- apple-list - University of Manitoba Mailing Lists

INTEREST: Microsoft Windows Mozilla/Firefox/Thunderbird security issue
by billing 12 Jul '04

12 Jul '04

...from: http://www.mozilla.org/security/shell.html What Mozilla users should know about the shell: protocol security issue On July 7 a security vulnerability affecting browsers for the Windows operating system was reported to mozilla.org by Keith McCanless, and was subsequently posted to Full Disclosure, a public security mailing list. On the same day, the Mozilla security team confirmed the report of this security issue affecting the Mozilla Application Suite, Firefox, and Thunderbird and discussed and developed the fix at Bugzilla bug 250180. We have confirmed that the bug affects only users of Microsoft's Windows operating system. The issue does not affect Linux or Macintosh users. On July 8th, the Mozilla team released a configuration change which resolves this problem by explicitly disabling the use of the shell: external protocol handler. The fix is available in two forms. The first is a small download which will make this configuration adjustment for the user. The second fix is to install the newest full release of each of these products. Instructions on administering these changes can be found below. How to update Mozilla, Firefox and Thunderbird users on Microsoft Windows operating systems should update in one of the following ways. • To install the security patch for Mozilla or Firefox, follow these instructions: 1. Click Install Patch. 2. In the Software Installation window, click the "Install Now" button. 3. Exit and restart your Mozilla or Firefox browser. • To verify the fix in your Firefox or Mozilla application, be sure to restart the browser and then follow these steps: 1. Type about:config into the address field and hit Enter. 2. In the Filter toolbar, type shell. 3. Look for the preference listing network.protocol-handler.external.shell. 4. If you see the preference listed with the value of false then your application has been patched. • To install the security patch for Thunderbird, follow these instructions: 1. Right-click the Patch and choose save link as. 2. Save the file, shellblock.xpi, to your Desktop. 3. In Thunderbird, go to the Tools menu and select the Extensions item. 4. In the resulting Extensions window, click the "Install" button. 5. Use Windows file picker to select the shellblock.xpi file from your Desktop and click OK to dismiss the file picker. 6. Click OK on the Software Installation window. 7. Exit and restart Thunderbird. • To download and install new Mozilla releases releases, follow the instructions below: 1. Download Mozilla 1.7.1 to your Desktop and double-click the mozilla-win32-1.7.1-installer.exe icon. 2. Follow the instructions in the Mozilla Install wizard. 1. Download Firefox 0.9.2 and to your Desktop and double-click the FirefoxSetup-0.9.2.exe icon. 2. Follow the instructions in the Firefox Install wizard. 1. Download Thunderbird 0.7.2 to your Desktop and double-click the ThunderbirdSetup-0.7.2.exe icon. 2. Follow the instructions in the Thunderbird Install wizard. We value our users' safety and security and will continue to make all efforts to release secure products and respond quickly when security vulnerabilities are identified in our software. Future versions of Mozilla Firefox will include automatic update notifications, which will make it even easier for users to be alerted to security fixes. The Mozilla Security Team would like to thank Keith McCanless for the original bug report and test case, and apologize for incorrectly omitting mention of his report in the initial version of this document.

1 0

FYI: Remote Desktop Connection Client for Mac controls Windows
by billing 09 Jul '04

09 Jul '04

...from: http://www.microsoft.com/mac/otherproducts/otherproducts.aspx? pid=remotedesktopclient Remote Desktop Connection Client for Mac Remote Desktop Connection Client for Mac allows you to connect from your Macintosh computer to a Windows-based computer and work with programs and files on that computer. With Remote Desktop Connection Client for Mac, you can: • Access everything available for Microsoft® Windows® from your Macintosh desktop. • Copy and paste information between Macintosh and Windows programs. • Print from Windows programs to the printers connected to your Macintosh. • Use Windows terminal servers to provide groups of Macintosh users in the workplace with access to Windows-only programs. To connect to a Windows-based computer, you need network access and permissions to connect to the computer, and the computer must be running Terminal Services or Remote Desktop Services. The following Windows products support Remote Desktop connections: • Windows XP Professional • Windows Server 2003 • Windows 2000 Server • Windows 2000 Advanced Server • Windows 2000 Datacenter Server • Windows NT® Server 4.0, Terminal Server Edition Download at: http://www.microsoft.com/mac/downloads.aspx?pid=download&location=/mac/ DOWNLOAD/MISC/RDC.xml&secid=80&ssid=9&flgnosysreq=True Last Updated: May 05, 2004

1 0

INTEREST: Macintosh World Wide Developer keynote (Tiger, etc.) and some slides previewing Tiger
by billing 07 Jul '04

07 Jul '04

If you've not yet seen it, the keynote (by Steve Jobs) from the World Wide Developer Conference last week can be viewed at: http://www.apple.com/quicktime/qtv/wwdc04/ Items talked about include Tiger (OS X 10.4) due next year. Also, some slide of what Tiger will look like can be viewed at: http://www.eweek.com/article2/0,1759,1619860,00.asp

1 0

INTEREST: US Army-NASA, UCLA build 1566 and 512 processor supercomputers
by billing 06 Jul '04

06 Jul '04

...from: http://www.colsa.com/cover_page/news_front/news_details/news_details.htm COLSA Corporation of Huntsville, AL and Apple Computer Corporation of Cupertino, CA jointly announce the acquisition of one of the largest and most powerful computers in the world. COLSA has contracted with Apple to deliver for COLSA’s government customer, the Aviation and Missile Research, Development, and Engineering Center (AMRDEC), the components for a supercluster computer system with more than 3000 processors. The system will consist of 1566 dual-processor, rack-mountable Xserve G5 units. These units employ Apple’s new 2.0 GHz G5 CPU, one of the most powerful processors in the new generation of 64-bit computer chips. COLSA will build, install, test, and operate the Apple Computer component supercluster computer system for its Army customer. The new system will be delivered to COLSA’s Hypersonic Missile Technology facility located at its newly renovated Research & Operations Center in Huntsville in June. The supercluster will be employed to model the complex aero-thermodynamics of hypersonic flight, including applications related to missile interceptors and scramjet engine performance. At its peak, the new supercluster has a performance capability of greater than 25 TFlop/s, meaning that it is capable of calculating more than 25 trillion floating point operations per second. A floating point operation, or Flop, represents an arithmetical operation on a pair of numbers and is a standard performance measure for scientific computing. On the basis of this performance capability the system would rank as the one of the most powerful computer on the planet as measured by the TOP500 List (on the net at www.top500.org). On today’s TOP500 listing, the new supercluster would be second only to Japan’s 40 Tflop/s, $350 million dollar Earth Simulator computer. At approximately $5 million dollars for 25 Tflop/s, the system will set a new price-performance standard for high-end scientific computing. The Xserve G5 supercluster system is expected to be on-line and in production for work by COLSA’s Research, Development and Engineering Center (RDEC) customer of the Research, Development and Engineering Command (RDECOM), located at Redstone Arsenal, AL by late Fall of this year. This acquisition is the second phase of a multi year COLSA program to create a center of excellence in Huntsville for computational modeling and simulation. Through the continued efforts of Senator Richard Shelby, (R.), AL, a long term supporter of bringing this advanced capability to Huntsville, the new system will benefit both the U.S. Army and NASA for the National Aerospace Initiative and their research and development objectives. ============================= ...from: http://www.thinksecret.com/news/ucla.html UCLA Plasma Physics to create 256 Xserve G5 cluster July 5, 2004 - By Andrew Feder, Contributing Editor According to officials, UCLA's Plasma Physics Group recently purchased some 256 Xserve G5s and is in the process of building a Virginia Tech-style parallel super computing cluster. The cluster will employ 256 Dual G5 Xserves running Mac OS X Server to form a 512-processor parallel supercomputing cluster. The cluster is being deployed for Plasma Physicist Warren Mori by a team at UCLA Academic Technology Services led by IT Infrastructure manager Bill Labate. The cluster's estimated cost is close to $1 million, which was largely funded by a grant to Mori from the National Science Foundation. Mori proposed the cluster in October 2003, at which point many platforms were evaluated. Xserves running Mac OS X Server proved to be the most cost-effective, straightforward and appropriate choice for the application, plasma physics research. Officials with the "Dawson Project," as it is known, told Think Secret that the cluster is currently under construction and that the Xserves are arriving in groups. The team has been installing the Xserves for the last few weeks, and expects the cluster to be up in running in another couple of weeks as the remainder of the servers arrive. The Dawson team has received some, if not all of its Xserves (pictured below) despite heavy demand and shipping delays on the dual servers. As Think Secret recently reported, Apple is on the verge of quelling the harsh backlog on dual Xserve orders. UCLA Physics is no newcomer to parallel computing with Macs. In 2002 a group working with NASA's Jet Propulsion Laboratory created a parallel computing cluster using 33 dual-processor 1GHz Xserves to achieve over 217 Gigaflops. The cluster used Pooch and MacMPI X, a development of AppleSeed, an ongoing project begun by physics researchers at UCLA in 1998. Earlier this month, the COLSA Corporation announced the building of "Mach 5," a Mac OS-based supercomputer cluster which is expected to be one of the fastest in the world. The cluster is to be made up of 1566 dual-processor Xserve G5 1U rackmounted servers and is expected to perform at over 25 Tflops/seconds. Mach 5 will be used by the US Army, at a cost of $5.8 million, to model the complex aero-thermodynamics of hypersonic flight. Mach 5 is expected to rank as one of the most powerful supercomputers on the planet, according to the June 2004 Top 500 supercomputers list. Mach 5 will rank second to Japan's $350 million Earth Simulator. Although the Plasma Physics Group's cluster pales in comparison to Virginia Tech and COLSA's, it is another step in the right direction for Apple as it vies for market share in the higher education arena. We are beginning to see, albeit slowly, the introduction of Mac OS-based servers into industry, government, and higher education as Apple makes inroads in these deeply sought after markets.

1 0

INTEREST: Gartner Research report: How to Stop the Destructive Overuse of E-Mail; iPods pose security risk for enterprises, Gartner says
by billing 06 Jul '04

06 Jul '04

...from: http://www.umanitoba.ca/ist/gartner/intraweb/research/121200/121276/ 121276.html How to Stop the Destructive Overuse of E-Mail 8 June 2004 Nikos Drakos Maurene Caplan Grey Excessive dependence on e-mail threatens to destroy valuable organizational knowledge. Attention to human factors, usability and flexibility is key to shifting e-mail traffic to appropriate systems. E-mail has become end users' tool of choice for ad hoc communication and carrying out more-complex coordination, collaboration and management activities. Aside from its negative effect on productivity, unchecked e-mail growth will endanger valuable organizational knowledge. To attract users to more-natural, activity-specific alternatives, enterprises must give special attention to human factors, usability and flexibility concerns — especially where alternatives to e-mail are already in place but underused. In the long term, excessive reliance on e-mail is likely to be symptomatic of inflexible business processes. Analysis The ease of use, ubiquity and flexibility of e-mail have made it the most-popular tool for person-to-person communication. But even a casual examination of a typical inbox reveals usage patterns that go far beyond simple communication. E-mail is used for activity coordination and management tasks (for example, scheduling meetings or tracking progress), group discussions and decision making, finding people or distributing information. Furthermore, these e-mail-based collaboration, coordination and discovery patterns typically are present across the spectrum of business processes. [...] Short-Term Remedies for Excessive Dependence on E-Mail Many enterprises have already deployed tools that provide explicit support for common communication, coordination and collaboration patterns — for example, virtual meetings, shared spaces, discussion forums and project management. Such support may be available through specific collaboration products, or as part of a broader intranet or portal deployment. Short-term remedies for excessive e-mail dependence are underused. There are many reasons why users rely too much on e-mail instead of various, more-specific alternatives — but there are just as many tactics and strategies to reverse this overreliance. The first reason for users' aversion to alternative communication and coordination tools is that they're often unaware of such tools and have received inadequate end-user training. This is the place to start remediation. Enterprises are increasingly developing e-mail productivity training programs, which include technologies and usage standards (see "Making E-Mail More Productive"). Any such program should include specific guidelines about when to use e-mail as opposed to alternatives such as instant messaging, Web conferencing or another enterprise communication infrastructure. Training can be delivered via various channels: • Just-in-time training — for example, short videos that can be included as part of the desktop software image • Lists of top-10 e-mail usage standards, distributed to employees on laminated cards • E-mail productivity management training Next, there are important human issues to consider, such as cultivating trust, recognizing and satisfying privacy concerns, and encouraging participation. The last item — encouraging participation — usually requires an enterprise to rethink employee incentives and rewards to overcome natural information-hoarding tendencies, as well as a natural aversion to discipline. Without active leadership, encouragement and appropriate responses to human issues, users will continue to prefer the almost-private world of e-mail. E-mail gives users control over who they trade information with and how, as opposed to other forums or applications in which users lose control of their contributions on submission. This is especially problematic in cases where the rules of engagement (that is, who can access a contribution or what they can do with it) are unclear or not enforced. Trust is a belief system. Enterprises should support communication mechanisms that take an individual's "trust levels" into consideration (see "Choose the Right Communication Channel to Build Trust"). A third reason for users' aversion to alternative communication and coordination tools is the poor usability and inflexibility of alternate e-mail tools. [...] E-mail traffic growth can be one of the obvious symptoms of inflexible or inappropriate business processes that force employees to broadcast or cascade messages to increasingly larger numbers of co-workers. Such bursts of e-mail traffic can be a force for good, however, as long as they're used to identify and rectify a broken process or exploit a new opportunity. Unfortunately, too many enterprises treat only the symptoms (in some extreme cases, they ban the use of e-mail) and fail to recognize the fundamental causes of and appropriate responses to problems. ============================= iPods pose security risk for enterprises, Gartner says By Laura Rohde, IDG News Service July 06, 2004 9:20 am ET The iPod may be popular, but also poses such a major security risk for businesses, that enterprises should seriously consider banning the iPod and other portable storage devices, according to a study by research firm Gartner Inc. The devices, using a Universal Serial Bus (USB) or FireWire (IEEE 1394), present risks to businesses on several fronts: from introducing malicious code into a corporate network, to being used to steal corporate data, the Stamford, Conn.-based research company said in its report "How to Tackle the Threat From Portable Storage Devices," published Friday. The report pointed to a variety of devices, including pocket-sized portable FireWire hard drives, like those from LaCie Group SA or Toshiba Corp., or USB hard drives or keychain drives, such as the DiskOnKey from M-Systems Flash Disk Pioneers Ltd. Gartner also named disk-based MP3 players, like Apple Computer Inc.'s iPod, as a security risk as well as digital cameras with smart media cards, memory sticks and compact flash. Gartner advised companies to forbid employees and external contractors with direct access to corporate networks from using these privately owned devices with corporate PCs. Companies should also consider a "desktop lockdown policy," disabling universal plug and play functions after installing desired drivers, to permit the use of only authorized devices. The report conceded that the devices themselves can be quite useful within corporations, making it "unpractical and counterproductive" to introduce an outright ban. Companies should take a multipronged approach to portable storage devices, Gartner said, including using personal firewalls to limit what can be done on USB ports. The use of products for selectively controlling ports and encrypting data should also be considered, the company said. Additionally, digital rights management technology should also be used by enterprises that want to protect intellectual property, Gartner said.

1 0

FYI: Increase Your Internet Explorer Browsing and Outlook E-Mail Safety
by billing 05 Jul '04

05 Jul '04

If you are using Microsoft's Internet Explorer or Outlook/Express), Microsoft has the following recommendations: ....from: http://www.microsoft.com/security/incident/settings.mspx Increase Your Browsing and E-Mail Safety 4 Steps to Help Ward Off Hackers and Attackers Updated: June 11, 2004 If your computer is part of a managed network, contact your system administrator before making any changes. Malicious hackers and virus writers can take advantage of low security settings in your e-mail and Web browsing software to infect your computer. They can do this by sending you a malicious e-mail message or by enticing you to visit a malicious Web site. By increasing your security settings in Microsoft Internet Explorer, Microsoft Outlook, and Microsoft Outlook Express, you can help limit your chances of being attacked. There are four things you can do right now to increase your security. 1. Set Internet Explorer security level to High 2. Add Web sites you consider safe to Trusted Sites 3. Use plain text to read the e-mail messages you receive 4. Block pop-up windows in your browser ...more details at: http://www.microsoft.com/security/incident/settings.mspx

1 0

INTEREST: Dutch Parliament Withdraws Support for Software Patents
by billing 05 Jul '04

05 Jul '04

...from: http://www.groklaw.net/article.php?story=20040702085542832 Dutch Parliament Withdraws Support for Software Patents Friday, July 02 2004 @ 08:55 AM EDT The Dutch parliament is making news. It has just withdrawn its vote for the Directive on Software Patents. It's a proof-of-concept vote, you might say, the first time such a move has been taken in the history of the EU, demonstrating that other countries are free to do the same, as we reported on June 22. Here is part of the FFI press release. Today, July the 1st, the Dutch Parliament has decided to direct Minister Brinkhorst and Secretary of State van Gennip (Economic Affairs) to withdraw the Dutch vote in support of the Council of Ministers' text for the Directive on Software Patents. This is the first time in the history of the EU that such a course of action has been undertaken. The idea of allowing patents on software has been strongly criticized among SMEs (small medium enterprises), scientists and consumer organisations. They inhibit investments in Research and Development and contribute to higher prices. Commentators also fear the rise of a "lawyers paradise" in Europe such as is found in the USA, where programmers are constantly threatened by lawsuits. This act represents an incisive criticism of the European Council of Ministers' attempts to introduce broad patentability of software. Minister Brinkhorst, acting on behalf of the Netherlands, endorsed the Council's current proposal, which not only reiterated the terms of the Council's strongly criticized first proposal, but went even further, directly rebuffing the clear stance assumed by the EU Parliament, which voted to add numerous amendments which made clear how the category of logical algorithms would be treated. The European Parliament's version asserted that patents would only be allowed for industrial inventions (e.g. washing machines) and would not be made possible for pure software. All these adaptations were removed in the Council of Ministers' controversial version. Earlier, Brinkhorst described the Council proposal to the Dutch Parliament as a compromise with the EP. In recent legislative debates,Van Gennip was forced to admit that this was incorrect information, and attributed it to "an error in the word processor." The Dutch Parliament apparently didn't buy this explanation and today she rendered an historic and groundbreaking decision, calling upon Minister Brinkhorst and van Gennip to withdraw the Netherland's supporting vote in the European Council and convert it to an abstention. This measure is possible because at the present moment there is only a "political agreement" and the "formal vote" can only take place after the contested text has been translated into the 20 European Languages. An emergency brake move in the procedure such as this has never been exercised before. With this decision, the Dutch Parliament demonstrates the active interest her public holds in the debate over software patents, and the recognition and appreciation for the adaptations introduced by the European Parliament. Dieter Van Uytvanck, spokesman of FFII Netherlands, stresses the importance of this decision: "This political signal reaches much further than just The Netherlands. We hope that other European countries that also have their doubts about the proposal of the Council will also withdraw their support, so that the current proposal no longer has a majority. The historic precedent is there now."

1 0

Apologies for inadvertent image inclusion in email
by billing 21 Jun '04

21 Jun '04

My apologies. Because I did a wholesale "copy and paste" of the first article in my message: INTEREST: ICANN surveys proposed Net domains, "Net is moving into Iron Age" ...there were included a couple of access tracking graphics included. I did not realize they were there or I would have cleaned them out before I sent the email. I'll take greater care in cleaning my messages of such unwanted "hitch-hikers" in the future. Wayne

1 0

INTEREST: ICANN surveys proposed Net domains, "Net is moving into Iron Age"
by billing 21 Jun '04

21 Jun '04

...from: http://zdnet.com.com/2100-1104_2-5176438.html?tag=default By Declan McCullagh CNET News.com March 19, 2004, 3:42 PM PT The Internet's real estate may soon be expanding, with the proposed addition of up to nine new top-level domains, including .jobs, .xxx, .travel and .mail. Ten organizations have submitted detailed proposals to the Internet Corporation for Assigned Names and Numbers (ICANN) for the rights to sell the potentially lucrative domain-name suffixes. ICANN, which made the list public on Friday afternoon, has not approved any new top-level domains since adding .biz, .info, and .aero and four others in 2000. The other proposed suffixes include .cat, .post, .asia, .mobi, and .tel. Two groups, New York-based Pulver.com and the U.K's Telname Limited London, are vying for .tel, which places ICANN in the uncomfortable position of judging which company is better qualified to run it. It is unclear how long it will take for ICANN to consider the new top-level domains, and how many will be approved. In a recent interview with CNET News.com, ICANN Chairman Vint Cerf said he has no upper limit in mind. "There is no specific number that has been set for acceptance," Cerf said. "My understanding is that we have not put any limits on the number of applications, and that as applications are qualified, that they would presumably be approved." ICANN plans a public comment period for the proposals over the month of April, followed by submission to an independent evaluation panel in May. The criteria for judging the proposals require that there be broad support for a top-level domain, that it not negatively affect the domain name system (DNS), and that it be financially viable. Each applicant paid $45,000 to ICANN, and proposals were due by March 16. Stuart Lawley, the president of Toronto-based ICM Registry, said he hopes ICANN will approve his request for .xxx so "responsible adult entertainment businesses can go about their business in a less restricted way." ========================================================== ...from: (requires the ability to play Microsoft streaming video) http://zdnet.com.com/1606-2-5239781.html ICANN chairman and MCI Senior Vice President Vint Cerf contends that the Net is still early in its evolution, in the process of moving from a figurative stone age to an iron age. In his Face to Face interview with ZDNet Editor in Chief Dan Farber, Cerf discusses the Internet's future and outlines his views on spam, privacy, IPv6 and interplanetary networking.

1 0

INTEREST: Munich to stick with open source
by billing 18 Jun '04

18 Jun '04

...from: http://zdnet.com.com/2100-1104_2-5237356.html By Jo Best CNET News.com June 17, 2004, 7:19 AM PT Munich, the city whose switch to Linux was seen as so significant it attracted a personal visit from Microsoft CEO Steve Ballmer, has announced that its yearlong trial is a success and that it will stick with open source for its PCs. The change will officially take place on July 1, and 14,000 desktops will permanently migrate to the open-source platform. The pilot was run using Novell's SuSE Linux and IBM products. But the eventual contract--which could be worth tens of millions of euros--will be put out to tender. The city's move to Linux is the biggest migration ever from proprietary software to open source, and it will call for municipal PCs and notebooks to move from Microsoft Office to OpenOffice and to use the Mozilla browser. City officials voted last year to make the change. The decision will doubtless come as a blow to Microsoft, which pulled out all the stops to get the German city to stay with proprietary software. According to a document seen by USA Today, the concessions the software behemoth was prepared to punt Munich's way included undercutting a Linux bid by $12 million, letting Munich license stripped-down versions of Windows, and offering training and support for nothing. The migration is expected to be complete by 2008 or 2009. Earlier this week, Norway's second-largest city, Bergen, announced it would be following in Munich's footsteps and opting to run Linux.

1 0