Jason Yow

Oracle's acquisition of Sun has hit some European roadblocks, but if it goes through customers will have to prepare to negotiate with a new IT behemoth. The European Commission has objected to Oracle's pending acquisition of Sun, saying the combination of Oracle's database products with Sun's open source MySQL violates European competition laws. With Sun on board, Oracle will have the software and hardware it needs to compete against more well-rounded companies such as IBM, and could vault up to the top of the open source industry, according to Gartner. "Believe it or not, Oracle would become the most powerful open source vendor in the market today, bar none," analyst George Weiss told audience members at this week's Gartner Data Center Conference in Las Vegas.

But a compromise could still be worked out allowing the completion of the acquisition. These questions, Weiss says, including the following: • Will Oracle support IBM applications, such as WebSphere, on Sun's Sparc servers?• Will Oracle put most of its efforts into Linux or Solaris?• Will Oracle continue Sun's partnership with Fujitsu to design Sparc processors?• Will Oracle attempt to move existing database customers from IBM and HP servers to Sun's Sparc machines?• How much sales energy will Oracle focus on combating IBM, HP and Dell in the x86 market? The combination of Oracle, a software vendor with a proprietary history, with Sun, a hardware vendor with open source inclinations, raises many questions. In an electronic poll of the Gartner audience, a plurality of 46% took a positive view, saying they expect Oracle to bolster and develop broad new capabilities for Sun's hardware. Weiss offered several pieces of advice to customers as they wait to see what happens with the pending Oracle/Sun acquisition.

The rest believe Oracle's approach to Sun hardware will be either to sell it off to another vendor, reduce and minimize to bare bones capabilities, or barely pay attention to the hardware product lines. That advice includes: • Do not negotiate multimillion dollar, long-term contracts with Sun until the European review of the merger is complete.• Do not make a strategic long-term commitment to large Sparc servers until a long-term contract is signed between Oracle and Fujitsu.• Existing Sun customers should try to lock Sun into long-term maintenance deals, five years or more, before Oracle can change the terms of the deal.• Leverage Sun's poor x86 market share to obtain high server discounts.• After the Oracle/Sun deal closes, force Oracle to document its open source strategy, and how it compares with other proprietary and open source vendors.• Continue to use Sun's application infrastructure middleware for current projects, but postpone new commitments until a deal is done.• Retain Java as an open standard but expect Oracle to institute licensing changes. Key items to negotiate include hardware maintenance, pricing and contract periods, bundling, software support on competitive hardware, and lifetime support for Solaris. Because Sun licensing and pricing could change after an acquisition, customers must be aggressive in negotiations to minimize risks. Oracle likely didn't think winning European approval for an acquisition of Sun would be so difficult, and CEO Larry Ellison has made matters worse by acting somewhat belligerent toward European authorities, Weiss says.

While Oracle has refused to compromise on MySQL, the company also hasn't walked away from the deal. In the meantime, Sun is reportedly losing $100 million a month during the delay and competitors are swooping in. "IBM and HP are all over the Sun accounts and they're attempting to instill fear into you [the customers]," Weiss says. While the acquisition could fall through, Weiss says the most likely scenario is that Oracle will negotiate a compromise with European officials by the deadline in late January. Customers may also question whether they want Oracle playing an influential role guiding the open source community. If it drags out further, "everybody that has Sun systems and products is going to be languishing around that uncertainty," he says. "It's pretty untenable that this would go into a lengthier process, but it could happen." Even the completion of the acquisition likely would not reverse Sun's revenue decline because many customers have already decided to migrate away from Sparc and Solaris, he says.

Assuming Oracle does acquire Sun, the company would obviously place more resources behind some Sun technologies and products than others. Although Oracle has seemed to place more importance on Linux than Solaris, Weiss predicts that the company will be agnostic on the question of which operating system customers use. In a poll, respondents said they want Oracle to demonstrate commitment to Solaris and the independence of Java. Among Sun's hardware, the products with the best chance of long-term survival under Oracle are high-end servers running data warehousing and online transactional processing applications, followed by Sparc Enterprise M-series servers, Weiss says. Sun middleware such as the GlassFish Enterprise Server should have a bright future under Oracle, Weiss says.

Storage products and x86 servers won't be jettisoned, but will not receive the same level of support from Oracle, he predicts. But certain other software products, such as the Java Composite Application Platform Suite, will probably be supported with only minimal enhancement, he says. Follow Jon Brodkin on Twitter.

Indian outsourcer Wipro has designed a gateway that uses GSM (Global System for Mobile Communications) wireless technology to collect data remotely from medical devices such as blood pressure monitors, glucose meters, pedometers, and weighing scales available with patients. The design, which will be customized by Wipro for its clients in the medical devices business, has been designed using Intel's Atom processor. In remote areas in India, GSM coverage is better than that of broadband or fixed-line dial-up connections, said R. Manimaran, general manager of the medical devices unit of the Wipro Technologies business of Wipro.

Using a standard platform like the Atom platform for embedded applications has helped drive down costs, making the technology affordable in emerging markets, Manimaran said. Indian outsourcers are increasingly focused on the development of intellectual property (IP) and reference designs that they expect will give them an edge in delivering product design and IT services to customers. The final price of the product will, however, be decided by the vendors, he added. Another Indian services company, MindTree, said in September that it was acquiring the Indian development subsidiary of Kyocera Wireless to do mobile handset design for Kyocera and other clients. It also supports video and audio conferencing for interactions between the patient and the doctor, and between doctors consulting with each other. The medical gateway designed by Wipro allows the transmission of real-time medical data to application servers, physicians' handheld devices, and hospital systems through GSM, broadband and dial-up connections.

In rural areas, where sometimes individual patients may not have the connectivity, they can come to rural health care centers where the information can be collected and communicated to larger hospitals in the city, Manimaran said. Medical devices can connect to the gateway through both wired technologies and wireless technologies such as Bluetooth to provide real time medical data, video and image transfer from a patient to doctor, and in turn from a doctor to doctor, Manimaran said.

The FCC voted unanimously yesterday to move forward with the debate in an effort to formalize net neutrality guidelines. In the wake of FCC chairman Julius Genachowski's initial announcement of his intent to pursue formal net neutrality rules, a group of GOP lawmakers already initiated a similar attempt. Senator John McCain followed up by introducing a bill that would prohibit the FCC from governing communications.

However, that amendment was retracted almost as quickly as it was filed. Basically, those in power or those who pay more will have better access. McCain's bill, the Internet Freedom Act, seeks to do the opposite of what its name implies by ensuring that broadband and wireless providers can discriminate and throttle certain traffic while giving preferential treatment to other traffic. Apparently we have different definitions of 'freedom'. According to the text of the McCain bill, the FCC "shall not propose, promulgate, or issue any regulations regarding the Internet or IP-enabled services." Isn't that what the FCC does? Oddly, the bill also contains text stating that any regulations in effect on the day before the Internet Freedom Act is officially enacted are grandfathered in and exempt from the provisions of the Internet Freedom Act.

Isn't that sort of like introducing a bill to prohibit the Treasury from printing money, or a bill to prohibit the IRS from collecting taxes? The implication seems to be that if the FCC can formalize net neutrality rules before McCain can get the Internet Freedom Act signed into law, the net neutrality rules would still apply. However, Comcast tried to throttle peer-to-peer networking traffic and only changed policy after the threat of FCC net neutrality rules. Net neutrality opponents claim that the free market can police itself and that any net neutrality restrictions will stifle innovation and competition. AT&T sought to block customers from using VoIP services from its wireless network, but changed policy out of fear of the net neutrality rules. What the FCC voted on yesterday is simply to start the debate.

The trend seems to be that these providers only do the 'right thing' when the net neutrality gun is pointing at their head. Its an open discussion, so what are net neutrality opponents afraid of? If there are valid issues that need to be resolved, then go ahead and bring them to the table. They have 120 days to gather information and collect data and present their case. Don't initiate legislation that seeks to pretend the table doesn't exist.

While Obama was attached surgically to his CrackBerry and his staff leveraged social media from their Macbooks, McCain admitted having little or no knowledge or interest in modern technologies like email or the Internet. During the Presidential election campaign last year the differences between the two candidates was stark. It seems suspicious that the Internet is suddenly a major concern for him. Tony Bradley is an information security and unified communications expert with more than a decade of enterprise IT experience. Maybe he just missed seeing his name in the paper.

He tweets as @PCSecurityNews and provides tips, advice and reviews on information security and unified communications technologies on his site at tonybradley.com.

Sun Microsystems will lay off up to 3,000 workers over the next 12 months as Oracle awaits approval from European regulators for its acquisition of the company. In a filing with U.S. regulators Tuesday, Sun said it was making the cuts "in light of the delay in closing the acquisition." It said the move will "better align the company's resources with its strategic business objectives." Sun will take a charge of $75 million to $125 million for the job cuts, mostly for cash severance payments, it said. Sun is losing US$100 million a month while it awaits approval for the deal, Oracle CEO Larry Ellison said last month, so news of the layoffs came as no great surprise. It expects to incur most of the charges in the second and third quarters of its fiscal year, which means the current calendar quarter and the first three months next year.

Tony Sacconaghi, a technology analyst with Sanford C. Bernstein & Co., has said Oracle may cut up to 10,000 jobs once the deal is complete. Job cuts were a likely consequence of the deal in any case. Sun already announced plans last November to axe between 5,000 and 6,000 jobs to improve its financial position. The U.S. Department of Justice approved Oracle's $7.4 billion acquisition of Sun in August, but the European Commission has launched an investigation that could last until January. The cuts announced Tuesday, which amount to about 10 percent of Sun's workforce, are in addition to the earlier reductions, a Sun spokeswoman said. The regulators say they are concerned about the effect that Oracle's ownership of Sun's MySQL database will have on the open-source software market.

A smart people smack-down is set to start next week where thousands of university computer researchers will pit their brains and machines in a grueling battle of logic, strategy, and mental endurance. Layer 8 Extra: 15 genius algorithms that aren't boring During the competition, ten to twelve problems are attempted in a five hour period. The 34th annual IBM-sponsored Association for Computer Machinery (ACM) International Collegiate Contest (ICPC) pits teams of three university students against eight or more complex, real-world problems, with a nerve-wracking five-hour deadline. The problems are of varying difficulty and flavor.

The goal is that every team solve two problems, that every problem is solved, and that no team solve them all, according to ACM. Contests in the past have included problems that searched for a missing boat at sea, triangulated the location of a faulty transmitter, computed golf handicaps, stacked pipe of varying diameters in a fixed width bin, coded or decoded messages, printed braille, sought an exit to a maze, processed satellite images and solved a math problem. ACM says it wants two problems that could be solved in an hour by a first or second year student, two that could be solved in an hour by a third year student, and two that will likely determine the winners. Problems are presented with no more than a page of text, a helpful illustration, a sample input set with and accepted output set, ACM states. And judging is relentlessly strict, IBM says. Teammates collaborate to rank the difficulty of the problems, deduce the requirements, design test beds, and build smart software systems that solve the problems under the intense scrutiny of expert judges.

The students are given a problem statement, not a requirements document. Each incorrect solution submitted is assessed a time penalty. They are given an example of test data, but they do not have access to the judges' test data and acceptance criteria. The team that solves the most problems in the fewest attempts in the least cumulative time is declared the winner. Some problems require a knowledge and understanding of advanced algorithms.

For a well-versed computer science student, some of the problems require precision only. Still others are simply too hard to solve - except for the world's brightest problem-solvers, according to IBM. The Battle of the Brains is the largest and most prestigious computing competition in the world, with more than tens of thousands of students from universities in approximately 90 countries on six continents participating. Previously, the 2009 ACM-ICPC World Finals took place in Stockholm, Sweden, where a team from St. Petersburg University of Information Technology, Mechanics and Optics in Russia emerged as the world champion for the second year in a row. Since IBM began sponsoring the contest in 1997, participation has grown from 1,100 to more than 7,100 teams. Regional bouts will begin in the United States on October 18 and continue through December, sweeping from continent to continent.

Only 100 three-person teams will advance to the World Finals on February 5, 2010 hosted by Harbin Engineering University in Harbin, China. "The ACM-ICPC affords students the opportunity to showcase their talents and gain exposure among top recruiters," said Dr. Bill Poucher, ICPC Executive Director and Baylor University Professor. "The contest is also a forum for advancing technology in an effort to better accommodate the growing needs of the future."

Among Microsoft's trials and tribulations in the mergers and acquisitions space, a Microsoft official on Tuesday evening cited fear of dealing with the company as an obstacle Microsoft has had to overcome. Brown made the comments at a Churchill Club event in Mountain View, Calif., during a panel discussion on mergers and acquisitions that also featured representatives from Cisco, Google, and Accel Partners. [ Microsoft and Yahoo recently agreed to partner in an effort to better compete with Google. | Stay ahead of the key tech business news with InfoWorld's Today's Headlines: First Look newsletter. ] After the event, Brown said he was referring to a time when he started at the company years ago.  In general, people were just scared of Microsoft, he said. Normal 0 false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4 "[For a while] there was a fear of dealing with Microsoft and we've worked really hard to try to overcome that," said Marc Brown, managing director of corporate development at Microsoft. This fear existed with both the entrepreneurial and venture capital communities, said Brown. The three technology companies represented on the panel have made waves over the years with their acquisitions.  Cisco is known for numerous purchases, ranging from Scientific Atlanta to Grand Junction Networks; Microsoft has acquired companies such as Great Plains Software and attempted to buy Yahoo, while Google bought YouTube and others.

Panelists discussed their companies' mergers and acquisitions strategies. "The M&A and acquisitions strategy's pretty straightforward," Brown said. "We are a technology buyer. Panel moderator Steve Smith, senior managing partner with Arma Partners, noted Microsoft actually began with an acquisition. "[Founder Bill] Gates bought PC DOS for something under $100,000 and turned it into a thing called Windows and a company called Microsoft," Smith said. Most of our acquisitions are of earlier-stage companies."  Microsoft then leverages sales and distribution channels and processes to bring acquired technologies to the widest audience possible, he said. "What I would say is M&A  is not really the strategy. We start with the idea of what should be our growth strategy," said Carmel. M&A is the tool," said Charles Carmel, vice president of corporate development for Cisco. "The strategy is really about capturing innovation." Cisco realizes it does not have a monopoly on good ideas, he said. "We don't start with the idea of what company we should buy. When pondering an acquisition, Google looks at the caliber of leadership being brought over to the company from the acquired venture, along with factors including time to market and opening of new markets, said David Lawee, Google vice president of corporate development.

Panelists also cited increasing interest in potential overseas acquisitions in places such as China. "There's nothing to prevent us from being as aggressive internationally," Lawee said. The company's acquisition of Urchin resulted in the Google Analytics platform while Keyhole, also bought by Google, became Google Earth, Lawee said. But panelists declined to make any predictions when asked whether the European Union should approve the planned acquisition of Sun Microsystems by Oracle. Tuesday's event was held at Microsoft's Silicon Valley offices. They also would not discuss what impact this acquisition would have on their own businesses. "Everybody's got their own twists and turns to their M&A activities," Carmel said. "No comment," Brown added.

This story, "Fear of Microsoft subsides in mergers and acquisitions arena," was originally published at InfoWorld.com. Follow the latest IT news at InfoWorld.com.    

Standards play a critical role in information assurance. Standards also provide a basis for demonstrating due care and diligence in fulfilling our fiduciary responsibilities to stakeholders. Given the impossibility of defining a deterministic model that includes billions of users, millions of computers, and thousands of programs and protocols potentially interacting with each other unpredictably, we have to rely on human consensus about best practices if we are to progress in our field. In this first of four articles about the latest revision of a landmark Special Publication (SP) from the Joint Task Force Transformation Initiative in the Computer Security Division of the Information Technology Laboratory of the National Institute of Standards and Technology (NIST), Paul J. Brusil reviews the key recommendations and strategic guidance offered in Recommended Security Controls for Federal Information Systems and Organizations, Rev. 3, which has been prepared by a panel of experts drawn from throughout the U.S. government and industry.

Traditionally, the Department of Defense (DoD) and the civilian federal agencies independently develop their own standards. Everything that follows is Brusil's work with minor edits. * * * From the furthest corners of the U.S. Defense and Intelligence communities to every civil office in the U.S. federal government, a single new security standard applies to all government information systems – including national security systems. Harmonizing the security needs of all government agencies has been a long time coming; but, for the first time ever, the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations, Rev. 3 dated August 2009 does just that. It is the harbinger of other soon-to-appear, cross-government, security recommendation collaborations in areas including certification and accreditation, risk assessments, security control assessment procedures and others. SP 800-53 provides a unified information security framework that applies across the entire federal government. SP 800-53 is part of an extensive library of guidelines, recommendations and standards NIST publishes and continually updates to help organizations protect their information systems and data.

The SP 800-53 standard, titled "Recommended Security Controls for Federal Information Systems and Organizations", was co-developed by the Computer Security Division of NIST, DoD and the U.S. Intelligence Community, as well as the Industrial Control System community. Protected information systems include all constituent components – local and remote – for processing, storing and transmitting information. It benefited by extensive public review and comments. The purpose of SP800-53 is to achieve information system security and effective risk management, in part, by providing a common information security language for all information systems and by providing consistent and repeatable guidelines for selecting and specifying standard security controls. It represents the best practices and guidance available today, not only for the government but for private enterprises as well.

With the aid of SP 800-53, organizations are able to select appropriate security controls to meet security requirements, to implement the selected controls correctly and to demonstrate the confidence and effectiveness of selected controls in complying with security requirements. Office of Management and Budget (OMB) policies mandate all federal agencies, their contractors and their external service providers use SP 800-53. The existence of SP800-53 as a government regulation has many benefits beyond the stipulation of security best practices. SP 800-53 guides security managers, security service providers, security technology developers, system developers, system implementers and system assessors. For one, it elevates security awareness to senior management. SP800-53 is a living document updated periodically.

Correspondingly, security funding can be positively impacted. The just-released Revision 3 supersedes the previous revision released 18 months earlier. In the next part of this four-part series, Brusil discusses the risk management section of SP 800-53 Rev. 3. * * * Dr Paul J. Brusil, PhD, MD graduated from Harvard University with a joint degree in Engineering and Medicine. It contains or amplifies a risk management framework, a security control catalog, a security control selection process, traceability of security controls to underlying security requirements, assurance requirements for security controls, and extensions for use in communities outside the U.S. government. He has authored more than 100 papers and book chapters in his distinguished career and worked in a wide range of industry and government sectors as a respected security, network management and program management consultant. He is on the editorial boards of several journals including the Journal of Network and Systems Management and is a Lead Instructor for the Master of Science in Information Assurance at Norwich University.

Indian outsourcer Wipro has designed a gateway that uses GSM (Global System for Mobile Communications) wireless technology to collect data remotely from medical devices such as blood pressure monitors, glucose meters, pedometers, and weighing scales available with patients. The design, which will be customized by Wipro for its clients in the medical devices business, has been designed using Intel's Atom processor. In remote areas in India, GSM coverage is better than that of broadband or fixed-line dial-up connections, said R. Manimaran, general manager of the medical devices unit of the Wipro Technologies business of Wipro. Using a standard platform like the Atom platform for embedded applications has helped drive down costs, making the technology affordable in emerging markets, Manimaran said.

Indian outsourcers are increasingly focused on the development of intellectual property (IP) and reference designs that they expect will give them an edge in delivering product design and IT services to customers. The final price of the product will, however, be decided by the vendors, he added. Another Indian services company, MindTree, said in September that it was acquiring the Indian development subsidiary of Kyocera Wireless to do mobile handset design for Kyocera and other clients. It also supports video and audio conferencing for interactions between the patient and the doctor, and between doctors consulting with each other. The medical gateway designed by Wipro allows the transmission of real-time medical data to application servers, physicians' handheld devices, and hospital systems through GSM, broadband and dial-up connections.

In rural areas, where sometimes individual patients may not have the connectivity, they can come to rural health care centers where the information can be collected and communicated to larger hospitals in the city, Manimaran said. Medical devices can connect to the gateway through both wired technologies and wireless technologies such as Bluetooth to provide real time medical data, video and image transfer from a patient to doctor, and in turn from a doctor to doctor, Manimaran said.

Soon businesses that run Check Point security tools will be able to understand how thousands of Web applications and Web 2.0 widgets are used, giving executives better control over what employees do with their computers at work. 12 tips for safe social networking The company is developing a software blade that customers can buy to address use of social Web sites and Web applications. With the blade, due out next year, businesses could see not only that employees use Facebook, but also whether they are participating in Facebook groups or playing games available through the site, for example. Check Point has licensed extensive libraries from FaceTime that identify 4,500 Web applications and more than 50,000 Web 2.0 widgets. Or they could keep an eye on applications that do file transfers, Check Point says.

Initially, Check Point plans to incorporate the libraries in a blade that is just a monitoring tool, but later it will incorporate them in a firewall to create an access-control blade that can enforce restrictions on the use of applications and widgets. Business use of Web 2.0 sites brings its own security concerns and can run afoul of regulations from governmental agencies and business consortiums. Later still, the company says it will incorporate the libraries into IPS and QoS blades. For instance, customers might buy firewall, intrusion-detection system and antispam software blades and run them on a single hardware chassis. Under Check Point's software blade architecture announced earlier this year, customers can buy individual security tools to create packages of custom security features. Before, Check Point sold monolithic multi-function unified threat management platforms that might include more functions than customers wanted.

The libraries support FaceTime's own Unified Security Gateway product.

Have some extra USB hard drives you'd like to put to a good use? Though marketed primarily as a media-sharing device, the forthcoming second-generation Pogoplug is a cool and useful tool for sharing business information as well. How using them to create an Internet storage cloud for your company, yourself, or your family? The device was introduced earlier today.

It provides a hardware device and online service that together provide secure file access and sharing. Here's the pitch: For $129, Pogoplug gives you the ability to connect USB hard drives directly to the Internet. Scheduled to ship next month, Pogoplug 2 (as I am calling it) is optimized for Internet viewing and sharing of multimedia files. Because the Pogoplug service keeps track of stored files-indexing across multiple hard drives-it allows users to share files without having to upload them. It can, for example, stream video to an iPhone, which can also upload and download files from the storage cloud the Pogoplug creates.

Optional Windows and Mac desktop apps provide local access to Pogoplug-managed storage. The new model offers four USB connections, allowing multiple drives to be connected without the need for a USB hub. There is no monthly charge for the online service, included in cost of the device. Other new features include better transcoding and wider support for streaming movies on the Web or to an iPhone app. There is also tighter integration with Facebook, Twitter, and MySpace, as well as automatic organization of your music, photos, and videos. The new software also provides the ability to automatically sync photos, music, videos, and other content from apps such as iTunes and iPhoto.

An address book remembers e-mail addresses with which you've shared content for future sharing. If not, Seagate's DockStar is a somewhat less expensive device, based on Pogoplug technology. The first version, introduced in January at CES, had but a single USB connection and was pretty utilitarian in appearance. (Here is our review). The new Pogoplug is fairly attractive, if you like bright pink. The hitch? Storage is, after all, a terrible thing to waste.

After the first year, Pogoplug service will cost Seagate customers $29.95-a-year. (The DockStar is one of our "25 Top Tech Gifts" for 2009). Meanwhile, Pogoplug's maker, a company called Cloud Engines, said it will "soon" enable additional features, such as "backup, file synchronization, photo printing and more." My take: I didn't think the first Pogoplug was useful enough the buy one, but having recenty discovered a half-dozen extra USB drives around my office, the device suddenly seems almost necessary. I will probably order one online, that is if I can get past the obnoxious self-starting music and videos on the Pogoplug Web site. With the product features now improved, maybe the site can be fixed, too. It keeps repeating over and over. David Coursey tweets as @techinciter and can be contacted via his Web site.

Nominum is hoping that the second time is the charm in the outsourced DNS market, as the maker of high-end DNS software announces a hosted service on Tuesday. Slideshow: How DNS cache poisoning works On Tuesday, Nominum will reenter the outsourced DNS market with the announcement of SKYE, a separate business unit that will offer its software as a cloud-based service to smaller ISPs and enterprises. Nominum had a managed DNS services operation earlier this decade but sold it to rival UltraDNS in 2002. Nominum has since focused on its DNS and Dynamic Host Configuration Protocol (DHCP) server software, counting among its customers many of the world's largest carriers including Verizon, Sprint and NTT Communications. Jon Shalowitz, vice president and general manager of SKYE, says the new venture's biggest differentiator is the underlying Nominum software, which is higher performing and more reliable than open source alternatives such as Berkeley Internet Name Domain (BIND). "This is the same software running in the top 100 ISPs around the world," Shalowitz says. "It handles two to three trillion transactions or queries per day.

Rodney Joffe, senior vice president and senior technologist at Neustar, says hosted DNS is a big enough market to support multiple vendors. "Despite the fact that it's been a pretty awful recession, we've continued to grow very effectively in our area of managed DNS for enterprises," Joffe says. "There is definitely a market, and we're nowhere near saturation." Nominum has set up SKYE as a separate organization, with 30 full-time employees and five data centers to run Nominum's software. "Enterprises need to wake up to the risks associated with ignoring their DNS and assuming that if it's not breaking all they time [they] can ignore it," Shalowitz says. "There are still a lot of organizations running legacy DNS and open source DNS that are fraught with vulnerabilities." SKYE is offering four hosted services: SKYE Core recursive DNS service; SKYE Secure authoritative (or external) DNS services; SKYE Search redirection service; and SKYE Trust, a blacklist service for malicious Web sites. "Our target customer is anyone who has a strong Web presence: E-commerce companies, banks, anyone that has regulations for protecting data such as hospitals and healthcare companies; and any other company where breaches of personal information could be catastrophic such as credit card companies," Shalowitz says. We're leveraging that same technology in a cloud model." SKYE's main competitor will be UltraDNS, now owned by Neustar. Nominum says the time is right for hosted DNS services because of a broader push by corporate IT departments toward cloud-based services. "Part of the reason why cloud is becoming the rage is because of its operational benefits," Shalowitz says. "When companies look at the cost/benefit analysis, they'd much rather have [DNS] being done by experts and run in the cloud." Abner Germanow, director of enterprise communications at IDC, says enterprises are realizing that DNS is a critical service and are paying more attention to it. Most of them are buying DNS appliances from vendors such as Infoblox or hosted DNS services such as the ones being offered by SKYE. "We've seen a fair amount of growth in hosted DNS services," Germanow says. "There are a whole slew of companies offering a variety of DNS services both for internal, recursive DNS services and external, authoritative services…This is something that's clearly rising in popularity." Joffe said new entrants into the enterprise DNS space such as SKYE and OpenDNS, which announced an enterprise offering earlier in the month, will face difficulties if they can't deliver top-notch service level agreements. "Companies that have tried to get into this market have been burned not because having DNS servers and networks is that hard but because making them work in a carrier-like way is not easy," Joffe said, adding that UltraDNS also runs its own DNS software rather than BIND. "The ability to do DNS in a really reliable way turns out to be hard."

Indian outsourcer Wipro has designed a gateway that uses GSM (Global System for Mobile Communications) wireless technology to collect data remotely from medical devices such as blood pressure monitors, glucose meters, pedometers, and weighing scales available with patients. The design, which will be customized by Wipro for its clients in the medical devices business, has been designed using Intel's Atom processor. In remote areas in India, GSM coverage is better than that of broadband or fixed-line dial-up connections, said R. Manimaran, general manager of the medical devices unit of the Wipro Technologies business of Wipro.

Using a standard platform like the Atom platform for embedded applications has helped drive down costs, making the technology affordable in emerging markets, Manimaran said. Indian outsourcers are increasingly focused on the development of intellectual property (IP) and reference designs that they expect will give them an edge in delivering product design and IT services to customers. The final price of the product will, however, be decided by the vendors, he added. Another Indian services company, MindTree, said in September that it was acquiring the Indian development subsidiary of Kyocera Wireless to do mobile handset design for Kyocera and other clients. It also supports video and audio conferencing for interactions between the patient and the doctor, and between doctors consulting with each other. The medical gateway designed by Wipro allows the transmission of real-time medical data to application servers, physicians' handheld devices, and hospital systems through GSM, broadband and dial-up connections.

In rural areas, where sometimes individual patients may not have the connectivity, they can come to rural health care centers where the information can be collected and communicated to larger hospitals in the city, Manimaran said. Medical devices can connect to the gateway through both wired technologies and wireless technologies such as Bluetooth to provide real time medical data, video and image transfer from a patient to doctor, and in turn from a doctor to doctor, Manimaran said.

Avaya has emerged as the winning bidder for Nortel's enterprise business, reportedly beating out Siemens Enterprise Communications over the weekend. Avaya will also contribute an additional pool of $15 million for an employee retention program. The firm will pay $900 million for the unit, Nortel's Government Solutions group and DiamondWare Ltd., a Nortel-owned maker of softphones.

That price is nearly twice what Avaya was initially said to be buying the enterprise business for back in July before auction bidding kicked in. Telecom carrier Verizon, however, is expected to contest the sale on the grounds that Avaya does not plan to retain customer support contracts between Nortel and Verizon. Slideshow: The rise and fall of Nortel Avaya has sought Nortel's enterprise business in hopes of boosting its share of the enterprise telephony and unified communications markets, and getting more customers to migrate to its IP line of communications products.  The sale, expected to close later this year, is subject to court approvals in the U.S., Canada, France and Israel as well as regulatory approvals, other customary closing conditions and certain post-closing purchase price adjustments. Nortel is confident the sale will go through without any snags. "We do not expect the Verizon interaction to impact court approval or the close of this deal," said Joel Hackney, president of Nortel Enterprise Solutions. "We will continue to go forward in supporting customers." Hackney would not say whether Nortel is engaged in the negotiations between Avaya and Verizon on the future of certain customer support contracts, mentioning only that Nortel supports Verizon as a customer as well as the carrier's customers. Nortel customers hope the deal works out in their interest. "Nortel earned the trust of our user group members by delivering innovative, reliable communications solutions and ensuring high-levels of service and support, " said Victor Bohnert, Executive Director of the International Nortel Networks Users Association, in a prepared statement. "With the announcement of today's purchase by Avaya, we look forward to extending that relationship forward to serve the business communications needs of our constituency base across the globe." Nortel will seek Canadian and U.S. court approvals of the proposed sale agreement at a joint hearing on September 15, 2009. The sale close is expected late in the fourth quarter.

Hackney also said there were two bidders for the enterprise unit but would not identify the second suitor. In some EMEA jurisdictions this transaction is subject to information and consultation with employee representatives. As previously announced, Nortel does not expect that its common shareholders or the preferred shareholders of Nortel Networks Limited will receive any value from the creditor protection proceedings and expects that the proceedings will result in the cancellation of these equity interests.

Almost as soon as it was launched, in only nine hours in fact, the Defense Advanced Research Projects Agency (DARPA) announced that the MIT Red Balloon Challenge Team won the $40,000 cash prize in the DARPA Network Challenge, a competition that required participants to locate 10 large, red balloons at undisclosed locations across the United States. Bots, bombs and weird science: The wackiest stories of 2009 "The Challenge has captured the imagination of people around the world, is rich with scientific intrigue, and, we hope, is part of a growing 'renaissance of wonder' throughout the nation," said DARPA director,Dr. Regina E. Dugan in a statement. The MIT team received the prize for being the first to identify the locations of all 10 balloons.

DARPA last month offered up the rather interesting challenge: find and plot 10 red weather balloons scattered at undisclosed locations across the country. According ton the agency, the balloons were in readily accessible locations, visible from nearby roadways and accompanied by DARPA representatives. The first person or team to identify the location of all the balloons and enter them on the challenge Web site will win a $40,000 cash prize. All balloons are scheduled to go on display at all locations at 10:00AM (ET) until approximately 4:00 PM on Saturday, December 5, 2009. Should weather or technical difficulties arise with the launch, the display will be delayed until Sunday, December 6 or later, depending on conditions. Latitudes and longitudes are entered in degree-minute-second (DDD-MM-SS) format as explained on the website Coordinates must be entered with an error of less than one arc-minute to be accepted.

If, for any reason, the balloon is displayed in one location then moved to a second location, either location will be accepted. 12 mad science projects that could shake the world Entrants were required to register and submit entries on the event website. The DARPA Network Challenge is designed to mark the 40th anniversary of the Internet. "It is fitting for DARPA to announce this competition on the anniversary of the day that the first message was sent over the ARPANET, the precursor to the Internet," said Dr. Regina E. Dugan, who made the announcement at a conference celebrating the anniversary. "In the 40 years since this breakthrough, the Internet has become an integral part of society and the global economy. The Grand Challenge competitions were started in 2004 to foster the development of autonomous robotic vehicle technology for use on the battlefield. The DARPA Network Challenge explores the unprecedented ability of the Internet to bring people together to solve tough problems." This is the latest example of DARPA's interest in reaching nontraditional sources of ideas and talent. The competition model for stimulating technological development enabled significant strides that will someday keep our men and women in uniform out of harm's way. DARPA has held a number of challenges including one that featured robot cars and another that seeks to develop lunar spacecraft.

A look back at the week's biggest Google-related news stories:   Google, Verizon unite on Android devices  Verizon and Google have entered into an agreement to jointly develop wireless devices based on Google's open source Android mobile platform. Verizon says that it will have two Android-based handsets on the market by year-end with more to come by 2010   Google celebrates anniversary of bar code patent  Google's "doodle" on its search home page Wednesday was a bar code that presumably translated into the word "Google". It also said happy 57th anniversary to the awarding of a patent for the bar code by Joseph Woodland and Bernard Silver. During a teleconference Tuesday, Verizon CEO Lowell McAdam and Google CEO Eric Schmidt outlined the companies' new strategic partnership that will see them working together to develop Android-based smartphones, PDAs and netbooks, and to deliver users with applications sold through the Android Market app store. It also coincided with the announcement earlier this week of the Nobel Prize for Physics to Charles Kao for his work on fiber-optic communications and Willard Boyle and George Smith, who invented imaging technology using a digital sensor dubbed a CCD (Charge-Coupled Device). The CCD has enabled developments such as bar codes/bar code readers to come along.   Gmail, other webmail passwords stolen  In the wake of the posting in online forums of stolen account and password information for thousands of Hotmail, Gmail and Yahoo e-mail accounts, evidence emerged of yet more abuse that entails attackers exploiting that information to hack into compromised accounts over the last few days to send spam aimed at stealing credit cards.

Attackers have been taking advantage of the exposed account information for Hotmail, Gmail and Yahoo to break into the victim's e-mail accounts and send out deceptive messages to the victim's contacts to promote the scam.   Google Voice in the middle of things AT&T buoyed the spirits of Google Voice fans this week by saying it would allow the application to run on its network, but later in the week word emerged that lawmakers want the FCC to look into whether Google Voice blocks calls to people in rural areas because they are expensive to connect. According to Patrik Runald, senior manager security research at Websense, the security firm noticed about a 40% surge in spam related to Yahoo, Gmail and Hotmail accounts in recent days, with some of the spam being a phishing scam related to a fake Chinese electronics shopping site. And guess which big carrier is encouraging the lawmakers in this pursuit?   Google Squared freshens up  PC World's David Coursey writes that "Google Squared, the ambitious project that delivers search results as a table, has received an update that improves both the quality and quantity of the information it presents." He cites a post on Google's blog that the update results will allow up to four times as many facts to be squeezed into a square.   Google, Microsoft woo Twitter  Various reports (All Things Digital, Reuters, etc.) had Google and Microsoft chatting with Twitter separately about how to best integrate Twitter with outside search engines.   Google: DRAM, DRAM, DRAM!  Computerworld reports that Google and the University of Toronto released a study of tens of thousands of Google servers showing that "data error rates on DRAM memory modules are vastly higher than previously thought and may be more responsible for system shutdowns and service interruptions." For more on Google, visit Network World's independent Google community, Google Subnet.

Lawmakers called upon the Transportation Security Administration and private sector companies to quickly re-establish a nationwide registered traveler program to help frequent travelers get through airport security checkpoints faster. Both lawmakers and vendors said the TSA had not done enough to support the registered traveler program and in fact distanced itself from the effort over the past year. The calls came after the abrupt closure earlier this year of Verified identity Pass Inc. (VIP), the largest provider of registered traveler services, and the subsequent shutting of services by two other vendors that offered the same service. The TSA, meanwhile, insisted that the program did little to improve security.

At a hearing on the future of the registered traveler program Wednesday, members of a House subcommittee on Homeland Security urged the TSA and private vendors to work together to quickly restore the service. The agency said that just because members of such programs had been pre-screened didn't eliminate the need for them to go through airport security checks like everyone else. The hearing came on the same day an investment banking firm, Henry Inc., said it had signed a letter of intent to buy VIP's assets and relaunch the service by the end of the year." U.S. Rep. At the same time, private sector companies need to find a model "that can support a security benefit, but which does not rely on one," she said. Sheila Jackson Lee (D-Texas), the subcommittee chairwoman, expressed hope that the TSA would make a "good faith effort" to explore a security benefit, or an additional layer of security vetting, for the registered traveler program. Even if passengers must still go through a security screeening, these companies can still offer the convenience of getting their customers through the process quicker, such as using a separate member-only line at security checkpoints.

Since 2005, the TSA has piloted several iterations of the program with private sector companies. The registered traveler program was established under the Aviation and Transportation Security Act (ATSA). It authorizes the TSA to implement trusted passenger programs to speed up the security screening of passengers who have submitted to comprehensive background and security checks. The biggest of them was VIP, which offered a registered traveler service called "Clear" at 21 major airports. The announcement raised immediate concerns about the data that VIP had collected as part of its Clear service, including Social Security and credit card number and home address. The company, which had signed up more than 200,000 subscribers, stopped service in June saying it had run out of money.

The company had also collected fingerprints, iris scans and digital images of customers' faces. Soon after Clear stopped its service, rivals Fast Lane Option Corp . (Flo) and Vigilant Solutions also shut down their services. Many who had paid a $199 annual fee were unable to get refunds. During the hearing, U.S. Rep. Going forward, the TSA needs to take the lead in supporting the program, Thompson and others said. Bennie Thompson (D-Miss.) said it is Congress' intent that such "a quick closing of business" does not happen again. "The traveling public deserves better," Thompson said.

Much of the reason the program is in disarray is because the TSA failed to support the effort, witnesses said. Despite the mandate from Congress, the TSA has not fully implemented the use of biometrics as a primary form of identification, Fischer said, nor has it used background screening to vet those using the RT lanes as it was supposed to. While the registered traveler program at one time was expected to provide add an additional layer of security at airports, today it is little more than a convenience for travelers willing to pay for it, they said. "To date, while the private sector has invested over $250 million and upheld its side of the partnership, the TSA has not," said Fred Fischer, managing partner at Flo Corp. Though the TSA at one point collected $28 per passenger to do a so-called Security Threat Assessment (STA) of passengers who had signed up for registered traveler programs, not one applicant was ever vetted using a criminal history records check, he claimed. John Sammon, an assistant administrator at the TSA, said that based on the pilot programs and the agency's own insight, registered traveler programs do not offer any additional security. As a result, the promised security benefits of the registered traveler program have yet to be realized, he said.

He said the TSA stopped doing security threat analysis for registered traveler programs because there was little value to be gained. "The prospect of a terrorist not identified on a watch list raised questions about the viability of a registered traveler program," he said. Going forward, the TSA will work with private vendors to identify programs that will support registered travelers programs, he said. After an evaluation of the pilot programs, the TSA concluded that registered traveler programs "do not provide any additional levels of security," he said. However, from a security standpoint, such passengers will still be subject to the same security checks as other ticketed passengers, he said.

If a research and development tax credit is allowed to expire at the end of the year, 120,000 U.S. jobs could be put at risk, according to a group of companies supporting an extension. The coalition on Wednesday called for Congress to make the tax credit permanent and to increase the credit paid to some companies. A lapse in the tax credit could also put at risk US$16 billion in R&D and related economic activity, the R&D Credit Coalition said. The R&D tax credit, which gives eligible companies a tax credit of 14 percent to 20 percent of R&D spending, has been temporarily extended multiple times since it was first approved by Congress in 1981. The tax credit "has been a driver of jobs and a boost for the U.S. economy, said Karen Myers, vice president of global government relations for CA. Coalition members are concerned that Congress will adjourn this year without extending the tax credit, putting U.S. companies' R&D plans in flux, she said.

Some groups, including tax reform advocates Citizens for Tax Justice, have called the R&D tax credit "corporate welfare." But members of the coalition said the tax credit has huge economic benefits for the U.S. and President Barack Obama, who has called for the credit to be made permanent, has said it returns $2 to the U.S. economy for every dollar spent. "We're talking about 120,000 jobs - if anything, this is citizen welfare ... or employee welfare," said Bartlett Cleland, senior director of policy for TechAmerica, a tech trade group aligned with the R&D Credit Coalition. "These are not 120,000 sweep-the-floor jobs. Lawmakers have been reluctant to make the tax credit permanent partly because of its cost - about $7 billion [b] a year. These are highly compensated, well-educated U.S. employees. The U.S. had the highest R&D incentives when the tax credit was first passed in 1981, but now 16 other nations have more generous incentives, they said. "When you see the other incentives that countries are offering, it's becoming a more challenging hurdle to keep R&D in the United States," said Marie Lee, director of finance and tax policy for TechAmerica. "Particularly when we see the credit lapse, that does [affect] the decisions companies make." The cost of extending the credit - without increasing it to 20 percent across the board, as the coalition wants - would cost about $68 billion over 10 years, according to congressional estimates. There's a growing pressure on U.S. companies to take R&D work overseas, coalition members said. Asked about budget concerns in Congress, Myers said many lawmakers continue to be concerned about jobs and unemployment in the U.S. "Lawmakers are very sensitive to cost in this environment," she said. "However, the fact that the credit is very closely aligned with jobs, and closely aligned with economic growth, I think its an incentive for which lawmakers have a lot of sympathy." On Tuesday, more than 400 companies and trade groups sent a letter to all members of Congress, asking them to make the R&D credit permanent and increase the rate.

A number of companies outside the IT sector also signed the letter, including Harley-Davidson, Toyota and the Schwan Food Co. A number of tech companies signed the letter, among them Adobe Systems, AT&T, Cisco Systems, Dell, Intel, Hewlett-Packard, and Microsoft.

A Seattle computer security consultant says he's developed a new way to exploit a recently disclosed bug in the SSL protocol, used to secure communications on the Internet. Frank Heidt, CEO of Leviathan Security Group, says his "generic" proof-of-concept code could be used to attack a variety of Web sites. The attack, while difficult to execute, could give attackers a very powerful phishing attack.

While the attack is extremely difficult to pull off - the hacker would first have to first pull off a man-in-the-middle attack, running code that compromises the victim's network - it could have devastating consequences. The SSL Authentication flaw gives the attacker a way to change data being sent to the SSL server, but there's still no way to read the information coming back. The attack exploits the SSL (Secure Sockets Layer) Authentication Gap bug, first disclosed on Nov. 5. One of the SSL bug's discoverers, Marsh Ray at PhoneFactor, says he's seen a demonstration of Heidt's attack, and he's convinced it could work. "He did show it to me and it's the real deal," Ray said. Heidt sends data that causes the SSL server to return a redirect message that then sends the Web browser to another page. A consortium of Internet companies has been working to fix the flaw since the PhoneFactor developers first uncovered it several months ago. He then uses that redirect message to move the victim to an insecure connection where the Web pages can be rewritten by Heidt's computer before they are sent to the victim. "Frank has shown a way to leverage this blind plain text injection attack into a complete compromise of the connection between the browser and the secure site," Ray said.

Their work gained new urgency when the bug was inadvertently disclosed on a discussion list. Last week, IBM researcher Anil Kurmus showed how the flaw could be used to trick browsers into sending Twitter messages that contained user passwords. Security experts have been debating the severity of this latest SSL flaw since it became public knowledge. This latest attack shows that the flaw could be used to steal all sorts of sensitive information from secure Web sites, Heidt said. Many high-profile banking and e-commerce Web sites will not return this 302 redirect message in a way that can be exploited, but a "huge number" of sites could be attacked, Heidt said. To be vulnerable, sites need to do something called client renegotiation under SSL and also to have some element on their secure Web pages that could generate a particular 302 redirect message.

With so many Web sites at risk to the flaw, Heidt says he does not intend to release his code immediately. The attack is similar to the SSL Strip attack demonstrated by Moxie Marlinspike [cq] at a security conference earlier this year. From the victim's perspective, the only noticeable change during an attack is that the browser no longer looks as though it's connected to an SSL site. Leviathan Security Group has created a tool that webmasters can use to see if their sites are vulnerable to a SSL Authentication Gap attack. Thierry Zoller, a security consultant with G-Sec, says that theoretically, the flaw could be used to attack mail servers. "An attacker can potentially highjack mails send over secured SMTP [Simple Mail Transfer Protocol] connections, even if they are authenticated by a private certificate," he said in an instant message interview. Because SSL, and its replacement standard, TLS, are used in a wide range of Internet technologies the bug has far-reaching implications.

Zoller, who has not seen Leviathan's code, said that if the attack works as advertized, it will be just a matter of days before someone else figures out how to do it.

Social networking site MySpace.com announced today that it has switched from using hard disk drives in its servers to using PCI Express (PCIe) cards loaded with solid state chips as primary storage for their data center operations. MySpace said the solid state storage uses less than 1% of the power and cooling costs that their previous hard drive-based server infrastructure had and that they were able to remove all of their server racks because the ioDrives are embedded directly into even its smallest servers. "We looked at a number of solid state solutions, using many different kinds of RAID configurations, but we felt that Fusion-io's solution was exactly what we needed to accomplish our goals," Buckingham stated. The PCIe cards, from Fusion-io Inc., have allowed MySpace to replace multiple server farms made up of 2U (3.5-in high) servers that had used 10 to 12 15,000 RPM Fibre Channel drives each with 1U (1.75-in high) servers using a single ioDrive . "In the last 20 years, disk storage hasn't kept pace with other innovations in IT, and right now we're on the cusp of a dramatic change with flash technologies," said Richard Buckingham, vice president of technical operations for MySpace, in a statement.

MySpace's new servers also have replaced its high-performance hosts that held data in large RAM cache modules, a costly method MySpace had been using in order to achieve the necessary throughput to serve its relational databases. Salt Lake City-based Fusion-io claims the ioDrive Duo offers users unprecedented single server performance levels with 1.5GB/sec. throughput and almost 200,000 IOPS. The system can reach such performance levels because four ioDrive Duos in a single server can scale linearly, which provides up to 6GB/sec. of read bandwidth and more than 500,000 read IOPS. The cards come in 160GB, 320GB and 640GB capacities. MySpace said its new servers using the NAND flash memory modules give it the same performance as its older RAM servers. A 1.28TB card is expected in the second half of this year. "Social networking sites and other Web 2.0 applications are very database dependent. Ethernet pipe," David Flynn, CTO of Fusion-io, said in an interview.

Our 320GB ioDrive can fill a 10Gbit/sec.

Microsoft made its holiday pitch Tuesday in New York giving a sneak peak at what its gadget lineup will look like. The OS adds improvements to Internet Explorer Mobile, new navigation tools, Flash Lite support, and the introduction of Windows Marketplace for Mobile - a new app store. (See Related: Review of Windows Mobile OS 6.5 HTC Pure) To me Windows Mobile 6.5 seems like a transitional step to a future OS - might it be called Windows Mobile 7? - that could pose a more realistic challenge to Android, iPhone, and other mobile operating environments on the consumer side. Here Microsoft stressed its portable music player Zune, Xbox, Windows Mobile 6.5 OS phones, and Windows 7. Microsoft's Robbie Bach, head of Microsoft's entertainment and devices division, said this season it will stress the integration of "lifestyles" with "work-styles." All eyes were on Microsoft's Mobile 6.5 operating system which was announced today.

As for Zune and Xbox, Microsoft says it will be rolling out a new feature that enables content downloaded to one of these devices to be played back on the other. Microsoft Zune representatives say the move will represent the first in a series of steps by Microsoft toward greater integration between various Windows-enabled hardware devices. The video quality will support an impressive 1080p high-definition (HD) video. In attendance Tuesday was phone makers Samsung, HTC, LG, Hewlett-Packard and Toshiba were all on hand delivering first looks at Windows Mobile 6.5 devices. Microsoft, though, faces increasingly visible competition from both the Google Android and Apple iPhone camps in a struggle to expand beyond its relatively good position in the corporate smartphone space. Also on hand were mobile carriers Verizon Wireless, AT&T, Sprint, Telus and Bell Mobility.

Today Verizon and Google announced a partnership to bring Android-based smartphones, PDAs, and netbooks to market later this year. At the CTIA show in Dallas, TX this week, Samsung and T-Mobile introduced the Behold II, a touchscreen phone that brings together the Linux-based Android operating system with Samsung's new TouchWiz user interface for one-touch access to the user's favorite features and applications.