Java founder Gosling joins Google

Java founder James Gosling has taken a job with Google, he revealed in a blog post Monday.
"Through some odd twists in the road over the past year, and a tardis encountered along the way, I find myself starting employment at Google today," Gosling wrote. "One of the toughest things about life is making choices. I had a hard time saying 'no' to a bunch of other excellent possibilities."
"I don't know what I'll be working on," he added. "I expect it'll be a bit of everything, seasoned with a large dose of grumpy curmudgeon."
Gosling left Oracle last year after it purchased Sun Microsystems, the company where he created Java, the now-ubiquitous programming language. While initially somewhat vague about the reasons for his departure, Gosling later told eWeek that the reasons included inadequate compensation and an atmosphere of micromanagement.
His arrival at Google comes as the company is being sued by Oracle over alleged Java patent and copyright infringements in its Android OS. That matter and others have raised tensions in the Java community of late.
"Developers are unsure what future controls Oracle will try to foist over the Java community," said Redmonk analyst Michael Coté. "It's hard for many Java developers to feel sympathy for anything less than a very, very open Java after it was open-sourced many years ago."
It makes sense for Google to bring aboard a figure with Gosling's prominence and background, according to Coté.
"Google has hired some of the larger thought and technical leaders in the Java world," he said. "Having them on board and, important to this point, working on Java, certainly would give Google a bigger voice in the Java community."
In addition, Gosling is "clearly a good coder and a legend in the field, as it were," he said. "He's exactly the kind of person Google likes to collect up and use its cushy position to fund and, hopefully, let flower into new innovations."

Firefox 4 races out the gate, doubles share in 6 days

Mozilla's Firefox 4's browser usage share grew over two-and-a-half times in the six days since its March 22 launch, a Web analytics company said today.
According to California-based Net Applications, Firefox 4 accounted for 3.7% of all browsers used Sunday, up from last Tuesday's 1.4%.
Firefox 4's Sunday share was double that of Microsoft's newest browser, Internet Explorer 9 (IE9), which debuted March 14.
Mozilla has been touting Firefox 4's download count since the browser launched last week, when it recorded 7.1 million downloads in the first 24 hours, and an unofficial record of 8.75 million the second day.
Those downloads have translated into a growing share for Firefox 4, which has averaged a 2.8% usage share since its release six days ago.
By comparison, IE9 is off to a much slower start, climbing just six-tenths of a percentage point -- an 80% increase -- and averaging 1.1% during its first six days. Since its launch two weeks ago, however, IE9 has doubled its usage share.
Firefox 4's battering of IE9 in the usage share battle wasn't unexpected. Unlike IE9, Mozilla's browser runs on Windows XP, Mac and Linux, operating systems that Microsoft's program doesn't support.
IE9 runs only on Windows Vista and Windows 7, which collectively account for slightly more than a third of all versions of Windows now in use.
Microsoft and Mozilla have traded barbs over the former's decision to dump XP. Microsoft has defended the move by saying it did not want to develop for what it called "the lowest common denominator," while Mozilla has bashed its rival for leaving XP users stuck with the two-year-old IE8.
It's unclear whether the releases of Firefox 4 and IE9 have managed to boost the overall usage shares of Mozilla or Microsoft, or if the gains of the new editions have come at the expense of older versions of the firms' browsers. Net Applications will not release its March numbers until Friday.
Both Firefox and Internet Explorer have been on a downward trend for months. Firefox has lost 2.5 percentage points in the last 12 months, while IE has dropped 4.8 points in the same period.
Google's Chrome and Apple's Safari have been the beneficiaries of those declines, picking up 5.3 and 1.9 points, respectively, in the last year.
Net Applications calculates browser usage share using data obtained from the 160 million unique visitors who browse the 40,000 Web sites the company monitors for its clients.
Firefox 4 can be downloaded from Mozilla's site; IE9 can be found on Microsoft's.
Firefox 4 is off to a faster start than IE9, according to Net Applications' usage share data.

Hotmail Disables HTTPS for Accounts From Certain Regions

Recently, there is a lot written about email account being hacked by governments. Last year the same happened in China for certain Gmail users. Google hit back by allowing HTTPS for all Gmail accounts by default. This added security has now become the norm and almost all email providers allow HTTPS access by default.

Hotmail recently deactivated HTTPS for accounts from certain regions according to EFF. This might have allowed governments of those regions to snoop into the email accounts of people from there.

Hotmail was deactivated in the Bahrain, Myanmar, Iran, Syria, Jordan and a few more countries. Interestingly these countries are the ones that have had a few protest movements and subsequently government crackdowns.

Microsoft calls it a bug!

Officially Microsoft has responded with the following statement

We are aware of an issue that impacted some Hotmail users trying to enable HTTPs.  That issue has now been resolved.  Account security is a top priority for Hotmail and our support for HTTPS is worldwide – we do not intentionally limit support by region or geography…..

Read Entire message here.

I changed by location to some of the countries mention and I could use HTTPS, so I am guessing the issue was resolved by Microsoft. Even though Microsoft are claiming it was a bug, I still find it difficult to believe, considering the locations picked up by this bug.

What are your views on Hotmail security? Do you think it was an honest mistake and just a bug or do your suspect Microsoft’s intentions? Do drop in your comments.

Source: EFF

Review: IE 9 Is Microsoft's Best Browser Yet

Internet Explorer 9 is a powerful, fast, and intuitive interface for browsing the Web and compares favorably with competing browsers such as Google Chrome and Mozilla Firefox.
With the release of Internet Explorer 9, Microsoft has created a powerful, fast, and intuitive interface for browsing the Web. IE 9 is easily the best browser that Microsoft has produced to date and, right now, it compares favorably with competing browsers such as Google Chrome and Mozilla Firefox.
Of course the key part of that statement is "right now." In the next few weeks we'll see the release of Firefox 4 and Chrome 11. If Microsoft sticks by their two year release schedule for browsers, by the time we see IE 10, Chrome will be at version 30 and the Microsoft browser will be far behind competitors and most likely ill suited for surfing the Web of 2013.
However, right now IE 9 is an excellent upgrade, with welcome improvements that make it a solid choice for surfing today's Web.

One of the biggest changes that users will notice is the completely revamped interface, which bears more than a passing resemblance to Chrome. Compared to the often-cluttered interfaces of previous versions of IE, version 9 has a clean and intuitive look and has combined most menu items into a single Tool menu icon.
One small issue I had with the new interface was how it placed tabbed windows and the address bar in the same row. If I opened multiple tabs in the browser, this row quickly became somewhat tight.

IE 9 has changed the window that displays when opening a new tab. Now when opening a new tab, IE 9 displays a list of icons of Web sites that the user visits the most. This worked well, but when compared to browsers such as Chrome and Apple Safari, the ability to customize the new tab page in IE was very limited.

Another feature found in other browsers that has now made its way to IE is the ability to enter search terms and run searches directly from the address bar. This worked well in tests and in general is a very easy and time saving way to run searches in a browser.

A feature available only to Windows 7 users of IE 9 is Pinned Sites. Using this feature, I could add any site to the Windows 7 taskbar simply by clicking on its icon in the browser address bar and dragging it down to the taskbar. With this feature I could quickly launch a pinned site or Web application from the taskbar and also add the Web application to my Startup folder so it would launch when Windows launched. And, when a pinned site is launched, the browser window works almost like a separate application, down to its own unique icons and look based on the Web site's properties.

The notifications feature in IE 9 is also much improved and is one area where I think IE works better than competing browsers. In IE 9, a pop-up notification box displays at the bottom of the browser whenever information on downloads or site loads needs to be displayed. I found this to be informative and an unobtrusive way to handle notifications and superior to the standard browser status bar.

One big improvement in the shipping version of IE 9 is clearly performance. While previous versions of IE performed poorly in almost all benchmark tests, IE 9 is now very competitive and even a leader in some tests. IE 9, at least in the 32-bit version, uses an updated JavaScript engine that provided a huge boost. On tests using the SunSpider JavaScript benchmark, IE 9 32-bit had a slight edge over competing browsers such as Chrome and Opera. Tests run using Futuremark's Peacekeeper benchmark, which is more of an overall browser performance test, showed great improvement, though it was still well behind performance leaders Chrome and Opera.

Tracking Protection, ActiveX Filtering

Internet Explorer 9 Fast, Powerful, Intuitive
(click image for larger view and for slideshow)Another potential performance boost for IE 9 comes from its ability to use the PC's graphics processor to handle video, images, and other graphics-intensive applications within the browser.
IE 9 also includes some new features designed to improve security and privacy control. One of the more interesting is the new Tracking Protection, which uses third-party lists to prevent certain sites from tracking Web activity through cookies. Microsoft doesn't maintain any of these lists, but users can choose one or select sites from their browsing history to create their own list.
Also useful is the inclusion of ActiveX filtering, which blocks any ActiveX applications on the Web from running. That's a good thing as ActiveX is often used to spread malware. I appreciated that it was possible to allow ActiveX to run on certain sites, which is useful for internal or other trusted sites where ActiveX support might be required.

Settings configuration in IE 9 has improved somewhat, though some areas, such as the classic Windows Internet Options, haven't changed much at all. IE 9 does now finally feature a good download manager that made it possible view content downloaded through the browser and also pause in progress downloads and restart failed downloads.
IE 9 also does a good job managing add-ons and plug-ins. One very nice feature makes it possible easily enable or disable add-ons in order to improve browser performance.

When it comes to standards support, IE 9 is certainly improved over previous versions and, like most other browsers, IE is making strides towards supporting the emerging HTML 5 standard. Using the Web Standards Project's Acid3 test, IE 9 scored a 95 out of 100, better than previous IE versions but still behind competing browsers.

As is often the case with Microsoft products, IE 9 has one major weakness when compared to competitors. While browsers such as Chrome and Firefox run on Macs, Linux, and Windows 7 through XP, IE 9 will only run on Vista or Windows 7.

You can find the new Internet Explorer 9 here.

Windows Phone 7 owners rage at Microsoft over update no-shows

Windows Phone 7 users are not happy about the slow pace of updates to their smartphones.
In more than 130 comments added to a Microsoft blog post, Windows Phone 7 owners mostly raged and ranted about a schedule published Wednesday that showed no U.S. users were yet receiving either February's or this month's updates.
Of the five affected smartphones available in the U.S. powered by Windows Phone 7, three display the "Testing" label, meaning that carriers are conducting their tests before releasing the updates. Two of the five -- Dell's Venue Pro and HTC's HD7 -- show their status as "Scheduling," which means that testing is complete and that Microsoft is prepping the update for rollout.
None are pegged with the much-anticipated "Delivering update."
Angry users flooded the comments section of the blog post, which was written by Eric Hautala, the general manager of Windows Phone 7's customer experience engineering team.
"So when Steve Ballmer says, first half of March, then wait, we want to get it right, second half of March, he really means second half of March to late April, possibly May, maybe later, depending on carrier testing and if we roll the 'here it is' beacon out to your phone that week," said someone identified as "dkb1898" in a comment posted Wednesday.
Dkb1898 was referring to comments made by Microsoft CEO Steve Ballmer last month that the latest update, nicknamed "NoDo," would be released in the first half of March. But two weeks ago, Hautala confirmed that the NoDo update would be delayed until the second half of this month.
Users blasted mobile carriers for dragging their feet and hammered Microsoft for not lighting a fire under those carriers. But mostly they seethed at the delays, no matter who caused them.
"This is wholly unacceptable, and, as we all know, it is also wholly unnecessary," said a user identified as "jimpict" in a Thursday comment. "You have betrayed the trust of early adopters, and your inability to get out a single update with anything even resembling moderate success only shows either how deeply you misunderstand the hostility toward your product you have generated or just how incredibly incompetent you are at a basic and fundamental task."
Jimpict and several others compared the problems Microsoft has updating Windows Phone 7 with the smoother process Apple iPhone owners experience.
"The iPhone is on numerous carriers worldwide, but it doesn't take Apple forever to test, schedule and release an update, yet they have millions more customers then Windows Phone 7," observed "conor.okelly" in a comment Wednesday.
Others wondered how, or even whether, Microsoft would be able to deliver a security update to patch an active vulnerability.
"I wonder if a massive security flaw was found that compromised user data if the update process would be this mind-bogglingly pathetic," commented "curtk" today. "If it happened fast, it would mean that this is all just incompetence on the part of the teams at Microsoft and the carriers. If it happened slow, it would mean that the process is severely flawed and we really backed the wrong horse."
Hautala's post, and the ensuing status tables for U.S. and international users, received praise from some commenters, but they were very much in the minority.
"The status update is exactly what we all wanted," said "Polychromenz."
And more than a few said that while they were loyal supporters of Microsoft and its products, they'd had it with Windows Phone 7 because of the update snafus.
"The thought of it being May or later before I get an update is unacceptable," said "bwgolfer," who claimed he was a supporter of Microsoft, a longtime user of its products and a .Net developer. "I tried, gave it a shot. Tried to be loyal. All I got was disappointment."
Hautala has gotten little love from Windows Phone 7 owners. His post of March 10, in which he announced a delay in the next update, attracted nearly 240 comments, most of them negative.

Bing extends social search features

Microsoft has expanded Bing's social search capabilities, displaying real-time Twitter messages on Bing's News section and simplifying the sharing of Bing entertainment content on Facebook.
The new capabilities build on existing links Bing has to both Twitter and Facebook, highlighting the increased importance of meshing search engines with social networking sites. For some queries, input from people's social circle is very valuable and relevant.
Bing Social already had a section for people interested in searching only through public posts and status updates from Twitter and Facebook. Now, Twitter content will appear in Bing News search results.
"Search for a news item and immediately see what people are tweeting on the topic," wrote Betsy Aoki, a Bing senior program manager, in a blog post.
Meanwhile, Bing now displays a Facebook box in which logged in users can type in a status update and post it to their Facebook profile without leaving the Bing interface.
The feature is now specifically available for "overview" pages in Bing Entertainment, a section of the site that offers information digests on movies, actors, singers and other entertainment categories.
"Whether it's a movie, a video game or even an artist, now you share your thoughts with just one click," Aoki wrote.
Google is also working hard to factor in social signals into some of its queries, and recently gave its Social Search service a revamping, promoting its results from a special section at the bottom of the page into the main results list based on their query relevance and sharpening other features.
While access to Twitter content and feeds seems uniform among search engines, Bing does enjoy preferred status with Facebook, thanks to a partnership between the two companies. That has resulted in Google lacking access to important Facebook functionality that Bing has, like the ability to include in results links to Web sites that one's Facebook friends have "liked."

Social networking gets Color but no privacy

If you want to share photos and videos and you don't care about privacy, there's a new social network just for you.
Known as Color, the new network is accessible via a free app for iPhones and Android-based smartphones. The application can detect your location and will share your photos with other Color users within 100 feet of you. It will also show you all of their photos.
Think of it as a social network for voyeurs, or a Twitter-like service that uses photos instead of tweets.
"I think the analogy to Twitter applies," said Ezra Gottheil, an analyst at Technology Business Research. "Some people -- especially, but not exclusively, young people -- like to share what they see, what they're doing, what they like and even what they don't like. And they like to see what other people are doing and liking."
Color, the brainchild of Bill Nguyen, who also co-founded music startup LaLa, has been getting a lot of buzz in the past week. The Palo Alto, Calif.-based fledgling company recently received a $41 million venture-capital investment, then came out with an iPhone app and on Wednesday released a Color app for Android.
Color has raised some eyebrows because it lacks any privacy features. Color is all about being public and being visible to everyone. If someone is using Color and she's near other people using the app, then her photos and videos will be publicly shared with her fellow users.
On Color, every photo and video is public. There is no friending, no choosing to follow only your family and friends. The app shares your images with any nearby stranger who is also using Color.
However, Color will determine who your friends are simply by detecting who is generally near you. If two people are using the app near each other, Color will note that and keep track of how often it happens. If the two of you hang out together often enough, Color will put you both into a social network. Once it establishes such a network, Color will show you pictures and video not only from people around you, but also from people in the social network it set up.
The questions about privacy (or lack thereof) could be a big deal. Facebook executives, for example, have repeatedly been criticized for not keeping users' information as private as the users would like.
The difference with Color, though, is that it makes no pretenses about privacy.
Gottheil noted that while Color could be a fun app for people on a college campus, at a concert or some other event, it also could be a useful business tool. "If this takes off, I guess restaurants in areas with a lot of foot traffic will start taking pictures of their plates," he said. "I know people for whom that would be very effective." Gottheil added that such tactics could also work for supermarkets and other retail stores.
"If the person is looking at his smartphone instead of your shop window, why not put your picture where he or she is looking?" he said.

Russian security team to upgrade SCADA exploit tool

A Russian security company plans to release an upgraded exploit pack for industrial control software that incorporates a raft of new vulnerabilities released by an Italian security researcher.
The three-person company, called Gleg, is based in Moscow and specializes in vulnerability research. It recently began focusing on problems within SCADA (supervisory control and data acquisition) systems, which are used in factories, utilities and many other kinds of industrial applications, said Yuriy Gurkin, Gleg's CEO.
Gleg works with the Miami company Immunity, which sells a tool called Canvas, which is a framework for penetration testers wanting to try out the latest exploits against software vulnerabilities, along the same lines as the Metasploit tool.
Gleg supplies Immunity with exploit packs, which are add-ons with specific kinds of exploits, for Canvas. Gleg's main product is Agora, which integrates with Canvas. Agora is regularly updated with publicly disclosed zero-day, or new, vulnerabilties and those discovered by its research team.
Canvas allows companies to figure out what kind of information a hacker could obtain, said Dave Aitel, CTO for Immunity.
"If you can't test against zero days, then you are not testing against a real-world situation," Aitel said.
About two weeks ago, Gleg released Agora SCADA+, a new add-on for Canvas, Gurkin said. It contains 27 exploits for SCADA software and will mostly likely have around 35 exploits when an upgrade is released next week, he said.
Gurkin said Gleg is incorporating the exploits written by Luigi Ariemma, who found about 50 vulnerabilities in four SCADA products made by Siemens, Iconics, 7-Technologies and Datac. All four companies had products with remotely exploitable vulnerabilities.
On his website, Ariemma self-published vulnerability details, which were also published on Bugtraq. He did not inform the vendors prior to releasing the information, something that is considered bad form by some in the security community. Officials at two of the vendors -- 7-Technologies and Datac -- said earlier this week they were working on patches.
Gurkin said he believes responsible disclosure practices are out of date.
"We, like Luigi, don't notify vendors," Gurkin said. "This is a waste of time."
However, Gleg's partner Immunity does vet organizations that are interested in buying Canvas to verify they are not going to use the product in a malicious way.
Gurkin said he has seen increasing requests from companies for SCADA audits. "Sometimes our partners who use different SCADA software ask us to check something they have, with terms like 'You give us recommendations, we give you access to the system'," he said.
The high-profile Stuxnet malware has also prompted wider concern, he said. Stuxnet is a worm that was designed to target Siemens' WinCC industrial control software. It was packaged with four zero-day exploits for Microsoft Windows. It is now widely believed that Stuxnet was designed to disrupt Iran's uranium enrichment program.
SCADA software was often not intended to be connected to the Internet, but nonetheless more companies have done that anyway, which poses security risks, Gurkin said. Companies in the SCADA field are also not as open as other software companies about exchanging security tips and knowledge, he said.
A three-month subscription for Agora SCADA+ costs $2,250, which includes updates to the exploit pack and a single license for the Canvas framework. A one-year subscription costs $5,400 and also comes with one Canvas license.

Report: Mysterious Facebook Web search box could be malware

A Web search box some users are seeing on their Facebook interface wasn't inserted by Facebook and could be the result of malware or a rogue browser plug-in or application.
AllFacebook, a blog devoted to Facebook-related news, first reported that a second search box had begun to appear on Facebook interfaces, right next to the legitimate site search bar.
The mysterious Web search box appeared perfectly integrated into the Facebook page layout, as if it were a native Facebook feature. However, Facebook is now saying that it didn't put that second search box there and that it could be a sign of malware infection.
"We are not testing the placement of a separate web search field and have no plans to do so. We believe the second search field or 'Search the Web" box appeared on peoples' accounts as the result of unknown actions by a third party targeting the browser -- potentially a browser plugin or malware -- unrelated to Facebook," a Facebook official told technology news blog Search Engine Land.
As Facebook members, users who think they might be affected by this situation have access to a free, browser-based virus scanning tool from McAfee, according to the company.
As the most popular social network and one of the world's largest sites, Facebook is in a constant battle against malicious hackers and online scammers who want to take advantage of its massive user base to commit fraud and spread malware.
At this point, it's not clear whether the sinister search box is the result of an external malware exploit or the work of a rogue Facebook application.

Google patches 6 serious Chrome bugs

Google on Thursday patched six vulnerabilities in Chrome, and silently updated users' copies of the browser.
The update to Chrome 10.0.648.204 also included two more entries to the browser's blacklist, a move related to last week's theft of nine digital certificates from a Comodo reseller.
All six bugs were rated "high," Google's second-most-serious ranking in its threat scoring system. Of the half-dozen bugs, two were "use after free" flaws -- a type of memory management bug that can be exploited to inject attack code -- while a second pair were pegged by Google as "stale pointer" vulnerabilities, another kind of memory allocation flaw.
As is Google's practice, the company locked down its bug-tracking database, blocking access to the technical details of the patched vulnerabilities. Google usually unlocks the bug entries several weeks, sometimes months later, to give users time to update before the information goes public.
Google paid out $8,500 in bounties to three different researchers for finding and reporting the six vulnerabilities. So far this year, Google has cut bounty checks totaling $58,145.
Frequent-contributor Sergey Glazunov took home $7,000 for reporting four of the bugs patched Thursday, bringing his 2011 bounty total to $20,634. Glazunov has become the most prolific of the independent researchers who specialize in rooting out Chrome flaws, reporting 14 of the 54 bugs attributed to outsiders.
Yesterday was the sixth time Google patched security vulnerabilities in its browser this year.
Google said the update also added support for the browser's password manager on Linux, and included performance and stability fixes. According to the Chrome change list, it also blacklisted more SSL (secure socket layer) certificates, the digital certificates that encrypt traffic between users and sites. Those new entries appeared to be for reissues of certificates originally blacklisted by Google on March 17.
The additions to the SSL blacklist are connected to last week's theft of several certificates from a Comodo reseller, an event that prompted Comodo to revoke the stolen certificates. Since then, Google, Mozilla and Microsoft have each issued updates
Comodo has cited circumstantial evidence that points to Iran, perhaps the Iranian government, being involved in the certificate theft.
Chrome 10 can be downloaded for Windows, Mac OS X and Linux from Google's Web site. Users already running the browser will be updated automatically.

Microsoft warns of hack attempt on Windows Live, Google, Yahoo, Skype, Mozilla

Microsoft has issued a warning  that a root certificate authority named Comodo Group has issued nine fraudulent digital certificates. Although the certificates were quickly revoked, their initial release still poses a threat to browser users, including users of Internet Explorer. This is not a security flaw in Microsoft software, the company says, but it released a security update for Windows all the same.
The nine fake certificates affect the following Web sites, Microsoft says:

• login.live.com (Windows Live)
• mail.google.com
• www.google.com
• login.yahoo.com (3 certificates)
• login.skype.com
• addons.mozilla.org
• "Global Trustee"

Fraudulent certificates give hackers the ability to spoof content, phish, or insert themselves in man-in-the-middle attacks, collecting information that users think is being sent over a secure link from browser to Web site. Browsers which have enabled the Online Certificate Status Protocol (OCSP) will automatically invalidate these certificates and block them from being used. IE7 and later supports this by default, as does Firefox 3 and later, Safari on Mac OS X (but it must be manually activated), Opera 8 and Chrome.
An alternative way for Web browsers to validate the identity of a digital certificate is by using the Online Certificate Status Protocol (OCSP). OCSP allows interactive validation of a certificate by connecting to an OCSP responder, hosted by the Certificate Authority (CA) which signed the digital certificate. Every certificate should provide a pointer to the OCSP responder location through the Authority Information Access (AIA) extension in the certificate. In addition, OCSP stapling allows the Web server itself to provide an OCSP validation response to the client.
OCSP validation is enabled by default on Internet Explorer 7 and later versions of Internet Explorer on supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. On these operating systems, if the OCSP validation check fails, the browser will validate the certificate by contacting the CRL Location. For more information on certificate revocation checking, see the TechNet article, Certificate Revocation and Status Checking.
So, if the browser will automatically check to see if the certificate is valid and, discover that it isn't, why issue a patch at all?
The OCSP system relies on being able to reach the CA's Certificate Revocation List (CRL). If the users can't get to that server, the browser assumes that the certificate issued by a trusted root authority is A-OK, uses it and by then the damage could be done.
Explains Microsoft:
Even when CRL and OCSP validation is enabled, validation techniques are not sufficiently robust to guarantee that users are protected against malicious use of these certificates. When the CRL location and OCSP responder can be reached, validation checks are highly reliable and effective.
However, when certificate revocation checks fail due to network and connectivity issues, browsers and other client applications, including Internet Explorer, may ignore these errors and consider the certificate trustworthy due to the lack of proof otherwise. In these scenarios, customers may still be affected.
Microsoft says it has not seen any attacks in the wild. Nevertheless, its Windows patch will be pushed out to users of its Windows Automatic Updates to ensure that the fraudulent certificates are not treated by IE as if they were valid. For enterprises that don't use Automatic Updates, the patch is available from the Microsoft Download Center.
The patch does not require a reboot. Here is more information on Security Advisory 2524375.

Download Final Version of Firefox 4

You can download firefox 4 – final version from here.

Below are download links for firefox 4.

• Windows – Firefox 4.0 Final (12MB)
• Mac – Firefox 4.0 Final (27MB)
• Linux – Firefox 4.0 Final (15MB)

Below are download links for International Releases

Links below points to FTP directory. Just select your language code and you will link to exe/dmg/bz2 file in your language depending on your platform selection.

• Windows – Firefox 4.0 Final (International)
• Mac – Firefox 4.0 Final (International)
• Linux – Firefox 4.0 Final (International)

Worst is over: chip makers start recovery

According to IDG News Service Japanese chip makers have resumed their operations, first time after earthquake and tsunami hit Japan. While some Factories have started recovering others are coping with damage and power shortage.
Shin-Etsu Chemical, the world's second-largest supplier of 300-millimeter (12-inch) silicon wafers, vital to chip production, said that two of its four factories shut down after the earthquake are back and running. Company is assessing damage to other two factories. It further added that it will be transferring production equipment from one of its plant to elsewhere in Japan.
Silicon wafers are the raw material on which chips are etched. Japan supplies 72% of the world's 300mm silicon wafers, according to investment bank.
Japanese DRAM maker Elpida Memory has said a chip testing and assembly plant located in northeastern Japan is back and running after an initial closure caused by power outages related to the earthquake. The company said the facility was not damaged by the earthquake.
Both of these companies said that power outages remain an issue.
The 9.0-magnitude earthquake and resulting tsunami knocked several power plants offline in northeastern Japan, according to Tokyo Electric Power Co. The company continues to work to restore power to companies and residents, and started rotating power outages from Monday due to a shortage of capacity.
Chip makers that fabricate chips, the sensitive etching work that takes the most time in chip production, would not be able to resume operations until the earthquake activity settles down in northeastern Japan, according to IHS iSuppli.
"Earthquakes ranging from 4 to 7 on the Richter scale will make it impossible to fully restart these labs until the aftershocks stop happening with such frequency," IHS iSuppi said. "Every time a quake tops 5, the equipment automatically shuts down."
Northeastern Japan continues to be rocked by earthquakes, the latest a fairly strong 5.4-magnitude temblor Friday evening, according to the Japan Meteorological Agency.
Japan continues to recover after the biggest earthquake in its history. On Friday, the National Police Agency of Japan published dead and missing figures almost double the numbers from Wednesday. The number of people confirmed dead now stands at 6,539 with 10,354 missing. The tsunami spawned by the temblor swept away entire towns, leaving hundreds of thousands homeless, while an emergency at the Fukushima Daiichi Nuclear Power Station caused by the tsunami continues to plague officials in Japan.

Indian Prime Minister lying said Wikileaks founder

According to Wikileaks founder Julian Assange Indian Prime Minister Manmohan Singh is deliberately misleading the public by suggesting that the veracity of cables between U.S government and Indian embassy cannot be established.
Since November Wikileaks has been publishing leaked cables in partnership with certain newspaper. Indian newspaper “The Hindu” started publishing cables related to it on March 15. Due to these publication of leaked cables, an uproar was sparked in India’s Parliament because some of these cables suggested that India’s ruling Congress party has given bribe to members of Parliament to survive avote of confidence. During that time left party has withdrawn their support from coalition government as they were oppose to a civilian nuclear deal between India and U.S.
Manmohan Singh denied these allegations against his party in Parliament due to which Julian Assange reacted by saying on NDTV that the cables are authentic, there is no doubt about that.

China blocking Gmail to suppress “Jasmine Revolution”: Google

According to Google, China is blocking Gmail with methods that it looks as if the problem lies with Google. For the last several weeks Chinese users have reported difficulty in visiting Gmail. According to users the service was either slow or inaccessible.
Google further added that they have no technical issue on their side and they have checked extensively. They said the government is doing this and it looks as if the problem is with Gmail.
The blocking of Gmail coincides with China's recent efforts to suppress any mention relating to the "Jasmine Revolution", which began as an online call urging the Chinese people to protest the government.
While China regularly blocks politically sensitive content, experts say government censors have further tightened their grip on the Web in the last few weeks. The word "Jasmine" and terms relating to the anti-government protests in the Middle East can no longer be searched for on the country's microblogs. China has also responded by arresting activists, harassing foreign journalists and deploying large police forces to prevent unrest.

Firefox eyes faster release, to get more features

According to a proposal posted this week, Mozilla will add more features in a series of versions and will make new versions faster of its browser like that of Google. The new pace will result in a new browser every 16 weeks that means new three browsers in a year and Firefox 5 and 6 in 2011.
An analyst of IDC, Al Hilwa said it is good to see Mozilla looking hard at streamlining their development to achieve faster release cycle.
The change Firefox users would immediately notice under the faster scheme is that new features will regularly appear in the browser, rather than waiting for months while work on the next edition is completed. "The goal of the process is to provide regular improvements to users without disrupting longer term work."
Mozilla's move would be a major departure for the open-source company. Firefox 4, for example, was in development for over a year, while Firefox 3.6 took about the same amount of time to complete
To replicate Chrome's rapid release schedule, said Sayre's planning document, Firefox will need to include a "silent update" feature that automatically delivers upgrades in the background, a practice Google uses for its browser. "This proposal also requires changes to our software update behavior to make them happen more automatically in the background and interrupt the user less often," said Sayre.
Nightingale, however, denied that silent updates was a requirement for the faster pace.
In August 2010, Mozilla had listed silent updates as one of the features that would make it into Firefox 4. But later, the company yanked the feature from the browser. In an interview Wednesday, Nightingale confirmed that silent updates didn't make it into the final of Firefox 4, and said developers are still working on the tool.
"We have a lot of patches [for silent update] under way," said Nightingale.
It's unclear how Mozilla will ship Firefox security updates if it pulls the trigger on the frequent-update plan, or how long the company will support earlier editions. Currently, Mozilla frequently delivers Firefox patches: In 2010, for instance, it shipped 13 security updates for Firefox 3.6, which launched in January of that year.
Nightingale said discussions are continuing about how best to serve up security fixes for Firefox in a faster-paced development process.

Facebook buying Snaptu: a mobile tool maker

According to IDG News Service Facebook is planning to buy a four year old startup named Snapto which develops mobile versions of web based applications for cheaper mobile phones.
According to a post on snapto blog acquisition will complete within few weeks. Facebook and Snapto together will enable more quick delivery of better mobile applications for phones with less processing capabilities than smartphones.
Earlier this year Snapto has released a mobile application for Facebook. The application called Facebook works on more than 2500 phone models.
Facebook has also developed its own mobile application for Apple's iPhone. There are also Facebook apps for T-Mobile's Sidekick and for smartphones from INQ, Palm, Nokia and High Tech Computer (HTC), which sells two Android smartphones with dedicated Facebook buttons.

Android defeated iPhone 4 by 50%

According to an independent field test by Blaze software it was found that the smartphone running latest Android loads webpage 52% faster than iPhone 4 which is running iOS 4.3. Android uses chrome browser whereas iPhone 4 uses safari.
Blaze has used 1,000 websites for the test and out of that it was found that Android has run 840 websites faster than safari. Android also provided faster browsing experience.
Both iPhone and Android optimized JavaScript engines in latest versions and both have said that it has vastly increased their browser performance, but it came as a surprise that they were not much faster than previous version.

Tsunami warnings now faster, more accurate

As the deadly tsunami generated by Friday's massive earthquake off the coast of Japan headed toward the United States, scientists at the National Oceanic and Atmospheric Administration's (NOAA) Center for Tsunami Research tracked its progress in real-time.
Dozens of deep-ocean tsunami-monitoring sensors more than three miles beneath the surface of the Pacific Ocean picked up information on the silent swell of water and transmitted it by way of a satellite to the Pacific Marine Environmental Laboratory in Seattle, Wash.

NOAA energy map shows the intensity of the tsunami caused by Japan's magnitude 8.9 earthquake. Darker red colors are more intense. (Image: Ho New/Reuters)
There, scientists crunched the data and quickly developed real-time predictions about how and when the tsunami would reach select locations in Hawaii, Alaska and the U.S west coast. The models predicted the wave arrival time, estimated wave height and the likely extent of inundation for about 50 communities likely to be affected.
When the data indicates danger, first responders in those communities get plenty of time to put evacuation plans into motion to limit human loss.
That kind of real-time, precision forecasting is a far cry from what was available in 2004 during the massive tsunami in the Indian Ocean, said Diego Arcas, a scientist with the NOAA Center for Tsunami Research (NCTR). That tsunami nearly obliterated the Indonesian coastline and that of other countries, killing hundreds of thousands without warning.
"It's almost a whole new world since 2004" in the field of tsunami forecasting, Arcas said.
Hundreds of people were killed and whole cities devastated in Japan by one of the worst earthquakes in over 100 years. The quake, which measured 8.9 on the Richter scale, generated a huge tsunami that inundated parts of Japan and put almost the entire Pacific coast line on high tsunami alert.
The effects of the quake, in terms of human loss and economic damage are expected to be huge.
The NCTR provides support to the national Tsunami Warning Center (TWC). Its mission is to develop numerical models for use by the TWC to develop faster and more reliable real-time tsunami forecasts. The technology used today by the NCTR is still being tested by the TWC for issuing tsunami warnings.
But it already represents the next step in tsunami modeling, Arcas said. Six years ago, there were just eight deep-sea sensors in the Pacific Ocean to monitor for tsunamis. Today, there about 30 of NOAA's Deep-ocean Assessment and Reporting of Tsunamis (DART) buoys collecting such data and beaming it to the TWCs around the country.
There are also about 20 DART systems in the Atlantic and about half a dozen in the Indian Ocean.
When a tsunami travels across the ocean and passes over a DART system, the sensor measures the change in sea levels and reports it back to the TWCs. With first-generation DART sensors, alerts were triggered only when sea-level measurements exceeded specific thresholds.
Current DART systems feature two-way communications that allow forecasters to get measurement data on demand. The sensors are also so sensitive that they can detect an ocean level rise of less than one centimeter, Arcas said. "So we have the ocean instrumented much better than it was five years ago," he said.
The data gathered from these deep sensors give tsunami modelers more information to work with compared to the data generated by tidal gauges. Combining the improved measurement capabilities with historical data -- and data about bathymetry (ocean depth) and topography -- scientists can predict tsunamis far more accurately, he said.
In fact, given the right set of data, scientists at the NOAA today can develop simulations of up to four hours of tsunami activity in about 10 minutes, Arcas said. "Usually, the largest waves happen within the first four hours of a tsunami," he said. For first responders and emergency managers, "that is the most important information they want to get out of a warning."

New Facebook vulnerability patched

Facebook has quietly fixed a vulnerability discovered recently by two student researchers that allowed malicious websites to access a Facebook user's private data without permission and post malicious links onto their profile.
Students Rui Wang and Zhou Li contacted security firm Sophos and told them the flaw they found made it possible for any web site to impersonate other sites which had been authorized to access users' data such as name, gender and date of birth. In other words, if a user has accessed any site - such as YouTube, or gaming sites and news sites -- and had given the site access to their Facebook profile, the potential was there for a malicious site to have access to their sensitive data. The researchers also found it was possible for the malicious site to pose as a legitimate web site and publish content on the visiting users' Facebook wall -- a common way malware is spread on the social network.
Users were at risk if they were to visit a malicious web site while logged into Facebook. The flaw was the result of a problem within one of Facebook's authentication mechanisms. The students explain the problem in a YouTube video found here.
The vulnerability has already been addressed by Facebook, since the students practiced responsible disclosure and informed Facebook's security team about the flaw. Facebook Security responded by fixing the vulnerability quickly, according to Sophos' Graham Cluley.
"Clearly Facebook's website is a complex piece of software, and it is almost inevitable that vulnerabilities and bugs will be found from time to time," said Cluley. "The risk is compounded by the fact that there's so much sensitive personal info about users being held by the site -- potentially putting many people at risk."
Facebook has fixed many research-discovered bugs in recent years. Earlier this year it patched a flaw that allowed private chats to be made public. Last week, Facebook announced new security enhancements on the site.

Google Docs Adds Discussions

Google Docs is designed for writing. But often there's a need to write about what's been written. That's why, on Wednesday, Google is planning to add discussions to Google Docs.
Discussions aren't the same as comments. They're not discrete notes placed in the text. Rather, they're intended to be yet another way to help people work together, to hash out ideas. A Docs discussion descends downward in its own window pane like a miniature forum. It's a well-designed and eminently useful feature.
Jelli has created a user-generated radio experience, where users vote songs onto or off radio stations, join in chats, and create song blocks.
Scott Johnston, a group product manager for Google, describes discussions as a way to accelerate collaboration.
Discussions integrate with e-mail and they're designed with business processes in mind -- there's a Resolve button to underscore how discussions can be used for document development and approval.
This is why people love cloud computing: New features just appear, without the need to download or install any additional software.
Google developed over 130 features last year for Google Apps, its online application suite. And in order to iterate that rapidly, Google depends heavily on people like Johnston.
Johnston came to Google in late 2006 through its acquisition of JotSpot, which became Google Sites. He oversaw the creation of discussions in Docs.
"I'm sort of a startup nut," he said. "I'm addicted to the energy. ...I don't do well at large companies." He says he expected to help re-release JotSpot on Google's infrastructure and to then depart for another startup. But he ended up being convinced to stay by Google managers Jonathan Rochelle and Bradley Horowitz.
Rochelle in particular, during the six years he's been at Google and working on Docs, has tried to maintain teams that operate like startups inside Google. Johnston says that Google itself is run like a federation of startups, so it's not as if the Docs group is alone in its attempt to maintain agility amid corporate growth.
About a year ago when he was on the verge of leaving Google, Johnston says his view of what a large company could be changed following a poorly received pitch meeting. Trying to address concerns raised about his suggested project, he made contact with Google engineer in Sydney, Australia, and subsequently traveled to Australia for a face-to-face meeting.
The meeting went well and led Johnston to believe that he could recapture the excitement of being an entrepreneur without leaving Google. Now, he says, he's running some 20 to 25 projects with various Google engineers as if they're startups.
"I feel almost at this point like I'm an angel investor," he said. "It's like this ideal world where I have these amazing resources. I have funding, if I can convince my boards to fund me."
For Google, maintaining a vital culture of entrepreneurship is believed to be necessary to retain talent, particularly with rivals like Facebook seeking to lure high-value employees away. "We're constantly trying to figure out how do you keep entrepreneurship going while still being the size we are," said Johnston. "And I think it's starting to click."
Perhaps not coincidentally, Google recently raised base salaries for its employees by 10% and, for non-executive employees, shifted from offering bonuses to salary increases.
Johnston says he's seen Google find itself in the past few years. "When I started, I don't think we were that sure of ourselves," he said. "All of a sudden there was all this attention on us and I don't think we were ready for that. I've seen the company mature a lot. And that's another reason that I stayed. The company has moved to a place where it seems to care as much about my health and well-being as it does about my output."

Is Google making a Facebook killer

Web is abuzz with rumor that Google is going to release a social networking site. For months now, online speculation is going that Google is secretly making a social networking site. It is also called as Facebook killer.
Technology pundit Tim O’Reilly, added fuel to fire when he said that he has seen Google circles (Google social networking site) and it is awesome. Then he reportedly told afterwards to AllThingsDigital that it is not a new social networking site it is just some research thinking about how you could better manage social data."
In an emailed response a Google spokeswoman said she don't have any information regarding when or if a social networking site platform will launch.

Google patches Pwn2Own WebKit bug in Chrome

Google Chrome became the first browser to fix a flaw exploited in last week’s hacking contest. According to a post in Computerworld, Google has patched a webkit flaw in Chrome browser which was exploited by a multinational company to hack BlackBerry Torch smartphone at Pwn2Own.
Although Chrome browser was unchallenged at Pwn2Own, the browser relies on the open-source WebKit browser engine, and so needed to be patched.
Friday's Chrome update made Google the first browser developer to patch a vulnerability used at Pwn2Own, the hacking contest sponsored by HP TippingPoint and its Zero Day Initiative (ZDI) bug bounty program. Pwn2Own ran Wednesday through Friday and handed out $60,000 in prize money to four individuals or teams.
Last Thursday, Vincenzo Iozzo, Willem Pinckaers and Ralf-Philipp Weinmann won $15,000 by hacking Research in Motion's BlackBerry Torch with an exploit of a WebKit vulnerability in the BlackBerry's browser. The same day, Dion Blazakis and four-time winner Charlie Miller exploited a different WebKit flaw in Apple's Safari browser on the iPhone 4.
According to Google, the WebKit bug exploited by Iozzo, Pinckaers and Weinmann was a "memory corruption in style handling." Google rated the threat to users as "high," its second-most-dire ranking.
As is Google's practice, it locked access to its bug tracker to bar outsiders from viewing the technical details of the just-patched vulnerability. The company blocks public access to flaws for weeks or even months to give users time to update.
Apple, which will need to patch the same WebKit bug that Google addressed, as well as the one that Blazakis and Miller exploited, does not comment on its security update process.
Google also awarded Iozzo, Pinckaers and Weinmann $1,337 from its own bug bounty program, adding to their cash take for the Pwn2Own hack.
Neither Chrome nor Mozilla's Firefox were challenged at last week's Pwn2Own: Researchers who had earlier signed up to take on the browsers didn't show or withdrew because they had failed to come up with reliable exploits in time for the contest.
Employees of both Mozilla and Google touted the browsers' survival skills.
"Whew, Firefox survived #pwn2own 2011. This is not a laurel we are resting on, but I'm still happy about it," said Brendan Eich, Mozilla's CTO, in a tweet last week. "Congrats to Chrome surviving, too."
"Both surviving browsers: open source, have bounty programs, have embedded security teams, better at faster fixes. Coincidence?" tweeted Chris Evans, an engineer on the Chrome security team.
Smartphones running Google's Android and Microsoft Windows Phone 7 operating systems also escaped Pwn2Own unscathed.
Last week's contest was the third consecutive Pwn2Own that Chrome was not exploited by researchers. It was the first time for Firefox since browsers were designated as targets in 2009.

Nokia lays out serious risks in Microsoft WP7 deal

Immaturity of the software is one serious risk, Nokia said
In a filing with the Securities and Exchange Commission on Friday, Nokia laid out the threats it faces as part of its planned deal with Microsoft to use Windows Phone 7 on its smartphones.
There are many, say Nokia. Some have already been identified by critics of the agreement, under which Nokia will phase out use of its Symbian operating system in favor of Microsoft's mobile operating system. Publicly held companies routinely disclose all the possible risks of their businesses to shareholders.
The immaturity of that software, just released in phones in November, is one serious risk, Nokia said.
"The Windows Phone platform is a very recent, largely unproven addition to the market focused solely on high-end smartphones with currently very low adoption and consumer awareness relative to the Android and Apple platforms, and the proposed Microsoft partnership may not succeed in developing it into a sufficiently broad competitive smartphone platform," Nokia wrote in the filing.
While the companies have signed a "non-binding term sheet," they still have to negotiate the final contract, a process that might take longer than expected or might not happen at all, Nokia warned.
By choosing Windows Phone, Nokia may forgo more competitive alternatives that would let its phones reach greater and faster acceptance in the market, it said.
Also, the transition to Windows Phone might take too long to allow Nokia to compete, given the ongoing development of other platforms, Nokia said.
In the same filing, Nokia said it expects to take two years to make the transition to Windows Phone as its primary platform. During that time, it will continue to support Symbian in the hopes of transitioning the installed base of 200 million Symbian owners to Nokia Windows phones, Nokia said. It reiterated its hopes of selling an additional 150 million Symbian phones in future years.
Nokia pointed to other threats as well, such as the danger that the deal could erode its brand identity in areas such as China, where it is quite strong, and fail to enhance the brand in areas such as the U.S., where it is currently weak.
Another challenge will be building a profitable business model around a platform like Windows Phone, for which Nokia must pay royalties, Nokia said. While Symbian is a royalty-free operating system, it didn't come without significant costs to Nokia, which spent more than US$400 million in 2008 to buy the half of the Symbian company that it didn't already own.
In the filing, Nokia also warned about the challenges it faces internally as it implements the new plan for Windows Mobile. For example, it may not be able to change its mode of working or culture to work effectively with Microsoft, the company said. Because Nokia anticipates laying off a large number of workers, the remaining employees may lose motivation, energy and focus, thus reducing their productivity, Nokia said.
Because of all of the uncertainty resulting from the proposed deal, the company said it will not provide annual targets for 2011, although it expects its devices business to grow faster than the market.
It did not further elaborate on the precise amount of money that Microsoft will contribute to Nokia. In February, Nokia CEO Stephen Elop said that Microsoft would pay Nokia billions of dollars as part of the deal over an unspecified time.

Hands-on: Chrome 10 pushes the browser speed barrier
The new version of Google's Chrome browser adds speed, password syncing and a new Options tab.
As Web sites become increasingly complex, streaming media becomes more common, and applications migrate from PC-client-based to Web-based, it becomes increasingly important for browsers to be as fast and responsive as possible. In fact, if you spend most of your life in Web-based apps, a speedy browser has gone from being a nice-to-have to a must-have.
The just-released Chrome 10 comes with speed improvements that make Web sites load faster and Web-based apps run more quickly. It also offers a revamped Options interface, such as improved security and better syncing. Put them all together and you have a winning upgrade.
A need for speed
Chrome has always been speedy, and with this release it gets even faster. Version 10 incorporates Google's new Crankshaft JavaScript engine, which the company first showed off in December. In its Chromium blog, Google claims that Crankshaft offers a 66% improvement in JavaScript performance as measured by the V8 benchmark suite.
In order to see how Chrome 10 compares to its rivals, I ran the SunSpider JavaScript benchmark using a Dell Dimension 9200 with a 2.40GHz Intel Core 2 Quad processor and 2GB RAM running Windows Vista. I ran three sets of tests on each browser and averaged the results.
Results showed that Chrome has caught up to the long-time speed champion, Opera. Chrome 10 averaged 312.23 milliseconds (ms) to complete the tests, while Opera 11.01 averaged 309.97ms -- a virtual dead heat. Safari 5.0.3 came in at 406.933ms, with Firefox 3.6.15 well behind at an average 978.37ms and Internet Explorer 8 lagging at 5,035.07ms.
Keep in mind, however, that Internet Explorer 9 could take the lead once it becomes an official release on March 14. My tests showed Internet Explorer 9 Release Candidate proved to be fastest of all the browsers with a 274.6ms average time. In addition, Firefox 4 Beta 12 took 321.3ms to complete the tests, essentially a dead heat with Chrome and Opera.

Chrome 10 and Opera 11.01 are in a virtual dead heat in the author's SunSpider JavaScript benchmark tests. IE8 brings up the rear, but the IE9 RC leads the pack. (Smaller numbers are better.)
Feeds and speeds are one thing, but personal experience is another. I can vouch that virtually every Web site I visited was exceptionally fast and responsive, whether it was a simple, straightforward page, one that featured plenty of graphics or a Web-based app.
The upshot: If you want fast browsing and responsive Web-based apps, you want this version of Chrome.
Happy news for tweakers
The most noticeable change in Chrome 10 is the Options settings, and they'll be welcomed by tweakers and anyone who ever changes Chrome options. When you click the gear icon in the upper-right corner and select Options (Preferences on a Mac), the menu now opens in its own tab rather than in a relatively small window, as with previous releases, making it easier to find the options you want to change. (Story continues on next page.)

In Chrome 10, Options now opens in its own tab.

More important is that you can now search through Options, so you don't have to hunt around for the feature you want to change. For example, if you want to make changes to any settings related to downloads or passwords, type in one of those terms, and you'll be sent directly to those settings.
As you use Options, the Omnibox (Google's name for the address bar) displays a local URL for your location -- for example, chrome://settings/advanced for advanced settings and chrome://settings/browser for basic settings. In some instances, an individual Option feature or setting will have its own URL, such as chrome://settings/passwordManager for the Password Manager. You can add this to your bookmarks if it's a feature you frequently use, which I found very convenient.
What else is new
Syncing among multiple computers and devices has been improved as well. Chrome 9 already synced bookmarks among versions of Chrome running on Windows PCs, Macs, Linux systems and Android Honeycomb devices such as the Motorola Xoom. (The Honeycomb browser looks and works like Chrome but is actually based on different code, although it syncs with Chrome.) With Chrome 10, passwords now sync as well.
I've found that to be a big bonus, because I use Chrome as my primary browser on my PC, Mac and Xoom. So now when I need to log into my Computerworld blog or my online library account from any of my devices, I no longer need to remember passwords.
Also added is increased security for synced data -- your passwords are encrypted so that they can't be snooped on.
It did take some time for me to figure out how to get the syncing feature to work. Finally, I was able to get it to sync by going to the Personal Stuff options page (chrome://settings/personal), clicking Customize and then clicking OK on the Encryption tab. After that, it took about 45 minutes for all the passwords to sync.
Chrome's already solid security has also been improved. Earlier versions of Chrome already used a virtual sandbox, in which programs were isolated from the rest of your computer, so that they couldn't break out of the browser and infect your PC. In Chrome 10, the browser's integrated Flash player is now sandboxed as well for PCs running Windows Vista or Windows 7.
The bottom line
Chrome may have only 10.9% of the browser market by the latest figures, but this version may help change that. If you don't yet use Chrome, you may want to try it out for the speed improvement alone. The new Options tab and the ability to sync passwords are the icing on the cake.

Adobe launches Flash-to-HTML5 conversion tool

Wallaby is most significant for iPad and iPhone users because it would make more Flash content available to the iOS devices
For most people, Wallaby conjures up images of a kangaroo-like creature. In the halls of Adobe, though, it has taken on a more technical identity.

Wallaby is the code name for an experimental Flash-to-HTML 5 converter that Adobe has just released to the development community via Adobe Labs, the site featuring Adobe's beta technology.

A cross-platform Adobe AIR application, the tool allows users to instantly convert Flash output (FLA files) to HTML5 via a simple drag and drop. It is available free for download.

Wallaby, which was first previewed last fall at Adobe's Max 2010 developer conference, is featured at FITC, a Flash show in Amsterdam.

"We are making this available free on Adobe Labs as experimental technology; it's something we hope to continue to iterate and get feedback on from customers," said Tom Barclay, senior product manager for Flash Professional.

"I'm interested in how useful this output is, what people intend to use it for, and whether this is something we should be supporting longer term in Flash Professional as another output option or publish setting," he said.

The release is especially significant for the Mac community because this technology would make some content previously unavailable on the iOS platform viewable on the iPad and iPhone.

Apple does not support Flash on its iOS devices, arguing that Adobe's multimedia technology is vulnerable to exploits, consumes too much battery life, and crashes too often. Adobe has fired back that Apple's Flash ban is an overly restrictive policy that hurts users and software makers.

Not all elements from the Flash files will translate into HTML5, Barclay said. Users get the benefit of the overall design and motion graphic animations. But blend modes and filters -- as well as audio, video, and ActionScript -- are discarded in the translation.

The output from Wallaby is essentially a combination of HTML, SVG (Scalable Vector Graphics), and CSS and is intended as a starting point. Vector graphics are converted to SVG; bitmaps are converted to image elements and JPEG files; and text is converted to paragraph elements or SVG text. The Flash timeline is converted to a group of CSS animations. Scripting allows for batch processing of multiple FLA files.

Supported Flash Professional features include: vector art and images; classic text; keyframes; MovieClips and graphics; classic, motion, and shape tweens; rollover buttons; and instance names.

Unsupported Flash Professional features include: filters (except simple alpha); blend modes; dynamic masks; some TLF (Text Layout Framework) text; 3D transforms and 3D tween; audio and video; and ActionScript.

Adobe envisions developers using Wallaby primarily for building simple banner ads and other types of animation. For anything more sophisticated, Barclay says developers would bring the content into Dreamweaver and add interactivity using JavaScript and JQuery.

Wallaby has been tested specifically in WebKit-based browsers such as the latest versions of Safari and Chrome. Adobe has also done some preliminary testing of the converter in Firefox, Android, and Opera browsers, but those versions are not yet available.

Barclay emphasized that the Wallaby release is designed to make the technology widely available and to determine the level of interest. Right now, Adobe is seeking comment from the Flash community on how best to deploy Wallaby -- from suggesting applications for the technology to feedback on the code and other issues.

Will it eventually be added to some future version of Flash Professional? Adobe isn't making any promises, but neither is it ruling out the possibility.

iPhone, BlackBerry tumble to Pwn2Own hackers

Charlie Miller, a staple at the hacking contest, becomes 'Mr. Four-peat'
Apple's iPhone 4 and RIM's BlackBerry Torch 9800 both succumbed to hackers today at Pwn2Own, but two other smartphones running Android and Windows Phone 7 were unchallenged, the contest's sponsor said.

Charlie Miller became the first "four-peat" at Pwn2Own when he teamed with Dion Blazakis to take down the iPhone. Both Miller and Blazakis work for the Baltimore-based consulting firm Independent Security Evaluators (ISE).

Miller has walked off with winnings from Pwn2Own four years running -- 2008 through 2011 -- twice as many times as anyone else.

"Every other year I've had an exploit ready to go for months," said Miller in an interview after the win. "But this was a different experience, working under the time pressure because we were working on [the iPhone] exploit the night before."

Miller credited his partner for much of the work. "Dion's a really good researcher in his own right," said Miller.

Miller and Blazakis worked on their iPhone exploit for months, Miller said. "This one was pretty hard. Different bugs take different exploits, and this one was hard to exploit."

Pwn2Own winners are forbidden from discussing technical details of the vulnerabilities they exploit, or to release the attack code they've used. Instead, they turn over their findings and code to HP TippingPoint, the contest sponsor. TippingPoint in turn reports the vulnerabilities to vendors, who have six months to patch the bugs before TippingPoint publicly releases any information.

On the BlackBerry, a multi-national team composed of Vincenzo Iozzo, Ralf-Philipp Weinmann and a third researcher from the Netherlands, matched Miller and Blazakis by hacking the Torch. Iozzo and Weinmann were old hands at Pwn2Own, having partnered in 2010 to successfully break into an iPhone 3GS at that year's contest.

Iozzo is an engineer at Zynamics GmbH, the German reverse engineering tool maker headed by noted researcher Thomas Dullien, better known as Halvar Flake. Zynamics was acquired by Google earlier this month for an undisclosed sum.

Weinmann, meanwhile, is a post-doctoral researcher at the Laboratory of Algorithms, Cryptology and Security at the University of Luxembourg.

Both teams were busy tweaking their exploits before today's round, said Peter Vreugdenhil, a former Pwn2Own winner who now works for TippingPoint, and served as a contest judge this year.

"Both were actually tweaking their exploits at the [CanSecWest] conference," said Vreugdenhil, referring to the Vancouver, British Columbia security conference where Pwn2Own takes place.

The iPhone and BlackBerry Torch hacks, however, were over in seconds. "They hooked up their computers to the phones, and that was it," said Vreugdenhil.

The teams each will receive a check for $15,000 from TippingPoint, as well as the smartphones they exploited, in a ceremony Friday at CanSecWest.

Google's Chrome untouched at Pwn2Own hack match

Scheduled attackers don't show, or pass on exploiting sandboxed browser
Google's $20,000 was as safe at Pwn2Own Wednesday as if it had been in the bank.

The search giant had promised to pay $20,000 to the first researcher who broke into Chrome on the hacking contest's opening day.

But no one took up Google's offer.

"The first contestant was a no-show," said Aaron Portnoy, manager of HP TippingPoint's security research team, and Pwn2Own's organizer. "And the other team wanted to work on their BlackBerry vulnerability. So it doesn't look like anyone will try Chrome."

Only two entries had pre-registered for Chrome: Moatz Khader and one or more researchers going as "Team Anon." (Researchers may remain anonymous if they wish.) Based on a random drawing several weeks ago, Khader was to get first shot, with Team Anon second.

Team Anon is also slated to tackle RIM's BlackBerry OS on Thursday.

Late Wednesday, TippingPoint provided a tentative schedule for today's Pwn2Own; that schedule doesn't show any planned Chrome exploit.

Even if someone unexpectedly stepped up to take a crack at Chrome and exploited the browser, Google would be on the hook for just $10,000. As part of the deal it struck with TippingPoint, the two will split the $20,000 payment for a successful hack on the second or third days of the contest.

If Chrome comes out unscathed, as it now appears it will, the browser will have survived three consecutive Pwn2Owns, a record.

On Wednesday, researchers successfully exploited Safari and Internet Explorer. A team from French security company Vupen took down Safari 5 running on a MacBook Air notebook in five seconds, and independent researcher Stephen Fewer used a trio of vulnerabilities to hack IE8 on Windows 7.

Portnoy was impressed with Fewer's work. "The most impressive so far," said Portnoy. "He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That's something we've not seen at Pwn2Own before."

ASLR, for address space layout randomization, and DEP, or data execution prevention, are a pair of technologies baked into Windows that are designed to make it more difficult for exploits to reliably execute. Protected Mode is IE's "sandbox," which isolates the browser -- and thus any attack code that manages to infiltrate it -- from escaping to do damage on the system as a whole.

Pwn2Own continues today and Friday, when Mozilla's Firefox and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows 7 Phone and RIM's BlackBerry OS will be in researchers' crosshairs.

Apple's iOS 4.3 a welcome update for iPad, iPhone

A faster Safari, enhanced AirPlay, and security fixes make it a must-have

Apple's update for iOS 4, released Wednesday (two days earlier than expected ), offers a number of changes and new features for iPhone, iPad and iPod Touch owners, plus 59 security patches for the mobile version of Safari.

For that last reason alone, you should install iOS 4.3. But there's more than just improved security in the latest upgrade: As expected AirPlay compatibility has been extended to additional apps, Safari now runs faster, iTunes Home Sharing is better integrated and personal hot spot support for the AT&T version of the iPhone has finally been rolled out.

Apple's iOS 4.3 is compatible with the iPhone 4 (the GSM model only), the iPhone 3GS, the third and fourth generations of the iPod Touch, and both the original iPad and the iPad 2 that's due on Friday. There's also a related AppleTV update for those who have the latest AppleTV, which was released last September. Not getting this update are the first- and second-generation iPhones, released in 2007 and 2008, and earlier versions of the iPod Touch.

In addition to the big changes offered in iOS 4.3, Apple tucked away several minor tweaks: the Camera app has a new shutter sound; the Notes app gets a few additional fonts; the Location Services setting is now prominently displayed under Settings; and Ping notifications are available.

Safari and AirPlay

For most users, the changes to Safari will be most obvious. Safari is now speedier, with Javascript performance twice as fast as before, according to Apple. In fact, that claim may be understated; Insanely Great Mac and others who have tested the new Safari found its Nitro Engine Javascript to be noticeably faster than Apple claimed.

Safari can also now stream specific H.264 videos to an AppleTV using AirPlay. But in an apparent effort to appease content creators, Web videos must be specifically tagged to allow the streaming: If Safari detects content that is not authorized, the video plays locally on the iPad/iPhone/iPod Touch while the audio alone is transmitted via AirPlay. I'm not sure how many sites will allow this streaming to happen, but the feature works really well; it's nice to be able to beam content right to the TV without everyone crowding around my iPhone or iPad. Aintitcool.com, for instance, has a preview of the movie Thor that you can surf to on your phone and then stream to Apple TV. You can do the same thing with the Apple-supplied video of the iPad 2 unveiling that took place March 2.

The changes to AirPlay mean you can finally stream photos, slide shows and movies stored in the Photos app wirelessly to Apple TV. Better yet, AirPlay capabilities are now available to third-party developers, meaning non-Apple apps like Pandora or Vevo could add this feature to their own apps. The implementation is much better than before, when only iPod and YouTube content could be streamed, but it still needs some work. I'll get to that in a moment.
Home sharing
To enable Home Sharing, you have to plug in your Apple ID and password on your iOS device.
Home Sharing and Apple TV

Users of iTunes with Home Sharing turned on can now access all of their content on their iOS devices. That's important because as digital media collections grow, the limited storage of the iPhone or iPad can become a hindrance. It's easy to set up: Just enter your iTunes Home Share username and password under Settings / iPod, tap the More icon in the iPod app itself, and tap Shared. From there, pick the iTunes library you wish to access (iTunes must be running on the host computer), and just like that, media from the cloud, your cloud, is available on your iOS device.

Reminder: You have to be on the same WI-Fi network as the Home Share to get access to your digital libraries.

Researcher chains three exploits to take down IE8 at Pwn2Own

Marks the first ever Pwn2Own escape from a browser sandbox
An Irish security researcher today said it took him six weeks to craft a three-exploit package that brought Microsoft's Internet Explorer 8 (IE8) to its knees at Pwn2Own Wednesday.

Independent researcher Stephen Fewer walked off with $15,000 and a Sony notebook yesterday after hacking IE8 on Windows 7 by exploiting three unpatched vulnerabilities in the operating system and browser.

"It was a challenge, especially engineering the exploit that escaped Protected Mode," said Fewer today, referring to the "sandbox" that isolates IE8 from the rest of the computer.

The sandbox, like the one baked into Google's Chrome, is designed to hold malicious code within the browser so that it can't leak into the operating system or system as a whole.

"I spent about six weeks finding the vulnerabilities and engineering the exploits," Fewer said. "Then I decided to give [Pwn2Own] a go, and bought a plane ticket."

Fewer is a first-time Pwn2Own contestant and winner. He has a one-man consulting firm called Harmony Security, and is a long-time contributor to both the Metasploit open-source penetration testing toolkit project, and to HP TippingPoint's Zero Day Initiative (ZDI) bug bounty program, which pays researchers for finding and reporting vulnerabilities. TippingPoint is the sponsor of Pwn2Own.

Fewer chained three exploits together to bring down IE8, a feat that Aaron Portnoy, manager of TippingPoint's security research team and Pwn2Own's organizer, called "impressive" yesterday.

Two of the three were necessary to craft a reliable attack that sidestepped ASLR, for "address space layout randomization," and DEP, or "data execution prevention," on Windows 7. ASLR and DEP are technologies baked into Microsoft's operating system designed to make it more difficult for exploits to reliably execute.

The third exploit leveraged yet another bug to jump out of the Protected Mode sandbox.

"That was pretty difficult," said Fewer, talking about the sandbox-escape exploit. "It took quite a while to engineer that, and then there was the time pressure of the contest."

By escaping Protected Mode, Fewer was able to gain complete control over the Sony laptop running Windows 7, a point he proved by adding a file to the machine, mimicking a cybercriminal's insertion of additional malware.

Fewer's hack of IE was the first ever at Pwn2Own to bust out of a browser sandbox. Although Chrome also boasts an anti-exploit sandbox, that browser has never been breached at Pwn2Own.

Yesterday, one expected Chrome contestant was a no-show, while a team slated to go second decided to focus instead on an attack against RIM's BlackBerry OS later today.

Although Fewer acknowledged he hasn't poked around Chrome, he didn't seem surprised that no one took on Google's browser yesterday. "Chrome's sandbox is fundamentally quite solid," he said.

Fewer made use of the work by Peter Vreugdenhil, last year's IE Pwn2Own winner, to build his multi-part package. "Peter's work was great, and I applied a few of his techniques," said Fewer.

Vreugdenhil, who now works for TippingPoint, chained two exploits last year to bypass Windows 7's ASLR and DEP.

The only other browser to fall Wednesday was Apple's Safari 5, which dropped to a team from French security company Vupen minutes before Fewer took his shot at IE8.

Not surprisingly, Fewer felt great about winning the $15,000. "I feel fantastic," he said today. "Everything here went very smoothly."

He plans to spend the cash prize to pay for his trip from the U.K. and on some home improvements.

Today's Pwn2Own schedule will pit researchers against Mozilla's Firefox -- that browser's turn was postponed to today after Wednesday's round started late -- and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows Phone 7 and RIM's BlackBerry OS.

Google patches 19 Chrome bugs week before Pwn2Own hacking contest

Pays out $14K in bounties to 9 researchers
Google on Monday patched 19 vulnerabilities in Chrome, paying nine researchers $14,000 in bug bounties for reporting the flaws.
As it did last year, Google beefed up the security of its browser a week before the kickoff of Pwn2Own, the annual hacking contest held at the CanSecWest security conference in Vancouver, British Columbia.
The update to Chrome 9.0.597.107 fixed 16 flaws rated "high," the second-most-severe ranking in Google's threat system, and quashed three "medium" bugs.
None of the vulnerabilities were ranked "critical," the category essentially reserved for bugs that may let an attacker escape Chrome's anti-exploit "sandbox." Google patched two sandbox-escape bugs -- both pegged critical -- in Chrome this year.
The bugs patched Monday were in several components, including WebGL, the hardware accelerated 3D graphics API that debuted in early February with Chrome 9; SVG (scalable vector graphics) rendering and animation; and the browser's address bar.
Nearly a quarter of the vulnerabilities were identified as "stale pointer" bugs, a term used to describe flaws in an application's -- in this case, Chrome's -- memory allocation code.
As is its practice, Google locked its bug tracking database to bar outsiders from viewing the technical details of the just-patched vulnerabilities. The company blocks public access to flaws for weeks or even months to give users time to update.
Google paid out $14,000, the second-highest total this year, for the 15 vulnerabilities found and reported by outside security researchers. Nine different researchers received checks, with Martin Barbella taking home $3,000, Sergey Radchenko $2,500 and two others $2,000 each.
Google and Mozilla, which makes Firefox, are the only browser developers to pay bounties directly to bug researchers.
In hindsight, Monday's update should have been expected: In 2010, Google also patched Chrome the week before Pwn2Own.
2011's Pwn2Own begins March 9, when security researchers will vie for fame and cash by trying to take down not just Chrome, but also the current versions of Apple's Safari 5, Microsoft's Internet Explorer 8 and Mozilla's Firefox 3.6.
Monday's patches could be particularly important this year, since Google has a special stake in Pwn2Own: It put up the $20,000 prize for hacking Chrome on the first of the contest's three days. (After that, if no one breaks the browser, the rules change and Google will fork over just $10,000, with Pwn2Own sponsor HP TippingPoint ponying up the other $10,000.)
At least one other browser builder will issue patches before Pwn2Own's first day of competition. Mozilla has scheduled a security update of Firefox 3.6 for later today.
The patched Chrome 9 can be downloaded for Windows, Mac OS X and Linux from Google's Web site. Users already running the browser will be updated automatically.