- apple-list - University of Manitoba Mailing Lists

INTEREST: Unpatched exploit nets 1.4 million Social Sec. Numbers
by billing 25 Oct '04

25 Oct '04

Hack at UC Berkeley Potentially Nets 1.4 Million SSNs By Lisa Vaas October 20, 2004 Hackers took advantage of a known vulnerability on an unpatched computer to potentially gain access to some 1.4 million names, Social Security numbers, telephone numbers, addresses and dates of birth at University of California at Berkeley, officials said Tuesday. The personal data was that of recipients and providers for the state's In Home Supportive Services program, which provides in-home care for elderly people. The data was being used by a researcher, who was studying the impact of wages and benefits paid for by providers and how it impacts the relationship between providers and recipients of in-home care, according to Carlos Ramos, assistant secretary at the California Health and Human Services Agency. [...] ...complete article at: http://www.eweek.com/article2/0,1759,1680799,00.asp

1 0

INTEREST: Apple announces "Tiger" Early Start Kit for Developers; includes pre-release Tiger 10.4
by billing 20 Oct '04

20 Oct '04

Leap ahead with Tiger. Tiger, the next major release of Mac OS X, contains more than 150 breakthrough features, including time-saving APIs and powerful tools to help you pack Tiger innovations into your applications quickly and easily. Get your hands on Tiger now. Start building competitive solutions for Mac OS X with the Tiger Early Start Kit for Developers. Bundled with a year-long ADC Select membership, the Kit provides everything you need to develop for Tiger, including: Pre-release versions of Mac OS X v10.4 "Tiger" and Xcode 2.0. One-on-one engineering consultation to get your application Tiger-ready. A special developer discount on the latest Apple hardware. Order the ADC Select membership and get Tiger Early Start Kit and Tiger training DVD. The Tiger Early Start Kit for Developers includes a free DVD-ROM filled with Tiger session videos from the Apple Worldwide Developers Conference 2004. This disc contains hours of detailed engineering instruction, along with presentation slides and sample code, on essential Tiger development topics. Order your Tiger Early Start Kit to begin development today at: http://developer.apple.com/macosx/tiger/tigerkit.html

1 0

Apple Logic 7 Presentation in Winnipeg
by Doug Hamilton 19 Oct '04

19 Oct '04

Hi Everyone: Apple will be show off what the new version of Logic (http://www.apple.com/logic) is capable of in November. You can see details about this free presentation here: http://www.seminars.apple.com/cgi-bin/WebObjects/ASPRegistration.woa/8/wa/e… While this seminar is free, registration is still required because seating is limited. Regards, Doug ------------- Doug Hamilton, BA, MA, APP Senior Apple Computer Consultant Computers-on-Campus; Univ. of Manitoba 204-474-6196 (Ph.) 204-474-7556 (Fax) http://www.umanitoba.ca/bookstore/

1 0

INTEREST: Financial Post reports "Market braces for Apple's iTunes Canadian Launch"
by wbilling 13 Oct '04

13 Oct '04

...original message from: > Jennifer Hardy > Manager of Administration & Communications > Canadian Recording Industry Association (CRIA) ...article can be found at (FP subscription needed to read complete article at the URL): http://www.canada.com/national/nationalpost/financialpost/story.html? id=db69b6ed-dcec-4029-b3b8-425bbdc194ae Music giant readies Canadian launch Market braces for Apple's download division, iTunes Robert Thompson Financial Post October 13, 2004 ITunes, Apple Computer Inc.'s hugely popular online music service, is gearing up for a Canadian launch that could come as early as next month, music industry sources say. The launch of a Canadian iTunes store would dramatically alter the digital music landscape in Canada. To date, only Puretracks.com, Archambault.ca and Napster.ca have operated in Canada. ITunes, the world's most successful legal downloading service, with 125 million paid downloads in the U.S. since launching in April, 2003, skipped this country earlier this year over copyright issues. In June this year, Apple launched iTunes in Europe, selling 800,000 downloads in its first week. Phil Leigh, an analyst with Inside Digital Media in the U.S., said Apple's iTunes, in conjunction with its iPod MP3 player, now defines legal downloading for many consumers. "ITunes and the iPod have lived up to the hype," said Mr. Leigh, noting Apple controls more than 70% of the digital downloading market in the U.S. An Apple representative has met with Canada's four major recording labels in order to secure songs for the service, sources say. The sources added the launch could be delayed until February if Apple can't get its promotional material prepared in time for next month. Apple's Canadian officials said yesterday they do not comment on rumour. Apple skipped Canada earlier because it could not reach an agreement on royalties with the Canadian Musical Reproduction Rights Agency Ltd., an organization seeking a tariff on digital music sales. But it is now believed Apple will go ahead with its Canadian plans despite the uncertainty over the copyright issue. Mr. Leigh said Apple will likely unleash a marketing blitz to promote an iTunes launch in Canada. "It makes sense for them to be really aggressive in promoting iTunes because it also promotes iPod sales," he said. Alistair Mitchell, co-chief executive of Puretracks.com, the first legal downloading service in Canada (it launched last year) said he has heard rumours of an iTunes launch and has noted an increase in advertising in Canada for the iPod. However, he believes increased interest in digital downloading should be beneficial for Puretracks, which already has partnership arrangements with Bell Canada and Telus Corp. "I think they'll have a great impact on the space because of the money and marketing they bring to the area," Mr. Mitchell said. Mr. Mitchell would not disclose how many downloads Puretracks has had to date. Puretracks.com is owned by Moontaxi Media Inc., Records on Wheels, Key Publishers, Universal Music Canada and EMI Music Canada. Mr. Mitchell said downloads on Puretracks.com are of a higher quality than what iTunes is offering in the United States, a factor he expects consumers will notice. Mr. Mitchell would not say how Puretracks.com plans to respond to the launch of iTunes. "I'll leave that as an element of surprise," he said. "But it'll all be about promoting our quality."

1 0

INTEREST: Security "deperimeterization", Security's disorderly mess
by billing 08 Oct '04

08 Oct '04

Turning IT security on its head Robert Vamosi Senior Editor, Reviews Friday, October 1 For years, corporate IT departments have been told to protect the perimeter of corporate networks with layered defenses, including firewalls. But new technologies such as instant messaging and virtual private networks have poked holes in the perimeter. So, perhaps this thinking is outmoded; maybe we no longer need perimeter security. Speaking at this year's Black Hat Briefings in Las Vegas, Paul Simmonds, Global Information Security Director (CISO) for Jericho Forum/ICI, declared that deperimeterization is the decade's next security challenge, if not the next security buzzword. I happen to think he's onto something, though the changes might not work as he proposes. Are we protecting the data? For example, Simmonds talked about the money-hauling industry (think Brinks armored trucks). What are they trying to secure? Money. How do they do it? They purchase armored trucks, true, but they also design security into the containers used for conveying the money: the containers explode if the money is stolen. In businesses today, we want to secure the data, yet we're locking down entire companies instead. Given that the nature of business has changed in the last few years, this model is outdated. The workforce now includes more temporary employees. We have more services designed to work around the traditional hardened perimeter, such as VoIP, IM, and VPN. And let's not forget that the hard-shell, soft-nugget strategy of corporate IT security has been successfully violated. Living in a post-MSBlast world In recent years, companies have spent millions on their perimeter security and very little on individual desktop security. Last year's MSBlast successfully exploited this flaw, requiring just one infected laptop to cripple entire companies. Yet, companies had to let that one infected laptop into the network because workers are increasingly mobile, working on the road or from home. Companies also allow port 25 e-mail traffic, so there's still the risk of e-mail infections through that chink. And companies have to allow port 80 Internet traffic as well, laying them open to the threat of infected Web pages. ...complete article at: http://reviews-zdnet.com.com/4520-7297_16-5534252-1.html?tag=nl.e540-2 ================================ ...from: http://news.zdnet.com/2100-9595_22-5305167.html Security's disorderly mess By Jon Oltsik Special to ZDNet August 11, 2004, 5:02 AM PT [...] Imagine a security perimeter composed of a Cisco PIX firewall, McAfee antivirus software, Websense content filtering, a Blue Coat Systems proxy server and an Internet Security Systems intrusion detection system--along with the accompanying 5 different servers, associated costs and sundry operational challenges. Since failure on any one of these boxes can halt network traffic, security systems often get purchased and configured in redundant pairs. The whole security ensemble is often accompanied by load-balancing switches from Cisco Systems, Nortel Networks and F5 Networks that divvy up the work across all of the security systems to ensure maximum performance. See what I mean about complexity? One security professional summed up his frustration this way: "Our perimeter security is difficult to manage, expensive to run and impossible to troubleshoot!" As if security costs and operations weren't bad enough, today's perimeter mess results in a few other big problems. Ironically, security complexity actually introduces security issues. With so many boxes to manage, the chances of a vulnerable or incorrectly configured system dramatically increase the potential for security holes. Finally, security complications restrict business flexibility. Firms want to open up their networks to customers, business partners and suppliers to increase revenue opportunities and productivity. I'd hate to be the security guy who has to tell the CEO that the company can't accommodate the new business initiative because of some security configuration issue. Security just can't be about boxes; it has to be regarded as a business service. [...]

1 0

INTEREST: Kodak Rules in Java Patent Dispute
by billing 04 Oct '04

04 Oct '04

...from: http://www.eweek.com/article2/0,1759,1666237,00.asp Jury Rules for Kodak in Java Patent Dispute By Darryl K. Taft October 4, 2004 Eastman Kodak Co. won the first round of a Java lawsuit against Sun Microsystems Inc. that could impact Sun's bottom line and possibly threaten Microsoft's .Net platform. A Rochester, N.Y., jury found Friday that Sun infringed on Kodak's patents when it created Java and released the technology in 1995. Kodak is based in Rochester and is the city's largest employer. At issue are three patents that Kodak inherited when it acquired Wang Laboratories Inc. in 1997. Kodak claims that Java infringes on parts of the three patents. "Kodak has made and continues to make substantial technology investments to ensure high-quality products," said James Blamphin, a spokesman for the company. "We are pleased that the court has validated our intellectual property rights protecting these valuable innovations for the benefit of our customers and shareholders." One of the patents at issue indicates a means by which "two processes that are to cooperate in a data-interchange operation identify each other, and to identify data formats they have in common." And some observers say that, taken broadly, the same patents might be used to claim infringement by Microsoft's .Net platform. Sun denied that it infringed on the Kodak patents during a three-week trial, and it will likely appeal the judgment. But this week, the trial will enter the penalties phase, where both sides will argue over what penalty should be imposed on Sun. Kodak is seeking more than $1 billion in damages. Sun intends to vigorously defend its intellectual property, company spokeswoman May Petry said in a statement. "We are disappointed with the federal jury's decision and are examining our options as we prepare for the liability phase of a two-phase jury trial," the statement said. "We intend to put on a vigorous defense and hope to reach a decision that will be in the best interest of shareholders, customers and Sun. We will also continue to vigorously protect and defend our IP when appropriate." Rick Ross, president of Javalobby.org, said the case is far from over. "I was surprised that it was litigated so quickly, but maybe the real battle will happen in the court of appeals," said Ross, who testified for Sun in its antitrust suit against Microsoft that was settled earlier this year. "And if Kodak prevails, then Kodak could possibly become the new Unisys, who held the entire Internet potentially liable for its patents on the LZW [Lempel-Ziv-Welch] compression that was used in the GIF image format." Added Ross: "This could also get a public response similar to the Eolas patent case against Microsoft, because now the public has tuned in to the ominously broad scope of the Kodak claims, and we may see a general effort to demonstrate prior art and attack the validity of the Kodak patents in question." Sources said both sides of the suit have been meeting with the judge to determine how the next phase will play out. Kodak said it placed the value of its damages at more than $1 billion because that represents half of Sun's operating profit from systems sold between 1998 and 2001. The company is not seeking any kind of ownership claims regarding Java. "We use Java and we will continue to use Java," Blamphin said. ===================================

1 0

FYI: 15-inch PowerBook G4 Display Repair program
by billing 04 Oct '04

04 Oct '04

...from the FAQ at: http://www.apple.com/support/powerbook/displayprogram/ September 24, 2004 What is the 15-inch PowerBook G4 Display Repair Extension Program? A limited number of 15-inch PowerBook G4 computers exhibit a display issue which may cause faint white spots to appear on the screen over time. The 15-inch PowerBook G4 Repair Extension Program is a worldwide program covering replacement of LCDs that exhibit these white spots. Your PowerBook G4 serial number must fall between one of two serial number ranges: ▪ V7334xxxxxx to V7345xxxxxx ▪ QT331xxxxxx to QT339xxxxxx NOTE: this repair may apply to factory refurbished machines whose serial numbers do not fall into the above range but if you call Apple's support number (as listed on the above web page) and have the white spots issue they should be able to correlate the refurbished serial number to the original serial number. Factory-refurbished PowerBooks are eligible for this program. These computers were manufactured from July 2003 through November 2003. PowerBooks with the serial numbers listed above may be referred to as: ▪ PowerBook G4 15-inch Aluminum (1GHz G4 or 1.25GHz G4) ▪ PowerBook G4 Titanium (867MHz G4 or 1GHz G4) How can I tell if my computer exhibits “white spots”? To determine whether your 15-inch PowerBook G4 exhibits “white spots”, follow the instructions on the above web page.

1 0

FYI: US-CERT Vulnerability in Microsoft Image Processing Component
by billing 14 Sep '04

14 Sep '04

NOTE: the end of this message an additional list of environments/applications that could be affected by this vulnerability: --------------------------------------------------------------- From: alerts(a)us-cert.gov Subject: US-CERT Cyber Security Alert SA04-258A -- Vulnerability in Microsoft Image Processing Component Date: September 14, 2004 6:18:58 PM GMT-05:00 To: alerts(a)us-cert.gov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cyber Security Alert SA04-258A Vulnerability in Microsoft Image Processing Component Original release date: September 14, 2004 Last revised: -- Source: US-CERT Systems Affected * Applications that process JPEG images on Microsoft Windows, including but not limited to * Internet Explorer * Microsoft Office * Microsoft Visual Studio * Picture It! * Applications from other vendors besides Microsoft Overview An attacker may be able to gain control of your computer by taking advantage of the way some programs process the JPEG image format. Solution Apply a patch Microsoft has issued updates to address the problem. Obtain the appropriate update from Windows Update and from Office Update. Note: You may need to install multiple patches depending what software you have on your computer. Use caution with email attachments Never open unexpected email attachments. Before opening an attachment, save it to a disk and scan it with anti-virus software. Make sure to turn off the option to automatically download attachments. View email messages in plain text Email programs like Outlook and Outlook Express interpret HTML code the same way that Internet Explorer does. Attackers may be able to take advantage of that by sending malicious HTML-formatted email messages. Maintain updated anti-virus software It is important that you use anti-virus software and keep it up to date. Most anti-virus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many anti-virus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible. Description Microsoft Windows Graphics Device Interface (GDI+) is used to display information on screens and printers, including JPEG image files. An attacker could execute arbitrary code on a vulnerable system if the user opens a malicious JPEG file via applications such as a web browser, email program, internet chat program, or via email attachment. Any application that uses GDI+ to process JPEG image files is vulnerable to this type of attack. This vulnerability also affects products from companies other than Microsoft. References * September 2004 Security Update for JPEG Processing (GDI+) - <http://www.microsoft.com/security/bulletins/200409_jpeg.mspx> * US-CERT Vulnerability Note VU#297462 - <http://www.kb.cert.org/vuls/id/297462> _________________________________________________________________ Author: Mindi McDowell. Feedback can be directed to US-CERT, at "US-CERT Security Alerts" at <mailto:cert@cert.org>. Please include the Subject line "SA04-258A Feedback VU#297462". _________________________________________________________________ Copyright 2004 Carnegie Mellon University. Terms of use: <http://www.us-cert.gov/legal.html> This document is available from <http://www.us-cert.gov/cas/alerts/SA04-258A.html> Revision History September 14, 2004: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFBR3B1XlvNRxAkFWARAtRbAJ9FRO0XqiiEMNjjwGoTBpox2wJqWgCg1YzJ 8JEt8xDHp6Gm5LXjI8y0uOU= =ehyf -----END PGP SIGNATURE----- MS04-028 - Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) - Affected Software: - Windows XP and Windows XP Service Pack 1 - Windows XP 64-Bit Edition Service Pack 1 - Windows XP 64-Bit Edition Version 2003 - Windows Server 2003 - Windows Server 2003 64-Bit Edition - Office 2003 - Office XP Service Pack 3 - Visio 2003 (All versions) - Visio 2002 Service Pack 2 (All versions) - Project 2003 (All versions) - Project 2002 Service Pack 1 (All versions) - Review bulletin MS04-O28 for information about these affected operating systems and applications: - Windows NT Workstation 4.0 Service Pack 6a - Windows NT Server 4.0 Service Pack 6a - Windows NT Server 4.0 Terminal Server Edition Service Pack 6 - Windows 2000 Service Pack 2 - Windows 2000 Service Pack 3 - Windows 2000 Service Pack 4 - The Microsoft .NET Framework, version 1.0 - The Microsoft .NET Framework, version 1.1 - Internet Explorer 6 Service Pack 1 - Picture It! 2002 (All versions) - Greetings 2002 - Picture It! version 7.0 (All versions) - Digital Image Pro version 7.0 - Picture It! version 9 (All versions) Including Picture It! Library) - Digital Image Pro version 9 - Digital Image Suite version 9 - Producer for Microsoft Office PowerPoint (All versions) - Visual Studio 2003 .NET - Visual Basic .NET Standard 2003 - Visual C# .NET Standard 2003 - Visual C++ .NET Standard 2003 - Visual J# .NET Standard 2003 - Visual Studio 2002 .NET - Visual Basic .NET Standard 2002 - Visual C# .NET Standard 2002 - Visual C++ .NET Standard 2002 - The Microsoft .NET Framework, version 1.0 SDK - Platform SDK Redistributable: GDI+ - Review the FAQ section of bulletin MS04-O28 for information about these operating systems: - Microsoft Windows 98 - Microsoft Windows 98 Second Edition (SE) - Microsoft Windows Millennium Edition (ME) - Impact: Remote Code Execution - Version Number: 1.0 Important Security Bulletins ============================ MS04-027 - Vulnerability in WordPerfect Converter Could Allow Code Execution (884933) - Affected Software: - Office 2003 - Office XP Service Pack 3 - Office 2000 Service Pack 3 - Works Suite (All versions) - Impact: Remote Code Execution - Version Number: 1.0

1 0

INTEREST: computational fluid dynamics software (GridGEN & FieldView) for OSX
by billing 07 Sep '04

07 Sep '04

...from: http://www.pointwise.com/ http://www.pointwise.com/pr/04-08.shtml http://www.ilight.com/ http://www.macworld.com/news/2004/09/07/cfd/index.php/?lsrc=mcrss-0904 new CFD tools coming to Mac OS X By Brad Cook bcook(a)maccentral.com Pointwise Inc. and Intelligent Light made a joint announcement on Tuesday that their computational fluid dynamics (CFD) tools Gridgen and Fieldview will soon become available for Mac OS X. The companies cited their NASA customers who have moved to the Mac as the impetus for porting the two applications. Pointwise's Gridgen software enables engineers and scientists to generate meshes used to create 3D models while Intelligent Light's Fieldview supplies the post-processing tools needed to interpret the results of tests applied to such models. Neither company offered precise availability dates for the applications, nor had either of them updated their Web sites with system requirements and other information for the Mac OS X versions of the software. Contact Pointwise and Intelligent Light for pricing information. Fieldview examples: http://www.ilight.com/animations/fish4_small.mpg (41k) - This movie shows periodic wake shedding in proximity of a swimming fish, and was visualized with FIELDVIEW. The work was created by Tim Warburton of Brown University http://www.ilight.com/animations/matsu.mpeg (847Kb) - This animation shows the cross flow from an impeller. - Data courtesy of Matsushita Electric Industrial Co., Ltd. ...more at: http://www.ilight.com/raps.htm

1 0

OS X (10.2.x and 10.3.x) Security Update 2004-09-07
by billing 07 Sep '04

07 Sep '04

...from: http://docs.info.apple.com/article.html?artnum=61798 Security Update 2004-09-07 This Security Update is available for the following system versions: - Mac OS X 10.3.4 - Mac OS X 10.3.5 - Mac OS X Server 10.3.4 - Mac OS X Server 10.3.5 - Mac OS X 10.2.8 - Mac OS X Server 10.2.8 Summary: Apple on Tuesday released Security Update 2004-09-07 delivering a number of security enhancements. The update, which is recommended for all users, updates the CoreFoundation; IPSec; Kerberos; libpcap; lukemftpd; NetworkConfig; OpenLDAP; OpenSSH; PPPDialer; rsync; Safari; and tcpdump. The update is available via the Software Update control panel. Details available at: http://docs.info.apple.com/article.html?artnum=61798

1 0