Sunday, February 24, 2008

Microsoft accidentally leaks SP1

On Thursday, some Windows Vista users began finding Service Pack 1 in Windows Update, even though the upgrade isn't supposed to be available broadly until the middle of March.
Microsoft acknowledged the error. "Yesterday, a build of SP1 was posted to Windows Update and it was inadvertently made available to a broad group. The build was intended only for our more technically advanced testers, and was meant to only be offered to those with a specific registry key set on their PC," Microsoft said in a statement. It also reiterated plans to make SP1 broadly available in mid-March.

Some customers on a Windows Vista forum reported that they successfully downloaded SP1 from Windows Update, but most others said that the download didn't work for them.

The accidental posting to Windows Update follows another recent issue with an update designed as a prerequisite for downloading SP1. Some users, after trying to install the update, got stuck in a reboot cycle. Earlier this week, Microsoft posted a fix for that problem.

Microsoft issued a second refresh of SP1 to beta users in late January, raising hopes that the final version would be out within a couple of weeks. The company had long said that SP1 would come out in the first quarter.

The final broad release of SP1 could boost Vista sales, particularly among enterprise users, because some companies have said that they are waiting for SP1 before upgrading to Vista.

EA offers $2 billion for Grand Theft Auto publisher

Take-Two Interactive Software, publishers of the popular Grand Theft Auto series of games, has received and rejected a US$2 billion acquisition bid from Electronic Arts but left the door open to a possible acquisition later.
The EA bid, which wasn't made public until shortly before Take-Two announced its rejection Sunday, offered $26 cash per share for Take-Two. At the time the bid was made on Feb. 19, the price represented a 64 percent premium on Take-Two's Feb. 15 closing price of $15.83. It is currently a 49 percent premium on Take-Two's Friday closing price.

In its rejection the board of Take-Two said it judged the bid to be "inadequate in multiple respects."

"Electronic Arts' proposal provides insufficient value to our shareholders and comes at absolutely the wrong time given the crucial initiatives underway at the company," Take-Two Chairman Strauss Zelnick said in a statement.

Take-Two is scheduled to release the latest installment in the popular Grand Theft Auto series, "Grand Theft Auto IV," on April 29. The release of "GTA IV" was slated for October last year, but was delayed in order to give the development team more time for certain game elements. The series has sold more than 65 million copies to date, and the company said that it wants to hold-off on talks with EA until after that game hits the market. Therefore it proposed to start talks on April 30.

EA had originally told Take-Two the offer was subject to Take-Two agreeing to start talks by Feb. 22, but it noted Sunday that it would hold the offer open "for the present time" in the hope that discussions can begin.

In an open letter to investors CEO John Riccitiello wrote EA believes its offer is a good one for Take-Two shareholders. He said Take-Two's future is uncertain and that "there is a strong likelihood that the company will be sold in the not-too-distant future."

"So, that's it. We've made a proposal to buy Take-Two. Our preference is to make this a friendly transaction and I'm hopeful we can achieve that. We've sent this proposal in the genuine belief that combining EA and Take-Two would be good for the people who make games and good for the people who play them," he wrote.

Goolag makes Google Hacking a snap

The hacking group Cult of the Dead Cow has released a tool that should make Google hacking a little easier for novices.
Called Goolag, the open-source software lets hackers use the Google search engine to scan Web sites for vulnerabilities.

This is something that hackers have been doing for years, but it can be tricky work -- involving custom scripts and tools that sift through the mountain of data available via Google.

The Cult of the Dead Cow is best known for creating the Back Orifice software 10 years ago, which could be used to remotely control a Windows machine.

Like Back Orifice, the software could be used by both legitimate security professionals and criminals. Goolag comes with an easy-to-use graphical interface. It is based on techniques developed by Computer Sciences Corp. researcher Johnny Long, a well-known computer hacker who has spent years documenting the way that Google's search engine can be used to uncover security vulnerabilities in the Web sites it indexes.

In a statement, The Cult of the Dead Cow said that the software is "one more tool for Web site owners to patch up their online properties."

"It's no big secret that the Web is the platform," the statement said. "And this platform pretty much sucks from a security perspective."

There are already free Web vulnerability search tools available -- such as the Wikto scanning software -- but the Cult of the Dead Cow's notoriety will probably help make Goolag popular, security experts said Friday.

"I don't think it's particularly new, but maybe it makes [Google hacking] more accessible," said Robert Hansen, CEO of Sectheory.com and author of the Ha.ckers.org Web security blog.

"It is interesting because it could theoretically represent a lower burden of entry for the novice Google hacker," he added.

Amichai Shulman, chief technology officer with security vendor Imperva, agreed that there are still far too many security vulnerabilities on Web sites. "Maybe the headlines that this release is getting will serve as a wake-up call for application owners," he said.

Microsoft letter hopeful, vague on Yahoo deal

In a letter to employees, Microsoft put an upbeat spin on its attempt to take over Yahoo.
While noting that no acquisition agreement is in place, Kevin Johnson, president of Microsoft's platforms and services division, wrote that he expects such a transaction to close in the second half of this year. "If and when Yahoo! agrees to proceed with the proposed transaction, we will go through the process to receive regulatory approval, and expect that this transaction will close in the 2nd half of calendar year 2008," he wrote.

Microsoft made its US$44.6 billion offer for Yahoo on Feb. 1. More than a week later, Yahoo rejected the bid as too low. Microsoft maintains that the offer is fair.

Johnson addressed some of the most pressing questions surrounding the potential acquisition in the letter, which Microsoft distributed to the media, but answered few of them definitively.

Acknowledging that there would likely be overlap in terms of staffing, he also noted that Microsoft has hired more than 20,000 people since 2005. "We have no shortage of business and technical opportunities, and we need great people to focus on them," he said. Microsoft would retain locations in both Silicon Valley and Redmond if the deal went through, he said.

He didn't shed any more light on the fate of either company's brands. "It is premature to say which aspects of the brands and technologies we would use in our combined offerings," he said.

Johnson also revealed little about how Microsoft would handle Yahoo's wide use of open-source software in its systems, an issue that some industry watchers have wondered about. Yahoo often uses open-source software in its back-end systems, while Microsoft prefers its own proprietary software. In the past, after acquisitions, Microsoft has sometimes migrated systems to its own software and in other cases maintained the existing software, Johnson said. "Yahoo! has made significant investments in both its skills and technologies, so we would work closely with Yahoo! engineers to make pragmatic platform and integration methodology decisions as appropriate, prioritizing above all how those decisions would impact customers," he said.

Johnson indicated that the process of integrating the companies would be critical to a combination's success. He pointed to recent Microsoft acquisitions, including aQuantive and Tellme, as examples of successful integrations.

Earlier this week, The New York Times reported that Microsoft planned to soon launch a proxy fight to replace Yahoo's board and force the takeover in a hostile bid. Neither company confirmed that report.

Johnson reiterated Microsoft's belief that a combination of the two companies would create a "more compelling alternative in search and online advertising," something that major media companies are looking for, he said.

Motorola finds new counter for shrinking pile of beans

Motorola President and CEO Greg Brown added another piece to the company's new management team on Friday with the announcement that Paul Liska will become executive vice president and chief financial officer.
Liska, who has been a partner in several private equity firms and played financial and general executive roles in transportation, publishing and retail companies, will take over Motorola's finances on March 1. Tom Meredith, who has been acting CFO since last year, will remain on Motorola's board and help Liska with the transition, the company said in a statement. It praised Meredith for cost-cutting efforts.

Motorola's last permanent CFO, David Devonshire, resigned last March. The company had run into rough waters after it failed to come up with a popular successor to the slim Razr clamshell phone. Former President and CEO Ed Zander handed those two jobs over to Brown in November, though he remains chairman until the next Motorola shareholder meeting in May.

Since Brown took Zander's place, Chief Technology Officer Padmasree Warrior has also left, and the company has said it might spin off its handset business.

Motorola has fallen behind both Nokia and Samsung in the hotly contested mobile-phone market, but its handset division still brought in US$4.8 billion of the company's US$9.6 billion revenue in the fourth quarter of last year. The company as a whole saw revenue fall from $11.8 billion a year earlier and earnings per share drop to $0.04 from $0.25.

Developers: OpenSocial OK, but needs tuning

Google's OpenSocial initiative to simplify the creation and adaptation of applications for social-networking sites pursues a valuable goal, but its technology platform needs further improvement.
That's the consensus from several developers who have been testing the OpenSocial APIs (application programming interfaces) and the OpenSocial implementations, or "containers," of participating Web sites.

However, the technical bumps they have encountered, while annoying and frustrating, haven't prompted them to give up on OpenSocial. Instead, the developers remain hopeful that the project, announced almost four months ago, will continue to mature.

Chris McCormick, a games industry contractor based in Australia, has encountered "a few rough edges" when working with OpenSocial, especially bugs in the partner sites' containers, but is "pretty satisfied" with the project.

"The API is intelligently designed and seems to cover all bases quite comprehensively. It should be possible to do some really fun stuff with it," McCormick said via e-mail.

Meanwhile, Aakash Bapna, an information sciences student in Bangalore, has also run into technical issues. "Bugs, bugs and lots of bugs. There are lots of issues with OpenSocial specs as they are launched. You can't tell when your smoothly working application can break," he said via e-mail.

For Bapna, a big hole is the unavailability of the server-side REST (Representational State Transfer) API, which will allow applications to tap servers, something that Thiago Santos, a Brazilian developer of an upcoming application called Partyeah, also misses.

Like McCormick, Santos also has encountered many bugs in partner site containers. Santos would also like Google to do a better job of communicating changes and updates to OpenSocial components. Still, he's confident OpenSocial will get over its growing pains eventually. "I have no doubt that [OpenSocial's promise] will be fulfilled," Santos said via e-mail.

That promise is to establish a standard application-development platform for social applications so developers don't have to remake an application for each social-networking site. While Facebook hasn't signed up for OpenSocial, other big social-networking sites have, like MySpace, Bebo and LinkedIn, as well as major enterprise software players like Oracle and Salesforce.com, which see emergence of social features within business applications.

With OpenSocial, developers will be able to build the core portions of social applications and then adapt them if necessary, with, they hope, minor tweaks and changes for specific sites.

"It's not 'write once, run everywhere.' It's more 'learn once and write everywhere.' You learn the OpenSocial model once. For most applications there will be a core of code that's common to all platforms," said Patrick Chanezon, developer advocate at Google.

Then it's likely that participating Web sites will make available to developers additional extensions in their OpenSocial containers, allowing developers to take advantage of specific features in their sites that aren't included in the standard, Chanezon said.

Developers don't seem worried that OpenSocial will splinter if partner sites add too many proprietary functions to their containers. "I think it should be reasonably easy to write apps that run on all social-networking sites that support OpenSocial without much modification," McCormick said. "The core of OpenSocial contains the most important parts of the social-networking experience ... Anything which does end up adding something drastically new and wonderful will more than likely become part of the standard anyway."

Regarding the technical bumps, Google was clear that the first version of the OpenSocial APIs, labeled 0.5, was far from final, and that it was putting it out in the market in order to get feedback from developers. Now, with version 0.7, Google says that developers can create production applications. Moreover, OpenSocial's technology will continue to improve. "If it turns out this round of OpenSocial provides good applications and we want to get to stellar applications, we'll enhance it," said David Glazer, an engineering director at Google.

The server-side REST API is also coming, but Google and its partners need to agree on the exact way it will be done, Chanezon said. "It will be super-useful for mobile applications," Chanezon said. Mobile phones whose browsers aren't powerful enough to run the OpenSocial Javascript APIs will take advantage of this REST API to get needed data from a server.

Google is also working on a security technology for OpenSocial applications called Caja, which the company calls an open-source Javascript "sanitizer" that aims to provide a security layer to prevent the spread of phishing scams, spam and malware via applications.
Also in the works is Shindig, an open-source reference implementation of OpenSocial overseen by The Apache Software Foundation, whose purpose is to let Web site operators implement an OpenSocial container in a matter of hours.

Meanwhile, Google's social-networking site Orkut will soon make available OpenSocial applications to its end-users, as will some of the other participating sites."That's what we're looking forward to: opening the doors and watching the party get started," Glazer said.

AOL's Userplane, a maker of Web-based communication applications, has been involved in the OpenSocial effort and is eager to see it continue to evolve, said Userplane CEO Michael Jones. "As application developers, we're excited about reducing the code we have to write, so I love the concept behind OpenSocial," Jones said.

"Although it has some uncertainties, I feel we're seeing an initiative that can have a great role in the future," Santos said.