Nokia lays out serious risks in Microsoft WP7 deal

Immaturity of the software is one serious risk, Nokia said
In a filing with the Securities and Exchange Commission on Friday, Nokia laid out the threats it faces as part of its planned deal with Microsoft to use Windows Phone 7 on its smartphones.
There are many, say Nokia. Some have already been identified by critics of the agreement, under which Nokia will phase out use of its Symbian operating system in favor of Microsoft's mobile operating system. Publicly held companies routinely disclose all the possible risks of their businesses to shareholders.
The immaturity of that software, just released in phones in November, is one serious risk, Nokia said.
"The Windows Phone platform is a very recent, largely unproven addition to the market focused solely on high-end smartphones with currently very low adoption and consumer awareness relative to the Android and Apple platforms, and the proposed Microsoft partnership may not succeed in developing it into a sufficiently broad competitive smartphone platform," Nokia wrote in the filing.
While the companies have signed a "non-binding term sheet," they still have to negotiate the final contract, a process that might take longer than expected or might not happen at all, Nokia warned.
By choosing Windows Phone, Nokia may forgo more competitive alternatives that would let its phones reach greater and faster acceptance in the market, it said.
Also, the transition to Windows Phone might take too long to allow Nokia to compete, given the ongoing development of other platforms, Nokia said.
In the same filing, Nokia said it expects to take two years to make the transition to Windows Phone as its primary platform. During that time, it will continue to support Symbian in the hopes of transitioning the installed base of 200 million Symbian owners to Nokia Windows phones, Nokia said. It reiterated its hopes of selling an additional 150 million Symbian phones in future years.
Nokia pointed to other threats as well, such as the danger that the deal could erode its brand identity in areas such as China, where it is quite strong, and fail to enhance the brand in areas such as the U.S., where it is currently weak.
Another challenge will be building a profitable business model around a platform like Windows Phone, for which Nokia must pay royalties, Nokia said. While Symbian is a royalty-free operating system, it didn't come without significant costs to Nokia, which spent more than US$400 million in 2008 to buy the half of the Symbian company that it didn't already own.
In the filing, Nokia also warned about the challenges it faces internally as it implements the new plan for Windows Mobile. For example, it may not be able to change its mode of working or culture to work effectively with Microsoft, the company said. Because Nokia anticipates laying off a large number of workers, the remaining employees may lose motivation, energy and focus, thus reducing their productivity, Nokia said.
Because of all of the uncertainty resulting from the proposed deal, the company said it will not provide annual targets for 2011, although it expects its devices business to grow faster than the market.
It did not further elaborate on the precise amount of money that Microsoft will contribute to Nokia. In February, Nokia CEO Stephen Elop said that Microsoft would pay Nokia billions of dollars as part of the deal over an unspecified time.

Hands-on: Chrome 10 pushes the browser speed barrier
The new version of Google's Chrome browser adds speed, password syncing and a new Options tab.
As Web sites become increasingly complex, streaming media becomes more common, and applications migrate from PC-client-based to Web-based, it becomes increasingly important for browsers to be as fast and responsive as possible. In fact, if you spend most of your life in Web-based apps, a speedy browser has gone from being a nice-to-have to a must-have.
The just-released Chrome 10 comes with speed improvements that make Web sites load faster and Web-based apps run more quickly. It also offers a revamped Options interface, such as improved security and better syncing. Put them all together and you have a winning upgrade.
A need for speed
Chrome has always been speedy, and with this release it gets even faster. Version 10 incorporates Google's new Crankshaft JavaScript engine, which the company first showed off in December. In its Chromium blog, Google claims that Crankshaft offers a 66% improvement in JavaScript performance as measured by the V8 benchmark suite.
In order to see how Chrome 10 compares to its rivals, I ran the SunSpider JavaScript benchmark using a Dell Dimension 9200 with a 2.40GHz Intel Core 2 Quad processor and 2GB RAM running Windows Vista. I ran three sets of tests on each browser and averaged the results.
Results showed that Chrome has caught up to the long-time speed champion, Opera. Chrome 10 averaged 312.23 milliseconds (ms) to complete the tests, while Opera 11.01 averaged 309.97ms -- a virtual dead heat. Safari 5.0.3 came in at 406.933ms, with Firefox 3.6.15 well behind at an average 978.37ms and Internet Explorer 8 lagging at 5,035.07ms.
Keep in mind, however, that Internet Explorer 9 could take the lead once it becomes an official release on March 14. My tests showed Internet Explorer 9 Release Candidate proved to be fastest of all the browsers with a 274.6ms average time. In addition, Firefox 4 Beta 12 took 321.3ms to complete the tests, essentially a dead heat with Chrome and Opera.

Chrome 10 and Opera 11.01 are in a virtual dead heat in the author's SunSpider JavaScript benchmark tests. IE8 brings up the rear, but the IE9 RC leads the pack. (Smaller numbers are better.)
Feeds and speeds are one thing, but personal experience is another. I can vouch that virtually every Web site I visited was exceptionally fast and responsive, whether it was a simple, straightforward page, one that featured plenty of graphics or a Web-based app.
The upshot: If you want fast browsing and responsive Web-based apps, you want this version of Chrome.
Happy news for tweakers
The most noticeable change in Chrome 10 is the Options settings, and they'll be welcomed by tweakers and anyone who ever changes Chrome options. When you click the gear icon in the upper-right corner and select Options (Preferences on a Mac), the menu now opens in its own tab rather than in a relatively small window, as with previous releases, making it easier to find the options you want to change. (Story continues on next page.)

In Chrome 10, Options now opens in its own tab.

More important is that you can now search through Options, so you don't have to hunt around for the feature you want to change. For example, if you want to make changes to any settings related to downloads or passwords, type in one of those terms, and you'll be sent directly to those settings.
As you use Options, the Omnibox (Google's name for the address bar) displays a local URL for your location -- for example, chrome://settings/advanced for advanced settings and chrome://settings/browser for basic settings. In some instances, an individual Option feature or setting will have its own URL, such as chrome://settings/passwordManager for the Password Manager. You can add this to your bookmarks if it's a feature you frequently use, which I found very convenient.
What else is new
Syncing among multiple computers and devices has been improved as well. Chrome 9 already synced bookmarks among versions of Chrome running on Windows PCs, Macs, Linux systems and Android Honeycomb devices such as the Motorola Xoom. (The Honeycomb browser looks and works like Chrome but is actually based on different code, although it syncs with Chrome.) With Chrome 10, passwords now sync as well.
I've found that to be a big bonus, because I use Chrome as my primary browser on my PC, Mac and Xoom. So now when I need to log into my Computerworld blog or my online library account from any of my devices, I no longer need to remember passwords.
Also added is increased security for synced data -- your passwords are encrypted so that they can't be snooped on.
It did take some time for me to figure out how to get the syncing feature to work. Finally, I was able to get it to sync by going to the Personal Stuff options page (chrome://settings/personal), clicking Customize and then clicking OK on the Encryption tab. After that, it took about 45 minutes for all the passwords to sync.
Chrome's already solid security has also been improved. Earlier versions of Chrome already used a virtual sandbox, in which programs were isolated from the rest of your computer, so that they couldn't break out of the browser and infect your PC. In Chrome 10, the browser's integrated Flash player is now sandboxed as well for PCs running Windows Vista or Windows 7.
The bottom line
Chrome may have only 10.9% of the browser market by the latest figures, but this version may help change that. If you don't yet use Chrome, you may want to try it out for the speed improvement alone. The new Options tab and the ability to sync passwords are the icing on the cake.

Adobe launches Flash-to-HTML5 conversion tool

Wallaby is most significant for iPad and iPhone users because it would make more Flash content available to the iOS devices
For most people, Wallaby conjures up images of a kangaroo-like creature. In the halls of Adobe, though, it has taken on a more technical identity.

Wallaby is the code name for an experimental Flash-to-HTML 5 converter that Adobe has just released to the development community via Adobe Labs, the site featuring Adobe's beta technology.

A cross-platform Adobe AIR application, the tool allows users to instantly convert Flash output (FLA files) to HTML5 via a simple drag and drop. It is available free for download.

Wallaby, which was first previewed last fall at Adobe's Max 2010 developer conference, is featured at FITC, a Flash show in Amsterdam.

"We are making this available free on Adobe Labs as experimental technology; it's something we hope to continue to iterate and get feedback on from customers," said Tom Barclay, senior product manager for Flash Professional.

"I'm interested in how useful this output is, what people intend to use it for, and whether this is something we should be supporting longer term in Flash Professional as another output option or publish setting," he said.

The release is especially significant for the Mac community because this technology would make some content previously unavailable on the iOS platform viewable on the iPad and iPhone.

Apple does not support Flash on its iOS devices, arguing that Adobe's multimedia technology is vulnerable to exploits, consumes too much battery life, and crashes too often. Adobe has fired back that Apple's Flash ban is an overly restrictive policy that hurts users and software makers.

Not all elements from the Flash files will translate into HTML5, Barclay said. Users get the benefit of the overall design and motion graphic animations. But blend modes and filters -- as well as audio, video, and ActionScript -- are discarded in the translation.

The output from Wallaby is essentially a combination of HTML, SVG (Scalable Vector Graphics), and CSS and is intended as a starting point. Vector graphics are converted to SVG; bitmaps are converted to image elements and JPEG files; and text is converted to paragraph elements or SVG text. The Flash timeline is converted to a group of CSS animations. Scripting allows for batch processing of multiple FLA files.

Supported Flash Professional features include: vector art and images; classic text; keyframes; MovieClips and graphics; classic, motion, and shape tweens; rollover buttons; and instance names.

Unsupported Flash Professional features include: filters (except simple alpha); blend modes; dynamic masks; some TLF (Text Layout Framework) text; 3D transforms and 3D tween; audio and video; and ActionScript.

Adobe envisions developers using Wallaby primarily for building simple banner ads and other types of animation. For anything more sophisticated, Barclay says developers would bring the content into Dreamweaver and add interactivity using JavaScript and JQuery.

Wallaby has been tested specifically in WebKit-based browsers such as the latest versions of Safari and Chrome. Adobe has also done some preliminary testing of the converter in Firefox, Android, and Opera browsers, but those versions are not yet available.

Barclay emphasized that the Wallaby release is designed to make the technology widely available and to determine the level of interest. Right now, Adobe is seeking comment from the Flash community on how best to deploy Wallaby -- from suggesting applications for the technology to feedback on the code and other issues.

Will it eventually be added to some future version of Flash Professional? Adobe isn't making any promises, but neither is it ruling out the possibility.

iPhone, BlackBerry tumble to Pwn2Own hackers

Charlie Miller, a staple at the hacking contest, becomes 'Mr. Four-peat'
Apple's iPhone 4 and RIM's BlackBerry Torch 9800 both succumbed to hackers today at Pwn2Own, but two other smartphones running Android and Windows Phone 7 were unchallenged, the contest's sponsor said.

Charlie Miller became the first "four-peat" at Pwn2Own when he teamed with Dion Blazakis to take down the iPhone. Both Miller and Blazakis work for the Baltimore-based consulting firm Independent Security Evaluators (ISE).

Miller has walked off with winnings from Pwn2Own four years running -- 2008 through 2011 -- twice as many times as anyone else.

"Every other year I've had an exploit ready to go for months," said Miller in an interview after the win. "But this was a different experience, working under the time pressure because we were working on [the iPhone] exploit the night before."

Miller credited his partner for much of the work. "Dion's a really good researcher in his own right," said Miller.

Miller and Blazakis worked on their iPhone exploit for months, Miller said. "This one was pretty hard. Different bugs take different exploits, and this one was hard to exploit."

Pwn2Own winners are forbidden from discussing technical details of the vulnerabilities they exploit, or to release the attack code they've used. Instead, they turn over their findings and code to HP TippingPoint, the contest sponsor. TippingPoint in turn reports the vulnerabilities to vendors, who have six months to patch the bugs before TippingPoint publicly releases any information.

On the BlackBerry, a multi-national team composed of Vincenzo Iozzo, Ralf-Philipp Weinmann and a third researcher from the Netherlands, matched Miller and Blazakis by hacking the Torch. Iozzo and Weinmann were old hands at Pwn2Own, having partnered in 2010 to successfully break into an iPhone 3GS at that year's contest.

Iozzo is an engineer at Zynamics GmbH, the German reverse engineering tool maker headed by noted researcher Thomas Dullien, better known as Halvar Flake. Zynamics was acquired by Google earlier this month for an undisclosed sum.

Weinmann, meanwhile, is a post-doctoral researcher at the Laboratory of Algorithms, Cryptology and Security at the University of Luxembourg.

Both teams were busy tweaking their exploits before today's round, said Peter Vreugdenhil, a former Pwn2Own winner who now works for TippingPoint, and served as a contest judge this year.

"Both were actually tweaking their exploits at the [CanSecWest] conference," said Vreugdenhil, referring to the Vancouver, British Columbia security conference where Pwn2Own takes place.

The iPhone and BlackBerry Torch hacks, however, were over in seconds. "They hooked up their computers to the phones, and that was it," said Vreugdenhil.

The teams each will receive a check for $15,000 from TippingPoint, as well as the smartphones they exploited, in a ceremony Friday at CanSecWest.

Google's Chrome untouched at Pwn2Own hack match

Scheduled attackers don't show, or pass on exploiting sandboxed browser
Google's $20,000 was as safe at Pwn2Own Wednesday as if it had been in the bank.

The search giant had promised to pay $20,000 to the first researcher who broke into Chrome on the hacking contest's opening day.

But no one took up Google's offer.

"The first contestant was a no-show," said Aaron Portnoy, manager of HP TippingPoint's security research team, and Pwn2Own's organizer. "And the other team wanted to work on their BlackBerry vulnerability. So it doesn't look like anyone will try Chrome."

Only two entries had pre-registered for Chrome: Moatz Khader and one or more researchers going as "Team Anon." (Researchers may remain anonymous if they wish.) Based on a random drawing several weeks ago, Khader was to get first shot, with Team Anon second.

Team Anon is also slated to tackle RIM's BlackBerry OS on Thursday.

Late Wednesday, TippingPoint provided a tentative schedule for today's Pwn2Own; that schedule doesn't show any planned Chrome exploit.

Even if someone unexpectedly stepped up to take a crack at Chrome and exploited the browser, Google would be on the hook for just $10,000. As part of the deal it struck with TippingPoint, the two will split the $20,000 payment for a successful hack on the second or third days of the contest.

If Chrome comes out unscathed, as it now appears it will, the browser will have survived three consecutive Pwn2Owns, a record.

On Wednesday, researchers successfully exploited Safari and Internet Explorer. A team from French security company Vupen took down Safari 5 running on a MacBook Air notebook in five seconds, and independent researcher Stephen Fewer used a trio of vulnerabilities to hack IE8 on Windows 7.

Portnoy was impressed with Fewer's work. "The most impressive so far," said Portnoy. "He used three vulnerabilities to [not only] bypass ASLR and DEP, but also escape Protected Mode. That's something we've not seen at Pwn2Own before."

ASLR, for address space layout randomization, and DEP, or data execution prevention, are a pair of technologies baked into Windows that are designed to make it more difficult for exploits to reliably execute. Protected Mode is IE's "sandbox," which isolates the browser -- and thus any attack code that manages to infiltrate it -- from escaping to do damage on the system as a whole.

Pwn2Own continues today and Friday, when Mozilla's Firefox and four smartphones running Apple's iOS, Google's Android, Microsoft's Windows 7 Phone and RIM's BlackBerry OS will be in researchers' crosshairs.

Apple's iOS 4.3 a welcome update for iPad, iPhone

A faster Safari, enhanced AirPlay, and security fixes make it a must-have

Apple's update for iOS 4, released Wednesday (two days earlier than expected ), offers a number of changes and new features for iPhone, iPad and iPod Touch owners, plus 59 security patches for the mobile version of Safari.

For that last reason alone, you should install iOS 4.3. But there's more than just improved security in the latest upgrade: As expected AirPlay compatibility has been extended to additional apps, Safari now runs faster, iTunes Home Sharing is better integrated and personal hot spot support for the AT&T version of the iPhone has finally been rolled out.

Apple's iOS 4.3 is compatible with the iPhone 4 (the GSM model only), the iPhone 3GS, the third and fourth generations of the iPod Touch, and both the original iPad and the iPad 2 that's due on Friday. There's also a related AppleTV update for those who have the latest AppleTV, which was released last September. Not getting this update are the first- and second-generation iPhones, released in 2007 and 2008, and earlier versions of the iPod Touch.

In addition to the big changes offered in iOS 4.3, Apple tucked away several minor tweaks: the Camera app has a new shutter sound; the Notes app gets a few additional fonts; the Location Services setting is now prominently displayed under Settings; and Ping notifications are available.

Safari and AirPlay

For most users, the changes to Safari will be most obvious. Safari is now speedier, with Javascript performance twice as fast as before, according to Apple. In fact, that claim may be understated; Insanely Great Mac and others who have tested the new Safari found its Nitro Engine Javascript to be noticeably faster than Apple claimed.

Safari can also now stream specific H.264 videos to an AppleTV using AirPlay. But in an apparent effort to appease content creators, Web videos must be specifically tagged to allow the streaming: If Safari detects content that is not authorized, the video plays locally on the iPad/iPhone/iPod Touch while the audio alone is transmitted via AirPlay. I'm not sure how many sites will allow this streaming to happen, but the feature works really well; it's nice to be able to beam content right to the TV without everyone crowding around my iPhone or iPad. Aintitcool.com, for instance, has a preview of the movie Thor that you can surf to on your phone and then stream to Apple TV. You can do the same thing with the Apple-supplied video of the iPad 2 unveiling that took place March 2.

The changes to AirPlay mean you can finally stream photos, slide shows and movies stored in the Photos app wirelessly to Apple TV. Better yet, AirPlay capabilities are now available to third-party developers, meaning non-Apple apps like Pandora or Vevo could add this feature to their own apps. The implementation is much better than before, when only iPod and YouTube content could be streamed, but it still needs some work. I'll get to that in a moment.
Home sharing
To enable Home Sharing, you have to plug in your Apple ID and password on your iOS device.
Home Sharing and Apple TV

Users of iTunes with Home Sharing turned on can now access all of their content on their iOS devices. That's important because as digital media collections grow, the limited storage of the iPhone or iPad can become a hindrance. It's easy to set up: Just enter your iTunes Home Share username and password under Settings / iPod, tap the More icon in the iPod app itself, and tap Shared. From there, pick the iTunes library you wish to access (iTunes must be running on the host computer), and just like that, media from the cloud, your cloud, is available on your iOS device.

Reminder: You have to be on the same WI-Fi network as the Home Share to get access to your digital libraries.