Joe John

Looking at the statistics, February was a positively brutal month for workers being idled. There were 2,769 mass layoff actions putting throwing 295,477 out of work. Last Friday, the Bureau of Labor Statistics (BLS) released the ugly numbers. That's 542 mass layoff actions more than January and 57,575 laid off.

The BLS only obliquely breaks out what could represent IT workers as "professional and technical services." Not surprisingly, manufacturing bore the brunt of February's layoffs accounting for 47% of the unemployment claims, but IT folks could represent a small piece in all the 19 industry sectors that BLS follows. I wondered how many of those were IT people and what percentage might turn to cyber crime. Suffice it to say there's plenty of IT folks with little or nothing to do. The story explores how idled workers in China are turning to cyber crime. That out of work IT professionals turn to cyber crime should come as no surprise so the headline China becoming the world's malware factory on top of an IDG News service is to be expected.

Everyone needs to be vigilant (but not turn into vigilantes). Indeed, a story at Chief Security Officer cites a Symantec study that says 98 percent of organizations suffer "tangible loss" as the result of cyber crime (more than a little self-interest on Symantec's part should be noted). With the third variant of the Conficker worm set to strike on April 1, take the message of vigilance to heart (let's hope it's as tepid as Y2K). By the way, the BBC reported this morning that the U.K. Government is monitoring social networking sites like Facebook to "tackle criminal gangs and terrorists." That's vigilance of a controversial nature. It's obvious: the latter. Is this just another day in the cyber jungle or is the cyber crime problem exacerbated by the expanding ranks of the idled? So if you want to freshen up your knowledge of malware, check out the many primers on the subject. I like Wikipedia's or check out the Chief Security Officer web site.

Intel today announced it is investigating reports from iPhone owners that they're unable to sync their devices to new PCs, although Microsoft said it had received no calls from customers about the glitch. Users first reported iPhone sync problems with Windows-based PCs in mid-September, but the traffic on the thread dedicated to the issue picked up when Microsoft released Windows 7 on Oct. 22. "I can plug [my iPhone] in again and iTunes will recognize it, but it says: 'iTunes could not connect to this iPhone because of an unknown error occurred (0xE8000065)'," said "MrBahr" in the kick-off message. Apple, meanwhile, has asked users on its support forum to submit the make of their computer, the version of its BIOS, their iPhone or iPod model and other information to help it troubleshoot. "Our leading theory is a BIOS or system configuration issue, but we are still investigating," an Intel spokesman said Tuesday, referring to reports on Apple's support forum that users have been unable get their iPhones to synchronize after upgrading to Windows 7, in particular the 64-bit edition of Microsoft's operating system. Most people adding to the thread said that their PCs were equipped with Intel's P55 Express chipset, which is included on motherboards intended for machines powered by Intel's quad-core i7 and i5 processors.

Maybe. [But] installing the iTunes update on my P55 system bricked my iPhone forcing a restore and now it will not sync (or connect) on that computer." Microsoft said that as far as it knew, Windows 7 was not responsible, but said it's looking into the problem nonetheless. " Microsoft has not seen this particular question posed in the Microsoft Answers for Windows 7 community forum, nor in any of our call centers," a company spokeswoman said today via instant message. "We reviewed the issue raised on the Apple Discussion Board and are currently investigating. Desktop and notebook PCs running those CPUs are available now from the likes of Hewlett-Packard; Apple plans to ship iMacs with those processors later this month . "I've got the same problem running Windows 7 Professional on a EVGA P55 SLI [mother]board, Core i7 860 processor," said a user identified as "e8link" on the Apple support thread. "Got the same stupid issue, already wasted 4 hours on this," complained "scamsel" on the same thread. "I have the new ASUS P55 EVO board using Windows 7 x64 Ultimate & just got a new rig this week, already this big issue, should have gotten a new iMac!" Although many pinned blame on Windows 7, some said that the new operating system was not at fault. "I have NO ISSUES with both Windows 7 32- and 64-bit on non-P55 [mother]boards," reported "scribbydagreat" in a Monday message. "Coincidence? If we determine this to be a problem specific to Windows 7, we will post an update on the Microsoft Answers site." Although there are iPhone-related questions on Microsoft's Answers support forum, none directly pertain to the synchronization problem being discussed on the Apple support site. Someone tagged as "Roy B" asked users on Sunday to send system details to an apple.com e-mail address. "We would like to get some more details about systems that are experiencing this issue. For it's part, Apple is also investigating the problem.

If you are having issues connecting your iPhone or iPod to a Windows 7 computer with the Intel P55 chipset, please compose an e-mail with this information," Roy B said, then followed that with a list that included the computer maker and model, the motherboard maker and model, the BIOS version, and the iPhone or iPod model being used. Inconsistent and random failures ranging from inability to sync only pictures to completely making the iPhone unrecognizable to any iTunes computer requiring a Restore," said "WildWill" yesterday. "Having tried everything I have read on the posts and forums on my P55, I am GIVING UP!" shouted scribbydagreat. "Nothing has worked and now am cynical that anything will until Apple issues an update." Users are frustrated. "Can't sync.

Maryland Gov. The state has literally mapped out where every dollar from the American Recovery and Reinvestment Act (ARRA) is going. Martin O'Malley doesn't have to guess where federal stimulus funds will do the most good in his state: He can see for himself - and his constituents can, too.

The data is displayed at StateStat, a Web site that pulls data from a geographic information system (GIS) that O'Malley's administration originally developed in 2007 to track the performance of state government. Maryland's pioneering work with GIS and ARRA reporting caught the eye of Earl Devaney, who, as chairman of the Recovery Accountability and Transparency Board, pushed for GIS-based reporting on the federal government's new Recovery.gov Web site. With StateStat in place, "we were well equipped to track those recovery dollars and do so in an open, transparent and measurable way," O'Malley says. That site, which relaunched on Sept. 28, uses similar technology to add spending maps. "This is one of the most important features on the whole Web site," says spokesman Edward Pound. Projects show up on maps as pushpin-style icons that vary in size with the spending within each area. Visitors to Maryland's StateStat Web site can see the total amount of stimulus dollars coming into the state and the counties that are receiving those funds.

Building on templates originally developed for Maryland by GIS vendor Environmental Systems Research Institute Inc. (ESRI), some other states have begun using the same tools to build their own reporting Web sites. Maryland is ranked No. 1. At StateStat, visitors can view spending within specific categories, such as transportation and housing. Ranked No. 1 What makes Maryland unique is the breadth and depth of data it provides, says Phil Mattera, research director at Good Jobs First, a Washington-based nonprofit research center that has ranked state Web sites based on how well they disclose expenditures from the $787 billion stimulus bill. From there, they can drill down to see the exact locations and details of specific programs and projects. What's particularly powerful about StateStat is its potential to show visually whether spending matches up with the areas of greatest need. In some areas, such as transportation, they can see who got the contracts, the winning bid, how far along the project is and the number of jobs each project will create. "Maryland is one of the few that has been doing that," says Mattera.

Visitors can view maps with overlays that show both spending data and need levels for every area. Most states aren't doing that yet, Mattera notes. The need overlays might include regional unemployment or foreclosure rates, for example. "The maps show us where the problems are and therefore where the opportunities are," O'Malley says. Baltimore roots StateStat, which the O'Malley administration launched shortly after taking office in 2007, is based on a system called CitiStat, whose development O'Malley oversaw when he was mayor of Baltimore. StateStat is built on ESRI's ArcGIS server platform.

CitiStat was based on CompStat, a statistical reporting system used in New York in the late '90s to fight crime. It uses Web services developed by the state as well as the StateStat templates that ESRI built in collaboration with Maryland and other states. Since many state governments already use ESRI's GIS products, the incremental cost to implement the system is relatively small, says ESRI founder and President Jack Dangermond. ESRI has made those templates available at no charge to any state that wants to use them. Other states, such as Washington and Colorado, have used the templates to build their own reporting sites. During biweekly meetings with department heads, the governor uses GIS maps to track projects and the performance of departments.

StateStat has the potential to show citizens the return on investment they get from get from government programs, and it could be used to hold agency chiefs accountable, O'Malley says. O'Malley says he uses GIS maps to quickly assess which divisions are performing well and which need new leadership. "That ability to recognize who the leaders are is what gets your entire organization to lean forward. But StateStat is far from perfect. "There's a lot of missing data," says Mattera, especially with regard to specific project details and performance metrics that show the impact of programs, such as the effect of weatherization initiatives on the number of applications for energy assistance. "The data in there now is not as granular as we want it," says Beth Blauer, director of the StateStat program. That's what makes it go," he says. But that's just one item on her wish list. "We are still dealing with a lot of issues as they relate to getting the data into iMap," the ArcGIS server behind StateStat, says Blauer.

Because the state agencies use many different GIS servers and databases, they export data in Excel format and give it to Blauer's staff, who must import it manually. Those issues include data ownership, accuracy, age, how often data is refreshed and whether it will be meaningful to decision-makers. It has been particularly difficult to maintain data integrity and get updates automated, she says. Blauer says that eventually, StateStat will be used at all levels of government and available to the public. "You'll be able to see where we are spending money in education and whether the test scores are getting better." She also envisions adding tools to allow public participation online. "They will be able to engage in a dialogue with government using the data," she says. Another goal is to add performance data that could, for example, illustrate the impact of a program by showing the effect of spending on the unemployment rate. But that may take some time: Blauer has just five people on staff.

Most information is still viewed by department, not by the geographic area where the money is actually spent. While the state of Maryland is using mapping technology to show where federal stimulus money is being spent, ironically, it has yet to do the same for the expenditure of funds from its own state coffers. But O'Malley says he wants to move in that direction. In the worst-case scenario, the data could be misused or misinterpreted. He also says he wants to make the raw data behind all of those pretty maps and charts available to the public as a download that could be imported into Excel, a GIS application or other analytical tools for further analysis (a feature that Recovery.gov already offers for all stimulus spending data - including Maryland's). However, releasing the raw data behind all state government reporting means the administration will lose control of how results are presented.

But O'Malley says he isn't worried. "I gamble wholly on the notion that people are smart and that, if given the information, [they] will make increasingly better decisions," he says. But O'Malley is optimistic. Whether StateStat ushers in a new era of openness in government - or fades with the ARRA reporting requirements - will likely depend more on politics than on technology. He points to his successor in Baltimore, who has continued to use CitiStat. "The public saw the value in it. That would have made it difficult to not continue doing it," he says. "Hopefully my successor here will also continue to do that [with StateStat]."

An Illinois judge this week dismissed a lawsuit filed by the Cook County Sheriff's Office charging Craigslist with facilitating prostitution. But the judge in the U.S. District Court for the Northern District of Illinois said that Craigslist can't be blamed. "Intermediaries are not culpable for 'aiding and abetting' their customers who misuse their services to commit unlawful acts," the judge wrote in his dismissal of the case. The sheriff's office announced that it filed the suit in March at a press conference describing the many stings officers have arranged after reading ads for prostitutes on the site, including some that found children and women trafficked in from other countries who were forced into prostitution. Craigslist warns users against illegal activity, bans illegal activity in its terms of use and removes inappropriate content that it discovers.

The Cook County Sheriff's Office has nearly three weeks to decide whether to appeal, said Steve Patterson, a spokesman for the department. If users ignore those rules, it isn't Craigslist's fault, the judge said. "While we accept as true the plaintiff's allegation that users routinely flout Craigslist's guidelines it is not because Craigslist has caused them to do so," the judge wrote. If it does, it will argue that the dismissal did not adequately consider the original complaint's charge that Craigslist poses a public nuisance, he said. Craigslist noted the ruling on its blog but did not otherwise comment. The court's ruling this week concluded that the Communications Decency Act, which protects online companies from liability over the way people use their services, essentially trumps the public nuisance claim, he said. The Electronic Frontier Foundation praised the ruling. "Meritless cases brought by law enforcement officers, amounting to little more than publicity stunts with little to no chance of success, do little to address the officers' underlying concerns," Matt Zimmerman , a senior staff attorney with the EFF, wrote in a blog post. "Service provides are not liable because Congress correctly understood that the soap box should not be held responsible for the speech of others.

Just as phone companies are not liable for harassing phone calls, or e-mail software providers for deceptive messages, online message boards like Craigslist are in most instances not liable for their users' posts."Following the initial filing of the suit, Craigslist removed its "erotic services" category, replacing it with one called "adult services." Each posting to the category is now manually reviewed before it is posted and costs $10.

Symantec Corp. today released a new version of Norton Online Backup that supports both Windows and Mac operating systems on up to five computers, linked together through the same central account. Backed-up files also can be retrieved from any Web connection, including up to 90 days of file revisions. Norton Online Backup version 2.0 now allows users to transfer files between any of their computers and with other users.

With Norton Online Backup's Web browser, users can select and share any of the files they have backed up by generating download links that can be e-mailed to any address. Norton Online Backup retails for $49.99 per year, which includes 25GB of online storage to back up files from up to five computers. Users who've purchased new computers, for example, will be able to use the file transfer feature to populate their machines from current systems. Additional storage space can be purchased incrementally at any time. "Now consumers can turn to Norton to back up their priceless photos and music collections," Rowan Trollope, senior vice president of consumer products and marketing at Symantec, said in a statement. "With the combination of our brand, worldwide reach, and these latest technical improvements, we intend to bring online backup to consumers in a major way." An advanced search feature also allows users to search for backed-up files by name, date, size or type of file. Also, the file purge and storage management features allow users to remove previously backed-up files in sequential order to clear up available storage space.

File backup stores the most current file, even if it's open, which can be handy for e-mail files. Other features include improvements to file migration, automatic initial setup, user settings and a more intuitive redesign of the user interface, Symantec said. Version 2.0 supports cross-platform functionality for Windows XP, Vista, Window 7 and Mac OS X, including Mac OS X 10.6 (Snow Leopard). The upgraded version is available through retail stores and through Symantec's online store . The new version of Norton Online Backup will be updated automatically for current subscribers within the coming weeks.

Lawmakers called upon the Transportation Security Administration and private sector companies to quickly re-establish a nationwide registered traveler program to help frequent travelers get through airport security checkpoints faster. Both lawmakers and vendors said the TSA had not done enough to support the registered traveler program and in fact distanced itself from the effort over the past year. The calls came after the abrupt closure earlier this year of Verified identity Pass Inc. (VIP), the largest provider of registered traveler services, and the subsequent shutting of services by two other vendors that offered the same service. The TSA, meanwhile, insisted that the program did little to improve security.

At a hearing on the future of the registered traveler program Wednesday, members of a House subcommittee on Homeland Security urged the TSA and private vendors to work together to quickly restore the service. The agency said that just because members of such programs had been pre-screened didn't eliminate the need for them to go through airport security checks like everyone else. The hearing came on the same day an investment banking firm, Henry Inc., said it had signed a letter of intent to buy VIP's assets and relaunch the service by the end of the year." U.S. Rep. At the same time, private sector companies need to find a model "that can support a security benefit, but which does not rely on one," she said. Sheila Jackson Lee (D-Texas), the subcommittee chairwoman, expressed hope that the TSA would make a "good faith effort" to explore a security benefit, or an additional layer of security vetting, for the registered traveler program. Even if passengers must still go through a security screeening, these companies can still offer the convenience of getting their customers through the process quicker, such as using a separate member-only line at security checkpoints.

Since 2005, the TSA has piloted several iterations of the program with private sector companies. The registered traveler program was established under the Aviation and Transportation Security Act (ATSA). It authorizes the TSA to implement trusted passenger programs to speed up the security screening of passengers who have submitted to comprehensive background and security checks. The biggest of them was VIP, which offered a registered traveler service called "Clear" at 21 major airports. The announcement raised immediate concerns about the data that VIP had collected as part of its Clear service, including Social Security and credit card number and home address. The company, which had signed up more than 200,000 subscribers, stopped service in June saying it had run out of money.

The company had also collected fingerprints, iris scans and digital images of customers' faces. Soon after Clear stopped its service, rivals Fast Lane Option Corp . (Flo) and Vigilant Solutions also shut down their services. Many who had paid a $199 annual fee were unable to get refunds. During the hearing, U.S. Rep. Going forward, the TSA needs to take the lead in supporting the program, Thompson and others said.

Bennie Thompson (D-Miss.) said it is Congress' intent that such "a quick closing of business" does not happen again. "The traveling public deserves better," Thompson said. Much of the reason the program is in disarray is because the TSA failed to support the effort, witnesses said. Despite the mandate from Congress, the TSA has not fully implemented the use of biometrics as a primary form of identification, Fischer said, nor has it used background screening to vet those using the RT lanes as it was supposed to. While the registered traveler program at one time was expected to provide add an additional layer of security at airports, today it is little more than a convenience for travelers willing to pay for it, they said. "To date, while the private sector has invested over $250 million and upheld its side of the partnership, the TSA has not," said Fred Fischer, managing partner at Flo Corp. Though the TSA at one point collected $28 per passenger to do a so-called Security Threat Assessment (STA) of passengers who had signed up for registered traveler programs, not one applicant was ever vetted using a criminal history records check, he claimed. John Sammon, an assistant administrator at the TSA, said that based on the pilot programs and the agency's own insight, registered traveler programs do not offer any additional security.

As a result, the promised security benefits of the registered traveler program have yet to be realized, he said. He said the TSA stopped doing security threat analysis for registered traveler programs because there was little value to be gained. "The prospect of a terrorist not identified on a watch list raised questions about the viability of a registered traveler program," he said. Going forward, the TSA will work with private vendors to identify programs that will support registered travelers programs, he said. After an evaluation of the pilot programs, the TSA concluded that registered traveler programs "do not provide any additional levels of security," he said. However, from a security standpoint, such passengers will still be subject to the same security checks as other ticketed passengers, he said.

It's as inevitable as the turkey hangover the day after Thanksgiving: There's a hot new camera, game system or MP3 player everyone wants for the holidays, and that demand causes the price to stay high. There are a few things you can do to keep your tech budget in check-and nearly all of them involve the Internet. What's a budget-minded technophile to do?

As part of our annual Gear Guide, we've rounded up some tips to help you get the most out of your gift-buying dollar this holiday season. There are two handy categories of bargain-hunting sites you can follow: deal aggregators, which collect sales notices across the Web, and deal-a-day sites, which offer one item on sale daily, so long as supplies last. Do your research Use your RSS reader to keep on top of retailers' best tech deals. Some of the most useful deal aggregators are: Ben's Bargains : This site aggregates the Web's best tech deals and allows you to track specific products and vendors. Newegg.com : This vendor has a reliably varied inventory and dramatic price reductions. Deal News : In addition to a dedicated tech deals section, the site also offers coupons for specific tech vendors, including the Apple store.

Spoofee : This site isn't purely tech-oriented, but it does a great job compiling deals from Amazon, Buy.com, GoGamer and other tech retailers. And the deal-a-day sites you'll want to follow include: Apple DOD : This site offers lots of accessories and peripherals-in other words, great stocking stuffers. Stootsi : Its Apple category offers a wide variety of new and refurbished goods. Cowboom : It offers one tech-related deal per day, but don't rule out the rest of the site's inventory. New Day New Deal : There are a lot of entertainment-related deals here, from Wii accessories to multimedia speaker systems.

Deadly Deal : The site also offers giveaways; recently, visitors scored free iPod earphones. Finally, check out the inventory on refurbishment sites. Throw yourself on the mercy of strangers Alternately, you can try your luck with Craigslist or eBay. Start with Apple-under the Special Deals section of its online store, you'll find links to their refurbished Macs and iPods, as well as clearance items. Depending on how much demand there is for the product you want, you may be able to get your gadget for a substantial discount off the retail price. First, there's no guarantee that you'll be getting what's listed, and it can be a struggle to get your money back.

There are some things to keep in mind when dealing with individual sellers. Second, it's up to you to do due diligence. If you do go the Craigslist or eBay route, don't forget to ask about packaging and documentation. If the gadget you want comes with software (for example, a digital camera or a scanner), make sure the seller provides proof that they've got installation disks and a software license number so you've got a usable gadget. Think outside the (shrinkwrapped) box Finally, keep an eye out for gadgets that pack a bang for the buck.

It's a definite best-in-class bargain. For example, the Flip Mino HD videocamera (Get best current price) is a lightweight, versatile and comparatively inexpensive portable videocamera. Visit your favorite tech products-review site and see which items are lauded by the reviewers as a great deal. While a photo printer may seem like the perfect gift for the grandparents, that $89 bargain you snapped up at Best Buy will end up costing a lot more in the long run owing to ink cartridges. Finally, don't buy a gadget just for the sake of giving someone a toy to unwrap under the tree.

In the case of photo-mad relatives, it might be more economical to give the gift of a Snapfish account. [Lisa Schmeiser is a freelancer writer who also runs the Dollars & Sense personal finance blog at SFGate.com.]

Microsoft yesterday re-patched Internet Explorer, the third time it's been forced to repair one of the updates from its largest-ever bug fix, which was delivered on Oct. 13. Monday's fix targeted MS09-054 , the update that patched four vulnerabilities, all "critical," in Internet Explorer (IE). According to Christopher Budd, a spokesman for the Microsoft Security Response Center (MSRC), the follow-on hotfix patches Web page display problems introduced by the update. The new problems can crop up in any still-supported edition of IE, including IE 5.01, IE6, IE7 and the newest version, IE8, on all Windows operating systems, including Windows 7. The troubles are serious enough to prompt Microsoft to push the re-patch to all users. "We plan to release this update through the same broad release channels as the original security update, MS09-054," Budd said in an entry to the MSRC blog yesterday. "Customers will see [the re-patch] offered by default through Windows Update, Microsoft Update and Automatic Updates." Computerworld confirmed that Windows XP, Vista and Windows 7 systems that had been fully patched last month were offered Monday's update through Windows Update. Budd downplayed the severity of the problems, saying that the number of users affected was "limited." A document on Microsoft's support site outlined the two issues, one that scrambles Web page elements, while the other spawns a "Type Mismatch" script error on sites that use VBScript or a mix of VBScript and JavaScript.

Monday's re-patch was the third correction related to Oct. 13's massive security update , which set records for both the number of separate bulletins (13) and the number of vulnerabilities quashed (34). On Oct. 14, Microsoft offered up a workaround for a problem with MS09-056 , then corrected several errors in MS09-062 last Thursday. It's not unusual for Microsoft to re-release security updates. The company also revised an August update, MS09-043 , last week to correct a patch-detection error that may have left some corporate users who receive updates via Windows Server Update Services (WSUS) unpatched. In June 2008, for example, the company admitted a patch intended to fix a problem in Windows XP's implementation of Bluetooth didn't work. The update for MS09-054 can be downloaded from Microsoft's site, or retrieved using Windows Update or WSUS.

Microsoft blamed human error for the snafu.

What was essentially a typo last night resulted in the temporary disappearance from the Internet of almost a million Web sites in Sweden - every address with a .se top-level down name. Problems that affect an entire top-level zone have very wide-ranging effects as can be seen by the .se incident. … Imagine the same thing happening to the .com domain, which has over 80 million domain names." The total blackout of .se lasted for about an hour and a half, Pingdom says, although aftershocks are expected to continue. "The .SE registry used an incorrectly configured script to update the .se zone, which introduced an error to every single .se domain name," says Pingdom. "We have spoken to a number of industry insiders and what happened is that when updating the data, the script did not add a terminating '.' to the DNS records in the .se zone. According to Web monitoring company Pingdom, which happens to be based in Sweden, the disablement of an entire top-level domain "is exceptionally rare. … Usually it's a single domain name that has been incorrectly configured or the DNS servers of a single Web host having problems.

That trailing dot is necessary in the settings for DNS to understand that '.se" is the top-level domain. Thanks to well-functioning surveillance system .SE discovered the error immediately and a new file with the DNS data (zone file) was produced and distributed within one hour. … The false information that was sent out affected accessibility to all .se domains for a short time. It is a seemingly small detail, but without it, the whole DNS lookup chain broke down." Sweden's Internet Infrastructure Foundation, which administers .se, issued this statement: "The cause was an incorrect software update, which, despite our testing procedures were not detected. However, there may still be some name servers that have not changed out of misinformation against the real." A spokesperson for .se, Maria Eklund told a Swedish press outlet that the issues may not be completely resolved before Wednesday. "This little mistake is going to affect Internet traffic for two days," she told the newspaper. (Speculation that it's really the fault of newly "internationalized" ICANN begins in 3 … 2 … 1.)

PC makers looking to boost sales in recent years have increasingly zoned in on rural China, a vast and largely untapped source of new PC users. But other Chinese and foreign PC makers are also building their distribution networks in those regions in a bid to boost sales. "Most vendors have realized the importance of this market," said Simon Ye, a Gartner analyst. Lenovo and Hewlett-Packard are the major PC makers that have made the most progress in rural China, a term often used to describe everything from mountaintop villages to cities of a few hundred thousand people.

But not all PC makers are ready to tackle rural China, said Ye. The HP and Lenovo cases suggest that catered marketing tactics and a major investment in expanding a company's retail outlets are required for a rural sales push to succeed. The vendor further extends its reach by selling PCs out of vans that it sends around the country. HP this year has partners running 7,000 retail stores for its PCs in China, and it aims to expand that network to cover 10,000 Chinese towns next year. HP also has a van that visits universities, clients and IT expos to show off PCs and teach people how to use them. HP staff gave talks and showed the animated movie "Kung Fu Panda" as they displayed the company's PCs to students. In June the bus visited a rural elementary school near Chongqing, an inland Chinese metropolis.

Lenovo has also used movies to promote its PCs in rural areas. HP has grown to become the second-largest PC vendor in China, where it took 14.2 percent of the market in the second quarter, according to IDC. Lenovo, a Chinese brand, led the market with a share of 28.5 percent. The company arranges screenings of current films that it precedes with Lenovo ads. Many potential PC buyers remain untapped in rural China. Chinese authorities launched a subsidy scheme for rural residents early this year that grants a 13 percent rebate on the purchase of PCs and other electronics.

Just over one in four PCs sold in China in the same quarter were sold in tier-one and tier-two cities, a category that includes cities such as Beijing, Shanghai and some provincial capitals, according to IDC. "The remainder obviously shows you the big opportunity in the lower-tier cities," said Bryan Ma, an IDC analyst. The scheme, an effort to drive domestic economic growth amid the global recession, sold nearly 580,000 computers by the end of September, according to China's commerce ministry. More than 40 percent of the PCs sold in the scheme were from Lenovo in September. But those sales have been dominated by Chinese companies like Lenovo and Founder, another PC maker that has targeted the rural market. HP took just 3 percent of the sales, while Dell and Acer both had less than 1 percent.

Both companies equip the PCs to function through the electric voltage fluctuations common in rural areas. Both HP and Lenovo tweak PCs for rural buyers. They also load the machines with programs such as agricultural databases for farmers - and the companies' own entertainment suites. Lenovo is pitching its PCs as wedding gifts with slogans like, "Lenovo wedding computers, one step to a happy life." The marketing makes use of a traditional preference in China to give gifts that appear prestigious. Lenovo has tailored its ads for the rural market, where the company is building nearly 8,000 new sales outlets.

Another slogan targeting businesspeople calls Lenovo PCs the "golden key to information wealth." Dell is another PC maker that hopes to crack China's rural market, but the company has only recently begun seeking the distribution partners it will need to do so, said Ye of Gartner. HP's success has largely been driven by its use of different resellers in each region of China, he said. "It will take two to three years to see if Dell can reproduce HP's success," said Ye.

Apple missed a golden opportunity to lock down Snow Leopard when it again failed to fully implement security technology that Microsoft perfected nearly three years ago in Windows Vista, a noted Mac researcher said today. Miller was disappointed that Apple didn't improve ASLR from Leopard to Snow Leopard. "I hoped Snow Leopard would do full ASLR, but it doesn't," said Miller. "I don't understand why they didn't. But Apple missed an opportunity with Snow Leopard." Even so, Miller said, Apple made several moves that did improve Mac OS X 10.6's security. Dubbed ASLR, for address space layout randomization, the technology randomly assigns data to memory to make it tougher for attackers to determine the location of critical operating system functions, and thus make it harder for them to craft reliable exploits. "Apple didn't change anything," said Charlie Miller, of Baltimore-based Independent Security Evaluators, the co-author of The Mac Hacker's Handbook , and winner of two consecutive "Pwn2own" hacker contests . "It's the exact same ASLR as in Leopard, which means it's not very good." Two years ago, Miller and other researchers criticized Apple for releasing Mac OS X 10.5, aka Leopard, with half-baked ASLR that failed to randomize important components of the OS, including the heap, the stack and the dynamic linker, the part of Leopard that links multiple shared libraries for an executable. Two that stand out, he said, were its revamp of QuickTime and additions to DEP (data execution prevention), another security feature used in Windows Vista. "Apple rewrote a bunch of QuickTime," said Miller, "which was really smart, since it's been the source of lots of bugs in the past." That's not surprising, since QuickTime supports scores of file formats, historically its weak link.

How Apple's rewrite of QuickTime for Snow Leopard plays out, of course, is uncertain, but Miller was optimistic. Last week, in fact, Apple patched four critical QuickTime vulnerabilities in the program's parsing of various file formats. An exploit of a vulnerability in Leopard's QuickTime that he had been saving doesn't work in the version included with Snow Leopard, Miller acknowledged. "They've shaken out hundreds of bugs in QuickTime over the years, but it was still really smart of them to rewrite it," said Miller. I don't think anyone would miss them." Snow Leopard's other major security improvement was in DEP, which Miller said has been significantly enhanced. If it was up to him, though, Miller would do even more. "I'd reduce the number of file formats from 200 or so to 50, and reduce the attack surface.

DEP is designed to stop some kinds of exploits - buffer overflow attacks, primarily - by blocking code from executing in memory that's supposed to contain only data. That's because if [the hacker] can hit 90% of the machines out there, that's all he's gonna do. Microsoft introduced DEP in Windows XP Service Pack 2 (SP2), and expanded it for Vista and the upcoming Windows 7 . Put ASLR and DEP in an operating system, Miller argued, and it's much more difficult for hackers to create working attack code. "If you don't have either, or just one of the two [ASLR or DEP], you can still exploit bugs, but with both, it's much, much harder." Because Snow Leopard lacks fully-functional ASLR, Macs are still easier to compromise than Windows Vista systems, Miller said. "Snow Leopard's more secure than Leopard, but it's not as secure as Vista or Windows 7," he said. "When Apple has both [in place], that's when I'll stop complaining about Apple's security." In the end, though, hacker disinterest in Mac OS X has more to do with numbers, as in market share, than in what protective measure Apple adds to the OS. "It's harder to write exploits for Windows than the Mac," Miller said, "but all you see are Windows exploits. It's not worth him nearly doubling his work just to get that last 10%." Mac users have long relied on that "security-through-obscurity" model to evade attack, and it's still working. "I still think you're pretty safe [on a Mac]," Miller said. "I wouldn't recommend antivirus on the Mac." But the missed opportunity continues to bother him. "ASLR and DEP are very important," Miller said. "I just don't understand why they didn't do ASLR right," especially, he added, since Apple touted Snow Leopard as a performance and reliability update to Leopard. "If someone else is running your machine, it's more unreliable than if you're running it," Miller concluded.

All engines, full reverse! Previously Skype and other Voice over IP (VoIP) applications for the iPhone, such as Fring, were relegated to Wi-Fi connections, prompting calls of foul play by consumers who often wanted to take advantage of features like the services' cheaper rates for international calling. That's the order AT&T seemed to be giving on Tuesday when it announced that it would be altering its existing policy to allow Internet phone applications such as Skype to place calls over the iPhone's cellular data connection. An FCC investigation was launched in April at the behest of Internet advocacy group Free Press, shortly after the Skype app was released for the iPhone.

While some alleged that AT&T's desire in keeping Skype off its data network was a way of stifling competition and forcing customers to use the wireless company's international calling options, it's also been suggested that AT&T was worried about the amount of traffic the immensely popular iPhone could bring to bear on its network. Notably, the ban did not apply to non-iPhone devices on AT&T's network. "Today's decision was made after evaluating our customers' expectations and use of the (iPhone) compared to dozens of others we offer," AT&T Wireless CEO Ralph de la Vega told The Wall Street Journal. Somewhat coincidentally-if you believe in such things-earlier in the day, Google and Verizon held a joint press conference to announce their new partnership, in which the two companies stressed network openness. Nor does it affect the contentious Google Voice service, which uses the standard telephone functions of the cellular network to route phone calls to and from users. The decision today does not apparently affect other applications that suffer from similar restrictions, such as the iPhone version of SlingPlayer Mobile, which allows users to stream video from their home devices only over Wi-Fi connections.

What if Twitter limited all posts to only 14 characters? That's the premise behind Squeaker, yet another Twitter parody site launched by the same zany people who brought us Woofer, the Twitter knockoff that requires all posts to contain at least 1,400 characters. Even worse, what if every post had to be exactly 14 characters, no more and no less?

Squeaker poses the question "What RU doing?," which happens to be 14 characters long, and won't accept your post unless you type exactly 14 characters. At least haikus allow 17 syllables. Spaces count against you, or for you if you're a glass-half-full type. Just like Woofer, the Squeaker site automatically lifts profile pictures from Twitter if you type in a real Twitter username. As of Monday afternoon, more than 1,100 users had penned more than 2,800 squeaks. No password is required, though, so you can "squeak" as yourself, or just impersonate a friend or foe.

Popular entries include "squeak > tweet," "1sml step 4man," and "mmmmmm, donuts," the latter posted by a user nicknamed HomerJSimpson. While the Web site's makers dubbed Woofer a "macroblogging" site, they came up with the word "nanoblogging" to describe Squeaker. "We are in no way associated with Twitter. Woofer and Squeaker were both designed by a quirky little outfit called Join the Company, LLC. Both feature user interfaces quite similar to Twitter's, with Woofer using a dog as its logo and Squeaker a mouse. This is simply a parody," a little FAQ on the site says. "After building Woofer, we thought it would be even funnier to require an exact number of characters. Follow Jon Brodkin on Twitter. What can you accomplish in 14 characters? … u cn use abbrs … no room 4links … b creative." As Squeaker itself notes, "14=all u need!" Join the Company hints that more parody Web sites are on the way, and is even asking users for suggestions.

An Illinois judge this week dismissed a lawsuit filed by the Cook County Sheriff's Office charging Craigslist with facilitating prostitution. But the judge in the U.S. District Court for the Northern District of Illinois said that Craigslist can't be blamed. "Intermediaries are not culpable for 'aiding and abetting' their customers who misuse their services to commit unlawful acts," the judge wrote in his dismissal of the case. The sheriff's office announced that it filed the suit in March at a press conference describing the many stings officers have arranged after reading ads for prostitutes on the site, including some that found children and women trafficked in from other countries who were forced into prostitution.

Craigslist warns users against illegal activity, bans illegal activity in its terms of use and removes inappropriate content that it discovers. The Cook County Sheriff's Office has nearly three weeks to decide whether to appeal, said Steve Patterson, a spokesman for the department. If users ignore those rules, it isn't Craigslist's fault, the judge said. "While we accept as true the plaintiff's allegation that users routinely flout Craigslist's guidelines it is not because Craigslist has caused them to do so," the judge wrote. If it does, it will argue that the dismissal did not adequately consider the original complaint's charge that Craigslist poses a public nuisance, he said. Craigslist noted the ruling on its blog but did not otherwise comment. The court's ruling this week concluded that the Communications Decency Act, which protects online companies from liability over the way people use their services, essentially trumps the public nuisance claim, he said.

The Electronic Frontier Foundation praised the ruling. "Meritless cases brought by law enforcement officers, amounting to little more than publicity stunts with little to no chance of success, do little to address the officers' underlying concerns," Matt Zimmerman , a senior staff attorney with the EFF, wrote in a blog post. "Service provides are not liable because Congress correctly understood that the soap box should not be held responsible for the speech of others. Just as phone companies are not liable for harassing phone calls, or e-mail software providers for deceptive messages, online message boards like Craigslist are in most instances not liable for their users' posts."Following the initial filing of the suit, Craigslist removed its "erotic services" category, replacing it with one called "adult services." Each posting to the category is now manually reviewed before it is posted and costs $10.

Microsoft today confirmed that it will launch its free security software suite, which has been in development for almost a year, Tuesday morning. "Microsoft Security Essentials, their highly anticipated no-cost consumer security offering, will be released to the public tomorrow, September 29," a company spokeswoman said in an e-mail reply to questions. Earlier in the day, Network World 's John Fontana had been told by Bob Muglia, the president of Microsoft's sever and tools division, that the company would ship the free software Tuesday. The spokeswoman added that the program will be made available Tuesday morning, Pacific time, although she did not have a specific hour for the launch.

Security Essentials, which Microsoft offered to a limited number of beta testers last June, is the company's replacement for Windows Live OneCare, a for-a-fee security suite that was retired at the end of June 2009. Microsoft has pitched the software as a basic anti-virus, anti-spyware program that consumes less memory and disk space than commercial security suites, like those from vendors such as McAfee, Symantec and Trend Micro. According to one researcher today, those security vendors have little to fear from Microsoft's giveaway. "It won't be the application that puts Symantec or McAfee out of business," said Andrew Storms, the director of security operations at nCircle Network Security. "...Microsoft still has to prove itself in this arena. Those companies, however, unanimously dismissed Security Essentials - once codenamed "Morro" - as proof that Microsoft couldn't compete in the paying market. Take, for example, Windows Defender, which has been free. If Microsoft starts dipping into the market share of these partners, will it affect that intelligence sharing? It's not necessarily the best anti-spyware product available." Storms also wondered how Microsoft's re-entry into the consumer security space would affect the relationships it's built with antivirus vendors, including those that involve the sharing of threat intelligence. "We've come to learn that Symantec and others have shared their threats and risk information with Microsoft in an effort to better protect all consumers.

The free Security Essentials will be available for Windows XP, Vista and Windows 7 as a 4.7MB download from the Microsoft Web site.

More than 10,000 usernames and passwords for Windows Live Hotmail accounts were leaked online late last week, according to a report by Neowin.net , which claimed that they were posted by an anonymous user on pastebin.com last Thursday. Neowin reported that it had seen part of the list. "Neowin has seen part of the list posted and can confirm the accounts are genuine and most appear to be based in Europe," said the site. "The list details over 10,000 accounts starting from A through to B, suggesting there could be additional lists." Hotmail usernames and passwords are often used for more than logging into Microsoft 's online e-mail service, however. The post has since been taken down.

Many people log onto a wide range of Microsoft's online properties - including the trial version of the company's Web-based Office applications , the Connect beta test site and the Skydrive online storage service - with their Hotmail passwords. Accounts with domains of @hotmail.com, @msn.com and @live.com were included in the list. It was unknown how the usernames and passwords were obtained, but Neowin speculated that they were the result of either a hack of Hotmail or a massive phishing attack that had tricked users into divulging their log-on information. Microsoft representatives in the U.S. were not immediately able to confirm Neowin's account, or answer questions, including how the usernames and passwords were acquired. Last year, a Tennessee college student was accused of breaking into former Alaska governor Sarah Palin's Yahoo Mail account in the run-up to the U.S. presidential election.

The BBC , however, reported early Monday that Microsoft U.K. is aware of the report that account information had been available on the Web, and said it's "actively investigating the situation and will take appropriate steps as rapidly as possible." If Neowin's account is accurate, the Hotmail hack or phishing attack would be one of the largest suffered by a Web-based e-mail service. Palin, the Republican vice presidential nominee at the time, lost control of her personal account when someone identified only as "rubico" reset her password after guessing answers to several security questions. Kernell's case is ongoing. David Kernell was charged with a single count of accessing a computer without authorization by a federal grand jury last October. Shortly after the Palin account hijack, Computerworld confirmed that the automated password-reset mechanisms used by Hotmail, Yahoo Mail and Google 's Gmail could be abused by anyone who knew an account's username and could answer a single security question.

Brocade Communications Systems Inc. has hung a "for sale" sign on its door, according to a report today in the Wall Street Journal . Brocade declined to comment on the report. Brocade is said to be valued at about $3.2 billion. Hewlett-Packard Co. and Oracle Corp. have shown interest in buying Brocade, which make switches for routing data storage traffic, according to the report, which added that an agreement is not imminent. The company reported a loss of $21 million on sales of about $493.3 million in the its 2009 fiscal year's third quarter that ended Aug. 1. San Jose-based Brocade has about 2,800 employees.

If true, he added, the timing isn't surprising. Brocade late last year acquired Foundry Networks Inc. whose IP networking technology gives it a leg up in the server networking market, and puts it in a stronger competitive position rival Cisco Systems Inc. "The question is: 'do the server vendors want to increase the competitive pressure against Cisco because Cisco is now in the server business?'" said Brian Babineau, an analyst with the Enterprise Strategy Group in Milford, Mass. "I think that's what makes Brocade more attractive, and you can consider Oracle in the server business as well because they plan to own Sun ." Babineau said he has heard rumors as recently as last week about Brocade putting itself on the block. Over the past seven or so years, switch maker Cisco has added a line of storage switches and routers that make it a heavy player in the storage business. Earlier this year, Cisco, EMC and others said they jointly developed a new storage blade server to be sold by Cisco. Just last month, it was reported that Cisco and EMC Corp. were in talks to create a technology services arm.

Brocade has also been making moves to attract new sales channels by signing reseller agreements with EMC rivals IBM, Hewlett-Packard Co. and quasi-competitor Dell Inc. Dell's acquisition of storage vendor EqualLogic two years ago likely placed a strain on its reseller relationship with EMC. Babineau said Hewlett-Packard may be the most appropriate suitor for Brocade because it has an established networking and a storage portfolio of products, and because Cisco is increasingly competitive with HP . "It's very logical. Dell has increased its presence in business-class data storage systems over the past few years, originally through reseller deals with EMC and recently with its own line of data storage products that are moving from entry-level to midrange. If you look at the timing, it's almost like a perfect storm for Brocade," Babineau said. "Exiting a Foundry integration process, potential uptick in IT spending starting shortly, and big IT companies wanting to compete against Cisco with Brocade being one of the only viable candidates in that market." "This is not about storage, but about networking," he added. Another source, who asked not to be named, said that HP executive Dave Donatelli , who had headed EMC's storage unit until earlier this year, could help HP position Brocade's storage offerings against those of his former firm. "I just think Donatelli has some real institutional knowledge after selling a good portion of Brocade's products when he was with EMC," the source said.

A new agreement between the Internet Corporation for Assigned Names and Numbers (ICANN) and the U.S. Department of Commerce that creates international oversight of the nonprofit operator of the Internet's domain name system may not provide enough accountability, some critics said. ICANN and the U.S. Department of Commerce (DOC) announced the new agreement on the day an 11-year series of agreements expired. The agreement, announced Wednesday, seemed to enjoy widespread support, but some critics questioned how new review teams overseeing ICANN would be independent and whether the new agreement represented average Internet users.

Under those agreements, the U.S. government provided primary oversight of ICANN. One of the main changes in the new agreement, called an Affirmation of Commitments, is the creation of new review panels, which would check ICANN's compliance with the agreement every three years. They're likely to produce the politics that already exist within ICANN." ICANN has a long history of disagreement among stakeholder groups and calls by other nations for the U.S. to give up its oversight role. Volunteers would serve on those review teams, as would independent experts and representatives of the ICANN board of directors and the DOC. The problem is that ICANN's chairman or CEO and the chairman of ICANN's Governmental Affairs Committee (GAC), selected by all the nations involved with ICANN, would have the final say on the makeup of those review teams, said Brenden Kuerbis, operations director the Internet Governance Project, a group of academics focusing on Internet governance issues. "The review panels are not external to ICANN," Kuerbis said Thursday at an ICANN forum hosted by the Congressional Internet Caucus. "They're selected by the very people responsible for what ICANN does. ICANN's major problem isn't a lack of oversight, it's a lack of clearly defined rules for the organization and standards to measure performance, Kuerbis added. "If these rules don't exist - and they still don't - the review panels ... can just become another layer of politics and second-guessing, superimposed on what is already a messy and pretty diffuse process," he said. There will be public comment on membership of the review teams, and ICANN's board and CEO don't control GAC, he said. "It's going to be extremely hard [for ICANN] to game the process," he said.

However, ICANN Vice President Paul Levins disagreed that the review teams will be made up of ICANN allies. Another criticism of the new agreement is that it was negotiated between ICANN and DOC in secret, even as the agreement calls on ICANN to be accountable and transparent to the public and to use a bottom-up decision-making process. "Whatever deliberation occurred prior to the approval of this 'affirmation of commitments' was entirely secret - except for those favorite friends ICANN chose to invite into the smoke-filled room, or to whom the deliberations or decisions were leaked," Edward Hasbrouck, a travel blogger and ICANN critic wrote on ICANNwatch.org, an ICANN watchdog site. "In fact, the completely secret, nontransparent and unaccountable way in which these 'commitments' were adopted is clear and compelling evidence of ICANN's continuing 'lack' of any actual commitment to these principles, or indeed to any transparency or accountability; its continuing commitment to lie - as loudly and as prominently as it can - about its lack of accountability and transparency; and the continuing need for 'real' transparency and accountability," the blog post continued. It's clear that ICANN received input from outside groups, and the agreement addressed major concerns about U.S. control over ICANN, said Steve DelBianco, executive director of NetChoice, an e-commerce trade group and frequent ICANN critic. But other ICANN watchers offered support for the new agreement. The new agreement gives the U.S. government a continued role in ICANN oversight, but it spreads out the oversight to other governments and the private sector, he said. "ICANN's independence day will be known as Sept. 30, 2009," DelBianco said. "[The agreement] is very clever in the way it balances some of those forces that were speaking out." GAC, which has complained of not having enough oversight of ICANN, will now have more control, he said. "The way we relieved the pressure [on ICANN] was to give governments more say," he said.

Other supporters of the new agreement included registrar Go Daddy, the Software and Information Industry Association, and U.S. Representative Henry Waxman, a California Democrat and chairman of the House Energy and Commerce Committee. "This agreement is a perfect example of how a public-private partnership can work to the advantage of all stakeholders," Waxman said in a statement. "It will help insure that the Internet remains stable and secure for the people around the world who use it for work, study, entertainment, or to stay in touch with family and friends."

Nominum is hoping that the second time is the charm in the outsourced DNS market, as the maker of high-end DNS software announces a hosted service on Tuesday. Slideshow: How DNS cache poisoning works On Tuesday, Nominum will reenter the outsourced DNS market with the announcement of SKYE, a separate business unit that will offer its software as a cloud-based service to smaller ISPs and enterprises. Nominum had a managed DNS services operation earlier this decade but sold it to rival UltraDNS in 2002. Nominum has since focused on its DNS and Dynamic Host Configuration Protocol (DHCP) server software, counting among its customers many of the world's largest carriers including Verizon, Sprint and NTT Communications.

Jon Shalowitz, vice president and general manager of SKYE, says the new venture's biggest differentiator is the underlying Nominum software, which is higher performing and more reliable than open source alternatives such as Berkeley Internet Name Domain (BIND). "This is the same software running in the top 100 ISPs around the world," Shalowitz says. "It handles two to three trillion transactions or queries per day. Rodney Joffe, senior vice president and senior technologist at Neustar, says hosted DNS is a big enough market to support multiple vendors. "Despite the fact that it's been a pretty awful recession, we've continued to grow very effectively in our area of managed DNS for enterprises," Joffe says. "There is definitely a market, and we're nowhere near saturation." Nominum has set up SKYE as a separate organization, with 30 full-time employees and five data centers to run Nominum's software. "Enterprises need to wake up to the risks associated with ignoring their DNS and assuming that if it's not breaking all they time [they] can ignore it," Shalowitz says. "There are still a lot of organizations running legacy DNS and open source DNS that are fraught with vulnerabilities." SKYE is offering four hosted services: SKYE Core recursive DNS service; SKYE Secure authoritative (or external) DNS services; SKYE Search redirection service; and SKYE Trust, a blacklist service for malicious Web sites. "Our target customer is anyone who has a strong Web presence: E-commerce companies, banks, anyone that has regulations for protecting data such as hospitals and healthcare companies; and any other company where breaches of personal information could be catastrophic such as credit card companies," Shalowitz says. We're leveraging that same technology in a cloud model." SKYE's main competitor will be UltraDNS, now owned by Neustar. Nominum says the time is right for hosted DNS services because of a broader push by corporate IT departments toward cloud-based services. "Part of the reason why cloud is becoming the rage is because of its operational benefits," Shalowitz says. "When companies look at the cost/benefit analysis, they'd much rather have [DNS] being done by experts and run in the cloud." Abner Germanow, director of enterprise communications at IDC, says enterprises are realizing that DNS is a critical service and are paying more attention to it. Most of them are buying DNS appliances from vendors such as Infoblox or hosted DNS services such as the ones being offered by SKYE. "We've seen a fair amount of growth in hosted DNS services," Germanow says. "There are a whole slew of companies offering a variety of DNS services both for internal, recursive DNS services and external, authoritative services…This is something that's clearly rising in popularity." Joffe said new entrants into the enterprise DNS space such as SKYE and OpenDNS, which announced an enterprise offering earlier in the month, will face difficulties if they can't deliver top-notch service level agreements. "Companies that have tried to get into this market have been burned not because having DNS servers and networks is that hard but because making them work in a carrier-like way is not easy," Joffe said, adding that UltraDNS also runs its own DNS software rather than BIND. "The ability to do DNS in a really reliable way turns out to be hard."

Researchers and hackers are developing tools to execute a new data-leak threat: sneaking proprietary information out of networks by hiding it within VoIP traffic. (A brief history of steganography) Techniques that fall under the category of VoIP steganography have been discussed in academic circles for a few years, but now more chatter is coming from the hacker community about creating easy-to-use tools, says Chet Hosmer, co-founder and Chief Scientist at WetStone Technologies, which researches cybercrime technology and trains security professionals investigating cybercrimes. "There are no mass-market programs yet, but it's on our radar, and we are concerned about it given the ubiquitous nature of VoIP," he says. Steganography in general is hiding messages so no one even suspects they are there, and when done digitally, it calls for hiding messages within apparently legitimate traffic. VoIP steganography conceals secret messages within VoIP streams without severely degrading the quality of calls.

For example, secret data can be transferred within .jpg files by using the least significant bits to carry it. There are more than 1,000 steganographic programs available for download online that can place secret data within image, sound and text files, Hosmer says, and then extract it. Because only the least significant bits are used, the hidden messages have little impact on the appearance of the images the files contain. There are none for VoIP steganography yet, but in the labs, researchers have come up with three basic ways to carry it out. The second is hiding data inside each voice payload packet but not so much that it degrades the quality of the sound. The first calls for using unused bits within UDP or RTP protocols – both used for VoIP - for carrying the secret message.

The third method calls for inserting extra and deliberately malformed packets within the VoIP flow. A variation calls for dropping in packets that are so out of sequence that the receiving device drops them. They will be dropped by the receiving phone, but can be picked up by other devices on the network that have access to the entire VoIP stream. These techniques require compromised devices or conspirators on both ends of calls or a man-in-the-middle to inject extra packets. "It's much more difficult to do and much more difficult to detect," than hiding data within other files, Hosmer says. For example, x86 executables can carry secret messages, according to Christian Collberg, an associate professor of computer science at the University of Arizona and co-author of the book Surreptitious Software.

The medium used to carry secret messages is called the carrier, and just about anything can be a carrier. By manipulating the compiler, it can be made to choose one addition operation over another, and that choice can represent a bit in the secret message, Collberg says. "There are lots of choices a compiler makes, and whenever you have a choice, that could represent a bit of information," he says. One of the newest methods takes advantage of TCP retransmission – known as retransmission steganograpny (RSTEG) - in which sending machines resend packets for which they fail to receive acknowledgements. Even something as broadly used as TCP/IP can be host to steganographic messages. The sending and receiving machines must both be in on the steganography, according to a paper written by a group of Polish researchers headed up by Wojciech Mazurczynk at the Warsaw University of Technology.

The resent packet is actually different from the initial packet and contains a steganographic message as the payload. At some point during the transmission of a file, the receiving machine fails to send an acknowledgement for a packet and it is resent. The receiving machine can distinguish such resent packets and opens up the message, the researchers say. In general, defending against steganography is tough to do because traditional security devices such as firewalls and application firewalls don't detect this type of illicit transfer; a file containing a secret message looks just like a legitimate file. In his blog Crypto-Gram Newsletter, security expert Bruce Schneier dismisses the threat from RSTEG. "I don't think these sorts of things have any large-scale applications," he says, "but they are clever." Mazurczynk and his colleagues have spent a lot of time figuring out new carriers for secret messages, publishing research on embedding them in VoIP and wireless LAN traffic.

The best way to combat suspected use of steganography to leak corporate data is to look for the telltale signs - known steganography programs on company computers, says Hosmer. When the steganography program is known, it can be applied to the carrier to reveal the secret message. On systems where it is found, forensic analysis may reveal files that contained messages and an indication of what data might have been leaked. That message may be in code and have to be decrypted, he says. They can confront the person and take steps to prevent further leaks, Collberg says. In many cases, just knowing that steganography is going on and who is responsible is enough for a business.

But businesses can take more active steps such as destroying the secret messages by altering the carrier file. Free programs such as Stirmark for scrambling files enough to destroy steganographic messages are available online. For instance, if the carrier is an image file, setting all the least significant bits to zero would destroy any messages contained there without significantly changing the appearance of the image, he says. Keith Bertolino, founder of digital forensics start-up E.R. Forensics, based in West Nyack, N.Y., has developed double stegging – inserting stenographic messages within files with the intent of disrupting other stenographic messages that might also be in the files. According to Hosmer, a look at evidence in closed cases of electronic crime found that in 3% of those cases, criminals had steganographic programs installed on their computers. "The fact that these criminals were even aware [of steganography] was a startling surprise to law enforcement agencies," he says. He is waiting to find out if he gets a Small Business Innovation and research (SBIR) grant from the government to pursue turning his steganography jamming technology into a commercial product.

Interest in steganography is growing, according to Wetstone Technology's monitoring of six popular steganography applications. That's not a dramatic increase given that the use of Internet-connected computes has gone up in the meantime, but it is still noteworthy, he says. In 2008, the six combined logged 30,000 downloads per month, up from 8,000 to 10,000 per month about three years ago, Hosmer says. Steganography is not always bad. The watermark is a secret message embedded, for instance, in an image file so if the image is use online, a Web crawler can find it. Technically, steganography is just the same as digital watermarking, but with different intent, Collberg says.

Then the creator of the image can check whether the site displaying the image has paid for it or is violating copyright, he says.

The European Union is not the only one antsy about Oracle taking possession of the open source MySQL database should the commercial database giant's merger with Sun Microsystems get final approval. On its Web site, Oracle merely notes that "MySQL will be an addition to Oracle's existing suite of database products." "I wish that Oracle would broadcast its intentions a little bit more" on the Sun acquisition, says Duane Kimble, a Linux technologist who works in the banking industry. So are MySQL users. (The E.U.'s executive arm has held up approval of the merger, fearing that Oracle's acquisition of MySQL could reduce competition in the database market, as well as harm the open source nature of MySQL. Sun's stockholders and the U.S. Justice Department have approved Oracle's $7.4 billion acquisition of Sun.) "We've got a fair number of databases and Web applications that use those databases in MySQL. If Oracle does something that sort of makes it look like MySQL's days are numbered or something is going to change that we don't like, we'll probably look at alternatives," says Ernest Joynt, a contractor for the National Oceanic and Atmospheric Administration. [ Relive Sun's storied history in InfoWorld's slideshow "The rise and fall of Sun Microsystems." | Learn why attendees at the JavaOne conference were skeptical of Oracle's buyout of Sun. ] Anand Babu Periasamy, CTO of clustered storage technology company Gluster, expresses doubts that Oracle would add enterprise capabilities to MySQL. "I hope that they will retain MySQL. [But] I am doubtful [that] they will ever improve MySQL to take it mid-enterprise level, but at least it will help them compete with Microsoft SQL Server on the low end," he says. (Gluster uses MySQL for its Web site operations.) Thus far, Oracle has said little about its intentions for MySQL and declined to discuss the issue with InfoWorld. For him, Oracle's ownership of MySQL is a specific cause for caution.

His firm has begun looking at other enterprise-scale open source databases such as EnterpriseDB's Postgres database in case it has to replace MySQL. Standing to reap a harvest from unease about the Oracle-MySQL pairing are open source database vendors EnterpriseDB and Ingres. MySQL users start looking at alternatives A key issue is that Oracle is a main competitor to MySQL, notes Timothy Dion, CTO of mobile and Web apps builder Sensei. "I'm very concerned about what that means," he says. EnterpriseDB, which builds its products on the PostgreSQL open source database, has been hearing from concerned MySQL users, says Larry Alston, EnterpriseDB's vice president of product management and marketing. "They're telling us that they're nervous" about the future of MySQL, he says. Doubts remain over the fate of other Sun technologies Users remain concerned over the fate of other Sun technologies such as Java and Solaris, not just of MySQL. "We are rethinking our Solaris deployments," says Linux technologist Kimble. "We are moving swiftly toward more of an AIX and Linux environment, depending on the size or the scale of the project." Although Kimble notes it is "too early to say whether we'll move off [Solaris] or not," he does say his employer is rethinking its Solaris commitment: "Certainly, we're not going full-bore with Solaris as we were before the merger." Kimble does see a positive side to the Sun acquisition: "I think it kind of simplifies the platform offering somewhat. Ingres also sees opportunities. "The phones ring a lot," says Ingres CEO Roger Burkhardt. Oracle is a strong company and if they keep Sun Java, which I'm sure is what they bought [Sun] for, I think it will make Java a better product." But Bryce Pier is not so sure.

Another large company buying another large company reduces competition," he says. The senior systems engineer at Target sees no benefits of the buyout - at least not yet. "I'm not really certain that it's going to be good for anybody. Pier expects the acquisition to cause Target to move away from Solaris to Red Hat's Linux over time. Oracle, said Craig Muzilla, Red Hat's vice president for middleware, was very active in the Java Community Process for updating Java and has strived for openness in Java. "We don't see anything from Oracle that [would indicate that] they would do anything" that would differ with the past, he said. One reason is the uncertainty: "We're just not sure what Oracle's commitment is going to be to the Java stack and to maintaining it as an open source project." Another is Oracle's reputation for extracting revenues from customers: "We certainly fear that all of the subscription fees are going to change for everything from Sun." At its recent conference, Red Hat sought to reassure customers about the continued openness of Java-based JBoss technology, which Red Hat owns, now that Oracle is buying Java founder Sun.

Cisco and VMware created some buzz at the VMworld show in San Francisco on Tuesday by announcing a method for using VMware's VMotion across data centers that are located as far apart as 125 miles, or 200 kilometers.

VMworld product blitz: Hot technology for the virtual world

Users have been pushing VMware to offer a method of allowing VMotion to be used between data centers, and this reference architecture is a step in the right direction. But it is only a step and not a true failover technology. It does not replace VMware's disaster recovery product, Site Recovery Manager.

The long-range Vmotion technique was originally demonstrated at Cisco Live! But VMware formally announced support for it. It can be used with Cisco switches that support VLANs, namely the Catalyst 6500 as well as the Nexus 7000. It requires that users implement VMware's latest product, vSphere (read our review of vSphere).

Today's announced reference design provides only what its makers refer to as "disaster avoidance" not "disaster recovery." Long-range movement of a virtual machine using VMotion must be performed manually (although users could write scripts to move VMs.)

Technical issues with the network and storage have yet to be solved to allow VMotion to support more automated long-distance failover. These include an inability to maintain an IP address if a VM is moved from one ISP to another, for instance from a data center in New York to another in San Jose. Likewise, storage is a problem. Until storage vendors come up with a way to support active/active SANs for the same VM moved between two physically far locations, no-latency failovers won't be possible between data centers.

Finally, this technique is not recommended, and not supported by VMware, when users have Disk Raw Mapping (DRM) turned on and used with clustered servers on either side.

All that said, for Cisco users wanting to deploy vSphere, this design can be practical in helping them manage VMs between data centers. It can be used for disaster situations where users have warning (tornadoes, hurricanes). It can be helpful for load balancing applications between data centers to offset an expected traffic spike. It also represents major progress on the network portion of the long-range VMotion problem.

The reference architecture is available for free download from Cisco.

Washington State breaks ground this month on a new data center and office complex that two state lawmakers have called a "mistake." A better approach, they argue, might include turning over some of the state's computing resources to commercial cloud providers, such as Google Inc. or local favorites, Amazon.com Inc. and Microsoft Corp.

"Software as a service is unequivocally the future in my view," said Washington State Rep. Reuven Carlyle, a Seattle Democrat. "The fact is that 110,000 state employees all with their own heavily loaded machine is simply not the long-term model," he said.

Cloud computing is turning IT into a political issue. Voters might debate the need for a new fire engine, but they typically leave issues such as a new mainframe for the IT manager to sort out. SaaS-based services delivered via cloud platforms are widely used by consumers who are asking why these platforms can't be used by government.

This consumer interest turns proposals, such a plan in Los Angeles to move to Google Apps, into issues that reach well outside of City Hall. Google is taking its Apps adoption campaign to select cities with a billboard advertising campaign launched this month.

The Washington lobbying machine is weighing in as well. Citizens Against Government Waste, which has fought open formats and supported Microsoft in its antitrust case, warned today that Los Angeles' use of Google Apps could "negatively impact" taxpayers. A spokesman for the group said the organization doesn't discuss its donors.

A much broader, public debate over technology directions may put IT managers, such as Washington State's CIO Tony Totorice, under a brighter spotlight.

Totorice is new on the job. He just started last month, having previously worked as CIO for the Los Angeles Unified School District. The decision to build a new data center with 66,000 square feet of raised floor, which is part of a $260 million state office complex, was made long before he arrived.

But the IT environment that Totorice took over illustrates why a shift to cloud and SaaS-based providers isn't likely to be swift. There are now some three dozen state data centers within the immediate area of the Washington State Capitol running thousands of x86 servers that aren't virtualized and are underused.

Totorice said his IT model is more along the lines of what Hewlett-Packard Co. accomplished when it consolidated 85 worldwide data centers into six. He would like to reduce Washington's data centers to two, one to serve as the primary center and the other as the backup in heavily virtualized environments that rely on far fewer servers.

Using a commercial cloud provider, such as Amazon's EC2, in lieu of state resources isn't possible "in any kind of a massive way" because of security issues, but also because of the many legacy applications used by the state, Totorice said. One of the state's first goals is to standardize on Microsoft Exchange 2010 on servers the state will operate.

As far as switching to commercial providers, such as Google, "I think it's something that ought to remain on our horizon," Totorice said, but he cites a number of issues, including security and legal discovery, that have him convinced that these services aren't ready for major enterprise adoption. But if commercial providers solve these issues, "then they will be able to get to economies of scale that we won't get to," he said.

A Los Angeles governmental committee was due to take up the Google App proposal this week, but the meeting was postponed to an unspecified date, a city official said. About 30,000 city employees would move to Google's e-mail, and over time, migrate away from Microsoft Office.

Los Angeles sees some risks to moving to Google. IT officials, in a report, warn a move away from Microsoft Office and Novell's GroupWise e-mail system is a decision of no return. "It may be cost prohibitive to return to the current City-owned and operated structure," the report said.

The Los Angeles IT department has nonetheless recommended Google. It says Google's service levels "often exceed the current city level," and it will save money mainly from repurposing staff and servers currently dedicated to GroupWise. Any pain of moving off Office will be mitigated by retaining Office licenses for a two-year evaluation period.

Security may be a bigger issue. Pam Dixon, executive director for the World Privacy Forum, questions how medical data, for instance, can comply with federal privacy rules. "This is about your data living in an entirely different legal reality," she said.

Even the federal government is moving in this direction. It may not adopt Google Apps for the White House, but commercial SaaS services are making inroads, such as Salesforce.com, which is being used by Army recruiting, for instance. Federal CIO Vivek Kundra adopted Google Apps for use in the District of Columbia prior to taking his federal job earlier this year.

Deniece Peterson, the manager of industry analysis at Input, a Reston, Va.-government-focused research firm, said adoption of these external implementations will grow, especially if there are some big adopters, such as Los Angeles. "Those kinds of implementations serve as success models for other cities."

Oracle has apparently raised the cost of some management options for its flagship database by 40 percent, according to an official price list dated July 1.

Processor licenses for the company's diagnostic and tuning packs, as well as a database configuration management pack, are now US$5,000, up from $3,500 listed on a 2008 price list.

The first two products are meant to help database administrators target and resolve performance problems. The latter tool is used for a range of tasks, such as tracking database configuration changes and ensuring policy compliance.

Meanwhile, a processor license for the enterprise edition of Oracle's database remains priced at $47,500, following a roughly 20 percent increase last year.

It wasn't clear Thursday whether other Oracle products also have seen price hikes. A company spokeswoman could not immediately comment.

It is also not clear when the increases took place, but the lower prices were in effect on a price sheet dated Dec. 1, 2008. Oracle posts its updated price lists on the company's Web site, but does not typically announce when changes are made.

Forrester Research analyst Ray Wang said Thursday his firm began examining the most recent price lists for changes after a sudden swell of chatter from sources in recent days.

Although list prices are rarely what customers actually pay for software, the increases nonetheless raise the starting point for discount negotiations, and could upset customers prepared to buy new licenses even in the face of a global recession.

But there may also be another game afoot, according to Wang.

By raising list prices for licenses, vendors such as Oracle may simply be catering to the needs of corporate IT procurement managers, who are under pressure to get good deals for their employers and whose compensation can be affected by the level of discount they garner from a vendor, he said.

When it comes time to negotiate, the vendor simply agrees to a steeper discount on the now higher-priced product, creating a "win-win" situation for both sides, Wang said.

This is a potential problem for IT organizations, Wang added. "If you just focus on procurement, then you're not focused on the product adoption strategy."

Toyota Motor Corp. today announced that its researchers have developed technology that will allow human brainwaves to steer an electric wheelchair.

The technology is the fastest in the world for analyzing brainwaves, Toyota said, noting in a statement that systems now in use take several seconds to accomplish that task. The new system can analyze brainwaves and put them to work on the chair in 125 milliseconds, or 125 thousandths of a second ( view video).

"Such systems allow elderly or handicapped people to interact with the world through signals from their brains, without having to give voice commands," said Toyota. "This technology is expected to be useful in the field of rehabilitation, and for physical and psychological support of wheelchair drivers."

Toyota reported that the new system successfully enabled drivers to give thought-powered commands to their wheelchairs 95% of the time. The company is working on developing better electrodes that pick up the brainwaves, as well as improving the system so it can handle more commands.

There was no information available on how soon the wheelchair technology could be on the market.

Research into combining biological systems with computers has been gaining attention in recent years.

Late in 2007, a scientist at the University of Arizona in Tucson successfully connected a moth's brain to electronics, using it to guide a 12-inch-tall robot on wheels. Associate Professor Charles Higgins predicted at the time that "hybrid" computers running a combination of technology and living organic tissue will be available in 10 to 15 years.

Then in January of 2008, scientists in the U.S. and Japan announced that they had successfully used a monkey's brain activity to control a humanoid robot. The research may only be a few years away from helping paralyzed people walk again by enabling them to use their thoughts to control exoskeletons attached to their bodies, Miguel Nicolelis, a lead researcher on the project, said at the time.

And about a year ago, Justin Rattner, CTO and a senior fellow at Intel, told Computerworld that perhaps as early as 2012 we'll see the lines between human and machine intelligence begin to blur.

Rattner also said that by 2050 or so, computing will be less about launching applications and more about living with computers woven into most daily activities.

Eye-Fi today added to its popular line of wireless and geo tagging-capable memory cards. Called the Eye-Fi Pro, the newest SDHC wireless memory card has 4GB of storage and is geared toward professional photographers and serious photo hobbyists. The Eye-Fi Pro has the widest functionality in Eye-Fi's lineup, with automatic uploads to a wide variety of Web sites; support for jpeg, RAW, and video formats; and the capability to create an ad hoc connection between your camera and computer for wireless photo transfer. The Eye-Fi pro retails for $149. For an additional $9.99 per year, you can automatically upload your photos or videos from the Eye-Fi Pro over a Wi-Fi connection to 25 photo and video sharing sites including Facebook, Flickr, Picasa, Photobucket, Snapfish, and YouTube. The direct upload service, called WebShare, also works with Eye-Fi Share and Eye-Fi Explore memory cards. As with other Eye-Fi products, the Pro provides geotagging via Skyhook Wireless' positioning system for an extra $14.99 per year. In addition to the Pro SDHC card, Eye-Fi has announced that all Eye-Fi users will now have access to a new free service called Selective Transfer. As the name implies, Selective Transfer lets you pick and choose which photos you'd like to upload from you camera by using the "protect" or "lock" feature found on most cameras. Any photos you mark under "protect" or "lock" will be automatically uploaded, and all photos will remain on the camera until you manually delete them. With the popularlity of Eye-Fi memory cards, some camera manufacturers are now producing Eye-Fi optimized cameras. These cameras can notify you when uploads are finished, optimize the camera's power consumption, and automatically recognize Eye-Fi cards. Recent optimized cameras include the Nikon D5000, and all Casio cameras slated for spring 2009 release including the Casio EX-S12, Casio EX-S5, Casio EX-FS10, Casio EX-FC100 and Casio EX-Z29. Eye-Fi wireless memory cards are compatible with many, but not all cameras. Visit Eye-Fi to see if your camera is Eye-Fi compatible.