Cool Yule Tools: Best techie gifts for 2014

The National Santa Agency has a handle on what everyone wants.


Our motto: “He Sees You When You’re Sleeping, He Knows When You’re Awake…”
After months of investigations, cups of coffee and several arm-twisting interrogation tactics, the Cool Yule Tools staff of writers and editors has discovered a shocking truth. The government group that has allegedly been spying on us, known as the “NSA”, is actually a cover group for a little-known organization with headquarters near the North Pole. Yes, we are speaking of the National Santa Agency. (See full writeups on these products.)

Thanks to our "Special Agents" who contributed reviews: Keith Shaw, Craig Mathias, Neal Weinberg, Abigail Weinberg, Ken Mingis and Tom Lupien.

Phones, computers and other mobile goodies
A large majority of the subjects we were monitoring were VERY interested in acquiring a new mobile device, whether it was a new laptop, phone or tablet. But we think they'll be quite happy with these reviewed devices.

Apple iPhone 6 Plus
$299 for the 16GB model with 2-year contract; $749, contract-free

The iPhone 6 Plus represents the epitome of Apple's phone line, but if you're thinking of getting one as a gift, make sure your gift recipient can handle it. Literally. With a 5.5-in. "Retina HD" screen, this is one big phone -- the biggest Apple's ever made and its first foray into the phablet market.

As you'd expect from an Apple device, the design and engineering are top rate, and the screen is pixel packed, with 401 pixels per inch. That means everything is razor sharp, colorful and bright. It's easily the best iPhone display Apple has produced.

Kyocera Brigadier smartphone
Price: $49.99 with two-year agreement, plus data plan

The Brigadier by Kyocera runs on Verizon’s 4G LTE network, and can take any kind of abuse you can dish out. We dunked it in water, dropped it on a hardwood floor, scraped the screen with a sharp knife. And nothing, not even a scratch.

Lenovo Horizon 2 Tabletop PC
$1,500 (our test unit, available via Best Buy)
When you lay this giant 27-inch computer flat on a table, the first thing people may think is that you somehow got your hands on the iPhone 7 Plus (a really really really big phablet). But in reality, it’s still a Windows 8.1 PC, but one with a touchscreen that multiple people can interact with. The Aura interface that overlays the Windows PC to provide the tabletop mode lets multiple people pinch, expand, shrink and move objects around on the touchscreen. While you can collaborate with co-workers via this method (looking at photos, or watching videos, for example), the majority of your time spent with this machine will be spent playing games.

Logitech k480 Multi-Device Keyboard
$49.99
You’re most likely to need/want a Bluetooth external keyboard when you acquire a tablet, but plenty of other devices (such as your smartphone and notebook) have Bluetooth as well, so it’s nice to have a single keyboard that can connect to multiple devices.

Logitech achieves this with its k480, a small, portable keyboard that includes a dial that switches between up to three devices, across multiple operating systems. If you want to connect a Windows PC, Android smartphone and Apple iPad, just turn the dial associated with each of those devices (it’s up to you to remember which device goes with each setting on your dial). The keyboard quickly and easily makes the Bluetooth connection to those devices. (See full review here).

Lenovo Y50
Starts at $1,089
I’ve been in the Mac camp for about three years now, about the same amount of time that Windows 8 has been out. But if I were ever considering coming back to the world of Windows, it would definitely be with this machine – the Lenovo Y50. The latest systems include fourth-generation Intel Core processors, a brilliant 15.6-inch full HD displays (touch-enabled, too), JBL speakers and a very cool backlit keyboard. I’m even coming around on Windows 8.1, if only a little bit (the return of the Start menu and easier access to the desktop definitely helps). (See full review here).

Lenovo N20p Chromebook
$329.99 (as tested)
Chromebooks have been out for a few years now, so the rough edges from earlier models have smoothed out, and Google seems to be doing a pretty good job at filling in the blanks of things that were missing from the operating system (remember, Chromebooks don’t use a traditional operating system like Windows or MacOS). You have to be invested in the Google universe, which means email will be done through Gmail, your browser will be Google Chrome, your productivity applications will be done through Google Drive (Docs, spreadsheets, presentations, etc.), and your music will be located on Google Play Music, etc. In fact, you might want to ask your friend, family or co-worker how comfortable they are with all of these Google offerings - if so, then it’s a definite recommend. (See full review here.)

Macally Quick Switch Bluetooth Keyboard
$69.99
It may seem like overkill to think that you would need one keyboard that quickly switches for use with five different devices, but you could find yourself in a scenario with two computers, a phone, a tablet and then you’re already up to four right there. Even if you don’t need five devices, it’s still a very cool option to have this functionality. In fact, you can connect a sixth device via the included USB cable, which is like Spinal Tap going to 11.

The keyboard itself is a full-sized keyboard with a very light touch and feel - it’s so light that you could carry it with you if you had a big enough laptop bag (it’s the width, not the weight that would be limiting).

REPORT #2: Audio Entertainment (Headphones, Music, Speakers)
After mobile devices, the next most popular item on holiday wish lists focus around musical entertainment. Whether speakers or headphones, we think these items will look great under the tree (or on your head).

Blue Mo-Fi headphones
$350
At first glance, the Mo-Fi headphones from Blue appear to be so large you'd never want to be seen in public with them. The headphones are big – very big compared with other headphones we’ve seen. They’re heavier, too. But the reasons for that will likely cause you to veto any concerns you may have. The extra weight and design are due to a built in audiophile amplifier and “ultra-premium drivers”, which give high-fidelity sounds to multiple devices – whether you’re listening on your phone, tablet, computer or even higher end A/V systems. Sure, this adds some extra weight, and you might get some odd looks while wearing these on your flight. But deal with it, you’ll enjoy the awesome sound compared to your seatmates listening on other headphones.
(See a full writeup of this product.)

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

11 Cyber Monday tech deals that truly save you serious money

Real deals, not cyber scams
If you want to see how morally bankrupt the post-Thanksgiving shopping season has become, just poke around online during “Cyber Monday.” You'll find many of our nation's major retailers marking up their list prices to advertise “savings” that don't actually exist, and pushing “limited-time” offers that are readily available elsewhere. But worry not; we've dug through these borderline scams to find 11 deals you should actually know about.

Motorola.com: Unlocked Moto X for $140 off
The 2014 Moto X is one of our favorite Android phones. You can customize it with different colors and textures (including real leather and wood), and it bucks the bloatware trend among Android handsets. Motorola's also good about updating its software—the Moto X is already running Android 5.0 Lollipop. The $140 discount starts Monday at 12 noon Eastern time.

Why it's a good deal: The discounted base price of $360 is killer for an unlocked “hero” phone, and AT&T or T-Mobile will give a discount on wireless service. [Link]

Best Buy: LG G3 for $1 on-contract
The LG G3 was this year's sleeper hit among Android phones, and unquestionably the one to get if you value camera quality above all else. With laser-assisted auto-focus, the G3 lines up shots quickly and excels in low light, so you rarely have to call for a do-over.

Why it's a good deal: Most carriers are still selling the G3 for its sticker price of $199 on contract. While that price will probably fall as the new year rolls around, it doesn't get any better than a buck right now. [Link]

Microsoft Store: Acer Aspire E15 for $399
The Aspire E15 is a run-of-the-mill budget notebook, with an Intel Core i5 processor, 4GB of RAM, a 500GB hard drive and a built-in DVD player. But because it comes from the Microsoft Store, it has none of the trialware and bloatware that comes standard on laptops from other major retailers. That alone makes it worth a look.

Why it's a good deal: This is one of the rare Cyber Monday laptop deals that packs Intel Core i5 power for $400. Just don't expect miracles from the display and build quality. [Link]

Newegg: Samsung 500GB SSD with Far Cry 4 for $180
With many new PC games gobbling gigabytes by the dozen, you're going to need a roomy solid state drive to run them at top speeds. Samsung's 840 EVO SSD has a whopping 500GB of storage and respectable read/write speeds of 540Mbps and 520Mbps, respectively. There's also a handy transfer tool for upgrading from a smaller drive.

Why it's a good deal: Newegg has a bunch of storage deals right now (including a $50, 128GB SSD from Sandisk) but $180 is darned cheap for a 500GB drive. The free copy of Far Cry 4 (normally $60) is the cherry on top for your new PC gaming rig. [Link]

Walmart: PlayStation 4 bundle for $449
Console bundles are everywhere this holiday season, but Walmart's $449 bundle will be hard to beat, especially for families. It includes the PlayStation 4 console, LittleBigPlanet 3, Lego Batman 3, your choice of another game, and a second controller.

Why it's a good deal : The PS4 normally costs $400, and most other holiday bundles are throwing in a game or two for free. This bundle has three games and an extra controller, so you're getting about $120 in value over other deals. [Link]

MacMall: 13-inch MacBook Pro with Retina Display for $1,030
Apple's current MacBook Pros are over a year old now, but they're still among the best professional-grade laptops you can buy. The discounted model has a dual-core Intel Core i5 processor, 4GB of RAM and 128GB of solid state storage, and it lasted nearly 11 hours in Macworld's battery test.

Why it's a good deal: You rarely see Apple products discounted by more than $100 on Black Friday or Cyber Monday, but MacMall's MacBook Pro deal manages to be $270 off the sticker price. [Link]

Google Play: LG G Watch for $99, $50 of Store credit
The LG G Watch, one of the first wave of Android Wear smartwatches, was quickly upstaged by classier-looking wearables such as the Moto 360 and LG's own G Watch R. Still, it does a decent job of showcasing how Android Wear works, and it's practically an impulse buy for the curious at $99.

Why it's a good deal : The $50 credit toward apps, videos and games from the Google Play Store effectively halves the G Watch's price if you were planning to buy some content anyway. You can still get the $50 credit when paying full price for a G Watch R, Asus Zenwatch, Samsung Gear Live, Sony SmartWatch 3 or Nexus 9 tablet. [Link]

B&H: iMac with Retina Display for $2,299
Apple's iMac with Retina Display is a fine piece of machinery, packing 14.7 million pixels into its 27-inch “5K” panel. B&H is knocking $200 off the base model, which includes a 3.5GHz quad-core Intel Core i5 processor, 8GB of RAM and 1TB of fusion drive storage.

Why it's a good deal: You don't often see big discounts on Apple products, especially brand-new ones. B&H's discount doesn't make the Retina display iMac cheap by any means—rather, a slightly easier splurge. [Link]

Microsoft Store: $100 to $150 off the Surface Pro 3
The Surface Pro 3 is a shining example of what a high-end Windows machine can be, weighing as little as an 11-inch MacBook Air but with a taller, higher-res touchscreen. Detach the keyboard cover, and you have a 1.7-pound tablet with a pen for sketching and a kickstand. Microsoft is knocking $100 off the price for Core i5 models, and $150 off for Core i7 models.

Why it's a good deal: The discount brings the base price to $1,030 with 128GB of storage and 4GB of RAM. That's just $30 more than a 13-inch MacBook Pro with similar specs. If you missed the same deal on Black Friday, now's the time to pull the trigger. [Link]

Staples: Acer Chromebook for $150
Like all other Chromebooks, this one can't run traditional Windows software such as Office and iTunes. But Acer's CB3-111-C670 Chromebook gets you online with a full mouse and keyboard at your disposal. It has an 11.6-inch, 1366x768 display, Celeron processor and 2GB of RAM, which should be all you need for basic browsing.

Why it's a good deal: Normally, Asus' competing 11-inch Chromebook is the slightly better buy, but these are two very similar machines. The $50 discount on the Acer is just enough to give it the edge. [Link]

Dell: 22-inch 1080p monitor for $99
The holiday shopping season can be a good time to upgrade aging computer monitors, and Dell's deal in particular is worth a look. The S2240L on sale for $99 has a 21.5-inch display, narrow bezels and a choice of VGA or HDMI input. The screen also tilts from 5 degrees down to 21 degrees up.

Why it's a good deal: You don't typically see 22-inch monitors of decent quality cracking the $100 barrier, so multi-monitor users may want to think about stocking up. You'll have to move quickly, though, as Dell says it will have limited quantities starting at 8 a.m. Eastern. [Link]

---

Best comptia A+ Training, Comptia A+ Certification at Certkingdom.com

Mozilla unveils search tool tweaks in next week's Firefox 34

New tools will accompany change from Google to Yahoo as default search engine for U.S. customers

Along with its impending switch to Yahoo as the default search engine for Firefox, Mozilla will also change how users conduct searches in the browser, the company said Tuesday.

Searches done in the next version of Firefox will display not only a list of suggested searches that narrow the results, but will show buttons for search engines other than the default, said Philipp Sackl, a lead designer of Firefox, in a blog post yesterday.

"These buttons allow you to find your search term directly on a specific site quickly and easily," Sackl wrote.

For example, a search for "US Grant" started in Firefox's default search engine can be switched to Wikipedia for results there by clicking a button.

Mozilla has implemented the changes in the beta of Firefox 34, which is scheduled for promotion to the finished, polished build next week. In the beta, Firefox 34 shows search-switch buttons for all available providers, including Bing, DuckDuckGo, Twitter and Wikipedia. Users can also add additional search engines.

Other browsers, such as Google's Chrome and Apple's Safari, lack similar tools, although Safari does offer a short list of suggested searches when a string is typed into its address bar.

Mozilla will introduce the search tweaks next week when it ships the production version of Firefox 34, currently slated for a Dec. 1 release. At the same time, Mozilla will also introduce Yahoo as the default search engine in the U.S.

"Under a new five-year strategic partnership ... Yahoo Search will become the default search experience for Firefox in the U.S.," Mozilla CEO Chris Beard said last week.

Beard's description implied that Mozilla will automatically change the default search engine within Firefox from the earlier Google to Yahoo for all U.S. customers. But in the beta of Firefox 34 the previous default -- Google -- remained in place.

Mozilla may face resistance from existing users if it changes the search engine to Yahoo without their permission when Firefox updates itself next week. Firefox users will be able to change the default to another provider, including back to Google, however.

Mozilla did not immediately reply to questions about how it will handle the change from Google to Yahoo within Firefox.

Firefox, unlike its browser rivals, will continue to use separate search and address bars rather than unify them into one field where users can type not only URLs but also search strings. Safari, Chrome and Microsoft's Internet Explorer (IE) all offer a unified address-search bar.

"That has been looked at several times, but there are difficult privacy problems to overcome if you also want to provide search suggestions," said Gervase Markham of Mozilla in an answer Wednesday to a user's comment appended to Sackl's post. "If someone is typing a URL, they don't necessarily want their default search engine to know where they are going. And yet, if you want to provide search suggestions well, you have to send every keystroke in a unified box to the search provider."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

BYOD forces users' personal information on help desk

Help desk staffers can be caught in the middle when BYOD users get verrrry personal with their devices.

As the recent scandal over leaked celebrity photographs reminded us all, people use their electronic devices for very personal pursuits in the era of smartphone ubiquity. Depending on the age and inclination of its owner, a modern-day digital device might contain not just nude selfies like those that were shared online, but images from dating sites like Tinder and Grindr, creepshots, or other salacious or even illegal material downloaded from the backwaters of "the dark Web" via anonymizers like Tor.

As blogger Kashmir Hill summed up as the selfie scandal was unfolding, "Phones have become sex toys."

If that's true, then those toys are making their way into the workplace in record numbers, thanks to the ever-increasing number of organizations adopting bring-your-own-device (BYOD) policies.

In a perfect world, none of this should concern help desk employees -- with a well-executed mobile management program in place that incorporates containerization, a technician ought to be able to assist employees with corporate apps and data without encountering so much as a pixel of not-safe-for-work (NSFW) material.

But the world isn't always perfect, as IT support staffers know perhaps more than most. Which means they can find themselves looking not just at enterprise applications but at private images and texts they'd really rather not see. Or politely pointing out to an employee who's synced all her devices to the cloud that pictures from her honeymoon are currently being displayed on the conference room's smartboard. Or repeatedly removing viruses picked up by the same users visiting the same porn sites.

The scope of the problem
In a survey published last year by software vendor ThreatTrack Security, 40% of tech support employees said they'd been called in to remove malware from the computer or other device of a senior executive, specifically malware that came from infected porn sites. Thirty-three percent said they had to remove malware caused by a malicious app the executive installed. Computerworld checked with several security experts, none of whom was particularly surprised by that statistic.

The ThreatTrack survey didn't tease out how much of this was on BYODs. But in a February 2014 survey by consulting firm ITIC and security training company KnowBe4, 34% of survey participants said they either "have no way of knowing" or "do not require" end users to inform them when there is a security issue with employee-owned hardware. Some 50% of organizations surveyed acknowledged that their corporate and employee-owned BYOD and mobile devices could have been hacked without their knowledge in the last 12 months. "BYOD has become a big potential black hole for a lot of companies," says Laura DiDio, ITIC principal analyst.

One big concern: As McAfee Labs warns in its 2014 Threat Predictions report, "Attacks on mobile devices will also target enterprise infrastructure. These attacks will be enabled by the now ubiquitous bring-your-own-device phenomenon coupled with the relative immaturity of mobile security technology. Users who unwittingly download malware will in turn introduce malware inside the corporate perimeter that is designed to exfiltrate confidential data."

Today's malware from porn sites is usually not the kind of spyware that's dangerous to enterprises, says Carlos Castillo, mobile and malware researcher at McAfee Labs -- but that could change. "Perhaps in the future, because of the great adoption of BYOD and people using their devices on corporate networks, malware authors could . . . try to target corporate information," he says.

In fact, a proof-of-concept application was recently leaked that is designed to target corporate data from secure email clients, Castillo says. The software used an exploit to obtain root privileges on the device to steal emails from a popular corporate email client, alongside other spyware exploits like stealing SMS messages. "While we still have not seen malware from porn sites that is dangerous to enterprises," Castillo says, "this leaked application could motivate malware authors to use the same techniques using malicious applications potentially being distributed via these [porn] sites."

Beyond security, there could be legal liabilities in play as well, some analysts caution. For example, a corporation might be liable if an IT staffer saw evidence of child porn on a phone.

To be sure, porn sites cause only a small fraction of the problems that users introduce into the enterprise. According to Chester Wisniewski, senior security advisor at Sophos, some 82% of infected sites are not suspicious places like porn sites, but rather sites that appear benign. And for smartphones, the biggest malware danger is from unsanctioned apps, not NSFW sites, he says.

Roy Atkinson, a senior analyst at HDI, a professional association and certification body for the technical service and support industry, sees no evidence of a widespread problem. When he specifically asked a couple of IT professionals who are responsible for mobile management in their organization, "they told me either 'we don't see it' or 'we make believe we don't see it,'" says Atkinson. "People don't really want to think about this or talk about it much."

Escalate or let it go?
Whatever the frequency, when and if NSFW issues do arise, the IT department often winds up functioning as a "first responder" that has to decide whether to escalate the incident or let it go. "If somebody complains about [a co-worker] displaying pictures on their smartphone at a meeting . . . then the company's acceptable use policy will come into play," says Atkinson. Or if IT employees find malware that came from a porn site and could endanger the network, they may say something -- to the employee or to a manager. "But as we know, policies are enforced somewhat arbitrarily," Atkinson says.

Barry Thompson, network services manager at ENE Systems, a $37-million energy management and HVAC controls company in Canton, Mass., says he has seen problems increase because of what he calls "bring your own connection." People assume "that it's their personal phone so they can do as they like," he says. But they are using the office Wi-Fi network, which Thompson monitors. He can see every graphic that passes through the network. "If I notice pictures of naked people, I can click on it and find out who's looking at that," he says. When that happens, Thompson usually gives a warning on first offense. If it happens again, he brings in the employee's supervisor.

It's like the Wild West out there if it's the employee's own device. -- Dipto Chakravarty, ThreatTrack Security

"It's like the Wild West out there if it's the employee's own device," says Dipto Chakravarty, executive vice president of engineering and products at ThreatTrack Security. Companies have a hard time enforcing their policies on BYOD devices, because it is, after all, the employee's device.

Often, the "old boy network" kicks in. The user "is petrified that IT will see all these bad sites that the user has visited," says Chakravarty. Employees admit they made a mistake and ask IT to please ignore the material. "IT doesn't really want to see the dirty laundry, so they say, 'Hey, no problem. I'll just wipe it clean and you're good to go,'" he says. "That's the norm."

The tendency to "cover for your buddies -- guys have been doing that for time immemorial," says Robert Weiss, senior vice president of clinical development with Elements Behavioral Health and a sex addiction expert. But there are social and ethical concerns for both the employee and for IT, says Weiss, co-author of the 2014 book, Closer Together, Further Apart: The Effect of Digital Technology on Parenting, Work and Relationships.

What happens, asks Weiss, when IT sees photos of naked children on someone's phone, which could be child porn, or repeatedly removes malware from porn sites from the same user's device, which could indicate an addiction? IT staffers are typically not well equipped to address criminal or addictive behaviors.

Weiss thinks there should be clear policies that indicate when IT needs to report such information to human resources, similar to policies about repeated drinking or signs of other addictions, and let HR take it from there. "The IT person should not be involved," he says. "I would not want to put the IT person in the position of having to talk about sex with an employee that they don't particularly know well."
I would not want to put the IT person in the position of having to talk about sex with an employee that they don't know well. -- Robert Weiss, Elements Behavioral Health

At least one technical analyst, who has worked in IT support at a range of companies, thinks reporting such users to HR is taking it too far. Flagging child pornography is one thing, he says, but addiction? "I'm not going to HR about BYOD riddled with porn. It's their device. As much as I love helping people, their personal porn habits, even at an addiction level, are not my problem. Unless it's criminal, I don't care."

Protecting IT from users
The ideal fix is to create a corporate container to hold all business applications, including corporate email and Internet browsing.

And the best way to achieve that goal is with the emerging class of enterprise mobility management (EMM) technology, says Eric Ahlm, a research director at Gartner. "When properly configured, EMM solutions create a corporate container that provides OS-level security and isolates apps and data in the container from what's outside," explains Ahlm. The corporate container can encompass email applications, Web browsers, customer mobile applications and off-the-shelf mobile applications. Within that container, IT can create isolated data-sharing and -protection policies, or easily deploy more mobile apps, or remove them -- all without touching the personal information outside of the container, he explains. "It makes all those issues go away."

On the personnel management side of the equation, companies should be sure to update their acceptable use policies to include BYOD. ENE's Thompson found that his company's acceptable use policy did not mention personally owned devices. So last year, says Thompson, ENE amended the policy to specify that "any use of corporate resources or systems, regardless of ownership of the devices, obligates the user to comply with the corporate acceptable use policy."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft's Surface turns first profit in 2 years

But gross margins -- between 9% and 13% -- aren't sufficient to sustain a profitable business

After two years and nearly $2 billion in losses, Microsoft's Surface turned a profit in the September quarter, the company said Thursday.

For the three months ending Sept. 30, Microsoft recorded $908 million in revenue for the Surface tablet line, an increase of 127% over the same quarter in 2013. The nearly one billion in revenue was a one-quarter record for the Surface, and beat the combined revenue of the previous two quarters.

Using information in Microsoft's filing with the U.S. Securities and Exchange Commission (SEC), as well as data from earlier quarters, Computerworld calculated the quarter's cost of that revenue at $786 million, leaving a gross margin of $122 million. Cost of revenue is the cost to make and sell a product, but excludes expenses such as advertising and R&D.

Microsoft said that the Surface line posted a positive gross margin -- implying that outside estimates of prior losses were correct -- but did not disclose a dollar figure.

According to Computerworld's estimate, the margin was small, about 13.4%. That's more than the average for a Windows personal computer, but less than half or a third of the margins on tablets like Apple's iPad.

It was even smaller by the figuring of Jan Dawson, principal analyst at Jackdaw Research, who has also used Microsoft's SEC filings to estimate the Surface's cost of revenue. He pegged the September quarter's cost of revenue at $825 million, the gross margin at $83 million, and the margin rate at just 9.1%.

"That's a gross margin ... which is not earth-shattering and in fact about half the gross margin of the phone business at Microsoft. But it's progress," Dawson wrote on his blog, where he published his analysis of Surface's financial performance.

Indeed.
Since its October 2012 introduction, Surface has been a money pit for Microsoft, in the hole to the tune of $1.73 billion through its first seven quarters. With the September quarter in the black, those overall losses have been reduced to about $1.6 billion.

Over the last four quarters, Surface also remained in the red, with losses of $325 million on revenue of $2.7 billion. Put another way, for each dollar Microsoft earned on Surface sales, it lost about 12 cents.

But were the brighter figures for the September quarter an accurate picture of what Microsoft really spent on the Surface? No, said Dawson and others.

"There's a long way to go to get to the kind of gross margins that would lead to true profitability once marketing and other costs are factored in," Dawson said.

Ben Thompson, the independent analyst behind Stratechery.com, agreed in his subscription-only Daily Update of Friday. "What is all but certain, though, is that this segment, once you include advertising and channel, was still quite unprofitable, and likely unprofitable by a lot," Thompson wrote of Microsoft's Computing and Gaming Hardware division, which generates the bulk of it revenue from Surface and Xbox sales.

Microsoft's advertising campaign for the Surface has been substantial, with widespread television spots, and its marketing spending has also been brisk, including a reported $400 million deal with the National Football League (NFL) that put Surface tablets on the sidelines.

Microsoft called out the Surface Pro 3, which went on sale in June -- making the September quarter the first complete quarter that booked Surface Pro 3 revenue -- in its earnings call with Wall Street for sparking the surge.

"Unit sales are pacing at twice the rate of what we saw with [Surface] Pro 2," said CFO Amy Hood, referring to the now-discontinued model launched in the fall of 2013.

"The release of Surface Pro 3 in June 2014 contributed to a 126% increase [in revenue], reflecting higher premium mix of devices sold," Microsoft said in the 10-Q filed with the SEC.

Thompson seized on the latter's "higher premium mix" to make the case for why Surface revenue jumped. He pointed out that the high prices of the Surface Pro 3 -- between $799 and $1,949 -- generated the increase, while the revenue in the comparative quarter of 2013 was fueled by large numbers of Surface RT tablets that Microsoft sold at fire sale prices to unload an overstock. Last year, Microsoft cut the price of the Surface RT to $349 for consumers and to as low as $199 for educational institutions, representing 30% and 60% discounts, respectively, from the original list price of $499.

Both Thompson and Dawson noted that Microsoft did not reveal Surface unit sales, making it impossible to determine which models have sold best or tell if volume was up, flat or down.

"We don't know the number of units sold or average selling price for the Surface, but considering that the Surface Pro 3 starts at more than double the price of last [year's third quarter] Surface RT, it's likely that Microsoft actually sold fewer Surfaces this quarter than they did a year ago," said Thompson.

"How many Surface devices did Microsoft sell in the quarter? Well, they won't say, but given the new version starts at $800, it's entirely possible that the company sold a million or fewer Surface tablets in total, and likely well under a million Surface Pro 3s in their first full quarter on sale," added Dawson.

As a comparison -- although Microsoft denies that the Surface Pro 3 is a tablet, preferring to dub it a notebook replacement instead -- Apple sold 12.3 million iPads in the same quarter, producing $5.3 billion in revenue.

Microsoft must do better if Surface is to be a viable business rather than a vanity project. "The gross margin has to keep moving up at this point," Dawson said in an email reply to questions. "It's at a point in its history when it has to get beyond the early losses to a sustainable business."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

11 ways to re-energize your IT career

Mid-career blues, begone. Here are 11 actionable items tech pros can tackle to keep moving on up in IT.

Stuck in the middle -- and blue?
Eric Reed knows a thing or two about mid-career pitfalls. He's seen some mid-level IT managers get too enamored with technology for its own sake, rather than viewing it as a way to advance business goals. Other would-be leaders didn't know how to communicate or collaborate with non-IT colleagues and were sidelined as techies rather than ID'd as future business leaders.

Reed is grateful he was able to overcome those challenges in his own career and sustain his momentum -- he's now CTO at GE Capital. With that goal in mind, Computerworld asked Reed and other seasoned IT pros for advice on how to keep your tech career from getting bogged down. Read on for their tips.

Develop a road map
It's smart to know not just where you want to land but how best to get there. Piera Palazzolo, senior vice president at Dale Carnegie Training, which specializes in business-oriented improvement, recommends starting with self-reflection. Map out the exact positions you'd like to hold and the ultimate title you'd like to achieve. "Then set a course for yourself and find out what you need to learn," Palazzolo says. Talk to your supervisor and other higher-ups in the company to determine how they can help you and whether your company's plans for you mesh with your own.

Gain new perspective
Managers often pay lip service to the concept of "walking the shop floor," but James Stanger, senior director of product development at CompTIA, an IT trade association, suggests going beyond the typical pat-on-the-back mentality. Instead, get to know how your direct reports, your colleagues and your customers view the world.

"In middle management, due to the demands of the job and just trying to get it done, people get these blinders on, and they don't think about how others think," Stanger says. Try asking: What do you think about this problem? What's your perspective? Can you explain your need here?

"Take those blinders off and you'll find yourself much more nimble in your thinking," Stanger says, which in turn will make you a better problem-solver -- a valued leadership quality.

Find leadership opportunities
To continue honing your leadership skills, look for opportunities that will get you noticed -- especially ones outside of your department. "Volunteer for a cross-functional task force that exposes you to senior leaders. Get out of your silo, and get more people in your organization to know who you are," says Carly Goldsmith, a career coach specializing in guiding mid-career professionals. She suggests seeking out projects and committees that will help you grow your skills.

One of her clients took Goldsmith's advice, joining a project that required her to have more interactions and strategic conversations with senior leaders. The move paid off: She was offered a promotion shortly after the project wrapped up

Be a perfectionist
Sure, no one's perfect, but if you're gunning for more responsibilities, you have to make sure you're doing your current job as close to perfect as possible.

Sean Andersen, director of interactive services at Six Flags Entertainment Corp., works with IT managers across the company's 18 theme parks. He says he notices the ones who "keep their house in order" -- consistently fulfilling all of their assigned duties, including routine and mundane tasks that often get overlooked. Andersen taps those individuals for special projects because they're most likely to be able to handle additional responsibilities.

Case in point: When the company launched a pilot program with the new Chromebox two years ago, he went to the manager who had everything else already under control.

Learn constantly, and share what you discover
To protect yourself from becoming technically obsolete as you move up in management and away from the tech trenches, you need to be constantly building and refreshing a well-rounded set of skills. "The idea is to be constantly learning," CompTIA's Stanger says. Take more classes, get another certification, earn an advanced degree, he says.

If you're like most workers, your current job requirements already fill your work week, which means you'll have to dig hard to find more hours for learning something new. Andersen, the Six Flags executive, says he carves out time -- usually late at night -- to read up on and test out new technologies. And he says he likewise has doled out plum assignments to direct reports who show similar initiative.

Compensate for your blind spots
Reed, the CTO at GE Capital, admits that in the past he often didn't think about the impact his decisions had on other people. "I'd sign onto an objective and put together a plan, but I was not thinking about the ramifications on the team," he says. He didn't realize the problem until someone on his team called him out on it.

Reed says his headlong decision-making style didn't kill his career, but it had done some damage with his business partners. Now that he's became aware of his blind spot, he works to keep it front of mind as he makes commitments that affect his team.

Bernadette Rasmussen, divisional senior vice president of information management and CTO of Health Care Service Corp. (HCSC), agrees with Reed's approach. "Listen to your team members, listen to your peers and listen to your business leaders," she advises.

Know how your business makes money…
It's not enough to have generic business acumen. That's required for most technologists these days.

To gain a leadership position, you have to know how your organization operates and, more importantly, how it makes money. "Some people get into middle management and they don't understand that. They don't understand that we're not here to implement neat technology. We're here to help the business make money," Reed says.

He recommends spending more time meeting with business colleagues to develop that insight and then using it to make smarter decisions within IT. Understanding which technologies have the biggest impact on the company's bottom line will help you prioritize projects and deliver the big bang that draws attention, Reed says.

… then use that knowledge to drive business results
As an IT middle manager, you most certainly need to know technology and must consistently deliver on your technology projects. As an aspiring C-level leader, your priority should be making sure those projects deliver a tangible benefit to the company. In other words, show your ROI.

"You must change your perspective from mastering technology to helping your organization drive results," says HCSC's Rasmussen. "Help connect the dots, drive change with perspective beyond your own and add your unique value," she advises.

Be the expert that people seek out
You need to be more than an expert to attain a corner office -- you need to be the expert.

Theresa Caragol learned that lesson during her upward climb. "You have to be the best and have the deepest expertise so someone says, 'If I want to understand this, I have to go talk to this person.' And if you're the expert in more than one technology, that's even better," she says.

Caragol, now global vice president for channels and partners at Extreme Networks Inc., positioned herself as an expert in software-defined networking at a previous employer. Her mentors helped line up opportunities for her to speak on the topic, which brought her to the attention of those in positions to promote her. She worked her way up to vice president of global channel, alliances and partners at Ciena Corp., her previous employer, a role that in turn served as a stepping stone to her current position.

Manage up and manage down
If you really want to shine, make sure your team does. And make your manager look good, too. After all, in almost all cases your boss will be the one to recommend you for top assignments and promotions. Have regular face-to-face conversations where you can talk about company objectives, professional goals and, yes, even your personal interests, says Dale Carnegie Training's Palazzolo.

Put the same effort into building relationships with your team, because you're only as good as the output you get from them. Vidhya Ranganathan, senior vice president of products and engineering at cloud-services firm Accellion Inc., takes a commonsense approach to building relationships. She regularly has lunch with her team and chats over coffee. "It's not to give them [formal] guidance, but to just listen and let them know I'm available," she says.

Avoid missteps
To make your rise through the ranks as painless as possible:
Don't wait for your manager to offer you opportunities. There's a reason why Microsoft CEO Satya Nadella recently found himself embroiled a firestorm of criticism when he urged women seeking a raise to "have faith in the system" rather than asking for what they want -- it's bad advice for all employees. "Too often, middle managers take a passive approach to their career advancement" -- including raises and promotions, career-coach Goldsmith says. "Go out and find the opportunities yourself.
Don't linger in a job you dislike or that's not well suited for you. "Motivation plummets, mistakes are made, stress increases. And whether you're conscious of it or not, you start to be seen as a poor performer," Goldsmith explains.
Don't get trapped in the weeds. According to Goldsmith, middle managers often do more hands-on work than they should. You need to move out of the tech trenches and lead your team, not code with them.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Startup proposes fiber-based Glass Core as a bold rethink of data center networking

Software Defined Networking (SDN) challenges long held conventions, and newcomer Fiber Mountain wants to use the SDN momentum to leap frog forward and redefine the fundamental approach to data center switching while we're at it. The promise: 1.5x to 2x the capacity for half the price.

How? By swapping out traditional top of rack and other data center switches with optical cross connects that are all software controlled. The resultant “Glass Core,” as the company calls it, provides “software-controlled fiber optic connectivity emulating the benefits of direct-attached connectivity from any port … to any other server, storage, switch, or router port across the entire data center, regardless of location and with near-zero latency.”

The privately funded company, headed by Founder and CEO M. H. Raza, whose career in networking includes stints at ADC Telecommunications, 3Com, Fujitsu BCS and General DataComm, announced its new approach at Interop in New York earlier this week. It’s a bold rethinking of basic data center infrastructure that you don’t see too often.

“Their value proposition changes some of the rules of the game,” says Rohit Mehra, vice resident of network infrastructure at IDC. “If they can get into some key accounts, they have a shot at gaining some mind share.”

Raza says the classic approach of networking data center servers always results in “punting everything up to the core” – from top of rack switches to end of row devices and then up to the core and back down to the destination. The layers add expense and latency, which Fiber Mountain wants to address with a family of products designed to avoid as much packet processing as possible by establishing what amounts to point-to-point fiber links between data center ports.

“I like to call it direct attached,” Raza says. “We create what we call Programmable Light Paths between a point in the network and any other point, so it is almost like a physical layer connection. I say almost because we do have an optical packet exchange in the middle that can switch light from one port to another.”

That central device is the company’s AllPath 4000-Series Optical Exchange, with 14 24-fiber MPO connectors, supporting up to 160x160 10G ports. A 10G port requires a fiber pair, and multiple 10G ports can be ganged together to support 40G or 100G requirements.

The 4000 Exchange is connected via fiber to any of the company’s top-of-rack devices, which are available in different configurations, and all of these devices run Fiber Mountain’s Alpine Orchestration System (AOS) software.

That allows the company’s homegrown AOS SDN controller, which supports OpenFlow APIs (but is otherwise proprietary), to control all of the components as one system. Delivered as a 1U appliance, the controller “knows where all the ports are, what they are connected to, and makes it possible to connect virtually any port to any other port,” Raza says. The controller “allows centralized configuration, control and topology discovery for the entire data center network,” the company reports, and allows for “administrator-definable Programmable Light Paths” between
How do the numbers work out? Raza uses a typical data center row of 10 racks of servers as the basis for comparison. The traditional approach;

Each rack typically has two top-of-rack switches for redundancy, each of which costs about $50,000 (so $100,000/rack, or $1 million per row of 10 racks).
Each row typically has two end-of-row switches that cost about $75,000 each (another $150,000)
Cabling is usually 5%-10% of the cost (10% of $1.15 million adds $115,000)
Total: $1.265 million

With the Fiber Mountain approach:
Each top-of-rack switch has capacity enough to support two racks, so a fully redundant system for a row of 10 racks is 10 switches, each of which cost $30,000. ($300,000).
The 4000 series core device set up at the end of an isle costs roughly $30,000 (and you need two, so $60,000).
Cabling is more expensive because of the fiber used, and while it wouldn’t probably be more than double the expense, for this exercise Raza says to use $300,000.

Total $660,000. About half, and that doesn’t include savings that would be realized by reducing demands on the legacy data center core now that you aren’t “punting everything up” there all the time.

What’s more, Raza says, “besides lower up front costs, we also promise great Opex savings because everything is under software control.”

No one, of course, rips out depreciated infrastructure to swap in untested gear, so how does the company stand a chance at gaining a foothold?

Incremental incursion.
Try us in one row, Raza says. Put in our top-of-rack switches and connect all the server fibers to that and the existing top-of-rack switch fibers to that, and connect our switches to one of our cores at the end of the isle. “Then, if you can get somewhere on fiber only, you can achieve that, or, if you need the legacy switch, you can shift traffic over to that,” he says.

Down the road, connect the end of isle Glass Core directly to other end of row switches, bypassing the legacy core altogether. The goal, Raza says, is to direct connect racks and start to take legacy switching out.

While he is impressed by what he sees, IDC’s Mehra says “the new paradigm comes with risks. What if it doesn’t scale? What if it doesn’t do what they promise? The question is, can they execute in the short term. I would give them six to 12 months to really prove themselves.”

Raza says he has four large New York-based companies considering the technology now, and expects his first deployment to be later this month (October 2014).

---

Best comptia A+ Training, Comptia A+ Certification at Certkingdom.com

9 cool Java 9 proposals developers will love

Modularity, JSON, smart compilation -- Java's future offers compelling features to look forward to

Cool Java 9 proposals developers will love
Java 8 arrived earlier this year to much fanfare, including high marks for lambda expressions and JavaScript on the JVM via Nashorn. But not everything about Java 8 was a love fest, and core developers at Oracle are already chalking up plans for the next version to improve Java.

Expected in early 2016, Java Development Kit 9, based on the Java Standard Edition 9 specification, is expected to include performance tweaks, new capabilities, and, most notably, modularity. While some proposed features could miss the final cut or be postponed to a later release, there's already a lot to like about Java's proposed future. Here is a preview of some of the most intriguing proposals for JDK 9 so far.

Modular source code
The most highly anticipated change to Java 9 will be modularity. Inspired by Project Jigsaw, which was deferred from Java 8 until Java 9, the effort to modularize Java's source code will be accompanied by a build system enhanced for this capability.

"Project Jigsaw aims to design and implement a standard module system for the Java SE Platform and to apply that system to the platform itself and to the JDK," according to JDK Enhancement Proposal (JEP) documentation. "Its primary goals are to make implementations of the platform more easily scalable down to small devices, improve the security and maintainability, enable improved application performance and provide developers with better tools for programming."

Multiple JEPs are planned as part of the modularization process.

Lightweight JSON API
Java 9 is expected to include a lightweight JSON API to facilitate the inclusion of JSON documents and data streams in Java programming.

"JSON has become the lingua franca for Web services and it is time for Java SE to adopt functionality for interacting with and utilizing JSON documents and data streams," a JEP document says. "This proposal is designed [to] provide the most commonly needed functionality and take advantage of Java 8/9 language and library features."

The JSON effort aims to enable Java developers to parse and generate JSON data. A generator style API for JSON data stream output and JSON literals is also a goal.

Process API updates
Java 9 is also expected to improve the API for controlling and managing operating system processes.

"The limitations of the current API often force developers to resort to native code," according to the process API JEP. Java SE presently offers limited support for native OS processes, allowing Java developers to simply set up an environment and start a process. Changes will require new unit and functional tests, according to the JEP.

OS differences mark the main risk facing this API, in particular Windows. "The design of this API needs to accommodate possible deployment on smaller devices with different operating system models. It should also take into account environments where multiple Java virtual machines are running in the same operating system process," the JEP states.

Segmented code cache
Java 9 aims to divide code cache into segments to improve performance and facilitate extensions.

"Instead of having a single code heap, the code cache is segmented into distinct code heaps, each of which contains compiled code of a particular type. Such a design enables us to separate code with different properties," the JEP states.

Top-level types of compiled code include JVM internal code, profiled and nonprofiled code, which would be separated. The organization and maintenance of compiled code has a big impact on performance, according to the JEP. Better control of the JVM memory footprint is a goal of this initiative, as is improved execution time for some compilation-intensive benchmarks.

Smart Java compilation, Phase 2
Java 9 proposes to improve the sjavac compiler tool, so it can be used by default in the JDK build. The tool is also expected to be generalized for use in other large projects.

"Due to various issues relating to stability and portability, sjavac is not used by default in the JDK build scripts," the JEP document states. "The first goal of this JEP is to resolve these issues. This involves making sure the tool produces reliable results on all software/hardware configurations at all times."

Currently, core developers have improved sjavac's build speed and allowed for incremental builds. "The quality of the code and stability of the tool as a whole, however, is not satisfactory and it is certainly not ready for public release."

Improve contended locking
Core Java developers aim to boost the performance of contended Java object monitors in the next iteration of Java, as measured by benchmarks and tests, including CallTimerGrid, among others.

"Improving contended locking will significantly benefit real-world applications, in addition to industry benchmarks such as Volano and DaCapo," JEP documentation states.

Performance improvements will be explored in a number of areas pertaining to contended Java monitors, such as field reordering and cache line alignment, as well as fast Java monitor enter and exit operations.

HTTP 2
Under development by the IETF, HTTP 2 aims to improve Web page loading times and API capabilities and is based on Google's SPDY networking protocol. "The focus of the protocol is on performance; specifically, end-user perceived latency, network and server resource usage," according to HTTP 2 documentation on GitHub. "One major goal is to allow the use of a single connection from browsers to a website."

Core Java developers are keeping an eye on HTTP 2 developments. "[This proposal is] basically looking at HTTP 2 and what is needed to support that," says Georges Saab, vice president of the Java platform group at Oracle and head of the Java Standard Edition group.

Cloud-optimized JVM
Core Java developers hope to enable users to better leverage existing cloud infrastructures with Java 9 by cloud-optimizing the JVM.

This proposal is all about helping with deployments of Java in the cloud, Oracle's Saab says.

Oracle already has been working on better enablement of cloud computing in Java EE (Enterprise Edition) 7. Plans call for building on that with Java EE 8, due in two years.


Ahead-of-time compilation
One common knock against Java is its relatively slower startup times. Java 9 proposes to fix this, by enabling ahead-of-time compilation to improve startup, among other benefits.

"The primary reason for adding ahead-of-time compilation to Java is improved startup time, but it may also bring other benefits such as smaller install footprint for self-contained Java applications that are bundled with a JRE [Java Runtime Environment]," says Henrik Stahl, vice president of java product management at Oracle.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Why Amazon is rebooting 10% of its cloud servers

Amazon says a patch is needed to fix Xen hypervisor issue

Amazon Web Services issued a blog post on Thursday providing some more details of why the company needs to reboot up to 10% of its cloud servers in the coming days, and it doesn’t have anything to do with the so-called Shellshock vulnerability.

Amazon says that about Elastic Compute Cloud (EC2) servers from across the globe will be impacted by what it calls a “timely security and operational update” related to its open source Xen hypervisor. The blog post explains:

“As we explained in emails to the small percentage of our customers who are affected and on our forums, the instances that need the update require a system restart of the underlying hardware and will be unavailable for a few minutes while the patches are being applied and the host is being rebooted.”

The full blog post can be read here.
It appears to be just a coincidence that an update to the open source Xen Hypervisor is happening at the same time that security experts have identified a major vulnerability in Linux code known as the Bash Bug, which some are dubbing Shellshock. AWS officials say the two events are unrelated.

Amazon likely deals with many vulnerabilities each day and week, but Jesse Proudman, founder and CTO of cloud provider Blue Box says this Xen bug is different because it effects the hypervisor that creates virtual machines. The only way to appropriately patch the system is to reboot it.

AWS goes on:
“While most software updates are applied without a reboot, certain limited types of updates require a restart. Instances requiring a reboot will be staggered so that no two regions or availability zones are impacted at the same time and they will restart with all saved data and all automated configuration intact. Most customers should experience no significant issues with the reboots. We understand that for a small subset of customers the reboot will be more inconvenient; we wouldn’t inconvenience our customers if it wasn’t important and time-critical to apply this update.”

Amazon says that the updates must be done before October 1, when details of the Xen flaw are made public as part of the Xen update XSA-108 release. Expect at that time AWS and the Xen community will have more details as to the specific security flaw that is being patched.

Proudman suspects the issue is likely related to flaw CVE-2014-7155 In the Xen code, which was first announced on Wednesday. It was found that the bug can be exploited by a hacker to escalate its privileges, allowing the hacker to potentially glean access to other virtual machines. In contrast, an issue like Shellshock is something that can be patched in the Linux code and does not require a reboot of the machine.

Proudman says the CVE 7155 has been in the Xen code since the 3.2 release, which was in 2008. Still, he says that customers should not be too worried about the situation since Amazon will be updating all of its impacted machines before more details about the security vulnerability are publicly released on October 1. Proudman says AWS is absolutely doing the right thing by updating its systems and rebooting customer machines, even if that may cause some stress in the coming days.

The big takeaway for customers is that a subset of AWS instances will be rebooted at some point in the next five days. Cloud consultancy RightScale expects the reboots to begin at 10 PM ET on Thursday and run through Sept. 30 at 7:59 PM ET. Customers don’t necessarily have to do anything, but they should be prepared for their EC2 instances to go down for a few minutes if they’ve been notified by AWS. RightScale advises AWS users to test their system for a reboot. “It’s going to test the operational prowess of a lot of systems,” Proudman says.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

'Bigger than Heartbleed' Shellshock flaw leaves OS X, Linux, more open to attack

Well, this isn't good. Akamai security researcher Stephane Chazelas has discovered a devastating flaw in the Unix Bash shell, leaving Linux machines, OS X machines, routers, older IoT devices, and more vulnerable to attack. "Shellshock," as it's been dubbed, allows attackers to run code on your machine after exploiting the flaw, but the true danger here lies in just how old Shell Shock is—this vulnerability has apparently been lurking in the Bash shell for years.

Why this matters: A large swath of the web-connected devices, web servers, and web-powered services run on Linux distributions equipped with the Bash shell, and Mac OS X Mavericks is also affected. The fact that Shellshock's roots are so deep likely means that the vulnerability will still be found in unpatched systems for the foreseeable future—though the odds of it directly impacting you appear somewhat slim if you use standard security precautions.
MORE ON NETWORK WORLD: Free security tools you should try

Heartbleed redux

The news comes as the security community is just shaking off the effects of Heartbleed, a critical vulnerability in the widely used OpenSSL security protocol. "Today's bash bug is as big a deal as Heartbleed," says Errata Security's Robert Graham, a respected researcher.

Hold your horses, Robert. Before we dive into dire warnings, let's focus on the positive side of this story. Numerous Linux variants have already pushed out patches that plug Shellshock, including Red Hat, Fedora, CentOS, Ubuntu, and Debian, and big Internet services like Akamai are already on the case.

But Graham says Shellshock's danger will nevertheless linger for years, partly because "an enormous percentage of software interacts with the shell in some fashion"—essentially making it impossible to know exactly how much software is vulnerable—and partly because of the vulnerability's age.

"Unlike Heartbleed, which only affected a specific version of OpenSSL, this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be, is much larger than Heartbleed."

Now consider that more than two months after Heartbleed was disclosed, hundreds of thousands of systems remained vulnerable to the exploit.
Maybe not Heartbleed redux?

But don't panic! (Or at least not yet.) While Heartbleed had the potential to be widely exploited, Jen Ellis of security firm Rapid7 says the Shellshock bug's outlook isn't quite as grim, even if it is rampant.

"The vulnerability looks pretty awful at first glance, but most systems with Bash installed will NOT be remotely exploitable as a result of this issue," Ellis writes. "In order to exploit this flaw, an attacker would need the ability to send a malicious environment variable to a program interacting with the network and this program would have to be implemented in Bash, or spawn a sub-command using Bash."

As a result, Ellis and Rapid7 urge keeping a level head about the bug.
"We’re not keen to jump on the 'Heartbleed 2.0' bandwagon. The conclusion we reached is that some factors are worse, but the overall picture is less dire… there are a number of factors that need to be in play for a target to be susceptible to attack. Every affected application may be exploitable through a slightly different vector or have different requirements to reach the vulnerable code. This may significantly limit how widespread attacks will be in the wild. Heartbleed was much easier to conclusively test and the impact way more widespread."

While older Internet-connected devices (like, say, security cameras) seem to be likely victims of Shellshock, respected security researchers Michal Zalewski and Paul McMillan note that many embedded devices don't actually use the Bash shell at all.

Beyond Linux-based systems, Graham and Ars Technica report that Mac OS X Mavericks contains a vulnerable version of Bash.

To test if your version of Bash is vulnerable to this issue, Red Hat says to run this command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If the system responds with the following, then you're running a vulnerable version of Bash and you should apply any available updates immediately:

vulnerable
this is a test

"The patch used to fix this issue ensures that no code is allowed after the end of a Bash function," Red Hat reports. So rather than spitting out "Vulnerable," a protected version of Bash will spit out the following when you run the aforementioned command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test

What does this mean?

When it boils down to brass tacks, most major websites and modern gadgets you own likely won't be affected by this Bash vulnerability, and Apple will no doubt patch the OS X implementation quickly. (Here's a highly technical DIY fix for now.)

It's impossible to know just how far this flaw reaches, and it's likely to linger on in neglected websites, older routers, and some legacy Internet of Things devices—many of which are impossible to patch—providing an opening for determined hackers to sneak into those systems.

So what should you do? Here's some actionable advice from security researcher Troy Hunt's tremendous in-depth primer on Shellshock:

"In short, the advice to consumers is this: watch for security updates, particularly on OS X. Also keep an eye on any advice you may get from your ISP or other providers of devices you have that run embedded software. Do be cautious of emails requesting information or instructing you to run software – events like this are often followed by phishing attacks that capitalize on consumers’ fears."

PCWorld's guide to protecting your PC against devious security traps can help you I.D. bad actors, while Ian Paul has three tips for spotting malicious emails over at his Hassle-Free PC column.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Happy Labor Day -- Will a bot take your help desk job?

Automation technology is getting better as help desk requests continue to rise

Competing forces are affecting people who work on help or service desks. One is improving automation tools, which advocates say can replace level 1 and 2 support staff. At the same time, the number of help desk tickets is rising each year, which puts more demand on the service desk.

These cross-currents in the industry make it hard to predict the fate of some IT jobs. A Pew survey, released in August, of nearly 1,900 experts found a clear split on what the future may bring: 52% said tech advances will not displace more jobs than they create by 2025, but 48% said they will.

Either way, a push toward automaton is certain. In the help desk industry, the goal is to keep as many calls for help at either Level 0, which is self-help, or Level 1, as possible. It's called "shift-left" in the industry.

"It costs way more to have a Level 3 or Level 2 person to resolve an issue, and it also takes a lot more time,' said Roy Atkinson, an analyst at HDI, formerly known as the Help Desk Institute. To keep costs down, help desks are increasingly turning to automation and improvements in technologies such as national language processing, he said.

A Level 1 worker will take an initial call, suggest a couple of fixes, and then -- lacking the skill or authority to do much more -- escalate the issue. The Level 2 worker can do field repair work and may have specific application knowledge. A Level 3 escalation might involve working directly with application developers, while Level 4 means taking the problem outside to a vendor.

Among the companies developing automation tools is New York-based IPsoft, a 15-year old firm with more than 2,000 employees. It develops software robotic technology and couples it with management services.

A majority of IT infrastructure will eventually be "managed by expert systems, not by human beings," said Frank Lansink, the firm's CEO for the European Union. IPsoft says its technology can now eliminate 60% of infrastructure labor tasks.

IPsoft's autonomic tools might discover, for instance, a network switch that isn't functioning, or a wireless access point that is down. The system creates tickets and then deploys an expert system, a software robot with the programming to make the repair. If it can't be done, a human intervenes.

Many service desk jobs have been moved offshored over the last decade, displacing workers. That trend is ongoing. One of the ideas underlying IPsoft's business models is a belief that offshore, as well as onshore, labor costs can be further reduced through automation.

Offshore firms are clearly interested. IPsoft's platform was adopted last year by Infosys and, more recently, by Accenture.

One IT manager using IPsoft's automation technology and services to support his firm's infrastructure -- including its network, servers and laptops -- is Marcel Chiriac, the CIO of Rompetrol Group, a Romania-based oil industry firm with 7,000 employees serving Europe and Asia.

"Without the automation, we would have to pay a lot more" for IT support, said Chiriac.

The cost savings arise from automatic repairs and routine maintenance that might otherwise be neglected, said Chiriac.

If he weren't using autonomic tools, Chiriac said he would have to hire more people for a similar level of service. But he can't easily estimate the impact on staff because of the firm's IT history. (Rompetrol Group outsourced its 140 IT staff, ended that relationship, then rebuilt an internal IT staff with about two dozen fewer workers; it also uses outsourcing as a supplement.)

Nonetheless, Chiriac doesn't believe that infrastructure automation will necessarily eliminate IT jobs, though it may shift them to other IT areas. "In IT, we're not going to run out of work for the next two generations," said Chiriac.

The work that help or service desks are asked to take on is increasing. Two-thirds of 1,200 organizations surveyed by HDI reported that the number of tickets, either to fix something broken or to outfit a new hire or change permissions, for instance, os increasing annually by more than 60%.

The top five reasons for this increase, according to HDI's survey, is an increase in the number of customers at surveyed firms, a rising number of applications, changes in infrastructure, increases in the scope of services, and the need to support different types of equipment and more devices. That latter could reflect BYOD use.

At the same time, support is being transformed in new ways. Service desks may, for instance, now act as a liaison for all service providers, including cloud and mobile carriers, said Atkinson.

"I think a lot of people have been predicting the death of support for a number of years, and it hasn't happened," said Atkinson.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Healthcare organizations still too lax on security

Data breach at Community Health is symptom of broader problem, security experts say

The data breach at Community Health Systems that exposed the names, Social Security numbers and other personal details on more than 4.5 million people is a symptom of the chronic lack of attention to patient data security and privacy within the healthcare industry.

For more than 10 years, the Health Information Portability and Accountability Act (HIPAA) has required all entities handling healthcare data to implement controls for protecting the data, yet many organizations pay little more than glancing attention to the rules because of the relatively lax enforcement of the standards.

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services has begun cracking down recently on hospitals and other healthcare entities that have suffered security and privacy breaches. The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 introduced some significant penalties for noncompliance with data security requirements.

Yet, many health organizations don't see data security as a major concern until a breach. So far this year, healthcare entities have reported to the HHS at least 150 incidents involving compromises of personal data.

"The industry has a long culture of not recognizing the incredible value of healthcare information," to those who want to misuse it, said Deborah Peel, a physician and founder of the advocacy group Patient Privacy Rights.

Apart from a lack of real enforcement of any of the privacy and security provisions in HIPAA, the industry has also suffered from the lack of an auditing requirement for security, Peel said.

HIPAA doesn't require even large healthcare organizations to submit to a third-party audit of their data security controls. "Only if you have a breach or someone reports you are you likely to come to the attention of HHS," Peel said.

Companies in other industries, such has financial services, have to go to great lengths to externally validate their systems and provide audit reports on request, she said. "There is no such requirement in healthcare," even though the information handled by the industry is highly sensitive and far more valuable in the underground market than financial data.

"There is a lot of catching up to do. A lot of public trust is going to be lost," before real change happens in the industry, Peel said.

Things will probably have to get worse before it starts getting better, said Phil Lieberman, president of Lieberman Software, a security vendors.

"It will take a Target type of episode where a healthcare provider and their C-suite face demise due to the damage they have caused to their entire population of patients to get some providers to wake up," and invest in real security, Lieberman said.

The unfortunate reality is that most healthcare providers have little concern for having IT security, he noted. "There is no incentive for them to invest, nor is there any material consequence for their failure to protect their infrastructure. HIPAA has had little to no effect in protecting patient data."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Mozilla warns of leaky developer network database

Mozilla’s website for developers leaked email addresses and encrypted passwords of registered users for about a month due to a database error, the

Email addresses for 76,000 Mozilla Development Network (MDN) users were exposed, along with around 4,000 encrypted passwords, wrote Stormy Peters, director of development relations, and Joe Stevensen, operations security manager in a blog post. Mozilla is notifying those affected.

No malicious activity on the affected server was detected, but that does not mean the data wasn’t accessed, they wrote.

A Web developer discovered around 10 days ago that a data sanitization process on the database running the MDN wasn’t working. The leak started around June 23 and continued for a month.

“As soon as we learned of it, the database dump file was removed from the server immediately, and the process that generates the dump was disabled to prevent further disclosure,” they wrote.

The exposed passwords were encrypted and “salted,” a security measure that makes it difficult to revert them to their original form. Even if the passwords were decrypted, “they by themselves cannot be used to authenticate with the MDN website today,” according to the post.

Since some people may used the same MDN password on other websites, it’s recommended the password be changed.

Mozilla said it was “deeply sorry” for the error.

“In addition to notifying users and recommending short term fixes, we’re also taking a look at the processes and principles that are in place that may be made better to reduce the likelihood of something like this happening again,” according to the post.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Climbing Aboard the 3rd Platform

Recent news from IBM and Microsoft highlight the upheavals underway as the technology industry rapidly transitions to new realities.


IBM announced that profits were up even as revenue was down as it continues to shift away from hardware business lines and tries "to convert the future of technology into an opportunity rather than a threat." Microsoft announced its largest layoff ever as it continues to "become more agile and move faster" toward cloud and mobile hardware!

These upheavals are due to the forces propelling mobile, social, cloud and big data into what IDC labels the 3rd Platform, “the emerging platform for growth and innovation.”

"The 3rd Platform will deliver the next generation of competitive advantage apps and services that will significantly disrupt market leaders in virtually every industry," IDC seer Frank Gens said, in laying out the firm’s predictions for 2014, late last year.

When long-time nemeses Apple and IBM climb into bed you know the ground is shaking!

With access to cloud infrastructure and other resources, new companies can be created almost overnight – the advantages of size that large, established companies used to rely on have greatly diminished. Everybody needs to be more agile, more flexible and willing to sacrifice proprietary advantages when customers demand adherence to open standards.

With so much change, no organization can afford to stand pat on the networking architecture of the past. Enterprises are driven to simultaneously improve business processes while reducing IT costs.

In order to move beyond the physical limitations of yesterday’s architecture so they can manage the complexity of the ever more connected world, many enterprises are modernizing data centers. Seeking to transform infrastructure into assets, they are turning to virtualization and cloud computing to drive up availability and transition IT to a services orientation.

They won’t get there with traditional Ethernet networks that rely on a rigid hierarchical approach that creates inefficient traffic patterns and purposely curtails the scalability. A newer category of flatter Ethernet networks called Ethernet fabrics combine the familiarity of Ethernet networks with the data center-hardened reliability and performance characteristics of fabric technologies such as Fibre Channel to provide organizations with elastic, highly automated, mission-critical networks to meet rapidly changing requirements.

Ethernet fabrics are specifically designed for the virtualized data center environments needed to transition to the 3rd Platform. Rather than focusing on management of discrete physical devices and physical ports, they logically eliminate the management of multiple switching layers and apply policies and manage traffic across many physical switches as if they were one.

Trying to forestall movement to the 3rd Platform is, at best, a defensive strategy that attempts to maintain a static position in an incredibly dynamic environment. It doesn’t make sense to become more stodgy while competitors are increasingly agile. As the situations at IBM and Microsoft attest, market advantages that once seemed insurmountable can quickly erode in the face of rapid transformation.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Vision-correcting display nixes your need for eyeglasses

Your reading glasses will be so yesterday with UC Berkeley's new technology

What would it be like if you didn't need your eyeglasses to clearly see your laptop screen or a text message on your smartphone?

Scientists at the University of California Berkeley are working on computer screens that would adjust their images to accommodate individual user's visual needs. Think of it as a display that wears the glasses so users don't have to.

"For people with just near sightedness or far sightedness, life isn't so bad," said Fu-Chung Huang, the lead author of the research paper on the display project at Berkeley. "But as you get older, your lenses lose elasticity and you cannot read things close to you, like a cell phone or tablet. You need another pair of reading glasses, which can be quite inconvenient.
Scientists at the University of California Berkeley are developing a vision-correcting display that would mean users wouldn't need their eyeglasses to see it clearly. (Video: UC Berkeley)

"With this technology, in the future, you just need to press a button and the display will accommodate to your vision," he said in an email to Computerworld.

Users would input their vision prescription into their individual desktop, laptop or mobile device. Then when the user logs on with a password, the computer recognizes the user and automatically adjusts its display.

Researchers at Berkeley, working with scientists at MIT, are developing algorithms that will compensate for a user's specific vision needs to adjust the image on a screen so the user can see it clearly without needing to wear corrective lenses. The software will create vision-correcting displays.

The researchers have been working on the technology for three years.
Computer screen
Researchers place a printed pinhole array mask, shown here, on top of an iPod touch as part of their prototype of a visually corrected display. (Image: Fu-Chung Huang)

A user who, for instance, needs reading glasses to see or read anything clearly on his laptop or tablet screens wouldn't need to wear the eyeglasses if the displays adjust themselves for his vision needs.

If a user who needs one pair of glasses to see things at a distance and another pair for reading, would not need to put on reading glasses to read her emails or Facebook posts if the display could adjust itself for her near-vision needs.

The displays, according to Berkeley, also could be used for people whose vision cannot be corrected with eyeglasses or contacts.

"This project started with the idea that Photoshop can do some image deblurring to the photo, so why can't I correct the visual blur on the display instead of installing a Photoshop in the brain?" asked Huang, who now is a software engineer at Microsoft. "The early stage is quite hard, as everyone said it is impossible. I found out that it is indeed impossible on a "conventional 2D display." I need to modify the optical components to make this happen."

The university said that the hardware setup adds a printed pinhole screen sandwiched between two layers of clear plastic to an iPod display to enhance image sharpness. The tiny pinholes are 75 micrometers each and spaced 390 micrometers apart.

The algorithm, which was developed at Berkeley, works by altering the intensity of each direction of light that emanates from a single pixel in an image based upon a user's specific visual impairment, the university reported. The light then passes through the pinhole array in a way that allows the user to see a sharp image.

Huang, who has not yet talked with computer monitor or smartphone and tablet manufacturers about the research, noted that the display technology could be developed into a thin screen protector.

"The current version is still quite fragile," he added. "It requires precise calibration between the eye and the display and it took some time to find the sweet spot for my own eye. But remember that Amazon just announced the Fire Phone with the super fancy dynamic perspective to track your eye. This technology can solve my problem ... so I'm pretty optimistic about the overall progress."

However, he said that at this point in their work, the technology wouldn't work on a shared display such as a television screen.

"In the future, we also hope to extend this application to multi-way correction on a shared display, so users with different visual problems can view the same screen and see a sharp image," he said.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft slates critical IE, Windows patches for Tuesday

One month left for businesses to migrate from Windows 8.1 to Windows 8.1 Update

Microsoft today said it will ship six security updates to customers next week, patching all versions of Internet Explorer (IE) and nearly all supported editions of Windows.

The IE update, one of two classified as "critical" -- Microsoft's most serious threat ranking -- will patch IE6 on Windows Server 2003, IE7, IE8, IE9, IE10 and the newest, IE11.

It's unlikely that July's IE update will match June's in size: Microsoft fixed a record 60 flaws in the browser on June 10. (Originally, Microsoft said it had patched 59 IE bugs last month, but a week later acknowledged it had forgotten to add one to the list, and so upped the count to an even 60.)

Windows 7 users who have not freshened IE11 with a mandatory April update will not receive next week's browser fixes.

According to Thursday's advanced notice, which briefly described the July updates, the second critical bulletin will patch all client editions of Windows -- from Vista to Windows 8.1 -- and all server versions except for those running on systems powered by Intel's Itanium processors. Windows Server 2008 and Server 2012 systems provisioned by installing only the Server Core -- a minimal install with many features and services omitted to lock down the machine -- are also exempt from Bulletin 2, Microsoft said.

Of the remaining four updates, three were labeled "important" by Microsoft -- the threat step below critical -- while the fourth was pegged "moderate." All will offer patches for some or all Windows editions, both on the desktop and in the data center.

Security researchers pointed to the two critical bulletins as the obvious first-to-deploy for most Microsoft customers.

They also remarked on Bulletin 6, the single moderate update, which will patch Microsoft Service Bus for Windows Server. The bus is a messaging and communications service that third-party developers can use to tie their code to Windows Server and Microsoft Azure, the Redmond, Wash. company's cloud service.

"The odd one out this month is the Moderate Denial of Service in 'Microsoft Service Bus for Windows Server,'" said Ross Barrett, senior manager of security engineering at Rapid7, in an email. "It's part of the Microsoft Web Platform package and is not installed by default with any OS version."

Although Microsoft did not mention it in today's advance notice, or in the blog post by the Microsoft Security Response Center (MSRC), enterprises have one more month to deploy April's Windows 8.1 Update and Server 2012 R2 Update before losing patch privileges for devices running Windows 8.1 or servers running 2012 R2.

Hardware powered by Windows 8.1 or Server 2012 R2 must be updated before Aug. 12, the next scheduled Patch Tuesday, to receive that month's updates, as well as any future security fixes.

Or in some cases, even present patches, said Chris Goettl, a program product manager at Shavlik, in an email.

"One thing to watch out for [next week] will be [something similar to] the many exceptions we saw last month," Goettl cautioned. "Many of the updates we saw in June required other updates to be in place, depending on the platform. For those running Windows 8.1 or Server 2012 R2, they need to be prepared for more of these updates to require Update 1 before they can apply them. Microsoft has stated they would delay a hard enforcement until August, but more and more of the patches [have] had variations that required Update 1. So look out for that cut over -- it's coming quick.

---

Best Microsoft MCTS Certification, Microsoft MCP Training at certkingdom.com