Gregarius » BetaNews.Com » mars 30, 2010

BetaNews.Com (6 non lus)

Apple launches iPad-friendly iTunes 9.1

Publié: mars 30, 2010, 11:32pm CEST par Tim Conneally

By Tim Conneally, Betanews

Just four days ahead of the iPad's first day of availability, iTunes has received an upgrade which adds sync for the new device. According to the software updater, the new version of iTunes lets users "Organize and sync books you've downloaded from iBooks on iPad or added to your iTunes library," and "Rename, rearrange, or remove Genius Mixes."
The icon under "Library" which formerly was called "Audiobooks" is now simply, "Books," and Genius mixes can now be re-named and moved. Otherwise, there is not much of an outward difference between 9 and 9.1
The new iTunes also brings a new version of VoiceOver for the iPod Shuffle and Nano. This is the feature which says artist names, song titles, and playlists with the Voiceover-equipped iPods with an earphone remote. With iTunes 9.1, there are several unspecified performance upgrades for VoiceOver, and pronunciation updates for the kit have become an automatic download.
Copyright Betanews, Inc. 2010
Chrome 5 becomes the Flash browser, integrates plug-in with dev build

Publié: mars 30, 2010, 11:19pm CEST par Scott M. Fulton, III

By Scott M. Fulton, III, Betanews

Download Google Chrome 5 Dev build 360.4 for Windows from Fileforum now.
With Google owning YouTube, the Internet's principal delivery system for Flash-based video, it was perhaps inevitable that the company would bundle the Flash plug-in with its Chrome browser. The announcement came today from both Google and the team developing the open source Chromium component on which Chrome is based.
The move now officially places Google in contention with proponents of HTML 5, who had held out a glimmer of hope for a non-proprietary, non-plug-in video format for the standard's new <VIDEO> element. In its blog post today, the Chromium team indirectly blamed the standards process for not having solved what it perceives as the problem of specifying how plug-ins should operate, and credits Mozilla -- which makes Firefox -- with helping to rectify that issue.
"The traditional browser plug-in model has enabled tremendous innovation on the Web, but it also presents challenges for both plug-ins and browsers," reads today's post from Google Vice President for Engineering Linus Upson. "The browser plug-in interface is loosely specified, limited in capability and varies across browsers and operating systems. This can lead to incompatibilities, reduction in performance and some security headaches."
Upson credits Mozilla's efforts to upgrade and improve the old Netscape plug-in API model, still called NPAPI. This model currently enables out-of-process plug-ins to operate essentially independently from the browser. Historically, it's this independence that has been exploited by malicious users infiltrating victims' systems through Adobe Flash. Under the new system proposed by Mozilla, code-named "Pepper," processes launched through the browser would run through threads that are routed completely independently of browser and renderer threads. Specifically, the new thread model would block browser threads when plug-in threads are active, and vice versa, so that one would never have access to the other.
Consider it a kind of "anti-multithreading" that may very well be necessary in the age of Web applications.
But by citing Mozilla as the leader in this effort, Google may effectively be ceding responsibility for solving some of the most critical Flash security issues to date, to Mozilla. Until then, Upson concedes that the first Chrome dev build to contain the Flash plug-in will not yet have resolved a potential security risk: the separation between the Chrome tab processes and the Flash runtime. Part of Google's (originally) innovative security model was its division of browser tabs into separate processes, so that when one tab crashes, the main browser remains stable.
One of the unanticipated side-effects of this model deals with Chrome's approach to add-ons: They too are separate processes, all of which identify themselves to the operating system as Chrome. The screenshot above shows a list of active processes from Sysinternals' Process Explorer, with the latest Chrome dev build 360.4. There's only one tab running the Acrobat.com page, but note that Chrome appears twice in the list. That second instance appears to be the Chrome sandbox wrapped around the Flash add-on.
But it's not. As Google's Upson said today, despite appearances, the Flash instance which that second item appears to encapsulate is not completely covered by Chrome's sandbox -- its safe operating environment. There's obvious reasons for that: Here, Flash Web apps are hosted in the client by the AIR runtime. There should only be one instance of AIR running within a client.
The reasons why were outlined in a 2008 white paper (PDF available here) written by a trio of university researchers who were employed by Google to design Chromium. It's in "The Security Architecture of the Chromium Browser" that the designers explain the division of the browser kernel, which interacts with the operating system, from the renderer which is isolated in the sandbox. Plug-ins must run independently of the sandbox in order to fulfill the needs of their manufacturers, the group stated, even though doing so introduces a potential vulnerability. Notice which plug-in they picked as their case-in-point:
In Chromium's architecture, each plug-in runs in a separate host process, outside both the rendering engines and the browser kernel. In order to maintain compatibility with existing web sites, browser plug-ins cannot be hosted inside the rendering engine because plug-in vendors expect there to be at most one instance of a plug-in for the entire web browser. If plug-ins were hosted inside the browser kernel, a plug-in crash would be sufficient to crash the entire browser.
By default, each plug-in runs outside of the sandbox and with the user's full privileges. This setting maintains compatibility with existing plug-ins and web sites because plug-ins can have arbitrary behavior. For example, the Flash Player plug-in can access the user's microphone and webcam, as well as write to the user's file system (to update itself and store Flash cookies). The limitation of this setting is that an attacker can exploit unpatched vulnerabilities in plug-ins to install malware on the user's machine.
Users could try running Chromium (and later Chrome), the group suggested, using the command line switch --safe-plugins, which would place all plug-ins under the protection of the renderer's sandbox. But they'll likely crash, they warned.
To address that problem, Adobe's senior director of Flash engineering, Paul Betlem, said in a blog post today that his team will work with both Google and Mozilla to replace and improve NPAPI. "While the current NPAPI has served the industry well, it lacks the flexibility and power to support the pace of innovation we see ahead," Betlem wrote. "We expect that the new API specification will offer some distinct benefits over the current technology available."
One foreseeable outcome of this collaboration could very well be a community where at least some plug-ins are compatible with both Chrome and Firefox simultaneously. But another outcome that Adobe's Betlem points to is a certain kind of unification, not just of the security model but of how the browser presents itself to the world. Think of it as "the Flash browser."
"The new API is being designed with the flexibility to allow plug-ins to more tightly integrate with host browsers," wrote Betlem. "The new plug-in API will provide performance benefits since the host browser will be able to directly share more information about its current state."
Reaction to Adobe's and Google's move today was mixed on Google's forums, with about two-thirds of respondents against the bundling and one-third vocally in favor. As supernova_00 wrote this morning, "Ugh. And here I thought we were all getting close(ish) to completely ditching Flash, and you guys decide to bundle Flash with Chrome. What the hell happened to open standards?"
Plus this from contributor Daniel Hansen: "Just when we thought that Google was the champion of HTML 5, they turn around and partner with Adobe on Flash to ensure that the Web remains a mess of proprietary brain damage."
Support for the move centered around the notion that Flash is simply a fact of life on the modern Web that no arbitrarily imposed standard is likely to change overnight, or even in the next decade. "People must be really dumb if they think HTML 5 is going to kill Flash," wrote Gabriel. "It's used for so-o-o much more than cats playing piano. The sooner you realize this, the more Google's move makes sense."
There was also this from contributor Troy: "How is Flash not an open standard? The bytecode format of [Shockwave] SWFs is published. There are open-source tools for producing SWFs. The tool chain is open-source and free. The player is available on the three major desktop OSs, and now on many mobile devices, as well as several video game consoles. Its virtual machine is open-sourced. Sure, it's not standard-certified by some international organization, but neither is HTML 5 (yet) nor is CSS3 (yet). It is a de facto standard, used by more Web sites and users than HTML 5, CSS3, Canvas, etc. Come on, folks, let's be pragmatic."
The bundling of Flash with Chrome does not change the relationship between the component and the browser, as indicated by the about:plugins page above. Notice its format changed with this latest dev build; it now includes (highly requested) Disable links that let you turn off plug-ins without uninstalling them. However, bundling Flash did add 2.4 MB to Chrome 5's download size, plus a single new question to the startup procedure (shown below). In the dev build, to start using the Flash plug-in that's distributed with the browser, you run Chrome from the command line, adding the switch --enable-internal-flash.
Copyright Betanews, Inc. 2010
'Hands-off' review of Dial2Do's solution to the texting and driving problem

Publié: mars 30, 2010, 6:23pm CEST par Tim Conneally

By Tim Conneally, Betanews

Back in December, I tried to enable everything I use on my Motorola Droid with text-to-speech, with only limited success. Ideally, I would have been able to have all of my incoming text-based media from Twitter, RSS, e-mail, and SMS read aloud to me so I could use my phone while driving. Unfortunately, Android's built in TalkBack functionality is very limited, and the talking apps I've tried are also pretty limited in what they do.
But with safe driving legislation in committee in Congress, and a growing list of states that have banned texting while driving, the market for eyes- and hands-free phone interfaces is hot.
At CTIA last week, there was actually a whole section of the show floor dedicated strictly to safe driving solutions, and a number of hardware manufacturers, like LG, addressed the topic in their booths as well.
So I found a couple of services that approximately do what I wanted to do back in December, and checked them out.
One of them is Dial2Do, which utilizes text-to-speech and voice recognition software to let a user check her e-mail, calendars, Twitter feeds, SMS, weather updates and news feeds, personal notes, and a growing list of other services without using her hands or eyes.
With the free Dial2Do Android app, you can have your incoming text messages read aloud to you as they arrive, and you can create 20-second audio notes which are transcribed and e-mailed to you. Access to all the other functionality of Dial2Do costs $3.99 per month ($39.99 per year.)
When you hit "hands-free assistant" in the Android app, it dials into the local Dial2Do menu system. From there, you can then use voice commands to access your different linked services. Saying "Send a text to [contact name]," for example, will give you 30 seconds to speak a message to that contact which will then be transcribed and sent without the need for lots of "Are you sure?" prompts. Saying "Twitter" lets you post a tweet to your feed which includes a partial transcription and a link to your recorded messages.
Like most voice recognition software, Dial2Do requires a somewhat slower cadence for accurate transcription, and has difficulty recognizing arcane words and proper names. After testing the notation software, I chose a random passage from a Rudyard Kipling book: "Free People, and ye too, jackals of Shere Khan, for twelve seasons I have led ye to and from the kill, and in all that time not one has been trapped or maimed."
What came through in transcription was passable: "Free people and jekyll's of (Sherkan?) for 12 seasons I have led thee to and from the hill and in that time not one has been trapped or named."
When navigating through the service, you may find some dead ends. If you're listening to a long string of tweets or listening to headlines in Yahoo News, for example, you cannot say the name of another service to switch tasks, and if you say "go back," it always registers as "goodbye" and asks if you want to hang up. Any phone can use Dial2Do since it's based on calling in to access the command system. But Android and BlackBerry both have apps in beta which make interacting with the service much simpler.
While Dial2Do is extremely useful for replying to messages and sending out communications to others, the built-in reader voice still suffers from lots of mispronunciations, and it reads at an awkward pace. It works well enough for text messages and e-mails, but when you're going through lists of tweets or news headlines (which is the main thing I wanted an application to do) it is often hard to understand what is being said.
So if you're looking for a voice command service to use while driving, Dial2Do is an excellent choice. If you're looking for a voice-driven feed reader that will speak clearly and let you drill down into articles that interest you, Dial2Do is probably not what you're going to want.
The Handsfree Assistant app is available for download directly from Dial2Do or in the Android market.
Copyright Betanews, Inc. 2010
Apple must apply 'right price, right rights' model to e-books

Publié: mars 30, 2010, 6:10pm CEST par Joe Wilcox

By Joe Wilcox, Betanews

There are many reasons why iPod and iTunes Store succeeded where competing products failed. But two reasons stand out: Right price, right rights. If iBookstore is to succeed, Apple must apply the same model to e-books and other publications sold there. CEO Steve Jobs and company must seize control of pricing during content negotiations -- and, more importantly -- rights. There must be a single (and generous), standard usage right for all titles, including magazine and newspapers.
When Apple launched iPod in October 2001, the "right price, right rights" model was the best possible: Free. Music labels hadn't locked down CDs with onerous digital rights management mechanisms. Therefore, people could rip music and make their own "mixed tapes" CDs. Meaning -- people buying iPod already owned content they could put on the device. Apple wisely chose not to restrict music copying to iPod. The price was free and the rights were unrestricted.
Other MP3 manufacturers should have benefitted from the same price and rights advantage, but poor PC synchronization plagued many devices. I know. I tested enough competing devices and media playback software in the early "Noughties" to see the problem. By comparison, iPod-iTunes sync worked right from Day One. Apple offered a better user interface -- on the device or from the MP3 software.
When Apple launched iTunes Music Store in April 2003, it did so with uniform pricing and seemingly transparent rights. Singles sold for 99 cents and albums for $9.99. Both prices were magical and right on target, based on consumer surveys conducted by colleagues at JupiterResearch (I was a senior analyst there from 2003-2006). Both prices were lower than CD singles or albums. The rights: Consistent among all tracks with CD burning three times for any playlist and generous copying to iPod.
By comparison most other digital music stores available then and soon after applied variable pricing and rights mandated by publishers. Varying rights usage -- as in how many times a song, album or playlist could be burned/copied to device or not at all -- corrupted the user experience. Consumers would buy one song that could be burned once, another song three times and yet another not at all. In my testing of music services and software during the early to mid Noughties, varying rights posed another problem: Synchronization. There were consistent problems syncing DRM content -- particularly from different music stores -- to music players or burning to CDs. These problems largely contributed to the failure of Microsoft's PlaysForSure program.
Apple revolutionized digitally downloaded music by standardizing price and rights for DRM content. Consumers already had consistent pricing and rights from the stuff they owned -- or stole from file sharing sites. Apple increased those rights over time, later to five burns per playlist. In February 2007, Jobs called for the end of DRM in an open letter. Publishers would later give broad DRM freedom to Amazon's competing music store, as leverage against Apple's growing distribution dominance.
Today, iTunes music rights are ubiquitous; there is no DRM, so no restrictions. Pricing is variable, however, a concession Apple reportedly made to music labels. In my testing, iTunes Store variable pricing means that buyers pay more than AmazonMP3 store for many singles or albums. I won't defend the practice, but must point out that Apple could much easier implement variable pricing as a leading music distributor than as one starting out seven years ago. Apple is starting out again, now with e-books.
Mistakes will Haunt Apple Customers
The pricing and rights mistakes Apple makes now will haunt iBookstore shelves for years. These apparitions will terrorize consumers browsing the stacks, and no "Ghostbusters" will be able to save them. Apple must get pricing and rights right from Day One, as it did with iPod and iTunes.
Amazon clearly understands the importance of the "right price, right rights" model -- at least applied to e-books. Its approach to selling otherwise free content (like blogs) or newspaper and magazine subscriptions is a more troubled scenario. Until recent, forced renegotiations, Amazon sold popular and new releases for the uniform price of $9.99. Usage rights are consistent, even if restricted compared to physical books. Generous personal usage rights allow buyers to download and redownload e-books pretty much to any device -- Kindle, PC/Mac or smartphone -- authorized by Amazon's software. Amazon offers consistent lending rights: None. Consistency helps curtail consumer confusion, but none isn't enough rights compared to physical books.
Barnes & Noble offers one-time lending rights for its e-books -- kind of. Publishers still control usage rights, which means some titles can't be digitally lent at all. The rights are restrictive and confusing.
Apple has opportunity to do for e-books and other e-publications what it did for music. I'm simply stunned that for all the online rumors and speculation about iPad, so little of it is about right price and right rights. Apple has a chance to fundamentally change the e-book/e-pub model, but that won't likely happen if publishers dictate terms. Amazon was right to seek consistent pricing, either working with publishers or around them. Apple should do better, and out-of-control iPad hype is leverage Jobs and his negotiators should use.
Apple should be cautious about adopting App Store pricing. Rights are fairly consistent, but developers set prices -- or try to. App Store buyers and fierce competition have driven pricing largely to free or 99 cents for the majority of popular applications. Regardless, App Store is a fundamentally different business model. For the market of software applications, there are tens of thousands of competing developers -- that despite dominance of a few giants like Microsoft.
Publishing distribution, including books and music, is largely dominated by a few big publishers or organizations. Microsoft sells software it owns, which people can buy or not from many places. But book and music publishers typically obtain rights to content they didn't create but can distribute through long-established and limited channels. When moving away from DRM, some music labels initially shut out Apple from DRM-free content. Publishers of the written word have similar clout.
The time for Apple to lock in the right price and right rights is now. What's right? It's probably what publishers won't want to give: $9.99 for e-book versions of new or popular hardcovers, ubiquitous personal usage rights for any device supporting iBookstore and non-restrictive lending to authorized accounts. Where Apple has DRM today, five authorized PCs/Macs remains the usage rights. Apple should strive for the same usage rights for e-books -- and more: Five authorized devices and/or unlimited lending among family members (which could be verified through MobileMe family account).
So I must ask: What price would you pay for e-books and with what usage rights? Please answer in comments.
Copyright Betanews, Inc. 2010
Test of China Internet connections reveals heavy filtering

Publié: mars 30, 2010, 5:42pm CEST par Scott M. Fulton, III

By Scott M. Fulton, III, Betanews

Using a Firefox 3.0 add-on created by developers in Hong Kong, Betanews was able to briefly establish a connection with the Internet via a proxy based in mainland China. With that proxy, we were able to confirm that searches performed using Google's Hong Kong-based page were effectively blocked.
Firefox 3.0 reported the blockage with this message: "The connection to the server was reset while the page was loading" -- a message from the browser, not from an ISP. We used version 3.0.16 of Firefox (an older edition) because it is the only version compatible with China Channel, a tool made for the express purpose of testing China's filtering ability. It has not been upgraded for version 3.6.
Further tests using the same proxy connection revealed that filtering may not be limited to Google. Searches for innocuous topics using Baidu, the country's leading search service known to employ its own filtering, were also blocked. We confirmed that the failed Baidu attempts were on account of blockage rather than just a dropped connection by browsing immediately to Xinhuanet, the country's state-run news service.
Our proxy connection lasted for approximately eight minutes before all requests began timing out. During that period, we saw some evidence that, rather than just blocking Google specifically, China ISPs may be using a much broader form of blocking of .com addresses in general, at least with the range of IP addresses under which our successful proxy connection falls.
For example, we could not connect to Baidu's home page using baidu.com. However, we were successful using baidu.cn, an address which, for clients outside China, is redirected to baidu.com anyway. Other .cn addresses were accessible, but betanews.com was not -- and I doubt we draw the attention of Chinese authorities enough to earn a spot on its blacklist.
The proxy IP address from which we were successfully able to establish the connection, should you wish to try this test for yourself, was: 218.14.227.197:3128, which traces to Beijing. Port 3128 is normally associated with proxy servers.
Copyright Betanews, Inc. 2010
It's not dead yet: Microsoft's out-of-band IE6 fix impacts IE8

Publié: mars 30, 2010, 12:48am CEST par Scott M. Fulton, III

By Scott M. Fulton, III, Betanews

Last month, Microsoft sent flowers to a mock funeral for Internet Explorer 6, in a show of support for the ideal that the old browser should be declared defunct worldwide. But for a few years yet, the company is still bound to support the product for those users (generally businesses) who refuse to upgrade it. That's why new exploits that continue to target old browsers, such as IE6 and IE7, continue to get attention even a full year after the proper security fix -- IE8 -- has been deployed.
One of the libraries that, among other functions, helps IE to print is the target of an exploit released to the wild earlier this month. The exploit creatively overloads the system with JavaScript variables, then places function calls to IEPEERS.DLL. Once the library is effectively crashed, its used memory isn't cleaned up, enabling binary code seeded into that memory to be executed -- a classic use-after-free scenario.
Although various IE8 and Vista-era architectures protect Windows users from this scenario, Microsoft's security team said today it will take the unusual step of issuing an out-of-band update tomorrow, two weeks ahead of the usual Patch Tuesday. The update will also serve as a "cumulative roll-up," adding nine other fixes that had been planned for April 13.
Microsoft has said that Data Execution Prevention in IE8 is one of the effective workarounds for this exploit, at least until tomorrow. But the US Homeland Security Dept.'s US-CERT agency warns that DEP is only a partial fix, saying, "DEP should not be treated as a complete workaround, but DEP can mitigate the execution of attacker-supplied code in some cases." US-CERT suggests that users instead disable Active Scripting, one of the perennially sensitive elements of the old ActiveX system.
Copyright Betanews, Inc. 2010