Pc News

[Rasputin]

ITunes Changes Fees

Apple Inc. unveiled a new feature of its market-leading iTunes music store that credits buyers for tracks already purchased when they download a complete album, putting an end to double-payment for the same song.

Complete My Album credits the US$0.99 customers paid for each track included on an album that they purchase, said Apple, with the caveat that the track must have been bought no more than 180 days before.

"Consumers have become very conscious of the risks of double or triple paying for the same song," said Aram Sinnreich, managing partner at Radar Research, a Los Angeles media consulting firm. "In the '90s, the growth in sales came from replacing music, from LPs to CDs. They've been encouraged to do that yet again with digital. But consumers, because of the Internet, have become much more conscious of this, and what the costs per track represents."

Single track purchases on iTunes now immediately trigger an addition to the buyer's personalized Complete My Album page, where the corresponding album's reduced price is listed. Buying the Joe Walsh track Ordinary Average Guy from the album of the same name, for instance, reduces the album's price from $10.89 to $9.90. The page also shows the 180-day deadline before the offer is null and void.

Apple is also making the offer retroactive for any iTunes tracks bought before today. It limits the credit period to 90 days, or June 26.

But the move will only slow, not stop, the decline of album sales, Sinnreich said. "It will have some kind of effect on purchasing albums, but long term, the album is simply not the most appropriate product format."

Album sales are definitely off. Nielsen SoundScan, the music industry's sales tracking service, recently reported that although digital single sales climbed 56 percent so far this year, album sales -- both physical and digital -- have dropped 16 percent.

"For the vast majority of recording artists, the album doesn't engage consumers. The labels put 10 junk tracks around three radio tracks and call it an album," Sinnreich said.

Yet even in an era where the playlist rules -- and remix and mash and shuffle are the norm -- there will be a place for albums. "People will still want to buy Coldplay albums, they'll still want to buy Jay-Z albums," said Sinnreich. "In 50 or even 100 years, music listeners will still conceive of Marvin Gaye's work as albums."

[Rasputin]

Cisco Hacks Expose Flaw

A couple of flaws in Cisco Systems Inc.'s Network Admission Control (NAC) architecture allow unauthorized PCs to present themselves as legitimate devices on the network, according to security researchers in Germany.

A tool that takes advantage of the flaws was demonstrated at the recent Black Hat security conference in Germany by Dror-John Roecher and Michael Thumann, two researchers working for ERNW GmbH, a Heidelberg-based penetration testing firm.

Cisco's NAC technology is designed to let IT managers set rules that prevent a client device from accessing a network unless it complies with policies on antivirus software updates, firewall configurations, software patches and other issues. "Cisco Trust Agent" technology sits on each network client and gathers the information needed to determine whether the device is in compliance with policies or not. A policy management server then lets the device either log into the network or puts it into a quarantine zone, depending on the information relayed by the Trust Agent.

But a "fundamental design" failure by Cisco to ensure proper client authentication makes it possible for pretty much any device to interact with the policy server, Roecher said. "Basically, it allows anyone to come along and say, 'Here are my credentials, this is my service pack level, this is the list of installed patches, my antivirus software is current' " and asked to be logged in, he said.

The second flaw is that the policy server has no way of knowing whether the information it gets from the trust agent truly represents that machine's status -- making it possible to send spoofed information to the policy server, Roecher said.

"There's a way of persuading the installed Trust Agent to not report what's actually on the system but to report what we want it to," he said. For instance, the Trust Agent could be fooled into thinking that a system has all the required security patches and controls and allow it to log into a network. "We can spoof the credentials and gain access to the network" with a system that is completely out of policy, he said.

The attack only works with devices that have a Cisco Trust Agent installed on it. "We did that because it needed the least effort," Roecher said. But ERNW is already working on a hack that will allow even systems without a Trust Agent to log into a Cisco NAC environment, but the tool for doing that will not be ready until at least August. "An attacker wouldn't need to have the Trust Agent anymore. It's a complete replacement of the Trust Agent."

Cisco officials were not immediately available for comment. But in a note posted on Cisco's Web site, the company noted that "the method of the attack is to simulate the communication between Cisco Trust Agent (CTA) and its interaction with network enforcement devices." It is possible to spoof the information pertaining to the device's status, or "posture," Cisco said.

But NAC "does not require posture information to authenticate incoming users as they access the network. In this regard, the [Trust Agent] is only a messenger to transport posture credentials," Cisco said.

Alan Shimel, chief security officer at StillSecure, a company that sells products that compete with Cisco NAC, said that Cisco's use of a proprietary authentication protocol may be causing some of the problems. "They don't have a mechanism for accepting certificates" to authenticate devices like the 802.1x network access control standard does, he said.

The Cisco Trust Agent spoofing issue highlighted by the researchers is a more generic problem, he said. Any agent software that lives on a machine, tests the machine and reports back to a server can be spoofed, whether it is Cisco's Trust Agent or some other software, he said. "This has always been an argument against use of client-side agents" for checking the security status of a PC, he said.

The security issues raised by the German researchers also highlight the importance of having "post-admission" network controls in addition to a "pre-admission" check such as Cisco NAC, said Jeff Prince, chief technology officer at ConSentry, a security vendor that sells such products.

"NAC is an important first line of defense, but it is not very useful" without ways of controlling what a user can do after gaining network access, he said.

[Rasputin]

Microsoft Posts Tools for Windows Home Server

Microsoft last week released a beta of documentation for a free software development kit (SDK) that helps developers build applications for its forthcoming Windows Home Server product.

The SDK documentation is available for download on the Microsoft Developer Network. It provides guidance on how developers can use the API and services in Windows along with the Visual Studio integrated development environment and Visual Studio C# tool to build new applications for Windows Home Server, which is currently in its second beta release.

Developers also must sign up and download the Windows Home Server beta on its Web site to use the SDK.

Typically, an SDK would also have libraries developers can use to build applications, but the developer libraries for Windows Home Server are available in the OS itself, said Charlie Kindel, general manager of Windows Home Server group at Microsoft.

He also said developing new applications for the product should be easy for developers because under the covers it is essentially the Windows client OS, except with tweaks aimed at specific functions. Those include features that help home users set up a network for several home PCs; store data and files from those PCs centrally; set up a security hub for the PCs; and allow users to access content from their PCs even when they are away from home.

Microsoft unveiled Windows Home Server, formerly known by the code name Quattro, at the Consumer Electronics Show in Las Vegas in January, and it is the first Microsoft server OS aimed specifically for home use. At the time of its launch, Microsoft said it did not plan to sell the product out of the box; instead, it said the OS will be distributed through original equipment manufacturers (OEMs) only on hardware built specifically to run it.

On Thursday, however, Kindel, said there might be a change in that plan. He said Microsoft may sell Windows Home Server out of the box when it becomes available later this year, alongside new MediaSmart Servers from Hewlett-Packard Co. that will be the first hardware available with the new OS pre-installed.

"We got a lot of feedback [from testers] and we want to satisfy them, so we are investigating whether [selling it separately] might be an option," he said.

Kindel said applications developers might build using the Windows Home Server SDK include those for system protection, media sharing, home security and home automation. Microsoft will continue to update the SDK beta as more information and APIs become available.

[Rasputin]

Carriers Oppose Consumers Seeking Open Networks

Representatives of large broadband and wireless carriers have voiced opposition to a proposal from consumer groups that would impose open access and net neutrality conditions on a spectrum auction next year.

On Thursday, a coalition of consumer groups, including Public Knowledge and Consumers Union, sent a proposal to the U.S. Federal Communications Commission, calling on the agency to place conditions on upcoming auctions of valuable spectrum in the upper 700MHz band. The groups called on the FCC to limit the bidding of large broadband providers, to allow open access on half of the spectrum being auctioned and to enforce net neutrality rules prohibiting auction winners from blocking customer access to Web content or applications.

But representatives of CTIA -- The Wireless Association, representing wireless phone providers, and the Hands Off the Internet coalition, representing AT&T Inc., Alcatel-Lucent SA and other groups, said they oppose the consumer groups' plan.

The proposal by the six groups calling themselves the Save Our Spectrum Coalition is an "awful idea," said Joe Farren, CTIA's director of public affairs. Auction conditions are unnecessary because "consumers have an abundance of choice" in the wireless market, he said.

"This makes no sense," he added. "In fact, it's dangerous because it could upend a completely healthy, competitive market."

The FCC's auction for 60MHz of spectrum in the upper 700MHz band is expected by early 2008. The spectrum, being abandoned by U.S. television broadcasters as they move from analog to digital broadcasts, is particularly valuable because wireless signals can travel four times farther than signals in higher bands. The spectrum would make it cheaper for wireless broadband providers to deploy networks over large geographic areas than with current spectrum, experts say.

The Save Our Spectrum Coalition said the spectrum auction represents the "last, best hope" for U.S. broadband customers to get a competitive third alternative to cable modem and DSL (Digital Subscriber Line) service. The conditions proposed could drive down prices and improve broadband speeds for U.S. customers, said Gigi Sohn, president of Public Knowledge.

"The problem we're trying to solve here is the lack of competition in the broadband market," added Ben Scott, policy director for Free Press, a media reform advocate and member of the Save Our Spectrum group. "If we don't have competition, we won't have better broadband networks. Without better broadband networks, we won't have the economic growth that has fueled our economy in the information age."

But the Hands Off the Internet Coalition, which has opposed net neutrality bills in Congress, said the Save Our Spectrum Coalition is attempting to circumvent an FCC inquiry into the need for net neutrality.

"Those promoting regulation evidently aren't content with trying to slow down the wired Internet because they're now trying to tie down the wireless Web, too," Christopher Wolf, Hands Off the Internet co-chairman said in an e-mail. "Federal regulation is simply incapable of keeping up with changing wireless technologies, which are transforming the wireless Web even faster than the wired Internet."

[Rasputin]

Intel Launches Quad-core Chip for Desktop Gamers

Intel Corp. is launching a quad-core chip for desktop gamers on Monday, continuing a barrage of new products the company has announced in the past week.

The Core 2 Extreme QX6800 runs at 2.93GHz, the fastest speed yet of the 12 designs of quad-core processors the company has launched since it announced the "Clovertown" Xeon server chip in November. That speed makes the chip a good fit for gamers and digital designers, the company said.

Multi-core chips can speed up computers that run multi-threaded software, dividing large jobs into several parallel parts. Until now, that software has been available mostly for server applications, but software developers have announced an increasing number of multi-threaded games, including Supreme Commander from Gas Powered Games Corp. and Hellgate London from Flagship Studios. Microsoft Corp. is scheduled to join that group later this month when it releases a multi-threaded version of its venerable Flight Simulator.

The new chip will also reduce waiting time for high-definition media editing jobs such as video encoding, said Eric Kim, senior vice president and general manager of Intel's Digital Home Group, in a statement.

Intel has unveiled a range of new products in recent weeks as the company keeps pressure on chip-making rival Advanced Micro Devices Inc. AMD is scheduled to launch a quad-core chip design by the middle of 2007 with the "Barcelona" Opteron server chip.

On Thursday, Intel launched two low-power versions of its Core 2 Duo processor, the U7600 and U7500 chips, aimed at products like Gateway Inc.'s E-100M ultraportable PC, due to hit stores on May 3. On Wednesday, Intel announced a plan to merge aspects of its vPro IT management package into its pending "Santa Rosa" Centrino notebook platform, due to reach markets in June. And on Tuesday, Intel launched two quad-core processors for high-end embedded applications.

Intel charges US$1,199 for the new Core 2 Extreme QX6800, with an 8M-byte memory cache and 1,066MHz front side bus speed.

[Rasputin]

SimpleTech Unveils Terabyte External Hard Drive

The design firm that crafted the seminal Ferrari car has turned its attention to hard drives, and the first of its efforts is an elegantly curved external drive just unveiled by SimpleTech. The rainbow of color options is tied to drive capacity, topped by the first external terabyte hard drive (in charcoal grey).

That 1TB drive packs Hitachi's five-platter, 3.5-inch Deskstar 7K1000 into the newly redesigned SimpleTech enclosure. The company expects the price to be in the upper $400s when the drive ships in mid-May.

Other entries in the new SimpleDrive Desktop line come in an array of capacities and colors; pricing starts at $99 for a 160GB drive. Each color designates a different capacity: fire red (160GB), pearl white (250GB), sapphire (320GB), onyx (500GB) and charcoal gray (750GB and 1TB). The drives will be available in USB 2.0-only and USB 2.0 and FireWire 400 varieties.

Sleek, Colorful Look
SimpleTech, which was recently acquired by Web services company Fabrik, drew on the skills of Italian industrial design house Pininfarina to design its Ferrari line of portable hard drives last year. The line was so successful, says Mike Coronado, Fabrik CEO and co-founder, that SimpleTech shot out of nowhere to claim the number two spot in the market. SimpleTech then returned to Pininfarina when it came time to redesign its previously unremarkable desktop external hard drives.

The redesigned SimpleDrive Desktop has an elegantly curved design and a large button on the top surface, which the company dubs its One-Click backup. The drive ships with One-Click Backup and Record software, based on ArcSoft's similarly named software. The 1TB capacity is unique among external hard drives. (Watch the Today @ PC World blog for a first look)

Services Bundled
All of the drives ship with 2GB of storage on Fabrik's Myfabrik.com Web storage, sharing, and content management service. That two gig capacity is up from the 1GB that's given on free Myfabrik.com accounts.

"Fabrik is a software and services company," Coronado says. "Syncing, backing up, managing your content on the Web--that's where we're going with this. And the Fabrik service will be part of an overall platform that the devices will fit into. It may be a flash drive, an external hard drive, or a network storage device--we'll be able to handle all of those "nodes" in the digital fabric."

The idea is to move away from the concept of backup, and to the concept of the making your content available to yourself, and to others. "In the fall," Coronado adds, "we expect to have an integrated service that will sync content on the myfabrik.com site with other devices, such as a hard drive or a flash drive. You'll be able to go from anywhere to anywhere."

[Rasputin]

Rival Asks Google to Yank 'Copycat' Application

Chinese Internet company Sohu.com has asked Google to stop distributing a product that allegedly copies portions of Sohu's Sogou Pinyin Input Method Editor (IME) software.

Deadline Set
The Sohu request came in the form of a letter sent to Google's Beijing office on Friday, giving the company three days -- until Monday -- to comply with Sohu's requests and stop downloads of the Google Pinyin IME software.

"We have requested they stop offering the software for download as quickly as possible. The second request is they make an apology, and the third is to discuss compensation for Sohu," said Wang Xiaochuan, Sohu's vice president of technology and head of the company's research and development center, in a telephone interview.

Google China executives, who are understood to be discussing the matter internally, had not responded to Sohu's letter by Saturday evening local time and Google's Pinyin IME remained available for download. A Google China spokesperson acknowledged receipt of an e-mail request for comment, but had not responded at the time of writing.

When Sohu's concerns first became public, Google noted that its software is still being tested, but did not address the accusation directly.

If Google doesn't meet the letter's deadline, the next step for Sohu will be to "follow the normal course of legal proceedings," Wang said.

Converting Characters--and More
Pinyin is a romanization system for Chinese characters. The Sogou Pinyin IME, released in June 2006, allows Internet users to type Chinese characters by entering their Pinyin equivalents. As they type, the software suggests possible matches for words and names, which are drawn from a dictionary that is part of the IME software.

Unlike IMEs from other companies, such as Microsoft, the dictionary of words and names used with Sohu's IME software is partly based on a database of popular Internet search terms compiled by its Sogou search engine. This dictionary lies at the heart of Sohu's allegations against Google.

"We were surprised to find that Google was using Sohu's dictionary," Wang said, noting that Sohu holds copyrights for its dictionary. "We have never made this dictionary public or licensed anybody to use it."

Several mistakes that exist in the Sohu dictionary, along with the names of several Sohu employees that were added to the dictionary, have been found in the dictionary used with Google's Pinyin IME.

For instance, Google's software requires users to enter the wrong Pinyin, 'pinggong,' to get the characters for the name of Feng Gong, a popular actor and comedian. Typing the correct Pinyin does not yield the actor's name. The same error exists in a version of Sohu's software.

Early Concerns
Sohu became aware of these similarities shortly after Google announced on April 4 that its IME software was available for download. When engineers discovered that Google's dictionary contained their own names, that was the first hint that something was amiss with Google's dictionary.

"The probability of these names appearing is very low. If we had not inserted them, then they would not be in our database," Wang said. "Google's database is even more unlikely to have them,"

Wang noted these names appear to have been removed from Google's software since its launch several days ago. However, at the time of writing, the common Pinyin errors identified in the Google software by Sohu had not been removed.

[Rasputin]

Users Gripe About Speeds of Vista Start-up, Shutdown

Windows Vista users are complaining on Microsoft Corp.'s support forums about long start-up, shutdown and application load times compared with Windows XP.

The users, who sound pro-Vista for the most part, have vented about a variety of speed issues on Microsoft's Performance & Maintenance forum. "I have XP and Vista running side-by-side [but] I twiddle my thumbs waiting for certain apps to load up on the Vista machine while the load is instantaneous on the older XP machine," wrote a user identified as William. "I've tweaked it as best as I could with the info available and I am still very disappointed."

Wrote another user, Kris: "Recently I upgraded from XP to Vista [Home] Premium. When I start the laptop and I see the last BIOS info and Vista starts loading, then I have to wait a full 6 (six!) minutes before I can open my first application (for example Outlook or IE or whatever)."

Some accepted the slower speeds as the price of admission for getting the latest and greatest from Microsoft. Said Jon: "XP is undoubtedly quicker than Vista. I don't think there will be a way around that. You'll never get extra functionality, without some performance cost, assuming the same hardware."

Suggestions from other users, including some tagged as Microsoft Most Valuable Professionals, ranged from adding more RAM to running Vista's Performance Information and Tools control panel to diagnosing possible problems. Replies to such messages, however, typically claimed 2GB or more of memory, and said no problems were reported by the operating system.

Start-up and shutdown times were particularly grating to some users. "Takes about 10 minutes to boot, then 5 minutes after login before you can use it," said user Bengt. "If no improvement I have promised my family to return to XP. But I want Vista!"

One user had a worse tale to tell. Martin Racette wanted to know if it was normal that Vista took more than an hour to shut down and to restart.

Others, at least, kept a sense of humor. "I've compared it to a Commodore 64 loading programs from tape, but I think the Commodore was faster," said Steve Franks. "I'm currently writing this on my other PC, because nothing has happened on my Vista machine for about 15 minutes."

Users, software reviewers and some analysts have dinged Vista for its high-powered hardware requirements, and a lawsuit filed last week took that very tack. Head-to-head comparisons between XP and Vista start-up and shutdown times, however, remain anecdotal.

Thus, it was no surprise that Microsoft denied that Vista is slower to boot, reboot or shut down. "Start-up and shutdown times will vary based on the configuration of the PC by the OEM," said a company spokeswoman today. "But we have seen, based on both internal and external measurement and testing, that most Windows Vista users experience very quick responses when using sleep, shutdown or restart.

"In fact, the majority of users will have start-up and shutdown times that are faster than they would have been with Windows XP," she added. "If users take advantage of Windows Vista's default sleep setting, they can achieve two-to-three second resume times."

Microsoft has positioned Vista's new sleep mode -- a hybrid state that combines Windows XP's separate hibernation and standby modes -- as the default setting, essentially conditioning users to not power-off their PCs. Some have reasoned that the move was made to mask Vista's long boot and shutdown times.

Although Microsoft has not admitted as much, last December, Jim Alchin, then the head of Windows, while describing sleep mode, said: "The bottom line is that because there is no reboot, the PC can respond much more quickly."

[Rasputin]

TurboTax Fixes Security Glitch

TurboTax says it has plugged a hole in its Web site that last week allowed a Nebraska woman to view prior year tax returns for two people with the same last name.

Last Tuesday, TurboTax became aware of a back door in a feature on its Web site that lets users save and view PDFs of previous tax returns. The back door allowed a woman to inadvertently view old tax returns of two other people in addition to her own.

When the woman told TurboTax tech support staff about the problem, TurboTax disabled the feature, fixed the hole and had it back up and running the following day.

TurboTax spokeswoman Julie Miller says the problem didn't affect people using the company's popular software to prepare or file 2006 tax returns.

Miller says TurboTax believes the backdoor affected only three of its customers: the woman who discovered the problem and the two individuals whose returns she was able to view.

"We looked all over our Web site. We scrubbed every customer log, and nothing else has come to light,'' Miller says. "We have very robust information safeguards here.''

Miller recommends that TurboTax customers with common last names choose strong passwords to prevent this sort of problem in the future.

"This was an isolated incident,'' she says.

[Rasputin]

How to Avoid Falling Into the Phishing Hole

You never can defend yourself too much while online.

A PC World reader alerted me to a flaw on eBay's Web site that enabled a scam designed to trick people into handing over their personal information. eBay promptly patched the flaw last week, but experts I spoke with are wondering how long the fix will hold.

The flaw allowed a scammer to use an increasingly common type of attack called cross-site scripting, or XSS, to redirect people from an eBay listing to a spoofed eBay site. Though eBay may have plugged the hole for now, experts say, similar problems have surfaced in the past on eBay and other sites, and it's a safe bet they will again. The problem is not going away, and it will continue to cause visitors to eBay and other sites trouble for the foreseeable future.

How It Worked
On a tip from a PC World reader, I reviewed the scam before eBay canceled the auction that it keyed to. Once potential victims were taken to the fake, or spoofed, eBay site, anyone interested in the item in the auction--a 1961 Volkswagen Microbus--was encouraged to e-mail the scammer directly at 4naffairs@yahoo.com to proceed with the sale.

According to security experts, such attacks are a very common and effective way of tricking Internet users into visiting fake sites.

"Any site that accepts user-generated content has likely had to patch their site for this flaw," says Bill Pennington, vice president of services at WhiteHat Security. Pennington says his company finds nearly 600 instances of cross-site scripting flaws on the Web every day.

Can the Vulnerability Be Fixed?
For eBay's part, it says that it constantly monitors its site for security problems and corrects them as quickly as they are found. "As soon as we became aware of this scheme, we changed some of the code on our site. So this scheme, and ones like it, can no longer be effective," says Nichola Sharpe, an eBay spokesperson.

And eBay is far from alone when it comes to being a target of this type of attack. Similar attacks on major sites like Amazon.com, MySpace.com, Verisign, and even the United States National Security Agency's Web site have been documented.

Security experts say cross-site scripting is part of doing business on the Internet. "There is no one fix [for Web sites] to solve this problem," says Ken Dunham, security expert with VeriSign iDefense Security Intelligence Service. He says finding and patching cross-scripting flaws is like a game of Whack-A-Mole, with new flaws popping up all the time.

In the example found on eBay, the cross-site scripting exploit first inserted malicious JavaScript code into the auction listing description. Next, when users visited the rigged eBay auction, the JavaScript directed the users' Internet Explorer or Firefox browser to instantaneously forward the users to a spoofed Web page that looked exactly like an eBay auction page.

eBay says it now prevents JavaScript on its site from forwarding visitors to third-party sites automatically. However, experts say, hackers can easily modify JavaScript code to once again trigger the same behavior.

[Rasputin]

Holocaust Museum, Google Launch Mapping Effort

The U.S. Holocaust Memorial Museum and Google Inc. Tuesday jointly unveiled a new online mapping initiative aimed at educating users about genocide. The effort was completed just days before Sunday's 2007 Holocaust Remembrance Day, or Yom Hashoah, which is set aside to remember the victims of the Holocaust.

The first project under the Museum's Genocide Prevention Mapping Initiative will include photographs, data and eyewitness testimony from a number of sources about the crisis in the Darfur region of the Sudan. The information is now available on the Google Earth Web site.

This content, being linked together for the first time, was posted today in the Google Earth global awareness section.

The Crisis in Darfur project will allow the more than 200 million users of the Google Earth mapping service to visualize and better understand the genocide in Darfur today, the museum said.

"When it comes to responding to genocide, the world's record is terrible," said Sara Bloomfield, director of the Holocaust museum in Washington. "We hope this important initiative with Google will make it that much harder for the world to ignore those who need us the most."

Content for the Crisis in Darfur project comes from the U.S. State Department, nongovernmental organizations, the United Nations, photographers and the Holocaust museum.

Users can zoom into the region and view more than 16,000 damaged and destroyed villages and the remnants of more than 100,000 homes, schools and other structures destroyed by militia and Sudanese forces, according to the museum.

The museum also announced the creation of a similar mapping project on Holocaust history. The museum said it is using Google Earth to map key historic Holocaust sites with historical content from its collections.

To access the Crisis in Darfur project, users must download the free Google Earth application and then fly over Africa on the mapping service.

[Rasputin]

37 Oracle Security Fixes Coming Next Week

Oracle Corp. will fix a number of products, including the Oracle Database, Application Server, and E-Business Suite, next week as it releases its quarterly batch of security patches.

Next Tuesday's Critical Patch Update will include 13 patches for the database, half as many as the software vendor provided in its January release. Three of the database bugs appear to be particularly serious, with Oracle warning that they could be remotely exploitable over a network, without requiring a username or password on the database.

The next most-patched product is Oracle's E-Business suite, which will have 11 fixes. Two of these could be remotely exploitable.

Also planned for next week's Critical Patch Update: Bug-fixes for Oracle Application Server, Oracle Collaboration Suite, and Oracle Enterprise Manager. The company is also planning to release four patches for its JD Edwards and PeopleSoft products.

[Rasputin]

Reviewed: Hitachi's Massive One-Terabyte Hard Drive

Data storage doesn't tend to elicit wows or water-cooler conversations, but that's about to change: Hitachi's new Deskstar 7K1000, the first hard drive to reach one terabyte, is here--and it's worth the hype.

Based on our exclusive evaluation, this gonzo-size drive is a keeper, scoring near the top on our performance tests. But be prepared to pay a premium for this drive's high performance and high capacity.

One terabyte has long been considered a watermark capacity for hard drives, and rightly so: Suddenly, it's possible to pack 330,000 high-resolution digital photos (at 3MB a pop) or about 150 high-definition movies (encoded at 9 megabytes per second using MPEG-4) onto a single drive.

Previously, if you wanted to achieve such colossal capacity, you'd have to harness multiple 250GB drives together with disk spanning, or pair two 500GB drives configured using either disk spanning or striping (RAID 0).

How It Scored in Our Tests
Hitachi achieves its massive capacity by packing 250GB onto each of the drive's five platters; that's up from 200GB per platter on Hitachi's 500GB model. The Deskstar 7K1000 is Hitachi's first 3.5-inch drive to use perpendicular magnetic recording to record data (Hitachi, however, has previously used perpendicular technology in its mobile hard drive line).

The Deskstar 7K1000 was a formidable performer across the PC World Test Center's test suite: It earned a top score of Superior on our tests. The drive was the fastest on our file search test; it required just 151 seconds to search for a text string in the 11.7GB of content we placed on the drive (besting the its smaller-capacity sibling, the Deskstar 7K400, by 7 seconds). The new Deskstar tied for top honors on our ACDSee test, taking 513 seconds to do perform our scripted tasks of searching and converting files from one format (say, .jpg) to another (say, .gif); and it sailed through our WinZip test, shaving 2 seconds off the result of the previous top WinZip performer, the Samsung SpinPoint T Series HD501LJ.

The drive's performance was slightly less impressive on two other tests: copying files and folders, and copying very large files. Here, it took 144 seconds to write 3.06GB of files and folders (25 seconds behind our top performer on this, the SpinPoint), and 117 seconds to write a single large 3.06GB zip archive (27 seconds behind the Samsung SpinPoint).

Pricey
The Deskstar 7K1000 has to be considered very expensive among the field of internal hard drives that we've tested. On a cost-per-gigabyte basis, the difference between the Deskstar 7K1000 and our least expensive drive, the $150 Samsung SpinPoint T Series HD501LJ, doesn't seem so large: The difference is just 10 cents per GB (40 cents per GB for the Hitachi versus 30 cents for the Samsung). But multiply that difference across 1000 gigabytes, and suddenly the $399 price feels a smidge high.

I don't mind paying a bit, more, though. The deep-bucket capacity and solid performance of the Deskstar--not to mention the limitless possibilities of what I can do with a one-terabyte hard drive more than justifies the premium price tag.

[Rasputin]

Vista Beta Testers Face Looming OS Expiration

Microsoft Corp. has begun reminding millions of testers of Windows Vista's beta and release candidate (RC) previews that their trial runs end on June 1.

Cori Hartje, director of Microsoft's antipiracy efforts, became the first company executive to note the impending deadline. "As a reminder to those that helped with Windows Vista beta testing, the beta installations are set to expire at the end of May 2007," said Hartje in a Q&A that Microsoft posted March 30 on its public relations Web site. "So customers need to decide if they want to move to Windows Vista or back to Windows XP if they have test versions of Windows Vista on their PCs."

Details on how best to do that, however, are scant. Despite repeated requests to clarify the exact procedure beta and RC users need to take -- and whether Microsoft will provide either guidance or offer a discount to testers -- the company declined to spell out its plans.

What information the company has published is on last year's Customer Preview Program (CPP) site, which points to the June 1 expiration date and explains that once installed, the Vista previews don't allow for operating system rollbacks. "You cannot roll back to the previous operating system installation -- you will either have to acquire and install the final released edition of Windows Vista or reinstall a previous edition of Windows," the site reads.

Some hints, however, can be found on Microsoft's Vista support forums:

-- Only a full version of Vista does the upgrade from Beta/RC to final. Multiple threads on the Vista forums note that it's not possible to do an in-place upgrade from Vista Beta or RC using a final, retail upgrade version of the operating system.

"You can't use an Upgrade edition to move from Beta/RC to final. Has to be a Full version," said a user identified as Richard Harper. That means Beta/RC users can't take advantage of the lower-priced upgrade Vista stock-keeping units (SKU) to retain their Vista settings and installed applications when migrating to the real deal. The price difference on Vista Ultimate is dramatic: US$259 list for the upgrade edition, $399 for the full version. And that's important because ...

-- $399 buys you in-place upgrade. If testers wondered why Microsoft gave them the most powerful, and expensive, Vista last year, this may be a clue: To do an in-place upgrade from a Vista preview to the final code requires not only a full edition, but a full edition of Ultimate.

"Just as in all past [Microsoft operating systems], downgrading isn't supported," said Dave B. Another user, Chad Harris, was more specific. "It has to be a Full version of Ultimate ... any other version (Home Premium, Business) is considered a downgrade to Ultimate and is not allowable."

-- Revert to resume. To take advantage of lower-priced upgrade editions of Vista, or to move from the Beta/RC Ultimate SKU to a less-featured version, like Home Premium, testers must reinstall an earlier operating system -- likely Windows XP -- before upgrading from that to Vista final.

"So if I return my laptop to XP, then if I bought the upgrade version of Vista, it should work right?" asked NoSpinVette. Rick Rogers answered with a simple "Yes indeed." The reinstallation of XP, of course, deletes all data on the boot hard drive and so requires testers to backup data files and reinstall applications on the Vista-powered PC after the upgrade is completed.

Those hassles didn't sit well with some dedicated beta testers. "Do you mean to say that because I installed Vista RC2 over XP, I screwed myself out of upgrade pricing? If so, seems like MS is punishing beta testers," said a user labeled as "tom."

[Rasputin]

Major Search Engines Improve Sitemaps Protocol

The rare collaboration between search rivals Google Inc., Yahoo Inc. and Microsoft Corp. over site maps has yielded its first result.

On Wednesday, the vendors announced they have enhanced Sitemap, a protocol designed to simplify how webmasters and online publishers submit their sites' content for indexing in search engines.

Along with the improvements, the vendors also announced that IAC/InterActiveCorp's Ask.com will support the protocol, which thus gains backing from another major search engine operator. IBM Corp. also signed up to support the effort.

In November, Google, Yahoo and Microsoft agreed to support Sitemap, an open-source protocol based on XML (Extensible Markup Language.)

A site map is a file that webmasters and publishers put on their sites to help the search engines' automated Web crawlers properly index Web pages. The Sitemap protocol aims to provide a standard format for site maps, which should simplify their creation by Web publishers and their discovery and interpretation by search engines.

On Wednesday, the vendors announced that the Sitemap protocol, now in version 0.90, provides a uniform way of telling search index crawlers where site map files are located on a site.

All Web crawlers recognize the robots.txt instruction, which tells crawlers not to index certain information, so now webmasters can indicate the location of their site map file within robots.txt files. Meanwhile, the protocol's official Web site is now available in 18 languages.