Mozilla patches three Firefox security vulnerabilities

November 27, 2007 5:32 AM PST
Posted by Robert Vamosi

Mozilla on Monday released Firefox version 2.0.0.10. The update addresses three high-impact security vulnerabilities. Two concern cross-site request forgeries, which can be used to steal personal information while visiting certain sites, and one concerns memory corruption.

The update is being pushed out to all current Firefox users. New users can download the current Firefox release from the Mozilla site (or download the English versions for Windows or Mac from CNET Download.com).

The first cross-site request forgery vulnerability could allow an attacker to generate a fake HTTP referer header by exploiting a timing condition when setting the window location property.

Mozilla says the referer header is supposed to reflect the address of the content that initiated the script. "Instead, the referer was set to the address of the window (or frame) in which the script was running, and this vulnerability arises from that tiny difference." It credits Gregory Fleischer with reporting the issue.

The second cross-site request forgery vulnerability concerns the JAR ZIP format, which enables Web sites to load pages packaged in ZIP archives containing signatures in Java archive format.

According to Mozilla, a Beford.org blogger noted that redirects confused Mozilla browsers about the true source of the JAR content: it was "wrongly considered to originate with the redirecting site rather than the actual source. This meant that an XSS attack could be mounted against any site with an open redirect, even if it didn't allow uploads."

A proof of concept demonstrates how to exploit this vulnerability to steal a user's Gmail contact list. Mozilla credits security researchers Jesse Ruderman and Petko D. Petkov with reporting the issue.

The final update concerns memory corruption, and Mozilla says there are three specific fixes that improve the stability of Firefox. The concern here is that with enough effort, some of these memory crashes could be exploited to run arbitrary code.

Source: News.com
URL: http://www.news.com/8301-10784_3-9823744-7.html?tag=~

One Laptop per Child Project by MIT Prof

Europe the leader, not the follower in open source

November 23, 2007 6:50 AM PST

Posted by Matt Asay

Matthew Aslett of The 451 Group quotes from Viviane Reding, European commissioner for information and society, on Europe's need to capitalize on its open-source assets:

As online software, or software as a service, replaces traditional packaged software, Europe has advantages that give it a "window of opportunity to develop a leadership position in software." These include a large home base of demand to build on, high levels of qualified talent, and the fact that 70% of open source developers worldwide are of European origin. However, "the window is small and it will soon be closed if we don't act," since 90% of the economic benefits of open source are being won by US companies.

Despite this, as Matthew goes on to say, Europe is a bit conflicted on open source. Its public policy statements tend to be affirmative of open source, but its purchasing policies tend to be neutral. I think it's just a matter of time before the rhetoric gives way to purchasing decisions.

Indeed, I've already seen it firsthand. Most open-source companies operating in Europe do a steady and growing stream of business with European governments (while, interestingly, much of the sales in the US are to private corporations).

Regardless, open source has a large home base in Europe. Indeed, I'd argue that open source is distinctively European in its roots and mindset, and that VCs who want to find the best open-source investments may well have to get on a plane to find them (even if they ultimately succeed in getting European executive management to move back to the US, as with Marten Mickos of MySQL and others).

The economic impact of open source on Europe should not be understated. Europe needs to accept this and buy accordingly. Its future is not in exporting euros to the U.S. Its future lies in building its own IT ecosystem with open source.

Google’s OpenSocial: What it means

Google’s open social networking platform play is the buzz of the blogosphere tonight. (see Techmeme). Indeed, it is called OpenSocial in that the set of APIs allows developers to create applications that work on any social network that joins Google’s open party. So far, besides Google’s Orkut social net, LinkedIn, hi5, XING, Friendster, Plaxo and Ning (see Marc Andreessen’s post) have joined the party.

Oracle and salesforce.com are also supporting Google’s OpenSocial efforts, which indicates that they have plans to add social networking elements to their application platforms. OpenSocial will officially launch on Thursday.

Plaxo emailed a statement about OpenSocial this evening, getting ahead of the stampede:

“Dynamic profiles redefine what users should expect in terms of how they can represent themselves in a social or business network,” said Todd Masonis, Co-Founder and VP of Products for Plaxo. “We believe that users should have full control over what they share with whom – and that the catalog of widgets that they can choose from should be as open and diverse as the web itself. We are excited to support in dynamic profiles any application written to Google’s just–launched OpenSocial APIs. ”

According to TechCrunch, which first reported on Google’s larger social networking ambitions, OpenSocial consists of APIs for profile information, friend information (social graph) and activities, such as a news feed. OpenSocial users Javascript and HTML rather than a markup language as Facebook does.

This comes on the heels of the Facebook’s dynamic growth based on opening its social graph to developers and Microsoft’s $240 million investment for 1.6 percent of the company. However, unlike Google, Facebook doesn’t open its APIs to support other social networks. The other social networking giant, MySpace, is also planning to open its platform to developers.

This openness is part of what Vic Gundotra, Google’s head of developer programs, meant when he said last week, “In the next year we will make a series of announcements and spend hundreds of millions on innovations and giving them away as open source.”

He explained the newfound openness as more than altruism: “It also makes good economic sense. The more applications, the more usage. More users means more searches. And, more searches means more revenue for Google. The goal is to grow the overall market, not just to increase market share.”

What does OpenSocial mean for Facebook?

Facebook has a lot of wind behind its sails, but OpenSocial will cause developers to rethink their priorities. Developing OpenSocial applications will be easier than creating Facebook apps and will work across different social networks. However, Facebook is winning because 50 million users like the service and the applications. Unless the other social networks, which in aggregate have more members, have greater appeal to users, Facebook will continue to gain ground and developers won’t abandon the Facebook Platform. Facebook could also consider supporting OpenSocial in addition to its own APIs and markup languages as a way to be more open. It will be interesting to see how Zuckerberg and company, as well as the MySpace team, respond.

The New York Times story by Miguel Helft and Brad Stone quotes Google’s Joe Kraus on the Facebook topic.

Joe Kraus, director of product management at Google, said that the alliance’s conversations preceded Microsoft’s investment in Facebook. “Obviously, we would love for them to be part of it,” Mr. Kraus said of Facebook. Facebook declined to comment.

What does OpenSocial mean for Google?

As cited above, OpenSocial is part of Google’s quest to increase usage of the Web. More applications can mean more searches and ad searches. You could also expect some new advertising services based on tapping into the OpenSocial APIs that work across all compliant social networks. In addition, Google will weave OpenSocial across its services beyond Orkut, such as iGoogle, and eventually embed the social graph in the Internet fabric for its users.

This could create some issues for Facebook, which is rumored to be cooking up a targeted ad service that can follow its members across the Web. And, Google, taking a page from Microsoft, has some confidence that over time it can build or buy its ways into a leading social network. Google will try to have its cake and eat it too.

What does OpenSocial mean for users?

For users, it means more applications that can tap into user data, social graph, feeds and other content on a variety of social networks. They will have more choice of social networks and potentially some degree of portability as the APIs evolve and Google and other heavyweights push for more standardization.

What does OpenSocial mean for developers?

For developers, they have more opportunity to spread their work across different networks without significant cost and complexity. Many of the top Facebook developers are expected to support OpenSocial APIs. In the end, the top developers will flock to the social networks that have traction, leaving room for others to build apps for the less popular networks.

What does OpenSocial mean longer term?

It could become a kind of identity fabric for the Internet–with user profile data, relationships (social graph) and other items associated with an individual, group or brand that is used as a basis for more friction-free interactions of all kinds.

See also: VentureBeat has a draft of the Google OpenSocial press release

OpenSystem Unleased into the Wild

Now that OpenSocial has been partially release into the wild, the effects on the ecosystem are being felt. TechCrunch reported on a hack of an application on Plaxo’s OpenSocial-compliant host. Plaxo shut down the application. Plaxo’s chief platform architect told Mike Arrington the OpenSocial platform is a work in progress and a few kinks need to get ironed out.

It’s early in the life of OpenSocial. The APIs are not yet stabilized and developers are just starting to test out the code in the Orkut sandbox. Plaxo jumped the gun with public access to an OpenSocial widget (Emote) on its service.

For enterprises, such as Oracle and saleseforce.com who jumped on board in support of OpenSocial on day one, the road to implementing the APIs will be longer than the consumer social networking services, given more sensitivity to security and identity management issues. But there should be no doubt that next year, OpenSocial will have significant impact and at least bring thousands of applications across the divide.

See also: Marc Canter on OpenSocial compatibility–social networks and applications vendors working together

Five Facts About Google Phone

Written by Om Malik

Monday, September 3, 2007 at 12:01 AM PT

Is Google (GOOG) Phone fact or fiction? Engadget says Google’s entry into mobile phone business is for real, and the company is going to announce it soon. Scott Kirsner talked to a bunch of folks over who are intimately familiar with the effort and outlined his findings in an article for The Boston Globe.

The story talks about a handful of Boston entrepreneurs and venture capitalists who have seen the phone, but are under NDA and can’t talk about it. Rich Miner, a co-founder of Android, a mobile software company he started with Andy Rubin (formerly of Danger) is based in Boston.

Google bought Android in August 2005. Later Google snapped up Reqwireless and Skia, two tiny start-ups with mobile expertise, and since then has been hiring mobile-focused folks at a pretty steady clip.

The news (or rumors) were enough to get me dialing-for-dirt over the big holiday weekend. These are the tidbits I picked up from a reliable source:

1. Google Phone is based on a mobile variant of Linux, and is able to run Java virtual machines.
2. All applications that are supposed to run on the Google Phone are java apps. The OS has ability to run multimedia files, including video clips.
3. The user interface is similar to a UI typical of mobile phones, and the image (with red background) floating around isn’t representative of the Google Phone UI. The entire UI is said to be done in Java and is very responsive. The UI, of course has a “search box.”
4. There is a special browser which has pan-and-browse features that are common to modern browsers such as browsers for iPhone and Symbian phones. The entire browser is apparently written in Java. But then others have told us that the browser is based on the WebKit core, the same engine in Safari and in iPhone, and Google has been making optimizations to speed it up. This is one aspect of the Google Phone I am not sure about.
5. Initially there was one prototype, but over past few months Google has the mobile OS running on 3-to-5 devices, most of them likely made by HTC, a mobile phone maker, and all have Qwerty apps. The model that folks have seen is very similar to the T-Mobile Dash. Around 3GSM, there were rumors that Google, Orange and HTC were working together on mobile devices.

These tiny-bits of information are pretty close to what Simeon Simenov, a VC with Polaris Venture Partners had very clearly outlined on his blog eons ago. I can’t seem to find that post, so here is is an alternate link. Simenov also wrote a pretty good post on what should be an ideal mobile stack. Google is pretty close to what Simenov had outlined.

We will post more details as they come our way. I had initially thought that it could be a more viable option to the $100 PC. While that argument still remains true, I think this is a strategic move by Google to keep Windows Mobile’s growing influence in check. Microsoft has spent billions on its mobile efforts including buying companies such as Tell Me Networks.

Release: AIM 6.5

Here's one for all you AIM users out there (and I know there's a bunch of you!) I just received word the other day that a new version of the popular AOL instant messaging program, AIM, has been released. Yep, AIM 6.5 is nwo available for download. How exciting is that?! If you're a long time AIM user, I guarantee you're not going to want to miss out on what this latest version has to offer. Keep reading for details on all the new updates, all the new features and everything else that comes along with it. Let's check it out!

One of the things I love the most about AIM 6.5 is that you can now personalize it beyond your wildest dreams. With new features like WeeMee and Wallmations, you can really show off your true personality. You can even change the color of your buddy list for a new way of expressing yourself. Along with all of that, AIM 6.5 also offers new cell phone features, brand new status options for when you're away from your computer, more games to choose from and there are even some new voice and video chat features as well. It's totally awesome!

And that's not all! AIM 6.5 also brings you new options when it comes to updating your buddy profile. You can now include RSS feeds, your personal blog, more photos and there's even a new feature for inserting your favorite quotes. I mean, your friends enjoy reading about you, so why not give them some cool things to look at, right?! Along with that, you also now have the ability to receive offline messages. If someone sends you an IM after you sign off, it will be waiting for you when you sign back in. How cool is that?! There's also a new feature for your IM history and there are some brand new options when it comes to your picture sharing. This new version really does cover everything and all you have to do to enjoy it is download AIM 6.5 right here. Check it out today and take your instant messaging experience to the next level. Yes!

~ Erin

Don't stop now! Keep reading to learn all about virtual memory and what it does for your computer, find out how to rule your own way in MS Word and learn all about the new Windows Vista Aero Glass interface and how it can make your Vista experience that much more enjoyable. Also, find out how you can easily send your photos via your e-mail account with today's video tip and as always, don't miss out on Amanda's Cool Site of the Day. Enjoy!

Google Tops world search engines

Thu, 11 Oct 2007 23:21:02

Google is the most popular search engine in the world.

Google has powered more than 37 billion out of 61 billion search requests carried out around the world in August, according to a report.

A global study carried out in August revealed that more than half of 750 million users turn to Google for searching the web, BBC reported.

Yahoo was the second most used engine, followed by Baidu, the Chinese language search engine, the report said. Microsoft's MSN and Korea's NHN stand 4th and 5th, respectively.

The study revealed that most search activity happens in the Asia-Pacific region, which includes countries such as China, Japan and India.

More than 258 million unique users in the region carried out 20.3 billion searches in August, said the report.

Europe had the second largest total of searchers (210 million), followed by North America (206 million).

According to the report "the search market in the Middle East-Africa region is the most underdeveloped thus far, with the fewest searchers (30 million)."

MHE/MMA

First Muslim image database launched

Wed, 29 Aug 2007 21:43:33

The dome of Sheikh Lotfollah mosque, Isfahan, Iran.

The Dubai-based Muslim Heritage Consulting has launched the world's first online image database to give an insight into the Islamic culture.

The new website offers stunning images from celebrated photographers like Werner Forman and manuscripts from Turkey's Soleymaniye Library.

Many of the images mark critical moments in history, such as the first surgeries carried out in the Middle East, centuries before similar treatments were available in Europe.

“Museums have always faced a great challenge to relate Islamic realities of the past through images,” said Samia Khan, the website spokesperson.

“The website has brought together thousands of images of manuscripts, and photos of Muslim culture, history and people and made it accessible using a simple online format,” she added.

www.MuslimHeritageImages.com also presents images about Iran, including numerous historical and ancient Islamic sites.

Yahoo Mail Raises the Stakes

Chinese spying on German government computers: report

Berlin, Aug 25, IRNA

Numerous computers of the German government are infected by Chinese espionage programs, the weekly Der Spiegel news magazine said in a report to hit the newsstands on Sunday.

The so-called 'Trojan' programs which enable the unnoticed spying of computers, have been discovered in several ministries a few months ago, Der Spiegel cited a probe by Germany's domestic Verfassungsschutz intelligence agency and the Federal Office for Information Technology Security.

Chinese cyber spies snooped reportedly on computers in the chancellery, the foreign and economic ministry as well as the research ministry.

According to the Verfassungschutz, the Chinese hackers are believed to be linked to China's People's Army.

China is continuing its efforts to plant Trojan programs via the internet on German government computers, Der Spiegel said.

Reacting to the report, the Chinese embassy in Berlin dismissed it as "irresponsible speculation without any basis of proof".

Chancellor Angela Merkel was due to embark on Sunday on a one-week visit to China and Japan.

The German media has repeatedly reported on extensive Chinese economic espionage inside Germany.

True Budget Computer USD99

News Corp. Explores MySpace Swap deal with Yahoo

Yoono Version 4.0.1 — 05.06.2007

Improved 'Suprise Me' feature

When you use the 'Surprise Me' feature, you will be able to check a checkbox so that a new page is displayed automatically each time you launch Firefox. This will not overwrite your home page, but open a new tab instead.
A new context menu (right click) is added to your bookmark folders so that you can ask a Surprise that will be based on the URLs within the folder : a nice way to discover stuff on a given topic.

Bug fixes

Autologin on your Buzzlog from the Yoono toolbar menu
Web pages already visited will no longer appear as 'Surprise' pages
Terms of use more easily readable before signing up


Tech Connection #5

Gmail Theater: Why Use Gmail?

Had Microsoft bought Yahoo?

In the second week of May there was a big news about a big offer made by Microsoft to buy over Yahoo. Has the deal been closed? I have not received any news on this.

Microsoft wants to buy Yahoo for USD$50billion

HardWareZone | 10 May, 2007 12:50

If you haven't heard about this, you might want to now!
Microsoft, the maker of the recent Windows 6 (Vista) Operating System, wants to buy its online rival Yahoo, for a staggering USD$50billion!

This isn't the first time Microsoft has made an offer to Yahoo - they're refused before - but Microsoft is hoping the higher USD$50billion is going to change the yodelling online giant's mind.
In the online space where Google buys YouTube and Newscorp buys MySpace, the best method
to eliminate your enemy is to just buy them over.

With Yahoo Messenger 8 being able to use MSN Messenger (or Windows Live Messenger since version 8) user names, the battle between the top IM (Instant Messengers) just got tougher for Microsoft. Since Microsoft isn't the kind to allow you to use Windows Live Messenger for your Yahoo IM user name, people just might switch over to Yahoo's IM to use both Yahoo and Microsoft IM user names.

Taking over Yahoo would also increase Microsoft's Web search market share by 38%, putting them right behind Google - Microsoft's ultimate rival. Yahoo's current value is around USD$30 to 40billion - so that's a cool USD$10billion extra to just say yes to Microsoft. Will Yahoo accept it?

Source: The New York Post

State Censorship

Last Updated: Friday, 18 May 2007, 01:02 GMT 02:02 UK

Global net censorship 'growing'

China filtered a wide range of topics, said the report The level of state-led censorship of the net is growing around the world, a study of so-called internet filtering by the Open Net Initiative suggests. The study of thousands of websites across 120 Internet Service Providers found 25 of 41 countries surveyed showed evidence of content filtering. Websites and services such as Skype and Google Maps were blocked, it said. >>>>cut

The survey found evidence of filtering in the following countries:

Azerbaijan, Bahrain, Burma/Myanmar, China, Ethiopia, India, Iran, Jordan, Libya, Morocco, Oman, Pakistan, Saudi Arabia, Singapore, South Korea, Sudan, Syria, Tajikistan, Thailand, Tunisia, Turkmenistan, UAE, Uzbekistan, Vietnam and Yemen.

Is PC guy an Achilles heel for Gates' pride?

By: Marius Oiaga, Technology News Editor

---

There is one subject that is taboo for Microsoft Chairman Bill Gates. You can talk to Bill about a lot of things. You can talk to him about the fast pace at which Google is extending its search and advertising

There is one subject that is taboo for Microsoft Chairman Bill Gates. You can talk to Bill about a lot of things. You can talk to him about the fast pace at which Google is extending its search and advertising

Internet business while Microsoft is lagging behind. You can mention the muted adoption of Windows Vista. And you can even praise the piracy of Microsoft software products in his presence, just consider the example of Romanian President Traian Basescu.

However, there is one subject that is totally off limits. You cannot speak of it, comment on it and if possible, not even think about it in the presence of Bill Gates. What is it you ask? Well, the Mac ads of course.

It seems that Bill Gates is quite irate with Apple's PC guy vs. Mac guy video commercials that have flooded the Internet. So much so that he fails to retain the high level of diplomacy that characterizes him. At the beginning of February 2007, Gates simply smiled while the President of Romania applauded piracy. But when a journalist mentioned the Mac ads, Bill experienced something close to a blue screen.

Bob Garfield, a columnist with Advertising Age asked Bill Gates to comment on John Hodgman's character PC guy in the Mac ads. Bill Gates refused to answer the question, stating that he could not provide an opinion on Apple's ads. Garfield did not let Gates get off so easily and he raised the stake asking about the resemblance between Gates and PC guy. Gates simply left at this point, and barely managed to utter a “goodbye.”

15 short Ads = Apple Mac Guy -VS- PC Guy

U.S. Search Engine Rankings, February 2007

Click Here to read it in the post section

DOMAIN SQUATTING

CYBERSQUATTING

The US administration passed the Anti-Cybersquatting Consumer protection in August 1999. The law enable trademark holders to obtain civil damages of a maximum amount of USD100k from those that register their trade names or similar-sounding names as domain names.

There was a case in 1999 where a domain was sold for one million USD. That domain was registered in 1994 at a cost of USD 70. The domain was wallstreet.com There were people who registered a common name and name combination they can think of with the hope of selling it a exorbitant prices and make a life time killing. Registering an Internet domain name for the purpose to sell later for a profit is termed as Cybersquatting


TYPOSQUATTING

Generally, the victim site of typosquatting will be a frequently visited website. The typosquatter's URL will be similar to the victim site address: Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content. Sometimes competitors of the victim site will do this.

Have you ever experience this. Say you have some sticky key. Now it causes you to key into your navigation bar typo errors for example. Instead of spelling blogspot it becomes logspot or in rush we mis-spell it as blogsport. Then you say to yourself why another site appear. Upon checking you discover a spelling error in your navigation bar. Well, that was done by design, read below. (bloggers note)

Typosquatting also called URL hijacking, is a form of cybersquatting which relies on mistakes such as typographical errors made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to an alternative address owned by a cybersquatter.

Alternatively, the user will be forwarded to a site of a completely different nature to what they intended. This tactic was infamously used by John Zuccarini, who redirected domains targeting children to pornographic websites. Sometimes, the typosquatters will use the false addresses to distribute viruses, adware , spyware or other malware. Some are also shock sites. More common are benign domain parking sites, selling advertising to firms based on keywords similar to the misspelled word in the domain.

As with cybersquatting in the past, the term typosquatting has been used by covetous parties in an effort to unseat domain registrants from brandable variants of generic domain names The shortage of poignant and generic domain names in the coveted .com generic top-level domain has left many hopeful registrants with no alternative but to locate catchy variants of existing generic words e.g. Orbitz.com (popular travel site with "z" to replace the "s") in an effort to find "new land" on which to build their website.As in the preceding example the line between typosquatting and registering a brandable variant of a generic domain name blurs dependent on the circumstance of each situation.

A company may try and preempt typosquatting by obtaining a number of websites with common misspellings and redirect them to the main, correctly spelled website. For example www.gooogle.com, www.goolge.com, www.gogle.com www.gewgle.com, and others, all redirect to www.google.com. In another example, actor and politician Arnold Schwarzenegger is reported to control the domains with the ten most common misspellings of his surname.

Microsoft has released new software to help combat this issue. The software is called "Strider Typo-Patrol". This is a tool that scans and shows third-party domains that are allegedly typosquatting. It also lets parents restrict access to typo-squatting domains that show sexually oriented ads on typos of children's web sites.

"Typosquatting" is a meaningless term where the law is concerned. Laws generally are not concerned about registrations of domain names that are similar to other domain names or similar to existing trademarks, unless some other important factor is involved.

from experience and reference answers.com

The genesis of dual-core technology

The road to dual-core processors really began when Intel and AMD discovered that the goal of improving processor efficiency and performance by increasing the clock speeds towards the 3-GHz mark and beyond was actually having the opposite effect. The faster clock speeds were producing more heat and consuming more energy, both of which were hindering the efficiency and performance of the processors. Both companies realized that they needed to move towards dual-core processor technology in order to continue to improve processor performance.

Dual-core processors contain two processor cores on one chip; consequently, they can simultaneously perform calculations on two streams of data, which increases efficiency and speed when running multiple programs. This is especially true when running new, multi-threaded software, such as video and audio editing applications.

excerpt from techrepublic

SSL

What does SSL mean? Well, to begin, it stands for Secure Socket Layers and it is basically what makes secure sites secure. Here's how it works.

When you log into a secure server, it communicates with your Web browser for a few seconds. During this communication, it sends your browser encryption information, that only it and your browser can read, out. Once this encryption is set, it acts like a normal Web page, except that all the information coming or going is encrypted. This encryption makes it extremely difficult for any third party (anyone who would intercept the transaction) to decipher it. All this extra protection is why secure servers seem to run slower than their unsecured counterparts.

Secure connections only protect the information as it's coming and going, not when it's just sitting on the server. With that being said, you probably have a better chance of getting ripped off by a sales clerk copying your credit card number at a department store than getting your information stolen over the Internet. Also, you can tell if a site is secure by the first part of its Web address. If it starts with https:// rather than http://, it's secure as can be. Stay safe!

~ Quoted from Steve