Pc News

[Rasputin]

Microsoft: Don't Ask Us About Next OS

Microsoft wants everyone to focus on Vista and forget about whatever may come down the operating system pike.

In a tightly-worded statement issued late yesterday and attributed to Kevin Kutz, the director of the Windows client group, the company said it "is focused on the value Windows Vista will bring to people today. We are not giving official guidance to the public yet about the next version of Windows, other than that we're working on it."

Kutz was replying to speculation that the next version of Windows -- with codenames ranging from "Vienna" to "Windows 7," depending on the pundit -- would be out before the end of 2009. The chatter was fueled by Ben Fathi, corporate vice president of development in Microsoft's Windows core operating system division, who spoke to reporters last week at the RSA conference.

At the time, Fathi said the follow-on to Vista would likely show up in 2009. "You can think roughly two, two and a half years is a reasonable time frame that our partners can depend on and can work with," he said. "That's a good time frame for refresh."

Yesterday's move was a clear effort by Microsoft to distance itself from Fathi's comments, said Michael Silver, an analyst with Gartner. But it was hardly unexpected.

""This is their pattern. They don't want to talk about what's coming, they want to talk about Vista," said Silver.

The last thing Microsoft wants, said Silver, is for users to hear that a new operating system will show up in a couple of years, then decide that they can wait it out, then simply skip Vista. "Vista is what they have to sell now."

In any case, Silver questioned the relatively short cycle that Fathi proposed. "I don't think enterprises can absorb [a new operating system] every two years."

Consumers, on the other hand, want a new and shiny operating system more frequently. "Maybe Microsoft should think about separating operating systems, one release for consumers, one for enterprises that just adds on capabilities."

In Silver's view, Microsoft has been forced to talk more about the post-Vista world because of the five years it took the company to create that just-released operating system. As early as last July, for example, Microsoft CEO Steve Ballmer told financial analysts that "we will never repeat our experience with Windows Vista, we will never have a five-year gap between major releases of flagship products."

"Actually, they'd like to talk about [the next OS] as little as possible," said Silver.

[Rasputin]

New Credit Cards May Leak Personal Information

You may be carrying a new type of credit card that can transmit your personal information to anyone who gets close to you with a scanner.

The new cards--millions of which have been issued over the past year--use RFID, or Radio Frequency Identification, technology. RFID allows scanners to use radio signals at varying distances to read information stored on a computer chip.

According to a study from academic and business researchers at the University of Massachusetts, RSA, and Innealta, many of the cards will transmit your name, credit card number, and expiration date (but not the three-digit security code) in the clear to anyone nearby with a scanner. One of the researchers, Kevin Fu of the University of Massachusetts, provided an electronic copy of the report's just-finished final version to PC World. The draft version is available online.

Millions of Cards in Use
RFID is widely used to track shipments and store inventory--and now it's in credit cards, allowing customers to swipe the cards past readers in McDonald's restaurants, CVS pharmacies, and elsewhere, making for quick and easy transactions. Visa says more than 6 million "contactless" cards exist worldwide, and their number is growing rapidly.

In an e-mail, Fu wrote that "in our collection of approximately 20 cards, the vast majority revealed CC name, CC number, and expiration" when the researchers scanned with a commercial RFID reader that they modified to work with the credit cards. According to the FAQ on the study, the sample cards "spanned all three major U.S. payment associations and several major issuing banks."

According to a Visa spokesperson, the company's contactless card network uses an encrypted security code to verify a transaction. That should protect against certain types of fraud--but again, it doesn't protect against someone pulling the name and number.

However, second-generation Visa Contactless cards no longer send the name, says Brian Tripplett, the company's senior vice president of emerging product development. The new cards still send their numbers, but those would be difficult to use without the card holder's name. With the first generation of cards, Visa suggested that banks not issue cards that transmit the name; with new cards, that's required.

Tripplett also says that Visa's technology has a shorter read range and communicates differently than does the standard RFID used for inventory management, for example. Mastercard didn't respond in time for this story.

Is Your Card RFID-Equipped?
How do you tell if your card has one of these chips? Some cards have visible microchips, according to the study's FAQ, but others don't. Tripplett says that Visa Contactless cards have a symbol: four vertical wave-like bands on the front or the back.

But to know for sure, and to know whether you have a first- or second-generation Visa card, you need to call your bank and ask. You should be able to request a card without the technology, or at least one that doesn't transmit your name.

Also, you can block RFID signals with a "Faraday cage," which uses a metal mesh or casing. A quick online search turned up some wallets and wallet inserts that incorporate the cages.

[Rasputin]

Next Version of Microsoft Office Coming in 2009

Microsoft Corp. may have just released Office 2007 to consumers mere weeks ago, but the company is already working hard on the next version -- internally known as Office 14 -- and targeting it for release in the first half of 2009, according to information from Microsoft's own Web site.

The company plans to spend almost US$1 billion per year in R&D for Office 14, or about 20 percent more than the amount devoted to Office 2007, according to a PowerPoint slide deck from a Nov. 8, 2006 presentation by a Microsoft employee in Copenhagen, Denmark.

The information and excerpts from the slide show were first posted on Tuesday by the independent AeroXperience blog, which is geared toward Windows Vista developers.

AeroXperience's senior editor Stephen Chapman also reported that Microsoft is skipping the version 13 for Office because it is "unlucky," and that the company will begin "dogfooding," or beta-testing Office with internal Microsoft employees, late in 2007. Chapman cited an interview of Eric Vigesaa, program manager for Office system client applications, with Microsoft's TechNet radio chat from December 27th .

A Microsoft spokeswoman downplayed the information.

"Microsoft is always planning," said a spokeswoman. Moreover, "it's typical for the Office team to deliver a new version of Office every 2 to 3 years."

The revelations about the next version of Office come hard upon reports last week that the next version of Windows, alternately called Windows 7 or "Vienna," will also see release in 2009. Microsoft has since tried to publicly retract that statement.

The Microsoft slides show the first beta of Office 14 due in the first half of 2008, a second beta due in the second half of 2008, and a final release in the first part of 2009, or between 26 and 32 months after Office 2007's release.

The slides also indicate that in Office 14, Microsoft plans to continue building on the established core features of the 25-year-old Office suite, and will focus on three areas: enterprise content management, communication and collaboration, and business process and business intelligence.

In particular, according to AeroXperience, Microsoft hopes to improve search relevance, enhance the management of complex documents and content, bring business intelligence into the business process itself, improve the offline experience in products such as SharePoint, and simplify the building of business applications on the Office platform through declarative programming and improved business data catalogue integration.

[Rasputin]

EMusic Adds Editorial Features

Online independent music reseller eMusic is expanding the editorial content for eMusic Magazine, its online repository of music-related reviews and other content.

The content is shepherded by Editor-in-Chief Michael Azerrad and almost 200 writers, including industry veterans like Kurt Loder. Musicians also author pieces, such as Isaac Hayes, Thurston Moore of Sonic Youth, John Flansburgh from They Might Be Giants and others.

The editorial content on eMusic Magazine also ties in with features on the sites including Playlists, Neighbors, Friends and Power Charts.

eMusic Magazine is accessible to subscribers and non-subscribers. eMusic itself sells MP3 music from independent artists, free of any sort of Digital Rights Management (DRM) technology. eMusic says it's second only to the iTunes Store in number of downloads sold.

[Rasputin]

Tests Set to Begin on Next-Generation Electronic Retina

The U.S. Food & Drug Administration has approved a study to evaluate a new electronic artificial retina that researchers hope can help people who have gone blind regain some of their sight.

Researchers at the University of Southern California's Doheny Eye Institute yesterday announced plans to begin a clinical study of the artificial retina, called the Argus II Retinal Prosthesis System.

The Argus II is the second generation of an electronic retinal implant designed to treat retinitis pigmentosa, a group of inherited eye diseases that affect the retina and can cause blindness, said Mark Humayun, professor of ophthalmology at the Keck School of Medicine at USC. The updated device may eventually be implanted in people suffering from age-related macular degeneration, he said.

The Argus II is designed to take the place of photoreceptor cells in the retina, which capture and process light, according to a statement from the university. The implantable device contains 60 electrodes on an array, which is attached to the retina and used with an external camera and video processing system to provide some sight for patients, the university said.

An earlier generation of the device - which contained 16 electrodes - has been implanted in six patients, Humayun said. These patients can now detect light and motion and distinguish between objects like a cup or a plate, he said.

There are 25 million people in the world who have been blinded or are severely visually impaired from diseases like retinitis pigmentosa or macular degeneration, he said. By 2020 that figure is expected to double.

The Department of Energy, the National Science Foundation, National Eye Institute/NIH, Research to Prevent Blindness, the W. M. Keck Foundation and the Albaugh Family Trust support the study.

[Rasputin]

Some PayPal Users Plagued by Security, Log-In Woes

Some visitors to PayPal's Web site may be getting unexpected security warnings and log-in problems when they attempt to access the site or their accounts, a spokesman confirmed Friday.

The problems appear to be connected to an SSL security certificate used by Omniture Inc., a company PayPal is using to collect aggregate data about people using its Web site, the PayPal spokesman said. SSL certificates are used by Web browsers, such as Internet Explorer and Firefox, to check the authenticity of a site and to let users know whether a site is spoofed or not. The spokesman said the problem affects a "small portion" of PayPal users.

Omniture started using a new so-called wildcard SSL certificate on Jan. 29 that is causing problems for users of Windows 98 systems and even some newer versions of Windows when they attempt to access PayPal. "Users running outdated operating systems, like Windows 98, as well as some that are using more recent software are seeing these warnings when they use the PayPal service," the spokesman said. The company is working with Omniture to diagnose the problem and to fix it, he said.

Using Firefox to access PayPal provides an immediate work-around for all users, he added.

A wildcard SSL certificate allows a company to use a single certificate to authenticate multiple subdomains within a larger domain.

Several users on a PayPal forum on eBay have complained over the last few days about error messages popping up on their screens warning about the validity of the certificate issued to the site.

"Since yesterday, I have been getting an error pop-up that won't let me sign into PayPal," one forum poster said on Feb. 2. "It comes up saying 'the security certificate for this site has been revoked,' and I've tried signing in through eBay and PayPal's [site] direct. Neither will let me in."

Another poster cited an error message saying the security certificate was "invalid or does not match the name of the site" on every PayPal page the poster attempted to access.

One poster Friday claimed to be getting error messages, even when using Internet Explorer 7. The poster claimed to have deleted all cookies and history files, downloaded the latest Windows Security Updates and tried accessing PayPal directly and via eBay -- and a message saying PayPal's certificate had been revoked still popped up.

"EBay and PayPal will not be receiving my business until this issue is completely resolved," the poster said. "I have lost money and product because of this issue and I am not a happy customer. It's like having my bank close its doors indefinitely and I can't get to my money to pay my customers," the poster said.

Several expressed frustration at what they claimed was a relative lack of clarification from PayPal on the issue.

Bruce Toski, a computer consultant in Fort Lauderdale, Fla., said that an examination of the certificate causing all the problems shows that it is issued by Thawte Inc., a Cape Town, South Africa-based issuer of SSL certificates that is wholly owned by VeriSign Inc. "One also sees that it is issued to Omniture, which appears to be a company that excels at data mining," said Toski.

He expressed concerns about "encrypted data streams" from PayPal being captured by Omniture, and said until he hears from PayPal about the cause of the issue, he is unwilling to ignore the security warnings he gets when attempting to access PayPal. "Till they tell me otherwise, I have to assume the worst," said Toski, who uses Windows 98.

In an apparent response to such concerns, a poster called Olive from eBay this morning posted a brief statement on the PayPal forum, offering an explanation that differs from the one offered by the spokesman this morning.

"The reason you are receiving the security certificate warning message when visiting the PayPal Web site is due to our recent implementation of Microsoft's Extended Validation certificates," the poster claimed. "We believe that this is occurring mostly for users using older operating systems, like Windows 98. Because Microsoft no longer supports Windows 98, [users of] this software are unable to receive security upgrades and may continue to see this message indefinitely."

The poster also suggested that "specific browser settings or configurations" could cause similar problems for users of more recent operating systems, including Windows XP and Vista. "We are working on diagnosing the situation and hope to have a resolution soon."

The PayPal spokesman this morning downplayed concerns from forum members about Omniture and said that the company is simply a widely used Web analytics company collecting data about the number of people visiting the site. "We use Omniture strictly to track aggregate data. We don't share or sell any personal or financial data" to the company, he stressed.

A spokesman from Omniture said the company is aware of the issue. "It has been escalated to the top of the priority list within the support organization, and it should be addressed by the end of the day today," he said Friday. He provided no details on the nature of the problem.

[Rasputin]

Google Apps Suite to Include Docs, Spreadsheets

Google Inc. is finalizing the integration of Docs & Spreadsheets with Google Apps for Your Domain, another step in its strategy to build a suite of hosted applications for organizations.

The introduction of the new version of Google Apps for Your Domain including Docs & Spreadsheets will happen this quarter, and it could come as early as next week, several people familiar with the company's plans said.

It has been widely assumed that at some point Google would add Docs & Spreadsheets, a word processing and a spreadsheet program, to Google Apps, a suite of communication services for organizations. Docs & Spreadsheets lets multiple users share files and collaborate on them.

Google Apps provides white-label versions of several Google communication services, including the Gmail Web mail service, the Talk instant message and voice chat service and the Calendar online scheduling service. Organizations can provide these services with their own Internet domain and branding to their users.

Arizona State University, which launched Google Apps in October for its students, would be very interested in having Docs & Spreadsheets as part of the suite, said Kari Barlow, assistant vice president of the university's technology office. "Where the strength is with Docs & Spreadsheets is in the ability to synchronously collaborate on documents," Barlow said. Groups of students could use it to collaborate on class projects, she said.

"Google Apps has been highly successful for us. We're looking at extending the environment and implementing new technologies as they are released to us. It'll be interesting to see when Docs & Spreadsheets comes out, how that will impact the environment," Barlow said.

Not everyone sees a use for the Docs & Spreadsheets integration, however. San Jose City College is delighted with Google Apps, which it adopted mostly to provide e-mail accounts to its students, but doesn't see a clear need to offer them hosted word processing and spreadsheet software at this time, said Michael John Renzi, the college's director of finance and administration. However, the college would like the suite to have a course management application, he said.

Google Apps is free but Google plans to introduce a more sophisticated, fee-based version for large organizations.

Google Apps and Docs & Spreadsheets have been parallel projects in Google's attempt to enter the hosted applications market and expand beyond its core search engine business. Many see Google gearing up to compete against Microsoft Corp.'s PC-based Office applications suite.

Proponents of hosted applications say they are more convenient than the PC-based, packaged software upon which Microsoft has built its empire. Hosted applications are housed in vendor servers, freeing customers' IT departments from installation and maintenance work, and from having to purchase extra hardware and storage, proponents say. However, the consensus currently is that hosted applications suites don't come close to offering the breadth of features that Microsoft Office has.

Google has other hosted applications for organizations, including Google Analytics, a hosted service for tracking Web site usage and traffic. The company also has a wiki platform that it acquired when it bought JotSpot Inc. last year. It has been rumored that Google is developing a presentations application.

Google declined to comment for this story.

[Rasputin]

Y2K Memories May Breed Complacency, Problems

When Y2K came and went without a major upheaval of the world's IT infrastructure, it left a legacy of complacency that may come back to haunt IT departments when changes to daylight-saving time take effect on March 11, according to Forrester researchers who have issued a new report titled "Echoes of Y2K in Daylight-Saving Time Changes."

Complacency has "been the issue here. Because Y2K didn't create as many issues as one would imagine, since that point in time coding has not been as rigid," says Ray Wang, a principal analyst at Forrester Research.

Daylight-saving time (DST) will move forward one hour on the second Sunday of March instead of the first Sunday of April, because of the U.S. Energy Policy Act of 2005. DST will also be extended by one week in October.

Wang and co-author Jeffrey Hammond, in their report issued last week, list problems the time change may cause if systems are not updated and urged IT professionals to take action.

International business systems that work across many time zones could face confusion. "One day each year will be 25 hours, and one will be 23 hours. Consequently, display and time tracking problems remain the most significant issue," the analysts write.

Business applications that record transactions could be affected. Billing programs that calculate elapsed time may be at risk, particularly in industries that rely on precision time, such as transportation, financial services, telecommunications, healthcare, and high-tech manufacturing, they write.

The problems could be as small as a meeting time being an hour off, and as big as a ticketing system connected to an airline issuing tickets for the wrong time, Wang says.

"We're stuck with a situation where a lot of people haven't put together testing or patch management plans that would account for these changes automatically," Wang says. "There will be massive problems if people don't start thinking about it and testing to find out what those problems will be."

Forrester made the following recommendations:

* Assess the overall environment for probability and potential impact. Evaluate all combinations and configurations of software, hardware and operating systems. Also determine which business processes require time sensitivity.

* Develop action plans across the enterprise. Identify tools to be updated and which product changes must be made.

* Marshal testing and application development resources. Testing pros should run a post-patch regression on custom applications. Keep a few developers on call the week after DST changeover to fix undetected problems.

* Reach outside IT. Firms lagging behind in updates may find that employees outside IT can update machines or reset time zones if given explicit direction. Businesses should at least communicate with users about the DST issue.

* Seek changes in future contracts. Seek legal counsel on contract language that protects future investments in equipment and software.

System patches are required for operating systems released prior to early 2006, Forrester reported. "Patches range from automatically applied updates for recent versions of Windows and OS X to installable fix-packs for Unix , Linux , z/OS and i5/OS , to instructions and tools that detail how to manually manipulate time zone tables in older versions of Windows and Java," the researchers write.

Wang says Forrester found 33 packaged application vendors that still don't have a solution for daylight-saving, although some of these vendors may rely on the Microsoft Windows clock, for which there are available patches. A Forrester survey of 11 application vendors found that most clients can fix the DST problem through operating system patches that address time zone change.

The report states that vendors have generally informed clients of the problem and published updates, but Wang says "vendors haven't been as careful as they should have been."

[Rasputin]

Three Minutes: The FTC Chief Takes on Cybercrime

Over the past few years, computer crimes and annoyances have become an increasingly important part of the U.S. Federal Trade Commission's work. In the past year, the FTC has announced settlements with spammers, adware distributors, and even Sony BMG Music Entertainment, over its distribution of rootkit software.

FTC Chairman Deborah Platt Majoras recently sat down with the IDG News Service to discuss some of the work her organization is doing to keep the scammers and criminals at bay. She talked about the Sony settlement, the role that online advertisers play in the adware and spyware plague, and whether buried disclosures in licensing agreements really count.

Following is an edited transcript of the interview.

IDGNS: Although there's this perception that much of online criminal activity happens outside of the U.S., there's actually a lot of money that makes its way to the pockets of U.S. spyware vendors, hosting providers, and even advertisers. What can the FTC to go after the U.S. money?

Majoras: It's a very interesting point. I spoke [recently] to a corporate council. I told them that corporate America in general ought to do a better job of figuring out where their ad dollars are going. Because what we think is happening is that some of the ad dollars are making their way to adware providers who may be providing the software without the consumer's knowledge and consent. And these companies may not even know about it at the end of the day.

If I were a company, I wouldn't think that having a consumer bombarded with pop-up ads advertising my product would be a great way to sell.

We want companies to have a better understanding of where these advertising dollars are going, so in a couple of our high-profile spyware cases, like the one against Zango, we tried to be very public. That's a company that has changed its business model now. They have told us, "We've changed our ways; we're going to do things differently." But the people who hire them need to understand exactly what is going on with this advertising.

IDGNS: Well, you could get their attention if you sued them. Do you think that's likely?

Majoras: That would certainly get their attention. I don't know right now.

IDGNS: You recently settled an action against Sony over its use of rootkit technology to protect copying. That was a case of computer owner's property rights bumping up against the entertainment industry's enforcement of its intellectual property rights. Do you anticipate more of this type of conflict in the future?

Majoras: Yes, we may see some additional collisions, but from our perspective, companies should think about the legal principles that we've developed in the industrial economy and continue to apply them in this new economy.

The principles we applied in the Sony case are not really new and different. It's not that they endeavored to protect their intellectual property, which they're entitled to do, it's that they didn't tell consumers what they were doing. We felt that how a consumer could use the CDs, where the music could be played ultimately, and whether or not their habits were being monitored, those were things that consumers would want to know about before they made their purchase. From our perspective, disclosure to consumers is a first principle.

As we look at principles that we're applying in spyware and the like, the first principle there is, the computer belongs to the user, not to the software distributor. You have to think of it that way.

IDGNS: There is something about the way legal agreements are evolving that offends common sense. I don't think people read most disclosure agreements, and I don't blame them. If you just want to download a plugin or play a CD, is it reasonable to expect someone to read a three-page boilerplate legal agreement?

Majoras: That's a tough issue that you're raising, and an important issue. One of the things that has always been the case, though, is that buried disclosures have never worked and have never been adequate. So if you are burying an important disclosure that's going to make a difference to a consumer, then there's a real question about whether that's a true disclosure.

This is also something that we worry about with some of the spyware legislation that's been proposed. People say that as long as it's disclosed to folks that, "this is what's going to happen," then that may be good enough. We actually had a case in which buried in the EULA was this disclosure that said, "We reserve the right to take over your computer."

But we said there, "No, that is not good enough." That is the type of disclosure that would need to be front and center for the consumer that they really couldn't get past.

[Rasputin]

Macrovision CEO Asks Apple to Hand Over FairPlay

Fred Amoroso, CEO and President of Macrovision, has responded to Steve Jobs' recent comments about Digital Rights Management (DRM) technology. Like Jobs, Amoroso has published his comments on his company's Web site, as an open letter. In it, Amoroso suggests, among other things, that Macrovision take over stewardship of Apple's own DRM technology.

Amoroso's company develops DRM technology widely used in commercial DVDs. It also develops DRM for commercial software publishers and other content creators.

Last week Jobs posted a letter to Apple's Web site suggesting that Apple would drop DRM from its iTunes Store offerings if record labels were to agree. Warner Music CEO Edgar Bronfman Jr. immediately responded , calling Jobs' anti-DRM stance a fight "without logic" and suggested to investors that any "manifestos in advance" of discussions between the companies "is counter-productive."

Amoroso's letter addresses what he considers to be four key points: That DRM has a broad impact across many types of content, not just music; that DRM "increases not decreases consumer value;" that it will increase electronic distribution; and that DRM needs to be interoperable and open.

Amoroso calls DRM "an important enabler across all content, including movies, games and software, as well as music."

"I believe that most piracy occurs because the technology available today has not yet been widely deployed to make DRM-protected legitimate content as easily accessible and convenient as unprotected illegitimate content is to consumers," he said. The solution, Amoroso believes, is to make DRM-protected content more convenient, reasonable, consistent and transparent to use.

"For example, DRM is uniquely suitable for metering usage rights, so that consumers who don't want to own content, such as a movie, can "rent" it. Similarly, consumers who want to consume content on only a single device can pay less than those who want to use it across all of their entertainment areas - vacation homes, cars, different devices and remotely," Amoroso said.

Amoroso believes the industry should pursue as a goal "truly interoperable DRM."

"Truly interoperable DRM will hasten the shift to the electronic distribution of content and make it easier for consumers to manage and share content in the home - and it will enable it in an open environment where their content is portable across a number of devices, not held hostage to just one company's products," he added.

Amoroso closed his letter by suggesting that Macrovision "assume responsibility for FairPlay," the DRM technology Apple uses for content purchased through the iTunes Store, "as a part of our evolving DRM offering and enable it to interoperate across other DRMs, thus increasing consumer choice and driving commonality across devices."

[Rasputin]

Y2K Memories May Breed Complacency, Problems

When Y2K came and went without a major upheaval of the world's IT infrastructure, it left a legacy of complacency that may come back to haunt IT departments when changes to daylight-saving time take effect on March 11, according to Forrester researchers who have issued a new report titled "Echoes of Y2K in Daylight-Saving Time Changes."

Complacency has "been the issue here. Because Y2K didn't create as many issues as one would imagine, since that point in time coding has not been as rigid," says Ray Wang, a principal analyst at Forrester Research.

Daylight-saving time (DST) will move forward one hour on the second Sunday of March instead of the first Sunday of April, because of the U.S. Energy Policy Act of 2005. DST will also be extended by one week in October.

Wang and co-author Jeffrey Hammond, in their report issued last week, list problems the time change may cause if systems are not updated and urged IT professionals to take action.

International business systems that work across many time zones could face confusion. "One day each year will be 25 hours, and one will be 23 hours. Consequently, display and time tracking problems remain the most significant issue," the analysts write.

Business applications that record transactions could be affected. Billing programs that calculate elapsed time may be at risk, particularly in industries that rely on precision time, such as transportation, financial services, telecommunications, healthcare, and high-tech manufacturing, they write.

The problems could be as small as a meeting time being an hour off, and as big as a ticketing system connected to an airline issuing tickets for the wrong time, Wang says.

"We're stuck with a situation where a lot of people haven't put together testing or patch management plans that would account for these changes automatically," Wang says. "There will be massive problems if people don't start thinking about it and testing to find out what those problems will be."

Forrester made the following recommendations:

* Assess the overall environment for probability and potential impact. Evaluate all combinations and configurations of software, hardware and operating systems. Also determine which business processes require time sensitivity.

* Develop action plans across the enterprise. Identify tools to be updated and which product changes must be made.

* Marshal testing and application development resources. Testing pros should run a post-patch regression on custom applications. Keep a few developers on call the week after DST changeover to fix undetected problems.

* Reach outside IT. Firms lagging behind in updates may find that employees outside IT can update machines or reset time zones if given explicit direction. Businesses should at least communicate with users about the DST issue.

* Seek changes in future contracts. Seek legal counsel on contract language that protects future investments in equipment and software.

System patches are required for operating systems released prior to early 2006, Forrester reported. "Patches range from automatically applied updates for recent versions of Windows and OS X to installable fix-packs for Unix , Linux , z/OS and i5/OS , to instructions and tools that detail how to manually manipulate time zone tables in older versions of Windows and Java," the researchers write.

Wang says Forrester found 33 packaged application vendors that still don't have a solution for daylight-saving, although some of these vendors may rely on the Microsoft Windows clock, for which there are available patches. A Forrester survey of 11 application vendors found that most clients can fix the DST problem through operating system patches that address time zone change.

The report states that vendors have generally informed clients of the problem and published updates, but Wang says "vendors haven't been as careful as they should have been."

[Rasputin]

Three Minutes: The FTC Chief Takes on Cybercrime

Over the past few years, computer crimes and annoyances have become an increasingly important part of the U.S. Federal Trade Commission's work. In the past year, the FTC has announced settlements with spammers, adware distributors, and even Sony BMG Music Entertainment, over its distribution of rootkit software.

FTC Chairman Deborah Platt Majoras recently sat down with the IDG News Service to discuss some of the work her organization is doing to keep the scammers and criminals at bay. She talked about the Sony settlement, the role that online advertisers play in the adware and spyware plague, and whether buried disclosures in licensing agreements really count.

Following is an edited transcript of the interview.

IDGNS: Although there's this perception that much of online criminal activity happens outside of the U.S., there's actually a lot of money that makes its way to the pockets of U.S. spyware vendors, hosting providers, and even advertisers. What can the FTC to go after the U.S. money?

Majoras: It's a very interesting point. I spoke [recently] to a corporate council. I told them that corporate America in general ought to do a better job of figuring out where their ad dollars are going. Because what we think is happening is that some of the ad dollars are making their way to adware providers who may be providing the software without the consumer's knowledge and consent. And these companies may not even know about it at the end of the day.

If I were a company, I wouldn't think that having a consumer bombarded with pop-up ads advertising my product would be a great way to sell.

We want companies to have a better understanding of where these advertising dollars are going, so in a couple of our high-profile spyware cases, like the one against Zango, we tried to be very public. That's a company that has changed its business model now. They have told us, "We've changed our ways; we're going to do things differently." But the people who hire them need to understand exactly what is going on with this advertising.

IDGNS: Well, you could get their attention if you sued them. Do you think that's likely?

Majoras: That would certainly get their attention. I don't know right now.

IDGNS: You recently settled an action against Sony over its use of rootkit technology to protect copying. That was a case of computer owner's property rights bumping up against the entertainment industry's enforcement of its intellectual property rights. Do you anticipate more of this type of conflict in the future?

Majoras: Yes, we may see some additional collisions, but from our perspective, companies should think about the legal principles that we've developed in the industrial economy and continue to apply them in this new economy.

The principles we applied in the Sony case are not really new and different. It's not that they endeavored to protect their intellectual property, which they're entitled to do, it's that they didn't tell consumers what they were doing. We felt that how a consumer could use the CDs, where the music could be played ultimately, and whether or not their habits were being monitored, those were things that consumers would want to know about before they made their purchase. From our perspective, disclosure to consumers is a first principle.

As we look at principles that we're applying in spyware and the like, the first principle there is, the computer belongs to the user, not to the software distributor. You have to think of it that way.

IDGNS: There is something about the way legal agreements are evolving that offends common sense. I don't think people read most disclosure agreements, and I don't blame them. If you just want to download a plugin or play a CD, is it reasonable to expect someone to read a three-page boilerplate legal agreement?

Majoras: That's a tough issue that you're raising, and an important issue. One of the things that has always been the case, though, is that buried disclosures have never worked and have never been adequate. So if you are burying an important disclosure that's going to make a difference to a consumer, then there's a real question about whether that's a true disclosure.

[Rasputin]

Wikipedia Breaks Into U.S. Top 10 Sites

Wikimedia Foundation Inc.'s popular Wikipedia online encyclopedia cracked the top ten list of most popular Web sites in the U.S. for the first time in January, according to comScore Networks Inc.

Wikipedia sites ranked ninth with 42.9 million unique visitors last month, ahead of the sites from The New York Times (number 10), Apple Inc. (number 11) and Viacom International Inc. (number 12), comScore reported Thursday.

Wikipedia, which already ranked in the top ten list of most popular Web sites globally, has been quickly gaining popularity in the U.S., where its parent company, the non-profit Wikimedia Foundation, is based.

In January of last year, Wikipedia sites ranked in the 33rd spot with 18.3 million unique visitors. By July, it had climbed to the 18th spot on the list with 28.1 million unique visitors, and in November it ranked 12th with 39.1 million unique visitors, according to comScore.

In doing its tally for Wikipedia, comScore also counts visits to other Wikimedia sites, like Wiktionary, Wikiquote, Wikibooks and Wikinews, but most of the traffic comes from the Wikipedia encyclopedias, a comScore spokesman said.

Wikipedia started in January 2001 with its English-language site, which currently has more than 1.6 million articles. The Wikipedia project has since grown significantly and has more than 5 million articles in more than 200 languages, according to WikiMedia. Access to Wikipedia is free. Volunteers contribute the encyclopedia's content, which can be edited by anyone accessing the sites.

Globally, Wikipedia sites ranked sixth in December with almost 165 million unique visitors, according to comScore.

[Rasputin]

The Most Annoying Things About Windows Vista

There's lots to like in the newest version of Windows. Vista's look is stunning, the OS should be more secure, and finding things is often easier. But Windows wouldn't be Windows without those aspects, big and small, that just drive you nuts with frustration. Here's our list of Vista features that just make us wonder, "What were they thinking?"

Home Basically-There's-No-Reason-to-Buy-This
The cheapest version of Vista, Home Basic, is so crippled it can't run the Aero interface. Theoretically, that's a boon for owners of machines that aren't capable of running Aero.

But it's time for some tough love, people: If your PC can't run Aero, you have no need for Vista. Period. On machines that aren't Aero-capable, the rest of the OS will run slowly enough that you're better off sticking with XP until it's time to buy a new Vista PC. So why does Home Basic exist? So Microsoft can say that Vista costs "as little as $100."

Not fixable: Unless you consider not buying Vista Home Basic a fix.

Ahhgh! My Screen Blacked Out!
Okay, Microsoft. We get that Vista is all about security. We get that you've sensibly limited what programs can do without explicit approval. We can even buy the idea that there's probably a good reason behind the incessant prompting from the User Access Control code built into Vista, warning about everything from installing software to changing fonts. So clearly you'd want a UAC alert to stand out a bit--to be something a user couldn't simply ignore. That's fine. But blacking out the entire screen as if the monitor were switching resolutions? That's the best you could do?

We thought you guys spent all this time designing a nifty new hardware-accelerated interface for your new OS. And you couldn't come up with something that looks even remotely 21st century for the UAC alerts? Really?

Seriously, UAC is a decent enough idea, but Vista's implementation pulls in two different directions. On one hand, the appearance of a UAC alert looks like the end of the world (or at least the end of some bit of computer hardware). On the other, the alerts' all-too-frequent appearances encourage users to give the warnings rubber-stamp approval. We're way too close to boy-who-cried-wolfsville here.

Somewhat fixable: You can turn off UAC alerts if you wish, but you give up a measure of Vista's enhanced security by doing so. Head to the User Accounts section of the Control Panel and click Turn User Account Control on or off. Uncheck the box labeled Use User Account Control (UAC) to help protect your computer, and then reboot your system. The UAC prompts will be gone.

The Large-Print Edition
If you like your current desktop-icon layout, you won't like what you see when you upgrade to Vista. Perhaps overly enamored with Vista's new photo-realistic icons, Microsoft went all AARP-friendly on us and bumped up the default size for desktop icons. That's okay, we guess. Plenty of people want bigger icons. Problem is, Vista's upgrade installation makes this layout-destroying change without asking you. And if you want to move all your icons back to their appointed places, you'll have to find the icon-size setting in its new location.

Fixable: Right-click your desktop and choose View, Classic Icons. Then spend far too long dragging your icons back to their proper positions. When you're done, you'll notice that the shortcut arrow now covers approximately a quarter of each supposedly beautiful new icon.

[Rasputin]

Adobe Ships Photoshop Lightroom

Adobe has released the first commercial version of its Photoshop Lightroom photographic software.

The software costs initially $199 in the U.S., rising to $299 after April 30. Adobe has said that Lightroom will not be included in the current or next versions of the Creative Suite.

Key Features
Photoshop Lightroom was available as a free downloadable beta program since its announcement more than a year ago. The current beta 4.1 will expire on February 28, after which users will have to purchase the full version to continue using it.

The 1.0 release adds a set of new features to those in the version 4.1 beta. The Library module gains advanced keyword tools to help photographers filter through large collections, and an improved import dialogue with more flexible file handling to allow more choice when determining file location.

The new Key Metadata Browser provides quick access to key information tags. It provides an improved ranking and rating system, says Adobe, with color labels and a pick/reject system.

The Develop module gains Virtual Copies and Snapshot tools. These provide multiple versions of the same image for comparison, without having to save physical versions. A new tool provides precise controls over hue, saturation and luminance, and the final release offers Clone and Healing brushes for sensor dust removal.

Support for more Raw image formats has been added, including those used by the Nikon D40 and D80, and Pentax's K10D. This brings the number of supported cameras to over 150.

Systems Supported
Photoshop Lightroom runs under Mac OS X 10.4 or Windows XP, though Adobe has not said whether Windows Vista is officially supported.

The company says that the recommended system requirements for the software are a 1GHz Power PC or an Intel Pentium processor, 768MB RAM, and a 1024 by 768 resolution screen. The Mac version of Photoshop Lightroom is a Universal Binary application that runs natively on both PowerPC- and Intel-based Macs, as does an upcoming version of Adobe Photoshop.