional audio and visual advertisements and lets you skip over songs just six times an hour; and 2) the commercial version, which is available via subscription for US$3.99 a month--$47.88 a year--and doesn't have a limit for song skips or requests.

iPhone and iPod touch, one of its most valuable features is currently restricted to the BlackBerry-specific version: station "caching." The ability to cache, or store, Slacker stations on your BlackBerry's media card means that you can listen to your favorite tunes without wireless connectivity, which makes the app particularly well suited for use during travel. (You must have at least 500MB of free space on your media card to cache Slacker stations.)

And like most BlackBerry apps, it supports multitasking, so you can, say, play a game of BrickBreaker while jamming out to the Beatles on Slacker.

More details on Slacker Radio for BlackBerry can be found online.

Bolt Browser for BlackBerry: Lightning Speed

RIM is a legend in the smartphone space: Its keyboards are inimitable; its "push" e-mail delivery system is the envy of the mobile industry. But the company's browser? That's a whole different story. The BlackBerry browser sucks; it's relatively slow, awkward to use and doesn't always render pages correctly, among other complaints. (The BlackBerry browser on the Storm, in OS v4.7, is a step in the right direction, but still...)

I've offered up free alternatives to the BlackBerry browser in the past -- namely, Opera Mini--but today, there's a new kid on the browser-block: Bolt.
I have a few quibbles with Bolt--it too has problems rendering certain pages; it uses a proxy server, which could be considered a privacy/security risk; and it's still in beta and is a bit unstable. But whatever it lacks in these categories, it makes up for in speed.

Bolt is fast, Fast, FAST; in fact, it's the speediest mobile browser I've ever used. And it employs similar shortcuts to Opera Mini for scrolling, zooming and other page navigation, so it shouldn't take you long to get used to it. And Bitstream, the company that makes Bolt, also says the browser uses one-third of the battery life of comparable mobile browsers.

As mentioned above, Bolt is still in beta testing, and as such, you'll need to request an invite for a free download at this point. But Bolt ought to be hitting the big-time any day now, and you can expect to find a download link on the Bolt website as soon as it does.

(Note: Bolt is not BlackBerry specific and will work on a wide variety of Internet-connected mobile devices.)

SmartFlicks: Netflix for Your BlackBerry

I'm an unabashed film buff; I love movies and DVDs. But it's been quite some time since I stepped foot into a brick and mortar movie rental joint like Blockbuster or Hollywood Video to pick up a flick. I've long been a user of the Netflix DVD mailing service, as the price is right, selection is great and you can't beat the convenience of having movies delivered directly to your door.

I've always wished for more though: Wouldn't it be handy

, and add movies to your online queue whenever, and wherever, you might be. Thanks to Pyxis Mobile and its SmartFlicks app, my wish is now a reality.

The SmartFlicks free BlackBerry app lets you manage and update your NetFlix account from anywhere there's cellular connectivity. You can not only add and remove titles from your movie queue, but also reorder them at any point with no restrictions. You can even add films to your "Instant" queue for future viewing on your TV. (A Netflix compatible DVR, Blu-ray player of other peripheral is required for Instant viewing.)

The free BlackBerry app also offers up-to-date movie news, recommendations for future rentals, a film search feature and "What's Hot" and "Coming Soon" tabs for information on the most popular films and actors at a giving time. And its clean, intuitive user interface makes employing SmartFlicks almost as much fun as watching the movies it helps you procure.

Download SmartFlicks here.

Where for BlackBerry: Your GPS-Based Search Companion

You can find plenty of local search applications for BlackBerry devices -- some free, some not; others GPS-based, others not. One of my early favorites in this category was Beyond411 for BlackBerry. Then there was Poynt. Now there's Where.

What's truly valuable about Where? You can customize it to your own specific needs and tastes: the app uses your phone's built-in--or externally connected--GPS data, along with a set of custom widgets, to let you know what sorts of businesses and establishments are around you at any given time. And you can also use Where to find out information about those specific establishments.

For example, the free Where app comes with widgets for finding gas prices in your area; pinpointing events; locating the nearest Starbucks and digging up local user reviews on Yelp. But that's not all; Where lets users download a variety of additional widgets that provide information on items like local golf courses and the "10 Best" food/travel/hospitality recommendations for specific cities.

Where is available to users of BlackBerry Bold 9000, 8800, Curve and Pearl series devices, though whether or not the app will work on your smartphone depends on your wireless carrier. T-Mobile and Verizon Wireless users appear to be out of luck, for now at least, but AT&T, Boost Mobile, Helio, metroPCS, Sprint and Virgin Mobile customers shouldn't have any issues with Where.

Capture It with On-Device BlackBerry Screen Shots

Have you ever wanted to take a picture of your BlackBerry device's screen, to help a friend with a handheld-related issue or describe a problem of your own to your IT help desk? If so, your days of fiddling with a camera to get a decent shot of your BlackBerry's shiny screen are over.

Thanks to Capture It, a free, on-device application that grabs images of whatever's on your BlackBerry's display and saves them as .jpeg files in your Pictures directory, snapping BlackBerry screen shots couldn't be easier.

First you download and install the app to your device, set it as a device convenience key and you're good to go. (To assign Capture It as a BlackBerry convenience key, launch the Options icon, click Screen/Keyboard, scroll down to the "Convenience Key Opens" section and choose Capture It from one of the corresponding drop-down menus. Finally, hit the Escape key to exit the Screen/Keyboard screen and then save your modifications when prompted.)

Taking BlackBerry screen shot from there is as simple as tapping the corresponding convenience key whenever something you want to capture is on screen. And you can transfer the jpeg files from your BlackBerry to a computer or other device using Bluetooth, USB, e-mail or MMS.

Download Capture It via BlackBerry browser here.

Read More

IBM's Palmisano: Tech's slumdog millionaire

BM's cruel layoff options: Take a job in the Third World and lose your severance, move within the United States at your expense, or lose both your job and severance.

Meet Sam Palmisano, bozo of the month. We diss IBM's CEO for allowing some management numbskull to suggest that the thousands of Big Blue employees who have been fired recently should consider a move to India. And work really cheaply. Always helpful, IBM is willing to pitch in with moving costs and -- in a particularly ironic twist -- visa assistance.

p>Yeah, it's hard to believe. But IBM put it in writing: "IBM has established Project Match to help you locate potential job opportunities in growth markets where your skills are in demand," IBM says in an internal memo first obtained by InformationWeek. "Should you accept a position in one of these countries, IBM offers financial assistance to offset moving costs, provides immigration support, such as visa assistance, and other support to help ease the transition of an international move."

Maybe India's not to your taste. No worries. IBM is also offering to send the newly unemployed to China, Brazil, the Czech Republic, Russia, South Africa, Nigeria, and the United Arab Emirates.

Pink slips at Big Blue
And in a touch that could only be called Dickensian, the IBM memo notes that Project Match, which sounds like a reality show on Bravo, is limited to "satisfactory performers who have been notified of separation from IBM U.S. or Canada and are willing to work on local terms and conditions." Right. The worthy poor who don't mind working for wages that are infinitely lower than what they've been paid in the United States.

(For those who are considering a move overseas, check out InfoWorld's guide to offshoring yourself.)

The stunningly stupid memo comes amid a wave of firings that has cost the jobs of at least 2,800 IBMers, a move the company was unwilling to acknowledge until ousted workers and their union leaked internal documents to the media, including the Associated Press, which said that workers have reported layoffs in Tucson, Ariz.; San Jose, Calif.; Rochester, Minn.; Research Triangle Park, N.C.; East Fishkill, N.Y.; Austin, Texas; and Burlington, Vt.

Did I mention this came at the same time IBM reported strong financial results?

According to the Web site of the Communications Workers of America which represents some IBMers, roughly 1,400 workers in the software group and a similar number in sales have been let go. There are unconfirmed rumors that as many as 16,000 workers could eventually be let go, surpassing even the 13,000 who were canned in 1985. I suspect that number is too high, but we'll see.

The Associated Press reported recently that in 2007, the last full year for which detailed employment numbers are available, 121,000 of IBM's 387,000 workers were in the United States, down slightly from the year before. Meanwhile, staffing in India has jumped from just 9,000 workers in 2003 to 74,000 workers in 2007.

And of course, tens of thousands of tech workers are losing their jobs at other companies, including such giants as Hewlett-Packard, Microsoft, Intel, and Motorola, not to mentions dozens of startups across Silicon Valley.

Take this job or nothing
Meanwhile, some IBM workers who still have jobs are being given a very tough choice: Move across the country at your own expense, or get fired with no severance package.

That information comes from an angry IBMer who spoke with a writer from the Silicon Alley Insider. According to the tipster, one of several who told similar stories, the workers are being placed at newly formed Global Delivery Centers in Colorado, New York, and Iowa. If they don't take the job, IBM labels them a "voluntary departure" and terminates them with no severance.

For those who are simply laid off, outplacement services aren't very good. One IBMer (I know his name but won't use it) gave this account in an e-mail to me: "The outplacement service is pretty bad, like calling the DMV. ... I called last week for a résumé review, left a message on the 800 number. 48 hours later someone calls back and leaves me a message -- they say they are returning my call, please call the 800 number if you would like to talk to someone. I call and get the same message."

Interestingly, this gentleman actually gave some thought to a potential IBM job in Malaysia, but as the pay was about one-third of his current salary, he rejected it. He also tells me that there's yet another catch in the offer to move employees to what we used to call the Third World. "The deal is that if you take the job IBM won't pay severance but will pay 'a portion' (undefined) of your relocation expenses, including tax and visa services. Not a good deal for many of my colleagues who have 20-25 weeks of severance under their agreement."

Sadly, with the economy in terrible shape, layoffs are sometimes necessary. But a company as rich as IBM should handle a downsizing better -- much better. At the moment, I'm ashamed to be an IBM shareholder.

Read More

Turning smartphones into desktops on the go

Flyweight RedFly makes using applications on smartphones practical

The idea that a business traveler would someday carry his or her desktop and applications on a small device has been around for well over a decade. Of course, back then, small was brick-size, and the notion was that the user would then be able to plug this device into a screen, keyboard, and mouse wherever they landed.

The concept was considered daring because it was making the outrageous assumption that computing devices were going to get small enough for a user to carry them comfortably while remaining powerful enough to hold and process megabytes of data.

Of course, the idea that there would need to be a screen and keyboard awaiting them at each stopping point was testament to the fact that folks couldn't foresee that these tools could be miniaturized as well.

Today, the idea is a reality, but it is no longer the size of a brick. Furthermore, remote connection back to corporate applications -- a concept never even considered at that time -- makes this new reality even better. This device is now called a smartphone.

But what of the problem of a decent-size screen and keyboard without which applications on a smartphone are quite impractical? At last there appears to be a solution. Our traveler can now carry around his or her own screen and keyboard. And if you guessed netbook, you're wrong!

The name of the device is RedFly by Celio, and it comes with a 7- or 8-inch screen, an 8.3-inch keyboard, two USB ports, Bluetooth, and 8 to 10 hours of battery life that, when connected, actually charges your smartphone while you work.

All RedFly does is duplicate what is on your cell phone. It has no application processor, operating system, or storage. There is a small kernel OS, on a Xilinx chip, that enables RedFly to establish a connection with the cell phone and then port the video from the smartphone over to its screen. But there is no need to synchronize data or duplicate applications.

The display is not derived from screen scraping. The display is enlarged to 800 by 480 pixels from the typical 2-by-2-inch smartphone image using compression technologies that enable RedFly to take hundreds of megabytes of data and pass it over either a 800Kbps Bluetooth pipe or a 2Mbps to 3Mbps USB connector. In turn, the USB connection can be used to plug in a thumb drive that will show up on your cell as another drive.

It currently works with Windows Mobile, but at CES, Celio unveiled an Android prototype, and we can expect to see support for other OSes roll out over the coming months.

Two models are on offer: the $199 Model C7, with a 7-inch screen; and the $299 Model C8N, with an 8-inch screen, media port, and NTSC/PAL external video.

What is still in development is the ability to take some video formats from the smartphone over to the device. But that is coming, too, Kirt Bailey, CEO and president of Celio, tells me.

Bailey believes that the smartphone will become the ubiquitous mobile computing platform, not a notebook or netbook. And of course, if that happens, he believes RedFly will grow right along with it.

There are some stats that seem to substantiate Bailey's optimism. Currently smartphones are outselling notebooks by about 1.5 times. And for all of the reasons we already know, such as Moore's Law, increasing memory capacity on smartphones, the decreasing cost of flash, and technology such as Microsoft RDP (Remote Desktop Protocol) for terminal services, and Citrix XenApp and XenDesktop already running on smartphones, it makes sense.

XenDesktop and XenApps client and server software gives remote users access to all Windows and Mac applications on a cell.

Bailey sees other areas of growth beyond smartphones. For example, a small RedFly ASIC (Application Specific Integrated Circuit) integrated into your car could talk to your cell phone, allowing you to use the phone GPS system for navigation and to put up a travel map, plus contacts and calendar, on the auto LCD, all while using an interface you're familiar with: your own cell phone.

It also has a cost advantage over a netbook, which requires a company to budget in an additional $70 for each employee for a 3G data card. Your company is already paying that for the cell phone, and no one is going to give up their cell phone even if they have a netbook, but the reverse may prove to be true.

At some point, if Bailey is right he may attract competitors, but at the moment, I could find none. The closest thing is a software utility from MotionApps called mDesktop. It puts smartphone functions on a desktop screen.

In one sense, the success of RedFly depends more on the current and future capabilities of the cell phone than on the business smarts at Celio. If the cell phone becomes the single most important computing device for remote users, then of course RedFly goes along for the ride.

But if looked at from the other side, RedFly is not a passive participant. Rather, RedFly is the device that will allow a cell phone to become a business user's single most important mobile computing device.

Read More

Test Center guide to browser security

Chrome, Firefox, Internet Explorer, Opera, and Safari have different security advantages and shortcomings. More important than the browser you choose, however, is how you maintain and use it.
The recent out-of-band emergency patch for Internet Explorer has many pundits recommending any browser but IE as the best security defense. Although there is some safety in using less frequently attacked software, a better question is which is the safest choice among the most popular browsers? What are the most important security features to look for in a browser, and what are the weaknesses to beware?

This review focuses on security features of the following Windows-based Internet browsers: Google Chrome, Mozilla Firefox, Microsoft Internet Explorer, Opera Software's Opera, and Apple's Safari. All but Chrome are included because they rank among the most popular browsers, with long track records and millions of users. Google Chrome is included because it boasts a unique security model and the wide expectation to significantly eat into the other browsers' market share. The latest publicly available versions (including beta versions) have been used in the review. Each browser has been tested on Windows XP Pro SP3 and Windows Vista Enterprise.

The purpose of this review was to test each browser's security fitness. As such, these reviews generally do not cover any new features not related to security. Also, since this review was focused on testing the security of each particular browser, all browsers were tested with the default vendor-installed add-ons only. For example, although NoScript is a popular Firefox browser add-on often installed to enhance security, it isn't installed by default and isn't created by the vendor, so it wasn't included in the review.

Full disclosure: The author of this article is employed full-time by Microsoft as a security architect. He has no involvement in the development or marketing of Internet Explorer. He uses multiple browsers across several OS platforms on a daily basis and has several favorites, including browsers not included in this review.

Making a secure browser
If you're looking for the perfectly secure browser, stop looking. Each new browser entry typically promises a more secure browsing experience, only to prove that making a truly secure Web browser is difficult. Each of the most popular browsers has dozens of patched vulnerabilities. Even the newest, Google's Chrome, released in beta form in September 2008, has nearly a dozen exploits already. Perhaps the strongest testament to how hard it is to make a secure Internet browser is the fact that even the text-only Lynx browser, which is as simple as a browser can be (it can't even display pictures or video without external programs), has had five vulnerabilities. If attackers can cause buffer overflows in a text-based browser, any browser more complex will have its issues.

In general, administrators must consider every Internet-connected Web browser as high risk. In very high-security environments, Web browsers aren't allowed to run or aren't allowed to render content from the Internet. But assuming your enterprise needs to browse the Internet and seeks a Web browser with an acceptable level of security, keep reading. A secure browser must include the following traits as a minimum:

* It was coded using Security Development Lifecycle (SDL) techniques.
* It has undergone code review and fuzzing.
* It logically separates network and local security domains.
* It prevents easy malicious remote control.
* It prevents malicious redirection.
* It has secure defaults.
* It allows the user to confirm any file download or execution.
* It prevents URL obscurity.
* It contains anti-buffer overflow features.
* It supports common secure protocols (SSL,TLS, etc.) and ciphers (3DES, AES, RSA, etc.).
* It patches and updates itself automatically (with the user's consent).
* It has a pop-up blocker.
* It utilizes an anti-phishing filter.
* It prevents Web site cookie misuse.
* It prevents easy URL spoofing.
* It provides security zones/domains to segregate trust and functionality.
* It protects the user's Web site logon credentials during storage and use.
* It allows browser add-ons to be easily enabled and disabled.
* It prevents mischievous window use.
* It provides privacy controls.
* It has been battle tested by hackers over a sufficient period of time.

Another good place to start learning the detailed basics of Web browser security is Part 2 of the Browser Security Handbook, maintained by Michal Zalewski. The Browser Security Handbook gives a great introduction to many of the behind-the-scenes security policies that underlie most of today's browsers and indicates which features are supported in various browsers.

How to measure the security of a browser
Vulnerability counts and the frequency of announced exploits account for much of the overall risk to a Web browser, but they are far from the only relevant factors to consider. In this security review, the following criteria were used during evaluation:

Security model. Each browser is coded on the underlying strength of the browser vendor's chosen security model. This model is what keeps the untrusted network side separated from the more trusted security zones. If malware is able to exploit the browser, how easily can it compromise the whole system? What defenses did the vendor include in the browser's underlying design to prevent malicious use? How is malicious redirection (such as cross-domain cross-site scripting and frame theft) prevented? Is memory secured and cleared against malicious reuse? Does the browser give end-users multiple security domains or zones with varying levels of functionality in which to place different Web sites according to their level of associated trust? What end-user protections have been built into the browser? Does the browser attempt to update itself? All of these questions, and more, go into determining the fitness of a browser's security model.

When the browser runs on Windows does it take advantage of Data Execution Prevention (DEP)? If it runs on Windows Vista, does it use file and registry virtualization, Mandatory Integrity Controls (see sidebar), or Address Space Layout Randomization? These topics require too much space to discuss appropriately in this review, but all four mechanisms can make it harder for malware to gain system control.

Feature set and complexity. More features and increased complexity are the antithesis of computer security. Additional features mean more code available to exploit with more unexpected interactions. Conversely, a browser with a minimal feature set may not be able to render popular Web sites, which forces the user to use another browser or to install potentially insecure add-ons. Popular add-ons are often exploited by malware writers.

User-definable security zones (also known as security domains) are also an important feature. Ultimately, less functionality translates into better security. Security zones provide a way to classify various Web sites as more trustworthy and, hence, suited for greater functionality. You should be able to trust your company's Web sites significantly more than a Web site offering pirated software or a small Web page served up by someone you don't know. Security zones allow you to set various security settings and functionalities based upon the Web site's location, domain, or IP address.

Security domains are used in every computer security product (firewalls, IPSes, and so on) to establish security boundaries and areas of default trust. Having a security zone in a browser extends that model. Browsers without security zones encourage you to treat all Web sites with the same level of trust -- as well as to reconfigure the browser or use another browser for less trustworthy Web sites before each visit.

Vulnerability announcements and attacks. How many vulnerabilities have been found and publicly announced against the browser product? Are the vulnerability counts going up or down as the vendor patches its browser? How severe have the vulnerabilities been? Do they allow full system compromise or denial of service? How many vulnerabilities are currently unpatched? What is the history of zero-day attacks against the vendor? How often is the vendor's browser targeted versus a competitor's product?

Browser security tests. How did the browser fare against popularly available browser security test suites? In this review, all of the products passed the most well-known browser security tests located on the Internet, so each item was further exposed to dozens of real-life malicious Web sites. Often the outcome was not pretty. I experienced frequent browser lockups, objectionable content, and sometimes complete system reboots.

Enterprise manageability features. InfoWorld caters to administrators and technicians who need to accomplish tasks across an entire enterprise. It is generally easy to secure a favorite individual browser for personal use, but doing so for an entire business requires special tools. If the browser were selected for enterprise use, how easy is it to install, set, and manage secure configurations for every user?

These are the general categories that were considered when reviewing each Internet browser.

How I tested
I downloaded the latest publicly available version of each browser (including beta products) and installed it on fully patched 32-bit versions of Windows Vista Enterprise SP1 and Windows XP Pro SP3. I reviewed all security settings and options and checked the vendor documentation for clarification. I then subjected each browser to numerous tests, including dozens of pre-defined tests made in the lab, Internet-based test suites, and exposing the browsers to known-malicious Web sites.

The Internet-based test suites included several browser security test sites, such as scanit and Jason's Toolbox; several JavaScript, Java, and pop-up blocker testing sites; several cross-site scripting (XSS) testing Web sites; and several browser privacy test sites. I tested the security of the browsers' password handling using the Password Manager Evaluator Web site and the security of cookie handling using the Gibson Research Corporation's Cookie Forensics Web site. I tested Extended Validation certificates using links provided on the IIS7 site.

I surfed to dozens of Web sites known to contain live malware from several public and private malware site lists, including ShadowServer. I also visited dozens of known phishing Web sites, courtesy of PhishTank and similar referral sites. I used Process Explorer to monitor local processes and resources during install and ongoing operations. And I sniffed the browsers' network traffic using Microsoft Network Monitor or Wireshark and examined the results for information leaks.

Finally, I also relied on public vulnerability testing for these evaluations, including Metasploit and milw0rm.com. Vulnerability statistics were taken from Secunia.com or CVE.

Additionally, each browser was used over a series of several weeks (or longer) to test general use, patching intervals, and other involved functionality.

The most secure browser
Which of the browsers tested can claim to be the most secure? Here's the big shocker: None of the fully patched browsers allowed silent infections or exploitation beyond simple DoS attacks. All of the browsers stopped the latest malicious attacks available on the Internet. Occasional zero-day attacks could silently infect a particular browser during a particular period of time, but all of the browsers have this same risk, and all of the browser vendors in this review are fairly consistent in patching significant problems in a timely manner.

Hence, the overall conclusion of this review is that any fully patched browser can be used relatively safely. You can change browsers, but your risk is the same with all of them -- nearly zero -- if your browser, OS, and all add-ons and plug-ins are fully patched.

However, if I pretended to be an end-user tricked into running a malicious executable (such as a fake anti-virus program), each browser allowed the system to be infected and compromised. End-users running on Windows Vista without elevated credentials would have prevented most malware infections from occurring, but even those users were readily exploited if they purposefully elevated themselves to install the rogue program.

Browser security tips
Instead of accusing one browser of being weaker than another, real-world testing has revealed that users should pick a browser that has the security features and functionality they desire, and implement the following suggestions.

* Don't log on as admin or root when running an Internet browser (or use UAC on Windows Vista, SU on Linux, etc.).
* Make sure the browser, OS, and all add-ons and plug-ins are fully patched.
* Don't be tricked into running malicious code.
* If unexpectedly prompted to install third-party software while browsing a site, open another tab and download the requested software directly from the software vendor's Web site.
* Be careful about which add-ons and plug-ins you use. Many aren't secure, many are very insecure, and some are actually malware in disguise.

Browser findings
As expected, each Web browser had its fair share of security advantages and disadvantages. All of the browsers reviewed here, save Google Chrome, have had years to mature in response to previous malicious attacks. All of the browsers had SSL/TLS (Secure Sockets Layer/Transport Layer Security) support, anti-phishing filters, pop-up ad blocking, cross-site script (XSS) filtering, automated updates, private session browsing, and cookie handling. The following review summaries highlight their differences. Click the links to the full reviews for more detail. See also the table, "Web browser security features," comparing security features among all of the browsers.

Google Chrome 1.0
Google's first browser is a security paradox. It begins with the best browser security model, but then layers questionable decisions over a dearth of security features. It utilizes Windows Vista's new security features even better than the browser that came with Vista. JavaScript runs inside of a virtual machine environment, where it is further restricted.

Unfortunately, Chrome has almost no significant security granularity, and no separate security zones in which to place Web sites with different trust expectations. More disappointing, you cannot disable JavaScript at all. This is a huge security oversight, even if Google believes the browser can trap malicious JavaScript within the sandbox. Perhaps most troubling, Chrome has been plagued by relatively simple buffer overflow problems.

Chrome has the potential to be one of the most secure Internet browsers, but its initial showing only leaves significant questions. Read the complete review.

Mozilla Firefox 3.12
Mozilla's Firefox deserves the growing market share it has today. It is a battle-tested veteran with best-in-class cipher support, excellent add-on management, and growing enterprise features. Firefox has a fair amount of security granularity and is the only browser besides Internet Explorer to provide multiple security zones, although they are not easy to configure.

JavaScript can be disabled on a global basis, but it takes a separate add-on (called NoScript) to enable or disable it on a per-site basis. Using the About:security option in the URL bar allows the user to configure dozens of features and security settings, but the only enterprise deployment and management tools are offered by third parties. Firefox makes a good browser choice for anyone, especially for users who want to avoid the risk of native ActiveX support.
Microsoft Internet Explorer 8 beta 2
Internet Explorer is the most frequently attacked browser in the world. Its popularity, complexity, and support of ActiveX controls gives it an elevated risk as compared to the rest of the competition. Still, it also has best-in-class enterprise support, superior security granularity, and multiple security zones in which to deploy Web sites with different trust requirements. It's the only browser with built-in parental controls and a granular add-on manager.

It is also the only browser with serious enterprise management features, providing more than 1,200 customizable settings across multiple security zones. For example, the U.S. government requires what is called FDCC (Federal Desktop Core Configuration) on all of its software, and FIPS (Federal Information Processing Standards) ciphers only. Tens of millions of PCs fall under these requirements. Only IE allows these policies to be enforced across all desktops. It is difficult to achieve with any of the other browsers.

IE 8 is bringing many new features to the table, including per-user and per-site control of ActiveX programs and other add-ons. Its improved base security model is second only to Google's Chrome, and nearly every security feature it has is mature and built for enterprise use. Read the complete review.

Opera 9.63
Opera is a solid browser that deserves more market share in the PC world. It has impressive security granularity, good anti-DoS handling, strict Extended Validation certificate handling, and many unique features. Its lack of market share means it hasn't been as tested as Internet Explorer and Firefox, but it has been involved in fighting many found vulnerabilities.

On the downside, Opera doesn't support DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), or ECC (Elliptical Curve Cryptography) ciphers. These deficiencies need to be corrected before its use can be more highly recommended. Even now, I invite readers to check out Opera. I think many people will be pleasantly surprised. Read the complete review.

Apple Safari 3.2.1
Apple's Safari browser has many good features, but lacks security granularity and zones. It has good pop-up blocking, good local password protection, and a surprisingly accurate anti-phishing filter. Unfortunately, DEP is disabled, something that needs to be corrected. Safari has the weakest cipher support, failing to offer AES ciphers, 256-bit keys, or ECC ciphers.

Safari always automatically prompts the user before downloading files, and it prevents some high-risk files from being executed before downloading. Safari has good default cookie control. It is one of only two browsers in this review (the other is Chrome) to prevent all writes by third-party cookies by default, which is a nice privacy bonus. Although local password protection is strong, Safari had the weakest remote password handling of the bunch. Safari is a great-looking browser but a mixed bag with respect to security

Read More