Samsung Galaxy S3 review

The Samsung Galaxy S3 is the Ferrari of Android phones, with a gorgeous 4.8-inch 720p resolution display, an impossibly slim and light casing and a quad-core engine that goes like stink. This super-premium phone is very expensive, and the more you push it, the quicker it guzzles battery juice. It's certainly not a phone for everyone, but expect it to give the iPhone a good run for its money.Android Ice Cream SandwichGorgeous 4.8-inch 720p screenSlick lightweight designQuad-core processor Slot for microSD card TouchWiz interface can be confusingPremium price


Android fans can finally exhale -- Samsung's follow-up to the wildly popular Galaxy S2 is here at last. Simply dubbed the Samsung Galaxy S3, this beast of a phone packs a whopping 4.8-inch 720p-resolution display, quad-core processor and boasts a slick new design.
The S3 goes on sale in the UK from 30 May and is being offered free on two-year contracts from £26 a month (or more), or you can pick it up SIM-free for between £500 and £520.
The S3 comes in 16, 32 or 64GB storage options but it also has a microSD card slot so you can further expand its virtual shelves.
Marketed under the axiomatic tagline 'designed for humans', read on to find out exactly how humanising the S3 is as you poke and prod its shiny surfaces.
The S3 is not a phone for folk with modest mobile needs or small amounts of cash to spend on a blower. Happily, those guys are spoilt for choice -- with so many great mid-range Android phones to choose from which will serve their mobile masters as faithfully as Old Yeller.
The S3 is a phone for people with serious power needs and a healthy bank balance. If you want a device for 3D gaming, HD video streaming and browsing the web -- I don't mean faffing around with mobile versions of websites or lightweight apps -- the S3 has the superpowered engine and massive display you're looking for.
The rectangular shape of the S2 (right) is replaced with a somewhat retro rounded design.Indeed, this phone sits at the very top of the smart phone spectrum -- rival high-end Androids at this lofty price are hard to find. The main alternative is HTC's quad-core brute -- the One X -- which is actually more affordable than the S3 but not such a powerhouse, judging by our benchmark tests.
The monthly toll for the S3 could buy you Apple's top-of-the-range blower, the iPhone 4S. Its iOS software is generally slicker and easier to use than Android but won't appeal to people who really like to drill down, tweak, tinker and customise their kit. So it's horses for courses.
It goes without saying that S3 buyers aren't likely to need hand-holding where technology is concerned -- instead they'll relish the fine-grained opportunities Android opens up for customising and controlling your digital environs.
Samsung has ditched the rectangular look that dominated the S2, opting instead for an oval-shaped styling that's highly reminiscent of the Galaxy Nexus, which arrived in November last year.
Samsung Galaxy S3 camera
The S3 has shed its lumpy bits around the back, with the camera lens neatly flush with the casing.Corners are smoothed and rounded, while the curved back is devoid of the rear-facing lumpy bits that adorned the S2 and Nexus. The camera is now almost flush to the back of the casing, and along the edges is some swooping chrome decoration. Samsung's not ditched its button layout either -- there's a physical home button underneath the screen, with touch-sensitive menu and back keys on either side.
The placement of those touch-sensitive keys is slightly inconvenient. They're close to the edge of the phone, so you might find yourself accidentally triggering them with your hand.
The power key -- sited on the curved right-hand edge of the phone -- is also slightly troublesome. The chrome trim has a super-shiny coating so it's quite slippery, especially as it's sitting on a slight slope, and it also doesn't stick out much. The volume rocker on the left edge is much easier to lock on to. I also had no trouble firing the home key.
The Galaxy S3 retains its predecessor's physical home button.I don't expect the new look will please everyone -- some folks within the CNET UK office have said the rounded corners on the back look dated, reminiscent of smart phones from several years ago. On the other hand, a simpler design is often better, and this 'pebble' styling is comfortable in the hand over long periods.
The S3 comes in either blue or white. The white version is glossy, while the blue option sports a brushed-metal effect. Don't despair if you're a fan of sultry black mobiles as the blue option is such a dark hue that it almost looks black. Samsung has a habit of releasing its mobiles in different shades later on, so I wouldn't be surprised to see a pink version surfacing later this year.
The Galaxy S3 is 8.6mm thick and weighs 133g. That makes it ever so slightly thicker than the S2, which is 8.49mm deep, but thinner than the 8.9mm HTC One X. By comparison, the much smaller iPhone 4S is 9.3mm thick and weighs 140g.
Shock, horror, it's 0.11mm thicker than the S2.Millimetre one-upmanship aside, the bottom line is that the S3 is very thin and light considering its large size. The reason it's able to be so light is that -- like the S2 -- the Galaxy S3 is constructed from a significant amount of plastic. If you're averse to plasticky mobiles, the more substantial One X or metal-and-glass iPhone 4S might be more to your liking.
That said, despite all this plastic, the S3 has a very tactile and luxurious feel. The pebble design is a real pleasure to hold and the slender and light frame caresses the palm with no risk of weighing you down.
The back may be plasticky but it still retains a luxurious feel.The plastic also has a luxurious sheen -- at least on the white model -- yet also manages to be slightly grippy so the phone sits snugly in the hand without feeling like it wants to slip out of your fingers.
It's worth noting that this phone is absolutely huge, with a screen that trounces the 4.65-inch Galaxy Nexus, and is ousized only by the ludicrous Galaxy Note.
Despite this massive screen, the S3 still feels manageable, even for smaller-handed folk, thanks to that slender, rounded and tactile form. If you're someone who likes to get to all your mobile stuff with one hand, you will find yourself having to stretch to reach everything. But the advantage of all that display real estate is that photos, videos and apps really do look gorgeous.
Build quality has typically been a strong point for Samsung phones and the S3 is no exception. Despite being predominantly plastic, it feels impressively stuck together. The screen is solid as a rock and ample amounts of chrome trim keep everything in order.
I was able to make the phone faintly creak by squeezing it from the sides. But considering the S3 has a removable backplate so you can get to the battery, micro-SIM and SD card slots, then this is to be expected. Overall, build quality has a very premium feel.
The S3's display measures 4.8 inches on the diagonal which, as noted above, makes it one of the biggest smart phones currently available. Some S2 owners are going to be unhappy about this increase in size -- since the S2's 4.3 inches is already plenty generous. Some would argue it had a perfect amount of pixels for a phone. But while you might find your knuckles bending in new and exotic ways, the benefit is that this whopping display will make your photos and video look stupendous.
With a 1,280x720-pixel resolution, the S3 will do justice to your high-definition footage, as well as leaving icons and text looking impressively sharp. This is an HD Super AMOLED screen, which is the same display tech used on the Nexus and Note, both of which are a real treat for the eyes.
AMOLED screens offer eye-searing colours and very deep blacks. But as with previous Samsung gear, if you're a fan of more demure, natural colour reproduction, then you might find this panel a little garish compared to the iPhone 4S.
There's one minor downside -- the S3's panel is missing the 'Plus' suffix that you'll find on the Galaxy S2's Super AMOLED Plus display. That means that the S3's screen is likely using a PenTile display, which has one fewer sub-pixel per pixel than the S2's panel.
Screen enthusiasts may be disappointed by this news, but I suspect most people will never notice the difference. All things considered this is a mighty fine display. It's truly glorious to eyeball and has a very impressive viewing angle. At times, as you tilt the phone away from you, the screen almost looks unreal -- as if it's been printed on the surface of the phone. Stonking stuff.
The 4.8-inch 720p-resolution display is looking gorgeous.The S3's pixel density per inch is not actually the sharpest in smart phone town -- at 306ppi it's not quite as high-res as the Sony Xperia S (342ppi), or the HTC One X (312ppi), but this is really splitting hairs. Most people won't notice any difference in clarity and it's entirely possible to read text on a full website such as the BBC News home page when fully zoomed out.
Both Apple's iPhone 4 and iPhone 4S pack in more pixels (326ppi apiece) than the S3 does but arguably the two iOS devices need sharper resolutions, since their screens are a lot smaller (3.5 inches).
One area where the S3's screen did not knock my socks off is under direct sunlight. This is hardly surprising given that loads of smart phones struggle to outdo the sun's rays. However, the S3's display really struggles to make itself seen, with content ghostly and indistinct and a reflective blue sheen masking what's on the screen.
Too much sun is not a huge problem for Brits, but if you do need to use your mobile outdoors a lot then there are phones designed with outdoor viewing in mind.
The S3 sports a beefy quad-core processor clocked at 1.4GHz, which means it's more than capable of chomping through high-resolution video and graphically demanding games. As you'd expect, performance feels super-slick, with none of the sluggishness or lag that so often dogs Android phones.
A question hangs over whether quad-core processors are really needed, and you'll be hard pushed to find apps in the Google Play shop that stress the S3's processor to its limits. But what you do get is peace of mind, knowing that the S3 has a good chance of handling any demanding apps that crop up in the future. A more powerful processor also means the S3 is less likely to be left out in the cold when the next version of Android is rolled out.
With the broad display real estate, high-resolution and powerful processor, it's no surprise the S3 excels at web browsing. Websites not only look glorious on the S3's display but are typically very quick to load and render, and a real joy to swipe, pinch and flick around.
The S3 scored 1,498.9ms on the SunSpider JavaScript benchmark test, which evaluates a browser's speed -- beating the iPhone 4S's score of 2,181.6ms by a considerable margin, and more than halving the Samsung Galaxy S2's 3,445.3ms. Lower is better in this test as it's a measure of time taken.
Samsung Galaxy S3 browser
The browser zips along at twice the speed of the S2.The S3 even trumps the new iPad in this test. Apple's newest tablet scored 1,890.9 when we benchmarked it, while the iPad 2 was about the same 1,884.6 -- both taking slightly longer than the S3.
In the Vellamo browser benchmark test, the S3 scored 2,077 -- but was just beaten into second place by the HTC One XL (a phone that's not yet launched in the UK).
Despite this minor blip, there's no doubt the S3's quad-core chip is a high-calibre performer -- indeed, in the mobile world right now, the S3 is top of the power pops.
On the Antutu benchmark, which tests memory, CPU speed and graphics, the S3 scored a whopping 12,112 -- beating both the Asus Transformer Prime tablet-cum-laptop and streaking past the quad-core HTC One X. The latter managed an impressive, but not quite as good, 10,827 on this benchmark.
Running Quadrant's benchmark, the S3 again topped out the Android power charts, scoring 5,289. HTC's One X managed 4,904 on this test.
I also tested the S3's capacity to handle 3D graphics by running GL Benchmark's Standard Egypt test. The S3 ran this at a whopping 59 frames per second -- the same rate as the new iPad -- and slightly faster than the HTC One X's rate of 52fps.
All this power and the big screen definitely take a toll on battery life. The S3 comes with a removable 2,100mAh battery -- a welcome boon if you like to carry a spare (or two), which is one way to manage its voracious appetite for juice.
At full brightness, the screen gobbles battery faster than Cookie Monster omnomnoming biscuits, so you'll need to keep a weather eye on the little battery icon in the corner of the screen. Ideally you should avoid using the screen at max brightness for long periods.
With the screen set to half brightness, the S3's battery dropped from 100 per cent to 60 per cent after around 3.5 hours streaming an HD video over Wi-Fi (by comparison, the One X plummeted to 30 per cent battery in the same test). So provided you don't insist on dialling the screen up to max brightness, you should eke a full day's worth -- circa 6 or 7 hours -- of video streaming on a single full charge.
I also tested the S3's battery using Antutu's battery benchmark, which tests battery performance over several hours. The phone lasted 1 hour 12 minutes on part one of the test, dropping from 100 per cent battery to 73 per cent. It endured 1 hour 9 minutes on the second part of the test, dropping from 73 per cent to 46 per cent.
Overall, on the Antutu battery benchmark, the S3 scored 597, beating the HTC Incredible S, Motorola Milestone, Samsung Galaxy S2 and the LG Optimus 2X, among other devices. It was beaten by the Motorola Xoom tablet and the Acer Iconia Tab A500. (The One X failed to run this test.)
Expect to charge the phone every night -- or sooner if you're using it a lot or revving its engines too much. It's also worth noting the S3 is quite slow to charge over USB. If you need a lot of power quickly, you'll have to find a wall socket to juice up.
Samsung has added a power saver mode to the S3 that can be customised to limit the maximum performance of the CPU, dim the screen, change background colour in email and the Internet and turn off haptic feedback.
Of course, you could say what's the point of spending all this money on a beast of a phone, only to throttle it? Which brings me back to the question of whether quad-core isn't overkill for a mobile phone right now. But the S3's extremely slick performance does make it a joy to use -- with apps downloading and loading quickly, HD videos playing smoothly and menus and gallery photos zipping around, eager to do the bidding of your fingertips.
The Galaxy S3 is running on Android, Google's mobile operating system. Specifically, the S3 is powered by Android 4.0, aka Ice Cream Sandwich, which is the latest, greatest version.
It's not quite that simple though, as Samsung's plastered its own interface on top of Android. Called TouchWiz, this is the same colourful interface you'll see on kit like the Galaxy S2 and Galaxy Note.
There are new goodies on board, including a 'Pop up Play' feature that lets you watch videos while performing boring functions like sending a text, and a transfer tool called S Beam, which lets you send large files over a Wi-Fi connection.
Pop up Play worked well when I tested it -- allowing me to overlay and playback a mini version of a video I captured or stored on the phone. The video can be overlayed over a web page or app such as Twitter -- so you can both watch and tweet.
Voice control is on board too, now dubbed S Voice. This feature has been bundled into Android's Face Unlock capability -- so now you can choose to have the phone demand to see your phizzog and hear your voice before it unlocks.
S Voice goes toe-to-toe with Apple's own voice-controlled assistant, Siri. And like Siri, you can get S Voice to tell you the weather or perform tasks like making a call, setting an alarm, controlling music playback or taking a photo.
In an extensive comparison of the two virtual assistants, neither acquitted themselves terribly well. But S Voice was by far the worst of the two -- it had real trouble recognising my voice, was slow to process sounds and ultimately seemed gimmicky rather than genuinely useful. Most of the time it's much quicker to tap to get to the function you're after, rather than faff around with S Voice.
Setting up Face plus Voice Unlock took multiple attempts to run through the vocal stage as my efforts to use my own voice repeatedly failed to win the approval of a very disappointed-sounding female-toned S Voice. Eventually I managed to set it up -- but I can't imagine too many people will want to have to speak to their phone every time they need to unlock it (Sergey Brin excepted).
S Voice goes toe-to-toe with Apple's voice-activated assistant, Siri.The previously Apple-exclusive Flipboard app also makes an appearance. This app turns links and updates from your social networks into an attractive, magazine-style layout. Flipboard really comes into its own on the S3's large, glorious display, and can also live on your home screen in an attractive widget form.
Those with files to hoard will be happy to know the S3 comes with two years of online storage app DropBox, giving you an impressive 50GB worth of virtual disk space on which to plonk your files.
Other Samsung additions such as S Suggest, Samsung Apps and the Games Hub give you multiple ways to get to content you can download from Google's Play Store. At the time of writing, Samsung's Music Hub service wasn't yet up and running.
The much-trumpeted eye-tracking technology that keeps the screen on if it detects a face looking at it -- one of Samsung's 'designed for humans' touches -- is more irritating than useful. If you're watching the phone at an angle so your face isn't directly in front of it, it won't see you anyway. It also doesn't appear to be active on the home screens or app screens so it only kicks in when you're using apps, the camera or web browsing.
TouchWiz has buckets of competition, whether it's from Apple's iOS operating system, the 'raw' Android experience found on the Galaxy Nexus, or rival manufacturer Android skins like HTC's excellent Sense interface.
TouchWiz on the S3 looks polished, with lots of carefully drawn icons and easy-to-read fonts. But when it comes to easy of use, it's not always as well thought through as HTC's latest Sense overlay. At times, the intuitive action does not yield the hoped for result.
For example, adding widgets to the home screens is not done by long-pressing the place where you want to add the widget. Rather you have to dive into the apps view, switch to the widgets tab and then long press on a widget -- then move it onto the home screen position of your choice.
Samsung Galaxy S3 voice control
The latest version of Android, Ice Cream Sandwich, is a welcome addition on the S3.It's a minor quibble but one indicative of TouchWiz's tendency to be a tad gnomic. S2 owners won't have any trouble navigating the S3's interface since they're retreading familiar ground. Newbies will need to get accustomed to Samsung's way of doing things though.
Android is a powerful, flexible operating system that affords users loads of scope to customise and tinker with their phone. But the wealth of options and tools available can be overwhelming to newcomers, which makes having a really slick interface especially important.
If you're after something easy to use and don't mind sacrificing the ability to customise the look and feel of your phone, you'd be better served by Apple's iOS platform. Anyone who prefers freedom to muck about with their mobile, however, will enjoy digging into Android. There are scores of different versions of Android to choose from -- from 'vanilla' Android, straight as Google intended it, to the raft of manufacturer-crafted Android skins.
A risk you take with opting for a device sporting one of these skins is that you might be left waiting for updates, while those with 'vanilla' Android kit like the Galaxy Nexus are updated very quickly. The Samsung Galaxy S2 Ice Cream Sandwich update proved to be an omni-shambles -- worth bearing in mind if you love getting the latest version as quickly as possible.
The S3 has an 8-megapixel camera, which is the same resolution as last year's Galaxy S2. It might not have bumped up the pixel count, but this blower does have a few new tricks up its sleeve, including the zero-shutter-lag trait seen in the Galaxy Nexus, and a clever feature that automatically suggests your best shot after you've fired off a few similar snaps, basing its decision on factors like smile detection and face recognition.
There are loads of camera options to muck about with.A new feature, also seen on the HTC One X, is the ability to take still images while you're recording video -- perfect for when your pet is doing something adorable.
The S3's camera can be very good indeed -- producing excellent close-up shots, both indoors and out, and having an impressively shallow depth of field.
The level of detail on this close-up shot of a flower, plus the shallow depth of field, shows the S3's lens at its very best (click image to enlarge).Colours are generally true to life, with a slight tendency to oversaturate certain shades.
Let them snap cake! The S3 proves it can produce a droolingly good-looking photo (click image to enlarge).The lens can be a touch fickle when dealing with variable light conditions across one scene. I found it has a tendency to wash out parts of the scene, and it can also suffer from lens flare.
Southwark's church looks majestic on a hazy morning but there is a slight tendency to wash out the sky (click image to enlarge).On the plus side, it's good at dealing with the lower light of an indoor environment. Unless it's really dingy, clarity is good and photos don't speckle with noise.
If it's shallow depth of field you want then look no furtherb than the S3's cam (click image to enlarge).The S3 shoots Full HD video at 1080p resolution. Video results during testing were less impressive than the still shots, with a tendency to look hazy. Levels of detail also drop off with even relatively slow -- walking pace -- levels of movement in the frame.
Add to that, the S3 review unit I used had an audio recording glitch, which manifested in three videos I shot with the phone (listen to the audio in the two YouTube clips below). It's entirely possible this glitch is an isolated case on one faulty handset.
There's a 2-megapixel camera on the front of the S3 that's used for video calling, Face Unlock and Samsung's face detection feature -- which stops the phone's screen from dimming as long as you're looking at it.
As well as internal micro-SIM and microSD card slots, there's a 3.5mm headphone jack on the top edge of the phone and a micro-USB port on the bottom edge for charging the phone and transferring files, videos and music to and fro.
Like the S2, the S3 has a rear speaker. But instead of being sited down low, it's positioned right up towards the top of the phone, next to the camera. Sound quality is good but the audio doesn't go especially loud. At the top of its range, songs can have a slight crackle.
The position of the speaker can affect the quality of the sound. If you're looking at the face of the phone, the rear-sited speaker is blasting away from your ears. An arguably better position for a second speaker would be on one of the phone's edges. However, the S3's pebble design means there's precious little room there.
Call quality is excellent and I had no trouble hearing or being heard. I also didn't experience any dropped calls.
Contactless sharing technology, or near field communication (NFC), is also on board. That's good news if you're a fan of NFC tags.
There's no support for the fastest current 3G technology, DC-HSPA, though -- in either its 21Mbps or 42Mbps variant -- so be aware that this phone is very much a 3G-only blower, despite previous reports to the contrary.
With the Galaxy S3, Samsung hasn't messed with its formula much, recognising that slick design and a gorgeous screen were the secret to the Galaxy S2's success. The S3's oval shape may not be an instant eyeball grabber but those pebble-like curves are made to caress the digits that are holding it. To this enticing design, Samsung has added an upgraded engine -- making a phone that's pretty much unrivalled in the speed and power stakes right now.
On the down side, the TouchWiz interface is occasionally frustrating, and Samsung's app offerings don't always hit the mark. These minor software concerns aside, the S3 will undoubtedly be one of the year's most important gadgets. There are very few phones that come close to matching Apple's premium, luxurious feel, but with the S3, Samsung has got closer than anyone.
To get all the latest phone reviews, news and features beamed straight to your Android device of choice, head to the Google Play store and download the free CNET Android app today.
Update 10 May: This article was re-published onto a new URL.
Update 24 May: Republished as a review by Natasha Lomas. Additional testing by Luke Westaway.
Update 28 May: Battery benchmark tests added.
Editor's note: We'll be updating this review over the next week or so with more video, more photos and more benchmarks, so bookmark this page and keep checking back. We'll also check other handsets to make sure that audio bug in our test video was a one-off.

Apple's HTML5 bet against Android extermination

Open ... and Shut Harvard professor Clayton Christensen has more than 500 billion reasons to think he's wrong to suggest Apple is in for rough sailing, but he's not backing down. The father of disruption theory - a theory that Apple's former chief executive Steve Jobs claimed had a huge impact on his thinking - believes that Apple's end-to-end, integrated approach to innovation is susceptible to disruption from a more modular, open approach like that of Google's Android.

He could be right. But then, we've heard this before. (Proving that I can be consistently inconsistent, I've argued both for and against Apple's strategy.)

It takes a bold person to predict Apple's downfall even as it continues to grow from strength to strength, but Christensen is comforted by having the weight of history on his side:

The transition from proprietary architecture to open, modular architecture just happens over and over again. It happened in the personal computer, and although it didn't kill Apple's computer business, it relegated them to a minor player.

As much as Apple looks indomitable right now, there are signs that Christensen's theory will prove correct again. While Apple is crushing competitors in the relatively new tablet market, it has already lost its pole position to Android in smartphones. If the Android crowd can get its act together in tablets, this seems likely to play out in the tablet market as well. Indeed, despite a Q1 drop in market share, Amazon's Android-based Kindle Fire seems like it could be the first Android tablet to give Apple a serious run for its money.

It's possible that part of the delay in Apple's "inevitable" decline has come from the two sides – Apple (closed) and Google (open) – stealing ideas from each other's playbooks. Apple has continued its high-margin business model, but it has also consistently lowered prices to compete on price with alternatives from Samsung and others. (Whether it can cut prices enough to be competitive in emerging markets is another question, however.)

Apple, for its part, has married these price cuts with significant investments in open technologies like HTML5 support in its devices. Contrarily, Google's Android hasn't been a truly open alternative to Apple's integrated approach, dulling its effect as the knight in open armor.

Roger McNamee, managing director of Elevation Partners, channels Christensen, arguing that Apple has won precisely by betting against the openness of the web with a closed ecosystem. But this is only momentarily true, as McNamee holds that Apple's closed app ecosystem model will give way to an infinitely more open web app future built on HTML5. There are plenty of reasons for this, but at least one is the hit-or-miss success of app developers, in part due to the difficulty of getting noticed in an overburdened App Store.

But this is where Apple may have learned from Christensen's "Innovator's Dilemma". As noted above, Apple has actually surpassed Google's Android in terms of HTML5 support. Apple not only has the best closed app model, but it also has the best open HTML5-based web app model.

Perhaps. But as legendary investor Warren Buffett notes, even an investor as savvy as he did not predict Apple's last 10 years, and so he and other big brains can't reliably predict its next 10 years.

Still, one thing is a pretty safe bet: over the long haul, openness generally wins. When that openness is backed by Google's willingness to lose money on Android for years in order to seed the market, Apple has a strong competitor. The question is whether Apple, through HTML5 and other means, has been open enough to keep winning the mobile game. As Buffett goes on to say, you might not want to bet on Apple to win, but you wouldn't be wise to short it, either. ®

Matt Asay is senior vice president of business development at Nodeable, offering systems management for managing and analysing cloud-based data. He was formerly SVP of biz dev at HTML5 start-up Strobe and chief operating officer of Ubuntu commercial operation Canonical. With more than a decade spent in open source, Asay served as Alfresco's general manager for the Americas and vice president of business development, and he helped put Novell on its open source track. Asay is an emeritus board member of the Open Source Initiative (OSI). His column, Open...and Shut, appears three times a week on The Register.

Adobe sucks on Oracle brain drain for HTML5 game gain

Adobe seems to be juicing its software gaming credentials against HTML5 by grabbing some hard-core Sun Microsystems talent as they slip out Oracle's back door.

Four senior and respected members of the old Sun Hotspot Java Virtual Machine team jumped clear of Oracle during March and April, and all four have landed at Adobe.

The four are Paul Hohensee, who has been named principal computer scientist at Adobe, John Pampuch, who grabbed a spot as director of Flash VM, and Igor Veresov and Tony Printezis, who were both appointed as senior computer scientists at the software-maker.

A further two Sun VM brains – Charlie Hunt, a former performance lead engineer, and YS Ramakrishna – have also left Oracle, for Salesforce.com and a small private software firm respectively.

Until their exit, they'd occupied similar posts inside Oracle as technical staff directing HotSpot or working on engineering performance. Hohensee joined Sun in 1999 and Ramakrishna in 2002 while Veresov, Pampuch and Printezis joined in 2005.

The group's members all boast deep experience in garbage collection, memory management, compilers, HotSpot development and in languages – prized among anybody interested in squeezing out micro sub seconds of performance from their software.

According to his LinkedIn profile, Hohensee is working with Adobe managers and engineers on technical direction and delivery of a "high performance and extremely reliable product" and to "contribute to overall Flash technical direction".

Oracle inherited the team along with HotSpot when it acquired Sun in 2010. Adobe, meanwhile, has them working on its ECMAScript-based ActionScript language and associated VM, which is part of Flash Player.

In November 2011, Adobe shook up its Flash roadmap in the face of competition from HTML5 and growing resistance to Flash on devices, thanks to Apple's deceased co-founder and chief exec Steve Jobs. Adobe has recast Flash as the platform for something very specific, gaming, instead of being a generic media player for broad use everywhere.

The ActionSctipt VM had been part of Flash but with Flash being sidelined either the ActionScript VM must perform better minus Flash, or ActionScript must work better on other VMs: chiefly, HotSpot.

To help, Adobe is revisiting ActionScript, which has gone virtually unchanged since its introduction in 2006. "Adobe believes it is time to revise the language to carefully steer its further evolution towards greater expressiveness as well as productivity and performance gains," the firm said.

The idea is to make ActionScript better suited to the high-performance and hardware utilisation requirements of gaming, and to improve developer productivity. The wording of the roadmap plays right into the skills of the ex-Oracle team – a complete embrace of static typing and hardware-oriented numerics.

This is big: having killed Flash for mobile, Adobe is now focusing on the browser and device hardware. ActionScript is up against its ECMAScript cousin, HTML5, which everyone from browser-makers to tablet-lovers wants to get with. The planned changes are so extreme that Adobe has warned that existing apps might not work with the new ActionScript.

While Adobe will have recognised the value of the quartet it has hired, there was no word on their LinkedIn profiles on why they've all jumped clear of Oracle all at the same time. Oracle has certainly seen a number of former Sun brains leave, the biggest being Java daddy James Gosling.

It is not unusual for employees acquired by a new owner to leave and it's possible this group have left in the wake of the vesting of any share options they might have received from Oracle. Shares in such acquisitions are allocated in chunks over a given time period to help retain the talent. Vesting periods are typically six months, a year, two years and four years. ®

Oracle claims $777m in new trial over SAP infringement

TomorrowNow business balls-up haunts SAP

By Iain Thomson in San Francisco • Get more from this author

Posted in Business, 3rd May 2012 19:41 GMT

WIN - A free one year, 25 user licence of Microsoft Office 365!

Oracle is going back to court with a claim of $776.7m against SAP over the software-stealing antics of subsidiary TomorrowNow.

Larry Ellison's crew got an award of $1.3bn in 2010 after TomorrowNow admitted filching Oracle's intellectual property and taking it to SAP when the German software house bought the company out. Co-CEO Bill McDermott was forced to make a humbling apology to Oracle on stand and now the two companies are fighting over the damages.

TomorrowNow pleaded guilty to the code copying charges and paid a paltry $20m for its crimes, but the battle over the amount of damages oracle wants has been going through the courts for two years now, and will probably not be sorted by the end of the year.

SAP's initial $1.3bn charge was potentially increased by $211m after Oracle demanded interest payments as well, but the award was deemed too high by the appeals judge and reduced to $272m. Oracle said that wasn't good enough and appealed, initially for the full $1.3bn but it has since reduced its offer.

“We think Oracle’s damage estimate is overstated,” Jim Dever, a spokesman for SAP, told Bloomberg. ®

WIN - A free one year, 25 user licence of Microsoft Office 365!

Google unleashes Chrome 19, flattens 20 bugs

Google released a major update to its Chrome browser on Tuesday that tackles 20 security vulnerabilities, eight of which are classified as high-risk bugs.

Chrome 19 – a cross-platform update for Windows, Mac, Linux and Chrome Frame – also includes a number of improved features such as tab sync. Google paid security researchers more than $7,500 under its bugs bounty programme for identifying the various vulnerabilities squashed by Chrome 19.

Most of the high risk flaws patched by the new version of Chrome tackle either "out-of-bounds write" or "use-after-free" memory vulnerabilities.

The full list of vulnerabilities addressed in Chrome 19 is detailed in Google's advisory here.

In other patching news, Apple released a critical update addressing 17 security flaws in its QuickTime Media Player software. Several of the fixed vulnerabilities might lend themselves to attacks that plant malware onto the systems of users running pre-update versions of Apple's media player software. QuickTime 7.7.2 addresses a total of 17 security bugs, as explained in Apple's advisory here.

Rodrigo Branco, director of vulnerability and malware research at Qualys, discovered one of the critical bugs during fuzzing, a process that involves supplying a range of malformed data inputs to the application and checking for problems. ®

IBM smashes Flash out of Wimbledon, serves up HTML5 app

Next month’s Wimbledon tennis championship in London will serve up more player data than ever before and, for the first time, deliver live video to game fans over the web.

SPSS software from IBM will be deployed at all 19 courts and to capture information, draw up competitors’ stats and evaluate their performance.

The kit is increasingly used in other sports to analyse players and predict injuries; the Leicester Tigers rugby club uses Big Blue's analytics for risk assessment, for example. It has also been used to study play on Wimbledon’s outer courts, but 2012 will be the first tournament with SPSS covering every court, including centre court and court number one.

IBM’s software will crunch minutiae game data - such as how fast a player runs, the distance covered and speed of turn - that’s fed in manually and electronically to build up a stats-based picture on aspects of the game, such as returns and consistency of servers.

SPSS runs as part of the Wimbledon Information System (WIS) installed at the venue in southwest London and that uses DB2 on System x and Linux.

The output will be chewed over by pundits, pros and the public from online scoreboards that have been redesigned from Flash to HTML5 to help Wimbledon capitalised on growth in mobile traffic, specifically iPhones and Android. The expansion in the SPSS will mean more data served up to the web using HTML5 by the Wimbledon tournament than ever before.

The Wimbledon website got 450 million hits during the tournament’s two weeks last year, and 7.6 per cent of that traffic came from mobile. Between 10 and 20 per cent of that came from an iPhone app that IBM had launched in 2010 – the Android build arrived last year. IBM, meanwhile, is relying on HTML5 for the iPad instead of building a dedicated app at this stage.

“Traditionally our on-demand scoreboards have been built in Flash, and Flash let us be very visual in the way the information could be presented,” IBM's Wimbledon client and programme executive Alan Flack told The Reg. “But tablets don’t support Flash and we are seeing an increasing number of these.”

Andy Burns, IBM lead consultant, added that the tennis-watching mobile public wants more data and less graphics – the latter being something Flash basks in.

“We may have sacrificed some of the visual eye candy, but our site is not about that – it’s about providing the rich and accurate stats. Our fans want to see stats rather than fancy transitions. We don’t need the power of Flash. We are quite OK using the power of HTML5,” Burns said.

Scoring might be stripped down but video is on the rise and this year’s tournament will see live match play broadcast online for the first time from Wimbledon.com – a move OK’d by the Lawn Tennis Association.

Video will be encoded using H.264 and played using the Daily Motion player. There won’t be geographic restrictions on the live feeds, meaning it can be viewed anywhere.

Flack added: “Hits to the web site grow every year – whether that’s through mobile or traditional laptops or computers. Mobile is driving a lot of additional traffic. It’s probably bringing sport to a wider audience.” ®

Microsoft to devs: Don't ruin Win 8 launch with crap code

Microsoft has urged developers to only use approved Windows 8 software interfaces to avoid spoiling the launch of its new operating system with dodgy code.

In a stark warning this week, the company said third-party programmers should “resist the temptation” of invoking APIs that aren’t included in the official Software Development Kit (SDK) for the new Metro user interface.

Developers who flout this rule are in “violation of customer expectations and [Windows] Store policy”, the software giant said in a blog post titled “delivering reliable and trustworthy Metro-style apps”.

Using unofficial APIs, Microsoft said, is likely to “ultimately undermine the expectations that customers have for your app” if it crashes or plays up as a result.

John Hazen, a programme manager for the Windows 8 developer experience team, blogged here:

APIs that are outside the SDK are not guaranteed to work with Metro style apps either in this release or in future releases, so you may find that your app doesn’t function properly for all customers.

These APIs may also not function properly in the async environment that is foundational to Metro style app design. Finally these APIs may undermine customer confidence by accessing resources or data that Metro style apps would not normally interact with.

The advisory is a standard one from any operating system developer; technophobic punters often blame the OS maker when a program crashes because some smart arse cut corners, used unofficial APIs or tried an unapproved technique.

However the warning comes hot on the heels of Redmond locking down Windows 8 on ARM (Windows RT) to ensure handheld devices can't be jail broken to run homebrew and unapproved software. The company is keeping the mobile platform so closed, it’s denying access to rival Mozilla which had been porting Firefox to Windows 8.

Microsoft has created plenty of confusion between Windows 8 for ARM and Windows 8 for everything else; its Metro interface for phone and PC use completely different runtimes and frameworks, and they have different online software shops - Windows Store for Windows 8 and Windows Marketplace for the phone.

It would seem Microsoft is trying to keep these two worlds separate, and prevent an app built for the phone finding its way on to the PC, encountering not just technical problems but also ruining some careful market segmentation by Microsoft based on device type and software.

Reg contributor Tim Anderson pointed out that the greater danger Microsoft faces is the likelihood that coders will try to play fast and loose on Windows 8 for PCs rather than Windows RT.

It comes back to what we've said before on Windows 8: just like the first Windows Phone, Microsoft is keeping the ARM platform closed to third parties, whose apps could cause application crashes and ruin the consumer launch. ®

Google Street View Wi-Fi data slurper named

The 'Engineer Doe', who designed Google's Street View Wi-Fi software to collect personal data, has been named by an American newspaper.

The engineer is reportedly Marius Milner, developer of the popular NetStumbler wardriving programme for Windows. Milner describes his occupation as a "hacker" on his LinkedIn page.

Google initially denied collecting personal information using its street-mapping camera-car fleet, then admitted it had captured unsecured Wi-Fi traffic but blamed a lone gunman slurper: a so-called "rogue engineer" who wrote the software in his "20 per cent time permitted for self-directed projects".

An investigation by the Federal Communications Commission demolished this theory, however. The FCC found Google guilty of obstructing its investigation but concluded that collecting personal data from unsecured wireless networks did not breach the US Wiretap Act.

Privacy group EPIC says the FCC report "undercuts the company's prior statements that a rogue engineer was responsible for the payload data collection".

"Instead," the organisation added, "it indicates that Google intentionally intercepted payload data for business purposes and that many supervisors and engineers within the company reviewed the code and the design documents associated with the project."

Google itself released the FCC's report into its Street View data collection activities on Saturday, with most of the details readable - some portions remain redacted. Groups including EPIC and Consumer Watchdog have filed Freedom of Information requests to access all of the documents in the case.

An independent source code analysis of the engineer's work, commissioned by Google, is now available [PDF, 486KB].

A little business context, missing from most press reports on this story, is useful to remember here. It concerns a firm called SkyHook.

SkyHook is a Boston-based company that had already compiled a nationwide database of Wi-Fi access points. The biz merely collected SSID and signal strength - not personal data. SkyHook's database was used by licensees of Google's Android operating system for locations services. Eighteen months ago, SkyHook filed a suit claiming that Google had strong-armed Android licensees to use Google's location database instead of SkyHook's.

Far from being the work of a "lone slurper" tinkering in his own time, the software could be seen as creating an essential component of the Street View software stack. Google's Wi-Fi access point database was considered to be of enormous strategic significance.

Google's strategy after the data-slurp is proving to be much more interesting than the actual packet sniff. ®

Facebook launches App <strike>Store</strike> Center

It's just a gallery of mobile applications ... for now

Facebook is launching an App Center to recommend mobile applications based on demographic preferences as well as user ratings, just as long as they're tied into users' Facebook credentials – with a view to monetising the process eventually, of course.

The App Center won't just recommend mobile apps, it will also showcase web-based applications embedded in Facebook and even other websites, as long as they are based around the Facebook logon. Listing will be free, and users will receive recommendations based on their demographic and history rather than blanket star ratings, so the Center will look different to every customer who enters.

Facebook won't sell mobile applications – Apple would never permit such a thing – so users are directed to the appropriate app store (iTunes/Google Play, there's no mention of BlackBerry World) but Facebook is the company telling them what to buy and is now open for submissions.

But Zuckerberg's empire has commercial aspirations for its service, promising "a simple-to-implement payment feature that lets people pay a flat fee to use an app on Facebook.com", which is taking applications for beta testing now. For mobile apps that will have to jump though the app-store hoops, this would probably involve a cut going to Google/Apple, but for applications within the Facebook site it could be a useful source of revenue.

Facebook would love to make some money on mobile applications, it would be delighted to make some money on mobile anything – having identified that mobile users are growing in number but are almost entirely unexploited as far as generating revenue is concerned. Even if the App Center can't make money selling mobile app subscriptions, Facebook might be able to sell premium advertising on it, and should be able to filter out a lot of the kipple which blights the main app stores.

Targeting content based on social demographics, recommending things on the basis that one's Facebook friends liked it, has a bit of a chequered past. Google's social search has attracted more than its share of criticism, while Facebook's Beacon was treated with the derision it deserved, but app recommendations based on demographic as well as social factors and may be an acceptable thin edge of the wedge for consumers looking for the next Bubble Witch Saga with which to fill their time. ®

Apple blocking Dropbox SDK over in-app buying

Developers using the latest Dropbox cloud storage SDK have been having applications rejected from Apple after Cupertino apparently decided that its terms and conditions have been breached.

"We have found your app provides access to external mechanisms for purchases or subscriptions to be used in the app, which is not in compliance with the App Store Review Guidelines. Specifically, this app contains a link that takes the user to Dropbox via Safari," numerous developers reported, with one posting his correspondence online.

According to the correspondence, Apple is taking umbrage at having a link to the Dropbox website where users can sign up for an account. The basic Dropbox service is free, although there are paid options available for higher amounts of storage, and it's these that appear to be causing the problems.

"Apple is rejecting apps that use the Dropbox SDK because we allow users to create accounts. We're working with Apple to come up with a solution that still provides an elegant user experience," the company told The Register in a statement.

Forum posts suggest that older versions of the Dropbox SDK may be good to go as far as Apple's concerned. Dropbox employee Brian S. has posted a workaround.

"You need to use this version of the SDK that removes the create account option," he posted. "We're working on a better solution and will have more to share about that next week."

The fuss is certainly not what Dropbox needs right now. The company is under pressure from similar cloud offerings and needs all the application support it can get. ®

Apache releases new OpenOffice build, promises faster upgrades

The Apache Software Foundation (ASF) has released an updated version of the OpenOffice free software suite, with enhanced graphics and better encryption support.

Version 3.4 of the office suite has had major changes in the graphics capability of the package. OLEObject handling has been improved, thanks in part to volunteer coder Armin LeGrand, as well as support for scalable vector graphics and better chart rendering. Line cap graphics have also received an improvement that should improve the look and feel of the code.

Other new features include a speeding up of the boot process and better support for ODF, notably ODF 1.2 encryption, as well as multiple images within the format. The entire software suite is now also under the Apache License 2 regime.

This is the first major revision to the OpenOffice code since Oracle handed OpenOffice over to the ASF, and will go some way towards regaining ground on its rival LibreOffice. OpenOffice Podling Project Management Committee member Donald Harbison told The Register that more revisions were coming soon and the team is already considering additions to the version four release.

"We wanted to make sure we had a really clean and stable built for version 3.4," he said. "Within six to eight weeks we should be in a position to get to version 3.4.1 out and then we'll be working on version four with the help of code from IBM."

IBM is due to hand over a chunk of its Symphony code for the OpenOffice project, which had been on hold until version 3.4 was released, and other companies are adding features. SugarCRM is working on integrating sections of its code base and SourceForge has been helping with extensions, although these are outside the Apache license, as well as adding a new distribution channel.

The releases will go some way to making OpenOffice more relevant for users, after much of its support has moved to LibreOffice, a similar suite set up by defectors from OpenOffice who left when Oracle started sticking its oar into the project. LibreOffice is now on version 3.5 and is included in most of the major Linux distributions, as OpenOffice used to be, and is gaining both developers and customers in government and enterprise.

It's not all cut and thrust in the open source office suite world however. Plenty of developers code for both packages – indeed the new work on line caps was done by a female German academic who has a foot in both OpenOffice and Libreoffice.

Harbison said that so far demand for the new build of OpenOffice was strong, with a significant spike in downloads so far, and Apache would be bringing in new features like a British English dictionary and application control features, with future releases. ®

RIM shares take a bath after uninspiring BlackBerry 10 unwrap

Investors were less than impressed with Research in Motion's demo of its new BlackBerry 10 operating system and the developer tools to go with it, sending shares sliding by 5.76 per cent.

New CEO Thorsten Heins pulled out the new gear at his first BlackBerry World keynote speech yesterday, giving folks a look at what the OS should be able to do. The start of the conference also marked the release of the developer kit for the system so app-makers can start have some snazzy stuff ready by the time the first handsets come out at the end of the year.

BlackBerry 10 is widely seen as the last chance saloon for the troubled Canadian phone-maker, which has struggled to look like it's keeping up with the likes of Apple and Android. And RIM needs developers to make a ton of apps for the new OS if it has any chance of taking off.

However, investor confidence in the firm seems to have evaporated. The stock has plummeted 72 per cent in the last year, helped by a 5.76 per cent fall yesterday from the previous day's close, leaving the shares trading at $13.48 on the NASDAQ.

One problem may be that RIM still hasn't given out many clues about what the hardware to go with the new system might be like. At BlackBerry World, it handed out a prototype device to developers, the Dev Alpha, although the company said the actual mobiles won't look anything like it.

In general, RIM has not done a good job of reassuring investors that it can recover from the market share shrinkage caused by Apple and Android phone-makers like Samsung.

Aside from failing to come up with a smartphone that can claw back some BlackBerry popularity, the firm also suffered after a three day outage towards the end of last year that was handled horribly, and from low sales of its unloved fondleslab the PlayBook. ®

Apple OS X update puts elderly Flash out of its misery

Apple has pushed out a slew of security updates for Macs running Snow Leopard (OS X 10.6) and Lion (OS X 10.7).

The operating system upgrades tackle various bugs that leak sensitive information, elevate a user's privileges and, most seriously, allow malicious code to be injected remotely and executed.

The 10.7.4 update grapples with a flaw in FileVault which causes users file encryption passwords to be stored in a log file in plain text. Apple's Remote Desktop client is also updated in 10.7.4 but isn't included in the update pack for Snow Leopard.

Mac OS X 10.7.4 fixes more than 30 vulnerabilities in the core OS, including Apple applications such as Quicktime, and some bundled software packages such as Samba, Ruby and PHP. A similar update for Snow Leopard 10.6.8 is available as Security Update 2012-0002.

Apple's explanation of the security components on both its Mac OS X updates can be found here. Each update requires a system restart to take effect, as is the norm.

The updates also bring in a new build of the Safari web browser. The latest version, 5.1.7, includes a feature that automatically disables the Adobe Flash browser plugin when it gets out of date and prompts users to install the latest version. This is to stop outbreaks of viruses that exploit security holes in old Adobe software.

Apple recently automatically switched off elderly Java installations in an OS update after hundreds of thousands of Macs were infected by the Flashback Trojan.

The update was broadly welcomed by security experts including Wolfgang Kandek, CTO at Qualys here, and Paul Ducklin of Sophos here.

The desktop update follows hot on the heels of Apple's update for smartphones and tablets – iOS 5.1.1 – which was released earlier this week; that update addressed three vulnerabilities with updates to Safari and WebKit. ®

RIM takes BlackBerry 10 out for a spin, forgets to bring phone

Video RIM's latest CEO has been showing off what its next OS, BlackBerry 10, will do, although without any hardware it's hard to be impressed by a touchscreen keyboard.

The trinkets came out during the Thorsten Heins' first BlackBerry World keynote, where attendees were given glances of a multitasking interface that involves swiping away foreground apps, and a soft keyboard with predictions above keys instead of the whole board.

But what they didn't get to see was a BlackBerry 10 device and without that it's little more than slideware.

That's a little unfair: developers will get to play with a "BlackBerry 10 Dev Alpha" device upon which they can prep their applications in anticipation of the launch of proper hardware later in the year, but that's small consolation for those who were hoping to see some real hardware at the event.

Thorsten Heins has only been RIM's CEO for three months, so it's not his fault there was only a video to show. The presentation does look like a step up from iOS and Android, though, if only because it departs slightly from the touch vocabulary that has become established on the leading platforms.

"We're taking our time to make sure we get this right," he told the audience, which is probably a good thing - patience with RIM is already running out and the company can't afford another PlayBook.

RIM probably has one roll of the dice left to avoid becoming an acquisition, holding the bones a little longer is therefore the right thing to do even if it disappoints those waiting to see how they fall. ®

Java jury finds Google guilty of infringement: Now what?

Analysis No judge has tried harder than Judge Alsup, presiding over the Oracle-versus-Google case, to persuade two warring parties not to go to court. But he hadn't counted for the egos of the two billionaire Larrys.

The jury seems to affirm Alsup's instincts were correct. At the weekend, after five days of deliberating, the panel turned in its verdict on the first phase of the trial, covering copyright issues. The jury found Google to be unequivocally guilty of copyright infringement on the major charge, copying the "overall structure, sequence and organization" of Java for its mobile operating system Android. Google isn't guilty of infringing the Java documentation, the jury decided.

However, the jury was unable to reach a verdict on whether Google's use of the code was permitted under "fair use" - a US legal concept covering exemptions for special purposes such as literary criticism, accessibility for blind users, and so on.

Fair use has expanded to include very limited clean-room copying for compatibility purposes, and Google tried to use this to justify the use of Java APIs in Android. However, Alsup didn't like this argument, and so when some jury members wanted more time for their deliberations, the judge allowed them to leave the question blank.

Oracle, which had sought $1bn in damages, welcomed the interim verdict: "Google knew it needed a licence and … its unauthorised fork of Java in Android shattered Java's write-once-run-anywhere principle." Google wants a retrial. "The core issue is whether the APIs are copyrightable, and that's for the court to decide," the company said.

It's not as clear cut as either side would have you believe.

Google only appeared to realise late in the day that there could be collateral damage - giving it a small patch of moral high ground to claim. Defeat could potentially allow an extension of copyright into previously undisputed areas, such as programming languages and APIs.

For two years, much of the tech press has reported the skirmish as a patent dispute, perhaps not surprisingly as the initial fusillade from Oracle alleged infringement of seven patents. But as we noted at the time, "this is no simple dispute over the violation of patents, though". Oracle alleged code was copied, and what could be copied became fairly central to Oracle's case.

For its part, Oracle has presented damning and unequivocal evidence that Google knew it needed a licence if it was to build Android on Java, but it didn't negotiate one figuring it would face the consequences if and when they came.

But Sun's management during the 2005-2009 period, embodied in the catastrophic appearance of former Sun CEO Jonathan Schwartz at the trial, gave Google every comfort that the judgement day would never come. Schwartz, who had authorised millions of dollars to be spent on a happy-clappy "participation economy" ad campaign, welcomed on his blog Google's copying and fragmentation; hostile litigation didn't start until long after Oracle had acquired Sun and bundled Schwartz out of the door. That may have been enough to temper the damage Oracle wanted to prove.

Ultimately, it's Judge Alsup who will decide on whether he considers APIs to be copyrightable in this instance - and on whether Google's copying can be covered by fair use. The case is unusual, and troublesome for the entire software industry, because Java itself is quite unusual. It's a hairball (as former CEO Scott McNealy might put it) of many things: a runtime, a language, frameworks using that language, compatibility tests, and documentation. A precedent appropriate to Java may be used inappropriately elsewhere.

Potentially, the effects could be severely disruptive. Could IBM reclaim ownership of SQL, and for that matter, markup languages such as HTML - which are all descended from work originating at Big Blue? Or is Java such a singular case, that only extensively derivative copies, such as Android's implementation, could be contested? If those IBM examples sound absurd, then remember that absurdity is no obstacle to a determined litigant. Demanding royalties from ISPs for the use of HTML hyperlinks was pretty absurd, too.

Contrary to some reports, the situation remains ambiguous. Europe effectively threw the issue back to national courts to apply some common sense to the issue. "It is only through the choice, sequence and combination of those words, figures or mathematical concepts that the author expresses his creativity in an original manner," the European Court of Justice affirmed. Nobody wants to set a precedent.

The copyrighting APIs and languages is a Pandora's Box - and the trouble with a Pandora's Box is that nobody knows what's inside. ®

Atlassian warns of critical security flaw

Confluence customers urged to upgrade

By Simon Sharwood, APAC Editor • Get more from this author

Posted in Security, 18th May 2012 06:50 GMT

WIN - A free one year, 25 user licence of Microsoft Office 365!

Atlassian has warned of a critical security flaw in its Confluence product.

All versions of Confluence up to and including 4.1.9 are at risk, the company says, thanks to what it calls an “XML parsing vulnerability” that could lead to “denial of service attacks against the Confluence server” or allow intruders to “read all local files readable to the system user under which Confluence runs.”

Atlassian has provided fixes for all major versions of Confluence that are supported – 3.5.x, 4.0.x and 4.1.x. Hence, customers do not have to upgrade to 4.2 to fix the vulnerability.

Atlassian has posted a mitigation procedure, but warns the actions it recommends “will only limit the impact of the vulnerability … not mitigate it completely.” ®

WIN - A free one year, 25 user licence of Microsoft Office 365!

Microsoft ejects DVD playback from Windows 8

Digital media playback in Windows 8 has fallen casualty to the savage economics of the PC industry and changing tastes in consumer viewing.

We knew Windows Media Center would be sold at extra cost in Windows 8, but Microsoft now says you won’t be able to play DVDs on Windows Media Player in Windows 8.

If you do want DVD playback, then it’ll be a case of shopping judiciously and picking a PC whose manufacturer has licensed the codecs from a third party.

The twist? Windows 8 customers will end up paying more than others, as PC makers will likely be compelled to license the required codecs themselves to enable DVD playback.

In the latest Windows 8 blog, Microsoft said:

Windows Media Player will continue to be available in all editions, but without DVD playback support. For optical discs playback on new Windows 8 devices, we are going to rely on the many quality solutions on the market, which provide great experiences for both DVD and Blu-ray.

The development came as Microsoft separately announced a deal to use audio playback technology from Dolby in Windows 8. Microsoft will include Dolby Digital Plus 5.1 channel decoding and two-channel encoding in Windows 8.

To use this technology in their machines, PC makers will have to pay Dolby licensing and royalties.

What’s going on is an attempt to pare the costs of PCs and keep down the price and maximise the margins. In its blog post Microsoft didn’t say why it’s killing the Windows Media’s ability to play DVDs, but overall the blog talks about the broader decision to make Media Player available as a separate addition at extra cost.

Price is one factor: vendors will be looking to avoid the need to license codec decoders on all machines. The idea is only a small market would want DVD-ready PCs. The irony is Microsoft is one of the planet's biggest licensees of media codecs, with Apple and others behind H.264 for video compression licensed through MPEG-LA. H.264 is used in Windows Media Player.

There was a time when such licensing costs could have been lost in the cracks, but that time has passed. One factor is that the internet is killing DVD: “The vast majority” of video consumption on the PC and other mobile devices is coming from online sources such as YouTube, Hulu and Netflix, Microsoft says.

Another factor is margin: on the reseller front, companies could make 30 per cent on a PC at the dawn of the PC revolution in the mid-1980s by convincing happy shoppers to spring for peripherals and consumables (printer and ink cartridges) with their new machines. However, margins today hover between 3 and 5 per cent. ®

Skype slurping software threatens IP exposure

Code posted online that can skim the last known IP address of users is being checked out by Skype as a possible security flaw.

The software, posted on Pastebin, works on a patched version of Skype 5.5 and involves adding a few registry keys that allow the attacker to check the IP address of users currently online without calling them. Services like Whois will then give some other details on the city, country, internet provider and/or the internal IP-address of the target.

"I've tested this and it does what it says on the tin," blogged Nick Furneaux, MD of security researchers CSITech. "I was able to extract the external and internal IP's of a friend in the US to within a few miles of his house, a buddy in Asia to within a few streets and my own to just a few miles down the road. More concerningly the internal IP combined with the internet facing address provides the basis for a direct probe and then attack of any individual on Skype's global address book."

He said a website had been set up to provide an easier way to exploit the IP tracking but that it hadn't yet been checked out for malware. The site is down at present.

Before everyone panics, it is not clear if the problem affects the current corporate build of Skype or just the deobfuscated build mentioned in the posting. Skype, and presumably Microsoft given the amount of integration Redmond is planning with its code base, are no doubt hoping it's the latter situation. In any case, simply turning off the software when you're not using it minimizes any threat window.

"We are investigating reports of a new tool that captures a Skype user’s last known IP address," Adrian Asher, director of product security at Skype told El Reg in an emailed statement. "This is an ongoing, industry-wide issue faced by all peer-to-peer software companies. We are committed to the safety and security of our customers and we are taking measures to help protect them." ®

Chrome beats IE for a weekend

Google creeps up on leisure time browsing crown

By Simon Sharwood, APAC Editor • Get more from this author

Posted in Software, 8th May 2012 05:56 GMT

WIN - A free one year, 25 user licence of Microsoft Office 365!

Fresh from knocking off Microsoft's Internet Explorer as the web's most-used browser for a single day in March, Google's Chrome browser has now claimed more users than Redmond's HTML-cruncher for a whole weekend.

Data gathered by StatCounter shows Chrome has enjoyed a day of dominance on most weekends since its March ascendancy. On May 5th and 6th, however, it opened a gap over IE. Sunday the 6th even saw Chrome take a lead of nearly three percent.

Chrome beats IE for a whole weekend

IE still rules on weekdays, when use of the browser surges, presumably thanks to corporate drones diligent workers returning to the locked-down world of enterprise IT. But IE's days as the market leader may even be numbered in those environments, as Microsoft has recently announced SharePoint and Microsoft CRM will support other browsers. That move will mean workplaces have fewer reasons to insist on IE as the corporate standard. ®

WIN - A free one year, 25 user licence of Microsoft Office 365!

Mozilla and Google blast IE-only Windows on ARM

Mozilla and Google are crying foul over Microsoft restrictions blocking rivals from Windows 8 on ARM, due later this year.

Firefox-shop Mozilla has branded Microsoft's restrictions a return to the digital dark ages "where users and developers didn't have browser choices".

Harvey Anderson, Mozilla general counsel, accused Microsoft of restricting user choice, reducing competition and chilling innovation by only allowing Internet Explorer to run on Windows RT – unveiled last month by Microsoft as the new name for Windows on ARM (WOA). He said:

Only Internet Explorer will be able to perform many of the advanced computing functions vital to modern browsers in terms of speed, stability, and security to which users have grown accustomed. Given that IE can run in Windows on ARM, there is no technical reason to conclude other browsers can't do the same.

Mozilla Firefox director Asa Dotzler has weighed in with the technical argument:

On ARM chips, Microsoft gives IE access special APIs absolutely necessary for building a modern browser that it won't give to other browsers so there's no way another browser can possibly compete with IE in terms of features or performance.

Anderson and Dotzler said this violated a 2006 statement of principles (PDF) by Microsoft on choice, opportunity and interoperability, and are calling on Microsoft to live up to these principles.

Chrome-maker Google has thrown its weight behind Mozilla. In a statement to The Reg, a spokesperson said the search giant shared Mozilla's concerns about Windows 8's restrictions of user choice and competition.

Google's spokesperson said:

We've always welcomed innovation in the browser space across all platforms and strongly believe that having great competitors makes us all work harder. In the end, consumers and developers benefit the most from robust competition.

Microsoft's decision to lock down Win RT is not news: introduced as WOA in February, Windows chief Steven Sinofsky said WOA would only support a small number of existing Microsoft apps – Word, Excel, PowerPoint and OneNote with Internet Explorer 10. x86 apps would not run on WOA. WOA would be populated with apps via the Windows Store.

The reason for this was simple and came down to chipset and interface: ARM doesn't support native x86 apps while Windows 8 introduces the tiled and touch-based Metro UI.

For this reason, Microsoft has three development scenarios for Windows 8: Classic - Windows 7-style 32-bit APIs that won't work with Metro; Metro that lives in a sandboxed environment; and "Metro-style enabled" desktop apps that straddle Classic and Metro and call both sets of APIs.

Back in March, Mozilla said it would build a version of Firefox in this third category, with the same system-level parity as IE10, built using traditional Win32 calls and the Windows Runtime WinRT framework that Microsoft has devised for building Windows 8 Metro apps.

At the time Dotzler said: "We should be able to build a single product, that when installed into the Classic environment via traditional means – a download from www.mozilla.org – will be able to become both the default browser in the Classic environment and in the new Metro environment."

At the same time we at The Reg said while this sounded fine in theory, the two big questions would be whether Microsoft would actually permit rivals' browsers to install as the default on Windows 8 and whether Mozilla's work could be transferred to ARM.

Between then and now an answer has been delivered, and it seems this was the catalyst for Mozilla's outburst. In a report here, Anderson says senior Microsoft lawyer David Heiner told him other browsers would not be allowed on ARM. Whether this is a technical or political choice is unclear, although Anderson's implication is there are no technical hurdles.

Dotzler, who had been upbeat in March, now says:

Microsoft has made it clear that the third category won't exist on Windows for ARM (unless you're Microsoft) and that neither will the first category (unless you're Microsoft.) That means that IE on ARM has access to win32 APIs – even when it's running in Metro mode, but no other Metro browser has that same access. Without that access, no other browser has a prayer of being competitive with IE.

Microsoft supporters may dismiss Mozilla and Google, and feel that Redmond is being given a hard time over openness and freedom to install software while others, mainly Apple, enjoy a free pass; Apple also only allows one native browser on its platform for tablets and phones: its own, Safari.

Mozilla, however, feels frustrated because it sees a potential market slipping away by not getting Firefox on Windows RT. ARM dominates smartphones and while it's tiny in tablets today, it has big growth plans. This is the market Mozilla fears losing out on should it expand.

That said, Windows RT is unproven and little known commodity, so there's no telling how successful it will actually be beyond Microsoft's own infectious predictions – that Windows on ARM is its riskiest bet and biggest change in 30 years. We don't know what devices will run Windows RT – although we imagine it will be ereaders; how many types of device there will be; or how they will stand up to the competition from Apple or Amazon.

Microsoft was unable to comment at the time of going to press.®

Google Knowledge Graph straddles semantic web and <i>Star Trek</i>

Google’s battle to retain search supremacy is seeing it roll something it claims will take us closer to the "computers of Star Trek".

Google has unveiled The Knowledge Graph, which it claims will give you the answers you really want, we presume instead of a bunch of useless blogs, blue links or message fragments from Wikipedia.

Rollout of the Knowledge Graph has started for US English users and will be tailored to work and display on the limited screen space of smartphones and tablets.

This is more than the standard moving about of the bits around the screen or feeding in of crowd-surfed results from Twitter or Facebook, as Google and Microsoft (with its Bing search engine), have been doing in their attempts to outdo each other in recent years.

Amit Singhal, senior vice president of engineering, reckoned Google has studied in aggregate what users have been asking Google about, to gain a better understanding of what questions are asked and the way they are being phrased.

This might mean answers can be returned even when the question is typed or phrased incorrectly and that Google will present the returns cleanly. Web-watchers already have a name for this - they call it the “the semantic web” – which drills into unstructured data to make it categorisable and searchable.

Also, Singhal said, Google has worked on its algorithms so that they can determine the relationship between “things” – again ensuring relevant data is pulled back.

On this latter point, the social graph has its roots in that other great graph of Web 2.0 – the social graph used by social networks such as Facebook and LinkedIn.

These sift personal data and posts to link you to other people that you know and build up a comprehensive map of people. The CIA does a similar type of online digital matching to find terrorists and their unknown associates.

Singhal said: ”We’ve always believed that the perfect search engine should understand exactly what you mean and give you back exactly what you want.”

He closed: “We hope this added intelligence will give you a more complete picture of your interest, provide smarter search results, and pique your curiosity on new topics. We’re proud of our first baby step — the Knowledge Graph — which will enable us to make search more intelligent, moving us closer to the ‘Star Trek computer’ that I've always dreamt of building.“

It’s a grand claim and something that will get consumer tech titles and news organisations very excited, which is probably just what Google wants.

The search giant's forays outside its core market haven’t gone so well – Google Wave and Google+ being good examples – and Google killed off its Labs projects. It now sounds like the company is trying to recapture the intellectual high ground in an area where it remains strong by doing something it has already tried: improving the basic search and return process to see off Bing.

Only now it has a piece of marketing shorthand to bandy about Silicon Valley while it does this. ®

Now India snaps on gloves, bends Google over for antitrust probe

Google is undergoing an antitrust investigation in India, the Competition Commission (CCI) in that country confirmed on Monday.

The Economic Times, citing sources, reported over the weekend that the CCI was readying a competition inquiry into the search giant's "alleged discriminatory practices" relating to its AdWords business.

According to that news story, an investigation was ordered following the discovery of "prima facie evidence" that allegedly showed Google had abused its dominant market position by selling advertising keywords related to dating website Bharatmatrimony.com to the site's rivals.

"We have asked the Director General (Investigations) to complete the probe and give a report on it within 60 days. Prima facie, we found evidence that suggests that Google did abuse its dominant market position," a senior official at CCI reportedly said.

A complaint was filed with the commission by the India-based match-making website in February this year.

The AFP reported yesterday that CCI's secretary S.L. Bunker had said that the investigation would last "at least a couple of months". He added that the commission was probing the claims to see if they could be substantiated.

A separate probe into Google's business practices is already underway in the country. That inquiry is looking at claims that Mountain View may have breached domestic foreign exchange transactions regulations.

Google gave The Register this statement:

Though competition is always a click away, we understand that with success comes scrutiny. We have not received any communication from the CCI, but we're always happy to answer questions about our business, and we're confident that our products are compliant with competition law in India.

Google is getting use to regulatory scrutiny around the world as more and more companies gripe about the world's largest ad broker's business practices.

In June last year the US Federal Trade Commission formally began probing allegations that Google favours its own search products over those of its rivals. A similar but separate investigation into Google's actions has been ongoing in Brussels since November 2010, but, as we reported late last month, regulators in Europe are yet to conclude on their findings.

The European Commission confirmed to El Reg that it had once again delayed its response to just before the EU's summer break. Regulatory pressure is piling up for Google, but responses from individual watchdogs remain months away. ®

Apple updates iOS, mum on Wi-Fi, battery fixes

Apple has released an update to its iOS mobile operating system, version 5.1.1, which it claims remove some bugs and improves reliability of some options, but which does not address the wireless connectivity problems – well, at least not overtly – that have had some fanbois fuming.

The update, released Monday, is for the iPhone 3GS and later, the third and fourth-generation iPod touch, and the iPad and iPad 2 – presumably by "iPad", Apple means both the original iPad and the third-generation iPad, aka "The new iPad".

According to Apple's release notes, the update includes the following:

iOS 5.1.1 update information

There may be other fixes in iOS 5.1.1, but these are the ones that Apple wants to tell you about

Not included among the listed fixes, you'll notice, are any references to battery-life or Wi-Fi connectivity upgrades – two items that have caused consternation among purchasers of the third-generation iPad.

One bit of advice: if you should choose to upgrade your iDevice to iOS 5.1.1, don't do it through iTunes, but instead download it from your device itself at Settings > General > Software Update. The 5.1.1 update's iTunes-download file size for our first-generation iPad was 726.1MB; downloading it using the iPad's Software Update function was a svelte 42.3MB.

Three cheers for incremental upgrades, new in iOS 5 – though clearly not yet available through iTunes. ®

Nvidia launches Nsight CUDA dev tools into Eclipse

GTC 2012 Nvidia kicked off its GPU Technical Conference today by launching an updated version of its Nsight development platform that wraps around the CUDA compiler set and now interfaces with Eclipse-based integrated development environments.

Nvidia also unwrapped updated versions of the Nsight tools that plug into Microsoft's Visual Studio IDE, at the shindig in San Jose, California.

Nvidia obviously wants for graphics and HPC application developers to have an easier time coding on its GPUs and GPU coprocessors. Back in July 2010 the company rolled up a bunch of tools for GPU computing and graphics processing that were available individually and made a plug-in to hook them into the Visual Studio 2008 IDE to make it a snap for programmers working from the Windows environment to dispatch work to GPUs.

Parallel Nsight Standard Edition 1.0, as the original stack was called, included a graphics debugger and a graphics inspector. The graphics debugger could debug Microsoft's HLSL graphics shading language right on the GPU as it is running, and could also examine how shaders were executing in parallel on the GPU. The graphics inspector did real-time examination of DirectX calls and monitored the the GPU pipeline state as applications step through their code. It also had a pixel history function to show how each operation in the application affects any pixel on the screen.

With the Professional Edition, Nvidia tossed in a parallel debugger for compute - you can debug right on the GPUs and look at thousands of threads executing in parallel at the same time and use conditional breakpoints to fix their bugs. A system analyzer was also in this edition of the Nsight tool, which showed what instructions are executing in both the CPUs and GPUs on a timeline as applications run. Professional Edition cost $349 per seat while Standard Edition was free. Both ran on Windows XP, Vista, and 7 desktops, now support Visual Studio 2008 and 2010, and hook into GeForce and Quadro discrete graphics cards and Tesla GPU coprocessors.

Now, with the 2.2 release announced today, Nvidia has thrown all of the Parallel Nsight features into one pot (no more editions) and has made plug-ins available for both Visual Studio and Eclipse IDEs while at the same time branding the toolkit just Nsight. There are two editions: one for Visual Studio and one for Eclipse.

The Eclipse edition lets coders working from Linux and MacOS environments integrate with these debuggers and analyzers and hook into the CUDA compiler stack for GPU applications.

With the updated release, Nvidia is adding automatic code refactoring, which converts sequential CPU loops automatically into GPU kernels where they can execute in parallel on the GPUs. Nvidia is also adding in syntax highlighting and autocompletion for both CPU and GPU code (pity it can't just write all the code, eh?) and an expert code analysis system that can help programmers deal with bottlenecks in their hybrid CPU-GPU applications. The Eclipse edition makes use of the CUDA 5 toolkit, which is still in preview and which includes Nvidia's own C and C++ compilers.

With Nsight Visual Studio Edition, Nvidia is now allowing you to debug code on a single GPU. Before, you needed to have one GPU to run the code and one GPU to run the debugger and analysis tools. Now, if you have the CUDA 1.1 or higher compiler stack, you can get by with one GPU, which saves you dough and hassle.

Nvidia is also boosting the performance for the frame profiler and debugger, and supporting DirectX 9 frame debugging, frame profiling, and analysis. The Visual Studio Edition 2.2 also supports the CUDA 4.2 compiler stack and the new "Kepler" GPUs, too, which began their rollout in the GeForce graphics chips in March.

Nvidia is giving freebie versions of the Nsight tools away to coders that become registered developers; it was not clear at press time if Nvidia is charging coders that don't register if they want to use the tools with their Eclipse or Visual Studio IDEs. But Nvidia confirmed from the floor of the GPU Tech Conference that the tools are now free and that it has created only one edition of the Eclipse and Visual Studio tool stacks. You can download the Visual Studio Edition here and the Eclipse edition there. ®

Solving traffic jams with maths

A Swiss traffic management and transport economics expert believes a combination of queue management and computing can help solve the gridlock that plagues the modern city.

Dr Dirk Helbing of ETH Zurich, a professor of sociology specializing in modeling and simulation, says “self organizing” traffic control systems, using massively parallel, decentralized control, are needed to avoid gridlocks. The problem, he told Tages Anzeiger (in German) is the inflexibility of current traffic control systems.

Today’s designs over-generalize: traffic lights are phased for typical behavior for a particular time of day (and day of week), and cope badly with anything unexpected. As a result, traffic lights have no response to an accident at an intersection; the previous set of lights will continue allowing traffic into an already-congested section of road, and eventually, the congestion feeds back into the rest of the road network.

Instead of typical queues, Dr Helbing says, the system is suddenly asked to cope with “extremely varied” queues.

Using sensors to measure variables like the amount of traffic already in a road section, how quickly it is moving, and how long to the next change of lights, Dr Helbing’s approach is designed to respond to unexpected events.

For example, the system would detect that traffic on one section of road is slowing down or has stopped, and divert it to alternate routes to prevent the backfill causing gridlock.

Dr Helbing told Tages Anzeiger that the mathematical modeling needed to represent such complex systems was “my most difficult trial”.

While lobbying Zurich to trial the system, Dr Helbing says the city of Dresden in Germany has already taken the plunge, and is about to launch a trial. ®

Microsoft makes good with a 23-fix Patch Tuesday

Busy Wednesday for BOFH

By Iain Thomson in San Francisco • Get more from this author

Posted in Security, 9th May 2012 00:48 GMT

WIN - A free one year, 25 user licence of Microsoft Office 365!

It'll be all hands to the pumps in IT departments around the globe as Microsoft has issued this month's round of patches. There are 23 flaws to be fixed.

The seven patches include three critical issues, affecting Microsoft Windows, Office, Silverlight, and the .NET Framework. One patch, MS12-034, sorts ten flaws, some of which are publicly disclosed.

“Duqu was only designed to exploit specific instances of CVE-2011-3402 that were addressed last year. We have not received any information to indicate that the attack vectors addressed in bulletin MS12-034 have been publicly used to attack customers,” said Yunsun Wee, director of Trustworthy Computing at Microsoft.

Microsoft's second highest priority if a critical flaw in Word that allows remote code execution from malware accessed via email and websites. One exploit is in the wild but doesn't give admin access, and Office 2010 users don't need to fix this. ®

WIN - A free one year, 25 user licence of Microsoft Office 365!

BlackBerry 10 developer kit aims to unleash application tsunami

RIM has marked the start of its BlackBerry World conference by announcing the release of the developer kit for the much-delayed BlackBerry 10 operating system and handing out crippled prototype handsets that should go on sale by the end of the year.

"We’re extremely excited to release the BlackBerry 10 developer beta tools for general use,” said Christopher Smith, VP of handheld application platform and tools at RIM. “Developers can use this first beta of the tools to get started building apps for BlackBerry 10 and as the tools evolve over the coming months, developers will have access to a rich API set that will allow them to build even more integrated apps."

The download includes BlackBerry 10 Native SDK with Cascades that can handle C++ or QML code. A WebWorks SDK is included for HTML 5 and CSS development, with JavaScript bindings built in, and there's a beta version of a plug-in to allow limited Visual Studio development. The initial API bundle includes push management controls, payment systems, LED and battery control, and some gaming features.

The point of all this is to get a whole host of applications ready to go when the final hardware carrying the new operating system is released, hopefully by the end of the year for the crucial fourth quarter sales peak. RIM seems to have recognized that the lack of apps is a major turnoff for customers and is hoping the 2,000 developers attending the conference in Orlando can rectify that.

Attendees also were also given a BlackBerry 10 Dev Alpha handset to play with, although it's not capable of voice calls as yet (Wi-Fi and Bluetooth only) and uses a stripped down PlayBook GUI that should be changed before the final release. The handset comes with a 4.2-inch screen (larger than the iPhone 4S's 3.5 inches) capable of 1280×768 resolution, along with 1GB of RAM and 16GB of storage.

The hardware keyboard, a feature much beloved by many existing BlackBerry users, has been replaced with a software version and a new style of typing that uses predictive text and swiping motions to speed up wordage, as shown in the traditional promo video.

These devices are very much prototype designs, and look more like a PlayBook that has shrunk in the wash rather than a final product. But RIM is hoping there's enough there to get developers started, and hinted that the final screen resolution may stand, which visually would make the devices stand out. Whether they are desirable enough to tempt people for their Jesusphones is another thing entirely.

The company is also eyeing the Asian market, with a coding initiative designed to get Chinese university students writing applications for the platform. It will be distributing code and handsets to several universities and looking to find the best applications for the automotive and "mobility lifestyle" markets. ®

Google's latest webspam crusade 'breaks' search results

Google's latest search engine algorithm update – dubbed Penguin – is proving to be something of a dud, according to website owners not happy with the latest tweak.

The Chocolate Factory debuted its latest search engine optimisation (SEO) change last week, at which point its engineer Matt Cutts penned a blog post explaining the latest update.

He said Google, this time, was targeting webspam. The update is the latest tweak to Panda - the company's controversial search results ranking algorithm that the ad giant claimed had been designed to bury "low-quality sites" on its search engine.

Google's Panda and Penguin love. Pic credit: Matt Cutts

"I've been in SEO for 10 years and this is the worst update in Google's history. I've been tracking results in the 'vision improvement' niche for many years," said one narked-off website owner using the handle MarkMark5 on the TrafficPlanet.com forum.

He went on to use the example of the search query "repair vision" on Google, which returned completely irrelevant results including an outdated article and another page that displayed no content whatsoever.

An online petition has already been created by webmasters who are unhappy with the Penguin update.

It reads:

With the recent Google Penguin update, it has become nearly impossible for small content based websites to stay competitive with large publishers like eHow, WikiHow, Yahoo Answers and Amazon.

Countless webmasters have seen their livelihoods vanish overnight. In a recent interview, Sergey Brin came out against 'Walled Gardens' of the likes of Facebook... Ironically, the Penguin update has created a similar garden that only admits multimillion dollar publishing platforms.

On [a] personal level, this update has ruined small online businesses, passive incomes and families' livelihoods worldwide.

The petition has so far garnered 285 signatures.

Following the webspam update from Google, Cutts has told web owners via his Twitter account to "report post-Penguin spam" by filling out an online form.

The Register has asked Google to explain what it is doing about the gripes expressed by some webmasters in response to the Penguin update. The company hadn't got back to us at time of writing, however.

The Choc Factory claimed at the launch of Penguin that only 3 per cent of search queries would be affected by the webspam update. ®

Adobe backs down, patches critical Photoshop CS5 hole

Adobe backed down on Friday and promised to release a fix for earlier versions of its Photoshop software after previously insisting users who wanted to safeguard themselves from a critical security vulnerability had to pay for an upgrade.

A security flaw in Adobe Photoshop version CS5 and earlier means users could be exposed to malware providing they were tricked into opening a boobytrapped .TIF file. Adobe's initial response to the discovery of the flaw was an issue an advisory pointing out that users of the latest Adobe Photoshop version CS6 were immune to the cross-platform flaw. The software giant initially declined the issue a security patch for earlier versions of the software on the dubious grounds that because Photoshop "has historically not been a target for attackers", the risk level was supposedly low.

This view was mistaken for several reasons, including the plausibility of possible exploits and the fact that Adobe applications, in general, have become a prime target for hackers over the last two or three years.

Instead of offering a security patch, Adobe initially advised users of earlier versions of Photoshop to "exercise caution" over what files they open with their applications. If that wasn't good enough then an upgrade to Adobe Photoshop CS6 would do the trick, at a cost of $199 (£124) or more. Adobe Photoshop CS6 was only released in early May 2012, just days before the security issue with earlier versions of the product became public knowledge.

Photoshop version CS5.5, released last year, doesn't need to be patched.

Adobe Photoshop version CS5 is around two years old and certainly not a discontinued product. The widely used application remains on sale through various channels.

Adobe Illustrator CS5.5 and earlier, and Adobe Flash Professional CS5.5 (11.5.1.349) and earlier are also vulnerable to the same vulnerability. In each case users were initially advised to upgrade to the CS6 versions of the expensive design product if they wanted security software.

Security watchers wasted little time on heaping scorn on Adobe's stance, arguing that the vendor was abusing its monopoly position and pushing its customers towards choosing between paying for a security upgrade or leaving themselves at greater risk of hacking attacks. They said Adobe was effectively charging paying customers for security fixes.

"Adobe has abdicated this responsibility," Graham Cluley, senior technology consultant at security vendor Sophos argued. "It has found a critical vulnerability — a security flaw in Photoshop CS5 — that puts its users at risk, and instead of fixing it, the company is advertising the fact that there is a problem where the solution is that you pay for an upgrade to Photoshop CS6."

Photoshop users also vented their frustrations on social networking websites.

As late as Friday afternoon, in response to questions from El Reg, Adobe continued to defend its controversial no-patch-for-CS5 stance.

While Adobe did resolve the vulnerabilities addressed in the security bulletin you are referencing below (APSB12-11) in the Adobe Photoshop CS6 major release, no dot release was scheduled or released for Adobe Photoshop CS5.

In looking at all aspects, including the vulnerabilities themselves and the threat landscape, the team did not believe the real-world risk to customers warranted an out-of-band release for the CS5 version to resolve these issues.

The security bulletin for Photoshop is rated as a Priority 3 update, indicating that it is a product that has historically not been a target for attackers, and in this case we are not aware of any exploits targeting any of the issues fixed. Installation of the upgrade is therefore at the user's/administrator's discretion.

Hours later, Adobe performed an abrupt U-turn and promised to issue a fix for Adobe Photoshop version CS5, something it should have done in the first place. Arguments advanced by Adobe last week – that the vulnerability was "theoretical" or that hackers weren't after its software – were shown to be weak and just plain wrong more than 10 years ago, as Microsoft would be able to testify.

Adobe has modified its original 8 May advisory to say it is developing patches for the critical holes in the CS5.x versions of Adobe Photoshop, Adobe Illustrator CS5.x and Adobe Flash Professional CS5.x. It's unclear when these patches will become available.

"Adobe has released Adobe Photoshop CS6 (paid upgrade), which addresses these vulnerabilities," the revised version of the advisory continues to say. "We are in the process of resolving these vulnerabilities in Adobe Photoshop CS5.x, and will update this Security Bulletin once the patch is available." ®