Google releases iPhone Web app

Google on Wednesday announced the release of a new interface to enable iPhone users to navigate Google's various services through a unified interface.

When iPhone users visit the Google site using the Safari browser on their iPhone, they'll find a navigation bar that lets them switch between Google Search, Gmail, Calendar, Reader and other services.

Google says they're using browser technologies like Asynchronous Javascript and XML (AJAX) to accomplish the feat. iPhone users are redirected to a different URL -- http://www.google.com/m -- when they first visit the site. Users can opt for the new interface or for the "classic" view using a hyperlink on the home page.

Big brands slip up in antivirus tests

Many big-brand security products fail to spot commonly-circulating malware, testing outfit has Virus Bulletin found in its latest tests.

A total of 17 out of 32 of antivirus products failed the company's stringent VB100 test, which expects software to detect 100 percent of the commonly-circulating 'WildList' thrown at it without signalling any false positives.

Programs failing included those from Sophos, Kaspersky, Fortinet, Trend Micro, CA Home, and PC Tools, though within this group detection failures varied widely. CA's Home program scored a disturbingly high 40 misses, while the others scored from 8 misses down to only one miss for Kaspersky. PC Tools' Spyware Doctor detected the WildList suite but failed because it falsely identified two files as malware.

The worst performer on test was the relative unknown, Kingsoft AntiVirus, which missed large numbers of malware types, including 120 examples from the WildList, and over 80 percent of the worms and bots it was tested against.

"It was a shock and a concern to see such a poor performance from so many products in this latest round of testing," said John Hawes of Virus Bulletin.

"It is particularly disappointing to see so many major products missing significant real-world threats. In these days of hourly updates computer users really ought to be able to rely on their chosen security vendors for full protection against known threats."

The tests were run on Windows 2000 using a variety of worms, viruses, bots, and polymorphic malware though the company said it rated the issues as being independent of platform. A program failing to spot a particular piece of malware on one platform would be unlikely to spot it running on another, such as XP, because the detection system would be the same.
"Once the products are up and running, the detection engines should in much operate the same way on all systems - we use the default settings applied by the products," said another company source.

"The main problem here was with some particularly tricky polymorphic viruses listed as 'In the Wild' by the WildList organization, with many products detecting some but not all files infected by the malware. There were also several clean files wrongly labelled as malware. Both these problems will have been repeated on XP, Vista, and probably other platforms too."

Not everyone agrees that the WildList, used by the VB100 tests, is a representative sample of real-world malware. The list excludes certain types of malware such as Trojans, backdoor rootkits. Moves are afoot to come up with a consistent set of tests for such malware based on behavioral characteristics rather than specific signatures.

Microsoft releases new Windows Server, Vista SP1 test code

Microsoft on Wednesday released new test versions of Windows Server 2008 and Windows Vista Service Pack, two highly anticipated technologies that are scheduled to be released early next year.
<A TARGET="_blank" HREF="http://ad.doubleclick.net/click%3Bh=v8/3620/3/0/%2a/g%3B130643729%3B0-0%3B0%3B18236161%3B4252-336/280%3B22315834/22333723/1%3B%3B%7Esscs%3D%3fhttp://www.computerworld.com/action/member.do?command=registerNewsletters&source=housead"><IMG SRC="http://m1.2mdn.net/743328/newslttr_sky_v2.gif" BORDER=0></A>
On this topic
Microsoft to beef up anti-piracy checks in Vista SP1
Vista a year later: Why IT clung to the status quo
Windows Tip: System restores made easy
Get practical tips, IT news, how-tos, and the best in tech humor.

Microsoft also revealed partner resources to prepare customers for the release of the server OS, which the company plans to release to manufacturing on Feb. 27, 2008, the same day as a joint-launch event that also will promote SQL Server 2008 and Visual Studio 2008. Combined, the three mark Microsoft's major product release cycle for the year, although the products are not scheduled to be released simultaneously.

Vista SP1 is expected to be available around the same time, but in a two-part release, the company said on Wednesday. According to a post on the Windows Vista Team Blog, a stand-alone installer will be released to the Web in both x86 and x64 versions for the following languages: English, French, Spanish, German and Japanese. About eight to 12 weeks after this release, all of the remaining Vista languages will be released in both x86 and x64 versions.

Both Windows Server 2008 and Vista SP1 are key releases for the business adoption of the Vista client OS, as many companies have been awaiting the release of both its complementary server OS and first service pack to upgrade their desktops. Windows Server 2008 is an especially important technology for enterprise and business customers, who have been waiting for a major update to the OS for nearly five years.

Windows Server 2008 Release Candidate 1 (RC1), the follow-up to Release Candidate 0 in September, can now be downloaded from Microsoft's Web site. According to the company, more than 1.8 million customers have acquired the evaluation code for Windows Server 2008 to date. Windows Vista Service Pack 1 RC1 is available to users through the Microsoft Connect Web site.

More information about the releases can be found on the Windows Server Division Weblog and on the Windows Vista Experience Blog.

Microsoft also has made changes to its Windows Server 2008 software certification program for partners, creating a "Works with Windows Server 2008" program and offering test tools so ISVs can test their applications to ensure they work reliably on the product. The program and tools are available online. Microsoft ran into trouble with Vista because many third-party software vendors didn't have applications ready for the OS in time, causing compatibility headaches for customers.

Partners whose applications pass the “Works with” tests can then submit test results to be validated for "Certified for Windows Server 2008” status, which has higher technical bars for achievement.

Tech groups call on Congress to extend R&D tax credit

More than 40 trade groups, many representing the IT industry, have renewed their calls for the U.S. Congress to extend a research and development tax credit that expires this month, saying the tax break protects U.S. jobs.

Groups including the Business Software Alliance, the Biotechnology Industry Association, the Information Technology Association of America, and the Information Technology Industry Council (ITI) said the tax credit is a critical piece of U.S. innovation. During a press conference on Wednesday and in a letter to congressional leaders dated Tuesday, the groups pressed Congress to extend the credit, which will expire for the 13th time since 1981 on Dec. 31.

"The credit for us is really a jobs issue," said Jay Timmons, senior vice president for policy at the National Association of Manufacturers. "The bottom line is, it's about keeping high-skilled, high-wage jobs in the United States."

Wednesday's press conference may have created a sense of déjà vu for participants. Every year or two, the tax credit expires or comes close to expiring, and tech, pharmaceutical and manufacturing groups keep calling on Congress to extend the credit, which covers 20 percent of qualified R&D spending.

Several tech groups, including the American Electronics Association (AeA) and ITI, have called on Congress to make the tax permanent, but lawmakers have shied away from the price tag of about US $7

ion a year. Some critics have called the tax credit a government subsidy for large businesses.

On Nov. 9, the U.S. House of Representatives passed a bill, the Temporary Tax Relief Act, that would extend the tax credit until Dec. 31, 2008. But the Senate has not yet acted on the legislation, and some Senate Democrats are pushing for lawmakers to find a way to pay for the cost.

But Senator Orrin Hatch, a Utah Republican, said raising taxes to pay for the credit isn't workable. "It would be ridiculous to have a permanent tax increase for a temporary R&D tax credit," he said at the Wednesday R&D Credit Coalition press conference.

Hatch also called for Congress to reform the R&D tax credit, phasing out the old way of calculating the credit in favor of another model already being used by many companies, called the alternative simplified credit.

Hatch said he's confident the current credit will get extended, but he told trade group members at the press conference not to expect a "miracle" in their efforts to make the tax permanent. "We have to fight for it every year," he said. "It's very hard for companies to do their planning."

Other countries are trying to lure companies away from the U.S. with more generous R&D programs, Timmons said. He held up a recent newspaper advertisement purchased by the Canadian province Ontario, touting its R&D tax incentives to U.S. companies.

The U.S. had the best R&D incentive program for several years, but now has fallen to 17th among the 30 member nations of the Organisation for Economic Co-operation and Development (OECD), press conference participants said.

"If the U.S. does not guarantee similar incentives, we will continue to see R&D activities, innovation and jobs moving offshore," said Christopher Hansen, AeA's president and CEO.

Facebook tweaks Beacon again, Zuckerberg apologizes

Facebook is giving members of its social network the ability to completely decline participating in the company's controversial Beacon ad system, a reaction to intense criticism that Beacon is too intrusive and compromises people's privacy.

The announcement was made in an official blog post by Facebook founder and CEO Mark Zuckerberg on Wednesday morning, in which he also apologized for missteps in the design and deployment of Beacon.

"We've made a lot of mistakes building this feature, but we've made even more with how we've handled them. We simply did a bad job with this release, and I apologize for it," Zuckerberg wrote.

The ability to skip Beacon altogether is the second major modification to the program. Last Thursday, Facebook gave members more control over Beacon and made the way it works clearer so that people could manage it properly.

Beacon, part of the company's new ad platform, tracks certain actions of Facebook users on some external sites, like Blockbuster and Fandango, in order to report those actions back to users' Facebook friends network.

The idea is to generate advertising that is more effective because it is intricately combined with people's social circle, so that products and services are promoted in a more organic way via the actions of friends and family.

More than 40 Web sites have signed up for Beacon, although not all have implemented the system. Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product, signing up for a service and including an item on a wish list.

Still, Zuckerberg's blog posting doesn't directly address the findings of a CA security researcher that have fueled the privacy controversy over Beacon in recent days.

Stefan Berteau found that Beacon tracks users even if they are logged off from the social-networking site and have declined having their activities broadcast to friends.

In this case, users aren't informed that data on their activities at these sites is flowing back to Facebook or given the option to block that information from being transmitted, according to Berteau, senior research engineer at CA's Threat Research Group.

If a user has ever checked the option for Facebook to "remember me" -- which saves the user from having to log on to the site upon every return to it -- Facebook can tie his activities on third-party Beacon sites directly to him, even if he's logged off and has opted out of the broadcast. If he has never chosen this option, the information still flows back to Facebook, although without it being tied to his Facebook ID, according to Berteau.

Moreover, Berteau also found that Beacon doesn't limit its tracking to Facebook members. It actually tracks activities from all users in its third-party partner sites, including from people who have never signed up with Facebook or who have deactivated their accounts.

In those cases, Beacon captures detailed data on what users do on these external partner sites and sends it back to Facebook along with users' IP (Internet Protocol) addresses, although there is no Facebook ID to tie to the data.

The information captured by Beacon in these cases includes the addresses of Web pages visited by the user and a string with the action taken in the partner site, Berteau said.

Facebook's response to Berteau's research has been a brief statement in which it confirms the findings, but says that in the case of logged-off users, deactivated accounts and nonmembers, Facebook deletes the data upon receiving it.

In Wednesday's blog posting, Zuckerberg made an apparent, passing reference to the CA findings.

"If you select that you don't want to share some Beacon actions or if you turn off Beacon, then Facebook won't store those actions even when partners send them to Facebook," he wrote.

That would seem to indicate that Beacon will continue to track users and send data back to Facebook, leaving it up to Facebook to decide which data it keeps and which it deletes.

Facebook didn't immediately reply to a request for comment about Zuckerberg's blog posting.

Novell delays financial results due to SEC inquiry

Novell on Wednesday said it has postponed announcing its fiscal fourth quarter and year-end 2007 results due to a review by the U.S. Securities and Exchange Commission into its accounting practices.

The Linux and open-source company was scheduled to report the results for the quarter and fiscal year ended Oct. 31, 2007, on Wednesday, but now has put them off until the SEC finishes its review. However, Novell does expect to file its Form 10-K for the current fiscal year before its due date of Dec. 31.

Novell said it received a letter from the SEC dated Aug. 7 regarding the company's Form 10-K for the fiscal year ended Oct. 31, 2006, and its Form 10-Q for the quarterly period ended April 30, 2007. The company responded in September but received another letter on Oct. 18 indicating that the SEC had reviewed Novell's first letter and would limit its future response to certain accounting matters.

Novell responded to the SEC's second letter on Nov. 7 and is currently awaiting word from the agency, the company said.

In a news release, Novell CFO Dana Russell said the company is "confident" of its accounting and working "diligently" with the SEC to respond to the agency's inquiries.

Google integrates AIM into Gmail

Google has integrated AOL's popular AIM instant-messaging service into its Gmail Web-based e-mail client, the company announced on Tuesday.

Gmail has had its own chat service since February 2006, but now Gmail users will be able to connect to AIM through a drop-down menu on the Gmail Web page, Google said. Gmail users can sign into AIM through the "set status here" menu, Google said. AIM contacts and Gmail chat will appear on the same menu.

Google said it was rolling out the new feature on the English version of Gmail on Tuesday. AIM access will be available on other language versions of Gmail soon, the company said.

"We're always looking for new and useful ways to help our users connect with friends, family, and coworkers," Google said in a statement.

The ability to connect to AIM through Gmail is a "very big deal," said Michael Osterman, founder of messaging analysis firm Osterman Research. About 75 percent of people who use IM in business settings use AIM or the AIM enterprise product, he said.

Now, when people are using Gmail, they can see if the people they're sending e-mail to are available for live chat on AIM instead, he said. "You've been given another option for communicating with people," he said. "It's one more way to talk to them."

Gmail users can keep a history of chats and e-mails together in so-called conversation threads.

Red Hat aims MRG software at IBM, Tibco

Red Hat on Tuesday unveiled software that combines messaging, real-time and grid capabilities for enterprises that need an OS that can process messages and transactions at lightning speed, such as those in the financial services industry.

Red Hat Enterprise MRG (Messaging, Realtime and Grid), which is expected to be generally available early next year on a subscription basis, is another piece of the company's so-called "automation" strategy for simplifying how applications are deployed and managed in distributed computing environments. The idea behind automation is to make it as easy as possible for an IT administrator to deploy an application anywhere, whether it's hosted or running on a physical server or a virtual environment.

MRG will be available in a public beta by the end of the week. Interested users can register for the beta online.

In a nutshell, MRG is meant to not only do the job of messaging middleware such as IBM's MQSeries or Tibco Software's Tibco, but also extend that with real-time capabilities and task-allocation and power-allocation features. In addition to providing a layer of software on top of the OS for low-latency messaging, MRG also can schedule tasks and provision power for resources running in heterogenous environments, said Bryan Che, a Red Hat product manager.

For example, when Windows desktop computers in an enterprise are idle because people aren't using them, MRG can bring them back into the infrastructure computing pool and use that spare capacity for other tasks. However, this functionality is based on integration of MRG with Intel's vPro desktop-management technology.

Red Hat MRG uses technology from two key projects to deliver an open-source infrastructure. One is a project to develop the Advanced Message Queuing Protocol (AMQP) standard for describing what messages between disparate systems look like and what should be done with them, which is backed by companies such as Cisco, Credit Suisse and JP Morgan Chase.

The other is the Condor high-throughput computing open-source project out of the University of Wisconsin, which provides a way to efficiently allocate and use the computing capacity of an IT system. Red Hat also has teamed with the university to make the Condor source code available under an Open Source Initiative-approved license, and has agreed to jointly fund ongoing development on the project.

William Fellows, a principal analyst at The 451 Group, said it's naive to think people will begin ripping and replacing current messaging infrastructure with Red Hat's new software once it's available. However, MRG does combine several technologies in a unique way for IT environments that need OSs to process transactions in microseconds, he said.

This is especially important to the financial services industry, "where the element of [message] latency provides an opportunity for arbitrage -- that is, people make money because they get to the bit of cheese first," he said. Fellows added that these features can be useful in other enterprise environments as well.

Red Hat probably wanted to introduce its new messaging software ahead of an update to MQSeries, which is imminent, Fellows added.

Verizon hedges on using Android

Verizon Wireless doesn't yet have any solid plans to support Android, Google's forthcoming open-source mobile software, despite reports that the operator had joined the Android club, a company spokeswoman said.

"Verizon has not yet decided whether we will use Android in any of the devices we ourselves offer," said Nancy Stark, a Verizon spokeswoman, in an e-mail on Tuesday.

Her comments sound very different from those made by Verizon Wireless President and CEO Lowell McAdam in a Business Week article that appeared late on Tuesday. In the article, he's quoted as saying that Verizon is planning to use Android.

Verizon announced its new open-access policy last week. It's designed to allow any device that meets the operator's technical standards to use the network and run any software application. Verizon expects some developers to use Android to create devices and applications that could run on Verizon's network as part of the new program, but the company hasn't decided whether it will use the software itself, Stark said. Verizon also hasn't decided yet if it will join the Open Handset Alliance, the group supporting Android, Stark said.

The discrepancy between McAdam's comments and those from the spokeswoman point to the hype and uncertainty around Android, said Jack Gold, an analyst at J. Gold Associates. "I think what we're seeing is people jumping on the hype bandwagon, as people do before something is real and tangible enough to determine what it's going to look like," he said. While the Android software development kit is out, the software itself isn't, so no one really knows if the platform will cause problems for wireless networks or if it will be solid and ultimately bring revenue for operators, he noted.

When Google introduced Android in early November, T-Mobile and Sprint Nextel said they were part of the Open Handset Alliance, in support of Android. AT&T and Verizon were notably absent from the group of supporters.

The hype around Android and moves to open up the wireless market are indicative of a bigger shift in the market away from operators fully controlling access to their networks, Gold said. "What we're seeing is a realization that the wireless market is maturing, that it has to open up, that these carriers are going to find a lot of competition from folks putting up WiMax or other networks, and they can't just sit there like the old days," he said.

Charles Golvin, a Forrester Research analyst, agreed. "All these guys, AT&T included, recognize that just like AOL's closed model was ultimately doomed, the closed model for Internet-based applications for mobile is ultimately doomed, although it's a much slower process to play out," he said. "Even two years ago, Verizon told me they were planning to gradually break down some of the walls of their walled gardens," he said. Verizon's new open policy and a broad acceptance of Android show that the model is changing, Golvin said.

Former Motorola CTO takes the same position at Cisco

Padmasree Warrior, who resigned as Motorola's chief technology officer on Monday, will take on the same job at Cisco Systems, the networking vendor announced Tuesday.

Warrior will become Cisco's first CTO since Charles Giancarlo traded the title for chief development officer in 2005 in a broad management reorganization. Cisco has not disclosed when she will start the new job. Warrior, 47, will report to Chairman and CEO John Chambers.

The move takes Warrior from a struggling maker of consumer and enterprise mobile products to a company that dominates several markets and is rapidly expanding into others. Her departure from Motorola came just days after CEO Ed Zander was replaced amid falling sales and profit. He is set to leave the company at year's end.

At Cisco, Warrior's job will be to further detail the company's technology strategy and to identify new opportunities and the partnerships that may be needed to take advantage of them, Warrior said in an interview Tuesday.

"There is no dearth of opportunity for a company like Cisco to grow into," Warrior said. "One of the first things we will have to work on its prioritizing the opportunities."

Her diverse experience will help in crafting a vision for Cisco, Warrior said. At Motorola, she has held leadership roles in the semiconductor and energy systems groups, and she has also worked in software, services and applications, she said. She has master's degree in chemical engineering from Cornell University and a bachelor's degree from the Indian Institute of Technology. Having come from India will help her deal with the key issues of globalization for identifying talent and developing markets, she said.

In hiring Warrior, Cisco has tapped one of its key rivals for the future of on-demand mobility, said Forrester analyst Chris Silva. Cisco, Motorola and Nortel Networks are at the forefront of this trend, all grappling with the intersection of Wi-Fi, WiMax and cellular infrastructure.

Salesforce offers data sharing for customers

Salesforce.com has introduced new features for its on-demand enterprise software designed to let customers share hosted data among themselves.

Dubbed Salesforce to Salesforce, the new data-integration capabilities cater to Salesforce customers who do business with each other.

Salesforce to Salesforce requires both parties to subscribe to Salesforce.com's services, but the vendor believes it will find success due to the size of its subscriber base -- which will reach 1 million this month, according to the company.

There is a long-standing need for such data sharing, said Bruce Francis, Salesforce.com's vice president of corporate strategy. "Every business depends on partners. ... And you're constantly needing to exchange information with those parties," Francis said.

Francis argued that many businesses still interact through cumbersome means, such as by e-mailing Excel spreadsheets to each other. "That information is out of sync the minute you hit 'send'," he remarked.

Demonstrating the new features, Elay Cohen, senior product line director for Salesforce.com, showed how companies can share CRM-related data, such as sales leads, as well as other types of information, such as job openings. The new tools also have an update function to keep data in sync across companies.

The interface lets users apply privacy settings on shared data "down to the field level," Cohen said.

Cohen said the new tools -- at least conceptually -- have been incubating for a long time: "From the very beginning, our underlying architecture was developed knowing this was going to be released."

The new features are available now and compatible with all Salesforce.com editions, but only Platform, Enterprise and Ultimate edition customers can initiate a data-exchange connection, according to Cohen. Doing so will cost those customers US$1,200 per year for each connection.

Denis Pombriant, managing principal of Beagle Research in Stoughton, Massachusetts, said the new capability "is much more important to business processes than anything application-oriented, per se."

He added that its goal is reminiscent of past efforts by partnering companies to integrate their mainframe computers, but could prove much less expensive.

Orange sells 30,000 iPhones in five days

French mobile phone operator Orange sold 30,000 iPhones in the five days following its Nov. 29 launch, the company said Wednesday.

In comparison, German operator T-Mobile said it sold 10,000 on Nov. 9, the day the phone went on sale there. Apple's U.K. partner O2 said the phone is its fastest-selling ever, but refused to give sales figures.

Some 80 percent of Orange customers bought the iPhone with an "Orange for iPhone" service contract that includes unlimited access to the Internet and the Visual Voicemail service.

Those customers paid €399 (US$585) for their iPhone, the same price T-Mobile charges for its iPhones.

Orange also offers the iPhone for €549 with other types of contract, or €649 without a contract.

About 1,500 were sold without a contract, said Orange spokesman Louis Michel Aymard.

Customers buying an iPhone from Orange for use on another operator's network must pay a €100 unlocking charge, which is waived if they wait for six months from the purchase date. Since an iPhone without a contract is of little use on Orange's network, the majority of those 1,500 customers have probably unlocked their phones, Aymard said.

Orange is now the only one of Apple's network operator partners to sell the iPhone unlocked. It does so to comply with a French law that forbids making the sale of one item conditional on the sale of another.

T-Mobile briefly offered unlocked iPhones for €999 to comply with a temporary court injunction. It had been sued by rival operator Vodafone, which claimed that selling the phone tied to a two-year contract breached Germany's consumer protection laws. On Tuesday, a court in Hamburg rejected Vodafone's complaint, giving T-Mobile the go-ahead to sell the phone bundled with a contract.

Early sales of the iPhone in Europe are dwarfed by its success in the U.S., where Apple and operator partner AT&T sold 270,000 on the first weekend. The U.S. population is almost four times that of Germany, and around five times that of France.

Apple said it took 74 days to sell the first million iPhones following its U.S. launch -- a milestone that it took the iPod two years to reach. But sales of mobile phones far outstrip those of digital audio players like the iPod: Last year, almost 1 billion mobile phones were sold worldwide, 164 million of them in North America and 175 million of them in Western Europe, according to market analyst Gartner.

Ron Paul spam traced to Ukrainian botnet

Ron Paul is not a botmaster.

Security researchers have shut down a network of computers responsible for sending out nearly 200 million spam messages supporting the U.S. presidential candidate last month, and after analyzing the server's software, it's clear that there is no such thing as a Ron Paul botnet, according to Joe Stewart, a senior security researcher with SecureWorks. "It probably wasn't even set up by a Ron Paul supporter," he said. "This whole system has been around since 2004. This [spam] somehow just landed in this underground spam economy."

When spam first surfaced, trumpeting Paul as the winner of a recent Republican presidential debate, the fact that it was being sent via illegally infected machines raised eyebrows. The spam messages have never been directly linked to the Ron Paul campaign, which has denied any involvement in the incident.

The Texas congressman is considered a long-shot contender for the Republican presidential nomination, but he has a strong Internet presence. His videos are popular on YouTube, and Ron Paul fundraisers recently were able to raise more than US$4 million in a 24-hour period.

Stewart published an analysis of the botnet on Tuesday, connecting it to an Eastern European spammer known as "spm," whose company, Elphisoft, sends unsolicited email using a network of about 3,000 infected "botnet" PCs. Stewart believes that spm, and many of the people involved in his operation, are located in the Ukraine.

The botnet server used to manage the Ron Paul spam was located in the U.S. and shut down in mid-November, giving researchers a chance to examine the software on the machine, Stewart explained.

Apparently spm rented out his botnet to a middleman, a spammer calling himself "nenastnyj," who has also sent out messages promoting pornography, online gambling, and male enhancement technology. He probably paid spm between $100 and $1,000 to send out the Ron Paul mailing, Stewart said.

It is nearly impossible to figure out who nenastnyj really is, but Stewart made a few guesses, based on his previous spam jobs stored on the server. "Nenastnyj appears just to be a small-time spammer who doesn't write the spam software," he said. "Basically he just makes money by finding sponsors and then becoming a mailer for them and using someone else's mail service to send it."

This botnet is one of 16 controlled by spm's servers, which use a user-friendly, Web-based application called Reactor Mailer to manage spam mailings. "The interface is pretty slick; it's Web 2.0-enabled," Stewart said. "It shows that they really do view this as a business and they put out a quality product. They are trying to make a lot of money on this."

The spammers used a malicious Trojan horse program called Trojan.Srizbi to take control of computers and link them into the botnet.

PDF approved as international standard in ISO vote

Adobe PDF (Portable Document Format) 1.7 has been approved as an international standard by the International Standards Organization (ISO), according to a company executive.

"Adobe has received word that the ballot for approval of PDF 1.7 to become the ISO 32000 Standard ... has passed by a vote of 13-1," wrote Jim King, a senior principal scientist and PDF architect at Adobe, in a blog post Tuesday.

After announcing its intentions to make PDF a standard in January, Adobe submitted PDF to the ISO's Technical Committee in July. Previously, specialized subsets of PDF -- PDF/Archive and PDF/Exchange -- have been approved as standards by ISO, and other subsets have been proposed as standards. The approval of PDF 1.7 will now serve as an "umbrella" standard that will help unify these different subsets.

The ratification of PDF as an ISO standard means Adobe gives up some control over the development of future versions. Instead of setting the future path of PDF on its own, Adobe will just be one of several parties with a say in how the standard evolves. And that's exactly what King, who was nominated technical editor of the new standard, hopes to see happen.

"The challenging part will be to get people to participate in the next release of the standard. Lots of people want standards but it takes a measurable resource commitment to participate," he wrote.