- apple-list - University of Manitoba Mailing Lists

INTEREST: Spam Moves to Cellphones and Gets More Invasive
by billing 11 May '08

11 May '08

...from: http://www.nytimes.com/2008/05/10/technology/10spam.html?th&emc=th Spam Moves to Cellphones and Gets More Invasive Christopher Capozziello for The New York Times By LAURA M. HOLSON Published: May 10, 2008 If you thought spam on your computer was a bother, brace yourself: spammers want to find you on your cellphone. Cellphones have become consumers’ most personal technological devices. Some industry executives, along with consumer groups and security experts, are concerned that unwanted text messages on phones will be an even greater headache than unwanted computer messages. Cellphone spam is particularly annoying to its recipients because it is more invasive — announcing itself with a beep — and can be costly. Taber Lightfoot, an assistant director for new media at the Yale School of Management, is among those who have paid for the privilege of receiving cellphone spam. “I was at work and I got so annoyed,” she said of the first burst of three messages she received. She got another burst two days later. “That is when I called Verizon and demanded they reimburse me $1.60 for eight text messages,” Ms. Lightfoot said. “It wasn’t a lot of money, but it was my money.” American consumers are expected to receive an estimated 1.5 billion unsolicited text messages in 2008, according to Ferris Research, based in San Francisco, which tracks mobile messaging trends. That is nearly double what they received in 2006. Of course that is a small percentage of the overall number of messages: an industry survey showed that consumers in the United States sent and received about 48 billion text messages in December alone. But for many people who are charged as much as 20 cents for an incoming message or are interrupted in the middle of dinner, even one is too many. “The reason this really burns people up is because they have to pay for messages they don’t want, and they shouldn’t have to,” said Chris Murray, senior counsel for Consumers Union, a nonprofit group. Now some consumers, like Ms. Lightfoot, are monitoring their cellphones more aggressively for unwanted messages and, in some cases, demanding refunds. Computer security companies have developed products to help fight mobile spam. And AT&T, Verizon and others are making it easier for customers to block unsolicited messages and keep spammers at bay. The fees that customers pay to receive messages are a source of profit for the phone companies. It is hard to estimate how much they make. Many consumers pay for a monthly plan that allows them to send and receive large numbers of messages. But for those without a plan, getting as few as 10 unsolicited text messages a month at 20 cents each would cost an extra $24 a year. Communications companies say they are not interested in spam as a profit center. They want to one day exploit the power of customized advertising on mobile phones, and tawdry spam pitches threaten to make their customers hostile toward all commercial messages. The companies are trying to head off the problem before consumers revolt. The carriers regularly adjust spam filters to block offending messages. At Sprint, more than 65 percent of all text messages sent over its network are identified and blocked as spam before they reach customers. The companies use legal weapons as well. Verizon said it had filed eight lawsuits against spammers since 2004. “Even if Verizon or AT&T are not the ones sending text messages to customers, there is the perception that the operator is to blame,” said Seamus McAteer, a senior analyst at M:Metrics, which tracks mobile phone advertising. “It is not in the companies’ best interest to have customers calling and complaining about their bills all the time.” Ralph de la Vega, chief executive of AT&T’s wireless unit, said wireless companies recently agreed to quickly share information about the sources of spam to fight it more effectively. Most phone spam is actually e-mail that comes through gateways linking the Internet and cellphone networks, industry executives said. Most wireless phones have a dedicated e-mail address. At AT&T, for example, it is a customer’s cellphone number followed by @text.att.net. Using computers, spammers create millions of possible number combinations, then send messages to those addresses. One day in March, Anthony Melone, Verizon Wireless’s chief technology officer, began getting complaints from customers in the Northeast and Midwest about a wave of unsolicited text messages that were flooding its network. Mr. Melone said Verizon technicians tracked down the source and found the messages were coming from someone using e-mail accounts at Microsoft’s Internet portal, msn.com. It took a day to quell the assault because the spammers kept changing their e-mail addresses and the Web sites they were promoting. By then, nearly five million messages had made it past the network’s anti-spam filters, resulting in grumbling and demands for refunds from customers like Ms. Lightfoot. “Even when you find them, spammers know how to keep it below the radar,” Mr. Melone said. Christopher Siracusa, a 24-year-old medical student in Brooklyn, said he gets about one or two spam messages a week, usually from pornographic sites with come-ons like, “Hey Sweetie, we talked last night.” As a result, he disregards any text message from a number not programmed into his cellphone. This, though, has caused miscommunication more than once with people he actually wanted to reach. Recently, he said, he got a text message from a female friend who wrote, “I have a new number, call me.” Mr. Siracusa did not, thinking the message was spam, and he later had to explain the problem to her. But inconvenience is not the only downside; there is also the threat of viruses as phones become more like personal computers. Some companies are already preparing for this. Last winter, Symantec, a maker of security software, introduced a product for smartphones that connect with the Internet to detect mobile threats, check for viruses and automatically delete spam or corral suspect texts in a folder. Khoi Nguyen, a product manager for mobile security at Symantec, said the company developed the software mainly for Asia and Europe, where creative spammers try to steal credit card information or banking data through phones. He said he expected to see the same trend here in the next 6 to 12 months. “There has been a transition from annoying spam to threatening spam,” he said. Michael Zaruba, an AT&T customer who works in Chicago as an editor and producer, recently received unsolicited texts from “Rose,” asking him to visit a Web site. He said he did not visit the site, but it made him question whether his 12-year-old brother, who just got a new cellphone, would. “Nowadays phones come equipped with access to the Internet,” Mr. Zaruba said. “It’s another way to mess with your computer. I can see people getting viruses on their phones.” All major communications companies give consumers the ability to thwart spam by changing the easily guessed e-mail addresses for their phones, or completely blocking messages coming from the Internet. They can do this by logging onto the company’s Web site and changing their preferences. “I did that six months ago and I have not received any spam,” Mr. Melone of Verizon said. “No one, not even me, wants their cellphone to ring at 2 in the morning.”

1 0

INTEREST: Microhoo (Yasoft?) not to be
by billing 04 May '08

04 May '08

Just to bring you up to speed if you haven't already heard. Some months back, Microsoft (http://www.microsoft.com) made an unsolicited bid to purchse Yahoo! (http://www.yahoo.com). At the time, Microsoft's CEO Steve Ballmer described the move this way, "“We have great respect for Yahoo!, and together we can offer an increasingly exciting set of solutions for consumers, publishers and advertisers while becoming better positioned to compete in the online services market.” “Our lives, our businesses, and even our society have been progressively transformed by the Web, and Yahoo! has played a pioneering role by building compelling, high-scale services and infrastructure,” said Ray Ozzie, chief software architect at Microsoft. “The combination of these two great teams would enable us to jointly deliver a broad range of new experiences to our customers that neither of us would have achieved on our own.” “The combined assets and strong services focus of these two companies will enable us to achieve scale economics while reaching R&D critical mass to deliver innovation breakthroughs,” said Kevin Johnson, president of the Platforms & Services Division of Microsoft. “The industry will be well served by having more than one strong player, offering more value and real choice to advertisers, publishers and consumers.” Indeed, the letter that was sent from the Microsoft Board of Directors to the Yahoo! Board of Directors includes, "In late 2006 and early 2007, we jointly explored a broad range of ways in which our two companies might work together. These discussions were based on a vision that the online businesses of Microsoft and Yahoo! should be aligned in some way to create a more effective competitor in the online marketplace. We discussed a number of alternatives ranging from commercial partnerships to a merger proposal, which you rejected. While a commercial partnership may have made sense at one time, Microsoft believes that the only alternative now is the combination of Microsoft and Yahoo! that we are proposing." After much to'ing-and-fro'ing by the two companies, Yahoo!'s April 7th response, however, was an unencouraging, "We consider your threat to commence an unsolicited offer and proxy contest to displace our independent board members to be counterproductive and inconsistent with your stated objective of a friendly transaction", in a reply to the Microsoft Board, while also saying Yahoo! is open to a deal but only at a higher price. Yahoo's letter also said Microsoft had not responded to requests for more information on antitrust issues since a deal would be subject to regulators: "To date, you have still not provided any of the requested information." (http://www.infoworld.com/article/08/04/07/Yahoo-again-rebuffs-Microsoft-in-… ) On Saturday (May 3, 200) Microsoft pulled the plug on the deal: ...from: http://www.engadget.com/2008/05/03/microsoft-pulls-bid-for-yahoo/ Microsoft pulls bid for Yahoo! Microhoo will never be by Ryan Block, posted May 3rd 2008 at 8:33PM Well, that's that! Microsoft has officially pulled its bid for Yahoo! -- inflated for good measure this weekend by another $5 billion -- after the company did "not move toward accepting [the] offer", asking again for even more, another $4 bil (totaling $9b more than the original offer). In a letter from [Microsoft CEO Steve] Ballmer to [Yahoo! CEO Jerry] Yang, he states that Microsoft also won't be looking at its option for a hostile takeover, stating that Yahoo! likely "would take steps that would make [it] undesirable as an acquisition"; Ballmer then goes on to make a few backhanded criticisms of Yahoo's possible new partnerships with Google (which is no surprise). Good night, Microhoo, the monstrous, hamstrung, lumbering mega-merger that might have been. Update: Yahoo! makes its public response here. Yang sums it up: "With the distraction of Microsoft's unsolicited proposal now behind us, we will be able to focus all of our energies..." etc. Alright then.

1 0

INTEREST: Warning on Storage of Health Records
by billing 17 Apr '08

17 Apr '08

...from: http://www.nytimes.com/2008/04/17/business/17record.html?th&emc=th Warning on Storage of Health Records By STEVE LOHR Published: April 17, 2008 In an article in The New England Journal of Medicine, two leading researchers warn that the entry of big companies like Microsoft andGoogle into the field of personal health records could drastically alter the practice of clinical research and raise new challenges to the privacy of patient records. The authors, Dr. Kenneth D. Mandl and Dr. Isaac S. Kohane, are longtime proponents of the benefits of electronic patient records to improve care and help individuals make smarter health decisions. But their concern, stated in the article published Wednesday and in an interview, is that the medical profession and policy makers have not begun to grapple with the implications of companies like Microsoft and Google becoming the hosts for vast stores of patient information. The arrival of these new corporate entrants, the authors write, promises to bring “a seismic change” in the control and stewardship of patient information. Today, most patient records remain within the health system — in doctors’ offices,hospitals, clinics, health maintenance organizations and pharmacy networks. Federal regulations govern how personal information can be shared among health institutions and insurers, and the rules restrict how such information can be mined for medical research. One requirement is that researchers have no access to individual patients’ identities. Under the current system, individuals can request their own health records, but it is often a cumbersome process because information is scattered across several institutions. As part of a push toward greater individual control of health information, Microsoft and Google have recently begun offering Web- based personal health records. The journal article’s authors describe a new “personalized, health information economy” in which consumers tell physicians, hospitals and other providers what information to send into their personal records, stored by Microsoft or Google. It is the individual who decides with whom to share that information and under what terms. But Microsoft and Google, the authors note, are not bound by the privacy restrictions of the Health Insurance Portability and Accountability Act, or Hipaa, the main law that regulates personal data handling and patient privacy. Hipaa, enacted in 1996, did not anticipate Web-based health records systems like the ones Microsoft and Google now offer. The authors say that consumer control of personal data under the new, unregulated Web systems could open the door to all kinds of marketing and false advertising from parties eager for valuable patient information. Despite their warnings, Dr. Mandl and Dr. Kohane are enthusiastic about the potential benefits of Web-based personal health records, including a patient population of better-informed, more personally responsible health consumers. “In very short order, a few large companies could hold larger patient databases than any clinical research center anywhere,” Dr. Mandl said in an interview. But the authors see a need for safeguards, suggesting a mixture of federal regulation — perhaps extending Hipaa to online patient record hosts — contract relationships, certification standards and consumer education programs. “I’m a great believer in patient autonomy in general, but there is going to have to be some measure of limited paternalism,” Dr. Kohane said in an interview. Peter Neupert, the vice president in charge of Microsoft’s health group, said that he admired the authors and that they raised some important issues. But he resisted the suggestion of extending Hipaa to newcomers like Microsoft and Google. “Philosophically and politically, I am skeptical of the concept of paternalism,” Mr. Neupert said in an e-mail response to the article, which he was sent, and to the authors’ comments. “It never turns out to be ‘limited.’ ” Designing a health records system that clearly informs consumers and requires their consent for data use is the better approach, Mr. Neupert said. “We have to earn the consumer’s trust for our brand,” he said. “So I can imagine a scenario where we have a third party verify that our system works the way we assert it does,” much as an auditor reviews a company’s financial reporting. Dr. Mandl and Dr. Kohane are physicians and researchers at Children’s Hospital Boston, the primary pediatric teaching hospital of the Harvard Medical School.

1 0

INTEREST: Net Neutrality
by billing 17 Apr '08

17 Apr '08

What is it? - long answer: http://en.wikipedia.org/wiki/Network_neutrality http://www.youtube.com/watch?v=l9jHOn0EW8U - short answer: In a "neutral" Internet the infrastructure owners do not differentiate one packet of information from another either by content, source, or destination. Neither is there a restriction on the type of device that can be connected to the Internet. Without this neutrality, infrastructure owners can give higher priority to certain packets and charge differential fees for each packet depending upon the contents, source, or destination of that packet. Differential fees could also be applied to the type of computer you connect in a non- neutral Internet. A "non-neutral" infrastructure is what is now found in the cell phone networks. The more you pay the more you are entitled to talk on them. There are also additional fees for the type of information and how much of it you send on the cell network: voice, SMS messaging, data, etc are all charged differently. There are also different fees for day and night cell service. A "neutral" infrastructure is your traditional telephone service. You pay one monthly fee (the same fee, pretty much, as everyone else) and you can talk 24x7 without it costing you more. In addition, you can connect your computer (over the older modems) and transfer data over that phone line and that also costs nothing more for the use of the telephone line. - - - - - - - - - - - - - Bell Canada seeking to create "non-neutral" Internet structure in Canada: ...from: http://www.winnipegfreepress.com/canada/story/4161642p-4748665c.html Bell seeking to curb heavy bandwidth use By: Sarah Schmidt OTTAWA -- Bell Canada says it is downgrading the Internet services of bandwidth hogs in the public interest, and is asking the Canadian Radio-television and Telecommunications Commission to toss out a landmark complaint by competitors alleging the telecom giant is regulating the web in its own interests. [...] The practice, known as "traffic shaping" or "traffic throttling," is part of a new billing system by telecom giants based on usage instead of connection speed. In addition to penalizing heavy bandwidth users with hefty charges and slower service at peak times, Bell is lifting a cap on over-usage charges for all its Internet customers. Last month, Bell informed smaller Internet service providers that it was bringing traffic-shaping to the network space it sells to them, effectively downgrading the services these smaller companies are able to provide to their customers. The association, which represents over 50 smaller companies, replied with a complaint to the CRTC, saying Bell's use of "deep packet inspection" technology to "choke" the traffic of its customers is illegal and tantamount to anti-competitive behaviour. Technology expert Jesse Hirsch says Bell's argument before the CRTC is bewildering -- and bad news for consumers. He says Bell is acknowledging it failed to anticipate the growth of the Internet, and is now penalizing innovative users who are turning to the web to swap TV shows and movies. [...] In its brief to the CRTC, Bell says the "balance of convenience" supports its new traffic shaping. - - - - - - - - - - - - ...from: http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/04/16/EDM11064UL.DTL Public must fight to maintain net neutrality Lawrence Lessig - Stanford University, Ben Scott www.freepress.net Thursday, April 17, 2008 The Internet is an engine of economic growth and innovation because of a simple principle: net neutrality, which assures innovators that their next great idea will be available to consumers, regardless of what the network owners think about it. No previous mass media technology has been so remarkably open. Traditional media - newspapers, radio, TV - have gatekeepers standing between consumers and producers, with the power to control content. The Internet eliminates the gatekeeper. Now, however, the Internet's unprecedented openness is in jeopardy. Comcast, AT&T and Verizon have been lobbying to kill net neutrality. They say they won't build an information superhighway if they can't build it as a closed system. No other industrialized country has made that devil's bargain, and neither should we. Without net neutrality, online innovation is vulnerable to the whims of cable and phone companies, which control 99 percent of the household market for high- speed Internet access. And Silicon Valley venture capitalists are unlikely to bet the farm on a whim. Network owners say the threat of abuse is hypothetical. But actions speak louder than words. Last fall, Comcast was caught secretly blocking popular technologies that can bring HDTV to your laptop - used by everyone from the Hollywood studios to NASA. It was no coincidence: Comcast is targeting a growing competitor to its cable TV service. In response, the media reform group Free Press and a coalition of public interest organizations and legal scholars filed a complaint with the Federal Communications Commission calling for urgent action. This is a bellwether case - a signal of whether we're headed toward an open or a closed Internet. After the FCC started an investigation, Comcast admitted to blocking, but thumbed its noses at the government and the public - going so far as to hire seat-fillers at an FCC hearing at Harvard University to stifle the debate. Public, government and media scrutiny ultimately forced Comcast to stop blocking one of the file-sharing companies. But we can't expect everyone to negotiate a side deal for permission to innovate. This limits the online marketplace to ideas and commerce that don't pose a threat to network owners - a chilling prospect. This type of behavior shows why we can't trust the future of the Internet to these companies. Just two years ago, telecom executives went before Congress vowing never to interfere with the open Internet. Their broken promises are exactly why we need net neutrality laws back on the books. Fortunately, members of Congress from both parties have introduced legislation that would do precisely that. But net neutrality is just the first step. If this nation is to return to the economic growth of the 1990s, it takes a renewed commitment to Internet deployment and technology. The past eight years have seen America fall behind other industrial nations - a deficit that we will pay for in jobs, wealth and social opportunity. Better policies in other countries have created a competitive high- speed broadband market. But these policies require political leadership - and public pressure to ensure that politicians aren't distracted by the telecom industry's cash and clout. Today, the FCC is holding a hearing at Stanford University - the birthplace of our Internet economy - to give the public a chance to weigh in on this debate. It's not often that federal regulators leave the Beltway to ask people what they think. It's time to stand up and make your voice heard. The threat posed by would-be gatekeepers is real and getting worse. The success of future innovation depends on an open Internet for everyone. Lawrence Lessig is a law professor at Stanford University and founder of the Center for Internet and Society. Ben Scott is policy director of Free Press, the national, nonpartisan media reform organization ( www.freepress.net ). The FCC hearing will be held at Stanford University's Dinkelspiel Auditorium today from noon to 7 p.m.

1 0

FYI: Safe financial sites in Canada? Don't bank on it.
by billing 14 Apr '08

14 Apr '08

...from: http://www.winnipegfreepress.com/canada/story/4157473p-4745347c.html Safe financial sites? Don't bank on it Study finds banks misleading customers Guarantees giving users a false sense of security By: Sarah Schmidt Updated: April 10 at 02:00 AM CDT OTTAWA -- Canadian banks mislead their customers about the safety of online banking in their marketing materials and give users a false sense of security with a refund guarantee if hackers raid their accounts, a leading software-security expert concludes in a new study. Paul Van Oorschot, Canada Research Chair in Network and Software Security at Carleton University, and PhD student Mohammad Mannan, a specialist in Internet security, tested the standard banking claim of a "100 per cent online security guarantee" against the fine print that makes it conditional on fulfilling complicated security requirements. The researchers opened up bank accounts at Canada's five major banks and one online bank, and surveyed 123 technically advanced users, mainly computer-science students, professors and security researchers. Most in the survey are more security-aware than average customers, and still failed to satisfy common security requirements. Expecting average people to meet them is "extremely naive," they write. "We conclude that most average users are ineligible for the 100 per cent reimbursement guarantee banks assert, and doing online banking with 'confidence' and 'peace of mind' is no more than a marketing slogan which misleads users." They found that despite strong recommendations about password uniqueness, most banks allow weak passwords, such as "123456" and "111111." In one case, RBC listed "iwthyh," an acronym for the Beatles' song I want to hold your hand, as an example of a "rock-solid" password, even though it doesn't meet RBC's password length requirement of eight characters. The researchers also found weaknesses in banks' Secure Sockets Layer, a protocol for transmitting private documents known as SSL certificates. Software designed to infiltrate or damage a computer system without the owner's knowledge, known as malware, can easily access all user information, including on SSL-protected sites, the study says. The researchers also point out that malware can replace a bookmarked login URL with a phishing site URL that masquerades as the bank. And increasingly, phishing sites include SSL certificates to gain the confidenc of users. Meanwhile, most banks' customer agreements require users to install and maintain up-to-date copies of anti-virus, firewall and anti- spyware programs. The survey of 123 tech-savvy users found fewer than half reported using anti-spyware on computers used for banking, and more than a quarter do not use anti-virus software. Ten per cent do not use any firewall. Further, 65 per cent of users didn't read the banking agreements when they signed on to online banking and 85 per cent couldn't name any conditions for being eligible for the 100 per cent reimbursement in the case of hacking. "Banks advertise that users can start online banking 'in minutes.' However, to comply with the security requirements and recommendations, we expect most users would be delayed hours or days, if indeed technically capable of doing so at all." Maura Drew-Lytle, spokeswoman for Canadian Bankers Association, says the expectations of banks are fair and are no more stringent than what people should have on their home computers to do simple things like sending e-mails. It's also fair to expect customers to read agreements before they agree to the terms, she added. The study points out agreements can be changed at any times, and customers will be notified by notice on the bank's website. -- Canwest News Service

1 0

INTEREST: use GarageBand to remix RadioHead song - a novel approach
by billing 02 Apr '08

02 Apr '08

It seemed like such a novel approach to handling and distributing media (music in this case) that I thought it might be of interest to some of you on this list. Wayne ...from: - MacWorld magazine - http://www.radioheadremix.com/information/ Remixing Radiohead By Christopher Breen mailto:cbreen@macworld.com Radiohead, in league with the iTunes Store, yesterday began offering fans the opportunity to remix the band's single, "Nude" (nudeness not required) and upload the results to the band's Web site, where the public will vote on its favorite remixes. The remix information site goes on to say that the band will listen to the best remixes. The Terms page provides further niggling details, the gist of which is that you're doing this for the fun of it and nothing more. It works this way: You purchase up to five "stems" -- the bass, drum, guitar, string fx, and voice parts of the single -- for $0.99 cents each. These parts are in iTunes Plus format (unprotected AAC) so you can import them directly into Apple's GarageBand or Logic as well as a variety of other music editing applications. (Or you can convert them to AIFF, WAV, or MP3 for editing in applications that don't support AAC.) If you purchase all five stems you'll receive a link to a GarageBand project file of the tune. The track is in 6/8 meter rather than 4/4, and no tempo or key information is offered (if you count it in 6 rather than 2 it runs at around 64 bpm). Nine Inch Nails' Trent Reznor did something like this three years ago when releasing a version of the song "The Hand That Feeds" in GarageBand format. (No longer available.) It's now Radiohead's turn. It's an interesting idea -- a nice way for bands to bring in some extra cash and promote their work while providing fans the opportunity to be part of the creative process. Given that GarageBand includes very few 6/8 loops, I'm not sure that it's the best editing environment for your remix unless you're willing to create your own parts (a couple of remixes I've heard cheat this by doubling up 3/4 loops), but kudos to the band and Apple for providing parts -- OK, stems -- that can be used in other editing applications. Whether you're an old hand or just someone who would like to try his or her hand at remixing, $4.95 is a small enough investment in something that should be, at the very least, a fun way to spend a couple of hours. Get all the latest iTunes and iPod news at http://www.macworld.com/weblogs/ipodblog.html?lsrc=mwipod.

1 0

FYI: Two possible Microsoft Word 2008 issues
by billing 31 Mar '08

31 Mar '08

...from: http://www.macworld.com/article/132716/2008/03/0328bugsnfixes.html?lsrc=mww… Bugs & Fixes: Two Word 2008 issues by Ted LandauMar 28, 2008 6:51 am If Word 2008 is bugging you with slow launch times or frequent crashes, here are two fixes that can help. Slow launch times for Word Does Word 2008 take unusually long to launch? If so, here’s a fix that reportedly speeds things up. Select Word -> Preferences and click on the General pane. From here, deselect WYSIWYG Font And Style Menus and Show Project Gallery At Startup. Quit the program. Next time, it should launch faster. Apparently a font preview problem is to blame and Microsoft is expected to fix it in an upcoming Office update. Word crashes How about crashes—experiencing those in Word 2008? Tidbits reports that you may still be able to use an old fix to solve this problem. If a corrupt “Word Settings (10)” file, located in your user folder/ Library/Preferences folder is the culprit, the solution is to trash the file. Word will create a new clean copy the next time you launch the program. This is a well-documented fix dating back at least as far as Word v. X running under Mac OS X 10.2 (see this Microsoft support file for details).

1 0

FYI: ASLR in LINUX, Vista, and OS X (was Re: [C-REPS] Article: Tool makes mincemeat of passwords)
by billing 31 Mar '08

31 Mar '08

...from: http://en.wikipedia.org/wiki/Address_space_layout_randomization Address space layout randomization (ASLR) is a computer security technique which involves arranging the positions of key data areas, usually including the base of the executable and position of libraries, heap, and stack, randomly in a process' address space. [The most common exploits take advantage of a known positions for specific structures such as heap and stack locations in memory. The idea behind ASLR is to randomly position in memory these sometimes vulnerable structures to make it more difficult for an automated exploit.] In Linux, a weak form of ASLR has been enabled by default since kernel version 2.6.12. The PaX and ExecShield patchsets to the Linux kernel provide more complete implementations. Various Linux distributions including Adamantix, Hardened Gentoo, and Hardened Linux From Scratch come with PaX's implementation of ASLR by default. Microsoft's Windows Vista and Windows Server 2008 have ASLR enabled by default, although only for executables which are specifically linked to be ASLR enabled. [NOTE: from http://blogs.zdnet.com/security/?p=104 - Those applications which link to the ANSI C heap allocation API malloc() are less vulnerable to exploitation. Beyond ASLR, there is / GS, a compile-time option in Visual C++ that adds stack-based buffer overrun detection, /SafeSEH, Data Execution Protection and Function Pointer Obfuscation. As Microsoft's Michael Howard explained when ASLR was added to Windows Vista Beta 2, it is not a panacea or a replacement for insecure code. "[But] when used in conjunction with other technologies,it is a useful defense because it makes Windows systems look 'different' to malware, making automated attacks harder."] Apple introduced randomization of some library offsets in Mac OS X v10.5[3], presumably as a stepping stone to fully implementing ASLR at a later date. Wayne

1 0

INTEREST: National Geographic pictures/story of Antarctic ice shelf collapse
by billing 28 Mar '08

28 Mar '08

...from: http://news.nationalgeographic.com/news/2008/03/080325-antarctica-photo.html March 25, 2008—New satellite images reveal what scientists call the "runaway" collapse of an enormous ice shelf in Antarctica as the result of global warming. (Read full story.) The chunk of coastal ice was some 160 square miles (415 square kilometers) in area—about seven times the size of Manhattan. The shelf's rapid collapse began on February 28 (see image sequence at top right), sending a giant swath of broken ice into the sea—as seen in the bottom image, which shows a 2-mile-wide (3.2-kilometer-wide) area. "[It's] an event we don't get to see very often," Ted Scambos, lead scientist at the U.S. National Snow and Ice Data Center in Boulder, Colorado, said in a press statement.

1 0

INTEREST: China Law Could Impede Microsoft Deal for Yahoo
by billing 28 Mar '08

28 Mar '08

...from: http://www.nytimes.com/2008/03/28/technology/28yahoo.html?th&emc=th China Law Could Impede Microsoft Deal for Yahoo By JOHN MARKOFF Published: March 28, 2008 SAN FRANCISCO — Microsoft’s hostile-takeover attempt againstYahoo may encounter an unexpected hurdle in August after a Chinese antimonopoly law takes effect that will extend the nation’s economic influence far beyond its borders. The law, which goes into effect on Aug. 1, is intended to strengthen an existing set of antitrust regulations the Chinese originally established in 1993. It will make China a third sphere of regulatory influence, matching the power of the European Union and the United States, according to legal specialists in this country and in China who have studied it. Formally enacted by the National People’s Congress last year, the measure gives Chinese regulators authority to examine foreign mergers when they involve acquisitions of Chinese companies or foreign businesses investing in Chinese companies’ operations. Beijing could also consider national security issues, according to a report by the official news agency Xinhua. The law could give China influence in Microsoft’s courtship of Yahoo because in August 2005, Yahoo, a premier search portal, invested $1 billion in Alibaba.com, China’s largest e-commerce business. The investment gave Yahoo about a 40 percent stake in the Chinese company. Alibaba officials have said they believe that a Microsoft takeover of Yahoo would set in motion a buyback provision, making it possible for them to gain independence from Microsoft. Nathan G. Bush, an antitrust law specialist with O’Melveny & Myers in Beijing, said the law represented the ascendance of China “as another regulatory capital contending for influence with Brussels and Washington.” “Multinational corporations will need to develop strategies for all the markets they operate in,” he added, “and China is a big market.” Whether China would seek to review a Microsoft acquisition, and what kind of posture it might take, would be closely watched by regulators and global companies as an indication whether it will play a conciliatory or a nationalistic role on the world stage. “I don’t think anyone has worked through the issue of where an Internet merger should be reviewed, given that it truly is a World Wide Web,” said Andrew I. Gavil, a law professor at Howard University. There are potentially dozens of jurisdictions that could claim oversight in such a deal because of the global business interests of the two huge companies and because it could potentially transform the Internet into two megaportals, Google and Microsoft. Other parts of the world that might have an active interest in the outcome of a merger include South Korea, a vibrant Internet economy where an antitrust investigation into Microsoft was previously opened. Executives at Microsoft and Yahoo declined to comment on the possible effect of the new Chinese law. In rejecting Microsoft’s takeover bid in January, Yahoo’s chief executive,Jerry Yang, said in a letter to employees that the offer substantially undervalued the company, in part because of the significant growth potential of the Alibaba business in China. [...] Last week, a vice minister in the State Council Information Office, which oversees the Internet, said there were 230 million Chinese users of the Internet. He said the Internet sector accounted for 7 percent of the country’s gross domestic product, and he expected that to rise to 15 percent in three to four years, according to a Reuters report. The official, Cai Mingzhao, warned that foreigners should not use the Internet to interfere in Chinese internal matters, according to a report in The Guardian. Even if the Chinese government did not try to prevent a takeover by Microsoft, a prolonged review could substantially damage the value of the business, a number of Internet industry executives said.

1 0