Sunday, May 25, 2008

Symantec: Microsoft to blame for Windows XP SP3 registry

Symantec Thursday said it was Microsoft's code that crippled some PCs after upgrades to Windows XP Service Pack 3 (SP3) emptied Device Manager, deleted network connections, and packed the registry with thousands of bogus entries.
"We finally got to the bottom of this last night," said Dave Cole, Symantec's senior director for product management of its consumer software. "All of these problems are related to the same thing, a Microsoft file that created all the garbage entries [in the registry]."

He also said that some of the same symptoms had been acknowledged by Microsoft when users updated to Windows XP SP2 several years ago; Cole referenced a pair of Microsoft support documents to back up his claim.

Two weeks ago, after Microsoft launched Windows XP SP3 on Windows Update, users started reporting that their network cards and previously crafted connections had mysteriously vanished from Windows after updating with the service pack. The Device Manager had been emptied, they said, and Windows' registry, a directory that stores settings and other critical information, had been packed with large numbers of bogus entries.

Most users who posted messages on Microsoft's XP SP3 support forum said that the errant registry keys -- which started with characters such as "$%&" and appeared corrupted at first glance -- were located in sections devoted to settings for Symantec products. Not surprisingly, they quickly pinned blame on the security company.

Earlier this week, Symantec denied that its software was at fault, and instead pointed a finger at Microsoft.

Thursday, Cole said Symantec engineers had connected the current problem to a Microsoft file named "fixccs.exe." According to information on the Web, fixccs.exe stands for "Fix CCS MaxSubkeyName mismatch," and appears to be part of both XP SP3's and SP2's update packages.

Cole wasn't sure exactly what function fixccs.exe served. "But it caused similar problems with the Device Manager after SP2. It looks like it's reared its head again."

Two Microsoft support documents -- KB893249 and KB914450 -- both describe a problem remarkably similar to what users have reported recently. "After you install Windows XP Service Pack 2 (SP2) on a Windows XP-based computer, the Device Manager window is blank or some devices no longer appear," reads KB893249.

The fixccs.exe file attempts to make changes to the registry, said Cole, but in some cases also adds large numbers of unnecessary keys. When asked why so many users had reported seeing the errant entries in sections reserved for Symantec products, Cole called it "the luck of the draw. We have a fair number of keys in the registry, and we're on a lot of systems. This is not exclusive to Symantec."

Others have noted that too. A user identified as MRFREEZE61, who posted the first message on the Microsoft support forum thread two weeks ago, and later came up with a workaround, said as much today.

"The reported problems are not just limited to those using Symantec products," wrote MRFREEZE61 in a comment added to the original Computerworld story. "Folks on the forum report this specific registry corruption with no Symantec products installed at all. Some find this corruption in device control set enumerators associated with UPNP (Universal Plug and Play) and other 'legacy devices,' others from users of Avast [Antivirus]."

Fixccs.exe has also been linked to problems some users had installing early builds of XP SP3 late last year. In a support forum thread that started Dec. 22, 2007, Shashank Bansal, a Microsoft engineer helping users troubleshoot XP SP3 installation bugs, said: "This is a serious problem for us and we would like to investigate it to further depths. We would need help from all users on this forum for the same." Bansal then asked users who had had trouble updating from XP SP2 to SP3 to identify the process that had hung or had hogged CPU cycles. "Look out for cscipt.exe or fixccs.exe," he asked.

On Thursday, Cole said Symantec was working on a standalone tool that would delete the extraneous registry entries. "We hope to have it ready pretty quickly," he said. "We're working with Microsoft in the normal channels."

That word must not have trickled down to Microsoft's technical support representatives. Users who have posted to Symantec's support forum and others who have e-mailed Computerworld claim that they have been told by Microsoft support that the fault is all or partially Symantec's.

A user going by "ZLevee" copied messages received from Microsoft support to a Thursday post on the Symantec support site. "Based on the current research, the issue can probably be caused by the conflicts between SP3 and Norton. Please let me know if you have any Norton product installed.," ZLevee said the Microsoft support representative had claimed.

A Computerworld reader e-mailed an account of his experience last week with Microsoft's support. "I had an online chat with a tech support person named 'Obaid' on 5/18," said Thom Nielsen in the e-mail. "He told me that Symantec products do NOT work with XP SP3. He told me Symantec is aware of the problem(s) & is working on it."

"This is the first I've heard of this," said Cole when asked to comment. "I hope we can clear up any confusion."

When asked earlier Thursday whether it had uncovered any more information about the disappearing Device Manager and the corrupted registry entries, Microsoft said it nothing new to add beyond the recommendation it made Tuesday: that users contact the company's technical support desk if they have had problems upgrading to XP SP3.

Microsoft was not available for comment Thursday night.

Criminal banned from posting clips of himself on YouTube

A man who posted more than 80 videos of himself and others apparently committing crimes on Google's YouTube video-sharing website has been banned from uploading any more clips or images of himself.
Speeding, taking drugs, setting off fireworks in a wheelie bin and refusing to pay a taxi fare were among the offenses that Andrew Kellett is alleged to have committed in clips posted on the site. In response to his antics, Leeds Magistrates' Court issued him with an Anti-Social Behaviour Order (Asbo) that prevents him posting any more videos or images of his activities.

Kellet, who was called "Leeds' dumbest criminal" by a Leeds Councillor, claimed the ban restricted his freedom of speech and that he was simply an innocent bystander recording events.

If he breaches the terms of the Asbo, Kellet may face an immediate jail sentence.

Criminal banned from posting clips of himself on YouTube

A man who posted more than 80 videos of himself and others apparently committing crimes on Google's YouTube video-sharing website has been banned from uploading any more clips or images of himself.
Speeding, taking drugs, setting off fireworks in a wheelie bin and refusing to pay a taxi fare were among the offenses that Andrew Kellett is alleged to have committed in clips posted on the site. In response to his antics, Leeds Magistrates' Court issued him with an Anti-Social Behaviour Order (Asbo) that prevents him posting any more videos or images of his activities.

Kellet, who was called "Leeds' dumbest criminal" by a Leeds Councillor, claimed the ban restricted his freedom of speech and that he was simply an innocent bystander recording events.

If he breaches the terms of the Asbo, Kellet may face an immediate jail sentence.

Facebook security flaw could compromise accounts

A researcher has spotted a security problem in Facebook that could lead to hackers taking control of user accounts.
The flaw allows a hacker to execute scripts on Facebook, which could potentially be used to create a fake log-in page and capture people's passwords, according to the XSSED security blog. The discovery is credited to "Mox."

"Malicious people can exploit this issue to execute script code in the context of Facebook or obtain sensitive information from its users, such us clear text authentication credentials with a fake login form," according to the blog post, written by Dimitris Pagkalos.

A cross-site scripting vulnerability can let an attacker display data from another Web site or run malicious code, which can compromise user data on the targeted Web site.

Cross-site scripting flaws are increasingly becoming one of the favored vectors for hackers, and security experts have warned that a vast number of Web sites potentially contain the vulnerability. In 2006, the Web Application Security Consortium surveyed 31,373 sites and found that 85.57 percent were vulnerable to cross-site scripting attacks.

Users will be able to transfer N-Gage games, says Nokia

N-Gage owners will be able to transfer games from one phone to another, according to Nokia. Miscommunication is blamed for users not being told.
This week, fan Web site All About N-Gage noticed the existing licensing terms, which states that games bought and paid for can only be used on one phone, and got confirmation from Nokia that games can't be transferred to another phone.

"Internally there have been some mixed messages in this matter as well," said Oskar Södergren, communications manager at Nokia Scandinavia.

But users outraged over the licensing terms can rest easy; a mechanism for transferring games to a new phone is under development.

"We have been working on a way for this to work since the relaunch, but it is taking some time for everything to fall into place," said Södergren.

He doesn't want to elaborate on the details for when a mechanism for transferring games will be in place, or why it hasn't been released.

Nokia relaunched its gaming platform at the beginning of April. N-Gage allows owners of the N81, N82 and N95 to download games, for example FIFA 08, World Series of Poker Pro Challenge and Tetris. Each game costs between €6 (US$9.35) and €10, according to Nokia.

The original report: http://www.idgns.com/news.nsf/0/852573C4006938800025745100397BFE

Vendor goes after SMBs with BSM offering

Startup BSM (business service management) vendor FireScope this week launched a low-priced product aimed at providing small and medium-size businesses with easier entry into BSM, where implementations can run into the six figures.
BSM software -- where FireScope competes with BMC, Hewlett-Packard and Managed Objects -- seeks to provide companies with a way to map the performance of their IT assets, such as servers and applications, against the day-to-day processes of a business.

"You can look at the 'health' of all your data-center stuff in relation to how smoothly, or not, the business is running," said Michael Coté, an analyst with Redmonk. "The idea there is two-fold: enabling, for lack of a better word, IT to simply do their job of running all the computers for the rest of the company, and, giving IT the raw data to justify their existence, resist budget cuts and ask for more budget."

Pricing for FireScope BSM Business Edition starts at US$2,450.

The product also simplifies the process of implementing BSM, said Mark Lynd, FireScope's president. "Everything has wizards and contextual information, step-by-step, how to do this." However, it does not include some key features found in FireScope's offering for larger enterprises. Among the omissions are the ability to customize the application's look and feel, multisite data aggregation, SAN (storage area network) support for Firescope data, real-time reporting and an advanced analytics package.

"Our goal is to go out there and reach [SMBs] with this, and as these companies grow, grow with them," Lynd said of the Business Edition, adding in reference to his competitors, "I don't think the market is ready for this kind of pricing."

But a representative of one FireScope rival downplayed the potential effect of such a low-cost offering on the market.

"The idea of providing some BSM functionality to smaller IT shops is noble and an interesting idea, but I'd recommend being cautious about raising expectations. ... BSM doesn't lend itself to tossing cheap and cheerful code over the wall and hoping it will self-install and model critical IT services independently," said Frank Strong, marketing communications director for Managed Objects, via e-mail.

Larry Page: U.S. government should open up its spectrum

The U.S. government should explore ways to conduct real-time auctions of its vast, and often unused, wireless spectrum holdings, with agencies holding spectrum to get the profits from the sales, Google cofounder Larry Page said Thursday.
Page, speaking in Washington, D.C., repeated Google's position that the U.S. Federal Communications Commission should allow unlicensed wireless devices to access unused spectrum held by television stations. But in addition to TV stations opening up their so-called white spaces, Page called for government agencies to do the same thing.

Google suggested the FCC look into allowing winners of the 700MHz spectrum recently sold by the FCC to conduct real-time auctions as a new business model for spectrum ownership. That idea could be expanded to the federal government, with agencies that sell spectrum on a temporary basis potentially raising billions of dollars, Page said during a speech at the New America Foundation, an independent think tank.

If government agencies could conduct real-time auctions on their spectrum, the unused spectrum "doesn't stay wasted," said Page, now Google's president of products. "It's unclear how much demand you'd have. I think you'll have a lot of demand as you free up more spectrum."

At any one time, about 3 percent to 5 percent of wireless spectrum in the U.S. is being used, Page said. Wireless broadband signals in the TV white spaces could travel four times farther than typical Wi-Fi signals, he said.

It's unclear how much wireless spectrum the U.S. government holds, but estimates suggest the government has more spectrum than any private user. More than 30 U.S. government agencies control spectrum, according to New America, but the government doesn't disclose how much spectrum it has or uses.

Page suggested that government agencies using real-time auctions could shut down outside access whenever they needed additional spectrum.

Commercial spectrum holders could also conduct temporary auctions of excess spectrum, added Michael Calabrese, vice president and director of the Wireless Future Program at New America. "There's so much more unused and underutilized spectrum," he said. "That's part of what is wrong with what's been the conventional wisdom in Washington -- that there's spectrum scarcity. In fact, what's scarce is government licenses to use the spectrum."

Government agencies have been reluctant to give up or share spectrum, with some agencies citing national security reasons. Google and other tech companies advocating for using the white spaces in the TV spectrum have run into stiff opposition from the National Association of Broadcasters (NAB) and wireless microphone vendors such as Shure.

The NAB has raised concerns about interference with TV signals, and three white-space prototype devices have malfunctioned in tests at the FCC since last July. Shure and other wireless microphone vendors have largely been using the TV spectrum without getting FCC licenses, and they, too, have raised interference concerns. Those same concerns could come up with government-controlled spectrum.

NAB has called white-space devices a technology that's "not ready for prime time." NAB has complained that Google and other tech companies "continue to try to muscle their way through Washington in support of a technology that simply does not work."

An NAB spokesman wasn't immediately available to comment on Page's speech.

But Page said opponents of using the white spaces in the TV spectrum have overblown concerns about interference. It's not difficult to deploy technology that will check for other spectrum users before sending out a signal, he said. The NAB in the past has complained about potential interference from other technologies, including satellite television signals, he said.

"People pay attention to that because they say it, but that doesn't mean it's true," he said. "I don't want people to be misled by [organizations] who have interests in this."

Green Computing Summit 2008: Going green is no longer optional

If one message stood out among the others at this week's Green Computing Summit in Washington, DC, it was that going green is no longer just good for the bottom line; it's absolutely necessary. And it's not just the tree huggers who are saying so. Prominent business executives and top ranking federal officials are leading a green revolution that promises to radically change computer technology and the way it is managed.

It may well have been skyrocketing energy prices that first got industry worried about its bottom lines and federal agencies grappling with their budgets, but concern for the escalating climate crisis was hardly an afterthought. What started as a realization that going green was the easiest way to save money has evolved into a series of federal initiatives jointly aimed at reducing energy consumption and cutting CO2 emissions.

Given industry projections of computer growth, dramatic increases in online data storage and additional floor space that could be required by expanding data centers along with the resultant power and cooling upgrades, energy issues will clearly move from problem to crisis if efforts to bring energy consumption under control are not successful.

According to EPA, corporate and governmental data centers in metropolitain areas are already driving the power grid toward gridlock. By 2010, we could have 41 million servers in the US, with less than 10% utilization. Power consumption in data centers in the US could cost $7.4 billion by 2011, compared to $4.5 billion today.

How did we get here? It is estimated that 80% of IT operations managers have no idea what computing power is costing them. Historically, those who manage technology and those who pay the utility bills share little, if any, communication. Meanwhile, idle servers typically waste in excess of 70% of the power they use. Computer users, even those with Energy Star compliant systems, may leave them on around the clock and fail to activate their energy saving features.

Solutions to the computing energy problem focus on strategies such as server consolidation and virtualization to reduce the number of servers, the use of more efficient electonics (e.g., cooler CPUs), better computer life cycle management and end user training.

Twenty-three federal agencies are meeting monthly under the auspices of the ITILOB (IT Infrastructure Line of Business) -- an unprecedented level of collaboration between agencies of the federal government aimed at improving energy efficiency in three areas: end user systems, mainframes/servers and telecommunications systems. They are looking to take advantage of commonalities across the federal government as well as define cost and efficiency measures.

Part of the new green federal infrastructure is a change in the way federal leaders view computer costs. Catherine Cesnik, a Senior Program Manager in the Department of the Interior describes the purchase price of a computer today as the "tip of the iceburg" with respect to the system's real cost. The cost of powering that same system over the span of its useful life is becoming an increasingly significant portion of its real cost -- a cost that both federal agencies and energy-conscious companies are beginning to factor into their IT plans.

The inaugural Green Computing Summit was held in December of last year. This week's summit -- a one-day conference held at the Ronald Reagan Building, Washington, DC -- featured speakers from the government, academia and business communities. Prominent among the many speakers were representatives from both GSA and DOE. Keynotes were provided by John Johnson, Assistant Commissioner, Integrated Technology Service, Federal Acquisition Service, General Services Administration and David Rodgers, Deputy Assistant Secretary for Energy Efficiency and Renewable Energy, Department of Energy.

Conference sponsors were on hand to display a range of energy efficient technology -- high-resolution monitor/camera units for effective teleconferencing, virtualization software to create multiple virtual systems on a single physical server, power management software that intelligently turns servers on and off, printers that use dry toner (no cartridges to recycle or throw away) and more.

This week's Green Computing Summit, subtitled "Actionable Strategies for Impact Today", highlighted federal initiatives and green technology. The next summit is scheduled for December 2nd, same venue. IT managers, procurement specialists and technology professionals should put this intense one-day event on their calendars and plan on learning about environmentally-conscious yet efficient solutions to today's IT challenges.

Microsoft Surface developer seeks new canvas

What if you threw out your mouse and laid down a touch-sensitive flat-panel monitor on your desktop?
That's essentially what Andy Wilson, one of the designers of Microsoft Surface, has done with his latest project, called LaserTouch.

The idea is to train a camera down on a sheet of infrared laser light and then keep track of what it sees on the surface. Track the lasers on a flat-screen computer monitor, and you've created something that feels remarkably like a touchscreen monitor.

To the uninitiated, Wilson's LaserTouch software seems to work a lot like Surface, Microsoft's tabletop computer that can read reflections on its screen. It responds to gestures, so instead of clicking on a mouse, the user drags and drops with a fingertip. Squeezing two fingers together shrinks the screen, and a quick dragging movement can flip the screen to the next window.

Surface is being rolled out in AT&T stores, where it's being used to power customer information kiosks.

Because LaserTouch can work with screens that have a much higher resolution than Surface, Wilson said it could be used by office workers, if it's ever brought to market.

Using experimental presentation software developed by Microsoft's Office Labs, called Plex, Wilson was able to navigate through PowerPoint-like presentation slides on a 30-inch flat-panel display.

The Microsoft researcher demonstrated LaserTouch at a Microsoft Research event held for media and researchers at the software vendor's Mountain View, California campus. This was actually LaserTouch's second public outing. Wilson said that his software was also used to power the interactive whiteboard technology called Touch Wall that Microsoft Chairman Bill Gates demonstrated last week at the company's CEO Summit last week in Redmond, Washington.

What has Wilson excited, though, is the fact that LaserTouch could work on virtually any flat display, including a projection screen. The two lasers and a camera used in his demo cost just a few hundred dollars, he said. "By far the most expensive piece is the display."

Wilson's earlier research has shown how technology like LaserTouch can mesh with the real world in interesting ways. Wilson showed a demo video of two people playing chess against each other in two different locations. Each one put a white piece of paper and white or black chess pieces on the board and the LaserTouch software did the rest, superimposing a chess board and the opponent's pieces onto a projection screen. The only drawback: when you take a piece, your opponent, not you, has to remove it from the board.

Like Surface, the LaserTouch research work is showing how the virtual and real worlds are meshing in very interesting ways, said Rick Rashid, the senior vice president of Microsoft Research. "It's fun, but I really think it's the future."

Craigslist tops U.S. mobile browsing

Mobile Web surfers in the U.S. spend more time on classified-ad site Craigslist than on any other Web site, and they spent nearly twice as much time browsing as their British counterparts in March.
Those are among the findings from a study by mobile research company M:Metrics in which client software installed on participants' smartphones gleaned information about user activity. It found U.S. owners of smartphones -- not even counting iPhones or BlackBerry devices -- spent nearly 4 hours, 38 minutes using their browsers in March. U.K. subscribers spent just under 2 hours, 25 minutes, on average. The survey tracked 3,500 users of Symbian, Palm and Microsoft Windows Mobile smartphones in the U.S. and U.K.

The devotion to mobile browsing in the U.S. has a lot to do with the wider use of so-called "unlimited" data plans in the country, M:Metrics said. In the U.S., 10.9 percent of smartphone users have data plans that don't charge them per bit or per minute for browsing, the researchers said. In the U.K., only 2.3 percent have such plans. Mobile operators in Europe have been slower to adopt all-you-can-eat pricing, said M:Metrics analyst Mark Donovan.

U.S. users spent about 1 hour, 39 minutes per month on Craigslist, M:Metrics said. The site has two big factors in its favor as a mobile destination, Donovan said. It's text-based, so it's easier to load with a weak signal, and it emphasizes local information. Donovan believes mobile users are visiting local listings for events such as yard sales along with the site's popular personal ads.

E-commerce giant eBay was the second most popular destination, with smartphone users spending about 1 hour, 26 minutes per month there, closely followed by social networking sites Myspace and Facebook. The Walt Disney Co.'s Go.com entertainment portal was fifth, with 1 hour, 7 minutes.

Although average time spent per month was higher for Craigslist, individual visits to eBay lasted longer. On the days they visited eBay, users spent an average of 29 minutes there, versus 22 minutes on Craigslist, M:Metrics said.

Facebook led in browser time in the U.K., with an average of nearly 1 hour, 45 minutes per month, followed by the portal of Three, a popular 3G (third generation telephony) operator. Media company British Sky Broadcasting's site was third, followed by Microsoft's Live.com search site and the BBC.

The study covered all Internet visits through dedicated browsers and mobile operator portals, but not through the dedicated mobile client applications that Facebook and others have introduced, Donovan said. M:Metrics hasn't yet brought iPhone or BlackBerry users into the monthly survey. Although the iPhone is the single device used most often for mobile browsing (most mobile OSes are represented by many different devices), Donovan believes the use patterns would look similar if the iPhone and BlackBerry devices were included.

Yahoo postpones board meeting, director resigns

Facing a battle for its board, Yahoo on Thursday pushed back its annual meeting until the end of July and announced the resignation of a board member.
The annual meeting, during which the entire board is up for re-election, had been scheduled for July 3. Yahoo did not yet set a particular date for the annual meeting but said that it will be around the end of July.

Billionaire investor Carl Icahn has been scooping up Yahoo shares and has told the company he is nominating 10 candidates to replace the entire board. He has said that in doing so he hopes to reignite talks with Microsoft, which recently pulled its acquisition bid for Yahoo.

The postponement of the board meeting probably means Yahoo needs more time to work out a deal with Microsoft, said Karsten Weide, an analyst at IDC. He believes Microsoft ultimately will buy Yahoo, even though the software giant removed its offer and has said it is working on another type of transaction with the company.

In addition to the change in the annual meeting, Yahoo said Edward Kozel resigned from the board. In a filing with the U.S. Securities and Exchange Commission, Yahoo said Kozel had planned to leave the board in February but decided to stay on following the acquisition proposal from Microsoft.

As a result of his resignation, Yahoo has reduced the size of its board to nine directors, it said.

While Kozel said he is resigning in order to spend more time with his family, he probably has another reason, Weide said. "What it means is there is dissent," he said. Kozel may not have agreed with the board's refusal to make a deal with Microsoft and he may be worried about lawsuits charging the board with failing to do its duty, Weide said.

Yahoo appointed Kozel to the board in 2000. He had spent 11 years at Cisco, including as chief technology officer, and also served on Cisco's board. Kozel also previously worked at Boeing and McDonnell Douglas and as managing partner at Open Range Ventures, a private venture capital company.

Microsoft announced its US$44.6 billion cash-and-stock bid for Yahoo on Feb. 1 but abandoned it three months later, after Yahoo initially spurned the offer. Microsoft was interested in a deal with Yahoo as a way to boost its lagging search business, although since it pulled its offer, the company has said that it can gain more market share through internal innovations.

Google extends search dominance

Extending its dominance in the search market, Google grew its share of queries in April at the expense of rivals Yahoo, Microsoft, AOL and Ask.com.
Google's U.S. search query share in April grew to 61.6 percent, up from 59.8 percent in March, comScore announced Thursday. Google accomplished this although the number of search queries dropped 2 percent overall in April to 10.58 billion, compared with March, comScore said.

So even with the overall monthly decline, Google managed to increase its search queries by 1 percent, from 6.44 billion to 6.51 billion.

Meanwhile, the other four major search-engine players saw their queries and their market share drop in April, compared with March, not a great situation for them to be in, considering that search advertising accounts for about 41 percent of U.S. online advertising, according to the latest report from the Interactive Advertising Bureau (IAB).

Yahoo's market share of queries dropped to 20.4 percent, and its number of queries fell 6 percent. Microsoft's market share shrunk to 9.1 percent, while its queries fell 5 percent. AOL, down to a 4.6 percent share, saw its queries drop by 6 percent. Ask.com, whose share slid to 4.3 percent, had the biggest fall in queries percentage-wise with 9 percent.

A desire to improve its position in search was a primary driver for Microsoft's now-abandoned acquisition bid for Yahoo. However, Microsoft is reportedly trying to strike a search deal with Yahoo, which is also in similar negotiations with Google. It's not clear whether Yahoo would be open to selling its search-advertising business outright or instead seek a deal to outsource part of it to Microsoft or Google.

Whatever happens, comScore's figures for April leave no doubt that Microsoft and Yahoo have resoundingly failed to slow down Google in search, and that Google remains well-positioned to use its search dominance to continue boosting its revenue and profits.

In a research note commenting on the comScore report, Citigroup analyst Mark Mahaney wrote: "As Google continues to take share, we continue to believe a deal between Yahoo and Microsoft would be necessary -- though not sufficient -- to compete effectively with Google."

Microsoft's embrace of ODF cautiously welcomed

Microsoft's support for the OpenDocument Format (ODF) could mean greater opportunities for software makers already using the format, observers said Thursday.
Microsoft will put native support for ODF as part of its next service pack for Office 2007, due out by the first half of 2009. The surprise decision came as Microsoft's faces continued regulatory scrutiny from the European Commission over interoperability concerns.

The Commission said in a statement Thursday that it welcomes steps Microsoft takes toward "genuine" interoperability and that it would analyze the latest announcement to see how it impacts consumers' software choices.

In January, the Commission opened two new antitrust investigations against Microsoft concerning the interoperability of Windows with other software and the company's practice of bundling software products with Windows.

At least one office software maker thinks Microsoft's turnaround on ODF will mean more flexibility for software buyers. The ability to save in ODF in Microsoft Office could give users more confidence to switch to OpenOffice.org, a free open-source suite, said John McCreesh, spokesman for OpenOffice.org.

“The whole purpose of having an open standard is to give people freedom of choice,” McCreesh said. “It means we have a level playing field, which is what it’s all about.”

Of course, those users could migrate to Microsoft from OpenOffice.org, too, McCreesh said.

A looming concern is if Microsoft's implementation of ODF within Office will handle documents with the same or better performance as competing suites. Microsoft has been criticized for embracing a particular standard but using subtle means within its software to subvert it.

Those concerns aside, one organization that has been particularly critical of Microsoft also welcomed the news. Wider user of ODF through Office could also give a boost to competing operating systems such as Linux, said the Free Software Foundation Europe.

"The move to support ODF, if genuine, would remove one of the most effective barriers for migration to GNU/Linux on the desktop," wrote Georg C.F. Greve, spokesman for the organization, in an e-mail. "The Microsoft desktop monopoly would be unlikely to continue in such a situation and millions of computer users would enjoy genuine freedom of choice."

Despite years of bitter criticism, Microsoft resisted putting native support for ODF in Office, instead supporting projects to create translators. Sun Microsystems developed one of those translators, which allows users to save in ODF in Microsoft Office 2003.

Microsoft also chose to push its Office Open XML (OOXML) format, which was approved by the International Organization for Standardization (ISO) in April. Opponents of OOXML said Microsoft's specification would unnecessarily splinter and complicate office software productivity products.

Microsoft said Wednesday that it would not implement ISO standard 29500, as the approved OOXML version is known, in Office 2007 but instead the next version of the program, known as Office 14.

That means ODF will have a few years' head start on the ISO's approved OOXML standard. Microsoft hasn't set a date for release of Office 14. Office 2007 was released first to business users in November 2006.

In the meantime, ODF could gain wider support, wrote ODF supporter Andrew Updegrove, an open-source and open-standards attorney with Gesmer Updegrove in Boston.

"Given the quality of open-source office suites such as OpenOffice...the frequency of ODF-based files popping up in the work flows of Office-based shops can now be expected to increase much more quickly," Updegrove wrote in an e-mail commentary.

Microsoft's latest move may help put out other fires. A British government agency filed a complaint with the European Commission earlier this month alleging Microsoft impedes the exchange of files between Office 2007 and competitors' products.

The British Educational Communications and Technology Agency (BECTA), which advises British schools on technology, recommended in January that schools not upgrade to Vista and Office 2007.

BECTA has also called on Microsoft to make its products more interoperable, as well as putting "built-in and effective" support for ODF in Office 2007.

BECTA said Thursday it will examine Office 2007 after it has been upgraded. "If necessary we will update our advice to schools and colleges," the agency said in a statement.

IBM, one of Microsoft's fiercest critics during the OOXML deliberations, praised Microsoft's new stance on ODF.

"They will definitely benefit form being able to address this support requirement in the marketplace," said Bob Picciano, general manager and head of the company's Lotus software and collaboration business.

But Picciano said he hopes Microsoft is serious about contributing to the development of ODF as Microsoft has pledged.

Microsoft's closest competitor in the office software space, Corel, also recently decided to included ODF support.

The latest version WordPerfect Office X4, released in April, adds support for ODF as well as Microsoft's version of OOXML included in Office 2007, said Greg Wood, communications manager for WordPerfect Office. So far, Corel's customers have been more interested in OOXML support than ODF, Wood said.

Facebook provides more redesign details

Facebook is disclosing more details about the planned redesign for its core member profile pages, as it attempts to regain the layout's orderly, streamlined look that had been one of its trademarks and a differentiator from competitors like MySpace.
The latest plans in Facebook's ongoing redesign efforts call for profile pages to evolve from a single repository of content and applications into a tabbed interface.

The goal is to let users organize in these tabbed sub-pages the various components of their profiles, such as the activity feed, photos, personal information and applications.

Facebook members can see the latest screenshots in this album and view this video of a presentation held Wednesday by company officials about the redesign plans.

At the event, Chamath Palihapitiya, Facebook's vice president of product marketing, explained that the interface changes are intended to make profiles cleaner and simpler and give users more control over their look and feel, and emphasize the most recent and relevant information.

"We need to take a step forward with respect to the user experience and the UI that we present to the consumer because the amount of information that's being created both passively and proactively is increasing," he said.

No doubt this is due to Facebook's membership explosive growth and the company's decision a year ago to let external developers create applications for the site. Facebook currently has about 70 million members and about 20,000 applications.

Still Facebook must be careful about how its redesign affects a member's experience, as in the past some of its changes have riled users and industry observers.

The activity feed feature was blasted by users as violating their privacy, as was the Beacon ad program that broadcast online transactions made by Facebook's users to their friends list.

Already, there have been some early grumblings among external developers concerned that the redesigned profile page will steal visibility from their applications.

But Palihapitiya argued that the redesign will do the opposite rather, and generate instead "a more meaningful engagement with users" for applications by offering new integration opportunities in the profiles.

Facebook plans to let developers and members test the redesign before launching it formally next month.

Chinese police detain woman over quake video

Chinese police in the northern city of Shenyang have detained a woman who posted a video filled with angry comments directed at victims of the devastating earthquake that rattled Sichuan province last week.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.

In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.

"How many of you died? It was just a few," Gao said. "China has so many people, anyway."

The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.

"Have you no humanity?" asked one commentator.

Chinese police detain woman over quake video

Chinese police in the northern city of Shenyang have detained a woman who posted a video filled with angry comments directed at victims of the devastating earthquake that rattled Sichuan province last week.
The 21-year-old woman, Gao Qianhui, was angry over a three-day mourning period that saw online entertainment and games shut down in China out of respect for those killed by the quake, according to a Xinhua News Agency report carried on Netease, a popular Chinese portal. The report, which was highlighted by Blogging for China, did not make clear what law Gao was alleged to have broken in her online outburst.

In the video, Gao is shown sitting inside what appears to be an Internet cafe. After introducing herself as a "common young girl" from Liaoning province in northeastern China, Gao complains she has no interest in coverage of the quake or its aftermath.

"How many of you died? It was just a few," Gao said. "China has so many people, anyway."

The video and apparent lack of sympathy on Gao's part for those affected by the Sichuan earthquake provoked an outpouring of anger and criticism from Chinese Internet users. The Xinhua story carried on Netease alone had more than 17,000 comments at the time of writing.

"Have you no humanity?" asked one commentator.

Ahead of rootkit talk, Cisco patches router flaw

Cisco has issued three security patches, fixing bugs that could crash its products and drawing a warning from the SANS Internet Storm Center.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.

Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.

In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.

These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.

Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.

But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.

The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.

"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.

"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.

Ahead of rootkit talk, Cisco patches router flaw

Cisco has issued three security patches, fixing bugs that could crash its products and drawing a warning from the SANS Internet Storm Center.
The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.

Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.

In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.

These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWest conference in London.

Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.

But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.

The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.

"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.

"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.

Singaporean blogger arrested, charged with racism

A 24-year-old Chinese man was arrested in Singapore on May 20 and charged with posting racist comments on his blog, according to the Singapore Police Force.
The man, who was not named, was arrested after police received two complaints about allegedly racist comments posted on his blog, SPF said in a brief statement. The blog was not identified.

"Police take a serious view of such irresponsible blog postings in a multi-racial society like Singapore and will expend all efforts in tracking the perpetrators," the statement said.

Under Singaporean law, comments made with the "deliberate intention of wounding the religious or racial feelings of any person" can result in a jail term of up to three years and a fine.

Singapore is predominantly Chinese, but also has large Malay and Indian communities. For historical reasons, the government is generally quick to clamp down on public comments that might create tension between the country's different ethnic groups.

In 1964, tensions between the Chinese and Malay communities in Singapore twice erupted into riots that killed 36 and left hundreds wounded. Riots again broke out between the two communities in 1969, sparked by violence between Malays and Chinese in Malaysia.

In the case of the blogger arrested Tuesday, his comments were directed at a fellow passenger on Singapore's train system, local media reported.

"There he sat, unaffected by his surroundings, smelling like he didn't showered (sic) in years and wore some really scary dirty clothes," the blogger allegedly wrote, according to The New Paper. The blogger allegedly proceeded to make "offensive" comments about the man's race, the report said, without providing details.

Details of the man described in the blog, including his race, were not disclosed.

The man arrested for making the comments apologized, the New Paper said, saying he was "shocked by the furore over his blog entry, which he said was only intended for his close friends."

The man plans to make an online apology, the report said.