San Francisco Mayor Gavin Newsom met with jailed IT administrator Terry Childs Monday, convincing him to hand over the administrative passwords to the city's multimillion dollar wide area network.
Childs made headlines last week when he was arrested and charged with four counts of computer tampering, after he refused to give over passwords to the Cisco Systems switches and routers used on the city's FiberWAN network, which carries about 60 percent of the municipal government's network traffic. Childs, who managed the network before his arrest, has been locked up in the county jail since July 13.
[ Related reading: IT admin locks up San Francisco's network ]
On Monday afternoon, he handed the passwords over to Mayor Newsom, who was "the only person he felt he could trust," according to a declaration filed in court by his attorney, Erin Crane. Newsom is ultimately responsible for the Department of Telecommunications and Information Services (DTIS) where Childs worked for the past five years
Mayor Newsom secured the passwords without first telling DTIS about his meeting with Childs, according to DTIS chief administrative officer Ron Vinson, who added, "We're very happy the mayor embarked on his clandestine mission."
[Related reading: IT administrator pleads not guilty to network tampering ]
The department now has full administrative control of the network, he said in an interview Tuesday night.
It's likely that Childs had a lot to tell the mayor when the two met.
Childs' attorney has asked the judge to reduce Childs US$5 million bail bond, describing her client as a man who felt himself surrounded by incompetents and supervised by a manager who he felt was undermining his work.
"None of the persons who requested the password information from Mr. Childs ... were qualified to have it," she said in a court filing.
Childs intends to disprove the charges against him but also "expose the utter mismanagement, negligence and corruption at DTIS, which if left unchecked, will in fact place the City of San Francisco in danger," his motion reads.
Vinson dismissed the allegations. "In Terry Childs' mind, obviously he thinks the network is his, but it's not. It's the taxpayers'," he said. "The reason he's been sitting in jail is because he denied the department and others access to the system."
The court filings help explain just how this happened.
According to an affidavit from James Ramsey, an inspector with the San Francisco Police Department, he and other investigators discovered dial-up and DSL (digital subscriber line) modems that would allow an unauthorized connection to the FiberWAN. He also found that Childs had configured several of the Cisco devices with a command that would erase critical configuration data in the event that anyone tried to restore administrative access to the devices, something Ramsey saw as dangerous because no backup configuration files could be found.
This command, called a No Service Password Recovery is often used by engineers to add an extra level of security to networks, said Mike Chase, regional director of engineering with FusionStorm, an IT services provider that supports Cisco products.
But without access to either Childs' passwords or the backup configuration files, administrators would have to essentially re-configure their entire network, an error-prone and time consuming possibility, Chase said. "It's basically like playing 3D chess," he said. "In that situation, you're stuck interviewing everybody at every site getting anecdotal stories of who's connected to what. And then you're guaranteed to miss something."
Without the passwords, the network would still continue to run, but it would be impossible to reconfigure the equipment. The only way to restore these devices to a manageable state would be to knock them offline and then reconfigure them, something that would take weeks or months to complete, disrupt service and cost the city "hundreds of thousands, if not millions of dollars," Ramsey claims.
Crane argues that these monitoring devices were installed with management's permission and were critical to the smooth functioning of the network. They would page Childs when the system went down and allow him to remotely access the network from his personal computer in case of an emergency.
In interviews, current and former DTIS staffers describe Childs as a well respected co-worker who may have gone too far under the pressure of working in a department that had been demoralized and drastically cut as the city moved forward with plans to decentralize IT operations.
About 200 of the department's 350 IT positions had been cut since 2000, mostly to be relocated to other divisions within city government, said Richard Isen, IT chapter president with Childs' union, the International Federation of Professional and Technical Engineers, Local 21.
Despite his conflict with some in the department, Childs has a lot of support there, Isen said. "There is a lot of sympathy, only because there is a basic feeling that management misunderstand what we actually do and doesn't appreciate the complexity of the work."
(Paul Venezia is Senior Contributing Editor with InfoWorld)
Wednesday, July 23, 2008
Sun moves to indirect sales for most US customers
Sun Microsystems is moving to an indirect sales model in the U.S. for all but about 300 of its largest customers, a step designed to help boost its flagging revenue.
The change means customers who aren't among Sun's biggest U.S. accounts from a revenue perspective will be switched to one of its reseller partners in the coming months, said Tom Wagner, vice president of Sun's North America partner sales organization, in an interview on Tuesday.
"Effectively we're going to go 100 percent 'channel' below the top 300 or so accounts," he said. That means Sun will depend wholly on its partners to generate leads, architect systems, close deals and provide much of the support and services for those customers.
The move will likely be welcomed by Sun's 600 or so channel partners in the U.S. because they will no longer be competing with Sun for business. Sun believes it will give them more motivation to attack areas of the market where Sun's "share of the wallet" is low today, and allow Sun to scale its sales efforts to target those accounts, Wagner said.
It is less clear how the move will be received by customers. "At the end of the day it'll be a 'wait and see' in terms of the customer reaction," Wagner said.
"We have a portfolio of partners who play pretty high up in the value stack and who we believe can provide quality technical support and system engineering resources," he said. But he acknowledged that some customers may have "very specific demands about how we handle their accounts."
"We'll have to deal with that when it comes to it," he said.
The so-called Partner First initiative is limited to the U.S. today and Sun didn't announce any plans to extend it overseas. Companies will sometimes try a new strategy in one region and roll it out worldwide if it's successful.
Sun does about two-thirds of its business through channel partners today and the proportion outside the top 300 accounts is roughly the same, Wagner said. "We're turning over what we believe is a fairly significant amount of our existing business" to the channel, he said.
The plan was announced internally on July 11 and relayed to Sun's partners through a conference call last week, Wagner said. The goal is to complete the transition by the end of this quarter or early next, which means by September or October.
The change comes at a time when Sun is struggling to grow its business as fast as competitors. Last week it announced that revenue for the June quarter will probably be lower than what it reported a year ago, although the preliminary figures were roughly in line with analyst estimates. It will report its full results on Aug. 1.
Sun is also restructuring and announced in May that it would lay off 7 percent of its workforce, or about 2,500 staff. Wagner said he couldn't comment on whether the new sales plan is related to the layoffs, but one industry analyst said that's likely to be the case.
"This will help to streamline their operations. It will result in lower headcount," said Dan Olds, principal analyst at Gabriel Consulting Group, in Beaverton, Oregon.
Sun may also end up handing over a larger proportion of its professional services revenue to the channel, Olds said.
"The challenge will be ensuring that they get the shelf space with these partners, and that they invest enough to make sure they're well represented in the field," he said.
Sun will make "targeted investments" in partners or recruit new ones as necessary, Wagner said. The company is also changing the way it supports its partners. In the past, managers were allocated to a particular region and had little incentive to help partners grow their businesses in other parts of the country. It is changing so that Sun's managers now have an incentive to help the partners they manage nationwide.
Wagner wouldn't be pinned down on which areas Sun hopes to get more business from. The company is strongest today in the telecommunications, financial and federal government sectors, and is pursuing a bigger share of the healthcare and education markets, as well as that for mid-market customers.
"We believe we have a value proposition for just about anyone out there," Wagner said
.
The change means customers who aren't among Sun's biggest U.S. accounts from a revenue perspective will be switched to one of its reseller partners in the coming months, said Tom Wagner, vice president of Sun's North America partner sales organization, in an interview on Tuesday.
"Effectively we're going to go 100 percent 'channel' below the top 300 or so accounts," he said. That means Sun will depend wholly on its partners to generate leads, architect systems, close deals and provide much of the support and services for those customers.
The move will likely be welcomed by Sun's 600 or so channel partners in the U.S. because they will no longer be competing with Sun for business. Sun believes it will give them more motivation to attack areas of the market where Sun's "share of the wallet" is low today, and allow Sun to scale its sales efforts to target those accounts, Wagner said.
It is less clear how the move will be received by customers. "At the end of the day it'll be a 'wait and see' in terms of the customer reaction," Wagner said.
"We have a portfolio of partners who play pretty high up in the value stack and who we believe can provide quality technical support and system engineering resources," he said. But he acknowledged that some customers may have "very specific demands about how we handle their accounts."
"We'll have to deal with that when it comes to it," he said.
The so-called Partner First initiative is limited to the U.S. today and Sun didn't announce any plans to extend it overseas. Companies will sometimes try a new strategy in one region and roll it out worldwide if it's successful.
Sun does about two-thirds of its business through channel partners today and the proportion outside the top 300 accounts is roughly the same, Wagner said. "We're turning over what we believe is a fairly significant amount of our existing business" to the channel, he said.
The plan was announced internally on July 11 and relayed to Sun's partners through a conference call last week, Wagner said. The goal is to complete the transition by the end of this quarter or early next, which means by September or October.
The change comes at a time when Sun is struggling to grow its business as fast as competitors. Last week it announced that revenue for the June quarter will probably be lower than what it reported a year ago, although the preliminary figures were roughly in line with analyst estimates. It will report its full results on Aug. 1.
Sun is also restructuring and announced in May that it would lay off 7 percent of its workforce, or about 2,500 staff. Wagner said he couldn't comment on whether the new sales plan is related to the layoffs, but one industry analyst said that's likely to be the case.
"This will help to streamline their operations. It will result in lower headcount," said Dan Olds, principal analyst at Gabriel Consulting Group, in Beaverton, Oregon.
Sun may also end up handing over a larger proportion of its professional services revenue to the channel, Olds said.
"The challenge will be ensuring that they get the shelf space with these partners, and that they invest enough to make sure they're well represented in the field," he said.
Sun will make "targeted investments" in partners or recruit new ones as necessary, Wagner said. The company is also changing the way it supports its partners. In the past, managers were allocated to a particular region and had little incentive to help partners grow their businesses in other parts of the country. It is changing so that Sun's managers now have an incentive to help the partners they manage nationwide.
Wagner wouldn't be pinned down on which areas Sun hopes to get more business from. The company is strongest today in the telecommunications, financial and federal government sectors, and is pursuing a bigger share of the healthcare and education markets, as well as that for mid-market customers.
"We believe we have a value proposition for just about anyone out there," Wagner said
.
NAND flash memory downturn to continue
A global glut of NAND flash memory chips, which store songs, photos and other data in gadgets from iPods to digital cameras, will continue for at least the next few months because companies have been slow to rein in production, according to DRAMeXchange Technology.
The market researcher, which is based in the heartland of the global memory spot market in Taipei, predicts the NAND flash supply will grow 149 percent this year despite worsening prices for the chips. The problem is that chip makers such as Samsung Electronics, Hynix Semiconductor and SanDisk's partner, Toshiba, have not moved fast enough to cut production.
The good news for users is that companies will be able to offer more NAND flash storage capacity for a lower price, or offer better deals on existing products such as flash memory cards and MP3 players. Low NAND flash prices could also spur companies to lower prices on hot products such as SSDs (solid state drives) in hopes of growing the market for the drives.
Prices of NAND flash memory dropped 20 percent on average in the month of June, DRAMeXchange said, and an upturn for the market may not be in the offing until as late as September.
The NAND flash market has been so bad that the creator of the chips, SanDisk, on Monday reported a surprise loss of US$68 million for the second quarter. The company blamed the supply glut for its problems, pointing out that it sold a record amount of flash, 120 percent more than the same time last year, but that prices are down 55 percent compared to then.
SanDisk also said NAND flash prices may worsen in the third quarter. The company's Nasdaq-listed stock fell US$4.31, or 24 percent, to end Tuesday at $13.62 as a result of its earnings news.
To counter the deteriorating market, SanDisk will delay the start of production at a new joint venture chip factory until April 2009 and put plans for another factory on hold until market conditions improve.
Credit Suisse analyst John Pitzer notes that SanDisk's plans to delay building new production lines are a positive for the NAND flash industry and rivals are likely to follow. SanDisk and partner Toshiba account for around a third of the global NAND flash supply, he said in a report.
The market researcher, which is based in the heartland of the global memory spot market in Taipei, predicts the NAND flash supply will grow 149 percent this year despite worsening prices for the chips. The problem is that chip makers such as Samsung Electronics, Hynix Semiconductor and SanDisk's partner, Toshiba, have not moved fast enough to cut production.
The good news for users is that companies will be able to offer more NAND flash storage capacity for a lower price, or offer better deals on existing products such as flash memory cards and MP3 players. Low NAND flash prices could also spur companies to lower prices on hot products such as SSDs (solid state drives) in hopes of growing the market for the drives.
Prices of NAND flash memory dropped 20 percent on average in the month of June, DRAMeXchange said, and an upturn for the market may not be in the offing until as late as September.
The NAND flash market has been so bad that the creator of the chips, SanDisk, on Monday reported a surprise loss of US$68 million for the second quarter. The company blamed the supply glut for its problems, pointing out that it sold a record amount of flash, 120 percent more than the same time last year, but that prices are down 55 percent compared to then.
SanDisk also said NAND flash prices may worsen in the third quarter. The company's Nasdaq-listed stock fell US$4.31, or 24 percent, to end Tuesday at $13.62 as a result of its earnings news.
To counter the deteriorating market, SanDisk will delay the start of production at a new joint venture chip factory until April 2009 and put plans for another factory on hold until market conditions improve.
Credit Suisse analyst John Pitzer notes that SanDisk's plans to delay building new production lines are a positive for the NAND flash industry and rivals are likely to follow. SanDisk and partner Toshiba account for around a third of the global NAND flash supply, he said in a report.
McAfee: SMBs underestimate cybercrime risks
The latest survey from security vendor McAfee has found that small to medium-size businesses in North America and Europe wrongly conclude their revenue is too low to draw the attention of cybercriminals.
SMBs are in fact rich hunting ground for hackers, McAfee said. Although there may be less money or data to steal, the attacks are also less likely to gain the attention of law enforcement organizations such as the U.S. Federal Bureau of Investigation.
"Lots of small attacks add up to large amounts of revenue," according to the survey, which polled 500 companies in the U.S. and Canada. There are an estimated 7.4 million SMBs in North America.
McAfee's study this year focused on North America, whereas last year it surveyed 600 European SMBs. However, the conclusions of the two studies are similar.
About 45 percent of North American businesses felt they did not have valuable data to steal. Last year, 58 percent of European businesses gave the same response.
In the U.S., 39 percent of businesses with up to 1,000 employees reported spending an hour or less a week on IT security. The figure is higher for Canadian businesses: 44 percent.
Part of the problem is that attention to security takes time, and SMBs have fewer resources. Many don't have an employee dedicated full-time to IT security. But McAfee argues that SMBs could face critical shutdowns in business as a result of weak security.
Every business retains employee data, which could be valuable, the survey said. Also, every business is hit with spam, which often is laden with malicious data-stealing programs.
McAfee said it expects hackers to increasingly go after VOIP (Voice over Internet Protocol) phone systems, virtual systems as well as mobile devices. McAfee's advice: patch regularly, filter e-mail and use antivirus software.
SMBs are in fact rich hunting ground for hackers, McAfee said. Although there may be less money or data to steal, the attacks are also less likely to gain the attention of law enforcement organizations such as the U.S. Federal Bureau of Investigation.
"Lots of small attacks add up to large amounts of revenue," according to the survey, which polled 500 companies in the U.S. and Canada. There are an estimated 7.4 million SMBs in North America.
McAfee's study this year focused on North America, whereas last year it surveyed 600 European SMBs. However, the conclusions of the two studies are similar.
About 45 percent of North American businesses felt they did not have valuable data to steal. Last year, 58 percent of European businesses gave the same response.
In the U.S., 39 percent of businesses with up to 1,000 employees reported spending an hour or less a week on IT security. The figure is higher for Canadian businesses: 44 percent.
Part of the problem is that attention to security takes time, and SMBs have fewer resources. Many don't have an employee dedicated full-time to IT security. But McAfee argues that SMBs could face critical shutdowns in business as a result of weak security.
Every business retains employee data, which could be valuable, the survey said. Also, every business is hit with spam, which often is laden with malicious data-stealing programs.
McAfee said it expects hackers to increasingly go after VOIP (Voice over Internet Protocol) phone systems, virtual systems as well as mobile devices. McAfee's advice: patch regularly, filter e-mail and use antivirus software.
With DNS flaw now public, attack code imminent
One day after a security company accidentally posted details of a serious flaw in the Internet's Domain Name System (DNS), hackers are saying that software that exploits this flaw is sure to pop up soon.
Several hackers are almost certainly already developing attack code for the bug, and it will most likely crop up within the next few days, said Dave Aitel, chief technology officer at security vendor Immunity. His company will eventually develop sample code for its Canvas security testing software too, a task he expects to take about a day, given the simplicity of the attack. "It's not that hard," he said. "You're not looking at a DNA-cracking effort."
[ Related reading: Details of major Internet flaw posted by accident ]
The author of one widely used hacking tool said he expected to have an exploit by the end of the day Tuesday. In a telephone interview, HD Moore, author of the Metasploit penetration testing software, agreed with Aitel that the attack code was not going to be difficult to write.
The flaw, a variation on what's known as a cache poisoning attack, was announced on July 8 by IOActive researcher Dan Kaminsky, who planned to disclose full details of the bug during an Aug. 6 presentation at the Black Hat conference.
That plan was thwarted Monday, when someone at Matasano accidentally posted details of the flaw ahead of schedule. Matasano quickly removed the post and apologized for its mistake, but it was too late. Details of the flaw soon spread around the Internet.
And that's bad news, according to Paul Vixie, president of the company that is the dominant maker of DNS software, the Internet Systems Consortium. Vixie, like others who were briefed on Kaminsky's bug, did not confirm that it had been disclosed by Matasano. But if it had, "it's a big deal," he said in an e-mail message.
The attack can be used to redirect victims to malicious servers on the Internet by targeting the DNS servers that serve as signposts for all of the Internet's traffic. By tricking an Internet service provider's (ISPs) servers into accepting bad information, attackers could redirect that company's customers to malicious Web sites without their knowledge.
Although a software fix is now available for most users of DNS software, it can take time for these updates to work their way through the testing process and actually get installed on the network.
"Most people have not patched yet," Vixie said. "That's a gigantic problem for the world."
Just how big of a problem is a matter of some debate.
Neal Krawetz, owner of computer security consultancy Hacker Factor Solutions, took a look at DNS servers run by major ISPs earlier this week and found that more than half of them were still vulnerable to the attack.
"I find it dumbfounding that the largest ISPs ... are still identified as vulnerable," he wrote in a blog posting. "When the [hackers] learn of the exploit, they will go playing. They are certain to start with the lowest hanging fruit -- large companies that are vulnerable and support a huge number of users."
He expects that users will see attacks within weeks, starting first with test attacks, and possibly even a widespread domain hijacking. "Finally will be the phishers, malware writers and organized attackers," he wrote in a Tuesday e-mail interview. "I really expect these to be very focused attacks."
Most ISPs will have probably applied the patch by the time any attacks start to surface, and that will protect the vast majority of home users, said Russ Cooper, a senior information security analyst with Verizon Business. And business users who use secure DNS-proxying software will also be "pretty much protected" from the attack at their firewall, Cooper said.
"If anyone actually tries to exploit this, the actual number of victims will end up being extremely small," he predicted.
HD Moore said he didn't exactly see things that way. Because the flaw affects nearly all of the DNS software being used on the Internet, he said that there could be lots of problems ahead.
"This is a bug we'll be worrying about a year from now," he said.
Several hackers are almost certainly already developing attack code for the bug, and it will most likely crop up within the next few days, said Dave Aitel, chief technology officer at security vendor Immunity. His company will eventually develop sample code for its Canvas security testing software too, a task he expects to take about a day, given the simplicity of the attack. "It's not that hard," he said. "You're not looking at a DNA-cracking effort."
[ Related reading: Details of major Internet flaw posted by accident ]
The author of one widely used hacking tool said he expected to have an exploit by the end of the day Tuesday. In a telephone interview, HD Moore, author of the Metasploit penetration testing software, agreed with Aitel that the attack code was not going to be difficult to write.
The flaw, a variation on what's known as a cache poisoning attack, was announced on July 8 by IOActive researcher Dan Kaminsky, who planned to disclose full details of the bug during an Aug. 6 presentation at the Black Hat conference.
That plan was thwarted Monday, when someone at Matasano accidentally posted details of the flaw ahead of schedule. Matasano quickly removed the post and apologized for its mistake, but it was too late. Details of the flaw soon spread around the Internet.
And that's bad news, according to Paul Vixie, president of the company that is the dominant maker of DNS software, the Internet Systems Consortium. Vixie, like others who were briefed on Kaminsky's bug, did not confirm that it had been disclosed by Matasano. But if it had, "it's a big deal," he said in an e-mail message.
The attack can be used to redirect victims to malicious servers on the Internet by targeting the DNS servers that serve as signposts for all of the Internet's traffic. By tricking an Internet service provider's (ISPs) servers into accepting bad information, attackers could redirect that company's customers to malicious Web sites without their knowledge.
Although a software fix is now available for most users of DNS software, it can take time for these updates to work their way through the testing process and actually get installed on the network.
"Most people have not patched yet," Vixie said. "That's a gigantic problem for the world."
Just how big of a problem is a matter of some debate.
Neal Krawetz, owner of computer security consultancy Hacker Factor Solutions, took a look at DNS servers run by major ISPs earlier this week and found that more than half of them were still vulnerable to the attack.
"I find it dumbfounding that the largest ISPs ... are still identified as vulnerable," he wrote in a blog posting. "When the [hackers] learn of the exploit, they will go playing. They are certain to start with the lowest hanging fruit -- large companies that are vulnerable and support a huge number of users."
He expects that users will see attacks within weeks, starting first with test attacks, and possibly even a widespread domain hijacking. "Finally will be the phishers, malware writers and organized attackers," he wrote in a Tuesday e-mail interview. "I really expect these to be very focused attacks."
Most ISPs will have probably applied the patch by the time any attacks start to surface, and that will protect the vast majority of home users, said Russ Cooper, a senior information security analyst with Verizon Business. And business users who use secure DNS-proxying software will also be "pretty much protected" from the attack at their firewall, Cooper said.
"If anyone actually tries to exploit this, the actual number of victims will end up being extremely small," he predicted.
HD Moore said he didn't exactly see things that way. Because the flaw affects nearly all of the DNS software being used on the Internet, he said that there could be lots of problems ahead.
"This is a bug we'll be worrying about a year from now," he said.
Coverity™ Introduces New Static Analysis Solution for C#
Coverity™, Inc., the leader in improving software quality and security, announced Coverity Prevent™ for C#. The product utilizes a new analysis engine developed by Coverity’s research and development lab that is designed specifically for detecting defects in applications built on Microsoft’s .NET framework. Prevent for C# expands the language coverage of Coverity’s static analysis products, and brings the company’s proven expertise in automatic defect detection to developers programming in C#. Over 450 development organizations currently use Coverity Prevent to ensure the quality and security of their C/C++ and Java code.
“To remain competitive, software development team leads need to stock their developer’s tool-box with advanced technology to maintain or improve productivity that helps them deliver higher quality code to everyone upstream,” said Theresa Lanowitz, founder of voke, a technology analyst firm. “As a language, C# is playing an increasing role in failure-intolerant devices, particularly in the embedded space. Coverity's expertise in static analysis will be a welcome addition to the tool-box of any C# developer.”
Unlike other static tools that simply extend existing analysis capabilities to encompass a new language, Prevent for C# is based on an entirely new analysis engine designed and optimized for Microsoft .NET-based applications. It seamlessly handles features of the C# language such as operator overloading, properties, and idioms for iteration and resource management. Prevent for C# also automatically finds third party .NET assemblies to ensure a complete analysis result, no matter how complex the application.
Coverity Prevent for C# automatically analyzes large, complex C# code bases and detects critical, must-fix defects that could lead to system failures, memory corruption or performance degradation. Because the product is the only C# static analysis tool to deliver 100% path coverage, it delivers the most comprehensive and accurate C# source code analysis. Prevent for C# requires no changes to existing build processes or code, and easily integrates into existing build processes and requires little or no additional hardware. Key capabilities of Prevent for C# include: Detect Critical Defects - Automatic detection of defects in C# source code that can cause crashes, performance degradation and incorrect program behavior
* 100% Path Coverage - Analysis of every path in C# code bases, ensuring that all possible execution branches are followed
* Low False Positive Rate - Accurate, actionable results help developers immediately begin improving the quality and security of their code
* Flexible Workflow - Defect Manager product interface allows teams to collaboratively view analysis results, triage defects, assign ownership, and provides comprehensive workflow capabilities
* Highly Scalable - Millions of lines of code can be analyzed in a matter of hours
“Coverity developed Prevent for C# in response to requests from our existing customer base and the growing use of the .NET application framework in mission-critical systems where software defects can be tremendously costly,” said Andy Chou, chief scientist and co-founder at Coverity. “Delivering new technology so that our static analysis product line covers C, C++, C# and Java is a significant milestone on our roadmap for our flagship static analysis solution.”
About Coverity
Coverity (http://www.coverity.com), the leader in improving software quality and security, is a privately held company headquartered in San Francisco. Coverity’s groundbreaking technology enables developers to control complexity in the development process by automatically finding and helping to repair critical software defects and security vulnerabilities throughout the application lifecycle. More than 450 leading companies including ARM, Phillips, RIM, Rockwell-Collins, Samsung and UBS rely on Coverity to help them ensure the delivery of superior software.
“To remain competitive, software development team leads need to stock their developer’s tool-box with advanced technology to maintain or improve productivity that helps them deliver higher quality code to everyone upstream,” said Theresa Lanowitz, founder of voke, a technology analyst firm. “As a language, C# is playing an increasing role in failure-intolerant devices, particularly in the embedded space. Coverity's expertise in static analysis will be a welcome addition to the tool-box of any C# developer.”
Unlike other static tools that simply extend existing analysis capabilities to encompass a new language, Prevent for C# is based on an entirely new analysis engine designed and optimized for Microsoft .NET-based applications. It seamlessly handles features of the C# language such as operator overloading, properties, and idioms for iteration and resource management. Prevent for C# also automatically finds third party .NET assemblies to ensure a complete analysis result, no matter how complex the application.
Coverity Prevent for C# automatically analyzes large, complex C# code bases and detects critical, must-fix defects that could lead to system failures, memory corruption or performance degradation. Because the product is the only C# static analysis tool to deliver 100% path coverage, it delivers the most comprehensive and accurate C# source code analysis. Prevent for C# requires no changes to existing build processes or code, and easily integrates into existing build processes and requires little or no additional hardware. Key capabilities of Prevent for C# include: Detect Critical Defects - Automatic detection of defects in C# source code that can cause crashes, performance degradation and incorrect program behavior
* 100% Path Coverage - Analysis of every path in C# code bases, ensuring that all possible execution branches are followed
* Low False Positive Rate - Accurate, actionable results help developers immediately begin improving the quality and security of their code
* Flexible Workflow - Defect Manager product interface allows teams to collaboratively view analysis results, triage defects, assign ownership, and provides comprehensive workflow capabilities
* Highly Scalable - Millions of lines of code can be analyzed in a matter of hours
“Coverity developed Prevent for C# in response to requests from our existing customer base and the growing use of the .NET application framework in mission-critical systems where software defects can be tremendously costly,” said Andy Chou, chief scientist and co-founder at Coverity. “Delivering new technology so that our static analysis product line covers C, C++, C# and Java is a significant milestone on our roadmap for our flagship static analysis solution.”
About Coverity
Coverity (http://www.coverity.com), the leader in improving software quality and security, is a privately held company headquartered in San Francisco. Coverity’s groundbreaking technology enables developers to control complexity in the development process by automatically finding and helping to repair critical software defects and security vulnerabilities throughout the application lifecycle. More than 450 leading companies including ARM, Phillips, RIM, Rockwell-Collins, Samsung and UBS rely on Coverity to help them ensure the delivery of superior software.
ISP responds to lawmaker concerns about ad tracking
Embarq, an Internet service provider based in Kansas, has suspended its test of a targeted advertising service that tracks subscribers' Web habits as a way to deliver relevant ads.
Embarq, in a letter to U.S. lawmakers made public Tuesday, said it has no plans to deploy a controversial behavioral ad service from NebuAd. Three members of the U.S. House of Representatives sent a letter to Embarq CEO Tom Gerke last week, questioning the ISP's use of the NebuAd service, which has prompted an outcry from privacy advocates.
"Embarq has no plans for more tests or for general deployment of this technology, until such time as the privacy questions that have been raised recently have been addressed," said the Embarq letter, signed by David Zesiger, the company's senior vice president for regulatory policy and external affairs.
NebuAd's targeted ad system tracks user behavior in order to deliver more relevant ads and allows ISPs to profit from online advertising, but some privacy groups have accused the company of illegally wiretapping ISP subscribers' connections and of using common Internet attacks to deliver its service.
NebuAd's service first raised concerns earlier this year, when another ISP, Charter Communications, announced it was testing the service. Charter later announced it had suspended the test due to privacy concerns.
The lawmakers' letter came from Representatives John Dingell, a Michigan Democrat and chairman of the House Energy and Commerce Committee; Edward Markey, a Massachusetts Democrat and chairman of the committee's Subcommittee on Telecommunications and the Internet; and Joe Barton of Texas, the ranking Republican on the full committee. The lawmakers raised concerns that the targeted ad service violated privacy and that Embarq had not notified its customers of the NebuAd test.
But Zesiger's letter says that Embarq, which provides voice and Internet service to customers in 18 states, did notify its subscribers of the test. Two weeks before the test began, Embarq posted a notice on its Web site saying it would use personal information to deliver targeted advertising. The notice included a link to a page where subscribers could opt out of this "preference" advertising.
"By opting out, you will continue to receive advertisements as normal, but these advertisements will be less relevant and less useful to you," the notice said.
The Embarq test was brief and did not collect information that could be linked to individual subscribers, Zesiger added. "Embarq put in place a number of clear protections around its test," he wrote.
The test complied with U.S. Federal Trade Commission guidelines on the collection of personal data, Zesiger added. "It appears that industry standards in this area are evolving rapidly toward a more robust form of notice and choice," he said. "Embarq ... not only welcomes, but fully intends to apply any such evolved standards."
Embarq, in a letter to U.S. lawmakers made public Tuesday, said it has no plans to deploy a controversial behavioral ad service from NebuAd. Three members of the U.S. House of Representatives sent a letter to Embarq CEO Tom Gerke last week, questioning the ISP's use of the NebuAd service, which has prompted an outcry from privacy advocates.
"Embarq has no plans for more tests or for general deployment of this technology, until such time as the privacy questions that have been raised recently have been addressed," said the Embarq letter, signed by David Zesiger, the company's senior vice president for regulatory policy and external affairs.
NebuAd's targeted ad system tracks user behavior in order to deliver more relevant ads and allows ISPs to profit from online advertising, but some privacy groups have accused the company of illegally wiretapping ISP subscribers' connections and of using common Internet attacks to deliver its service.
NebuAd's service first raised concerns earlier this year, when another ISP, Charter Communications, announced it was testing the service. Charter later announced it had suspended the test due to privacy concerns.
The lawmakers' letter came from Representatives John Dingell, a Michigan Democrat and chairman of the House Energy and Commerce Committee; Edward Markey, a Massachusetts Democrat and chairman of the committee's Subcommittee on Telecommunications and the Internet; and Joe Barton of Texas, the ranking Republican on the full committee. The lawmakers raised concerns that the targeted ad service violated privacy and that Embarq had not notified its customers of the NebuAd test.
But Zesiger's letter says that Embarq, which provides voice and Internet service to customers in 18 states, did notify its subscribers of the test. Two weeks before the test began, Embarq posted a notice on its Web site saying it would use personal information to deliver targeted advertising. The notice included a link to a page where subscribers could opt out of this "preference" advertising.
"By opting out, you will continue to receive advertisements as normal, but these advertisements will be less relevant and less useful to you," the notice said.
The Embarq test was brief and did not collect information that could be linked to individual subscribers, Zesiger added. "Embarq put in place a number of clear protections around its test," he wrote.
The test complied with U.S. Federal Trade Commission guidelines on the collection of personal data, Zesiger added. "It appears that industry standards in this area are evolving rapidly toward a more robust form of notice and choice," he said. "Embarq ... not only welcomes, but fully intends to apply any such evolved standards."
Yahoo's profit down in Q2
Yahoo reported a modest revenue increase and a considerable drop in profit for its second quarter, along the way missing Wall Street's expectations in both categories, results that are unlikely to please its nervous shareholders.
Although Yahoo managed to defuse Carl Icahn's proxy fight this week, a rare victory in its monthslong, tumultuous sparring match with shareholders and suitor Microsoft, its results for the quarter ended June 30, 2008, will probably do little to dispel doubts over its ability to survive as an independent company.
[ Related reading: Yahoo settles with Icahn on board members ]
Yahoo had revenue of US$1.798 billion, a 6 percent increase from 2007's second quarter, the company announced Tuesday. Deducting the commissions it pays to its ad network publishers, Yahoo had revenue of $1.346 billion, up 8 percent but short of the $1.374 billion consensus expectation from financial analysts polled by Thomson Financial.
Net income fell to $131 million, or $0.09 per share, from $161 million, or $0.11 per share, in 2007's second quarter.
[ Related reading: Yahoo rejects MS proposal, seeks bid for entire company ]
On a pro forma basis, taking into account one-time items, net income was $139 million, or $0.10 per share, a penny short of analysts' consensus expectation. Yahoo had pro forma net income of $163 million, or $0.12 per share, in 2007's second quarter.
Still, Yahoo President Sue Decker said in a statement that the company made significant advancements in its turnaround strategy during the quarter. "We remain confident that our efforts will lead to a stronger and more profitable Yahoo," she said.
[ Related reading: Senate panel to hold hearing on Google-Yahoo search ad deal ]
Yahoo, which has been struggling on the financial and technology fronts for the past two years, has been embroiled in a corporate soap opera since Microsoft announced a bid to acquire the company in February.
That bid collapsed in May, leading to accusations from shareholders, including Icahn, that Yahoo's managers and board had purposely sabotaged the negotiations in order to protect their own financial interests, violating their fiduciary duty to shareholders.
Yahoo's management and board have denied the accusations, which have led to shareholder lawsuits, saying they negotiated in good faith and that ultimately it was Microsoft's decision to walk away. In the meantime, Yahoo has seen a steady parade of high-profile executives leave the company in recent months.
Yahoo this week managed to reach an agreement with Icahn, who had proposed an alternate slate of director candidates for the Aug. 1 shareholder meeting in order to unseat the entire board. By expanding the board and granting Icahn three seats, Yahoo convinced the billionaire investor to call off the plan. Icahn had indicated previously that his intention was to unseat Jerry Yang as Yahoo CEO and attempt to lure Microsoft back to the negotiating table, a possibility that now seems remote.
An attempt by Microsoft to acquire Yahoo's search advertising business also fell through, as Yahoo instead opted for an alternate deal to outsource part of that business to rival Google.
Although Yahoo managed to defuse Carl Icahn's proxy fight this week, a rare victory in its monthslong, tumultuous sparring match with shareholders and suitor Microsoft, its results for the quarter ended June 30, 2008, will probably do little to dispel doubts over its ability to survive as an independent company.
[ Related reading: Yahoo settles with Icahn on board members ]
Yahoo had revenue of US$1.798 billion, a 6 percent increase from 2007's second quarter, the company announced Tuesday. Deducting the commissions it pays to its ad network publishers, Yahoo had revenue of $1.346 billion, up 8 percent but short of the $1.374 billion consensus expectation from financial analysts polled by Thomson Financial.
Net income fell to $131 million, or $0.09 per share, from $161 million, or $0.11 per share, in 2007's second quarter.
[ Related reading: Yahoo rejects MS proposal, seeks bid for entire company ]
On a pro forma basis, taking into account one-time items, net income was $139 million, or $0.10 per share, a penny short of analysts' consensus expectation. Yahoo had pro forma net income of $163 million, or $0.12 per share, in 2007's second quarter.
Still, Yahoo President Sue Decker said in a statement that the company made significant advancements in its turnaround strategy during the quarter. "We remain confident that our efforts will lead to a stronger and more profitable Yahoo," she said.
[ Related reading: Senate panel to hold hearing on Google-Yahoo search ad deal ]
Yahoo, which has been struggling on the financial and technology fronts for the past two years, has been embroiled in a corporate soap opera since Microsoft announced a bid to acquire the company in February.
That bid collapsed in May, leading to accusations from shareholders, including Icahn, that Yahoo's managers and board had purposely sabotaged the negotiations in order to protect their own financial interests, violating their fiduciary duty to shareholders.
Yahoo's management and board have denied the accusations, which have led to shareholder lawsuits, saying they negotiated in good faith and that ultimately it was Microsoft's decision to walk away. In the meantime, Yahoo has seen a steady parade of high-profile executives leave the company in recent months.
Yahoo this week managed to reach an agreement with Icahn, who had proposed an alternate slate of director candidates for the Aug. 1 shareholder meeting in order to unseat the entire board. By expanding the board and granting Icahn three seats, Yahoo convinced the billionaire investor to call off the plan. Icahn had indicated previously that his intention was to unseat Jerry Yang as Yahoo CEO and attempt to lure Microsoft back to the negotiating table, a possibility that now seems remote.
An attempt by Microsoft to acquire Yahoo's search advertising business also fell through, as Yahoo instead opted for an alternate deal to outsource part of that business to rival Google.
VMware Q2 revenue up 54 percent, but slightly misses Street
VMware reported revenue that slightly missed analyst expectations for its 2008 second quarter, a crucial period during which the virtualization leader ousted its cofounder from the CEO spot and lowered its revenue forecast for the year.
Revenue for its second quarter, which ended June 30, was US$456 million, an increase of 54 percent from the same period last year. However, consensus estimates from Thomson Financial analysts expected the company to fare slightly better, predicting $458.6 million in revenue for the quarter.
[ Related reading: VMware replaces CEO, shares plummet ]
Non-GAAP (generally accepted accounting principles) net income for the quarter was $92 million, or $0.23 per diluted share, which was in line with analyst estimates. GAAP operating income for the quarter was $61 million, compared with $47 million for the same period last year. VMware's cash exceeded $1.5 billion, and deferred revenue was $721 million as of June 30, the company reported.
In the U.S., revenue for the quarter was up 43 percent to $240 million, and international revenue grew 68 percent to $216 million. Service revenue -- which includes support, subscription and professional services -- jumped 85 percent to $172 million, while revenue from software licenses was up 39 percent to $240 million.
On July 8 VMware replaced cofounder and then-CEO Diane Greene with former Microsoft executive Paul Maritz. A company statement hinted that Greene did not leave of her own volition.
VMware at the time also said its year-over-year revenue growth would be "modestly below" a previous estimate of 50 percent. On Tuesday, VMware said it expects revenue for 2008 to grow 42 percent to 45 percent from last year, which means it could be as much as 7 percent less than the company's original forecast.
VMware faces some of its toughest competition yet from its new CEO's former company Microsoft, which released its Hyper-V virtualization software for its Windows Server 2008 OS last month. Citrix Systems' XenServer software also is putting the heat on VMware, a subsidiary of EMC that made its initial public offering not quite a year ago. Microsoft and other companies are aiming to commoditize virtualization, VMware's bread and butter, as part of the OS.
Revenue for its second quarter, which ended June 30, was US$456 million, an increase of 54 percent from the same period last year. However, consensus estimates from Thomson Financial analysts expected the company to fare slightly better, predicting $458.6 million in revenue for the quarter.
[ Related reading: VMware replaces CEO, shares plummet ]
Non-GAAP (generally accepted accounting principles) net income for the quarter was $92 million, or $0.23 per diluted share, which was in line with analyst estimates. GAAP operating income for the quarter was $61 million, compared with $47 million for the same period last year. VMware's cash exceeded $1.5 billion, and deferred revenue was $721 million as of June 30, the company reported.
In the U.S., revenue for the quarter was up 43 percent to $240 million, and international revenue grew 68 percent to $216 million. Service revenue -- which includes support, subscription and professional services -- jumped 85 percent to $172 million, while revenue from software licenses was up 39 percent to $240 million.
On July 8 VMware replaced cofounder and then-CEO Diane Greene with former Microsoft executive Paul Maritz. A company statement hinted that Greene did not leave of her own volition.
VMware at the time also said its year-over-year revenue growth would be "modestly below" a previous estimate of 50 percent. On Tuesday, VMware said it expects revenue for 2008 to grow 42 percent to 45 percent from last year, which means it could be as much as 7 percent less than the company's original forecast.
VMware faces some of its toughest competition yet from its new CEO's former company Microsoft, which released its Hyper-V virtualization software for its Windows Server 2008 OS last month. Citrix Systems' XenServer software also is putting the heat on VMware, a subsidiary of EMC that made its initial public offering not quite a year ago. Microsoft and other companies are aiming to commoditize virtualization, VMware's bread and butter, as part of the OS.
Mozilla to release first Firefox 3.1 preview Friday
Mozilla Tuesday set Friday as the ship date for the first preview edition of Firefox 3.1, the fast-track update it hopes to polish off by late this year or early in 2009.
In a meeting Tuesday, Mozilla developers and managers nailed down details of Firefox 3.1, including the release date for the first alpha. Previously, Mozilla had tentatively scheduled the alpha for sometime this month.
"Still on track for Friday release," said the notes posted online after the morning meeting.
Mozilla froze the Firefox 3.1 code Monday and will begin to assemble builds of the preview Tuesday, the notes continued. Only the US-English version of the browser will be tested before it's posted to Mozilla's servers.
Although the alpha is a work in progress -- numerous features Mozilla wants to ship with the final won't make it into the first preview -- several changes will debut Friday, including improvements to the location bar and enhanced Ctrl-Tab tab switching that presents thumbnails when cycling through open tabs.
The new Ctrl-Tab presentation and behavior -- on the latter front, pressing Ctrl-Tab switches between current and last-viewed tabs rather than simply moving to the next tab to the right -- was, like many of the features slated for Firefox 3.1, originally meant to be included with Firefox 3.0.
In May, when Mike Schroepfer, Mozilla's chief engineer, first talked about Firefox 3.1, he said that the update would comprise features that didn't make it into the June release, but were "nearly complete."
The list of features being considered for 3.1 range from support for offline storage by Web apps to adding support for the Cross-Site XMLHttpRequest (Cross-Site XHR) specification, a still-under-development specification that Microsoft Corp. recently said it is also investigating.
In a meeting Tuesday, Mozilla developers and managers nailed down details of Firefox 3.1, including the release date for the first alpha. Previously, Mozilla had tentatively scheduled the alpha for sometime this month.
"Still on track for Friday release," said the notes posted online after the morning meeting.
Mozilla froze the Firefox 3.1 code Monday and will begin to assemble builds of the preview Tuesday, the notes continued. Only the US-English version of the browser will be tested before it's posted to Mozilla's servers.
Although the alpha is a work in progress -- numerous features Mozilla wants to ship with the final won't make it into the first preview -- several changes will debut Friday, including improvements to the location bar and enhanced Ctrl-Tab tab switching that presents thumbnails when cycling through open tabs.
The new Ctrl-Tab presentation and behavior -- on the latter front, pressing Ctrl-Tab switches between current and last-viewed tabs rather than simply moving to the next tab to the right -- was, like many of the features slated for Firefox 3.1, originally meant to be included with Firefox 3.0.
In May, when Mike Schroepfer, Mozilla's chief engineer, first talked about Firefox 3.1, he said that the update would comprise features that didn't make it into the June release, but were "nearly complete."
The list of features being considered for 3.1 range from support for offline storage by Web apps to adding support for the Cross-Site XMLHttpRequest (Cross-Site XHR) specification, a still-under-development specification that Microsoft Corp. recently said it is also investigating.
Colorado 'Spam King' walks away from prison camp
Convicted penny-stock spammer Eddie Davidson walked away from a federal minimum-security prison camp in Colorado on Sunday, the U.S. Department of Justice said Tuesday.
Davidson, 35, had been serving 21 months in federal prison after pleading guilty to criminal spam charges in December. He is now considered an escapee and is being pursued by U.S. marshals, with help from the U.S. Federal Bureau of Investigation, the U.S. Internal Revenue Service and local police.
He earned millions of dollars between 2003 and 2006 by operating a spamming operation, called Power Promoters, out of his home. He would change the header information in his messages to make it appear as if they had come from legitimate companies such as AOL and then send them out to hundreds of thousands of addresses.
Davidson sent the messages on behalf of an unnamed Houston company, court filings state. He was asked to promote about 19 penny-stock companies, including one called Advanced Power Line Technologies in 2006 and 2007. He would earn fees based on the trading volume of the stocks he was promoting.
The business was lucrative: The Houston company paid Davidson about US$1.4 million for his services, court documents state.
Between 2003 and 2006, when his primary source of income was spam, bank account deposits into Davidson's account totalled about $3.5 million.
Davidson, of Bennett, Colorado, had been incarcerated at the Florence Federal Correctional Complex, about 45 miles south of Colorado Springs.
Davidson, 35, had been serving 21 months in federal prison after pleading guilty to criminal spam charges in December. He is now considered an escapee and is being pursued by U.S. marshals, with help from the U.S. Federal Bureau of Investigation, the U.S. Internal Revenue Service and local police.
He earned millions of dollars between 2003 and 2006 by operating a spamming operation, called Power Promoters, out of his home. He would change the header information in his messages to make it appear as if they had come from legitimate companies such as AOL and then send them out to hundreds of thousands of addresses.
Davidson sent the messages on behalf of an unnamed Houston company, court filings state. He was asked to promote about 19 penny-stock companies, including one called Advanced Power Line Technologies in 2006 and 2007. He would earn fees based on the trading volume of the stocks he was promoting.
The business was lucrative: The Houston company paid Davidson about US$1.4 million for his services, court documents state.
Between 2003 and 2006, when his primary source of income was spam, bank account deposits into Davidson's account totalled about $3.5 million.
Davidson, of Bennett, Colorado, had been incarcerated at the Florence Federal Correctional Complex, about 45 miles south of Colorado Springs.
Wednesday, June 18, 2008
China quake site hacker caught
A 19-year old Chinese man is in police custody after allegedly hacking into a provincial seismological bureau's Web site to place a false earthquake warning, Chinese state media reported Monday.
The teenager, identified only by his surname Chen, altered the Web site of the Guangxi Seismological Bureau to warn residents in southwestern China to prepare for an impending earthquake expected to measure 9.0 on the Richter scale, according to a report on China Central Television's Web site.
Such a posting could have caused a panic. On May 12 an earthquake measuring 7.8 struck China's Sichuan province, killing over 70,000 people and leaving millions homeless. Following the quake, many people have fallen prey to rumors that earthquakes can now be predicted in a manner similar to weather forecasts, although there was no warning of the Sichuan quake.
Authorities did not say what impact the hacker's posting had.
An earthquake measuring approximately 9.0 was the cause of the 2004 Asian tsunami, which killed about 250,000 around the Indian Ocean.
Chen was arrested in the Guangxi province city of Taicang on June 4, and was being held in the provincial capital of Nanning. The report did not indicate what the exact charges would be, nor when Chen might face trial or what type of punishment was possible if he is convicted.
Chen had confessed and said that he altered the Web site to demonstrate his technical skills, according to the report.
Other young people have been involved in untoward online events since the earthquake. In late May, Liaoning province resident Gao Qianhui caused an uproar when a webcam recording she made expressing apathy towards the quake's victims reached viewers of online video sites. Gao was later arrested on unspecified charges.
Last week, a young woman known only as "Xiaoyun" or "Little Cloud" and claiming to be a native of Sichuan posted lurid photos of herself online. "I am posting some photos to encourage contributions" to quake relief efforts, she claimed. The authenticity of the photos and claims remain unknown, but the pictures have been circulated widely on blogs and bulletin boards in China.
The teenager, identified only by his surname Chen, altered the Web site of the Guangxi Seismological Bureau to warn residents in southwestern China to prepare for an impending earthquake expected to measure 9.0 on the Richter scale, according to a report on China Central Television's Web site.
Such a posting could have caused a panic. On May 12 an earthquake measuring 7.8 struck China's Sichuan province, killing over 70,000 people and leaving millions homeless. Following the quake, many people have fallen prey to rumors that earthquakes can now be predicted in a manner similar to weather forecasts, although there was no warning of the Sichuan quake.
Authorities did not say what impact the hacker's posting had.
An earthquake measuring approximately 9.0 was the cause of the 2004 Asian tsunami, which killed about 250,000 around the Indian Ocean.
Chen was arrested in the Guangxi province city of Taicang on June 4, and was being held in the provincial capital of Nanning. The report did not indicate what the exact charges would be, nor when Chen might face trial or what type of punishment was possible if he is convicted.
Chen had confessed and said that he altered the Web site to demonstrate his technical skills, according to the report.
Other young people have been involved in untoward online events since the earthquake. In late May, Liaoning province resident Gao Qianhui caused an uproar when a webcam recording she made expressing apathy towards the quake's victims reached viewers of online video sites. Gao was later arrested on unspecified charges.
Last week, a young woman known only as "Xiaoyun" or "Little Cloud" and claiming to be a native of Sichuan posted lurid photos of herself online. "I am posting some photos to encourage contributions" to quake relief efforts, she claimed. The authenticity of the photos and claims remain unknown, but the pictures have been circulated widely on blogs and bulletin boards in China.
Former 'spam king' to pay MySpace $6 million
A Colorado man has been ordered to pay US$6 million in damages and legal fees for spamming thousands of MySpace.com users.
Scott Richter of Westminster, Colorado, must pay MySpace $4.8 million in damages and $1.2 million in legal fees, a court-appointed arbitrator ruled on Thursday.
Richter, who was once accused of pumping out more than 100 million spam messages per day, had been sued by MySpace in January 2007 in connection with an August 2006 campaign in which MySpace members were hit with unsolicited messages promoting a Web site called Consumerpromotionscenter.com. The messages were sent from phished MySpace accounts, according to the findings of Philip Boesch, the court-appointed arbitrator in the case.
The messages were sent to a MySpace community that was ill-equipped to deal with any security problems. At the time, "MySpace only employed two relatively junior staff employees to deal with these issues," Boesch wrote. The company's security staff has now grown to about 40, he added.
MySpace had been seeking a court ruling in the case, but in August 2007, U.S. District Judge George King of the Central District of California granted Richter's request to assign the matter to arbitration. Terms of the award were made public on Monday.
In a statement, Richter said that he and his company, Media Breakaway, were happy to have this matter behind them, noting that the arbitrator's award was 95 percent less than the amount sought by MySpace.
"We respect the decision of the arbitrator and we're not going to appeal it," said Steven Richter, the president and general counsel of Media Breakaway and father of Scott Richter. "We're going to pay the money he awarded."
This is not the first time a Scott Richter company has had to cough up millions of dollars to fight spam charges. In 2005, his previous company, Optinrealbig.com, paid $7 million to settle similar charges brought by Microsoft.
Scott Richter was removed from anti-spam organization Spamhaus' list of known spammers that same year.
Media Breakaway, which has no other spam cases pending, is doing everything it can to build a compliance team and make sure it is acting within the law, Steven Richter said.
MySpace said the Richter award was the latest in a series of steps it has taken to combat abuse on its Web site. In May, the company was awarded a $230 million antispam judgment against Sanford Wallace and Walter Rines.
"This award reflects MySpace's continued momentum and holistic approach to ridding the site of spammers and phishers," MySpace said in a statement. "We will continue to do our part in cleansing the Internet of this invasive onslaught of spam."
Scott Richter of Westminster, Colorado, must pay MySpace $4.8 million in damages and $1.2 million in legal fees, a court-appointed arbitrator ruled on Thursday.
Richter, who was once accused of pumping out more than 100 million spam messages per day, had been sued by MySpace in January 2007 in connection with an August 2006 campaign in which MySpace members were hit with unsolicited messages promoting a Web site called Consumerpromotionscenter.com. The messages were sent from phished MySpace accounts, according to the findings of Philip Boesch, the court-appointed arbitrator in the case.
The messages were sent to a MySpace community that was ill-equipped to deal with any security problems. At the time, "MySpace only employed two relatively junior staff employees to deal with these issues," Boesch wrote. The company's security staff has now grown to about 40, he added.
MySpace had been seeking a court ruling in the case, but in August 2007, U.S. District Judge George King of the Central District of California granted Richter's request to assign the matter to arbitration. Terms of the award were made public on Monday.
In a statement, Richter said that he and his company, Media Breakaway, were happy to have this matter behind them, noting that the arbitrator's award was 95 percent less than the amount sought by MySpace.
"We respect the decision of the arbitrator and we're not going to appeal it," said Steven Richter, the president and general counsel of Media Breakaway and father of Scott Richter. "We're going to pay the money he awarded."
This is not the first time a Scott Richter company has had to cough up millions of dollars to fight spam charges. In 2005, his previous company, Optinrealbig.com, paid $7 million to settle similar charges brought by Microsoft.
Scott Richter was removed from anti-spam organization Spamhaus' list of known spammers that same year.
Media Breakaway, which has no other spam cases pending, is doing everything it can to build a compliance team and make sure it is acting within the law, Steven Richter said.
MySpace said the Richter award was the latest in a series of steps it has taken to combat abuse on its Web site. In May, the company was awarded a $230 million antispam judgment against Sanford Wallace and Walter Rines.
"This award reflects MySpace's continued momentum and holistic approach to ridding the site of spammers and phishers," MySpace said in a statement. "We will continue to do our part in cleansing the Internet of this invasive onslaught of spam."
Telecom industry focuses on video, fat pipes
Wired and wireless carriers will meet up with network equipment vendors this week in Las Vegas to figure out how to meet the changing and fast-growing demands of enterprises and consumers.
The NXTcomm trade show, the latest incarnation of an annual event that used to be called Supercomm, will bring together the heads of AT&T, Verizon and Sprint Nextel, plus other luminaries, and they will have plenty to talk about. Demand for bandwidth is rising, new wireless technologies are emerging, huge swaths of radio spectrum in the U.S. have recently been allocated to wireless data and carriers are redesigning their networks to deliver packages of IP (Internet Protocol) wired and mobile services.
Video, for consumers and increasingly for business, is a major driver in the growth of data traffic and is likely to be a big topic at the conference. Research company IDC predicted last December that video distribution would be the biggest driver for service providers to consolidate their networks around IP this year.
Tandberg will push video for enterprises with two types of products on display at the show. On employees' desks, it will make the video phone a reality with its E20 Video IP Phone. It's designed from the ground up for visual calls, with a 10.6-inch LCD (liquid crystal display) screen built in right over the phone keypad, and a 5 megapixel video camera on top. The screen will have 448 lines of resolution, near DVD quality of 480 lines, and will feature CD-quality audio, according to Tandberg. With a button on the phone, employees can switch from video to sharing an application running on their PCs. Picture-in-picture application-sharing will come later, said Peter Nutley, director of global product marketing.
The E20 will come with a handset and also work as a speakerphone. There is an RJ-11 jack for wired headsets and Bluetooth is built in, though it won't be activated until a software upgrade due in the first half of 2009, Nutley said. Priced at US$1,490, the E20 can take the place of an existing desk phone and can be hooked up to either a Tandberg infrastructure or an existing IP PBX (private branch exchange). It is designed to work with most other IP phones and videoconferencing systems using SIP (Session Initiation Protocol) and other standards. The E20 is set to ship in the first quarter of 2009.
Most video phones have been designed for consumers, and enterprise employees typically have PCs they could use for IP calls with video, said IDC analyst Nora Freedman. But a dedicated device such as the E20 is likely to offer better image and voice quality and may be easier to start up and use, she said.
"I don't want to have to call my IT guy so I can dial the phone," Freedman said.
Devices such as the E20 may appeal more to a niche market, said Robert Arnold of Current Analysis, though having the video calling capability up and available all the time would be an advantage over PC-based options.
Also at NXTcomm, Tandberg will show off the beginning of its next generation of telepresence systems, featuring 1080p high-definition video. It will demonstrate the Codec C90, a telepresence engine using Tandberg's latest codec. That engine will power the T1, a telepresence system with one 65-inch 1080p screen and a 1080p camera. The arrangement of the camera and display on the T1 can make it seem that participants are looking into each others' eyes, Nutley said. The C90 will cost $36,900 and the T1 will cost $69,900, and both are scheduled to ship in the fourth quarter.
Although Cisco Systems' telepresence products also have 1080p quality, Tandberg claims its system is more in line with standards and will deliver better quality when hooked up with other vendors' products.
However, with IP communications standards in the state they are today, it's unlikely anyone could make interoperability simple, Arnold said.
"It's probably going to take some sweat," Arnold said. "None of this stuff is straightforward."
Ericsson, one of the world's largest wired and wireless network infrastructure makers, will focus its NXTcomm push on IPTV with a Televisionary Pavilion in its booth. The company said it will show how it can help carriers deliver video on everything from big-screen TVs to handheld devices, whenever and wherever consumers want to watch and interact with it.
A service provider and a group of vendors are going to tackle the bandwidth problem head-on with a real-world demonstration of 100G bps (bit per second) Ethernet at NXTcomm, which they call the world's first.
Carriers are gradually converting their data networks to IP and Ethernet to take advantage of relative simplicity and low cost and to better deliver services to enterprises, which already use Ethernet internally. An emerging standard for the next generation of Ethernet, following the current 10G bps, allows for both 40G bps and 100G bps versions.
Equipment makers Infinera and Avago Technologies will set up gear for the demonstration, in which network testing company Ixia will send data over XO Communications' network from Las Vegas to Los Angeles and back. Using products now under development, they will achieve that speed by "mapping" the 100G bps of traffic onto 10 "lanes" of 10G bps, a type of connection widely available today. The technology is based on a standard under development by the IEEE 802.3ba task force, which Infinera expects to be agreed upon within 18 to 24 months. The 100G bps Ethernet technology also will be useful in the backbones of large enterprise networks as more 10-Gig Ethernet pipes are installed in data centers, said Errol Ginsberg, founder and chairman of Ixia.
Arbor Networks will use the show to unveil a system for protecting high-speed Ethernet links from DDoS (Distributed Denial of Service) attacks. Arbor's Threat Management System 3100 can detect and mitigate DDoS attacks on a 10G Ethernet connection, using deep packet inspection of more than 80 critical IP services and applications on the network, including VoIP (voice over IP), HTTP (Hypertext Transport Protocol), instant messaging and P-to-P (peer-to-peer). It can issue reports and surgically remove only attack traffic, according to the company. Arbor has integrated TMS 3100 into its Peakflow SP platform, which performs a variety of other protection functions.
The NXTcomm trade show, the latest incarnation of an annual event that used to be called Supercomm, will bring together the heads of AT&T, Verizon and Sprint Nextel, plus other luminaries, and they will have plenty to talk about. Demand for bandwidth is rising, new wireless technologies are emerging, huge swaths of radio spectrum in the U.S. have recently been allocated to wireless data and carriers are redesigning their networks to deliver packages of IP (Internet Protocol) wired and mobile services.
Video, for consumers and increasingly for business, is a major driver in the growth of data traffic and is likely to be a big topic at the conference. Research company IDC predicted last December that video distribution would be the biggest driver for service providers to consolidate their networks around IP this year.
Tandberg will push video for enterprises with two types of products on display at the show. On employees' desks, it will make the video phone a reality with its E20 Video IP Phone. It's designed from the ground up for visual calls, with a 10.6-inch LCD (liquid crystal display) screen built in right over the phone keypad, and a 5 megapixel video camera on top. The screen will have 448 lines of resolution, near DVD quality of 480 lines, and will feature CD-quality audio, according to Tandberg. With a button on the phone, employees can switch from video to sharing an application running on their PCs. Picture-in-picture application-sharing will come later, said Peter Nutley, director of global product marketing.
The E20 will come with a handset and also work as a speakerphone. There is an RJ-11 jack for wired headsets and Bluetooth is built in, though it won't be activated until a software upgrade due in the first half of 2009, Nutley said. Priced at US$1,490, the E20 can take the place of an existing desk phone and can be hooked up to either a Tandberg infrastructure or an existing IP PBX (private branch exchange). It is designed to work with most other IP phones and videoconferencing systems using SIP (Session Initiation Protocol) and other standards. The E20 is set to ship in the first quarter of 2009.
Most video phones have been designed for consumers, and enterprise employees typically have PCs they could use for IP calls with video, said IDC analyst Nora Freedman. But a dedicated device such as the E20 is likely to offer better image and voice quality and may be easier to start up and use, she said.
"I don't want to have to call my IT guy so I can dial the phone," Freedman said.
Devices such as the E20 may appeal more to a niche market, said Robert Arnold of Current Analysis, though having the video calling capability up and available all the time would be an advantage over PC-based options.
Also at NXTcomm, Tandberg will show off the beginning of its next generation of telepresence systems, featuring 1080p high-definition video. It will demonstrate the Codec C90, a telepresence engine using Tandberg's latest codec. That engine will power the T1, a telepresence system with one 65-inch 1080p screen and a 1080p camera. The arrangement of the camera and display on the T1 can make it seem that participants are looking into each others' eyes, Nutley said. The C90 will cost $36,900 and the T1 will cost $69,900, and both are scheduled to ship in the fourth quarter.
Although Cisco Systems' telepresence products also have 1080p quality, Tandberg claims its system is more in line with standards and will deliver better quality when hooked up with other vendors' products.
However, with IP communications standards in the state they are today, it's unlikely anyone could make interoperability simple, Arnold said.
"It's probably going to take some sweat," Arnold said. "None of this stuff is straightforward."
Ericsson, one of the world's largest wired and wireless network infrastructure makers, will focus its NXTcomm push on IPTV with a Televisionary Pavilion in its booth. The company said it will show how it can help carriers deliver video on everything from big-screen TVs to handheld devices, whenever and wherever consumers want to watch and interact with it.
A service provider and a group of vendors are going to tackle the bandwidth problem head-on with a real-world demonstration of 100G bps (bit per second) Ethernet at NXTcomm, which they call the world's first.
Carriers are gradually converting their data networks to IP and Ethernet to take advantage of relative simplicity and low cost and to better deliver services to enterprises, which already use Ethernet internally. An emerging standard for the next generation of Ethernet, following the current 10G bps, allows for both 40G bps and 100G bps versions.
Equipment makers Infinera and Avago Technologies will set up gear for the demonstration, in which network testing company Ixia will send data over XO Communications' network from Las Vegas to Los Angeles and back. Using products now under development, they will achieve that speed by "mapping" the 100G bps of traffic onto 10 "lanes" of 10G bps, a type of connection widely available today. The technology is based on a standard under development by the IEEE 802.3ba task force, which Infinera expects to be agreed upon within 18 to 24 months. The 100G bps Ethernet technology also will be useful in the backbones of large enterprise networks as more 10-Gig Ethernet pipes are installed in data centers, said Errol Ginsberg, founder and chairman of Ixia.
Arbor Networks will use the show to unveil a system for protecting high-speed Ethernet links from DDoS (Distributed Denial of Service) attacks. Arbor's Threat Management System 3100 can detect and mitigate DDoS attacks on a 10G Ethernet connection, using deep packet inspection of more than 80 critical IP services and applications on the network, including VoIP (voice over IP), HTTP (Hypertext Transport Protocol), instant messaging and P-to-P (peer-to-peer). It can issue reports and surgically remove only attack traffic, according to the company. Arbor has integrated TMS 3100 into its Peakflow SP platform, which performs a variety of other protection functions.
Novell patches Suse Linux kernel for VMware efficiency
Novell Monday released updates to its Suse Linux kernel designed to make the operating system more efficient when running on top of VMware environments.
The upgrade to the Suse Linux Enterprise kernel lets it take advantage of paravirtualization techniques so it runs more efficiently as a guest operating system. Specifically, Novell has built in support for VMware's Virtual Machine Interface (VMI)."The patch to the kernel provides increased performance and better interoperability," says Carlos Montero-Luque, vice president of product management for open platform solutions at Novell.
The kernel patch is available in Suse Linux Enterprise Server (SLES) 10 Service Pack 2, which can be downloaded.
In a paravirtualized environment the guest operating system is modified to work more closely with the underlying hardware and not just with the virtualized environment. It is one of a handful of variants for designing virtual machine environments.
In order to take advantage of paravirtualization, however, an operating system must be specifically ported to run on top of a host system. Novell and VMware have been working on the Suse upgrades for the past nine months.
Novell also has a kernel patch to support paravirtualization of SLES on the Xen hypervisor that SLES uses when it is serving as a host environment.
In addition, Novell has been working with Microsoft in a lab the two opened last September to ensure SLES runs in a paravirtualized mode on top of Windows Hyper-V, which is slated to ship later this summer. The two also are ensuring Windows Server 2008 runs in enlightened mode on top of Novell's Xen hypervisor. Enlightened mode is a Microsoft technology that allows the server to recognize when it is running on top of a hypervisor and then automatically take different avenues to access memory management and IO.
"Regardless of the different environments -- VMware or Hyper-V -- we want SLES to be the best supported, best performing guest operating system," Montero-Luque says."We expect to see mixed environments in the future for a number of reasons and interoperability has been a key part of our strategy."
The upgrade to the Suse Linux Enterprise kernel lets it take advantage of paravirtualization techniques so it runs more efficiently as a guest operating system. Specifically, Novell has built in support for VMware's Virtual Machine Interface (VMI)."The patch to the kernel provides increased performance and better interoperability," says Carlos Montero-Luque, vice president of product management for open platform solutions at Novell.
The kernel patch is available in Suse Linux Enterprise Server (SLES) 10 Service Pack 2, which can be downloaded.
In a paravirtualized environment the guest operating system is modified to work more closely with the underlying hardware and not just with the virtualized environment. It is one of a handful of variants for designing virtual machine environments.
In order to take advantage of paravirtualization, however, an operating system must be specifically ported to run on top of a host system. Novell and VMware have been working on the Suse upgrades for the past nine months.
Novell also has a kernel patch to support paravirtualization of SLES on the Xen hypervisor that SLES uses when it is serving as a host environment.
In addition, Novell has been working with Microsoft in a lab the two opened last September to ensure SLES runs in a paravirtualized mode on top of Windows Hyper-V, which is slated to ship later this summer. The two also are ensuring Windows Server 2008 runs in enlightened mode on top of Novell's Xen hypervisor. Enlightened mode is a Microsoft technology that allows the server to recognize when it is running on top of a hypervisor and then automatically take different avenues to access memory management and IO.
"Regardless of the different environments -- VMware or Hyper-V -- we want SLES to be the best supported, best performing guest operating system," Montero-Luque says."We expect to see mixed environments in the future for a number of reasons and interoperability has been a key part of our strategy."
Subscribe to:
Posts (Atom)