Checkmarx touts innovation in secure coding

Checkmarx announced technology this week that the company describes as an innovation in secure coding. Static code analysis tools have been used to fight software vulnerabilities but they require that a project be almost completed before scanning can take place, according to the company. The Checkmarx Virtual Compiler lets source code be scanned in real time without using a compiler, giving developers, auditors, and security professionals capabilities for secure coding and fixing flaws at the earliest stages of development, the company said. [ Microsoft also has focused on security for application development. | Keep up with app dev issues and trends with InfoWorld's Fatal Exception blog. ] Most security issues can be traced to code vulnerabilities, Checkmarx said.

This makes security repairs to code costly and nullifies the benefits of static analysis. Security auditors, meanwhile, can conduct audits any time on the code base without having to emulate a developer's environment. "The Checkmarx Virtual Compiler means developers can finally fix code on the assembly line instead of having to wait until the software is almost out the door," said Checkmarx CTO and founder Maty Siman in a statement released by the company. Checkmarx Virtual Compiler lets developers scan un-built code so static analysis can be performed earlier in the development lifecycle, Checkmarx said. Usable in any stage of development, the product supports Linux, Windows and Solaris and languages such as Java, C/C++ and Salesforce.com Apex. This story, "Checkmarx touts innovation in secure coding," was originally published at InfoWorld.com. Checkmarx is offering a free trial of its code analysis, accessible.

Follow the latest in developer trends at InfoWorld.com.

Google Search Page Gets a New Look

Google has introduced a new version of the search engine's home page, which features a sleek fade-in effect that hides all the elements of the page except the logo, search bar, and the buttons. The rest of the elements of the page, such as links to Gmail, Documents, News, Maps, Shopping, etc., will be revealed with a fancy fade-in effect when you fist move the cursor on the screen. When accessing the main Google search page, you will only see the Google logo (or the doodle of the day) and the super-sized search bar (introduced a few months ago) with the search buttons underneath.

Google's new search homepage is now even less crowded, in comparison to Bing, the competing search engine from Microsoft, which overlays different images under the search bar daily and features search queries of interest. The search company says it tried about ten versions of the fading homepage and chose the current one based on "user happiness metrics". Some of the earlier versions of the fade-in Google homepage had an even more minimalistic approach, with the search buttons hidden at first. The fading Google homepage was first noticed a few months ago, when Google was experimenting with different designs. The final version of the fading homepage is now being introduced to Google home pages around the world. Google also introduced a better format for image search results earlier this week. Google explains in a blog post that it was concerned with the time to first action on the new homepage, which could confuse users initially. "We want users to notice this change... and it does take time to notice something (though in this case, only milliseconds!). "Our goal then became to understand whether or not over time the users began to use the homepage even more efficiently than the control group and, sure enough, that was the trend we observed," the Google team explained.

The new image search layout will show a larger image and additional smaller images alongside. In a previous update in November, Google also introduced Image Swirl, which bring layers of similar images into searches.

Grassley seeks proof of jobs from H-1B applicants

WASHINGTON - One of the U.S. Senate's leading critics of the H-1B visa program, Sen. Grassley wants IT consulting companies that hire H-1B workers at third party client sites to prove that there is work waiting for them. Charles Grassley (R-Iowa), is asking immigration officials to toughen their demands for evidence from companies hiring visa workers. The timing of his request to the U.S. Citizen and Immigration Service (USCIS) is no accident or is Grassley's interest.

In a statement accompanying the release of his letter to Mayorkas, Grassley said, that "Employers need to be held accountable so that foreign workers are not flooding the market, depressing wages, and taking jobs from qualified Americans. About a year ago, Grassley released a USCIS study that found either evidence of fraud or other violations in one-out-five H-1B visa petitions . His letter to USCIS Director Alejandro Mayorkas, released Tuesday, also comes just prior to the start of the new fiscal year, Oct. 1 and the release of 66,700 H-1B visas petitions, a number well short of the cap, applied for since April 1, the start of the annual petition process. Asking the right questions and requesting the necessary documents will go a long way in getting out the fraud in the H-1B program." Five months after USCIS completed its fraud study, federal officials arrested about a dozen people and charged with fraud. The U.S. recently expanded the case ; the company is fighting the charges in federal court. One of the cases involved a New Jersey company, Visions System Group Inc. alleged to have set up shell offices in Grassley's home state. Grassley said in his letter that the USCIS should be asking, "companies up front for evidence that H-1B visa holders actually have a job awaiting them in the U.S.," and not end up being "benched," or unpaid until work is found.

In response, a USCIS official said Mayorkas has received the letter and will respond for it. Grassley is also seeking information on the progress the USCIS has made on a number of other issues addressed in the fraud report, including job duties that differ from those described in the petition and failure to pay prevailing wages. Grassley's letter to tougher steps comes at the same time that some immigration attorneys have complained of stepped up enforcement efforts this year, especially with request for more evidence to support a petition. Richard Durbin (D-Ill), have introduced legislation that would toughen the rules on H-1B program, and impose a number of restrictions , especially on Indian firms and their ability to use large numbers of visa holders without hiring a proportional number of U.S. workers. Grassley, along with U.S. Sen. The U.S. can issue up to 85,000 H-1B petitions under the cap, with 20,000 set aside for advance degree graduates of U.S. universities.

IT employment is down generally, and with it, demand for the visa.

Microsoft defends its anti-malware software after Symantec piles on

Microsoft is defending the merits of its free Security Essentials anti-malware software after a top Symantec engineer badmouthed the new release. "Microsoft Security Essentials provides real-time protection that uses behavior monitoring and reputation services to help identify the malicious software as soon as it emerges in the ecosystem and then uses the Dynamic Signature Service to make the newest definitions available virtually real-time, without having to wait for the next signature download," Microsoft said in a statement. 11 security companies to watch Earlier in the week, Jens Meggers, vice president of engineering for Norton products, claimed the newly released Security Essentials is just an unimpressive recycling of Microsoft's discontinued Live OneCare technology for Windows desktops. "It's just stripped down OneCare," Meggers said, citing a report from Dennis Technology Lab that compared Norton AntiVirus 2009 to Microsoft Security Essentials and deemed Norton stronger in malware defense by about a 2-to-1 margin (the test was sponsored by Symantec). Microsoft expressed disappointment in Symantec's claims but did not rebut each of Meggers' remarks. In its statement Microsoft said it "continues to advocate for a defense in depth strategy that includes the use of anti-malware software, but also includes protections such as firewall and user account controls like those found in Windows, browser security like that in IE8 and continuous updates like those provided through Microsoft Update." Microsoft indicated it is offering Microsoft Security essentials for free because "we still see far too many consumers worldwide that do not have up-to-date protection either because they cannot afford it, are concerned about the impact the suites will have on the performance of their PCs, or because they simply do not realize their AV software is not up to date." Offering its software for free, said Microsoft, "will remove some of the barriers in the way of consumers having quality anti-malware protection today."

Experts scrutinize 2009’s most notable IT apologies

We asked Peter Goolpacy and the team at Perfect Apology to rate the quality of the apologies issued by top tech companies and executives this year for their assorted mistakes and misdeeds. Perfect Apology (PA) rating: 8.5 Amazon CEO Jeff Bezos' apology for deleting illegally sold books from customers' Kindle devices, without any warning, was pretty impressive. The following contains their reviews of the apologies and their ratings of the apologies on a scale of 1-10, with 10 being the best. (Here are links to our original article on the "Year in IT Industry Apologies," which includes the complete apologies' text, and a slideshow featuring abbreviated versions of the apologies.) Amazon Kindle apology.

Of course, his second apology to those whose copyrights the company abused by illegally selling these books is still pending - no doubt for several reasons tied to ongoing litigations. Perhaps the most impressive part of this apology was the decision to change Amazon's deletion policy "so that in the future we will not remove books from customers' devices in these circumstances." Presumably, they continue to reserve the right to remove books from Kindles under different circumstances. The initial apology issued by Bezos was reinforced by additional apologies on the main Amazon web site - together they satisfied many of the key ingredients we recommend throughout our site: acknowledging the stupidity of the error, taking full responsibility for the mistake, establishing new procedures to prevent unauthorized deletions in the future, and a refund to those who purchased the copies. There are two problems with the apology. Taking the books back was not the real problem (most users understood the importance of returning the 99 cent books) - what really hurt was Amazon's decision to do this without any warning. First, Bezos could easily have conveyed a clearer appreciation of the harm done beyond simply acknowledging Amazon's stupidity - the unauthorized deletions raise important issues tied to corporate control over personal property and privacy rights that must have seriously damaged the trust many Kindle users have in the company.

The irony that one of the books in question was Orwell's 1984 was not missed by many. The question is whether the 99 cent refund was considered reasonable by most of the customers directly affected by the deletion. Second, the apology certainly satisfied the important prerequisite of expressing regret and taking responsibility, but excessive self criticism (e.g., stupid, thoughtless, painful, self-inflicted, etc.) produces diminishing returns if not followed by some form of restitution - in this case an immediate and "reasonable" refund. Once purchased (especially for only 99 cents) a book like Orwell's 1984 is far more valuable to the owner than the original 99 cents, so losing it was much more costly to them. This would have represented a more significant cost to Amazon and a clearer measure of responsibility and regret.

Amazon's refund could have included a credit to defer at least some of the $9.99 cost to repurchase a legal copy of the book. However, judging by the responses on the Amazon blog, Bezos' apology seemed to hit the right note - the replies were very positive. But its overall quality was affected by excluding any critique, warning or reprimand directed at Sikalosoft, both for the original app and then for the abysmal apology Sikalosoft issued in its defense. Apple iPhone apology (Shaken Baby App). Rating: 7 for Apple; 0 for Sikalosoft Apple's apology was brief and largely effective, because it probably controlled some of the damage. Apple could also have included at least some reference to correctives designed to prevent the inclusion of offensive applications in the future, or a commitment to monitor companies like Sikalosoft that continue to produce offensive apps.

Now, in direct contrast to Apple's apology, the one issued by Sikalosoft made things worse by virtually dismissing the mistake with a joke - "Okay, so maybe the Baby Shaker iPhone app was a bad idea….No babies were harmed in the making of Baby Shaker." Apple missed a good opportunity to improve its apology by slamming the one issued by Sikalosoft. Simply deciding to drop the product, rather than issuing a threat to drop Sikalosoft, might appear insufficient to those who were offended. Pepsi iPhone app apology. The Twitter apology read - "Our app tried 2 show the humorous lengths guys go2 get women. Rating: 1 Pepsi's apology for its iPhone app, which offered advice for picking up women, received one of the lowest ratings by the PA team. We apologize if it's in bad taste & appreciate ur feedback." This was an impressive 99 character long apology.

The app obviously offended some people, so it required a decent attempt at an apology, but it deserved much more than a tweet. Ironically, the problem with this tech apology was the limitations tied to the very technology used to send it. Judging by this tweetology, the Pepsi PR guy is obviously not a Twitter genius capable of crafting the perfect 140 character mea-culpa. We're not saying it's impossible to use Twitter to say sorry; it's just much harder to do it well. Twitter is probably not the best approach for sending business apologies, for many of the reasons we cover on our website - if an apology is easy and painless, it's probably not heartfelt or credible. But there was a far more serious problem with this apology, one that probably made things worse - Pepsi made the common error of including the word 'if' in an apology - "we apologize if it's in bad taste." In other words, the apology applies only if we were too prudish or pompous to appreciate the humour.

So, for content, style and substance we give this one a 1 rating for at least including the following 11 characters "we apologize". T-Mobile and Microsoft Sidekick apology. Telling those who were offended by the app that they screwed up, because they missed the point, is never recommended. Rating: 8.8 The T-Mobile-Microsoft apology was among the strongest of those reviewed by the team. Data breach apologies are particularly damaging because clients have assigned so much faith, trust and confidence in Microsoft and T-Mobile to save and secure their personal data. The strength of the apology was related to the time and effort devoted to carefully explaining how Microsoft was going to fix the problem for Sidekick users, followed by a detailed list of the steps already taken to avoid the same problem in the future. Any failure to protect that data inevitably damages the trust required to retain customers for their product.

Belkin apology for commissioned reviews. The rapid restoration of personal data certainly helped, as did the measures taken to enhance future security measures and backup plans, but a few more words conveying at least some appreciation for the effects of lost access to personal data would have gone a long way towards personalizing the apology. Rating: 8.5 Belkin's admission that one of its employees actually commissioned positive reviews of one of its network products offers another good illustration of a strong apology. We regard our responsibility to our user community as sacred, and we are extremely sorry that this happened." This was followed by a description of the solutions - "We've acted swiftly to remove all associated postings from the Mechanical Turk system. The President (Mark Reynoso) clearly acknowledges the importance of the error, and addresses the potential harm this caused - "We know that people look to online user reviews for unbiased opinions from fellow users and instances like this challenge the implicit trust that is placed in this interaction.

We're working closely with our online channel partners to ensure that any reviews that may have been placed due to these postings have been removed." Reynoso's apology was noteworthy not only for acknowledging the damage to the company's reputation, but for appreciating the implications for the larger online community and the credibility of web-based reviews of tech products. Rackspace apology for cloud outage. Accepting this additional measure of responsibility was impressive. Rating: 6 The Rackspace apology to thousands of customers for yet another outage was certainly lengthy, but there are diminishing returns, even for strong apologies, if the same problems recur. Unless the outages stop, subsequent failures, no matter how minor, are likely to produce a more significant and negative backlash from customers.

A promise to avoid the same mistake in the future carries less weight each time. Repeated apologies, no matter how detailed and sincere, will be less and less effective over time. The effects may be the same, but differentiating apologies will help avoid the impression that the problem can't be fixed. In this case, it would have helped to add a few more details about what caused this particular outage if only to distinguish the events. Major League Baseball Web video apology. There were many fires and we were off working on them and didn't man the blog." The apology was about as close as you can get to saying "s- happens." The "lack of communication" was really only one small part of the problem, but it was unintentionally reinforced by the apology itself.

Rating: 4 MLB's apology for technical problems with its fee-based game video-streaming service was not great - "Apologies for the lack of communication. The MLB video team failed to communicate the nature of the problem, failed to convince users they understood it, and failed to provide any indication that they knew how to resolve it - "We have a lot more to do still to get the [media] player to perform in a more stable manner across the board." There is no clear indication of what "a lot more" actually means, or what measures they plan to take to manage the recurring errors (e.g., instant blog updates; specific tech fixes; some form of compensation or credit for down time; etc.). VMware exec apology to Microsoft. He apologizes for damaging VMware and Microsoft's credibility, but he implied in his apology that only "some" people may have found reason to be concerned about the company's credibility. Rating 4.5 Scott Drummonds' apology for anonymously posting a misleading (and excessively optimistic) YouTube video praising a Microsoft product failed on several levels. The practice of fabricating positive reviews to exaggerate the quality or performance of any product would be viewed by anyone with a conscience as a serious mistake. He should have taken full responsibility for a much larger breach of trust.

Yet Drummonds seems to be apologizing only to those few, with ethical higher standards, who may have been offended. Instead, he simply describes the error without ever addressing the more important issue of the credibility of online reviews - Drummonds should take lessons from Belkin's 8.5 apology. This is a more significant breach of trust that should have been acknowledged in the apology. Keep in mind, Drummonds was not aggressively pushing a product because it was good and deserved the exposure; he was exaggerating the quality of the product by claiming a level of performance it could not meet. Dancer "Woz" apology. In addition to clearly conveying honest regret and remorse for his actions, Woz managed in his apology to elevate the respect people have for those he hurt, while simultaneously establishing a higher measure of credibility for the technology used by DWTS to tally results.

Rating 9 The PA team was surprised by its decision to assign the highest rating (approaching perfection) for the apology delivered by Apple co-founder Steve Wozniak - he mistakenly criticized Dancing With The Stars producers for fabricating audience voting results. In other words, the apology left the situation better for those he hurt and improved impressions people have of the show he originally criticized. In sum, this brief letter accomplished more 'good' than the 'harm' created by the original insult. The heartfelt endorsement by Woz, a widely respected and incredibly successful technology expert, went well beyond anything the show's producers could have accomplished on their own. Google apology for Gmail outage. Rating: 8.5

Cloudera intros Hadoop management tools

Startup Cloudera is introducing a set of applications on Friday for working with Hadoop, the open-source framework for large-scale data processing and analysis. It allows an application workload to be spread over clusters of commodity hardware, and also includes a distributed file system. Cloudera, which provides Hadoop support to enterprises, developed the new browser-based application suite to simplify the process of using Hadoop, according to CEO Mike Olson. "It's an easy-to-use GUI suitable for people who don't have a lot of Hadoop expertise," Olson said. "The big Web properties with sophisticated and talented PhDs have been successful [with it], but ordinary IT shops ... have had a harder time." Hadoop is known for its behind-the-scenes role crunching oceans of information for Web operations like Facebook and Yahoo.

But although the technology is "at its best" when data volumes get into multiple terabytes, Hadoop has relevance for a wide variety of companies, according to Olson. "It's increasingly easy to get your hands on that much data these days," especially from machine-generated information like Web logs, he said. Cloudera and its partners are fine-tuning the suite, which is now in beta, before issuing a general release. The browser-based application set is supported on Windows, Mac and Linux, and includes four modules: a file browser; a tool for creating, executing and archiving jobs; a tool for monitoring the status of jobs; and a "cluster health dashboard" for keeping tabs on a cluster's performance. Hadoop needs many more tools like it, according to analyst Curt Monash of Monash Research. "If Hadoop is to consistently handle workloads as diverse and demanding as those of [massively parallel processing] relational DBMSes, it needs a lot of tools and infrastructure," Monash said via e-mail. "The three leaders in developing those are Yahoo, Cloudera, and Facebook. There's a long way to go."

Scientist who found water on moon arrested for espionage

A scientist who once worked on the Star Wars missile defense project and is credited with discovering the presence of water on the moon is being accused by federal prosecutors of attempting to sell top secret information to a foreign intelligence agency. If convicted, Nozette faces life in prison, the U.S. Department of Justice (DOJ) said. Stewart Nozette, 52, of Chevy Chase, Md., was arrested yesterday on charges of attempted espionage after he was allegedly caught trying to sell classified national defense information to someone he thought worked for Israel's Mossad intelligence agency.

Nozette is a Ph.D in Planetary Sciences from the Massachusetts Institute of Technology and served on the White House National Space Council in 1989 and 1990. He is credited with developing a radar experiment to look for water on the south pole of the moon, the DOJ said. During the nine years he worked there developing "highly advanced technology," Nozette held a special security clearance that gave him access to Top Secret and critical nuclear weapon design information. Nozette worked at the Department of Energy's Lawrence Livermore National Laboratory after his White House stint. He later established a non-profit organization called the Alliance for Competitive Technology (ACT). Bedtween January 2000 and February 2006, Nozette's ACT entered into several agreements to develop advanced technology for the U.S. government. Over the last decade, Nozette also consulted with an Israeli aerospace company that is wholly owned by the Israeli government. The facilities that Nozette's company did work for included, the U.S. Naval Research Laboratory and NASA's Goddard Space Flight Center.

Nozette's arrest yesterday stemmed from an FBI sting operation. But it does mention a trip abroad that Nozette made during which he allegedly had in his possession two computer thumb-drives containing encrypted material. An affidavit filed in connection with his arrest does not say what tipped federal authorities off to Nozette's alleged espionage activities. The thumb drives were apparently not with him when he returned. During a later meeting between the two, Nozette allegedly agreed to work for Israeli intelligence in return for money. According to the affidavit, Nozette was contacted by telephone in September by an FBI agent posing as a Mossad agent.

On two separate occasions after that meeting, Nozette was allegedly video-taped dropping off large manila envelopes into a designated post office box in Washington. The information that Nozette thought he was passing on in return for thousands of dollars in cash included secret and top secret data on satellite systems, early warning systems, means of defense and retaliation against large-scale attack and nuclear weapons. The envelopes contained an encrypted hard drive and pages of information that Nozette had provided in response to a series of questions posed by what he thought were Israeli agents.