NEWS FOR SEP. 02, 2002 search options | site map BetaNews CBS MarketWatch CNET News.com Google News Search The Guardian MSFT InfoWorld IT-Director.com Linux Today NewsForge OSOpinion Paul Thurrott's PC Magazine RedHerring The Register Salon.com Technology Slashdot.org Washington Post Watching Microsoft Wired News Like this content? Add it to your site!

Security Hole Affects Explorer, KDE Browser: In mid-August security researchers revealed major security holes in Internet Explorer for Windows and Linux's KDE Konqueror browser. The holes, which work identically but are not related in origin, are the result of simple programming oversight. Specifically, the holes affect secure socket layer (SSL) security, which is used for any secure Web transactions involving passwords, credit cards, or other personal information. SSL essentially works by sending a digital certificate from server to browser in order to confirm the security of a site. The certificates are "signed" by an authorized company to confirm their validity. But in the case of IE and Konqueror any signed certificate is accepted by the browser, no matter what domain they were signed for. For example, ripoffsales.com could attach a signature for buy.com to its SSL certificate and (after redirecting from one site to the other) Explorer or Konqueror would accept that site as secure. Making things worse, the SSL hole was not actually an Internet Explorer problem but a Windows problem, because the SSL framework is built into the operating system instead of the browser. That leaves users of IE on every version of Windows since 95 potentially vulnerable to this serious security breach. Faced with the monumental task of quickly patching several dozen different browser/OS combinations, Microsoft took its usual exit and dismissed the SSL problem as a non-issue, then promised to produce a patch for it. Weeks later no such patch has been released, but it took less than two hours for someone to put out a fix for KDE Konqueror - before Microsoft had even issued an official response. What's a Windows user to do while waiting on Microsoft to take action? Download Mozilla, Opera, or Netscape, browsers that supply their own SSL frameworks and are thus not affected by Microsoft's oversight. IE flaw can expose credit cards SSL defeated in IE and Konqueror Multiple Vendor Invalid SSL Certificate Vulnerability SSL flaw is in operating system, not Web browser MS soft-pedals SSL hole Expert: Banks yield to Microsoft flaw Alternatives to Internet Explorer UPDATE: Dell Rebellion Not Complete, But A Good Start: Our report last edition about Dell's decision to avoid a Microsoft contract clause has been backed up by additional reports from several other sources. As reported here, Dell has chosen to skirt around a stipulation in Microsoft's new OEM contract that forbids the sale of any computer system without an operating system by tossing free copies of an MS-DOS clone in the packaging of its clean computers [see Aug 12, 2002]. Unfortunately, Dell is only making the hardware available to corporate customers, and the systems cost the same as PCs with Windows XP and Office preloaded. (An issue dictated by Microsoft's paranoia about anyone knowing what preloads actually cost.) But the good news is Dell probably keeps that money instead of sending it on to Microsoft (OK, the news isn't so good after all), and - most importantly - this action may inspire other box assemblers to follow suit and offer their non-corporate customers the same deal using similar tactics. Not a total victory, but still a small step in the right direction. Dell mocks MS' mandatory-OS regime Dell: No-OS PCs Aren't Designed for Linux MS plays volume licensing upgrade card against Naked PCs HP Swaps Preloaded Ms Works for WordPerfect: HP, struggling with declining profits because of a slowing economy and costs related to its merger with Compaq, has decided to trade Microsoft Works for Corel's WordPerfect Office Productivity Pack on discount Pavilion desktop PCs. Corel's package includes the WordPerfect word processor and Quattro Pro spreadsheet software, both of which offer more features than the equivalent portions of Works and cost $20 less. WordPerfect is not completely compatible with Office but neither is dumbed-down Ms Works, so swapping one for the other will not reduce Office compatibility for consumers. HP is reportedly in talks with Corel to expand the deal, while Dell and Sony have both offered Corel software on budget laptops for at least a few months. Microsoft gives up some ground HP Goes Corel: Rare Win or Changing Times? HP, Dell ditch MS Works for WordPerfect Microsoft losing out to Corel Released APIs and Middleware Control Found Useless: Now that Win2000 SP3 has been out for a few weeks, closer examination shows that the touted "middleware control" software [see Aug 12, 2002] added for the antitrust trial settlement agreement isn't so great. Apparently it only works when applications provided by other companies have been written to recognize the new framework, and, since Microsoft only made details of the control available to developers a few weeks before the release, nothing out at the moment has been coded to use it. Hopefully future releases of competing software will take advantage of the concession, but until they do it's absolutely meaningless. The 272 DOJ-agreement-required application APIs released at the same time have also proven to be useless, as Microsoft apparently released a big pile of mixed old and new interfaces, most of which came with little or no accurate documentation. Developers who looked them over report that they are useful only as a public relations boost for Microsoft. That, of course, is what Ms was counting on. A few days later Microsoft's lawyers sent the judge overseeing the federal antitrust lawsuit an unrequired "progress report" highlighting all the steps they've taken to comply with the settlement agreement. MS API disclosures - errors, incomplete, useless? Microsoft discloses 289 Windows APIs Microsoft highlights antitrust progress Date Set to Consolidate Ms Antitrust Lawsuits: Last week a federal judge set October 1st as the date for a hearing to see if the 100+ individual antitrust lawsuits filed against Microsoft should be consolidated into one massive class action case. The infamous lawsuit filed by the US government and 18 state attorneys general is not involved, but the list of plaintiffs does include AOL/Netscape, Sun, Be, and several hundred others. Judge Frederick Motz of the District of Maryland court also set October 24 as the day to decide if rulings made in the federal antitrust case apply to those other suits. A separate hearing to address some of Sun's charges, also overseen by Motz, will begin in early December. Dates set in antitrust suits against Microsoft Microsoft Facing New Legal Challenges Win2000 Server Replacement Still Years Away: Microsoft has admitted defeat in the race to complete a successor to Windows 2000 server this year, adding on August 30th the version indicator 2003 to the product's name. The server (whatever they decide to call it) was originally promised for April 2001, then in April 2001 was promised for early 2002, leading to a March 2002 promise that it would be finished in "the second half" which has now arrived without any finished software. The addition of a year indicator is the 3rd name change for that product, which was first called Windows 2002 Server, then Windows.net Server when Microsoft was .net-crazy, was briefly rumored as being an XP branded product, and will now be called Windows.net Server 2003 - leading us to wonder how long before Microsoft decides to stick the letters NT or XP in there somewhere. Maybe they would be able to get done faster if someone could decide what the product is actually supposed to be... .Net Server's new name suggests delay Windows .Net Server gets 2003 label Microsoft Purchases Canadian College: The president of Microsoft's Canadian subsidiary announced on August 14th that his company had formed the Education Innovation Alliance Fund, a supposed charity with $10 million in grants earmarked for Canadian schools. The Alliance's first "donation" is being made to the University of Waterloo in Ontario, which will receive $2.3 million over a five year period. That grant is allegedly for independent research but it will be spent almost entirely on projects that benefit Microsoft, such as researching technology for the Microsoft Slablet PC and setting up computer labs to explore .net software. Most disturbing, the bribe will also pay for the university to replace its existing C++ programming courses with a Microsoft's C# class which will be mandatory for all students in the electrical and computer engineering department. Microsoft had apparently been lobbying the school to make that change for some time with little success until their sizable pocketbook fell open. Upon hearing of the agreement, University of Waterloo students were livid and immediately accused the school of selling out. The school's federation of students issued a statement saying that the deal "sets a dangerous precedent" and "compromised" the university's academic standards (assuming it had any to begin with). Waterloo President David Johnston issued a press release denying charges of undue influence and claiming that the school's independence "is not for sale," even though he had pretty much just signed away his authority for a 2.3 million dollar bribe. One administrator then later joked how "$2.3 million isn't enough to sacrifice curriculum" - perhaps showing an desire for larger "donations" from other companies interested in wrapping young minds around their products. UW receives first $2.3M from Microsoft Microsoft's grant has strings attached? Students Say MS Buys Curriculum UW Microsoft Alliance Fact Sheet X-Box Gaming Network Launches in November: On November 15, a year to the day since X-Box first shipped in the U.S., Microsoft plans to launch a proprietary network supporting multiplayer gaming on the console. The X-Box Live network, available for $50 a year with a customized microphone headset, will launch nearly three months after Sony starts selling network adapters for its popular PlayStation 2 console. Sony is only providing hardware and will leave game publishers to develop their own networks, while Microsoft's system will be closed and proprietary. Sony will be paid once for its system while Microsoft can tie the X-Box Live service into .net and extract monthly fees from users for years, but the open nature of Sony's console makes it more attractive to publishers - probably explaining why there are so far only six titles in development for Microsoft's network and dozens for the Sony system. Xbox Live set for November 15 launch Microsoft names the day for Xbox online Xbox Live Launch Set for November 15 Microsoft talks up Xbox online service Xbox Live applicants: No game for you Microsoft Scams Citizens of New Orleans: Living up to its reputation as a politically corrupt backwater, the city of New Orleans, Louisiana, has entered into an agreement with Microsoft that saves millions of dollars up front but will eventually lead to a significant taxpayer shakedown. On August 15, New Orleans mayor Ray Nagin announced that he signed an agreement for Microsoft to upgrade the city's government and police department computers for "free." The project, worth an estimated $100 million, will replace crucial quarter-century-old computer systems at the verge of overload. New Orleans had awarded another company a $150 million contract last year to do the same job but suddenly canceled it after Mayor Nagin and Bill Gates met personally in July. Microsoft's contract was awarded without any bids being placed because it appears to be a free gift - but according to New Orleans CTO Greg Meffert, the city will have to purchase the software "eventually" at minimal expense. In other words, Microsoft got the contract without placing a bid because it will be "free" for the time being, and in several years when the mayor has moved on to bigger and better things Microsoft will present the city with a substantial bill for outdated software. Way to get reelected, Mayor Nagin. City may get free Microsoft makeover MS gives New Orleans 'free' systems for City Hall, PD Microsoft Sinks Teeth Into New Orleans Seven Years Later, MSN Comes to the Mac: Even as Microsoft's executives were attacking Apple for the supposed slow adoption of Mac OS X, its Mac Business Unit (which occasionally shows a surprising amount of independence) was working on delivering MSN services to that platform. On August 22, Microsoft officially announced that it will make MSN Explorer and the services that accompany it available for Mac OS X sometime early next year. Microsoft's ISP agreement with Qwest [see May 07, 2001] already requires dialup MSN service for Mac users, but MSN's exclusive questionable-quality content has been otherwise off limits to Mac users since MSN's creation in 1995. No word if any Macintosh owners actually WANT Microsoft Internet service, but it will soon be available either way. Apple users to get a taste of MSN MSN cuddles up to OS X Windows Media Player Upgrade Expected Soon: How you see it, how you don't Microsoft puts privacy policy on display Microsoft Ends Free Font Downloads: For almost as long as Microsoft has had a corporate Web site, it has provided free TrueType fonts there for download. The fonts, duplicates of a half-dozen default typefaces that come with Windows and Mac OS, were made available for anyone who cared to go get them - including users of non-approved systems like Linux. That's probably why Microsoft discontinued its "TrueType core fonts for the Web" downloads on August 12, redirecting interested users to sites with shareware typefaces. Microsoft refused to comment about the decision, only saying that its font packages had been "abused, repackaged, modified and shipped with commercial products" - likely referring to a handful of companies that were including Microsoft fonts in their Linux distributions. Microsoft's decision will affect all users of alternative OSes since the fonts in question are used by most Web sites and are necessary for Web designers who want their work to have a uniform appearance on every platform. Microsoft Withdraws Free Web Fonts MS yanks free Web TTFs MICROSOFT QUICKIES: Microsoft released Office XP Service Pack 2 on August 21, finally repairing a large list of bugs and security holes. The 15MB update, which is fairly minor in comparison to previous Office service packs, combines previously released patches for Outlook, Word, and Excel into a single package. The update also corrects annoying flaws in foreign language versions of Office and other small problems like reversed images and scrollbars missing from some applications. Office XP was launched with little fanfare in May 2001. Fresh from merging with Compaq and desperate to grow the services side of its business, HP recently became the sole provider of helpdesk support to all of Microsoft's employees. The new contract gives HP access to Microsoft's 61,000 U.S. workers in addition to the 11,000 global employees it was already under contract to serve. Taiwan's Fair Trade Commission has launched an investigation into Microsoft's business practices in that country. According to reports, Taiwanese companies are complaining that Microsoft's subsidiary there forces them to sign long-term contracts that restrict their abilities to use competing products. Officials from Microsoft have so far refused to comment about the charges. OTHER UNRELATED STORIES: Experiences at a Firm Hostile to Free Software China: The Republic of Linux How to defang Win2k SP3's auto updating New super patch for IE fixes six new flaws MS recruits for Palladium Microsoft revamps Asian management Microsoft patches Windows 2000 flaw, SQL holes more threads...