First Preview of Windows 8 Seamlessly Integrates Touch, Desktop, Web [Video]

First Preview of Windows 8 Seamlessly Integrates Touch, Desktop, Web [Video]

  1:23:00 AM    Science Lover

---

Windows pulls back the veil on its next OS, and it's a doozy.

"This is the new version of Windows. It's going to run on laptops, it's going to run on desktops, it's going to run on PCs with a mouse and keyboard, it's going to run on touch slates, it's going to run on everything. Hundreds of millions of Windows PCs powered by this new interface  and new platform."




Notable:

* Windows 8 apps are a new class that will be built with HTML 5.

* But existing Windows apps will continue to work in Windows 8.

What does this tell us? That Microsoft recognizes the power of tapping Web developers directly. Through intermediaries like Appcelerator, Apple's iOS ecosystem has already benefitted from this trend. In the future, developers move seamlessly from the Web to the desktop, just like their apps.

Read more: Previewing 'Windows 8'

Read More

IE or Firefox: Who's to blame for newest browser zero-day?

IE or Firefox: Who's to blame for newest browser zero-day?

  10:05:00 PM    Science Lover

---

Both browsers must be present for the vulnerability to be exploited


Confusion reigns around a zero-day browser vulnerability made public yesterday, with four researchers or organizations squaring off over whether Microsoft Corp.'s Internet Explorer or Mozilla Corp.'s Firefox is at fault.

Image via Wikipedia

According to researcher Thor Larholm, the zero-day bug is in IE. "There is an input validation flaw in Internet Explorer that allows you to specify arbitrary arguments to the process responsible for handling URL protocols," Larholm said on his blog. That becomes a problem on PCs that also have Firefox 2.0.0.2 or later. Firefox, said Larholm, registers a URL protocol handler called FirefoxURL, designed to let Web pages force a Firefox launch if the "firefoxurl://" uniform resource identifier (URI) is used.

IE doesn't perform any input validation on the protocol, which means an attacker can use IE to pass malicious a script -- JavaScript code, say -- to the browser. The result: a PC hijack. Symantec Corp.'s analysts backed up Larholm's conclusion.

Larholm also said that the IE bug is similar to the input validation vulnerability in Safari 3.0 that he spotted the same day Apple Inc. released the Windows browser in beta.

Others, however, blamed Firefox for the vulnerability. In an e-mail, Thomas Kristensen, chief technology officer at Danish bug tracker Secunia, did not dispute Larholm's findings but did have a problem with his conclusion. "This is in fact not an IE issue, it is a Firefox issue," said Kristensen. "The way in which the URL handler was registered by Firefox causes any parameter to be passed from IE (or another application) to Firefox when firefoxurl:// is activated." FrSIRT, a French company that also monitors vulnerabilities, agreed with Secunia.

"Registering a URI handler must be done with care," said Kristensen, "since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application. Improper usage of URI handlers and parameters supplied via URIs has historically caused problems."

No matter which browser is to blame, it takes two to tango or, in this case, both must be present to let an attacker inject malicious code. Only PCs with Firefox 2.0.0.2 or later (Firefox's most recent update was to 2.0.04) are vulnerable, and then only if the victim uses IE to surf to a malicious site sporting the firefoxurl:// protocol.

Secunia rated the threat as "highly critical," its second-highest ranking; FrSIRT, meanwhile, pegged it as "critical," its top-most warning. Several proof-of-concept exploits have been posted to security mailing lists or Web sites, including one by Larholm and another by a researcher named Billy Rios, who goes by the initials BK.

Image via Wikipedia

No fixes -- for either Firefox or IE -- are available, although in a comment posted last month to a security message forum, Dan Veditz, a Mozilla developer, said the team is preparing a patch. "[We are] working on protecting users from this on our end for a future security update," said Veditz. Nonetheless, Veditz, like Larholm and Symantec, said IE should shoulder responsibility for the zero-day vulnerability.

"I do think IE should escape quotes in URLs (RFC 1738 considers them an 'unsafe' character in URLs), but the Firefox team has been looking into back-stop protection in our app since we saw Thor Larholm's Safari 0-day post," Veditz wrote.

Source : Computer World

Read More

BBC web downloads set to launch

BBC web downloads set to launch

  1:07:00 PM    Science Lover

---

The BBC's on demand TV service, the BBC iPlayer, will launch to the public on 27 July, the corporation has revealed.

UK users will be able to download popular shows over the net seven days after broadcast to watch on their PC.

Later this year, the service will also be available via links from YouTube and could also appear on other websites such as MSN, Bebo, and Facebook.

At launch the application will only work on Windows PCs but a version for the Mac could be available by autumn.

iPlayer
Shows can be watched seven days after transmission
Over time other features will be added to the iPlayer including live streaming of programmes, the BBC Radio Player and "series stacking", which will allow users to download episodes from series retrospectively.

Director General Mark Thompson said: "Forty years ago, in July 1967, BBC Television launched colour TV.

"This July we are going to launch the iPlayer and in our view, the iPlayer is at least as big a redefinition of what TV can be, what radio can be, what broadcasting can be, as what colour television was 40 years ago."

Timely launch

The iPlayer has been in development since 2003 and received final approval from the corporation's governing body, the BBC Trust, in April 2007.

In that time it has been through numerous revisions, many demanded by the Trust and the broadcast and telecoms regulator Ofcom, whilst other broadcasters, such as ITV and Channel 4, have launched their own on-demand services.

"The market badly wanted to make the BBC go through a proper due process," said Ashley Highfield, director of Future Media and technology at the BBC.


BBC iPLAYER
iPlayer will allow viewers to catch up on TV programmes for seven days
Some TV series can be downloaded and stored for 30 days
Viewers will be able to watch shows streamed live over the internet
Users will not be able to download programmes from other broadcasters
Classical recordings and book-readings are excluded from iPlayer

Who else offers TV on-demand?

He added that the long process had been "frustrating" but had ultimately made the iPlayer a "better" proposition.

"Nobody wants to be the first to innovate and the last to implement but I don't think that matters," he said.

"We are right at the beginning of the video over the internet revolution, these are really early days."

At launch users will be able to download programmes seven days after their first transmission and will then have up to 30 days to watch them.

Programmes will include popular series such as Life on Mars; soap operas such as EastEnders and documentaries such as Planet Earth. Initially, 400 hours of programming will be available.

Some sporting events, such as Euro 2008, will be offered through the iPlayer as the service expands.

Mr Highfield said that over a 2MB broadband connection half an hour of programming would take approximately half an hour to download.

Once viewed in entirety, programmes will be automatically deleted.

Critical view

The lifetime of downloads is controlled by a digital rights managements system (DRM) supplied by Microsoft.

Some critics of the iPlayer, notably advocacy group the Open Source Consortium (OSC), has said that programmes should be made available without these digital locks.


SYSTEM REQUIREMENTS
iPlayer screengrab
Operating system: Windows XP SP2
Browser: Internet explorer 6.0 or above
Media Player: Windows Media Player 10 or above
Net connection: Broadband

However, Mr Highfield said this was not possible.

"We wouldn't be able to launch the iPlayer at all without digital rights management," he said.

"The rights holders - the people that make the programmes, from Ricky Gervais to the independent producers that account for up to a third of our programming - simply wouldn't have given us the rights to their programmes unless we could demonstrate very robust digital rights management."

The OSC has also criticised the BBC for initially releasing the iPlayer as a Windows-only system and has threatened to make a complaint to the European Commission.

The OSC argues that the system should work on all computer operating systems.

"I am fundamentally committed to universality, to getting the BBC iPlayer to everyone in the UK who pays their licence fee," said Mr Highfield.

"This is the approach we have always taken but we have always started with the platform that reaches the most number of people and then rolled it out from there."

Mr Highfield said that a version for Apple Macs could be available in autumn, with versions for Window's Vista and mobile devices to follow.

Versions for Freeview and cable viewers are also planned with Virgin Media expected to roll out the service later this year.

Deals with other distributors such as MSN, AOL, telegraph.co.uk, Tiscali, Yahoo, MySpace, Blinkx and Bebo were also in the pipeline, whilst a commercial iPlayer for global audiences could launch in 2008 he said.

"Wherever you are on the internet you will come across BBC programmes," said Mr Highfield.

SOURCE : BBC NEWS TECHNOLOGY

Read More