Wednesday, February 6, 2008

Skype plugs critical cross-zone scripting hole

Skype Ltd. Tuesday patched a critical vulnerability that forced it to dump several features from its VoIP and chat software to prevent attackers from hijacking Windows PCs.
In a security advisory issued Tuesday, Skype said it fixed the underlying flaw publicized by Israeli researcher Aviv Raff nearly three weeks ago. The vulnerability, which Raff called a cross-zone scripting bug, could be exploited with rigged video files that leveraged a security flaw in how Skype rendered HTML.

At root, Raff said, was the fact that Skype, which uses IE's Web control to handle internal and external HTML pages, ran the control in a low-security mode. "Skype is running this Web control in Local Zone ... [and] the HTML pages in a not-locked Local Zone mode," Raff said in mid-January.

After Raff and others posted proof-of-concepts, Skype temporarily plugged the hole by first ditching connections to Dailymotion, one of the Internet-calling service's video-sharing partners. Six days later, it severed the line to Metacafe, another partner, when Raff pointed out an even more serious exploit.

Last week, Raff spotted yet another Skype problem, this time in the SkypeFind command, which lets users recommend businesses to others and write reviews of those businesses. At the time, Raff said if a hacker crafted a review that included a malicious script, any user who viewed the business via the SkypeFind command would have his PC shanghaied.

Raff traced all three cross-zone scripting vulnerabilities to Skype's poor security model, and said a fix was relatively simple. "To lock the Local Zone, they basically need to change one registry value," he said last Thursday.

Skype hinted that it had done just that. "The core vulnerability has been fixed by setting IE control security context to Internet Zone," said the company in Tuesday's security alert. It also claimed that all three of the exploits -- the two related to Dailymotion and Metacafe and the third connected to SkypeFind -- had been quashed by the patched Skype now available for download.

Raff, however, wasn't willing to give it the thumbs up, at least not yet. After seeing the Skype advisory, he had questions that needed answering before he would give the patch a green light. "I'm still waiting for answers from Skype," Raff said in an instant message interview.

Users can download the patched Skype -- Windows version 3.6.0.248 -- from the service's Web site. Existing Skype users can update by using the software's "Check for Updates" command under the Help menu.

Nokia offers N-Gage to some customers

Nokia on Tuesday invited some phone users to start playing with its delayed new N-Gage gaming service and rebranded its video- and photo-sharing service.

The world's largest handset maker has begun branching out to offer services as a way to bolster profits. The services could help produce a new revenue stream in a mobile-phone market that is quickly shifting volume sales to developing markets, where people tend to spend less on mobile phones.

Nokia invited users of its N81 phones to download a prerelease version of the N-Gage application and start buying and using games on their phones. A handful of games and applications are now available to them, said Camilla Pagliaroli, a Nokia spokeswoman.

Nokia hopes that the users will offer feedback so that the company can refine the software and begin offering it for more devices. The company expects to add more games in the coming weeks and will add support for more devices as the software evolves, Pagliaroli said.

N-Gage originally included a stand-alone handheld gaming device developed by Nokia. But the company discontinued the device, promising to launch a new N-Gage platform late last year that would work on regular Nokia phones. That launch had been delayed until now.

This week Nokia also rebranded Twango, the photo- and video-sharing site aimed at mobile users, to be called Share on Ovi. The service is based on one developed by Twango, a company Nokia acquired in July last year.

Share on Ovi becomes the first Ovi-branded service, said Pagliaroli. The service is still in beta but anyone can use it, she said.

Ovi is a Nokia site designed to be a central spot where phone users can visit to access a variety of mobile services. The site already includes Nokia's music download service, available in the U.K.; Nokia's mapping offerings; and N-Gage. Nokia also plans to launch a service there that lets users synch their mobile calendar and contacts information online.

The mobile market is closely watching Nokia's Ovi offerings because the services may compete with those offered by the phone maker's operator customers. They'll also compete with those offered by big names in the computer-based Internet world, such as Google and Yahoo. Those companies are increasingly expanding their services for access by mobile customers.

Why Wi-Fi may be a possible substitute for RFID

Given that many companies already have Wi-Fi networks, Wi-Fi Real Time Location Systems (RTLS) may be a cheaper alternative to some more expensive radio frequency identification (RFID) technology applications, according to one analyst.
That's because businesses have already made the partial investment with Wi-Fi access points that have been previously installed and paid for, said Stan Schatt, vice-president and research director of Oyster Bay, New York-based ABI Research.

And, although the operation would require the deployment of some additional points to reap full coverage, Schatt said that could be still be accomplished at a reasonable price given that the Wi-Fi RTLS standard is an open platform. "RFID readers are proprietary and very, very expensive," he said.

But cost savings isn't the sole benefit. Using Wi-Fi RTLS to manage inventory, for instance, means being able to incorporate that component into the overall network infrastructure, said Schatt. "Instead of having a separate network, you have one single network that you're managing and it's a much more efficient that way."

The benefits can then be extended from inventory to the security access system as well, he added.

But Schatt cautions that Wi-Fi RTLS doesn't lend itself well to all applications as would proprietary RFID. In particular, tracking inventory in an outdoor environment like a port where individual packages as opposed to palettes might be involved would present accuracy issues.

"You're really concerned with getting accuracy within one foot. You can't get within one foot of Wi-Fi RTLS," he said, adding that the technology works by triangulating a location using the closest access point.

Another imperfect application of Wi-Fi RTLS is in wide-open spaces that present a lot of interference like the outdoors or in large warehouses in which the signal would bounce of walls and other objects, said Schatt.

The accuracy of Wi-Fi RTLS technology may improve down the road, but he said that "will be quite a while."

However, he does see Wi-Fi RTLS has being very useful in certain verticals like healthcare. "If you've got a piece of medical equipment, just knowing it's on the third floor in such and such department is pretty much what you need to know," he said.

Schatt said he thinks the technology will catch on among early adopters like healthcare and retail, just as the industry witnessed a similar adoption pattern of Wi-Fi in general. "Eventually it will become a horizontal application," he said.

Major equipment vendors, he added, are beginning to offer Wi-Fi RTLS as a "regular part of their offerings."

But the adoption of Wi-Fi RTLS will be around "green fields", or companies facing the decision of which technology to purchase, said Schatt. Companies with an established proprietary RFID system that's working well won't want to ditch the infrastructure for another. Those businesses with no prior system in place and that have a Wi-Fi network might consider deploying the additional access points required for RTLS.

If faced with the decision, Schatt said IT professionals would likely prefer to take the Wi-Fi RTLS route because the proprietary platform is a locked-in expense from a single source provider.

The issue with having varied technologies, however, is that proprietary RFID and Wi-Fi RTLS technology won't integrate, said Schatt.

While Wi-Fi RTLS has gained popularity in healthcare and fleet management, it still remains a niche application that depends on a business having deployed high-end wireless local area network (WLAN) enterprise equipment, said Gemma Tedesco, Senior Analyst with Scottsdale, Ariz.-based research firm In-Stat.

"Not that many businesses have full wireless local area networks deployments of high-end access points," she said.

In addition, the accuracy of location tracking technology "varies", cautioned Tedesco.

Based on the lukewarm response to research reports issued last year by In-Stat on the topic of Wi-Fi RTLS, the firm inferred the market probably holds limited potential.

New iPhone, iPod touch models double storage

Apple Inc. added new iPhone and iPod touch models to its lineup of phones and music players Tuesday by doubling the maximum amount of storage space in each to 16GB.
The new top-of-the-line iPhone is priced at $499, Apple said. This is the first time since September, when Apple dropped the 4GB iPhone from its sales sheet, that the smart phone family has had multiple models. Apple continues to sell the 8GB iPhone for $399.

The iPod touch -- for all intents and purposes an iPhone that cannot make or take calls -- now sports a 32GB model, also priced at $499, as a third option. Older models, including the $299 8GB and the $399 16GB configurations, remain available.

"This is just a bigger, faster kind of announcement," said Ezra Gottheil, analyst with Technology Business Research Inc., speculating that the timing was in part driven by an attempt to pump iPhone sales during a traditionally slow period. "Mobile phone [sales] aren't as seasonal as iPods, but they are seasonal."

Gottheil said he still expects Apple to make major changes to the iPhone in 2008, adding 3G capability and perhaps even true GPS functionality. "I'd put that around the middle of the year," he said today.

The larger-capacity iPhone and iPod touch are available immediately at Apple's own retail stores, its online outlet and at resellers in the U.S. The upgraded models sell for 499 Euros in Europe and 329 pounds in the U.K.

The new iPhone's price tag is the same as the 4GB model's when the latter debuted in June 2007. Just over two months later, however, Apple CEO Steve Jobs ditched that model and slashed the price of the 8GB smartphone by $200, to $399.

Several users who said that they had recently bought 8GB iPhones asked on Apple's support forum whether they would be allowed to swap their purchase for the larger-sized model. Apple's policy is to accept returns within 14 days, although a 10% restocking fee applies if the iPhone box has been opened.

Other recent customers complained of the bump in storage. "I brought my iPhone about a month ago so I have no way of exchanging my phone," said a user pegged as SimonLee. "But Apple don't [sic] care about that because they just want me to go and buy a new one."

That kind of comment got little love on the forum. "Blah blah blah, go cry somewhere else," said Goshia on the same thread.

"Maybe the solution is to never bring out a new product. Oh, but then you'd complain too," said Simon Taylor. "So Apple, please stop developing new products or improving the ones you have. You are upsetting your customers. They would obviously prefer to use the original Apple II."

Dell suit reveals lucrative trade in domain names

A civil suit filed in Florida by Dell and its Alienware subsidiary is giving insight into the enormous sums of money that can be made by creating Web pages full of advertising links.
In October, Dell sued a group of domain registrars, alleging the companies bought more than 1,100 domain names with trademark-infringing characteristics, such as "dellbatterrogram.com" in order to put advertising links on the pages.

The practice, known as typosquatting, is illegal. It's intended to draw unwitting Web surfers to pages with URLs (uniform resource locators) that are similar to legitimate sites, and then redirect them to other sites. The owners of these Web sites get revenue from advertising referral programs every time a link is clicked.

The defendants -- Belgiumdomains, Capitoldomains, Domaindoorman, Netrian Ventures, iHoldings.com, Juan Pablo Vazquez and 10 unnamed defendants -- deny the claims. Dell contends the businesses, most of which are registered outside the U.S., are shell companies engaged in collusion.

Dell sought a court order in November to freeze their assets so the money from their operations wouldn't disappear. Last month, the court amended the freeze order, and contained in the details of the new order are clues to just how much money the defendants may be raking in.

Google, whose AdSense advertising-placement program was used to monetize the domains, was ordered to hold in a special account the first US$1 million collected on behalf of the defendants each month. The second $1 million that accrues in the account every month will be given to the defendants. If more than $2 million accrues in one month, the money is split between the defendants and the Google account.

Google takes a cut of AdSense revenue, which shows that it in part benefits from this kind of abuse of the Internet. However, Google recently announced it will not allow AdSense campaigns on "kited" domains.

Kiting is a technique used by some rogue registrars to avoid having to pay the fee for using a domain. The domain is repeatedly registered and unregistered within a five-day Add-Grace Period. The grace period, which applies to a handful of TLDs (Top Level Domains) was intended to let people get a refund of their domain registration fee if they made a spelling mistake.

Kiting often goes hand in hand with another abusive practice, "domain tasting." A domain name is registered and monitored during the grace period to see if it gets sufficient traffic to pay for its registration fee. The domain owners then get refunds on the sites with low traffic. However, the Internet Corporation for Assigned Names and Numbers (ICANN) is considering keeping a $0.20 fee it normally refunds as part of the registration process in order to stop tasting.

Dell has accused the typosquatter defendants in its lawsuit of both practices and is claiming their profits as well as $100,000 per infringing domain used.

Google's antikiting policy doesn't apply to domain tasting, meaning the company will still potentially benefit from Web sites intended merely for advertising. A Google spokesman said Tuesday, however, that Web sites are supposed to have legitimate content in order to be accepted into AdSense.

Other information in the court documents shed light on the economics of monetizing domain names. Dell contends the defendants control some 1 million domain names, and believes they also have used at least 64 million other unique domain names.

When the court froze the defendants' assets in November, it also froze their ability to stop renewing domain names that weren't producing enough revenue to justify the registration fees. Since the defendants controlled so many domain names, the automatic renewal of those names -- likely around 3,000 domains a day -- cost them $20,000 per day.

However, the defendants successfully petitioned the court to cancel domains that were generating less than $8 a year in revenue.

"These [figures] tell us that there's lots of money in tasting, and it's a game of huge volume," wrote John Levine, a consultant and author of "The Internet for Dummies" on his blog.

The Dell case continues in U.S. District Court for the Southern District of Florida.

FCC approves sale of nationwide spectrum to AT&T

The Federal Communications Commission has approved the purchase by AT&T of 12MHz of wireless spectrum that covers 60 percent of the U.S.
AT&T bought the spectrum from Aloha Spectrum Holdings. The spectrum, in the highly coveted 700MHz band, covers 196 million of the 303 million U.S. residents and includes 72 of the top 100 media markets in the country. Aloha acquired the spectrum in earlier FCC auctions and from other auction winners. This portion of the 700MHz spectrum is not part of the FCC auction now in progress.

The FCC, in an order issued Monday, approved the sale despite concerns expressed by the commission's two Democratic members. AT&T announced in October that it intended to buy the spectrum for US$2.5 billion. The company said then it planned to use the spectrum for broadcast video or for two-way communications such as voice, data or multicast content.

The 700MHz spectrum band carries wireless signals three to four times farther than some higher spectrum bands, making it optimal for long-range broadband networks.

Commissioner Jonathan Adelstein said he voted to approve the deal because of a lack of public opposition, but he had concerns about the FCC's review of the deal.

The agency's review "lacks both substance and analysis in its review of whether, on balance, the transaction serves the public's interest," Adelstein said in a statement. "We are required to do more than simply conclude that a transaction benefits the public and will not have an adverse effect on competition. I would have preferred to see a more thorough assessment weighing the potential public interest harms and benefits of this transaction and its impact on the mobile telephony market."

Commissioner Michael Copps voted against the deal. The deal could have a large impact on a mobile voice and data market "that has seen round after round of consolidation in recent years," he said in a statement.

Copps also raised concerns about the FCC's review of the deal. The review "contains only an extremely abbreviated analysis of the competitive effects of this change in ownership," he said.

AT&T, in a statement, said it was pleased with the FCC's decision. The deal will help AT&T meet growing customer demand for wireless services, the company said.

Dell announces first arrays from EqualLogic acquisition

Acting immediately on its recent EqualLogic acquisition, Dell on Monday announced a new line of network storage products that the company claims are easy to install and manage.
Targeted at small to medium businesses, the Dell EqualLogic PS5000 Series of arrays includes controllers, disks and chassis with 16-bay enclosures that are scalable to store up to 192T bytes of data and execute up to 60,000 transactions at once, said Brad Anderson, senior vice president of Dell's business product group, at an event in San Francisco.

The product can be plugged into existing IT infrastructure and be up and running rapidly, in some cases under an hour, Anderson said. It is also compatible with existing EqualLogic systems.

The arrays operate over a SAN (storage area network) using the iSCSI (Internet Small Computer System Interface) interconnect protocol to transfer data and manage networked storage.

Because storage disks can be attached on the fly, system administrators don't have to plan the amount of storage needed, saving money and resources in the long run, said Praveen Asthana, director of enterprise storage at Dell.

On installation, software that comes with the arrays senses network topology, conducts a system health check and ensures that components are fully functional before serving up storage on a network. Software included with the array manages virtualized storage environments to provide optimized performance, including load balancing by shifting storage loads between arrays and by provisioning data to prevent poor utilization of disks.

With remote replication capabilities over IP (Internet Protocol) networks, the software enables continuous access to data, protecting potential data loss from disaster or system failures, Anderson said.

Few SMBs have storage specialists on staff to set up and manage storage, so it makes sense for them to adopt iSCSI arrays to consolidate disparate storage environments that users can dip into for data access, said Mike Karp, senior analyst at Enterprise Management Associates. Familiar technologies like IP communication and the iSCSI interconnect protocol make iSCSI SAN products easy to install and operate, Karp said.

In addition, the arrays make it easier for users to squeeze maximum value from network storage, he said.

The initial products will come in three models. The EqualLogic PS5000E iSCSI Array supports up to 16 SATA (Serial Advanced Technology Attachment) II drives with up to 1T byte of storage per drive. The Dell EqualLogic PS5000XV and EqualLogic PS5000X iSCSI arrays support up to 16 SAS (serial-attached SCSI) drives with varying storage capacities.

Pricing for the storage devices begins at US$19,000, which includes the management software, Dell said. They are available immediately through channel partners.

The new arrays come just five days after Dell completed the $1.4 billion acquisition of network storage vendor EqualLogic. The acquisition was part of Dell's new strategy to expand hardware and IT services to large enterprises and SMBs.

EqualLogic has offered solid iSCSI arrays with virtualization management capabilities in the past and the new product is no different, Karp said. With Dell, EqualLogic products will be largely distributed -- though it may take a few months until Dell's staff is fully trained to support the products.

Dell is already offering iSCSI-based storage products to SMBs through its partnership with EMC. It is a good revenue stream for Dell, and the company will not turn it off to exclusively sell EqualLogic products, Karp said. Dell will find a balance to sell both products, he said.

Microsoft-Yahoo deal: What about developers?

While observers believe that Microsoft is willing to pay Yahoo $44 billion primarily for its users and advertising base, Microsoft's chief software architect, Ray Ozzie, wants to grow its developer community as well.
"We respect the work Yahoo has done in the realm of creating an open development platform through its Yahoo Developer network and look forward to extending this great work to an even broader base of developers," he said during a press conference discussing Microsoft's offer on Friday.

The question now is how that process would unfold. Yahoo's approach to development has indeed emphasized open source. In contrast, Microsoft has a deep investment in its proprietary .NET programming framework and Visual Studio IDE (integrated development environment). It only recently began making some overtures to the open-source community.

But Microsoft also boasts a vast army of loyal developers -- something that Yahoo can't necessarily claim, although it does maintain the Yahoo Developer Network. And a Yahoo purchase clearly ties into its emerging "software-plus-services" strategy for distributing online applications.

This may be a case where the pieces fit to form a serendipitous whole, according to one observer.

"Yahoo has the most beautiful set of [application programming interfaces] in its properties," such as for the Flickr photo-sharing site, said James Governor, an analyst with Redmonk. "But frankly, it just has not done a great job of building an ecosystem. ... There's no such thing as a 'Yahoo developer.'"

Yahoo's tools hold promise, but really need a high-profile evangelist pushing hard behind them, Governor argued. "The first thing I would do in taking over the company would be to get someone who really understands APIs ... to me, Jon Udell -- who is now at Microsoft -- would be ideal in this role. He would be someone I would be thinking of right away," he said.

While Yahoo's APIs arguably are more consumer-oriented, they could still hold value within the average corporate shop, Governor said. "There's no reason why Flickr can't have some enterprise applicability. ... For the enterprise developer it's probably not the biggest thing in the world, but it definitely offers some cool new things."

But other observers said there are obstacles as well as opportunities.

John Gruber, who writes about the Web and Apple at his site, daringfireball.net, sees a major architectural clash between Microsoft and Yahoo, which has an infrastructure that incorporates Linux.

"I don't think Microsoft has ever bought -- and maintained -- a significant software product that wasn't written against Microsoft technology," he wrote on his blog. "So there's a paradox: Technically, I can't see how Microsoft would migrate all of Yahoo to Windows servers and software. But culturally, it just isn't in Microsoft's DNA to accept and maintain all of these PHP/FreeBSD/Linux products."

Robert McLaws, a .NET developer and blogger at windows-now.com, questioned the overall wisdom of the acquisition attempt, given this inconsistency. "If one of the points in buying them is their infrastructure, but their infrastructure isn't Windows, what are they buying?" he said in an interview on Monday.

Yet there's no doubt that Microsoft would move to merge its tools and assets with Yahoo's, according to Greg DeMichillie, an analyst with Directions on Microsoft and a contributor to the initial design of the .NET Framework. "Anything Microsoft does, they think about it from a platform perspective," he said.

The final shape of that platform is far from clear, as there are substantial redundancies between the companies' services offerings. (Purely on the development front, Yahoo and Microsoft are competing within the mashup market, with their Pipes and Popfly toolsets, respectively.)

For developers already wedded to the Microsoft platform, the major pitfall is the "corporate indigestion" that could follow a deal, according to DeMichillie.

"The biggest risk to developers is that it defocuses executives from the important job of getting a Vista successor out," he said.

A Microsoft spokesperson said Monday that the company would not comment beyond materials on its Web site announcing the proposed deal.

MySpace readies developer Web site

MySpace will open the doors of its developer Web site on Tuesday and make available there the necessary tools to build applications for the world's most popular social-networking site.

Developers will have about one month to familiarize themselves with the development tools and create and test applications before MySpace begins letting its members install them early in March.

"Developers will be able to build applications, but they'll be in the sandbox environment where consumers won't be able to see them," said Kyle Brinkman, vice president and general manager of Platform for MySpace.

With the opening of the developer Web site, MySpace gets closer to catching up to its main rival, Facebook, which opened its platform to external developers in May.

For Facebook, despite some bumps along the way, opening its platform has been overwhelmingly positive. More than 14,000 applications have been created for the site, which in turn has increased its attractiveness to current and potential members.

MySpace isn't alone in following Facebook's lead, as most major social-networking site operators have decided to open their platforms to external developers as well.

In addition to the individual developer platforms, Google unveiled in November its OpenSocial project, which aims to provide a set of common APIs (application programming interfaces) for social-networking operators to adopt, so that applications built with those APIs will work across multiple sites.

To make sure that the applications are safe to use, MySpace will test all of them before making them available to its members, Brinkman said.

Developers will be able to generate revenue from their applications by placing advertising on their applications' "canvas" pages, where members manage the applications they install. Developers will get to keep 100 percent of the advertising revenue generated on canvas pages, Brinkman said.

Developers can choose to run ads from third-party ad providers as long as the ads conform to MySpace policies, such as not containing pornographic content. Moreover, MySpace will let developers run ads from two new ad services that it is beta testing and that it plans to launch at a later date called HyperTargeting and SelfServe, Brinkman said.

In addition to the canvas page, applications will also be featured on their own profile pages, where developers will be able to explain in detail what each application does and how it works. Moreover, there will be a gallery where the applications will be listed. Of course, the applications will also appear on the profiles of members who install them and on members' MySpace home pages.

MySpace will make available three types of APIs to developers: Google's OpenSocial APIs with MySpace extensions for building applications in JavaScript and HTML; ActionScript to build Flash applications; and Representational State Transfer (REST) APIs for applications that require server-to-server connections.

Applications will be able to make use of data on MySpace profiles, but they will be governed by existing privacy controls that apply to members.

The MySpace Developer Platform site will also include documentation, sample code and discussion forums.

Also on Tuesday, MySpace will launch a blog geared toward developers, where MySpace staffers will post relevant information and news about the program.

eBay sellers split on changes

The significant changes that eBay announced last week have merchants abuzz as they analyze and react to the impact that the restructured fees, modification of the search and feedback functions, and other changes will have on their sales and profits.
Of particular interest have been the proposed changes to fees, which involve lowering the cost of listing items and increasing the commission eBay gets when products are sold. There has also been much discussion in blogs and discussion forums of eBay's plan to forbid sellers from leaving negative feedback for buyers.

While merchants are split on the potential benefits and disadvantages of the changes, there seems to be a general consensus that, whether one supports them or not, the changes represent a major attempt on eBay's part to alter the way that the marketplace works.

"It's clear eBay is taking it really seriously that they have to improve the buyer experience, and they're laying the groundwork for getting aggressive about doing it," said Jonathan Garriss, executive director of the Professional eBay Sellers Alliance (PESA), a group of large sellers that has often been highly critical of eBay.

Garriss, also CEO of Gotham City Online, an apparel store on eBay that also has its own site, hopes that the proposed changes will be a first step of others that eBay will take to fix what PESA considers key problems with the marketplace, such as making the buyer experience more convenient and streamlined.

To that end, Garriss is encouraged by the proposed incentives to reward merchants who provide superior customer service by giving all qualifying merchants preferred placement in search engine results and offering PowerSellers additional fee discounts based on their customer ratings.

"We don't want to lose sight of the health of the marketplace, and the changes eBay is making are absolutely in the right direction," Garriss said in a phone interview.

While he supports the concept of lowering insertion fees and shifting them to the commission, he recognizes that, as proposed, the fee restructuring will greatly hurt some merchants, particularly, in his view, those that sell lower-priced items in high volume via auctions. Garriss hopes that eBay will take this into consideration and possibly adjust the fee changes before rolling them out in a few weeks in the U.S.

Lisa Witt, an eBay PowerSeller for eight years, says the fee changes will not have much of an impact on her bottom line. A seller of fine jewelry, Witt says the listing fees will remain too high even under the new fee structure.

"They need to dramatically change the fee structure if they expect seller growth on the site. eBay should have a flat rate listing fee and it should be the same amount across the board for everyone, and that listing fee should be low," she wrote in an e-mail interview. "A monthly fee for unlimited listings on eBay would work well too."

Witt is against the plan to forbid sellers from leaving negative feedback about buyers. This change may lead to buyers using the threat of negative feedback as an extortion tactic to get extras, she said. Buyers may also be disinclined to contact sellers if a disagreement arises, resorting simply to leaving negative feedback, she added. "Feedback is voluntary and should be able to be left by either party as they see fit," Witt said.

Meanwhile, John Lawson, another PowerSeller and owner of 3rd Power Outlet, is generally positive about the proposed changes. "There'll be some bumpy roads, but they're on a path to make this marketplace more vibrant," Lawson said in a phone interview.

3rd Power Outlet, which sells urban wear and accessories and makes about 80 percent of its sales via eBay, will save about 50 percent in listing fees and, factoring in the increased commission, will have net savings in eBay costs of about 30 percent, Lawson said.

"It'll have a nice impact on our eBay costs. It's extra money in our pockets," Lawson said. While not a major windfall, the savings will allow him to add more listings and do more auctions, he said.

Forbidding sellers from leaving negative feedback about buyers is a good move because, as eBay officials have argued, some sellers have used negative feedback to retaliate against buyers, he said. "A seller doesn't have to leave any comment about buyers at all," Lawson said. "The buyer has to be satisfied and must have the ability to leave a true comment."

Still, he's not crazy about new proposed fee discounts to PowerSellers based on them attaining certain levels of DSR (Detailed Seller Rating). For example, he finds that it's off the mark for eBay to have a specific DSR category for shipping and handling, because, as a rule, no one likes to pay for this portion of the transaction. Merchants like himself, who sell to buyers overseas, are in particular disadvantage, because many buyers abroad don't have a clear understanding of shipping costs from the U.S. to international locations, he said.

For others like Witt, DSR-based fee discounts are welcome. "It's fine to offer incentives to sellers who strive for excellence. That was a good idea and they should expand on it. Offering rewards has always worked better than punishments," she said.

These and other differing viewpoints about the plans reflect the ripple effect that eBay changes inevitably have, since there is such a wide variety of merchants on its platform. It remains to be seen whether eBay will want, and be able to refine further, its planned changes to achieve -- as much as possible -- a happy medium across its vast community of sellers.

HP user groups plan merger to increase clout, lower costs

Three independent Hewlett-Packard user groups said Monday that they plan to merge into a single organization with more than 50,000 members in an effort to increase training opportunities and their clout with the IT vendor.

The groups also hope to reduce costs while using their combined resources to reach younger users of Hewlett-Packard Co.'s technologies through social networks and other Web 2.0 tools.

The planned merger involves Encompass, which originated as a group for users of the former Digital Equipment Corp.; HP-Interex EMEA, a Brussels-based surviving affiliate of Interex, a U.S. group that folded in 2005; and ITUG, which represents HP's NonStop user community.

ITUG stands for the International Tandem User Group, Tandem Computers Inc. being the original developer of the NonStop systems line, which HP acquired along with the remnants of Digital when it bought Compaq Computer Corp. in 2002.

Encompass and ITUG, which are both based in Chicago, have about 16,000 and 2,500 members, respectively, while HP-Interex EMEA has 33,000. The planned merger has been approved by the boards of the three user groups but still requires the approval of their memberships.

Officials from the groups said that they expect to have the new organization in place by HP's annual technical conference, which is scheduled for June in Las Vegas. Among the things still to be determined is a name for the combined group; for now, it's being referred to by the code name Endeavor.

"It's more than a merger -- it's creating a new organization, and the new organization is targeting the needs of a larger community," said Scott Healy, ITUG's chairman. Healy, who is vice president of industry solutions at GoldenGate Software Inc. in San Francisco, said that ITUG "will stay a strong community within the larger group."

But he added that many of ITUG's members are also responsible for systems other than NonStop machines, and that the merger of the user groups will help them gain access to a broader base of peers as well as more training programs.

Another goal for the combined user group is to grow membership overall, especially among a younger demographic, said Nina Buik, president of Encompass. It plans do that through the use of technologies such as podcasts and social networking tools, Buik added. To remain relevant and viable, "it's important that we grow," she said.

Buik, who works as a senior vice president at MindIQ Corp., an IT training firm in Norcross, Ga., indicated that the merger should also help with costs. "We are all basically paying for the same type of infrastructure," she said.

One HP user group that isn't involved in the planned merger is Vivit, a Boulder, Col.-based group that formerly was known as OpenView Forum International. Buik said Vivit, which focuses on OpenView and other HP software products, was asked if it was interested in joining the other three groups.

Vivit officials weren't immediately available for comment.

The merger would continue a consolidation of HP's user groups, following on the shutdown of the U.S. chapter of Interex three years ago. Interex, which was oriented around the HP e3000 minicomputer line and claimed more than 100,000 members at one point, closed its doors and filed for bankruptcy protection after HP announced plans to begin holding its own annual conference.

Prior to that, Interex had been getting a major share of the income that funded its operations from its own HP World conference. But the HP Technology Forum & Expo competed directly with the Interex event for attendees as well as trade-show booth bookings from technology vendors.