Wednesday, August 16, 2006

Cisco can't reproduce Black Hat flaw: "

(InfoWorld) - Cisco Systems has been unable to reproduce a security flaw reported in its PIX firewall appliance earlier this month, the networking company said Tuesday. Alleged flaw was discovered by Hendrik Scholz, a developer with Freenet Cityline, who discussed it during Aug. 2 presentation at the Black Hat USA conference in Las Vegas. Freenet is a German VOIP (voice over Internet Protocol) service provider.

Scholz claimed that if someone sent the PIX device a specially crafted SIP (Session Initiation Protocol) message, the firewall would then allow attackers to send traffic to any device on the network. SIP is a protocol used to set up telephone calls and other communication sessions over the Internet.

'We've had engineers both within the business unit and within our PSIRT [product security incident response team] organization looking into this,' said John Noh, a Cisco spokesman. 'We have not been able to replicate what he claims he has discovered.'

Cisco had not ruled out the possibility that a flaw exists and is still testing its security appliances for a possible vulnerability, Noh said. But the company wanted to update customers on what it had found so far, he explained. 'This is just a response for the benefit of our customers who might have seen the press coverage.'

Scholz could not be reached immediately for comment.

During his Black Hat presentation, the security researcher said that exploiting the flaw was 'really easy to do.' But in an e-mail interview conducted two weeks ago, Scholtz said that a hacker would first need to know 'intimate details' about the network being attacked and have control of a device on the inside in order to pull off the attack.

The problem, as Scholtz described it, had to do with the PIX SIP state engine and parser.

Google launches free Wi-Fi network: "

(InfoWorld) - The Wi-Fi network Google built for Mountain View becomes generally available on Wednesday, providing free broadband wireless access in this California city that the search engine giant calls home.Google's network includes 380 access points throughout this city, which has about 72,000 residents and covers a 12-square mile area, said Chris Sacca, Google's head of special initiatives.

It will offer 1Mbps of throughput both upstream and downstream, and that capacity can be increased if necessary, he said.

Google had been shooting for mid-September for the service's official launch, but it wrapped up its final tests ahead of time. About 1,000 people participated in the service's test phase, he said.

Starting Wednesday, people with Wi-Fi devices will be able to pick up the Google network's signal and sign in with their Google account user ID and password.

Those who don't have a Google account will be able to create one by simply choosing a password and entering an e-mail address. If they don't have an e-mail address, they will be able to create one as well, he said.

Google has no plans to deliver online ads to the network's users and it isn't charging the city anything for building the network. In fact, the city stands to receive payments from Google for the placement of equipment on city-owned light poles, Mountain View officials have said in the past. Moreover, Google will cover maintenance and utility costs.

'We have no business plan for this network,' Sacca said. Google hopes to benefit indirectly by the increased availability of Internet access, and it believes it is contributing to its home city, where more than 1,000 of its employees live, he said.

People should be able to reach the network inside their homes, to some degree. 'Wi-Fi signals are irregular and hard to predict, so coverage varies depending on where you are, how close the node happens to be and what your house is made of,' Sacca said.

Residents can buy inexpensive repeater devices to boost and extend the reception inside their homes, he said.

San Francisco, about 40 miles north of Mountain View, has chosen Google and partner EarthLink to provide municipal Wi-Fi service. The companies have proposed a two-tiered service: EarthLink would offer a paid subscription service with speeds over 1Mbps and Google would offer a 300Kbps service for free. The companies are currently in negotiations with the city on the terms of the agreement.

The free service is expected to include ads, and this has triggered criticism from civil liberties advocates who are concerned that users' privacy may be compromised if ads are targeted based on their location and interests. Meanwhile, others have complained the city isn't allocating funding to help low-income users take advantage of the network.

Tuesday, August 15, 2006

Apple Previews Mac OS X Server Leopard: "Apple today previewed Mac OS X Server version 10.5 Leopard, the next major release of Apple’s award-winning UNIX server operating system. Scheduled to ship in spring 2007, Leopard Server builds on Apple’s legendary ease of use with new Server Assistant and Server Preference features that make it easy for even non-technical users to set up and manage a server with just a few clicks of a mouse.

My MacBook Pro Battery Swelled Up!: "

Wow, we really need to fix our MacBook Pro battery issue before things really get bad. We first reported our troubles with our beloved Mac notebook last week and then the new week started with a replacement program from Apple, direct, explaining our problem. Well, we've been just a wee-bit busy here at SOT and haven't had a chance to fill out that dandy form. Today when we pulled out our MBP from our Swiss…

WWDC06 Disappoints?: "

Where was the aluminum iPod? The glossy MacBook? Tabbed Finder? Windows Virtualization? Didn't Scobel say there was too many surprises to let slip 'cause Jobs would have his head? (Leo said this on Episode 64 of TWiT.) I don't know, I like Time Machine a ton, and the Mac Pro does look hot, but, did this meet the hype? For me? No. I think Wall Street agreed as Apple's stock (AAPL) fell when all the… Windows Virtualization? Didn’t Scobel say there was too many surprises to let slip ‘cause Jobs would have his head? (Leo said this on Episode 64 of TWiT.) I don’t know, I like Time Machine a ton, and the Mac Pro does look hot, but, did this meet the hype? For me? No.

I think Wall Street agreed as Apple’s stock (AAPL) fell when all the guys that dress better than Steve Jobs cast their votes of “unimpressed” after the Cupertino CEO finished his keynote speech from the Moscone Center in San Francisco, Monday morning. Biz Journals had the headline “Apple stock down on no Jobs’ surprises” which Microsoft’s MSN Money site was more than happy to run. The business world wasn’t moved.

In all, the day ended with no bang. No great stunning new gizmo that no one even thought of but rather, everything — for the most part — that everyone anticipated: a PowerMac replacement running Intel chips with some Leopard highlights. That’s it. Wow, is Jobs losing his touch?

Virgin Offers Weird In-Flight Service: Answers: "Virgin Atlantic Airways claims to be offering the first in-flight text messaging service: If you define text messaging as 'sending short emails to somebody at a dedicated service who answers your questions,' then, sure, they're the first, and, I hope, the last. Instant messaging isn't what they're offering; Tenzing, by the way, was the first to offer it in 2003 and 2004, plus low-speed email via proxy. That service was discontinued, but will re-emerge from its descendent merged entity OnAir next year along with cell phone calling in flight. You have to tell me why anyone would pay whatever ridiculous fee Richard Branson--now the world's third greatest billionaire--will demand from passengers to ask, for instance, 'the best way to chat up the cabin crew' according to a Virgin spokeswoman (and isn't that a nice double entrendre on top of that nonsensical query) quoted in this Reuters story....

Another Free Wi-Fi through Advertising Model from Hypewifi: "Don't prejudge them by the word hype in their name: Hypewifi has yet another model of providing users with free Wi-Fi through support from advertising. In their model, a user must answer a few demographic questions which are tied to their profile in order to surf. These demographic questions allow more closely targeted advertising, they say, without exposing a particular user's details. Advertisers can choose to only target those whose profile matches their needs extremely closely. This kind of approach requires a very high volume of users as qualifying users because winnowing down all users to find just the reasonable targets of ads means that an advertising inventory can't be served uniformly. Sell a million ad impressions and you see just 50,000 qualified users come through for a few pages each, and you've got a lot of unsold inventory. (You could have low-rate salvage ads displaying for 'unqualified' users; this is why some sites seem littered with T-shirt ads, for instance. Although let me not mock the billions spent each year on message T-shirts.) Hypewifi looks for locations where users would want free Wi-Fi and where professionals that meet the demographic that they want to offer to advertisers would congregate. The company says that they have 1,000 registered users so far with a soft launch....

Sun edges closer to open-source Java: "Sun has launched a portal site for its Java programming language, part of the company's move to make the Java code open-source. August 15, 2006 (IDG News Service) -- Sun Microsystems Inc. launched a portal site for its Java programming language today as it inches closer to making the Java code open-source, a company executive said.

The Web site details the company's efforts to make open-source the first bits of the Java SE (Standard Edition) implementation, known as the Java Development Kit (JDK), said Simon Phipps, Sun's chief open-source officer. The site is also a forum for input on the best way to take Java to open-source, he said.

"I don't think that I or any of the people in Sun's Java organization know how to take Java and make it into a successful open-source community," Phipps said. "We've got ideas. We're fairly confident that it's possible, but we really need the advice and insight of the existing communities to help us get to that place."

Sun's move is part of a broad company restructuring following the replacement in April of co-founder Scott McNealy with Jonathan Schwartz as CEO. Sun has undertaken several other open-source projects, including its operating system with OpenSolaris and the open-source tools platform NetBeans.

CIO warns many IT workers face dangerous stress: "At the Share conference today, William Cross, CIO of Seminole Electric Cooperative, warned attendees that IT staffers work too much, get too stressed and are endangering their lives. August 15, 2006 (Computerworld) -- BALTIMORE -- When it comes to testing an IT system, William Cross, the CIO of Seminole Electric Cooperative Inc. in Tampa, Fla., uses an approach that his staff describes as "brutal." But it's a system Cross hopes will avoid sleep-disturbing middle-of-the-night production failures -- part of a larger effort to keep his staff from getting stressed out.

"I work very hard to make sure that my staff doesn't work overtime," said Cross, who spoke here today at the Share conference for IBM users. "We go to great lengths to help keep people from being called on nights and weekends."

The reason: People who work in the middle of the night are more prone to mistakes, he said.

Three terabyte desktop network drive ships: "The NAS is Mac OS X, Windows and Unix-compatible. It uses Web browser-based administration. It supports SMB/CIFS, UPnP and Webdisk network services.
he Platinum NAS system uses four individual Serial ATA (SATA) hard disk drive mechanisms, and can support 750GB drives -- for a total combined capacity of 3TB. Each drive can be hot-swapped using a lockable drive tray. The drive is Mac OS X, Windows and Unix-compatible.

The Platinum NAS uses Web browser-based administration. It supports SMB/CIFS, UPnP and Webdisk network services. The Platinum NAS is designed to work from a desktop, rather than a rack system, aimed primarily at small to medium sized businesses (SMBs) looking for fast, redundant network storage capabilities without the added complexity of a full-blown file server.

Sony to help pay for Dell recall: "

(InfoWorld) - Sony Corp. has promised to share the cost of a massive battery recall announced by Dell Inc. Monday after a series of notebook PCs burst into flames.Dell reported to the U.S. Consumer Product Safety Commission that 4.1 million laptops worldwide could catch fire, and recalled the batteries, which were built by Sony.

Asked if Sony would help pay for the cost of the action, a spokesman said, 'We are supporting Dell in many factors of this recall and that is one of them.'

The financial impact on both companies is unclear. Sony would not say how much money was involved, but did say it had also provided the battery cells to other PC manufacturers.

The defect was caused by a short circuit that happens when microscopic metal particles break through the lithium ion cell wall and contact a battery anode, said Sony spokesman Rick Clancy.

'You try to eliminate that in the manufacturing process, but to eliminate them 100 percent is very difficult. Usually when you have a short circuit, it might lead to a battery powering down so you'd have a dead battery, but other times it could lead to incidents including flaming,' Clancy said

The chances of a short circuit depend on the design of each PC, such as whether the battery cells are aligned in parallel or perpendicular, and their proximity to heat sources like the processor and power supply. But ultimately, the odds are against the engineers, since any given particle can create a short, just as any given sperm can make a baby.

'It's kind of like impregnating someone. It only takes one, so the more of them there are, the more likely that you'll impregnate someone,' said Clancy.

Despite the challenge of blocking every particle, the number of short circuits has been very low, Sony insists.

'It's a number you can count on two hands,' Clancy said, adding that it is inconsequential 'when you look at it by Six Sigma standards.' Six Sigma is a measure of engineering quality that ensures a process will not produce more than 3.4 defects per million opportunities.

Faced with the danger of fighting open flames in an office or airplane, many corporate IT managers might not take solace in Sony's assurance. But some analysts agree that the chances of a given laptop catching fire are slim.

'Bully for Dell to come clean and admit it. The incident rate is very, very low. It's a handful and they've got 4 million batteries, so it's not like the Pinto,' said Ted Schadler, vice president for consumer electronics research at Forrester Research Inc. The Pinto was a car sold by Ford Motor Co. with a design defect causing its fuel tank to rupture in rear-end collisions, leading to deadly fires. Ford recalled 1.5 million Pintos in 1978.

Many IT managers now face a choice of whether to embark on an expensive campaign to recall all the notebooks scattered throughout a large company.

'IT departments may not pull out all the stops; it depends on their replacement cycle,' Schadler said. 'If it's an executive cycle of one or two years, they might wait, but if it's three years, they may want to do it sooner.'

Many IT managers will ask Dell for more details, since the recall spans a variety of 10 types of Dell Latitude notebooks, 15 models of Inspiron notebooks, four Precision workstations, and four XPS models.

The engineering specs, form factors and applications used will vary so much between those PCs that some administrators may decide that certain computers have an acceptable amount of risk. After all, Dell was merely following market demand to install power-hungry processors, shave weight off portable PCs, and hold prices down, Schadler said.

'Dell is not known for their engineering prowess, are they? Sony is an engineering company, and Dell is a marketing and sales company.'

But another analyst said the recall could cause havoc in corporate IT departments.

'IT managers need to react quickly to Dell's recall. It is likely to cause headaches for travelers that are asked to rely on AC power while waiting for the battery to ship to them. End users will not be happy,' said Samir Bhavnani, director of research at Current Analysis Inc.

Losing customers' trust would be bad news for Dell, of Round Rock, Texas. The company missed its earnings target for the first quarter and has watched rival Hewlett-Packard Co. catch up fast in market share.

'Dell right now is at a low,' he said. 'It is likely that we will not see a huge impact from the changes Dell is making until the second half of 2007.'

Since reporting its last results, Dell has spent $100 million on customer service and has simplified its process of offering discounts. Investors could learn more about the company's reaction to the recall when Dell reports its next quarterly earnings on Thursday.

(Via InfoWorld.)

Novell feels "passionate" about Linux! Novell Still Alive? WoW! If you ask any Novell Inc. watcher to rate the software vendor's abilities, the chances are that observer will give the company a low grade for marketing. Novell has struggled with how to position its products for years and now hopes it's finally on the right track with a new focus for its Suse Linux distribution.We've underperformed in marketing; I accept that,' said John Dragoon, senior vice president and chief marketing officer at Novell. 'We're going to be a little more focused and more passionate.'

Novell executives provided a general update on Suse Tuesday at the LinuxWorld conference in San Francisco. Suse faces off against rival Red Hat Inc.'s Linux distribution at the server level, but which company will be a major Linux provider on the desktop is up for grabs.

Dragoon hopes Novell's new tagline for Suse, 'Your Linux is ready,' will strike a chord with users concerned about the open-source operating system's performance, reliability, security, usability and support. The vendor released Suse Linux Enterprise Server 10 (SLES 10) and Suse Linux Enterprise Desktop 10 (SLED 10) last month.

Novell's new message about Suse promotes the operating system's ability to run on the desktop to the data center, as well as stressing the role the open-source community plays in contributing to the software. 'Our job as [Suse] custodians is not to screw it up,' Dragoon said. Novell acquired the Linux distribution when it purchased German company Suse in 2003.

Since last month's launch, Novell has seen over 325,000 downloads of the operating system, 175,000 of SLES 10 and 150,000 of SLED 10.

'We know that mindshare is not market share,' Dragoon said, adding that Novell's challenge is to convert the casual downloader into a Suse customer. About 19,000 of 150,000 SLED 10 downloads were by users who registered with Novell, indicating 'some level of seriousness' about Suse, added Jeff Jaffe, executive vice president and chief technology officer of Novell.

'The battle for the Linux desktop has taken many years and will continue to take many years,' Jaffe said. While Novell has had success with desktop Linux as a thin client or powering POS (point-of-sale) systems, the distribution has yet to make much of a dent in the corporate desktop operating systems arena where Microsoft Corp.'s Windows OS dominates. 'For the first time, we have a real alternative to the Windows desktop,' Jaffe said.

Novell will target two groups of desktop users for SLED 10, Jaffe said. The first group is users of engineering desktops like the ThinkPad laptop Lenovo Group Ltd. debuted Tuesday at LinuxWorld and which runs SLED 10, aimed at electronics engineers and chip designers.

The second, much larger group consists of 'corporate knowledge workers' whom he defined as staff typically using five applications -- e-mail, presentation graphics, spreadsheets, word processing and the Web -- at work. What Novell needs to focus on with SLED 10 is ensuring that the distribution runs those five applications well and is interoperable with Microsoft's Active Directory, he said.

For the next six months, Novell wants to encourage companies currently evaluating Microsoft's delayed Vista client operating system, now due out early next year, to pilot SLED 10.

'Find several 100 users and try out our desktop,' Jaffe said. 'If you like it, roll it out; if you don't like it, go back to bloatware and upgrade to Vista.'

Review: Ajax in 10 Minutes: "For Web developers who want to add more interactivity to their Web sites, this book is packed with information. It's well written, but if you're a novice additional programming background is recommended. To learn more, read on... By Lee Underwood. 0623"

The layout of the book, according to the introduction, is "divided into bite-sized lessons, each designed to take no more than about 10 minutes to complete." So it's the lessons that take 10 minutes, not the entire book. Well, that made a bit more sense. I found as I read the book that the lessons were easy to digest, and yes, they took roughly 10 minutes to complete. You would be amazed at the amount of information you can learn in ten minutes when it's put together in a concise format. The book was written by Phil Ballard, a professional Web consultant based in south east England.

Monday, August 14, 2006

Dell to recall 4 million batteries: "Inspiron, Latitude and Precision owners should check to see if they qualify for recall offer."