Month: September 2010

Update. The bug has been patched and rolled out. In addition, Twitter has added two new features to the updated interface: Reply to All and auto-complete for Twitter names.

We’ve identified and are patching a XSS attack; as always, please message @safety if you have info regarding such an exploit.

We expect the patch to be fully rolled out shortly and will update again when it is.

Update (6:50 PDT, 13:50 UTC): The exploit is fully patched.

A pretty dangerous bug has just been discovered on Twitter that lets users embed Javascript in tweets which will execute once your mouse moves over the tweet. This is dangerous because it could be used to redirect your browser to a malicious website and potentially harm your computer.

Most users are just using the exploit for fun, using Javascript’s “alert” function to popup messages like “I Love You” and “Hola.” In the case of Sarah Brown, wife of the former British Prime minister, tweets appearing in her stream were redirecting visitors to a hardcore Japanese porn site. Definitely not a good look for her over 1 million followers.

She first posted a warning on her page to try to protect visitors, saying “don’t touch the earlier tweet – this twitter feed has something very odd going on ! Sarah.” Her profile now shows up as protected. Not sure if it was always so or if this is a more drastic attempt to protect her followers.

At the time of this writing, there has been no statement issued from Twitter and, in my testing, the exploit is still active. There are a few ways to protect yourself, but first and foremost is to completely stay off of Twitter.com. It appears that the exploit only works if you haven’t been upgraded to the new Twitter interface, but better safe than sorry. Also, if you are using a third-party client like Tweetdeck, you should be in the clear.

Many affected tweets appear as a black box or in rainbow colors. This is a red flag as the colors hide the content of the tweet, but all affected tweets are not hidden this way. If you absolutely must use Twitter using the old interface at Twitter.com, avoid moving your mouse cursor into the tweet area. It’s very easy to activate these things and, if Twitter doesn’t do something about it quick, it’s only a matter of time before someone gets creative.

With most users still using Twitter via the web interface, this is a serious issue that needs to be resolved immediately. It’s very surprising that a bug this simple wasn’t caught in testing and is only being discovered now. (Update: This flaw was corrected a month ago, but was re-introduced in a recent update completely unrelated to the new Twitter)

Have you seen or been affected by this bug?

via Sophos, Twitter Blog

When Facebook Places launched, many wondered what the fate of Foursquare and other location-based services would be. Foursquare CEO Dennis Crowley even remarked that Facebook Places was “generic.” In their latest update, Foursquare not only adds new features, but shuffles around the old ones to offer a fresh new experience.

Tips and To-Dos are those features of Foursquare you probably never bother with. In this latest update, they are given much more attention. They’ve been placed in separate sections. Simply highlighting these features by moving them to the forefront changes things a bit. The goal is for you to use Foursquare to track where you’ve been, tell people where you are, and to remind yourself where you want to go via Tips and to-Dos.

In addition to getting their own sections, Tips and To-Dos are easily accessed from other parts of the Foursquare app (iPhone update is live, but Android and Blackberry users have to wait). As you move around, you can easily add a To-Do for a nearby venue. If you have already added a nearby location to your To-Do list, it appears with a blue “dog ear.” Tips are suggestions from other users for things you should do at a venue. They also receive an important counter that lets you know which tips are popular.

One of the more interesting updates is the new “Add to my Foursquare” button. This is a button that is embedded on any website and allows a visitor to add a To-Do or Tip with a single click. A simple use case for this button is for a business to embed on their website (and anywhere else they can stick it). A site visitor is interested in going to that place at some point, so they click the button. The next time that person is physically near your business, Foursquare automatically reminds them to pay you a visit.

The new Foursquare button lets you bookmark a physical location that you’d like to visit rather than simply a web destination. It’s almost like the Facebook Like button, but also implies your intention to actually do something about it. While this update changes the game a bit, Tips and To-Dos are still slightly confusing and I expect updates in the near future to clean things up.

The major point is that we’re moving past simple check-ins into something more useful. The location space is maturing. At some point, maybe the average person will see the value in participating.

via Foursquare

IBM has acquired data analytics company Netezza for $1.7 billion, paying out $27 per share. Netezza provides high-performance analytics in data warehousing appliances, which streamline many aspects of business by providing fast and efficient access to necessary information. The move marks IBM’s 23rd acquisition in the last four years.

It seems that IBM is betting on analytics technology in order to grow. Analytics in this instance allows a business to improve by making it easy to compare data from past activities. This makes it easier to figure out what moves to make for success in the future. Netezza is also one of Oracle’s main competitors. Analytics is big business according to the numbers. IBM estimates the current analytics market at $100 billion and Netezza more than doubled their stock this year. The deal makes perfect sense for IBM.

“IBM is bringing analytics to the masses. We continue to evolve our capabilities for systems integration, bringing together optimized hardware and software, in response to increasing demand for technology that delivers true business value. Netezza is a perfect example of this approach,” said Steve Mills, senior vice president and group executive, IBM Software and Systems. “Netezza strongly complements our business analytics capabilities and client base. Together, we have the opportunity to quickly leverage the technology and accelerate the offering.”

The deal also makes sense for Netezza. While things are looking good, they still have the likes of Oracle to worry about. IBM could be a valuable partner in this regard. The data market is shrinking, with larger companies like IBM, Dell, and HP buying out the smaller ones. IBM and Netezza have already been “strategic partners for many years.” The deal is set to close in the fourth quarter, which does leave the door open for a competitor to step in with a higher offer. This may be unlikely given their existing relationship, though.

“Our customers choose our appliances for their fast time to value and how they simplify analytics against big data,” said Netezza President and CEO Jim Baum in a joint statement. “Together with IBM, we are looking forward to extending our capabilities to a much broader market.”

If the deal does close, Teradata will be left competing against IBM and Oracle, so it may also become an acquisition target. The buyer? HP, who still has no answer for IBM’s Exadata.

via ZDNet, CNN Money, SiliconAngle

Switching to Google Apps can be a very productive step for a business. They take care of a lot of the heavy-lifting usually necessary for creating, sharing, and storing documents as well as collaboration and being productive as a company. One area that has always been in question is security. Google Apps makes things easier, but “organizations looking to secure their information beyond a password have faced costs and complexities that prevented many of them from using stronger security technologies.” This changes today as Google announces Two-step verification.

“Today we are changing that with the introduction of a more secure sign-in capability for Google Apps accounts that significantly increases the security of the cloud: Two-step verification. For the first time, we’re making it possible for organizations large and small to use this technology in just a few clicks for free.”

The idea is simple. In order to get into your account, you need something you know in combination with something you have. You know your password and you have a phone. After you put in your password, you will be asked for a verification code. This code is sent to your mobile phone via SMS, voice, or generated on an application you can install on your Android, BlackBerry or iPhone device. This means that, even if someone finds out your password, they probably still won’t be able to get into your account. You can also set trusted systems that don’t need two-step verification.

Two-step verification is built on open standards so that it can be integrated with other solutions in the future. The mobile application is open-source so that it companies using the new technology can customize it. This is one more step in “stream of security innovation” started by Google in 2009 when they added the ability to view password strength and set minimum lengths. HTTPS encryption came later that year and Google Apps became the first cloud messaging and collaboration service to gain US government security certification in 2010.

Administrators for Google Apps Premier, Education, and Government Editions can activate the feature now. Standard edition users will have it rolled out in the coming weeks. Individual Google users will also see the same security features in the coming months.

via Google Enterprise Blog

Facebook has teamed up with Rotten Tomatoes to expand their Instant Personalization feature. This is the controversial feature that allows a select few access to your Facebook data without your explicit permission. You don’t have to Connect with these sites, login, or otherwise authorize them. With Rotten Tomatoes, you’ll relevant movie reviews immediately “without having to register, search for friends, or fill out a profile.”

The reason Instant Personalization is so polarizing is actually the same reason it’s so interesting. Imagine if every website you visited already knew a little about you and tailored itself accordingly. Even though the information exchanged with these select third party sites is stuff that you’ve already designated as public, the new feature just added fuel to the Facebook privacy fire. Initially, it launched with three partners: Yelp, Microsoft Docs, and Pandora.

It’s been a little while since all that went down, so Facebook is cautiously moving forward. In their blog post, they remind us how Instant Personalization works: “Like other instant personalization partner websites, you only bring the public parts of your profile to Rotten Tomatoes so they can create your social experience.” They also give a link to a video that explains the personalization in more detail.

If you’re logged into Facebook, you’ll see personalization information immediately. If not, you can hit the Facebook Login button. I must admit that seeing what movies my friends are into is pretty useful. Privacy issues aside, Rotten Tomatoes just got a lot more useful.

Here are some important points about the Instant Personalization program that Facebook sent to TechCrunch:

Users control Instant Personalization – when they arrive at a site they can disable the experience, or they can turn off the program for all websites in their Facebook settings.

If you have previously opted out of the Instant Personalization program, you’ll continue to be opted out for any new sites.

Partner sites follow clear product/security/privacy guidelines and may only use your public information and friend lists to offer a more personalized experience.

All experiences are based on explicit actions (i.e. info you’ve typed into your profile or clicked “Like”); passive behavior (what you’re reading) is never surfaced.

User data is never transferred to ad networks. Facebook also clarifies that “No revenue is ever exchanged as part of this program and user data cannot be transferred by partners to third-party ad networks.”

Expanding the program slowly over the next few months with a handful of partner sites where value to people is clear. Focused on verticals where you already find information through friends in the real world (examples like: reviews, food, travel, music, movies).

Earlier this week, it was reported that T-Mobile would begin charging an extra fee to businesses sending texts over its network. They plan to charge businesses a toll of one-quarter of a cent for each text delivered through its network. The change, expected to go live on Oct 1st, would mean that services like Twitter would have to pay T-Mobile to send your texts.

ChaCha CEO Scott Jones has already commented on T-Mobile’s move using some pretty strong language: “We’re dropping T-Mobile if they do this. T-Mobile is ‘triple dipping’ here. They already make money when they charge their customers, aggregators, and publishers.”

Jones says that ChaCha’s aggregator, OpenMarket, informed the company of T-Mobile’s new fee hike, and said that because of its razor thin margins it had no choice but to pass on that fee to ChaCha, which is based in Indianapolis. (Aggregators are middlemen that stand between publishers like ChaCha, Twitter, Facebook and ESPN and the mobile subscribers they send content to.) — DailyFinance

Why You Should Care

If ChaCha is doing two million texts every day, what about Facebook? Twitter? Will they simply eat the costs associated with dealing with a single cell carrier? My guess is they will either drop T-Mobile as ChaCha has vowed to do, or pass the costs on to users somehow.

With African-Americans texting more than anyone else, this move could directly affect the community. Currently, you can still take part in the social web without an Internet connection at home or even a data plan on your phone. SMS makes it possible to engage others on the Internet with minimal tech knowledge or monetary investment. This is probably one of the reasons why 25% of Twitter users are African-American.

For T-Mobile customers, that middle-ground may be disappear as publishers figure out how to deal with the new charges. The small window that allows those without full Internet access to interact on the social web will be closed. T-Mobile has issued the following statement on the matter, which I’m surprised doesn’t end with a #kanyeshrug:

While we don’t disclose the details of our business relationships, we do want to clarify recent mischaracterizations. Business agreements with content aggregators, including messaging fees, have been common practice in the wireless industry for years. It is not accurate to characterize these business agreements as new or simply as a price increase. We believe our agreement in its entirety is a net positive for our partners.

At the end of the day, our goal is to ensure that the market for mobile data and access to mobile content thrives and that innovation can easily find its way to T-Mobile customers. We see nothing in our current business model that is counter to this goal.

Please note, there is no change to our consumer messaging or data plans.

via DailyFinance, GigaOm

At an event today, Yahoo gave us a preview of what the future holds for their products. They plan to make major enhancements to both their mail and search products as well as to the overall Yahoo! experience. In a post on their blog, they gave some detail as to what we should expect:

Some of the updates you can expect to see this fall include:

• A new Yahoo! Mail experience with even more focus on performance and speed
• New Yahoo! Search experiences with rich, immersive results that keep you in the loop on the news and entertainment topics that matter to you the most
• Twitter integration on Yahoo! that will allow you to link your accounts so you can view and share updates with friends across both networks
• A new Yahoo! app for iPad and other tablets that’s designed to deliver personally relevant news, information, and essentials like weather, commute updates, and more
• Customized Content Ads with creative formats that leverage an advertiser’s robust content and enable social sharing
• New Connected TV partnerships that provide consumers with thousands of video-on-demand content sources, social networks, games, music, shopping, and more — all while watching TV

The new Yahoo mail is up to 2x faster, easier to use, and provides better protection for your data. It features inline IM, inline SMS, folders, and unlimited storage. A “What’s New” page shows you the latest emails, IMs, and tweets. Just as Hotmail did just recently, Yahoo is stepping their webmail game way up. These updates should put them on par with both Gmail and Hotmail.

Yahoo is paying a lot of attention to the social web. They say social is “just getting started” and want to help you own “real social relationships on the web.” They are looking to “build an ecosystem” by pulling together various pieces of the social web, using your own personal data to enhance your Yahoo experience. Another piece of the puzzle is in reaching 100% user authentication. This means you will be able to login to Yahoo using your ID from just about any other service: Twitter, Facebook, and more.

On the social networking side, Yahoo recognizes that it’s sometimes hard to be yourself on most social networking sites. We usually act different depending on who we’re around. Yahoo wants to help you organize your friends into groups, a problem that Orkut tackled with their recent launch of Personas.

On the search side, we will see a “more visually compelling” experience that will “let you discover information and be entertained all on one search result page.” Search will also include trending topics and a slideshow of stories related to what’s going on.

While many have written Yahoo off, it looks like they are trying their best to keep up. With the speed that the web is moving at, it remains to be seen if they will succeed.

via Yahoo!, Business Insider

According to Skyhook Wireless, Google has taken some unsavory actions to disrupt Skyhook’s contracts with major cell phone manufacturers. Skyhook, based in Boston, develops a technology which allows mobile phones to find their physical location without the aid of GPS satellites. This is done using nearby WiFi signals. Skyhook has worked with the likes of Apple (who later ditched the technology for their own) and Motorola.

In the later case, Skyhook says Google changed their handset compliance rules in such a way that Skyhook found it impossible to pass (No, I didn’t know Android handsets had to be approved by Google either). After reaching out to Google representatives for help in fixing the problem and getting no response, Skyhook was forced to file suit to protect their business interests. According to those familiar with Skyhook, their pay technology is superior to Google’s free offering in this area. Motorola had already dumped Google in favor of Skyhook, so the question is did Google actively take actions to prevent Skyhook from doing business?

Skyhook filed a business interference lawsuit in the Massachusetts Superior Court in Boston today, and a patent infringement lawsuit in the U.S. District Court of Massachusetts. According to Skyhook, Google took advantage of their close relationship with handset manufacturers like Motorola to push Skyhook out, costing them millions. The patent infringement lawsuit sites four patents and Skyhook has requested an injunction on the Google WiFi location software.

Skyhook CEO Ted Morgan points out that, while Android is touted as being an open platform, that doesn’t always turn out to be true. This is presumably because Google has the final say in approving each device, something that seems more Apple than Google.

“The message that Android is open is certainly not entirely true. Devices makers can license technology from other companies and then not be able to deploy it.” — Ted Morgan, Skyhook CEO

“Their behavior in this case is contradictory to their message of openness,” Skyhook Chief Executive Officer Ted Morgan said today in an interview. “In areas that are very important to Google, the rules seem to change.” Does Google have a dark side that we don’t yet know about or is this a misunderstanding? Google has released no official comment yet as they have not been officially served.

via GigaOm, Bloomberg, Business Insider

Internet Explorer 9 Beta, the latest from Microsoft, tones down on the browser fluff to offer a better user experience. The interface is clean and unobtrusive. The underlying engine has been upgraded and tweaked. It shows clear performance benefits with full hardware-acceleration. Rather than focusing on building a better browser, it appears Microsoft focused on building a better browsing experience.

IE9 is being built to take advantage of the latest web standards. HTML5 support is at the forefront of this development. Most of the new features in IE9 won’t seem that new to users of Chrome or even Firefox. It even looks a lot like Chrome. This isn’t all that surprising as I’m still convinced Google only created Chrome to serve as a template for other browser developers. IE9 has fallen right into the trap, much to the end-user’s benefit. New features include:

• Notifications that pop up in a bar at the bottom of the window, so they don’t interrupt your work flow
• Tearable tabs
• A combined search / location bar that shows results from Bing as you type

One important new development is the addition of apps to the IE experience. You can turn any website into an application, which lets you launch it in a single click. Users of Chrome will recognize this feature immediately. A few interesting things to note about IE’s implementation, though:

• Application windows still have all the navigation and menus attached
• You can add tabs to an app window
• Your add-ons don’t work inside the application window

So, while you have the added benefit of being able to group related sites in a single window, there is a drawback in that users can’t use any of your add-ons in those tabs. This could be a major problem for many users, but Microsoft says it is set up this way by design. Also, Some of the hottest features in IE9 are missing from the Vista version and XP has been left out in the cold completely. It seems MS is focusing mostly on Windows 7 at this point.

In any case, it seems everyone can agree that IE9 is a major step up from IE8. The interface and underlying engine are snappier and more responsive. Rendering speeds are improved. They’ve even decided to embrace the latest web technologies, which should make developers happier in the long run.

Have you tried IE9 Beta? What do you think?

More info at ZDNet and IEBlog

Google has launched a new video campaign on YouTube to highlight the abilities of its Voice Search features. While Voice Search is a very powerful tool, some find it hard to figure out exactly what to do with it. In a new series of videos on their new YouTube channel, Google promotes their “What you say is what you search” mantra.

They offer a few compelling examples, including:

• A guy in a hot tub who wants to find out how many calories he’s burning without destroying his phone.
• A bird watcher in a tree who doesn’t want to lose site of his target, but needs to identify the bird he’s looking at.
• A woman eating an ice cream cone who needs to know how to cure brain freeze ASAP.

Interesting examples that will probably spark ideas among those interested in Voice Search. What I find more interesting about these videos is that Google provides links to the actual search results inside the videos, challenging you to “Go ahead” and click the links on the phone. You can interact with the video to pull up the results from the search, providing some credibility to the service. (You can add links in your own YouTube videos using the Annotations feature, but you are limited in what you can link to.)

Keeping things moving on all fronts, Eric Schmidt re-ignited rumors of a Facebook-killer app called Google Me when he spoke at the Zeitgeist event. He didn’t get too specific, but did say that Google’s products would include more social elements later this year.

He didn’t talk about killing Facebook, but he did say that Google wants access to your Facebook contacts. This would be to grow and expand your social network. This would also give Google a better idea of who you are, who you’re connected to, and what type of ads you might want to see. Schmidt also added a somewhat controversial statement, saying:

“The best thing that would happen is for Facebook to open up its data. Failing that, there are other ways to get that information.”

Presumably, this simply means having users to authorize Google to access their contacts in some way, but who knows. While the rumors focus around some monolithic Facebook-type service, I’m pretty sure Google isn’t going to try to re-invent the wheel here. The smarter option is to simply make their existing services more social by adding social context.

Users don’t want to join yet another social network, but they’re probably already using one or more Google services. Simply adding social hooks and context to their existing services would go a long way for Google in gathering more information about users and providing opportunities to show them ads. At the end of the day, that’s what they’re really after.

via Phandroid, WSJ