"TechFeed" via Ken in Google Reader

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

2012-04-27T20:40:02Z

Comments

Introducing .NET Gadgeteer

2011-11-08T01:45:29Z

Comments

Two amusing side channel attacks

2011-10-26T17:07:21Z

Comments

Breaking the Internet: Researchers Successfully Hack SSL

2011-09-20T18:30:00Z

Secure Socket Layers and Transport Layer Security (SSL/TLS) is the foundation of Web security. Banks, travel booking sites, social networks like Facebook and Twitter, email services and a plethora of other industries built their security based on the fact that it is very hard to crack SSL. Yet, a group of researchers has figured out how to do just that.

SSL encryption protects data in transit from the client to the server. This communication happens very rapidly and the encryption effectively makes a secure tunnel for information. The researchers that have cracked SSL used a vulnerability that until now was considered only a theory. Like wormholes.

Sponsor

Researchers Thai Duong and Julinao Rizzo essentially slipped a Trojan Horse into the SSL communication between the server and the client that decrypts the information, according to The Register. Instead of cracking or forging digital certificates, as has been seen with the recent DigiNotar controversy, the SSL hack goes straight to the heart of how it works.

Duong and Rizzo have created a proof of concept that they call BEAST. The demonstration they use is the decryption of an authentication cookie used to access a PayPal account. The hack penetrates the HTTPS communication and sniffs the data in transit.

The researchers created BEAST from a plaintext-recovery attack. That breaks down a supposed weakness in TLS by guessing the encryption used for blocks of data or packets that are encrypted along the data string. If the first block can be decrypted, then the hacker has the tools to attack the rest of them.

The Register points out that each byte of an encrypted cookie takes about two seconds to breakdown. That is an eternity and makes a long data string difficult to break down quickly. Hence, hackers would need either great patience or have very specific targets in mind. That shows that this SSL decryption is not for the faint-of-heart bad guy but those that are extraordinarily diligent in getting the information they desire.

The SSL vulnerability only works on SSL version 1.0. Versions 1.1 and 1.2 are not affected. That does not really mean anything since almost nobody on the Web has the capability to support versions 1.1 or 1.2. SSL/TLS is notoriously hard to implement and each successive iteration breaks all compatibility with the previous version. That makes updating SSL cumbersome, time consuming and expensive. Almost no entity on the Web uses anything past version 1.0.

Now that researchers have cracked one version, their methodology will be used by those who truly wish to steal information. The motivated always find a way. Web engineers will soon have no recourse but to band together to upgrade SSL across the Internet.

Discuss

Mail Your Hard Drive to Amazon

2011-07-08T16:00:00Z

We have written before about a little-known facet of AWS, the ability to ship your physical hard drive off to that Big Cloud in Seattle and have them make a copy of all your precious data and put it in their cloud.

Sponsor

Up until now, your data had to reside on an S3 raw storage account, which made it harder to incorporate into a machine image on AWS. That has changed as of today, and your contents can be imported to AWS' Elastic Block Storage, which is a lot easier to manipulate in the AWS solar system. Once your drive is uploaded, you can create a volume based on the EBS snapshot and attach it to a VM, or share it with others.

The cost is reasonable: you pay $80 per drive, plus the time it takes them to make the copy. This avoids slow (or even reasonably fast) Internet connections, and Amazon will send you back their drive once they are done. A TB disk would cost about $120 as an example, and there is a pricing calculator so you can see what to expect.

Discuss

Crawljax - Tool for crawling and testing AJAX web apps

2011-05-24T21:27:09Z

Comments

Is Microsoft trying to end the reign of mobile carriers? (MSFT+Skype+Nokia)

2011-05-23T19:45:13Z

Shared by Alex Scrivener
"If technology companies were in control of the full telecom stack, you’d be able to get caller ID data for incoming cellphone calls. You’d be able to see someone’s availability before you call them, and that availability could be controlled automatically by time of day, location, current calling status (“Kevin is currently on the phone.”) and a hundred other innovations to make calling a reasonable mode of communications again.

Sure, a few middleware services like Google Voice (and Grand Central before them) have offered some innovation, but they’ve been limited by spotty deep OS integration and even more limited access to carrier services. They don’t let you ping a phone for status before you call or a dozen other features that can be found in IM or email clients. Even the iPhone’s visual voicemail was only implemented because it was a dealbreaker feature Apple insisted upon in its negotiations with AT&T. Carriers have a disincentive to make calls more efficient because they charge by the minute."

Are Microsoft, Apple and Google quietly preparing for war with mobile carriers? I think so.

With all the advancements in mobile phones in the past 10 years, the part that’s been woefully slow to advance is the phone part. Making calls, placing calls, searching for signal and scrimping minutes hasn’t changed much since the phone came out, because carriers have little motivation for innovation. Cellular carriers make their money either way, and ‘innovation’ is charging $1,300/megabyte for text messages or adding 20 seconds of instructions on how to leave a voicemail before letting you leave a voicemail, so that they might get an extra minute’s revenue.

If technology companies were in control of the full telecom stack, you’d be able to get caller ID data for incoming cellphone calls. You’d be able to see someone’s availability before you call them, and that availability could be controlled automatically by time of day, location, current calling status (“Kevin is currently on the phone.”) and a hundred other innovations to make calling a reasonable mode of communications again.

Sure, a few middleware services like Google Voice (and Grand Central before them) have offered some innovation, but they’ve been limited by spotty deep OS integration and even more limited access to carrier services. They don’t let you ping a phone for status before you call or a dozen other features that can be found in IM or email clients. Even the iPhone’s visual voicemail was only implemented because it was a dealbreaker feature Apple insisted upon in its negotiations with AT&T. Carriers have a disincentive to make calls more efficient because they charge by the minute.

Then there’s the cellular network. Recent innovation in cell networks has been driven almost exclusively by mobile data needs. Most 4G-capable phones can’t even use 4G for voice calls, relying on the 3G chipset and network for calls. 4G is just for data on these phones. Got a wi-fi capable smartphone (as all modern smartphones are)? Tough, you can’t use that for calls either, unless you but a microcell for your home network so you can use 3G to access your own wi-fi network, and still pay your carrier for the minutes on calls you pipe through your own internet connection.

That’s the preamble for what’s broken, and I could go on, but I’ll get to the point: What if Microsoft’s plan is to fix it?

To control the full mobile pipeline you’d need to control the mobile phone hardware, the mobile OS, and the carrier. It’s incredibly hard to start a new carrier, placing cell towers all over the country, so most small carriers lease capacity from one of the major players, which gives them a disadvantage when it comes to pricing. Also, leasing bandwidth on another network doesn’t let you bring new technology to the table, which is why wi-fi is the way to go. Our phones already use wi-fi for data access, falling back seamlessly to the cellular network when Wi-fi isn’t available. Wi-fi is essentially free, so a ‘soft carrier’ could drastically lower their costs by routing calls over wi-fi when available.

If over half of a soft carrier’s airtime minutes were carried over wi-fi rather than a leased cellular network, that carrier could beat a national carrier on price even if the national carrier doubled their costs when they leased access to the soft carrier, and for every customer who only has 3G access there’s another who has almost exclusively wi-fi access, and over time the scales continue to tip toward the latter, steadily lowering soft-carrier costs.

Microsoft has a good mobile OS, they just bought a soft carrier in Skype, and whether the rumors of a potential acquisition of Nokia pan out or not, Microsoft’s recent deal with Nokia seems to go beyond a simple OS licensee. If Microsoft is trying to turn the cellular industry on its end, it’ll start out with Nokia hardware. No other hardware manufacturer will risk pissing off their major customers (AT&T, Verizon, etc.) with a move that so directly challenges their entire industry.

And of course Microsoft isn’t alone in this ambition. Apple and Google appear to have been moving to the same destination by different paths. Apple’s integration of FaceTime is a clear move toward carrier independence. In a limited sense, the iPod Touch is already a wi-fi phone. It would take very little for Apple to build its own Facetime-to-POTS gateway. In fact, I’d be amazed if they weren’t already there. Mix in Apple’s recent deals with voice recognition leader Nunace and we’re several steps closer to what Nuance calls ‘Dialtone 2.0’ where phone conversations start simply by lifting the receiver to your ear and talking to the computer.

Google Voice and Google’s interest in the spectrum auctions are clear indications of their ambition in this area, and their recent moves to tighten their control on the design and feature sets of Android handsets may be another indication that changes are afoot.

The next five years are going to see as much innovation in the way we make and take calls as the last five have seen in how we use our phone for data. It’s about damned time.

Comments

Coming This Summer: Fully Offline Gmail, Google Calendar, And Google Docs

2011-05-11T17:35:23Z

While it hasn’t always been clear just how big of a bet Google was going to make on Chrome OS, after Google I/O today, it seems very clear that they’re very serious. With the launch of Chromebooks, Google is aiming to strike right at the heart of Microsoft and the Windows stronghold. But they know that one big hold up remains before a browser-based OS can be everywhere: offline access.

With that in mind, on stage today, Google’s Sundar Pichai revealed that Google has internally been using offline versions of their three most popular apps for months now: Gmail, Google Calendar, and Google Docs. And this summer, all users will be able to use these apps offline too.

All of this is a long time coming for Google. They’ve had options for going offline in the past with things like Gears, but it wasn’t perfect. And actually, Gears is no longer being supported by Google as Chrome gains many of the same features via HTML5.

Pichai also noted that there are already hundreds of apps in the Chrome Web Store with offline access. And that includes almost every game in the store. This, on top of the built-in 3G connectivity is all vital to ensure the vitality of Chromebooks, Pichai noted.

CrunchBase Information

Google

Gmail

Information provided by CrunchBase

The Google Chromebook Breaks Cover At I/O 2011, Hits Retailers June 15th

2011-05-11T17:13:21Z

The Google Chromebook is here — for real, this time. Google first announced the nondescript Cr-48 Chrome OS Notebook back in December of 2010 but the production version, now called Chromebook, was just announced at Google I/O 2011.

The idea is the same as the original in that it’s basically a barebones computer that runs Google Chrome OS. In many ways the philosophy is a lot like Apple’s iPad in that the hardware takes a backseat to the user experience. Google is selling a Chrome interaction platform, not a traditional notebook.

The hardware seems like a dream machine: built-in security, “all day battery”, and multiple connectivity methods that keep the hardware always connected. The production version now sports an unnamed Intel dual core CPU which should give it much more polished feel than the CR-48 pilot program. External file storage now works, and unlike on the Cr-48, users can plug in a camera or SD card and the Chromebook will mount it automatically.

The connectivity of Chromebooks allows users to always have access to their personal cloud. The file manager works in the browser like another tab, but seems to feature most modern file manager features, like specifying default apps for certain file types.

Chromebooks don’t always have to be connected, though. There are offline versions of Google Gmail, Calendar, and Docs coming, and Google has reportedly been using these offline flavors internally for some time.

However, as great as the Chromebook seems, it’s launching as what sounds like a post-beta product. The company announced on the stage of I/O that Chromebook updates will roll out every few weeks. Sort of awesome but also sort of scary. But that’s just how Google works.

Google has partnered with Acer and Samsung for the hardware and in the US, Verizon for 3G data. “Leading carriers” all over the world will power Chromebooks internationally. Samsung’s first Chromebook features an 8-second boot, 8 hour battery, 12.1″ 1280×800 display, and is, of course, always connected. Acer’s is much of the same, but features a 6.5-hour battery and an 11.6″ screen. [Chromebook Product Page]

The Samsung will run $425 for the Wifi-only version or $499 for the 3G model, which includes 100MB data service. The Acer will cost “$349 and up.” Expect the duo on June 15th from Amazon and Best Buy in the US with leading retailers selling the two in the UK, France, Germany, Spain, Netherlands, and Italy.

Google is also targeting the Chromebooks for Education and Business. The education editions cost $20 per student while business pay $28, which also includes new hardware upgrades.

More posts on Google, Chrome OS, and Android:

Frequently Forgotten Fundamental Facts about Software Engineering

2011-04-29T18:35:39Z

Comments

Google Chrome Can Now Clean Up Flash’s Cookie Mess

2011-04-26T23:35:55Z

I still don’t particularly like the fact that Google decided to bundle Adobe Flash with their Chrome web browser about a year ago. Apple preference aside, the last thing I want is the buggy, often insecure, and performance killing plug-in shoved in my face. More importantly, I think it’s a maneuver that will only serve to slow the transition to HTML5. But Google has their reasons. And today, we see one of the good ones.

Google has maintained since they started bundling Flash that it was mainly to ensure they could make it more secure for their Chrome users. They do this by both sandboxing it and auto-updating it when the security patches regularly appear. But a new feature has just hit the Chrome dev builds which also now allows users to easily clear Flash cookies from within the browser.

Normally, when Flash is run as a standalone plug-in (as it is with all other browsers), users have to visit an Adobe website to clear Flash Local Shared Objects (LSOs). In other words, almost no one ever did that. Worse, the vast majority of users probably didn’t realize you even could do this — or that you perhaps should.

The newest builds of Chrome now bring this Flash cookie clearing right within the browser settings. In the “Clear Browsing Data” menu area (found at Wrench > Tools > Clear browsing data) you’ll now see the option to “Delete cookies and other site and plug-in data”. Selecting this will include Flash cookies.

Better, you can also set up Chrome to clear all plug-in cookie data every time you close Chrome. Other plug-ins will be able to work with this browser feature too if they use the NPAPI ClearSiteData API baked into Chrome (Adobe is now using it with Flash 10.3).

So, credit where credit is due — this is a solid move by Google (and Adobe) to further clean up the Flash experience. If they’re going to bolster the plug-in to the detriment of HTML5 (and ultimately, I think, the web itself), at least they’re improving it as well.

CrunchBase Information

Google Chrome

Adobe Systems

Information provided by CrunchBase

Google Earth Builder Allows Companies To Process And Store Geospatial Data In The Cloud

2011-04-20T17:34:33Z

Google Maps and Earth are both massively popular consumer products produced by Google. In fact, Google Earth has been downloaded over 700 million times and Maps has become one of the most popular cross-platform online mapping applications in the world. Today, Google is blending the capabilities of the backend of these mapping products into an enterprise oriented application—Google Earth Builder.

The product allows users to upload, process and store geospatial data in the Google Cloud. Many government agencies, environmental companies and more have massive amounts of geographic data and maps that need to be organized, stored and categorized for use. There are traditional on-premise products that help companies do this, but Google is hoping to enter this space with a cloud-based product that brings the ease of use of Maps and Earth to the enterprise.

With Google Earth Builder, users actually use Google Maps and Google Earth to share and publish mapping data. No technical expertise or GIS training is required, says the search giant. Besides being able to use Maps and Earth within the application, you can also add imagery, roads, points of interest from Google to complement your data. And because the application is cloud based, you can tap into a wealth of real-time features including the ability to scale, obtain detailed analytics, increase storage space, ensure data backup, and push features more quickly.

From the blog post, here are the various types of uses for companies: Whether you have terabytes of imagery or just a few basemap layers, now you can create multiple map layers from your data, such as shapefiles of demographic data, spreadsheets of worldwide customer locations and files of your recently acquired imagery for a new development. You can also integrate the map layers with our own imagery basemap, road data, Google Street View, Terrain View, or Directions in order to find your next best store location.

Australian energy giant Ergon Energy is currently using Google Earth Builder to manage and share geospatial data. And Google anticipates that many more companies and government agencies will find the product ideal for shifting this data to the cloud. Google Earth Builder will be made publicly available in Q3 2011.

CrunchBase Information

Google

Information provided by CrunchBase

Glimpse - "server-side Firebug" for ASP.NET

2011-04-19T14:06:37Z

Comments

Dojo Web Builder Brings the Dojo Build System to the Web

2011-04-06T03:35:00Z

The JavaScript framework Dojo has made its build system available as a Web service called Dojo Web Builder. According to a blog post announcing the new site, the goal of the project is to "dramatically lower the barrier to entry for the build system, easing new users into the process of using a build tool and improving the performance of unoptimised Dojo applications everywhere."

Sponsor

According to the site, you can use the Web Builder to:

Browse catalogue of every module in Dojo, Dijit and DojoX, using text searching to quickly filter the entire results. Simply select desired modules to include those in a custom build. Currently serving over eight hundred modules for the 1.6 release.

Automatically generate custom Dojo builds using our remote service, no need to open terminals and run the intensive build system locally. When the build is complete, it will automatically start the download of the result. Progress indicator keeps you informed of status during a custom build.

Auto-analyse existing Dojo applications to discover module dependencies. Provide the Web Builder with a remote URL, upload a HTML page, zip archive or an existing build profile to have the tool show you any Dojo Toolkit or custom module dependencies uncovered. Custom builds using the results will automatically include your custom modules.

Customise builds even further in "Advanced Mode". Want to include a Dijit theme with compressed CSS? Want to use Google's Closure compiler for aggressive compression? Want to build multiple application layers? Want to generate builds for the WebKit platform? Need to generate a cross-domain build? Switch to using the Web Builder in "Advanced Mode" to unleash the ability to heavily customise build parameters.

Here's a video explaining it a bit more:

Dojo Web Builder - Custom Builds from Dojo Toolkit on Vimeo.

Discuss

Interesting but lesser known data structures

2011-03-25T04:24:50Z

Comments

Stack Overflow: Printing 1 to 1000 in C

2011-03-14T22:56:55Z

Comments

Junkyard Jumbotron: join all your screens into one big one, no software install needed

2011-03-13T16:14:56Z

Here's a demo of the Junkyard Jumbotron, created by Rick Borovoy at MIT's Center for Future Civic Media. It's a cool app to allow you to gang up multiple screens (phones, tablets, flat panels), running any OS, and turn them into a single, joined display. It's very clever: you arrange the screens as desired and then display a web-page with a QR code on each of them; snap a picture and send it back to the server and the server takes any image you feed it and splits it across the screens. No client-side software needed, apart from a browser.

Junkyard Jumbotron (Thanks, Akwhitacre, via Submitterator!)

Enterproid Separates Professional And Personal Lives On Android Phones

2011-02-28T16:01:10Z

As more businesses turn to Android and iPhones for employee use, there is a need for enterprise-focused mobile security on these devices. Enterproid, which is launching today, hopes to fill this gap by allowing professionals to maintain completely separate professional and personal profiles on a single Android device.

Called Divide, the platform allows users to create a completely separate profile on Android devices that includes enhanced security, access control, remote wipe capability and a set of enterprise-grade versions of applications like email, a web browser, instant messaging, and SMS. Users can switch back and forth between their professional and personal profiles but no data can cross the division, so that no business content is compromised in the personal profile.

Enterproid’s Divide also allows users to manage devices from the cloud. Divide is available exclusively for Android phones and tablets but the startup plans to extend the service to iOS and Windows Phone 7 platforms in the future. For now, Divide is free but will soon adopt a subscription model after exiting private beta.

Founded by former Morgan Stanley, MTV and Smule execs, Enterproid is also a finalist in the 2011 Qualcomm Ventures QPrize competition and was selected as the North American regional winner last month. UPDATE: At the DEMO conference today, Enterproid took the top spot in the competition, winning $150,000 in prize money.

While some Android phones already allow you to create separate profiles, Enterproid’s technology gives IT departments the ability to adopt Android phones without making a security compromise. And Enterproid comes with a bunch of useful tools, including the ability to segregate voice and data usage for work, or hand a child a phone without the risk of the child accidentally emailing or calling a contact.

Remote Support Tool TeamViewer Gets an Android App

2011-02-25T15:00:27Z

Cross-platform screen sharing solution TeamViewer has been around for a while (we wrote about it a couple of years ago). But it’s been recently updated to version 6, and also has a new Android app. While there are many screen sharing and web conferencing apps available, TeamViewer stands out by offering an all-in-one solution for making presentations, connecting to and troubleshooting remote computers. I’ve been trying the Android app, and I found it easy to set up and use. It’s responsive, too, as the developer says that it can adapt to different connection speeds.

TeamViewer can be set up in different ways. If you want to share your screen for presentations or training, you can install the software on your machine, and then share your ID with your audience, who can view your desktop in a web browser. The software is not intended to support large numbers of viewers, so it would not be suitable for webinars.

TeamViewer can also be used for troubleshooting remote computers, similar to CrossLoop, LogMeIn Rescue, or the “remote assistance” functions built into Windows and Mac OS X. In this configuration, you ask the client to download and run the TeamViewer QuickSupport module (it doesn’t need to be installed). The client gives you the ID and password that the QuickSupport module creates, which you can enter into your copy of the software or use the web version.

The TeamViewer software, which is available for Windows, Mac, and Linux, can also be used to connect remotely to unattended computers. It’s also possible to connect on the go via iOS and Android apps.

One nice feature of TeamViewer is that (as with LogMeIn and similar products) it can create connections behind firewalls, meaning that it doesn’t take the sort of setup that VNC does. A chat and file transfer system is included.

All in all, TeamViewer is a well-developed product that can be used for many needs faced by those of us with remote workforces. I confess, though, that I got a bit of sticker shock from TeamViewer’s pricing structure, which starts at $729 for one workstation. But since TeamViewer is priced as a one-time payment with no monthly subscription fees, it may be a good buy for some organizations. Note that TeamViewer is free for non-commercial use, and also offers free trials.

Related content from GigaOM Pro (sub. req.):

Review: Motorola Xoom – The Android Tablet Redefined

2011-02-24T02:06:45Z

Few tablets have met with such widespread anticipation as the recently-announced Xoom. It is the closest anyone has come to an iPad equivalent for the Android set. I was impressed with the speed, design, and quality of the device, and although there are a few caveats, I came away optimistic for the new crop of Honeycomb devices that will follow this one.

It’s an impressive and attractive piece of kit, with a lot going on under the hood. But dangerous pricing and the threat of better and/or cheaper devices around the corner somewhat reduce its charm. If you can’t wait, though, the Xoom will probably satisfy your Honeycomb craving.

Continue reading at CrunchGear…