Realmac Software acquires social app EventBox

EventBox, the one-stop shop for many of your social media needs, is taking a big step up in the world of Mac software. Last July, Macworld's James Dempsey dove into EventBox and all the socializing it has to offer, and I picked it as part of my $300 Student Challenge last month. Realmac Software, makers of RapidWeaver and LittleSnapper, announced Tuesday morning that it has acquired EventBox from its developers, The Cosmic Machine.

Instead of visiting separate websites to get your daily dose of Facebook, Digg, Twitter, Google Reader, Reddit, Flickr, Identi.ca, and even plain ol' RSS feeds, EventBox wraps them all into one polished, centralized application. You can create smart folders to organize your friends and information for the way you, erm, "work," upload photos to compatible services, and even send links to Instapaper for reading later. It even makes a few services work together in useful ways, such as letting you post Google Reader headlines to Facebook or Twitter right from inside the app. Realmac Software's acquisition means that EventBox will have more resources and room to grow, as Realmac is no stranger to bringing solid products to market. EventBox is now huddling into a cocoon, undergoing a transformative process that should finish in November.

RapidWeaver has long been known as a sort of "iWeb Pro" upgrade, and LittleSnapper quickly gained traction as a powerful "iPhoto for designers and web developers." EventBox doesn't currently have much in the way of competition as far as tackling such a broad sample of the social media space, so The Cosmic Machine and Realmac are already a step or three ahead of the game. When it reemerges, it will be renamed as Socialite. EventBox owners who purchased a license in the past will get a free Socialite 1.0 license, which will cost everyone else $20. Customers who scored licenses through MacHeist will receive an email with the option of purchasing a license upgrade at a discounted price. Realmac is soliciting feedback in its forums for what users want out of version 1.0 and beyond.

Large online payroll service hacked

In a somewhat unusual data breach, hackers recently stole the login credentials of an unknown number of customers of payroll processing company PayChoice Inc., and then attempted to use the data to steal additional information directly from the customers themselves. Hackers broke into the site and managed to access the real legal name, username and the partially masked passwords used by customers to log into the site. The breach, first reported by the Washington Post this week, took place on Sept. 23 and involved PayChoice's onlineemployer.com portal site. They then used the information to send very realistic looking phishing e-mails to PayChoice's customers directing them to download a Web browser plug-in to be able to continue using the onlineemployer.com service.

Users who clicked on the link to download the plug-in instead got infected with a username and password stealing Trojan. Each of the messages addressed people by their real names and contained their real username and passwords (partially masked), which had been harvested earlier from PayChoice. It is not immediately clear how many customers might have actually clicked on the malicious link. The company bills itself as the "national leader" in the payroll services and software industry and claims over 125,000 business customers. PayChoice, based in Moorestown, N.J, proivides payroll processing services and technology.

In an e-mail statement to Computerworld , PayChoice said today it discovered the security breach in its online system last Wednesday. "We are handling this incident with the highest level of attention as well as concern for our clients, software customers and the employees they serve," CEO Robert Digby said in the statement. The company has also engaged two outside forensic experts to help figure out the full scope of the intrusion. "PayChoice is determined to find the cause and extent of the breach and to take further measures to prevent a future occurrence," Digby said. Once the company discovered the breach, it immediately shut down the online system and instituted "fresh measures" to protect client information, the statement said. Steve Friedl, an independent security consultant, said he first heard of the breach last Thursday when a PayChoice customer informed him. But it appears very likely that the only data the hackers accessed was the information they included in the fake e-mails that PayChoice's customers received, said Friedl, who wrote about the incident in his blog . If hackers had in fact accessed on more data, it is highly unlikely that they would have resorted to sending out those additional e-mails to PayChoice's customers, and thereby running the risk of being exposed, he said. At this point, it is not clear what other information the hackers might have gotten access to, said Friedl who consults for a rival payroll services firm.

Friedl said the links in the phishing e-mails were to Websites hosted at Yahoo. The relatively poor English in the e-mails appear to indicate that those behind the attack were from outside the country, he said. The malware itself was a password-stealing Trojan that was designed to send the stolen information to a Web server in Sweden. Chris Wysopal, chief technology officer at application security vendor Veracode Inc., said the breach is interesting because it shows that hackers are looking for targets other than credit card numbers and social security numbers to steal. "The market is saturated with [stolen] credit card data," Wysopal said. As a result cybercrooks looking to monetize what they are doing are moving up to higher value attacks where possible, he said.

A credit card record that was worth $10 in the underground in 2007 today can be had for about 50 cents, he said. In this case, the hackers appear to have been trying to install keystroke loggers to get information that would have allowed then to access online banking accounts of PayChoice's customers, he said. "That is where they would have got tens of thousands of dollars," had they been able to pull it off. An online payroll service company such as PayChoice presents a "huge attack surface" to those looking for ways to compromise it, Wysopal said. "An application like that, which is exposed to the Internet, is susceptible to SQL injection, cross-site scripting," and numerous other Web application attacks, he said.

Want to make BI pervasive? It's the culture, stupid

Business intelligence software may have been around for several decades, but it remains an esoteric niche in most companies, according to an analyst. It's the people that often get in the way," said Dan Vessett, an analyst with IDC Corp. Unfriendly corporate cultures, not the BI tools or apps themselves, are preventing BI from becoming pervasive. "The technology has been around for a long time.

IDC recently conducted a study of 1,100 organizations in 11 countries measuring how pervasive BI is in companies, what factors helped make it more pervasive, and what "triggers" data warehousing architects and IT managers can use to the further the spread of BI in their companies. According to IDC, that was between 48% to 50%. Degree of external use, or how much it shared data with vendors or customers. In a speech Tuesday at Computerworld's Business Intelligence Perspectives conference in Chicago, Vessett said IDC measured BI's pervasiveness via six factors: Degree of internal use. Sharing BI data keeps customers loyal, Vesset said. Percentage of power users in a company. And canny BI users in industries such as retail can sell that data to generate non-trivial revenue, he said.

The mean was 20% in surveyed companies. Over five years, the average at surveyed companies grew to 28 from 11. Data update frequency. Number of domains, or subject areas, inside the data warehouse. While real-time updates can be indicative of heavy dependence upon BI, "right-time data updates" is more important. "Daily, weekly or monthly could be sufficient," he said. They still rely more on experience rather than analytics," Vesset said. Analytical orientation, or how much the BI crunching helped large groups or the entire organization make decisions, rather than isolated individuals. "The fact is that most individuals and companies are not data driven.

According to Vesset, these factors in descending order had the most impact on BI pervasiveness: Degree of training, not in the BI tools - "the vendors do a pretty good job" - but in the meaning of the data, what the key performance indicators (KPIs) mean, etc. Satisfied users will talk up the BI software, creating "BI envy" in other employees, helping spread the software's use. Design quality,or the extent to which IT-deployed performance dashboards are able to satisfy user needs. Unsatisfied users will go around IT and use Excel or some SaaS applications. Involvement of non-executive employees. Prominence of the data governance group.

Prominence of a performance management methodology. Vesset also listed a number of potential "triggers" for BI projects that IT should take advantage of:

Report: New net neutrality rule coming next week

Federal Communications Commission chairman Julius Genachowski will propose a new network neutrality rule during a speech at the Brookings Institute on Monday, the Washington Post reports. Additionally, the principles state that consumers are "entitled to competition among network providers, application and service providers and content providers." Broadly speaking, net neutrality is the principle that ISPs should not be allowed to block or degrade Internet traffic from their competitors in order to speed up their own. Anonymous sources have told the Post that Genachowski won't offer too many details about the proposed rule and will likely only propose "an additional guideline for networks to be clear that they can't discriminate, or act as gatekeepers, of Web content."  The Post speculates that the rule will essentially be an add-on to the FCC's existing policy statement that networks must allow users to access any lawful Internet content of their choice, to run any legal Web applications of their choice, and to connect to the network using any device that does not harm the network.

The major telcos have uniformly opposed net neutrality by arguing that such government intervention would take away ISPs' incentives to upgrade their networks, thus stalling the widespread deployment of broadband Internet. The debate over net neutrality has heated up over the past few years, especially after the Associated Press first reported back in 2007 that Comcast was throttling peer-to-peer applications such as BitTorrent during peak hours. Several consumer rights groups, as well as large Internet companies such as Google and eBay, have led the charge to get Congress to pass laws restricting ISPs from blocking or slowing Internet traffic, so far with little success. Essentially, the AP reported that Comcast had been employing technology that is activated when a user attempts to share a complete file with another user through such P2P technologies. The FCC explicitly prohibited Comcast from engaging in this type of traffic shaping last year.

As the user is uploading the file, Comcast would then send a message to both the uploader and the downloader telling them there has been an error within the network and that a new connection must be established. Both friends and foes of net neutrality have been waiting anxiously to see how Genachowski would deal with the issue, ever since his confirmation as FCC chairman earlier this year. Tim Karr, the campaign director for media advocacy group Free Press, said at the time of Genachowski's nomination that he was instrumental at getting then-presidential candidate Barack Obama to endorse net neutrality during his presidential campaign. Net neutrality advocates cheered when Genachowski took over the FCC, as many speculated that he would be far more sympathetic to net neutrality than his predecessor Kevin Martin.

The Net at 40: What's Next?

When the Internet hit 40 years old - which, by many accounts, it did earlier this month - listing the epochal changes it has brought to the world was an easy task. Businesses stay in touch with customers using the Twitter and Facebook online social networks. It delivers e-mail, instant messaging, e-commerce and entertainment applications to billions of people. CEOs of major corporations blog about their companies and their activities.

On Sept. 2, 1969, a team of computer scientists created the first network connection, a link between two computers at the University of California, Los Angeles. Astronauts have even used Twitter during space shuttle missions. But according to team member Leonard Kleinrock , although the Internet is turning 40, it's still far from its middle age. "The Internet has just reached its teenage years," said Kleinrock, now a distinguished professor of computer science at UCLA. "It's just beginning to flex its muscles. That will pass as it matures." The next phase of the Internet will likely bring more significant changes to daily life - though it's still unclear exactly what those may be. "We're clearly not through the evolutionary stage," said Rob Enderle, president and principal analyst at Enderle Group. "It's going to be taking the world and the human race in a quite different direction. The fact that it's just gotten into its dark side - with spam and viruses and fraud - means it's like an [unruly] teenager.

We just don't know what the direction is yet. It may doom us. It may save us. But it's certainly going to change us." Marc Weber, founding curator of the Internet History Program at the Computer History Museum in Mountain View, Calif., suggested that the Internet's increasing mobility will drive its growth in the coming decades. Sean Koehl, technology evangelist in Intel Corp.'s Intel Labs research unit, expects that the Internet will someday take on a much more three-dimensional look. "[The Internet] really has been mostly text-based since its inception," he said. "There's been some graphics on Web pages and animation, but bringing lifelike 3-D environments onto the Web really is only beginning. "Some of it is already happening ... though the technical capabilities are a little bit basic right now," Koehl added. The mobile Internet "will show you things about where you are," he said. "Point your mobile phone at a billboard, and you'll see more information." Consumers will increasingly use the Internet to immediately pay for goods, he added.

The beginnings of the Internet aroused much apprehension among the developers who gathered to watch the test of the first network - which included a new, state-of-the-art Honeywell DDP 516 computer about the size of a telephone booth, a Scientific Data Systems computer and a 50-foot cable connecting the two. We were confident the technology was secure. The team on hand included engineers from UCLA, top technology companies like GTE, Honeywell and Scientific Data Systems, and government agencies like the Defense Advanced Research Projects Agency. "Everybody was ready to point the finger at the other guy if it didn't work," Kleinrock joked. "We were worried that the [Honeywell] machine, which had just been sent across the country, might not operate properly when we threw the switch. I had simulated the concept of a large data network many, many times - all the connections, hop-by-hop transmissions, breaking messages into pieces. It was thousands of hours of simulation." As with many complex and historically significant inventions, there's some debate over the true date of the Internet's birth. The mathematics proved it all, and then I simulated it.

Some say it was that September day in '69. Others peg it at Oct. 29 of the same year, when Kleinrock sent a message from UCLA to a node at the Stanford Research Institute in Palo Alto, Calif. Kleinrock, who received a 2007 National Medal of Science, said both 1969 dates are significant. "If Sept. 2 was the day the Internet took its first breath," he said, "we like to say Oct. 29 was the day the infant Internet said its first words." This version of this story originally appeared in Computerworld 's print edition. Still others argue that the Internet was born when other key events took place. It's an edited version of an article that first appeared on Computerworld.com.

Microsoft issues XP, Vista anti-worm updates

Four months after it modified Windows 7 to stop the Conficker worm from spreading through infected flash drives, Microsoft has ported the changes to older operating systems, including Windows XP and Vista, the company announced on Friday. Conficker copied a malicious "autorun.inf" file to any USB storage device that was connected to an already-infected machines, then spread to any other PC if the user connected the device to that second computer and picked the "Open folder to view files" option under "Install or run program" in the AutoPlay dialog. In April, Microsoft altered AutoRun and AutoPlay, a pair of technologies originally designed for CD-ROM content, to keep malware from silently installing on a victim's PC. The Conficker worm , which exploded onto the PC scene in January, snatching control of millions of machines, used several methods to jump from PC to PC, including USB flash drives. Microsoft responded by changing Windows 7 so that the AutoPlay dialog no longer let users run programs, except when the device was a nonremovable optical drive, like a CD or DVD drive.

Four months ago, Microsoft promised to make similar changes in other operating systems - Windows XP, Vista, Server 2003 and Server 2008 - but declined to set a timeline. After the change, a flash drive connected to a Windows 7 system only let users open a folder to browser a list of files. On Friday, Microsoft used its Security Research & Defense blog to announce the availability of the updates for XP, Vista and the two Server editions. Links to the download are included in a document posted on the company's support site. Microsoft issued the updates almost three weeks ago, on Aug. 25, but did not push them to users automatically via Windows Update, or the corporate patch service Windows Server Update Services (WSUS). Instead, users must steer to Microsoft's download site, then download and install the appropriate update manually.

The Windows XP update weighs in at 3MB, while the one for Vista is about 7MB. The AutoRun and AutoPlay changes debuted in the Windows 7 Release Candidate (RC), which was available for public downloading from May 4 to Aug. 20 . Windows 7 is set to go on sale Oct. 22.

How to get fired

IT professionals can do a lot to avoid layoffs, but they may be unwittingly doing even more to make themselves a target for downsizing.

How to make yourself layoff-proof

"No one can get too comfortable in their position right now. If you get complacent and have no intentions of improving upon yourself, you will lose your job to that person – and there is always at least one – who is constantly looking for ways to better himself and add more value to the business," says Colt Mercer, a network engineer at Citigroup in Dallas and a Network World Google Subnet blogger.

Here IT professionals and career experts point out five ways high-tech workers could earn themselves a spot in the unemployment ranks.

1. Be invisible

Now is not the time to go unnoticed.

"It's not the time to shrivel and try to be invisible to management. Many people tend to default to hide-and-retreat mode when layoffs come up, but that could call more attention to you and make it appear you aren't contributing enough to be kept around," says Adam Lawrence, vice president of service delivery at talent and outsourcing service provider Yoh.

Even those working hard could unknowingly be at risk due to their in-office time. Some IT workers who operate from a home office might need to make a few extra trips into work to remind managers, in person, of all that they do.

"Being visible during downtime is a big deal. If you are always remote and people at the office don't see you as part of the team, that could cause problems," says Bryan Sullins, principal tech trainer at New Horizons in Hartford, Conn., and a Network World blogger covering Microsoft certifications and training. "Often it can be a case of out of sight, out of mind, and remote workers could unwittingly become a target to be cut."

2. Let skills stagnate

There may be no training dollars, but that doesn't mean managers won't be considering IT pros' lack of updated skills when making layoff decisions. Regardless of the current economic trouble, high-workers should always be looking for ways to advance their knowledge.

"IT staffers that don't maintain their certifications and stay trained show poor strategic thinking and will very quickly find themselves behind the curve," says Chris Silva, senior analyst at Forrester Research. 'Turning a blind eye to new technology and thinking it can wait will wear thin in a down economy. Managers don't want staff that add to the 'can't do' list in times like these."

And the employee who uses the excuse about lack of dollars won't make points when it comes to cutting staff.

"A pet peeve of mine is people asking companies for more than they are willing to give," says Rich Milgram, CEO of Beyond.com, an online job board. "There has to be some level of mutual understanding about what contributions can feasibly be made on both the employer and employee's side. There are low- and no-cost training options if the employee is willing to make the effort."

3. Snoop in systems

It goes without saying that IT workers shouldn't abuse their access to company confidential systems, but industry watchers warn that if layoffs are going to happen, those high-tech pros with questionable practices will be the first to go.

"It is really easy for an IT person to see what others are doing and to look at confidential data, without being caught," says Beth Carvin, CEO of Nobscot Corp., a maker of employee retention and other HR-related software based on Kailua, Hawaii. "But if you are suspected of some shady stuff, that would be reason enough to bring your name to the top of the layoff list."

And even if the practices aren't breaking corporate policies, IT professionals need to be on their best behavior. Try to avoid abusing a flexible schedule with long lunches and don't use your high-tech position as a reason to spend too much time on the Internet for non-work-related activities.

"If you are the person viewed as someone just logging their hours to collect a paycheck and don't plan to contribute more than the minimum, management will see that and you will become vulnerable," says John Reed, district president with Robert Half Technology.

4. Make demands

Pay cuts, hiring freezes, layoffs – none of these factors suggest it's an appropriate time to ask for a raise. Yet experts say some will use their ongoing service to a company during a recession as a reason to demand more money and other benefits.

"Now is not the time to ask for a raise; now is not the time to complain about needing more time off," Sullins says. "In these cases, the squeaky wheel will get the shaft."

While it may seem to IT pros they are going above and beyond and deserve compensation for their efforts, those in the position to fire staff might not want to hear it.

"Right now, employees should be nodding their heads a lot, not being surly or pushing back on responsibility," says Sean Ebner, regional managing director for IT staffing and recruiting firm Technisource

5. Spew negativity

Employers now more than ever want positive attitudes on staff, and those spewing negativity will be weeded out.

"The truth is that everybody from a technical standpoint is replaceable. I notice more than anything the negativity an employee displays. Negativity is contagious, and once an employee goes that route, it is nearly impossible to turn them back," says Michael Kirven, principal and co-founder of IT resourcing firm Bluewolf.

Do you Tweet? Follow Denise Dubie on Twitter