E-week (APRIL 24, 2006)

Oracle Database 10g #1 On Windows Starts at $149 per user Oracle Database 10g— The World’s #1 Database. Now For Small...

45 downloads 487 Views 5MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Oracle Database 10g

#1 On Windows

Starts at $149 per user

Oracle Database 10g— The World’s #1 Database. Now For Small Business.

oracle.com/start keyword: #1onWindows or call 1.800.633.0675 Terms, restrictions and limitations apply. Standard Edition One is available with Named User Plus licensing at $149 per user with a minimum of ﬁve users or $4995 per processor. Licensing of Oracle Standard Edition One is permitted only on servers that have a maximum capacity of 2 CPUs per server. For more information, visit oracle.com/standardedition Copyright © 2005, Oracle. All rights reserved. Oracle, JD Edwards and PeopleSoft are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

digital Exclusive coverage only for eWEEK digital edition subscribers

S U N O B TENT! N O C

News: Sun’s James Gosling opens up about his problems with AJAX development Pages EW1-2

eWEEK Labs: Peter Coffee interviews Day’s Roy Fielding on content management Page EW3

Opinion: Stan Gibson handicaps the winners of the outsourcing “globe rush” Page EW4

w w w. e w e e k . c o m

N E W S & A N A LY S I S

Rootkits are the target of a federally funded startup 13 T H E

E N T E R P R I S E

N E W S W E E K L Y

Setting Content Free BY HENRY BALTAZAR

HWE E K LAB S

N E W S P A P E R APRIL 24, 2006 VOL. 23, NO. 17 • $6

P E R I O D I C A L

IT managers must protect and preserve sensitive data, but proprietary storage systems and applications complicate the job PAGE 37

THIS fWEEK

T

he thinkpad is still the thinkpad. It’s been a year since Lenovo officially took over IBM’s PC business, but it’s hard to believe that Lenovo wasn’t always making all those ThinkPads. The Chinabased manufacturer has accomplished a great deal in the past 12 months, reports Senior Writer John G. Spooner this week on Page 16, managing growth while restructuring and bringing in new executive leadership in the form of William Amelio, formerly head of Dell in China. But perhaps Lenovo’s greatest achievement going forward will be its role in legitimizing the PC business in China. The company on April 17 agreed to buy $1.2 billion worth of Microsoft software in the next year, a big step toward thwarting the piracy markets in China. The Chinese government, which owns about a quarter of Lenovo, has made it a requirement that PC makers install “legitimate” software on all systems before shipment.

FWEEK.COM STORAGE Is EMC a storage company anymore or a software company? Or both? On Monday, Brian Fonseca will seek the answers at the EMC WORLD conference in Boston, where the company will showcase its latest efforts in hardware, document management and utility computing. LINUX The opportunity for open source in financial companies can be tracked at the LINUX ON WALL STREET conference in New York. Peter

r

digital

This is a great deal for Microsoft, to be sure, but it also will help open up Chinese markets to other software developers and all businesses seeking to expand there. Parkinson’s Law states that “work expands so as to fill the time available for its completion.” In the computer world, its corollary is “data expands to fill the space available for storage.” As storage needs and capacity expand, so does the need for better, more open and more robust tools to manage all that data. In his comprehensive package on CAS (contentaddressed storage) systems starting on Page 37, eWeek Labs Senior Analyst Henry Baltazar writes that the era of proprietary solutions is over and, like all things that enable interoperability and compliance, the time for open standards is now. Baltazar outlines the CAS problem

Contact Scot Petersen at scot_petersen@ ziffdavis.com.

PODCASTS go.eweek.com/podcasts TestRun Jason Brooks gives high marks to the latest version of Gnome, which features the Google Desktop search alternative, Beagle.

eWEEK InfraSpectrum Galli will report on the progress and problems starting Monday. Across the country, Desktop Linux Editor Steven J. VaughanNichols will attend the DESKTOP LINUX SUMMIT in San Diego, looking at reasons for the stilltepid adoption rates for the alternative operating system. ENTERPRISE APPLICATIONS Look for on-the-spot coverage online from several user group conferences this week. Renee

TRY IT NOW! go.eweek.com/zinio

Exclusive bonus coverage for digital edition subscribers: News Sun’s James Gosling opens up about his problems with AJAX development

and what is being done to solve it, particularly the developing standards of XAM (Extensible Access Method) by the Storage Networking Industry Association and two Java Specification Requests, JSR-170 and JSR-283. He also has created the latest eWEEK RFP (request for proposal) template, providing readers with the questions IT managers need to ask before investing in a CAS solution. ´

Labs Peter Coffee interviews Day Software’s Roy Fielding on content management

4 eWE E K n APRIL 24, 2006

Opinion Stan Gibson handicaps the winners of the outsourcing “global rush”

Boucher Ferguson will head to Nashville on Sunday for the annual OAUG (Oracle Applications User Group) COLLABORATE conference. Lisa Vaas will report from the MYSQL USERS CONFERENCE in Santa Clara, Calif., where customers will get their first look at the new storage engines MySQL cooked up in the wake of Oracle buying its engines. gWEEK LABS From its Sunnyvale, Calif., TRIOLE Integration Center, FUJITSU COMPUTER SYSTEMS officials on April 18 said that the company is ready to join IBM and HewlettPackard as a solutions vendor. Senior Analyst Henry Baltazar tells of Fujitsu’s vision as well as a raft of new products (and check out the slide show at go.eweek.com/slideshows).

Peter Coffee looks at the challenge of keeping the infrastructure trains running on time in conversations with Dan McCall, COO of application management technology provider AppWorx, and with senior software engineer Brent Iverson about his use of the AppWorx product in government operations in British Columbia.

Cyber Cynic Steven J. Vaughan-Nichols asks, Will Oracle really try to become a Linux power? And, if it does, what will happen next?

eWEEK Interview Salesforce.com’s Adam Gross explains his company’s AppExchange developer strategy and how it is creating the “business Web.”

Microsoft Watch Mary Jo Foley will review the latest on Vista builds and pricing and discuss Microsoft’s plans to take on Google’s Gdrive with “Live Drive.” She also will preview Microsoft’s Management Summit in San Diego, as well as the company’s latest appearance in EU antitrust court set for next week.

w w w. e w e e k . c o m

TEED. UARAN G , Y ED. IT BIL LERAT AVAILA , ACCE E C N A RM . PERFO SURED ITY, AS R ED. C U SECU D ITY, RE X E livery L P COM tion De a c li p p olute A re APS Radwa

ET

RN U O Y IS

ING

ET T L K R WO

?

OWN D U O Y

S. RLOAD EN IC OVE F ES. WH F A H C R T A . E S R RKING K B C LENE N’T WO URITY T E C T E R O S A B . S S R E TION SERVE FAILUR PPLICA ACTION ICAL A IT ERS. R S C TRANS U OUR INESS Y S E U tion R B A applica HER YOUR grated Y, NEIT te L in R . E s e n P th o , PRO licati lute™ led app b re APSo a a n w d -e a b d we re’s R rked an lly, the stments r netwo Thankfu fo n o ti ur inve o lu y o s m o ry e fr delive um valu fastest et maxim bility and the g u o ecause y , grow b availa ts PSolute /7 ﬁ A 4 ro 2 h p it h W le wit rs and d peop vity soa e. in IT an roducti P . anytim s e , e tim ywhere n a m respons o fr Solute’s an work nge, AP a h users c c ts tom-ﬁt emen you cus s requir s ts e le in s to re u itectu atures your b urity fe ble arch And as c e la s a c d s n r and ance a modula perform mix of l a e id the eds. an your ne better th satisfy ization and m rt ti a p o ation tion-sm c a li c p li p p a p rk a does r netwo Nobody secure. ake you M ble and . a re li a re t, s Radw fa s n ? plicatio network your ap h your it w t ls a e whe heel g your rtune W . spinnin are’s Fo w th 525 o d o a B R Are you 2006 to win , in -4 p 2 s y e a Com egas, M , Las V g. in it Interop a w rtune is Your fo 6 22-431 1-866-7 @ re dwa Call Ra .com. radware @ fo or in

Editorial Director Eric Lundquist Editor in Chief Matthew Rothenberg Editor Scot Petersen Executive Editor/News Director/eWEEK Labs Executive Editor/eWEEK Labs Technology Editor Executive Editor/Special Projects Executive Editor Executive Editor/Technology

Larry Dignan Jim Rapoza Deb Donston Peter Coffee David Morgenstern Stan Gibson Sean Gallagher

N EWS News Editors John Pallatto, Lisa Vaas, Steve Bryant, Don Sears Senior Editors Jeffrey Burt, Caron Carlson, Peter Galli, Paula Musich, Darryl K. Taft Senior Writers Ben Charny, Renee Boucher Ferguson, Brian Fonseca, John Hazard, Matt Hines, Ryan Naraine, John G. Spooner Staff Writer Deborah Rothberg Executive Assistant Colleen Heckman

APRIL 24, 2006

CONTENTS OPINION

13

4

gWE E K LABS

West Coast Technical Director Senior Analysts Technical Analysts Senior Writer

boosts anti-piracy efforts.

Cameron Sturdevant Henry Baltazar, Jason Brooks Michael Caton, Andrew Garcia Anne Chen

10 Eric Lundquist: Data

transfer rates increase at the expense of security.

FEATU R E S Associate Editor, Solutions Series David Weldon Senior Editor Kevin Fogarty

36 Our View: Stay battle-

ready or risk cyber-crime.

E D ITO R IAL PR O D U CTI O N Rick Dagley Debra Perry Jim Williams Emily Zurich Kelsey Adams, Vikki Lipset, Shane O’Neill Newsletter Editors Jenni Miller, Alethea Yip

Managing Editor Deputy Managing Editor Copy Chief Senior Copy Editor Copy Editors

ART D E PARTM E NT Senior Art Director Associate Art Director Senior Production Designer Senior Designer

Stephen Anderson Paul Connolly Tara-Ann Fasulo Chip Buchanan

gWE E K

Publisher Karl Elken Business Manager Eric Berk Marketing Melissa Grieco, Marketing Manager John Tsao, Research Manager Production Manager Michael DiCarlis Ad Traffic Coordinator Tim Bennett

ZI FF DAVI S M E D IA Chairman & CEO Robert F. Callahan Chief Financial Officer Mark Moyer Executive Vice President & Chief Content Officer Michael J. Miller Executive Vice President, Licensing & Legal Affairs, General Counsel Gregory Barton

PR E S I D E NTS Scott McCarthy (Game Group) Sloan Seymour (Enterprise Group) Jason Young (Consumer Tech/Small Business Group)

S E N I O R VI C E PR E S I D E NTS Kenneth Beach (Corporate Sales) Ira Becker (Game Group) Jim Louderback (Editorial Director, Consumer/Small Business Group) Angelo Mandarano (Internet) Martha Schwartz (Custom Solutions Group) Elda Vale (Research/Market Intelligence & Corporate Marketing) Michael Vizard (Editorial Director, Enterprise Group)

VI C E PR E S I D E NTS John Davison (Game Group) Elaine Ebner (Corporate Sales) Aaron Goldberg (Market Experts) Barry Harrigan (Internet) Kristin Holmes (International Licensing) Michael Krieger (Market Experts) Ray Ledda (Game Group) Rick Lehrbaum (Internet) Carlos Lugo (Production) Eric Lundquist (Editorial Director, eWEEK) Chris Maginn (Internet) Jim McCabe (PC Magazine) Scott McDaniel (Game Group) Paul O’Reilly (Event Marketing Group) Ellen Pearlman (Editor in Chief, CIO Insight) Beth Repeta (Human Resources) Dave Rock (Circulation) Chris Stetson (Research/Market Intelligence) Stephen Sutton (Audience Development, Consumer/Small Business) Stephen Veith (Enterprise Group Publishing Director) Monica Vila (Event Marketing Group) Randy Zane (Corporate Communications) eWEEK editorial staff members can ™ be reached at (781) 938-2600 or (800) 451-1032, or via e-mail using the following formula: firstname_ [email protected]. For example: [email protected]. (Don’t use middle initials in address.)

This eWEEK: Lenovo

36 Reader mail 46 Jim Rapoza: Security’s

NEWS& ANALYSIS 13 Government-funded Komoku takes aim at

rootkits. 14 Microsoft withholds

details of vulnerabilities. 16 The “new Lenovo” cel-

ebrates its first birthday. 18 Apparent eyes proactive

network management.

to detect, according to a McAfee study. 31 EMC offers virtual shred-

ding for disk-based line. 33 The Buzz

fWEEKLABS 48 REVIEW: Sun and Open-Xchange servers

51 51 Peter Coffee: It’s time

to redefine “information superhighway.”

can put Outlook face on e-mail.

20 Rogue Wave’s Hydra

lets SOA processes run in parallel.

like a box of chocolates.

30 Malware is now harder

54 Spencer F. Katt: Gossip

Cover Illustration: Devon Bowman

has the kitty all shook up.

22 Labs: What Linux path

should Oracle take? 22 Work in Progress:

Labs is testing SAVO and Sant sales tools. 24 Microsoft could profit

from Vista premiums. 25 Microsoft’s next Vista

test build nears release. 26 Oracle enters telecom

space with SDP.

CONTENT SET FREE 37 Tech Analysis: CAS

eases compliance, but standards are needed to open it up. 39 REVIEW: HP’s RISS

1.4 is a powerful archive solution. 41 Sample RFP: Labs

ers are around the bend.

looks at CAS systems.

29 BEA warms up to giving

44 Case Study:

28 Anti-virus vendor merg-

support for ColdFusion. 29 Sybase releases an

enhanced PowerBuilder. 30 Microsoft patches are

causing problems.

w w w. e w e e k . c o m

CMS drives Edmunds’ Web site. 45 Day Software’s Roy

Fielding discusses content standards.

APRIL 24, 2006 n eW E E K 7

NEWS&ANALYSIS ERIC LUNDQUIST: UP FRONT

USB security: A sticky situation

WEBLOG

ERIC’S PICKS FROM GWEEK BLOGS

go.eweek.com/weblog

SHUTTING DOWN TRANSFER POINTS MUST BE MADE EASIER read about how to shut off USB ports, but all streeters say you will also encounter this: “Warning: SeriDuco Cement is ous problems might occur if you modify the the preferred glue registry incorrectly by using Registry Editor for permanently shutting or by using another method.” A search of down a USB, serial or the Microsoft security site yields little more any other laptop port that than another glue-in-the-ports article. A trip needs to be shut down. I over to Dell.com ends up with the company spoke with Ben Campbell, trying to sell a cable lock, which is a good vice president for sales at investment but of little help in describing Safend, about some of the more brute-force security measures you should consider in methods used to shut off port access, followlaptops. A search over at Apple.com for USB ing an investigative article that appeared in security gets you hits about setting up wirethe Los Angeles Times, in which Campbell less security. provided the Duco endorsement. You could argue that it is not the job of In that LA Times article, reporter Paul companies such as Microsoft and Dell to Watson described a bazaar next to the stop users from doing stupid things. And Bagram Airbase in Afghanistan where flash even with the stress and urgency of wartime drives allegedly containing the identities of contingencies, letting classified informalocal agents hired by the U.S. forces were tion leak out onto flash drives is a senseless for sale. The drives, apparently stolen from and dangerous activity. The point is that inside the base, could be had for as little as even with the added impetus security has $40 and appeared to be sold mostly for the achieved in the enterprise since the Sept. 11 hardware value with little or no regard for attacks, security still often takes a back seat the information they contained. to ease of use, flashy graphics and speedy The article touched off a furor (as it connections. Is it too should have) and led much to ask vendors to a follow-up article SECURITY OFTEN TAKES A for one of their flashy describing an army BACK SEAT TO EASE OF USE graphic screens to make officer traveling through visible which ports are the bazaar with a wad AND FLASHY GRAPHICS. on and present a data of cash, buying up transfer risk and make it easy to turn ports every errant drive being offered. I wrote an off without being prompted to change regisarticle for eweek.com on the risk associated try settings and BIOS commands? with USB devices. While I suggested glue The history of industrial design often has or chewing gum as the most expedient and visible way to mess up a USB port, Campbell been one that keeps users from activities where they can harm themselves and others. noted that while gluing up the port is one Anti-lock brakes, airbags and smoke alarms method, that doesn’t lock down other leaky have become standard products that are methods, including infrared, wireless and aimed at alerting users to dangerous activities transferring the hard drive from a stolen lapor saving them when they engage in those top to an unfettered laptop. activities despite warnings. The movement to Companies such as Safend, SmartLine vendors and corporate technology managers and others have sprung up with products to locking down all access and then only opensafeguard laptops and the many ports that ing up data and ports as required is an indicaadorn new computers. Did you shut down tion of movement in the right direction. The your USB ports? What about slipping a $20 next, and best, step is incorporating security USB hub adapter into your PCMCIA slot? into the design from the start and making I’m just saying that while computer vendors the level of security a visible reminder for the have gone out of their way to speed up data computer user. ´ transfer, they are sorely lagging at making it easy for users to shut down those transfer points. Editorial Director Eric Lundquist can be reached You can go to Microsoft’s security site to at [email protected].

W

10 e W E E K n A P R I L 2 4 , 2 0 0 6

@

K I M NAS H

A degree in IT? There’s some good debate riffing about how higher education does—and doesn’t— prepare technology professionals for real-world business jobs. ... I wonder whether IT isn’t like journalism: You don’t necessarily need an advanced degree to practice (though that can help), and some of the best journalists have diplomas in other topics. It’s more will and skill that determine a good practitioner. 4/14/2006

@

D A N B R I O DY

RFID’s time has come Nothing is so powerful as an idea whose time has come. And though Wal-Mart accelerated RFID’s future, all those companies that were forced kicking and screaming into that future now see its value. Manufacturers see the value of inventory tracking. Even some consumers, despite occasionally taking a hammer to it, see the benefits of this powerful, controversial little technology. 4/14/2006

@

B E N CHAR NY

Playing in Google’s sandbox While Google’s never confirmed its existence, Web site operators routinely complain about the “Google sandbox.” The practice, perhaps better described as a Google sand trap, is meant to maintain the integrity of what Google’s delivering. 4/17/2006 w w w. e w e e k . c o m

73% of the FORTUNE 100 ® and 76% of the European 100 compared business collaboration providers and came to a single conclusion.

Obviously, great minds think alike.

Many of the world’s most successful organizations rely upon Sterling Commerce to automate their business processes, so they can exchange critical information with their trading partners, subsidiaries and customers. Reliably. Securely. And regardless of the application being used. Sterling Commerce delivers the first platform to meet all the complex challenges of real-world multi-enterprise collaboration. Find out what so many companies already know. Speak to a Sterling Commerce representative today. Or visit www.sterlingcommerce.com BUSINESS

A P P L I C AT I O N S

/

BUSINESS

I N T E G R AT I O N

/

BUSINESS

INTELLIGENCE

/

BUSINESS

PROCESS

MANAGEMENT

/

SOLUTION

DELIVERY

©2006 Sterling Commerce, Inc. ALL RIGHTS RESERVED. Sterling Commerce and the Sterling Commerce logo are trademarks of Sterling Commerce, Inc. Sterling Commerce is an AT&T company. FORTUNE is a registered mark of Time Inc.

14 MICRO-

NEWS&

SOFT MUM ON SECURITY DETAILS TO PROTECT USERS

16 AS THE

‘NEW LENOVO’ TURNS 1, IT SEEKS GAIN IN PC MARKET

24 MICRO-

SOFT TO PUSH PREMIUM EDITIONS OF WINDOWS VISTA

31 EMC

ADDS VIRTUAL TAPE SHREDDING TO DISK LIBRARY LINE

ANALYSIS

Startup blasts rootkits By Ryan Naraine

A

startup funded by the U.S. government’s Defense Advanced Research Projects Agency is ready to emerge from stealth mode with hardware and software-based technologies to fight the rapid spread of malicious rootkits. Komoku, of College Park, Md., plans to ship in the summer a beta of Gamma, a new rootkit detection tool that builds on a prototype used by several sensitive U.S. government departments to find operating system abnormalities that may be linked to malicious rootkit activity. Rootkits modify the flow of the kernel to hide the presence of an attack or compromise on a machine. This gives a hacker remote user access to a compromised system while avoiding detection by anti-virus scanners. The company’s Copilot prototype is a high-assurance PCI card capable of monitoring the host’s memory and file system at the hardware level. It is specifically geared toward high-security servers and computers. Gamma, meanwhile, is a separate, software-only clone of Copilot that will target

w w w. e w e e k . c o m

businesses interested in a lowassurance tool to protect laptops and PCs. Komoku launched quietly in 2004 with about $2.5 million in funding and rootkit detection contracts from DARPA, the Department of Homeland Security and the U.S. Navy. The

changes the system at the operating system level, it can’t be reliably detected via the OS itself or through applications running on the system,” he said. “We have this notion of what the operating system is supposed to look like, and we look for deviations

company has its roots at the University of Maryland, where computer scientist William Arbaugh worked on what he calls a “unique approach” to finding rootkits. “Security technologies depend on the correctness of the system they’re actually checking,” said Arbaugh, who now serves as president of the outfit, which consists of three full-time and two parttime employees. “If something

to that. We aren’t initially looking for the rootkit—we look at the side effects of the infection.” Komoku has partnered with security vendor Symantec to handle disinfection and restoration after rootkits and other sophisticated forms of malware are detected. Symantec’s LiveState product combines with Copilot and Gamma to restore the system to its original state.

James Butler, a renowned rootkit researcher who serves as Komoku’s chief technology officer, said Gamma will have limited cleanup capabilities because it is softwarebased and susceptible to direct attack, much like any application running on the operating system. “Cleanup is a very difficult goal while maintaining a running system. When you find a rootkit, you essentially have several choices. The easiest choice is to halt the system. But, that means that you’ll lose any evidence that might be in memory. It also means that the services provided by that system are made unavailable,” Butler explained. Another choice, said Butler, is to eliminate the effects of the rootkit, although this can be very difficult because of the complicated nature of an operating system. A third option is to allow the rootkit to remain active while attempting to discern its motives, Butler said, noting that both Gamma and Copilot will allow all three of these choices. Komoku’s long-term plan is to have both the hardware and [CONTINUED ON PAGE 14]

A P R I L 2 4 , 2 0 0 6 n e W E E K 13

DAN GUIDERA

GOVERNMENT SECURITY AGENCIES BACK KOMOKU’S MALWARE-OBLITERATION PLANS

NEWS&ANALYSIS

Microsoft’s silence isn’t golden COMPANY WITHHOLDS DETAILS OF FLAWS By Ryan Naraine

icrosoft has fessed up to hiding details on software vulnerabilities discovered internally, insisting that full disclosure of every security-related product change only aids attackers. The admission follows criticisms from a security researcher that the policy of silently fixing software flaws is “misleading” and not in the spirit of Microsoft’s push for transparency. Mike Reavey, operations manager of the Microsoft Security Response Center, said the Redmond, Wash., company’s policy is to document the internally discovered flaws and the area of functionality where the change occurred but that full details on the fixes are with-

M

held for a very good reason: to protect customers. Critics argue that silent fixes can hurt businesses that depend on information from thevendortodeterminedeployment time frames and the actual severity of the patched vulnerability. According to eEye Digital Security, which sells host-based IPS (intrusion prevention system) technology, silent fixes from Microsoft are commonplace. “We routinely find them,” said Steve Manzuik, product manager of eEye’s security research team, in Aliso Viejo, Calif. Manzuik said Microsoft has been silently fixing bugs since as far back as 2004. He referred to the company’s MS04-007 bulletin as a classic example of Microsoft announcing a fix for a single vulnerability when, in fact, a total of seven flaws

ROOTKITS FROM PAGE 13

software versions collect forensic data when a compromise is detected. Butler said both products are able to capture hidden malware in memory and send it back to a central management station when the products are running in enterprise mode. Komoku also is exploring potential partnerships with other security companies that have offline malware analysis tools, he said. Pricing details have not been worked out, but Arbaugh expects to ship Copilot to high-end enterprises with supersensitive data. Gamma, on the other hand, is lower-assurance and aimed at protecting business assets that don’t require high-end security protection and businesses that are unable to install hardware. Arbaugh said Gamma has been built with two modes of operation: an enterprise mode where it communicates with a central server to receive updates and incident reports, and a stand-alone mode where incidents are reported locally. Updates 14 e W E E K n A P R I L 2 4 , 2 0 0 6

were quietly fixed. Manzuik’s team presented a paper on its findings at the Black Hat Briefings in Europe earlier in 2006 to highlight problems with withholding fix details from customers. “When details aren’t included, [administrators] won’t install [a] patch,” Manzuik said. Manzuik said IT departments lack skills or resources to reverse-engineer every patch. “They are simply left in the dark and may ignore a patch that is supercritical to their environment. Meanwhile, the bad guy has spent the time to find out what was silently fixed,” he said. Matthew Murphy, the independent researcher who flagged the issue after finding silent fixes in the April batch of patches, said third-party vendors that incorporate code from Microsoft also are hurt by the lack of full disclosure. Murphy outlined a

Komoku at a glance What’s the big idea? To offer hardware and software security at the operating system level to ferret out stealth rootkits

Is there a product? Komoku’s first product is a PCI card that detects malicious changes to the operating system; a software-only product is due this summer

Who’s in charge? William Arbaugh, president, and James Butler, CTO; Butler wrote “Rootkits: Subverting the Windows Kernel”; the company has three fulltime and two part-time employees

Does Komoku have customers? Yes, it has contracts with the Navy, Department of Homeland Security and DARPA

recent case in which anti-virus vendor Trend Micro got burned by a silent fix of Microsoft’s. The issue involved a bug in Visual Studio that was reported to Microsoft in 2002 but remained unfixed for several years. Withheld information caused Trend Micro to unwittingly use vulnerable code in its products, putting its customers at risk of a heap overflow vulnerability that could be used in code execution attacks. Manzuik also pointed out that businesses rely heavily on host-based IPS technology to secure valuable assets while patches are being tested for deployment. “How can you create a signature for a flaw if you don’t know the location of the flaw?” Manzuik said. Reavey said businesses should use Microsoft’s severity rating system to help with patch deployment timetables. “It’s important to remember that the best way to be safe and secure is to apply all the updates,” he said. ´

will be available via a subscription service similar to the anti-virus space, he said. Citing confidentiality issues, Arbaugh declined to discuss the severity of the rootkit threat on government networks. However, he said that during actual Copilot tests, it is “very clear that the government shares the same problems like everyone else.” Copilot was being tested on the Navy networks when news of the Sony DRM (digital rights management) rootkit issue made headlines in November 2005. “That was a zero-day rootkit to us, so we decided to throw it at Copilot as part of the operational tests. We detected the Sony rootkit in all its vectors, in real time,” said Butler. According to statistics from Microsoft, rootkits account for more than 20 percent of all malicious programs removed from Microsoft Windows machines. The stealthy technology has been found in a variety of threats, including spyware, Trojans and DRM. ´ w w w. e w e e k . c o m

NEWS&ANALYSIS

Lenovo, it’s time to grow up ON ITS FIRST BIRTHDAY, THE PC COMPANY’S IMMEDIATE CHALLENGE IS GETTING ITS BRAND KNOWN By John G. Spooner

I

t’ll be business as usual at Lenovo Group’s headquarters on May 2. However, the day will hold special significance, marking the first anniversary of its acquisition of IBM’s Personal Computing Division. Since the closing of the $1.25 billion deal on May 2, 2005, the “new Lenovo,” as the company often calls itself, has plotted a course that it hopes will broaden its customer base and ultimately hoist it upward in the ranks of the world’s top PC makers. To date, the company—a distant third in market share behind Dell and HewlettPackard—appears to be steadily, if slowly, advancing toward its goal. It’s already in better shape than HP was one year after purchasing Compaq, for one. But the new Lenovo still has work to do, analysts say. Granted, Lenovo’s and IBM’s businesses, which essentially focused on China and the rest of the world, respectively, were more complementary than those of HP and Compaq.

But Lenovo management is credited by analysts and customers as having kept up its product quality and service standards and for having maintained the bulk of its large customers. Some customers say it has also become more aggressive on pricing, particularly in large bids. “There was a certain amount of trepidation” about the deal, said Robert Rosen, president of the IBM user group Share, of Chicago. But, “the bottom line, from everything I’ve seen ... nobody notices a difference, which is good news.” But even though it saw solid growth in the first quarter—it shipped 3.4 million units, up 10.5 percent, versus market leader Dell’s growth rate of 10.2 percent, according to Gartner— analysts expect more from Lenovo. “The step to demonstrate, now, is to start growing market share,” said Richard Shim, an analyst at IDC, in San Mateo, Calif. Lenovo faces both perceptual and legal challenges. It must continue to establish its brand

name as well as counter challenges such as that from the State Department, which has moved to quash an agreement reached by CDW to sell the agency $13 million worth of ThinkPads due to security concerns. Ray Gorman, a Lenovo spokesperson in Purchase, N.Y., said the company believes that CDW has already gone over the implications of its deal with the State Department. Before that, its acquisition of IBM’s PC arm passed muster with the Committee on Foreign Investments in the United States, which reviewed the deal in March 2005. Lenovo’s more practical concerns revolve around its efforts to gain market share. It shipped 3.4 million units in the first quarter of 2006, versus Dell’s 9.6 million and HP’s 8.7 million, according to IDC. Lenovo’s strategy, in part, centers on its Lenovo 3000 brand, an all-new line of computers that rolled out in February to target SMBs (small and midsize businesses). Over time, Lenovo aims to

sell to three sets of customers worldwide, as it does now in China. It plans to target larger businesses—a traditional IBM ThinkPad stronghold—as well as SMBs and consumers, according to Mark Cohen, executive director of Lenovo’s Notebook Business Unit, in Raleigh, N.C. To that end, the company plans to add some products to the Lenovo 3000 line as well as to develop a consumer product line. “We’re starting to work on bringing [the consumer line] into selected markets, first in Asia and then looking at where it’s applicable outside of that ... in order to further extend our reach and capture opportunities that are out there,” Cohen said. Indeed, “the biggest challenges it’s going to face, going forward, are going to be go-tomarket,” said Leslie Fiering, an analyst at Gartner, in Stamford, Conn. Lenovo “needs to get the Lenovo brand into the channel. This is not an area where it has had to play seriously before. There’s a learning curve there,” said Fiering. ´

Happy first birthday to the new Lenovo Here’s what the first year of life for the reborn company has been like:

2004 DECEMBER Beijing’s Lenovo Group announces its intent to purchase IBM’s PC business for $1.25 billion.

MAY After gaining government approval, the deal closes. The “new Lenovo” sets up headquarters in Purchase, N.Y.

2005

16 e W E E K n A P R I L 2 4 , 2 0 0 6

DECEMBER Steve Ward, Lenovo’s CEO, steps down. He is replaced by William Amelio (pictured), former head of Dell in China.

SEPTEMBER Company details its intent to target SMBs throughout the world. It unveils plans to tout the Lenovo brand outside China, in large part by sponsoring the 2006 and 2008 Winter and Summer Olympics, respectively.

2006

MARCH Lenovo restructures, cutting 1,000 jobs and moving its operational headquarters to Raleigh, N.C., and Beijing, in an effort to streamline operations.

FEBRUARY The Lenovo 3000 PC line arrives, expanding the company’s efforts to target small businesses.

MAY The new Lenovo marks its first anniversary.

w w w. e w e e k . c o m

NEWS&ANALYSIS

UPDATg

Apparent eyes proactive fixes

UPDATES TO RECENT STORIES

go.eweek.com/updates

Google doubles down on enterprise search GOOGLE HAS FORGED NEW PARTNERSHIPS

with business software suppliers Oracle, Cognos and Salesforce.com to push its enterprise search features (eWEEK, Jan. 23, Page 23). Essentially, the companies are now set to blend their features together through a new Google user interface, called OneBox, that’s found at Google Base, Google’s classifieds listings. The first mashups will debut this summer. —Ben Charny

Intel resets INTEL IS HITTING THE RESET BUTTON, FOL-

lowing a lackluster first quarter. The chip giant, which has been struggling to thwart AMD (eWEEK, Jan. 23, Page 8), on April 19 reported firstquarter 2006 revenue of $8.9 billion and earnings per share of 23 cents, down 5 percent and 44 percent, respectively, from the first quarter of 2005. The second-half comeback plan: Cut spending by about $1 billion and speed introduction of its new processors based on its Core Microarchitecture—its first such transition since the launch of the Pentium 4 in late 2000. —John G. Spooner

IBM weighs in BIG BLUE IS HEDGING ITS BETS. IBM BROKE

its silence about the potential implications of Red Hat’s acquisition of JBoss (eWEEK, April 17, Page 13) on their current close relationship, saying that it will continue to partner strongly with both Red Hat and Novell. In an interview with eWEEK, Scott Handy, IBM’s vice president for Linux and open source, in Somers, N.Y., said the wheeling and dealing could accelerate the adoption of open source and open standards. —Peter Galli 18 e W E E K n A P R I L 2 4 , 2 0 0 6

TESTERS UPBEAT ABOUT APPCRITICAL NETWORK TEST TOOL By Paula Musich

pparent networks is the latest in a long line of network and systems management vendors talking a good game about how they can help administrators manage proactively. The difference this time? Apparent Networks may actually be able to deliver, said Jimmy Brown, vice president of network services for Dallas-based outsourcer Affiliated Computer Services. Brown is beta testing new network management software from Apparent Networks that can test the different paths that applications traffic traverses and automatically identify problems by the signatures they create as packets cross the network. The offering, AppCritical, will be launched May 1 at Interop in Las Vegas. Brown has found that the new AppCritical network performance management system can find problems and allow ACS and its clients to fix them, often before users become aware there is a problem. “Proactive monitoring is what AppCritical delivers, so we can ensure that we understand what’s going on with the network at all times instead of just reacting to client requests,” said Brown. The patented technology in AppCritical allows the tool to perform continuous, real-time testing of network paths, rather than focusing on the availability of individual devices in the network. It sends out a small burst of precisely timed and configured test packets once per minute, but users can define other interval periods. “When we detect something’s changed ... we can then test more frequently,” said Kelly Daniels, chief technology officer at Apparent Networks, in Vancouver, British Columbia. As it detects problems, AppCritical automatically escalates the testing, performing deeper and deeper tests to look for such Sublayer 3 problems as full/half duplex mismatches, NIC (network interface card) driver problems, rate-limiting behavior, QOS (quality of service) issues and so on. AppCritical is made up of an NIS (Net-

A

work Intelligence System), typically installed on a server in the data center. It contains several analysis engines, a database and a user interface, and it manages probes or sequencers that are placed at strategic locations around the network. A new monitor in the sequencers for AppCritical “keeps an eye on the microtests, knows about the paths, schedules continuous testing, and when it detects there is a problem, it accelerates the testing to verify there is a problem. Once it confirms the problem, it notifies the NIS to run a full test,” said Daniels. The NIS evaluates the results of the full test and sends an e-mail or an SNMP notification or both to network operators. With the tool, users can set thresholds for service quality definitions that allow users to ensure the network is providing the performance required by an application.

AppCritical automatically identifies problems by performing continuous, real-time testing.

Because AppCritical, which will cost about $100,000, can reduce the amount of time it takes to troubleshoot performance problems, beta tester Willis Marti looks at it as a “people multiplier,” said the associate director for networking, computing and information services at Texas A&M University, in College Station. “It’s a continuous test that tells us when things go out of balance from what we expect or desire. Then AppCritical does its own shift into a detailed test and alerts us. By the time you’ve put a body on looking at a screen, you’ve got your first tests [done]. Then you can decide what to do after that point. So I can do more things with the same number of people because it points me to the right place,” Marti said. ´ w w w. e w e e k . c o m

NEWS&ANALYSIS

HYDRA HEADS FOR PARALLEL

helped eliminate those issues, Singh said. ogue wave software, Meanwhile, in the world of a division of Quovadx, SOA, standards are both boon on April 19 announced and bane. One attendee, who the availability of ROGUE WAVE’S SOA FRAMEWORK CHEWS THROUGH requested anonymity, said Hydra 3.0, the latest SERVICE-ORIENTED, PARALLEL-PROCESSING TRAVAILS that while SOA works, “all version of its service-oriented these standards are making architecture framework, at an event here targeting the financial services Hydra] is one of the applications we things too complex for the ordinary perthink will help people move into distrib- son.” industry. Dana Gardner, president and founder Hydra is designed to facilitate the dis- uted computing in the next level in the of Interarbor Solutions, in Gilford, tribution of business processes within an enterprise.” Seven beta implementations of Hydra N.H., agrees, to a point. “A lot of standards application, enabling developers to address service-oriented and parallel-processing are under way with POC (proof-of-con- are de facto, and we need to lay down development challenges while capitalizing cept) customers in the financial ser- the law and say this is the standard,” Gardon existing software assets. In essence, vices, telecommunications and software ner said. “Open source could come forward and take over.” Hydra enables SOA processes to run in industries. Moreover, the ability to stitch things Integrating disparate pieces and reusing parallel using parallel-processing technology, said Rogue Wave President Cory components is one draw of SOA. “We together is one of the strengths of SOA, had a lot of different applications, each tak- panelists said. In that regard, the SOA marIsaacson. Isaacson said Rogue Wave’s use of what ing care of its own piece of the system,” ket is not one where one-stop shopping is it calls Software Pipelines is based on said Aviral Singh, in New York, a director particularly suitable, some said. “SOA design patterns that are in turn based on at Credit Suisse. “People needed to talk to lets you do best of breed; there’s no onereal-world experience. He said the each other, and this was done point to point stop shop,” said Gibbs. “SOA lets you Pipelines technology allows for efficient without any management.” However, the optimize at the component level.” However, IBM recently made a soupexecution and distribution of software implementation of an SOA environment to-nuts announcement regarding SOA comcomponents or services for simulponents and services, including 11 new taneous processing on available int products and more than 20 upgrades to resources. As such, this peer-toexisting products and services. BEA Syspeer architecture minimizes bottletems, Oracle, JBoss (now part of Red Hat) necks and allows businesses to Hydra is a distributed SOA framework and Sun Microsystems also promote a achieve new levels of throughput and based on the SCA approach proposed by full SOA stack. performance, Isaacson said. BEA, IBM, Oracle, SAP, Iona and others “The whole point of SOA is it enables Mike Stolz, chief architect of debt a best-of-breed kind of buy,” Isaacson technology at Merrill Lynch & Co. and Uses Software Pipelines to make SOA said. “The large vendors do want to be ubiqa member of a panel at the Hydra processes run in parallel using paralleluitous, but their offerings are not strong launch event, said that while he was processing technology across the board.” not speaking for Merrill Lynch, his Major Wall Street investment companies Rogue Wave’s Hydra supports the experience has led him to believe that rely on Rogue Wave’s software to help run recently released SCA (Service Component performance is a key issue in the SOA mission-critical business systems Architecture) specification that was proworld. Rogue Wave Hydra IDE (integrated posed by IBM, BEA, Oracle, Iona TechTom Gibbs, director of worldwide development environment) is based on the nologies and others. And Isaacson said strategy and planning in Intel’s Eclipse open-source IDE Hydra is the first production-ready, highSolutions Market Development Hydra features cross-language support performance SOA development framework Group, said the problems of perand coalesces Java and C++ components and run-time that supports and compleformance in SOA can be overcome into the same Web service ments key concepts of SCA. with software like Hydra, as well as Gardner said: “The ability to take [SCA] with processing power. “There is stuff Key customer markets include financial into the role of coalescing Java and C++ out there to process XML at wire services, telecommunications and indecomponents into the same service—all speed,” said Gibbs, in New York. “The pendent software companies tightly coupled—is an important milestone performance challenges are going to Source: eWEEK reporting for making SOA mission critical.” ´ be ‘overcome-able.’ ... [Rogue Wave’s By Darryl K. Taft IN NEW YORK

R

SOA runs fast, thanks to Rogue Wave’s Hydra

20 e W E E K n A P R I L 2 4 , 2 0 0 6

w w w. e w e e k . c o m

HP PROLIANT BL35p BLADE SERVER with ProLiant Essentials Management Software • Up to 2 Dual-Core AMD OpteronTM 200 Series processors • High density: Up to 96 servers per rack • Flexible/Open: Integrates with existing infrastructure • HP Systems Insight Manager TM: Web-based networked management through a single console • Rapid Deployment Pack: For ease of deployment and ongoing provisioning and reprovisioning • Integrated Cisco or Nortel switch options Save up to $450 on select AMD based Blade Servers.1

HP STORAGEWORKS MSA1500cs with StorageWorks Essentials Management Software • Up to 24TB of capacity (96 250GB SATA drives) • Up to 16TB of capacity (56 300GB SCSI drives) • Ability to mix SCSI and Serial ATA enclosures for greater ﬂexibility • 2GB/1GB Fibre connections to host Get 2TB of storage free ($2,008.80 value)2

Chaos, now under your control. HP BladeSystem servers offer tools to help you keep pace with fluctuating demands.

The HP ProLiant BL35p Blade Server is designed to relieve some of the stress. Its AMD OpteronTM processors offer dual-processor power with breakthrough efficiency. With management features like the Rapid Deployment Pack that lets you deploy and redeploy blades without missing a beat, and a single-view‚ graphical user interface that streamlines monitoring and configuration, HP BladeSystem servers work with you so you don’t have to work so hard. And, bundled with the StorageWorks MSA1500cs, you can reduce the cost and complexity of deploying a storage area network, giving you a better return on investment. Save up to $450 on select AMD based Blade Servers.1

SMART ADVICE > SMART TECHNOLOGY > SMART SERVICES

Call 1-888-223-7061 Click hp.com/go/bladesmag50 Visit your local reseller

1. Save up to $450 on select AMD based Blade Servers. Offer valid through 7/31/06. 2. Receive up to 2TB of storage free with purchase of HP StorageWorks Modular Smart Array 1500cs devices. Offer valid through 7/31/06. All offers available from HP Direct and participating resellers. Prices shown are HP Direct prices, are subject to change and do not include applicable state and local sales tax or shipping to recipient’s destination. Reseller prices may vary. See Web site for full details. For hard drives, 1GB = 1 billion bytes. Actual formatted capacity is less. Photography may not accurately represent exact configurations priced. Associated values represent HP published list price. AMD, the AMD Arrow Logo, AMD Opteron and combinations thereof are trademarks of Advanced Micro Devices, Inc. ©2006 Hewlett-Packard Development Company, L.P.

NEWS&ANALYSIS

Larry Ellison on the penguin prowl LABS GIVES ORACLE SOME ADVICE AS IT EYES LINUX COMPANIES AND DISTROS ord is that larry ellison and could get off to a similarly strong start by Oracle are interested in having a beginning with Debian, slapping a new Linux distribution of their very nameplate on it and shaping the distribuown—a proposition that, in my opinion, tion to fit Oracle’s needs. What’s more, a child distro of Oracle would be of limited value to Oracle. Building and maintaining your own dis- and Debian would pay back real dividends to the Debian project tribution is a real chore. upstream. Just ask Sun MicrosysOracle could build on tems, which, at one time, was set to offer up its own distro before Fedora or even Red Hat Enterprise Linux, tossing the project in favor of a SUSE Linux but this strategy would indirectly strengthen base for its (also since tossed away) Java Red Hat’s Linux leadership role. By opting instead to launch a sub-distro of Debian, Desktop System. Oracle would be hitching its forHowever, if Oracle is serious tunes to an entity that couldn’t about staking a Linux OS claim, care less about competing with it should forget about buyOracle. ing Red Hat (too costly), If Ellison truly has his Novell (too much baggage) heart set on buying a Linux or Mandriva (too obscure). company, rPath would I’ve seen Ubuntu mentioned make a better target than the as an option, but Ubuntu and other Linux outfits I’ve menthe Debian distribution on tioned. The young company is which it’s based are noncomchock-full of former highmerical beasts—you can’t buy Ellison is looking at Linux level Red Hat engineers, what isn’t for sale. firms to fill stack gaps. and it’s focused on creating Ellison would do well, though, to emulate what Mark Shuttleworth application-centric distributions, rather and company have done with Ubuntu, which than general-purpose ones such as Red exploded in popularity because its Debian Hat’s and Novell’s. But, Oracle, keep in mind that we’re talkfoundation was already so strong. Oracle

W

ing about free software here: There’s no sense in buying or building what you can simply take. ´ Senior Analyst Jason Brooks can be reached at [email protected].

W W WE B R E S O U R C E S

Free to be Why buy or build a Linux distro when Debian’s available for free?

www.debian.org

The right path? rPath boasts both former Red Hat engineers and an application-centric distribution approach

www.rpath.com/corp

Sweet child o’ mine One compelling measure of a distribution’s popularity is how many child distros it’s sired

distrowatch.com/dwres.php? resource=independence

The sales pitch AS SOMEONE WHO CREATES DOC-

uments for a living, I can attest that it isn’t easy, particularly when trying to make important points to people with limited time to read information. This can be particularly true for sales and marketing teams, since they are often tasked with building communications tailored to show their products and services as best-suited to individual customer needs— lots of individual customer’s needs. To simplify and structure this kind of work, and to make it eas22 e W E E K n A P R I L 2 4 , 2 0 0 6

ily reproducible, a small number of companies have introduced proposal automation suites. These products are designed to help users develop proposals, presentations and responses to RFPs (requests for proposal) using data that will be most relevant to a particular customer’s needs. The applications help sales staffers consult more effectively by allowing them to focus on messages that address customer pain points and package success stories about companies of similar size in the same industry.

I’m currently testing two such suites: SAVO Group’s Sales Asset Manager and Sant’s Sant Suite (see screen). Sales Asset Manager has been available as a hosted application from its inception, while Sant has just introduced a hosted version of Sant Suite. I’m also looking at a

search tool from Pragmatech that helps salespeople find relevant information that resides outside of proposal automation applications. How well these products meet their respective goals will be revealed in my reviews in the coming weeks. —Michael Caton w w w. e w e e k . c o m

MOBILIZING THE WORKFORCE WITH TABLET PC Toshiba Tablet PCs with Microsoft Windows® XP Tablet PC Edition are revolutionizing the way people work and helping VARs and solution providers solve the mobility challenges faced by their customers. Visit the Toshiba Business Center today— sponsored by Toshiba and Microsoft—to ﬁnd out how.

www.toshibabusiness.com Y VIRTUAL SYMPOSIUM

Y ESEMINARS Learn all about how Tablet PCs can beneﬁt your customers’ businesses—as well as your own—during a live, interactive eSeminar.

May 24 Everything You Need to Know About Tablet PC Everywhere you look—from doctors’ ofﬁces and hospitals to insurance agencies and pharmaceutical ﬁrms —Tablet PCs are helping companies enhance productivity and improve business processes. Join Toshiba and Microsoft for a live Virtual Symposium to ﬁnd out how you can use Tablet PCs to deliver complete mobility solutions to your customers. Learn ﬁrsthand the operating and business process efﬁciencies that can be gained with Tablet PC. Hear from mobile computing executives about the advantages of equipping your workforce with Tablet PC technology.

April 27: Easy Information Capture with Tablet PCs Who should attend: Small and midsize business owners, IT professionals, solution providers May 10: Tablet PCs for the Enterprise Road Warrior Who should attend: Senior IT executives, IT managers, solution providers

Y ARCHIVED EVENTS

Visit www.toshibabusiness.com today to register!

For Event Registration Information and Access to Industry-Speciﬁc Tablet PC Resources, Visit www.toshibabusiness.com

Copyright © 2006 Toshiba America Information Systems, Inc. and Microsoft Corporation. All rights reserved. Microsoft, Windows, and the Windows logo are registered trademarks of Microsoft Corporation in the United States and/or other countries.

Paperwork Made Simple: Forms Automation with Tablet PCs Solution Provider Alert: Tablet PCs as Part of Mobility Solutions Access anytime at www.toshibabusiness.com

digital

Gosling outlines AJAX obstacles CREATOR OF JAVA SAYS SUN EASES USE OF AJAX COMPONENTS BUT CREATING THEM IS NOT EASY

J

ames gosling, the creator of java and chief technology officer of Sun Microsystems’ developer products group, in Santa Clara, Calif., said he believes Sun is leading the way to enabling developers to incorporate Asynchronous JavaScript and XML components into Web applications. But

building those components is another story, he said. In an interview with eWeek Senior Editor Darryl K. Taft, Gosling discusses

some of Sun’s highs and lows in the software business. What’s Sun doing in terms of AJAX support, and what do you think you could do more of ? What are Java developers asking for? What we’re doing these days is a combination of things. One is to make sure that the serverside frameworks like JSF [ JavaServer Faces] will work well with the various different client frameworks like AJAX. So using JSF you can build JSF components that download AJAX on the client. They do the interaction using AJAX so that people can use it pretty easily. At a level up, we move a lot of effort into the tools so that when you use something like Creator and the enterprise stuff in NetBeans, then you can incorporate AJAX components into the Web pages that you build. So we end up with this kind of meta-component model, where we can use components of many different kinds and get them to all work together. Whether it’s AJAX or applets or plain old HTML, they all play together. And that works pretty well. That’s sort of the area that we get the most demand from developers.

The place where there’s sort of black magic right now that we’re trying to figure out what to do in, is around how you create AJAX components. We can make it pretty easy to use AJAX components. There are a bunch of folks out there that just need to use them. But there’s a dramatically smaller community of people that create them. Creating them is extremely hard—not because programming JavaScript is hard, but because all these flavors of JavaScript are ever so slightly different. You have to build your components so that they’re adaptable to all the different browsers that you care about. And you have to figure out how to test them. None of the browsers has decent debugging hooks. We could build little things for people where they could test these components. The problem is that it wouldn’t be exactly the same environment as being inside Internet Explorer or being inside Spark or being inside Firefox. And those environments are pretty limited. Pretty much all you can do is include

EW1 eW E E K n A P R I L 2 4 , 2 0 0 6

Gosling: Right now it looks pretty hopeless to make AJAX development easier.

a bunch of printf’s—capture the log input as printf ’s— [with] no ability to look at variables or segue points or single-step things. There’s no ability to do cross-platform QA; you’ve just got to do them one by one. Right now it looks pretty hopeless to make AJAX development easier. So would that be an area you guys would want to go into? Well, if we could figure out a good story, it would be nice to go into. We haven’t come up with a story there that says anything terribly useful. Do you think anybody has? Well, the problem is just intrinsically really, really hard because of the divergence of the platforms. And there’s a bunch of things people do to try to make that better. Like there are a number of libraries that exist that try to paper over the differences, but lots of difficulties exist. We’re putting a lot of support into NetBeans for our

multilanguage support and language to support. No. 1 is JavaScript. And we’ll be able to do a lot of the typical IDE [integrated development environment] things like syntax management and that kind of stuff. But when it comes to debugging and QA, it’s pretty limited as to what we can do. And we’re trying figure that out. What would you say has been Sun’s biggest blunder in terms of software? There are so many to choose from. And sometimes it’s hard to say what’s a blunder and what’s just the case of the world being weird. True. And that’s why I sort of paused at the use of the term “blunder.” But you guys have taken several hits as far as your software strategy over the years. Yeah, and we tend to have to play to about a dozen different communities. We try really hard to listen to the developer w w w. e w e e k . c o m

community the most and the analyst community the least. At least in my part of the universe, we don’t do software architecture by listening to the analysts. Sometimes we have, and it’s been a dumb idea. As for blunders, boy, one of the ones that has always gotten under my skin is the whole BSD [Berkeley Software Distribution] versus [UNIX] System V Release 4 merge that we did. That marked the transition from SunOS to Solaris. That set our whole OS [operating system] story back like two or three years. That was a really tough one

to do. There were a variety of business reasons why we wanted to do it, but it was really hard for me to believe that the two or three years that it cost us were worthwhile. But it’s the kind of thing that, at the time, just felt really dumb. Now that we have a bunch of new perspective on that transition, it’s worked out reasonably well. But also it sort of worked out to be somewhat pointless because the BSD side of the universe has survived pretty well, and the whole System V universe has pretty much died. And we were trying to make peace between those competing camps.

At some level, what we didn’t know was one of those sides was going to die, and it was pretty hard to predict which side was going to die. So we tried to do this other grand, unique thing. And we mostly succeeded at that. But, in retrospect, technologically it was somewhat pointless, and we would probably have been ahead of where we are now. But, interestingly, we’re still pretty far ahead. We lost a bunch of ground, but we gained a lot of ground. Other than Java, what would you say have been some of Sun’s

AJAX client extends Nexaweb

N

EXAWEB TECHNOLOGIES HAS ANNOUNCED THAT IT WILL EXPAND THE CAPABILITIES OF THE

Nexaweb Platform with the addition of an AJAX client. Nexaweb officials said the company’s Asynchronous JavaScript and XML-

based offering for developing and deploying RIAs (rich Internet applications) will address key issues and limitations associated with current AJAX development. The AJAX client will be available to developers sometime in the second quarter of 2006, with additional versions available by the end of the year, officials said. Nexaweb’s expanded RIA platform will enable enterprises to generate Internet (HTML) applications using AJAX (DHTML/ JavaScript) technology. Nexaweb, of Burlington, Mass., announced the new AJAX client on April 11. Nexaweb’s AJAX-based offering for developing and deploying RIAs will eliminate the dependency on scripting and manual coding, address the lack of a visual dragand-drop development environment, address the lack of a rich user interface or incremental update capability, eliminate the excessive use of JavaScript that breaks the wellestablished “markup+logic” design pattern that separates UI from application logic, and break down code maintenance and team development challenges associated with JavaScript. At TheServerSide Java Symposium in March in Las Vegas, Coach Wei, Nexaweb’s chairman, founder and chief technology offiw w w. e w e e k . c o m

cer, spoke about the comparative strengths and weaknesses of using Java, .Net, AJAX or Adobe Systems’ Flash for building RIAs. Wei said that while object-oriented programmingbased technologies such as Java and .Net are good for supporting team development, they have limitations in that they require a specific virtual machine and highly skilled developers. And while Flash and AJAX are good for the Web tier, they are not designed for team development and are tied to scripting languages. “What this means to the enterprise is that RIA is not about any single technology,” Wei said. “The truth of the matter is to let them co-exist. You really need to have all four of these.” To enable the use of all four technologies, enterprises need what Wei called an Enterprise RIA Reference Architecture, which is what Nexaweb is shooting for. “With this kind of reference architecture in

bigger successes in software? Solaris, for sure. Solaris has been a really big deal for us. The Solaris guys have really been on a tear lately. The stuff in Solaris 10 is really cool. If you go to some Web sites, you can get the early builds for Solaris 11. I’ve been running Solaris 11 for quite a while now. Just the ZFS [Zettabyte File System] stuff alone is definitely worth the price of admission. A long time ago, I used to be a sys admin, and I never had a tool that was that easy for administering data files. It’s very cool. ´

place, you can write your next-generation app without having to worry about Java or AJAX or which one to use when,” Wei said. Meanwhile, “By incorporating AJAX capabilities into its powerful RIA platform, Nexaweb continues to demonstrate its commitment to open standards-based RIA development,” said Jason Bloomberg, senior analyst at ZapThink, of Waltham, Mass., in a statement. “Nexaweb’s expanded platform gives developers the freedom to select and use different technologies, easing system integration, application maintenance and asset protection.” John Justin, director of development at New York-based Artstor, said in a statement, “The Nexaweb Platform powers Artstor’s feature-rich, image-based Digital Library application. We benefit from ease of development and deployment without compromising functionality or requiring client configuration or installation. The addition of AJAX to the Nexaweb Platform represents the next generation of Nexaweb’s flexible development capabilities.” Added Wei, also in a statement, “Today’s enterprises seek greater development flexibility—precisely the reason we’re extending the Nexaweb Platform with AJAX capabilities. With AJAX development on the rise, particularly for HTML and consumer-facing applications, our support of AJAX enables developers to create high-performance RIAs using the technology of their choice and ensures ease of development and ease of maintenance.” —Darryl K. Taft A P R I L 2 4 , 2 0 0 6 n e W E E K EW2

NEWS&ANALYSIS

Vista: Expect premium pricing RESEARCH REPORT SAYS MICROSOFT WILL PUSH USERS TOWARD 6 CORE VERSIONS By Mary Jo Foley

M

icrosoft is still holding many specifics about Windows Vista—pricing among them—close to the vest. But Redmond’s reticence to talk isn’t stopping company watchers from speculating. Goldman Sachs & Co. analyst Rick Sherlund issued a research note April 3 noting that Goldman is now figuring Microsoft could garner an extra $1.5 billion per year in revenues simply by persuading users to buy the premium Vista versions. Microsoft announced earlier this year that it is readying six core Vista packages, or SKUs: Windows Starter 2007, Windows Vista Enterprise, Windows Vista Home Basic, Windows Vista Home Premium, Windows Vista Ultimate and Windows Vista Business. In February, company officials reiterated Microsoft’s goal to persuade more customers to opt for Vista’s premium SKUs—specifically, Vista Enterprise, Vista Home Premium and Vista Ultimate—when selecting their next-generation Windows operating system. Rather than upping Windows Vista’s price, Microsoft will be able to maintain and grow its Windows revenue by getting people to buy in at a higher price point, company officials said. Looking at the pricing of Windows XP today might give a hint at what to expect for Vista pricing. Currently, the street price of Windows XP Home is $99 per copy for an upgrade, and $199 for a full version. For XP Professional, those prices are $199 and $299, respectively. Windows XP Media Center Edition, which is an example of a

current-day “premium” version of XP, sells for $320-plus. Retail sales comprise a relatively small part of Microsoft’s Windows business, however. Microsoft obtains more significant shares of its Windows revenues from PC makers on the consumer side and volume licensees on the business side. Goldman Sachs estimates that Microsoft is charging PC makers roughly $45 per copy of Windows XP Home and $85 per copy of Windows XP Pro. While the Vista SKUs do

face and ability to burn DVDs and related multimedia,” said Sherlund in New York. “We have been more focused on the incremental upgrade revenues from Vista, but the bigger benefit over time is the mix shift to a higher-priced Windows SKU.” If that $20 extra per copy for the premium home edition calculation holds, Microsoft will earn $1.5 billion a year in additional revenues, just by switching its product mix, Sherlund reasoned in the

What a difference $20 makes If

Microsoft can charge $20 extra for a “premium” version of Vista, the company will reap $1.5 billion in incremental revenue

Source: Goldman Sachs

not line up feature by feature with their XP predecessors, Goldman is estimating that Microsoft will charge PC makers $45 per copy of Vista Home but about $65 per copy for Vista Home Premium, which includes Media Center, Tablet and other functionality built into a single SKU. (It is up to PC makers to determine how much, if any, of a Microsoft Windows price increase they will pass on to customers when selling new systems preloaded with Vista.) “We think most of the Home market would elect the Premium version since this has the Aero/Glass inter-

24 e W E E K n A P R I L 2 4 , 2 0 0 6

research note. The change in its Vista revenue forecast led Goldman to revise its Microsoft projections, increasing its Microsoft fiscal 2007 earnings per share figure from $1.54 to $1.57 and its 2008 estimate from $1.75 to $1.78. On the enterprise side, the calculation is not quite as clear-cut, but the logic still holds. If Microsoft can persuade business users to flock to the Enterprise edition rather than the less-feature-rich Business variant of Vista, Microsoft will be able to reap significant revenue returns, even if the actual price per copy increases little or none. Microsoft is using more of a stick than a carrot on the business side to persuade custom-

ers to go with the premium Enterprise SKU. The company has decided to make a number of the Vista features that it has honed for enterprise users— specifically, the BitLocker drive encryption; Virtual PC Express virtual machine support; the SUA (Subsystem for Unixbased Applications), which is designed to allow Unix applications to run on Vista machines; and access to all worldwide languages supported by Vista via a single deployment image— available only to users who agree to sign up for Microsoft volume licensing agreements, such as Enterprise Agreements and Software Assurance. In addition to overcoming these kinds of negative perceptions, Microsoft has some other issues with which to contend before its premium push will work, company watchers said. “It would appear that [Microsoft’s] goal is get people onto Vista and, as they use it, get them to pay to move to the next edition,” through programs such as Windows Anytime Upgrade, said Michael Cherry, an analyst with Directions on Microsoft, in Kirkland, Wash. “But the problem here appears to be the unknown hardware requirements,” Cherry said. Cherry added that the customer set for which the effects of Microsoft’s planned premium strategy are most murky is SMBs (small and midsize businesses). “What is really unclear here is how this will play out for the small to medium-sized business, [which] are not likely to have [volume license] agreements but rather buy from OEMs. Will they be forced to buy [Vista] Ultimate?” ´ w w w. e w e e k . c o m

USEFUL KEYBOARD SHORTCUTS for navigating digital magazines PAGE DOWN

.................................

flip to next page

PAGE UP....................................... flip to prior page ENTER ................................... zoom in on left page SHIFT + ENTER

.....................

zoom in on right page

ENTER .................. zoom back out to full-page view C ....................................... flip to Table of Contents HOME ......................................... flip to front cover END............................................. flip to back page

USEFUL KEYBOARD SHORTCUTS for navigating digital magazines PAGE DOWN

.................................

flip to next page

PAGE UP....................................... flip to prior page ENTER ................................... zoom in on left page SHIFT + ENTER

.....................

zoom in on right page

ENTER .................. zoom back out to full-page view C ....................................... flip to Table of Contents HOME ......................................... flip to front cover END............................................. flip to back page

NEWS&ANALYSIS

By Mary Jo Foley

M

icrosoft’s new test build of Windows Vista is in the ondeck circle. Microsoft was widely expected by Windows testers to make available for download the new release, Build 5365, sometime during the week of April 17. Whether the company actually would deliver the anticipated code was still uncertain by the time this article went to press. The company was expected to make the build available only to its TAP (Technology Adoption Program) and TechConnect testers as it did with the interim Vista build that it released in March. Build 5365 is not the build once known as the April CTP (Community Technology Preview). That build, now expected by testers to arrive sometime in May, is also known as the Vista Consumer CTP and is expected to go to more than 2 million testers. Microsoft is not providing a firm date for that CTP build, other than to say it will arrive sometime in the second quarter. The latest effort is a much more modest update, known as an EDW (External Developer Workstation) build. Microsoft releases these builds—which are typically rougher and less thoroughly tested than CTPs— to a smaller, selected set of testers on a regular basis. According to various Windows-enthusiast sites around the Web, Build 5365 includes primarily cosmetic updates and fixes. One such site, H/D News, reported the build will include Sidebar fixes, support for more gadgets, Welcome Center changes, and install and driver support w w w. e w e e k . c o m

VISTA’S NEXT ACT SOFTWARE GIANT PREPS BUILD 5365, WHICH WILL BE AN INTERIM STEP TO THE FINAL VERSION improvements. When asked on April 17 for comment on the new build, a Microsoft spokesperson provided the following statement: “We are considering releasing updated Windows Vista code to Windows Vista Technical Beta program participants as well as select TAP customers. In

reflect these builds, but, regardless of the ultimate name, the test builds are one way Microsoft is counting on to speed up its test and development processes. The Windows, SQL Server and Visual Studio teams already are relying increasingly on the CTP process in developing products. The Office team

What’s in the latest Vista build? Build 5365 touts several new fixes and improvements. Here are the most recent: Vista

Sidebar fixes

Support

for more gadgets

Welcome Install

Center changes

improvements

Additional and improved driver support Source: H/D News

addition to the CTPs, we sometimes provide a select group of testers with current prerelease versions of Windows Vista based on their feedback and testing needs. These builds are not CTPs. As we have said, the next CTP will conclude the Beta 2 process and will be called Beta 2. We are on track to deliver Beta 2 in the second quarter of this year.” More and more Microsoft divisions are moving toward making CTPs, rather than traditional betas, their preferred progress milestones. Microsoft may create a new term to

is said to be considering the CTP mechanism, as well. On the Windows front, the last interim Vista build Microsoft released was the EDW it delivered on March 24. That Vista test build, number 5342, also included primarily user interface tweaks. Microsoft is expected to continue to make EDWs available to a subset of TAP and TechConnect testers on a regular basis as the product moves toward completion. Microsoft officials have taken to referring to the

partner/December CTP, t h e e n t e r p r i s e / Fe b r u a r y CTP and the consumer/May CTP collectively as “Beta 2.” There will be no single, t r a d i t i o n a l Vi s t a B e t a 2 release, however. Following the release of the May CTP, Microsoft is expected to roll out a number of various, smaller technical betas until the product is finished. Vista has been featurecomplete for several months. Microsoft will not be adding any new features to the product before it ships, although the company is reserving the right to cut some functionality if the product isn’t up to snuff by the time it is ready to go gold. Microsoft decided in March to cut from Vista planned support for the EFI (Extensible Firmware Interface). EFI, the successor to the PC BIOS, has been touted as an operatingsystem-independent interface that could aid in driver portability. Microsoft has been promising for months, if not years, that Vista will support both BIOS and EFI. Microsoft is now committing to provide EFI support for 64-bit Windows first in Longhorn Server in 2007. Microsoft officials have said Vista is still on course to be released to manufacturing this year and that business users with volume-license agreements will be able to take delivery of the code in November. The official Vista launch—and worldwide availability of all versions of the product for all customers—is slated for January 2007. ´

A P R I L 2 4 , 2 0 0 6 n e W E E K 25

NEWS&ANALYSIS

ORACLE TALKS TELECOM MAKES FIRST FORAY INTO A MIDDLEWARE VERTICAL WITH SERVICE DELIVERY PLATFORM By Lisa Vaas

O

racle came to talk telecom, outlining the company’s first foray into a vertical market for its middleware. To wit: Oracle on April 18 announced yet another acquisition. This time, it’s Net4Call, a Norway-based provider of Parlay and SLEE (Service Logic Execution Environment) technology. Oracle execs also outlined a road map for a comprehensive, standards-based SDP (Service Delivery Platform) for the telecommunications industry. Parlay constitutes open, technologyindependent APIs that enable the development of applications that operate across converged networks. The APIs integrate Internet multimedia networks and IN (intelligent networks) with IT applications via a secure, measured and billable interface. The technology has been widely deployed in telecom networks globally. SLEE is a Java execution environment optimized for high-performance, asynchronous interactions typical in the telco world. Parlay will play a starring role in Oracle SDP, which is aimed at enterprises that are building next-generation voice-enabled and mobile applications, Oracle President Charles Phillips said in a conference call for media and analysts. SDP is designed to help operators leverage investments in current infrastructure to exploit new technologies such as VOIP (voice over IP), IMS (IP Multimedia Subsystem) and Presence. Oracle’s telecom road map builds on other, earlier acquisitions in this space. The Redwood Shores, Calif., company snapped up HotSip, a provider of SIP (Session Initiation Protocol) and IMS platforms, in February. Another telecom credit Oracle can claim is that it also now owns TimesTen, purchased in June 2005. The Oracle TimesTen In-Memory Database is a standard in the telecom industry, where lightning-fast data replication is a necessity. Regardless of the recent acquisitions, the “why” behind the telecom road map boils down to Oracle’s venerable track record in this space to date, Phillips said. 26 e W E E K n A P R I L 2 4 , 2 0 0 6

“We already have a lot of relationships support for legacy networks. Oracle SDP in the industry,” Phillips said. “[Telecom includes a programming environment that companies] know us well and have used extends J2EE (Java 2 Platform, Enterprise Edition) for asynchronous, event-based our database for many, many years.” Oracle’s aim now is to push telecom programming that Oracle says is crucial and enterprise customers toward speed- to support and leverage legacy telecom ing up provisioning, adopting standards networks. Oracle SDP supports Java API more quickly and shifting to an IP-based Parlay X Web Services standards, thanks to the Net4Call acquisition. network, Phillips said. Other available pieces include: Oracle SDP, Oracle Senior Vice President of Server Technologies Development Thomas a set of adapters to connect to existing network Kurian said SDP is aimed at solving three elements and telecommunications equipissues facing telecom providers and car- ment, enabling service providers to quickly roll out new services; and carrier-grade communiriers today. The first issue is the need to rapidly create cation infrastructure such as Oracle Database and deliver new services, including data ser- 10g, RAC (Real Application Clusters) and the vices and mobile services. The second issue TimesTen In-Memory Database. ´ in the telecom space is the push to exploit network convergence as telecom players seek to offer all services over a Here’s an outline of Oracle’s vast telecom plan, converged IP network. To do called the Service Delivery Platform: so, they need to move from SDP highly specialized systems and software to a standards Software infrastructures to create based SDP, Kurian said, and new services they need to employ SOA Integrates with operator’s existing (service-oriented architecOSS and BSS ture) to develop new services Built on standards-based Oracle Fusion and integrate with existing Middleware suite systems and packaged software. The third issue in the Core SDP infrastructure telecom space is to leverage Carrier-grade infrastructure existing investments, Kurian SIP said, such as investments in OSS (operational support VOIP and XMPP (Extensible systems), including proviMessaging and Presence Protocol) sioning, and BSS (business Parlay/X: Web services support systems), including connectivity to telco PSTN (Public billing. Switched Telephone Network) Pieces of SDP that are Telco enablers: messaging, call available today include IMS control support. SDP includes the

Oracle’s got your number

industry’s leading SIP Application Server, Presence Server, Proxy Registrar and Location for what Oracle claims is a complete IMS-ready infrastructure. Oracle acquired this SIP infrastructure in the HotSip buy. Also available now is

SDP service gateway SOA infrastructure to integrate and manage content providers

Road map for out-of-box SDP services Faster

ROI with the out-of-the-box functionality Virtual PBX, content delivery, e-mail push and others Source: Oracle

w w w. e w e e k . c o m

NEWS&ANALYSIS “The big vendors will buy smaller, younger companies because they need the new capabilities these firms can offer, these customers are asking for more comprehensive products and the purchases will increase their revenues,” Kashkari said. “As long as hackers come up with new ways to steal data, it will require new technologies to defeat them, and many of these new tools will be developed at young companies; it’s really hard for the bigger guys to innovate as quickly on their own.” Another trend driving potential consolBIG VENDORS THRIVE AND SMALL ONES DIVE; MERGERS ON THE WAY idation could be the continued investsecurity applications for the sake of more ment in security technologies by compaBy Matt Hines ncreased demand for security suites centralized applications management, many nies working in other areas of the IT and too many anti-virus vendors could customers are also hoping to deal with fewer landscape, such as storage giant EMC’s buycreate a good brew for consolidation, say vendors, said Pescatore. He predicted that out of Authentica in March. Grisoft, a midsize anti-virus specialist companies focused specifically on products industry watchers. While industry giants such as mar- tied to compliance with government regu- based in Millburn, N.J., announced a deal ket leader Symantec continue to broaden lations such as the Sarbanes-Oxley Act may on April 19 to purchase rival Ewido Networks, a much smaller company with a diftheir portfolios with the recent acquisitions also see demand slip. Another prime example of the types of ferent type of anti-malware applications of Relicore, Sygate and WholeSecurity, smaller anti-virus companies’ profits are companies ripe for acquisition are ones that engine. The deal, the terms of which being pinched. While large players such provide only one type of application, such were not disclosed, was helped along by the as RSA Security have reported impressive as anti-spyware, that are now included in $52 million recently invested in Grisoft earnings for the first quarter of 2006, many many software suites that aim to address by chip maker Intel. Dennis Smith, director of Grisoft, presmaller players, including Entrust, Internet many different types of malware. “This has been coming together for some dicted that such investment from outside Security Systems and Websense, have the security sector, combined with missed their revenue projections. the need for applications vendors to On April 17, RSA reported net continue to broaden their offerings, income of $5.3 million on revis certain to drive more deals of enue of $87.5 million for the first Analysts and industry insiders agree that the anti-virus the same nature. quarter. The results topped expecmarket may be poised for consolidation. Here’s why: “The security market as a whole tations. Smaller vendors, however, Too many providers of similar technologies will undoubtedly continue to grow, have issued profit and sales warn Customers demand more integrated security tools but the increasing sophistication and ings. Entrust said April 6 it would Chasing threats becoming increasingly expensive speed of attacks makes it such that report a first-quarter revenue loss only those companies with enough of $21 million. On April 7, ISS Larger companies shopping for boutique technologies resources to invest in their infrasaid its first-quarter sales would fall Nonsecurity vendors investing in anti-virus tools structure to stay ahead of new threats $2 million short of estimates of $80 Post-compliance spending may slow down will survive,” said Smith. “In this million. On April 5, Websense Source: eWEEK case, we found a small but very announced its financial results aggressive company that has techwould fall short of Wall Street estimates with revenue between $42.3 mil- time, mostly based on the need for greater nology that handles anti-virus differently ease of management with all the different than our existing products; I think these lion and 42.5 million. Couple those results with the fact security point products on the market,” said are the sorts of deals that we’ll see more of there are an estimated 800 to 1,000 com- Charlotte Dunlap, an analyst with Cur- going forward.” Indeed, the consolidators plan to keep panies on the global market selling IT secu- rent Analysis, in Port Washington, N.Y. “We rity applications at present and consolida- will see more threat protection technologies hunting. Firewall specialist Check Point Softbeing bundled together, as with the ongoing ware Technologies, of Ramat-Gan, Israel, tion is likely. “The simple facts are that there are combination of intrusion protection and under pressure from Cisco Systems, recently tried to buy security appliance maker Sourceway too many security companies out there, behavioral security tools.” Wall Street also sees consolidation com- fire, but the deal was shot down by regulaand we haven’t seen a major virus outbreak in a while,” said John Pescatore, an ana- ing. Neel Kashkari, an investment banker tors. “We’re not sitting back and I would lyst with Gartner, in Stamford, Conn. “Two in Goldman Sachs’ Cupertino, Calif., office, expect even more mergers and acquisitions years ago, when some of the big worms hit, said that there are a number of security- to start closing, because the smaller comyou saw a lot of venture capital money being oriented mergers and acquisitions in the panies with unique technologies can help thrown at a lot of different security com- pipeline at present, driven largely by the companies fill gaps in their portfolios,” demands of keeping up with increasingly said Ken Fitzpatrick, chief marketing offipanies, but not all of them can last.” cer for Check Point. ´ In addition to demand for integrated sophisticated IT threats.

Anti-virus market is due for consolidation

I

The urge-to-merge virus

28 e W E E K n A P R I L 2 4 , 2 0 0 6

w w w. e w e e k . c o m

NEWS&ANALYSIS

BEA boosts ColdFusion support SOFTWARE LETS CFML APPS RUN ON WEBLOGIC By Darryl K. Taft

B

ea systems is offering ColdFusion users the ability to run their ColdFusion applications on the BEA WebLogic Server without requiring a rewrite. BEA, based in San Jose, Calif., announced on April 17 the availability of BlueDragon, BEA WebLogic Edition. The software, which is from New Atlanta Communications and licensed by BEA, helps users modernize and extend legacy CFML (ColdFusion Markup Language) applications to run on BEA WebLogic Server 9.0, BEA officials said. “Several of our customers are still using CFML to run their businesses,” Wai Wong, executive vice president of products at BEA, said in a statement. “ To d a y’ s B l u e D r a g o n announcement is further p r o o f o f B E A’ s c o m m i t ment to helping customers improve application performance and leverage their existing IT assets in serviceoriented environments. It’s also another example of how the company is continuing to invest in WebLogic Server and find new ways to help customers get to a modern app server without a lot of pain,” Wong said. Doug Chambers, IT applications administrator for the Atlanta-based Georgia Department of Transportation, said in a statement that BlueDragon is a valuable application that has allowed him “to standardize our enterprise architecture and leverage, modernize and extend legacy applications throughout our IT systems without costly investments. “ We’ r e e x c i t e d b y t h e

w w w. e w e e k . c o m

extensive product evolution possibilities that having a big, reputable company like BEA [to] stand behind affords,” Chambers said. ColdFusion has supported WebLogic Server for some time. As early as January 2003, Macromedia, since acquired by Adobe Systems, announced the availability of Macromedia ColdFusion MX for BEA WebLogic Server, allowing Web application developers without Java programming skills to leverage ColdFusion MX to build and deploy applications on the

BEA WebLogic Enterprise Platform. BEA officials said WebLogic Server has continued to gain momentum in the market to the point that BEA has achieved a 12 percent increase in year-over-year licensing revenue from WebLogic. This suggests that “we are taking share away from our competition,” Wong said in a statement. Indeed, BEA officials said WebLogic Server continues to outpace BEA competitors such as IBM, JBoss and Oracle in three primary

BEA support for ColdFusion Here is how BEA is helping leverage legacy applications, sans rewritting: BlueDragon

technology provides ColdFusion support by enabling CFML-based applications to run on BEA WebLogic Server 9.0

BEA

licenses BlueDragon technology from New Atlanta Communications Source: eWEEK reporting

areas: product releases and updates, benchmark scores, and reviews and awards. In a December interview with eWeek, BEA CEO Alfred Chuang said he believes BEA has advantages over certain open-source competitors. “I think the marketplace so wants to believe there’s a transition that everything is going to become open-source,” said Chuang. “They are believing in something that really doesn’t exist. Will JBoss work? I think yes. Only if the J2EE [ Java 2 Platform, Enterprise Edition] APIs become obsolete. If they become a commodity and nobody programs to J2EE anymore, then people will use JBoss. Because then you can pop in JBoss and put it on WebLogic on the fly. We’re not there yet. JBoss is not Linux, and Linux is not free.” Then getting prescient i n t h a t D e c e m b e r i n t e rview, Chuang said, “Even if JBoss becomes part of, I don’t know, Red Hat, it’s a different model. Linux has an ‘open’ source community. JBoss does not have an open community: not everybody can join.” ´

Sybase unveils latest PowerBuilder By Darryl K. Taft

S

ybase announced on april 17 the availability of Sybase PowerBuilder 10.5, the latest version of its rapid application development tool. Sybase officials in Dublin, Calif., said PowerBuilder 10.5 delivers several functionality enhancements and improvements to its DataWindow data access, presentation and manipulation technology. The enhanced DataWindow capabilities include the ability to more easily build complex forms and reports using the Autosize Height functionality for all bands in a report, as well as TreeView, a new presentation style that enables hierarchical data to be easily displayed. Other new DataWindow features include properties to make complex data access, manipulation and presentation easier, officials said.

PowerBuilder 10.5 also offers a new rich-text control, support for new data types, enhanced support for Web services and user interface enhancements, officials said. Des White, product development manager at Synergy Logistics, in Loughborough, England, said the PowerBuilder enhancements will allow his company to alter applications with the “least risk and maximum benefit.” “We are calling PowerBuilder 10.5 the ‘back to basics’ release because the focus is truly back to its roots, which is what our loyal developers have asked for,” said Karen Frederiksen, director of application development technology at Sybase. “Core enhancements, including improvements to the DataWindow and advanced support for Web services, have been made to help developers build better applications, faster.” ´ A P R I L 2 4 , 2 0 0 6 n e W E E K 29

NEWS&ANALYSIS

Microsoft suffers patch problems PATCHES CAUSE WINDOWS CRASHES, LOCKUPS; GOOGLE, SIEBEL PROGRAMS ALSO AFFECTED By Ryan Naraine

T

wo patches released in Microsoft’s April batch of security updates are causing system hangs, Windows crashes and the appearance of strange dialog boxes. The problems stem from a nonsecurity modification to Internet Explorer and a critical fix for a code execution hole in Windows Explorer. The changes affect third-party programs from Google and Siebel Systems, as well as Microsoft’s own Windows Media Player. On April 15, Microsoft acknowledged “problems” in the Windows Shell component of Windows Explorer after the MS06-015 security update is installed. That update, Microsoft said in a Knowledge Base article, includes a new binary called verclsid.exe that validates shell extensions before they are instantiated by the Windows Shell or by Windows Explorer. On some consumer-facing programs running HewlettPackard’s Share-to-Web software

and Sunbelt Software’s Sunbelt Kerio Personal Firewall, the new binary stops responding. The issue is having “little to no impact on corporate networks,” said Mike Reavey, program manager in the Microsoft Security Response Center, in Redmond, Wash. Windows users deploying the MS06-015 update also have complained about problems accessing special folders such as My Documents or My Pictures. In addition, the update is causing Microsoft Office applications to stop responding when Office files are saved or opened in the My Documents folder, system freezes when opening a file through an application’s File/Open menu and lockups when typing a URL into IE. According to PatchLink, of Scottsdale, Ariz., the MS06-013 mega-patch, which includes a significant modification to the way IE renders certain ActiveX controls, also is causing workflow issues for its enterprise clients. The ActiveX changes result

Study: Malware threat explodes By Matt Hines

R

ecent reports predict that new and sophisticated forms of malware will challenge the security industry’s ability to stay ahead of emerging threats. A study from McAfee Avert Labs claims that the technology used to cloak some malware, especially rootkits, is becoming increasingly complex and harder to detect. The report also found a growing tendency toward collaboration among hackers. The number of rootkit attacks being reported to McAfee Avert Labs was up by 700 percent during the first quarter of

30 e W E E K n A P R I L 2 4 , 2 0 0 6

from an ongoing patent dispute between Microsoft and Eolas Technologies. IE users must now manually interact with certain embedded multimedia content. According to a PatchLink spokesperson, businesses using all Siebel 7 High Interactive clients must click several times to interact with the program because of the way the ActiveX change was made. Siebel and Microsoft are working together to identify a solution, and a

Siebel product update will be released in the spring of 2006 to address the issue. Windows users running the Google Toolbar are also reporting an access violation error when a window containing an inactive ActiveX control is closed. Google is expected to ship an automatic update to fix the problem, which affects versions before Google Toolbar Version 3.0.129.2. The PatchLink spokesperson said problems were also reported in ActiveX controls that use Java Platform, Standard Edition 1.3 or 1.4. ´

Holy patch perils, Batman! These are the programs affected by Microsoft’s most recent security updates: HP’s

Share-to-Web software

Sunbelt

Kerio Personal Firewall

Google Toolbar ActiveX

controls that use Java Platform, Standard Edition 1.3 or 1.4

Siebel

programs that use ActiveX controls

The following are the associated patch problems: script technique does not work when the “Disable Script Debugging (Internet Explorer)” check box is cleared

External

Unable

to use the /integrate switch to update Windows installation source files Source: PatchLink and Microsoft

2006, compared with the same period in 2005. Rootkits are increasingly being written to attack Windows systems. McAfee said Windows-oriented rootkits increased by a staggering 2,300 percent between 2001 and 2005. McAfee contends that a primary driver behind rootkit proliferation is the growing collaboration among virus writers, including the misuse of materials published on resource Web sites dedicated to helping people fight the programs. Some of these sites, such as Rootkit (www.rootkit.com), contain hundreds of lines of rootkit code and may be doing more harm than good, McAfee officials said. Jamie Butler, an administrator and malware code contributor to Rootkit since 2001, said the information available on the site can be found elsewhere and that Rootkit has no

plans to stop publishing code. In a separate research report, anti-virus software maker Kaspersky Lab identified a handful of evolving threats that it said could serve to trouble IT administrators in the future, including at least one proof-ofconcept attack being tested by hackers that could challenge network defenders. The program reportedly locates itself in a computer’s boot sector and gains control of the device prior to the launch of its operating system. Because the attack is introduced in this manner, Kaspersky officials said, the program is able to modify many operating system functions. Another trend highlighted in the research is the growing popularity of malicious programs being created specifically to attack Apple Computer’s Mac operating system. ´ w w w. e w e e k . c o m

NEWS&ANALYSIS

EMC offers virtual tape shredding FEATURE JOINS DISKBASED BACKUP FAMILY By Brian Fonseca

R

earchitecting part of its disk library family to suit the requirements of small and midsize businesses and remote branch office users, EMC on April 17 unveiled its new entry-level disk-based EMC Clariion Disk Library. Also, EMC announced a new virtual “tape shredding” feature to its disk library portfolio, integration with EMC Networker 7.3 backup and recovery software, and system support for the IBM System i platform, formerly called iSeries. Currently available, the virtual tape Clariion DL210 system offers about 50 percent

performance improvements at only half the cost of the larger Clariion DL310 Disk Library. The DL310 will eventually “go away” but, in the interim, will still be supported by EMC, according to Jay Krone, director of Clariion marketing at EMC, in Hopkinton, Mass. Krone said the DL210 will feature new software utilities and wizards specifically designed to simplify diskbased backup for smaller enterprises that tend to be more do-it-yourselfers. The virtual tape box uses 500GB SATA (Serial ATA) disk drives capable of scaling from 4TB to 24TB. Rolled out in April 2004, EMC’s Clariion Disk Library family currently includes the higher-end DL710, DL720

and DL740 models. EMC’s Clariion Disk Library line is undergoing a healthy growth spurt, having installed over 35 petabytes with more than 600 customers in a span of just two years, noted Krone. To allow customers to better meet regulatory requirements and ensure that unwanted data is not compromised during or after backup processes carried out via connected virtual tape and physical back-end tape systems, EMC introduced its virtual tape shredding functionality for all Clariion Disk Library models. The tape shredding feature is enabled through a commandline interface when a storage administrator deletes a virtual tape from a disk library. Virtual tape shredding will

be available by the end of the second quarter of 2006 via integration with Networker (formerly Legato) 7.3 with EMC’s Clariion Disk Library family. The component will be released near-simultaneously with Version 2.2 of Clariion disk software, Krone said. The Networker 7.3 integration will allow a media or backup application to pinpoint precisely where a backup asset lies, whether it sits on a virtual tape or physical tape medium. Clariion Disk Library support for the IBM System i platform will allow EMC customers with iSeries systems to improve backup operations and restore times. The IBM System i platform support will encompass largescale backup applications for the AS400 audience, including Veritas Software and Legato users. ´

NEWS&ANALYSIS

the

buzz INTERNET FRAUD

Boys will scam, be scammed IF INTERNET FRAUD WERE A BATTLE

of the sexes, men have the upper hand as both perpetrators and hapless victims. That’s just one of the takeaways from the 2005 annual report from the Internet Crime Complaint Center, or IC3, a partnership between the FBI and the National White Collar Crime Center. Not only were 75.4 percent of the Internet fraud perpetrators male, men lost $1.83 to scams for every $1 a woman lost. In addition, 64 percent of fraud victims were male. “This may be a function of both online purchasing differences by gender and the type of fraudulent schemes by which the individuals were victimized,” said the IC3 in its report.

Given that men are snookered the most, it’s no surprise that Super Bowl ticket scams were one of the more popular ways to separate Netizens from their dollars. Among other

findings: • The financial losses for all cases of Internet fraud in 2005 were $183.2 million, with victims losing a median amount of $424. Internet auction fraud accounted for 62.7 percent of complaints. • Nigerian letter fraud had the highest median loss at $5,000. • Most perpetrators lived

QUOTE OF THE WEEK Our Internet businesses now account for 7.5 percent of our overall revenues, up from 4.5 percent in the first quarter of last year. Janet Robinson, CEO of The New York Times Co.

w w w. e w e e k . c o m

in California (15.2 percent) followed by New York (9.8 percent) and Florida (8.4 percent). • Alaska was the state with the most complaints filed (158.66) per 100,000 people.

SPONSORED SEARCH

Google’s emerging conflict of interest? MERRILL LYNCH ANALYST JUSTIN

Post in a research note pointed out an interesting tidbit to monitor for Google lovers—will the search giant compete with its advertisers? And, if so, does that diminish Google’s standing with advertisers? Post said that Google properties are increasingly popping up in sponsored ad results. “Sponsored link advertisers could begin to question Google’s neutrality if Google increasingly integrates its own products and services in algorithmic and sponsored results,” said Post. “Google has a conflict of interest between promoting Google content and providing the most relevant and unbiased results for users and advertisers.” Among the potential conflicts cited by Post: • A search on the term “finance” returns Google Finance at the top of paid sponsored links on the right-hand side of search results. The promotion of Google Finance over paid advertiser links could be unfair for those bidding for the top position. • A search on “used Porsche” returns a “refine your search” box at the top of the organic listings section. Users who refine their search with a ZIP code are transferred to Google Base, which provides a number of local Porsche listings on a Google Map. Although Post highlighted the potential rift between Google and advertisers, he added that he wasn’t aware of any negative feedback, and Google’s internal promotion so far has been minimal. But Post notes that search neutrality

could become an issue. Kanoodle on April 11 announced a deal to be the exclusive provider of sponsored links on Dow Jones sites. “Kanoodle management has indicated that it has an advantage with publishers because it does not compete directly for users,” said Post. “We believe this argument could resonate well with content providers, such as Dow Jones, that compete with content offerings from Yahoo and Google.”

BLOGS

Blog fatigue YES, FOLKS, BLOGGERS GET TIRED,

too. And who can blame them? They’re rambling 24/7 online for the masses (if you’re lucky). A recent post from Microsoft blogger Robert Scoble on April 9: “I’m gonna take some time off, think more about what I want to do as a blogger, as an employee, as a husband, as a father, and come back fresh. Translation: I gotta play some Xbox! ... It’s possible that I’ll take two weeks off cause my son will be here next week, and I wanna spend some time with him. Take care of the place while I’m gone.” Apparently, Scoble’s break didn’t urge readers to do the same. At last check, some 44 comments were made on his post. —Compiled by Larry Dignan

BY THE NUMBERS

Help, I’m online

231,493 Number of complaints the IC3 received in 2005

207,499 Number of complaints the IC3 received in 2004 Source: IC3 2005 annual report

A P R I L 2 4 , 2 0 0 6 n e W E E K 33

DS`WAWU\W\bSZZWUS\bW\T`Oab`cQbc`SObe]`Y

$DS`WAWU\7\Q/ZZ`WUVba`SaS`dSRDS`WAWU\bVSDS`WAWU\Z]U]µEVS`SWbOZZQ][Sab]USbVS`¶O\R]bVS`b`ORS[O`YaaS`dWQS[O`Ya O\RRSaWU\aO`S`SUWabS`SR]`c\`SUWabS`SRb`ORS[O`Ya]TDS`WAWU\O\RWbaacPaWRWO`WSaW\bVSC\WbSRAbObSaO\RW\T]`SWU\Q]c\b`WSa

B]ROgO\RSdS`gROgDS`WAWU\W\bSZZWUS\bW\T`Oab`cQbc`SaS`dWQSaS\OPZSO\R^`]bSQbOZZYW\Ra]T\Sbe]`Y W\bS`OQbW]\aW\b]ROg¸aQ][^ZSfRWUWbOZe]`ZRDS`WAWU\]TTS`aOV]ab]T[WaaW]\Q`WbWQOZaSQc`WbgaS`dWQSab] [WbWUObS`S^cbObW]\OZ]^S`ObW]\OZO\RQ][^ZWO\QS`WaYaW\bVSaW[^ZSab[]abQ]abSTTSQbWdSeOg^]aaWPZS DS`WAWU\EVS`SWbOZZQ][Sab]USbVS`

eeedS`WaWU\Q][W\bSZZWUS\QS 2]e\Z]ORbVST`SSeVWbS^O^S`]\W\bSZZWUS\bW\T`Oab`cQbc`SaS`dWQSa

OPINION STAN GIBSON: OUR VIEW

Beating cyber-crime D

eep inside, we all realize that the battle for secure computing will never be over. Still, the price that must be paid to keep our data safe and our e-businesses operating can seem daunting. Once we’ve succeeded in protecting ourselves from one threat, another emerges, requiring diligence, creativity and expense to combat. In the latest escalation in the game of cyber cops and robbers, it is now clear that security breaches are no longer the exclusive domain of teenagers with time on their hands. Instead, sophisticated bot attacks are being carried out by organizations with ruthless, mafialike methods. As has been reported by Ryan Naraine in eWeek, the use of sophisticated programming techniques to create botnets, the use of organized-crime-style money-transfer methods and the threat of violence are a significant departure from security breaches of the past. This new wave of cyber-criminals will be much harder to track, arrest and prosecute than were the lone misfit hackers of old. What’s to be done? First, it’s your duty to implement the strongest appropriate security measures. Start with a system lockdown approach, restricting users’ rights and permissions. Because the use of botnets suggests defense measures that focus on e-mail and instant messaging vulnerabilities, a secure e-mail gateway that can defend against viruses, spam and phishing attacks should be high on your list. You also may want to deploy token-based identity management. But it’s not enough to rely entirely on self-defense. Legislation and law enforcement must serve as weapons in the battle. Congress is considering several measures, among them the Personal Data Privacy and Security Act of 2005. This bill contains many measures that will LEGISLATION AND LAW help, including increasing ENFORCEMENT MUST SERVE criminal penalties for comfraud involving perAS WEAPONS IN THE BATTLE. puter sonal data, invoking RICO (Racketeer Influenced and Corrupt Organizations) Act provisions in cases of unauthorized access to personal information, and making it a crime to intentionally conceal a security breach involving personal data. The bill also will let individuals access and correct personal information held by data brokers; will require the holders of personal data to vet third parties hired to process the data; and will limit the buying, selling or displaying of a Social Security number without the individual’s consent. No one wants to live in a cyber-police state. We believe these provisions strike an appropriate balance between taking a tougher stance and allowing us to enjoy essential freedoms. Above all, you must realize that security work never will be finished and spread that knowledge throughout your organization. As an IT professional, the ongoing nature of the security battle may be clear to you, but have you made it clear to your company? Educating users on basic security measures is a never-ending task. Advocacy for funding to ensure the security job can be done and done right is a basic part of your job. As the sophistication of attacks increases, one thing is clear: Ease up for one minute and your company and its customers stand to be the next victims. ´ eWEEK’s Editorial Board consists of Jason Brooks, Larry Dignan, Stan Gibson, David Morgenstern, Scot Petersen and Matthew Rothenberg.

36 e W E E K n A P R I L 2 4 , 2 0 0 6

Reader mail No map required regarding jason brooks’ april 3 article “kweek Labs’ Apple birthday bash” (Page 23): While I don’t disagree that Apple’s secrecy keeps us in the dark as to product road maps, it’s no worse (or perhaps better) than other enterprise computing manufacturers that have us performing 180s every time a product is announced, changed, recalled, delayed and so on—sometimes at great expense, both financially and emotionally, for IT teams. Accuracy and timely delivery dates are equal to, if not more important than, “newsworthy” product announcements that often turn out to be either premature or otherwise vaporous. My suggestion would be to stay tuned. lawrence zevon

Promises, promises reading peter coffee’s april 3 epicenters column, with its reference to Microsoft’s Cairo (“Storing up my disappointment,” Page 54), reminded me of February 1993: I had been invited, along with 300 of my closest friends, to participate in the first Windows NT 3.1 training and certification hosted by Microsoft at the Sheraton Hotel Ballroom in Seattle. For three long days, information was hammered into our heads, and, at the end, everyone took both the server and workstation tests for 3.1. (Oh, and I passed both!) Anyway, at that training, they talked of Cairo, and two of the biggest features I remember were the Object-Oriented File System (referred to in Coffee’s column) and Directory Services (Active Directory today). In fact, I remember that the initial release of Exchange Server was to use Directory Services in the operating system, and, so, in its absence, we dubbed Exchange 4.0 Cairo .75. It shall be interesting to see what the next 20 years bring. eric g. steinberg managing partner teclink denver

More mail is at go.eweek.com/letters.

eWEEK welcomes your comments. Please send them to eWEEK Letters to the Editor, 500 Unicorn Park Drive, Woburn, MA 01801 or e-mail them to [email protected]. All letters must include name and contact information. We reserve the right to edit letters for clarity and space. Individual responses and communications with columnists and staff are considered for publication unless specifically stated otherwise. w w w. e w e e k . c o m

39 REVIEW: 44 CASE

LABS

HP’S RISS IS A HIGH AND MIGHTY CAS SOLUTION

STUDY: EDMUNDS TAPS CMS TO DEMOCRATIZE SITE

eWEEK Labs provides questions to ask and points to ponder when evaluating CAS systems. PAGE 41

45 DAY’S

FIELDING SOUNDS OFF ON CONTENT STANDARDS

48

REVIEW: E-MAIL SERVER OPTIONS FROM OPENXCHANGE, SUN

CONTE NT-ADDR ESSE D STORAG E

To protect and preserve By Henry Baltazar

C

ontent-addressed storage systems arrived just in time to help organizations deal with what was then a new challenge—compliance. For harried IT managers desperate to bring their companies into compliance with regulatory mandates, the proprietary nature of these systems was a necessary evil. That was then. Interoperability among different vendors’ CAS systems and between CAS systems and applications has improved in recent years, but it is clear that standards are needed soon to make it easier for applications and storage products to share data. CAS stormed on to the scene in 2002, helping IT managers bring their organizations into compliance with a host of regulatory mandates by making their content searchable and tamper-proof. Probably the most widely known CAS product is EMC’s Centera—it was the first to enter the market, and other vendors have been trying to catch up with it since. So, what exactly is a CAS solution? It’s an intelligent repository used to store and preserve business data, such as documents and e-mail messages. CAS solutions can be

w w w. e w e e k . c o m

used effectively by a wide range of organizations, but they are best suited for the storage of compliance-sensitive documents, such as medical records, blueprints, invoices and e-mail messages. Through the use of identifiers, IT managers can ensure that sensitive business content is not altered, preserving the “paper trail” within the context of a paperless environment—a requirement for compliance in many types of industries. Another core element of CAS products is the ability to perform high-speed searches through the repository. Since CAS products use hard drivebased arrays to store data— as opposed to slower and more cumbersome tape and optical archive technolo-

gies—auditors can search the contents of a CAS system at a very fast rate. This is key because the ability to swiftly retrieve information is another requirement for compliance with many regulations. Vendors in this space offer a couple of ways for IT managers to move data into CAS units—from file servers and from applications. Most CAS vendors support CIFS (Common Internet File System), NFS (Network File System) and other common protocols, allowing IT managers to easily move

files from file servers to the CAS systems. Migrating data from applications to various CAS solutions, however, is not so straightforward. CAS vendors publish open APIs that application vendors can use to establish links between their products and various CAS systems. Unfortunately, because every CAS vendor has its own set of APIs, application vendors must modify their wares specifically to each. As data is fed into a CAS system, a unique identifier is created for each piece of data. The identifier is derived from a hash value of the data being archived, and this information is stored in a repository for safekeeping. Because the identifier is derived from the content itself, any change to the original content spawns the creation of a new identifier. However, there also is no standard for creating the unique identifiers, so vendors create their hashes using different protocols. EMC uses MD-5, for example, while Hewlett-Packard’s StorageWorks RISS (Reference Infor[CONTINUED ON PAGE 38]

A P R I L 2 4 , 2 0 0 6 n e W E E K 37

DEVON BOWMAN

CAS ARCHIVING CAN EASE COMPLIANCE BURDEN, BUT TECHNOLOGY IS TOO CLOSED OFF

fWEEKLABS they want to retain the migrated this content eventually com- among applications. JSR-170 was finalized last mation Storage System) appli- information and what type of pletes its life cycle in an archive ance uses SHA-1. (A review of security needs to be maintained system—be it a tape or optical June, and work is being done on its successor, JSR-283, which library or a CAS system. for that content. RISS 1.4 is on Page 39.) Many applications do not should be complete in May An SDK (software developProprietary hardware is another unfortunate charac- ment kit) for XAM could be have shared data repositories, 2007. While it was originally teristic of CAS solutions—one available as early as this year. so IT managers need to spend that doesn’t seem like it will (See “SNIA pushes Extensible a significant amount of re- designed for Java content, Access Method standard for- sources plotting out the ILM JSR-170 is not limited to Java be going away any time soon. path for content coming from applications—support has been From a physical standpoint, ward” at eweek.com.) added to allow PHP and .Net There also is room for hope the various applications. there is nothing exotic about the CAS can be implemented applications to work with JSRhardware in CAS solutions, in software. Because the hardwhich are basically built out of ware used in CAS solutions is fairly quickly to deal with spe- 170 repositories. The first and most longcommodity servers and storage. not unique, there are opportu- cific problems, such as e-mail However, as storage and pro- nities for software players to cre- and document archiving, but to lasting benefit of a standard like cessing power run low, IT man- ate a CAS application with no create a more comprehensive JSR-170 is that it will give agers must go back to their CAS hardware lock-in. One vendor corporate archive, we suggest IT managers the flexibility vendors to purchase additional with some potential here is that IT managers perform in- to change when technology hardware—they can’t just throw Caringo (www.caringo.com), a depth analyses of their appli- changes. With JSR-170 in place, cheap hardware at the problem. CAS startup founded by Paul cations before committing to new applications can connect to HP’s RISS 1.4, for example, Carpentier. Carpentier invented a CAS solution. For example, legacy repositories, allowing IT managers and develscales to impressive opers to move forward heights, but only with without sacrificing old proprietary SmartCell CAS solutions have the ability to import content from a variety of data sources. data and code. units. Repository consoliWhen you factor in Inside CAS E-mail Application File server server server As documents are dation is another key this limitation, along added to a CAS system, benefit that can come with the fact that archive a unique identifier is from JSR-170. Often, solutions and the data created for each docuCAS solutions are ment, based on a hash many versions of they store are long-term built on commodity Document A value of the document (but proprietary) a document can be investments, it is clear contents. If an applicahardware. The found throughout a that IT managers should tion or a user attempts innovation comes ID Document A to write the same docunetwork. (For examnever rush into a CAS from the software ment to the CAS system, ID Document A linking the CAS ple, different versions implementation. it detects the matching nodes together, identifiers and leaves a of the same file might preserving busipointer for the new file ness data and be sitting on a file instead of rewriting the Document A enabling highserver, portal and CMS despite its limitacontent and wasting speed searches. space. If a new version [content management tions, CAS is an imporID Document of a document is created, A—Version 2 system].) With a centant technology with the it will have its own As the CAS runs low on storage, tralized repository, potential to ease much unique identifier and will additional nodes can be added to be added to the CAS users can easily find of the compliance burincrease capacity. system. Document the most up-to-date den for IT shops. So, A—Version 2 Source: eWEEK Labs version of the docueWeek Labs is glad to ment instead of huntsee standards emerging that promise to simplify at least the technology on which EMC’s administrators should make a ing through multiple locaconscious effort to eliminate tions. the movement of data from Centera was built. From a storage management It is important to note that, outdated applications and file applications to CAS solutions. Currently being developed in the grand scheme of things, shares and consolidate appli- perspective, a single repository also makes it easier to by members of the Storage Net- the long-term management of cation data when possible. A broader standard, but maintain backups and manworking Industry Association content is a complex problem is XAM (Extensible Access that transcends the storage one that could ease the con- age storage resources. JSR-283 will feature imMethod), a storage interface that world. Solving it will require solidation of data before it’s is designed to provide a stan- cooperation between applica- dumped into CAS solutions, provements to the managedard method for applications to tion development teams and is JSR (Java Specification ment of access control and Request)-170. Also known as retention policies. (For more talk to CAS solutions and move storage administrators. Looking at things from an the Content Repository API for information, go to www.jcp. data without the use of propriILM (information lifecycle man- Java technology, JSR-170 is a org/en/jsr/detail?id=283.) ´ etary APIs. Within the XAM specifica- agement) perspective, docu- powerful standard that allows tion will be provisions for meta- ments and other forms of con- IT managers to consolidate data Senior Analyst Henry Baltazar data that will allow applications tent get created by people using stores and to simplify and stan- can be contancted at henry_ to tell CAS devices how long a wide array of applications, and dardize the movement of data [email protected]. CAS FROM PAGE 37

How CAS fits in the storage picture

Standards SOS

38 e W E E K n A P R I L 2 4 , 2 0 0 6

w w w. e w e e k . c o m

fWEEKLABS

HP does archiving right REVIEW: RISS 1.4 IS A SMART, BEEFY CAS SOLUTION By Henry Baltazar

H

ewlett-packard’s storageWorks RISS 1.4 appliance uses a grid architecture to deliver compliance-class archiving capabilities along with high-speed search. With both data retention and search optimization becoming core storage management goals for IT managers, CAS (content-addressed storage) solutions like the HP StorageWorks Reference Information Storage System 1.4 have been added to the shopping lists of many enterprises. More than just a dumb box of disks, the RISS 1.4 appliance is a formidable archive solution that packages management tools with powerful e-mail, application and file server archiving capabilities in modular appliance hardware. However, while the RISS 1.4 device may excel at storing messages and documents, it is a poor choice for storing files such as medical images and digital media because they will not take advantage of the RISS 1.4’s indexing capabilities. Also, the RISS 1.4 is expensive in terms of per-gigabyte metrics. (Pricing starts at $112,000 for a 1.7TB unit.) The RISS 1.4 scales using modular appliances called

SmartCells, which are basically HP ProLiant-class servers. SmartCells incrementally boost the storage capacity and processing power of a RISS grid. For redundancy, SmartCells are added to the grid in pairs, increasing storage capacity 850GB (of usable space) at a time. Storage for each SmartCell comes in the form of onboard Ultra SCSI hard drives and a RAID controller. The RISS 1.4 can scale with as many as 250 SmartCells in a single grid, which will eventually translate to petabyte-size grids. One drawback, however, is that storage can be added only in the SmartCell format, so IT managers can’t add cheaper storage to the RISS grid. HP officials said SmartCells will increase to 1.4TB each with Version 1.4 of the RISS appliance, which is slated to become available this summer. IT managers will have the ability to use both 850GB and 1.4TB SmartCell pairs within a grid, which will allow the newer and more powerful SmartCells to be added to a grid without getting rid of legacy SmartCells. An 850GB SmartCell also could be paired with a 1.4TB SmartCell, but you’d be sacrificing the added capacity of

Web-based search tools helped us find and save content in the RISS device. w w w. e w e e k . c o m

The RISS appliance scales using modular hardware.

the new cell because of mirroring.

The search is on from a hardware perspective, the RISS grid is really not much more than a big stack of servers hooked together with standard IP networking gear. The real innovation comes from the RISS software, which maintains all the content indexes within a single database and spreads

searches across multiple SmartCell nodes. The RISS 1.4 has the ability to archive a wide range of content, including e-mail messages and documents. As information is added to the archive, a unique file ID is created for the content using SHA (Secure Hash Algorithm)-1 to create a hash. The e-mail archive capabilities of the RISS 1.4 system that eWeek Labs tested were comparable to the basic functionality we have seen in solutions like Enterprise Vault from Symantec. E-mail archiving solutions tend to cater to Microsoft Exchange implementations, and the RISS 1.4 is no exception. Exchange e-mail is moved into the RISS archive using the MAPI (Messaging API) protocol. IBM Lotus Domino is also supported, and messages stored on Domino e-mail servers are sucked up by a Domino gateway appliance that feeds the content into the RISS system for indexing and storage. (We did not perform tests using Domino.) RISS does a pretty good job of integrating with Microsoft Outlook. An MSI (Microsoft Windows Installer) file needs to be pushed out to clients; this file adds a search bar, tombstones (graphical markers labeling archived content) and offline caching functions to Outlook. [CONTINUED ON PAGE 40]

The RISS’ management tools let us monitor all the CAS components. A P R I L 2 4 , 2 0 0 6 n e W E E K 39

fWEEKLABS RISS FROM PAGE 39

The RISS 1.4 appliance’s archive functions blend in pretty well with Outlook, so only minimal retraining should be required for users. The offline cache allows mobile users to access messages in the RISS archive when they are on the go. For sites drowning in a sea of .pst (Personal Storage Table) files, RISS offers import capabilities for reeling this content back into the corporate fold and off laptops and desktops.

Archive profiles riss has two basic user profiles for the e-mail archive: The profile for users who need to be monitored for compliance reasons archives all messages and implements retention rules; with the profile for standard users, IT managers can tailor archive rules for specific needs (such as messages of a certain size or messages to or from a specific user or company). License fees will be cheaper for compliance user accounts, but IT managers can probably save more money using standard user

accounts with carefully crafted archive rules. (HP declined to provide exact pricing.) During tests, the RISS 1.4’s content discovery features were easy to use and quite speedy. The RISS 1.4 has a handy quarantine repository in which compliance officers can store the results of previous queries. The HP StorageWorks FMA (File Migration Agent) is available for customers that want to add data to the grid; pricing starts at $2,400 per server. FMA, which currently supports only Windows servers, allows IT managers to create archive policies for moving content to the RISS grid. In terms of functionality, its ability to perform file-level replication is similar to what we have seen from other vendors, including Xosoft. As you would expect in a CAS solution, the RISS 1.4 has SIS (Single Instance Storage) capabilities, ensuring that multiple copies of the same message or document are not stored on the RISS grid. However, with the RISS 1.4, a small change (a couple of

Web resources RISS factor More info on HP’s RISS appliance (h18006.www1.hp.com/ products/storageworks/riss/index.html) Java Community Process Information on JSR-170, the Content Repository API for Java technology (www.jcp.org/en/jsr/detail?id=170) XAM vision statement Technical overview of XAM from the Storage Networking Industry Association (www.snia-dmf.org/ xam/index.shtml) EMC on CAS CAS as seen by EMC, the company that coined the term (www.emc.com/products/networked/cas/index.jsp)

The RISS 1.4’s offline archive let us access resources without a connection.

bytes or so) in a document will cause the creation of a new document. HP officials said data deduplication functionality will be added to Version 1.5 of RISS to improve storage efficiency. (For example, if a single word in, say, a 16MB PowerPoint presentation were changed, future versions of RISS would keep track of the change instead of creating a new 16MB version of the file.) When data in the RISS expires, the SmartCells delete the file and use Department of Defense-level

file shredding to make sure that the file cannot be recovered at a later date. HP officials have stated that XAM (Extensible Access Method) will be supported as the standard evolves. The JSR-170 standard also may be supported down the road, but HP has made no commitment as yet. (See related story, Page 37.) ´ Senior Analyst Henry Baltazar can be reached at henry_ [email protected].

EXECUTIVE SUMMARY

StorageWorks RISS 1.4 HP’s StorageWorks RISS 1.4 is a powerful CAS solution with integrated e-mail archiving capabilities, as well as the ability to archive file server and applicaKEY PERFORMANCE tion data. Using proprietary hardINDICATORS ware called SmartCells, IT managEASE OF IMPLEMENTATION GOOD ers can quickly scale their RISS CAS SCALABILITY EXCELLENT implementation to match storage PERFORMANCE EXCELLENT STORAGE EFFICIENCY GOOD needs. RISS 1.4’s integrated manINTEROPERABILITY GOOD agement capabilities make it easy APPLICATION SUPPORT GOOD to detect and resolve problems in MANAGEABILITY GOOD the SmartCell units. For more information, go to www.hp.com. COST ANALYSIS: The base price for the RISS 1.4, with 1.7TB of storage, is $112,000. The product’s ability to locate data quickly should deliver significant return on investment, but RISS is not a good solution for digital media and image files because they will not leverage RISS’ indexing capabilities.

EVALUATION SHORTLIST Software solution? FAQ on Caringo’s software CAS system (www.caringo. com/faq.html)

40 e W E E K n A P R I L 2 4 , 2 0 0 6

N EMC’s Centera The market-originating CAS product that other

vendors are still trying to catch up with (www.emc.com) N Permabit’s Compliance Vault Permabit has an OEM agreement with StorageTek, a subsidiary of Sun Microsystems (www.permabit.com) w w w. e w e e k . c o m

fWEEKLABS

Describe how the CAS system alerts IT managers to potential problems.

CONTENT MANAGEMENT & SECURITY

Which directory systems are supported? Is file encryption supported? If yes, what type? Does the CAS system provide an audit trail? Does the product provide a digital time stamp? Does the product expire data? Does the product perform digital shredding? If yes, is digital shredding performed to Department of Defense levels?

CONTE NT-ADDR ESSE D STORAG E By Henry Baltazar

Content-addressed storage systems have emerged to help IT managers protect business data while keeping it accessible and searchable. Implementation of a CAS system could be difficult if you have a complex environment with many different applications and data sources to archive. When sending out your RFP, be sure to list all the types of content you intend to archive. (Do this early on, in the business case section.) Many application vendors have taken steps to make sure their products will work with particular CAS solutions, so it’s important to take a careful look at CAS vendors’ interoperability lists. Any application outside that list will require extra effort to become CAS-friendly. Following are some questions that should appear on an RFP for CAS solutions.

HARDWARE SUPPORT

What is the maximum number of cells/nodes that can be added? What is the maximum number of files supported? What is the maximum amount of storage? What is the power consumption per node? Does the product include any power-saving features?

CAS solutions are essentially stacks of servers. Unlike traditional archive mediums such as tape and optical storage, CAS solutions consume a fair amount of power while generating heat. SEARCH

DATA SUPPORT

How does your CAS system enable content search? What search engines are included?

COST/BENEFIT ANALYSIS

What kinds of data can be imported? Does your product have file service support (Common Internet File System, Network File System and so on)? Does your product support e-mail archiving? If so, for what platform? • Microsoft’s Exchange • IBM’s Lotus Domino • Novell’s GroupWise • SMTP Please list available CAS APIs. Please list the applications supported by your CAS system. Will your product be adding support for XAM (Extensible Access Method)? In what time frame? (Please be specific.) Does your product support JSR-170?

The Storage Networking Industry Association’s XAM will standardize APIs between applications and CAS systems. JSR-170 allows applications to maintain a shared repository of data.

What does the product cost, including base cost and costs for additional features? What is the impact of adding additional storage? What cost advantages will our organization realize by choosing this solution?

CAS solutions have complex licensing schemes based on hardware, the type of content archived and the number of users. Be sure to compare prices among vendors based on your desired configuration, not just the base price. DATA PROTECTION

Does your CAS system have site-to-site replication capabilities? Does your CAS solution have the ability to back up to tape or optical mediums (for off-site storage)?

STORAGE OPTIMIZATION

MANAGEABILITY

Is there a single console for managing the overall health of the CAS system and for detecting and solving problems in nodes? Does the CAS system automatically take steps to compensate for a disk, power supply or total node failure? When cells/nodes are added, do they autoconfigure themselves?

w w w. e w e e k . c o m

Does your solution support Single Instance Storage? What storage optimization features does your product have? How will storage optimization improve in the future?

REFERENCES Please provide references from customers that have completed a similar deployment, with similar numbers of users and applications, in the same industry.

A P R I L 2 4 , 2 0 0 6 n e W E E K 41

Find tools and guidance to defend your network at microsoft.com/security/IT Free Security Training: Help secure your network with security webcasts and in-depth, online courses. Register now for free security management training, including upcoming Security Summits in one of ﬁve major cities. Microsoft Security Assessment Tool: Complete this free, online self-assessment to evaluate your organization’s security practices and identify areas for improvement. © 2005 Microsoft Corporation. All rights reserved. Microsoft, Antigen, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

Antivirus for Exchange: Download a free trial of Antigen® for Exchange and arm your e-mail server with powerful multi-engine protection from viruses, worms, and inappropriate content. Free Tools and Updates: Streamline patch management with automated tools like Windows Server Update Services. And verify that your systems are conﬁgured for maximized security with Microsoft® Baseline Security Analyzer. TM

fWEEKLABS

Edmunds makes CMS drive CASE STUDY: TAPS COMMUNIQUE TO STREAMLINE PROCESSES open and flexible. Since no CMS product ith more than 350,000 people a he evaluated did everything Edmunds. day relying on its automobile Web com needed out of the box, Gandee also site for the latest information on wanted a product he could customize—one new and used cars, Edmunds. that was more of a framework than a tracom recently turned to a content ditional CMS. On the business side, Gandee wanted a management system to bring together product that would be easy to use, control content throughout the company. By d e p l o y i n g t h e C o m m u n i q u é and secure, among other things. “We wanted to put the CMS from Day Software, product in the hands of our Edmunds.com has made it businesspeople and have easier for corporate users to them be able to get up to quickly update and manage speed quickly,” Gandee said. the content on the Web site, “We wanted it to be Websaid Stephen Gandee, direcbased, support digital asset tor of enterprise architecture management, have a decent at Edmunds.com, in Santa workflow and have user Monica, Calif. access rights so we could “Our strategy and initiacontrol and secure the contive for this past year was tent and allow certain people a notion we call self-service and automation,” Gandee Edmunds.com’s Gandee: Users to do certain tasks.” will maintain the Web site. Based on the proof of said. “We want to allow our concept and its own testing, Edmunds. users to interact and maintain the site.” Founded in 1966, Edmunds.com pro- com in October 2005 decided to go with vides consumers with pricing tools, insur- Communiqué from Day Software. Version ance and financing resources, vehicle 4 of Communiqué came out in December reviews and comparisons, warranty and 2005, which is when Edmunds.com set to performance information, and access to work implementing the software. Edmunds.com’s software stack comnew- and used-car buyers and sellers. Two years ago, Edmunds.com set a goal prises Red Hat Linux Enterprise Server of empowering business users to man- 4, J2EE (Java 2 Platform, Enterprise Ediage Web content without having to get tion) on BEA Systems’ WebLogic Server lengthy estimates for the level of effort and 8.1, Oracle’s 10g RAC (Real Application number of programmers required to add Clusters) database, the Apache Software Foundation’s Apache Web server and, now, something to the Web site. The company decided that a centralized Communiqué. The software stack runs on content repository would be the best way Dell PowerEdge 1850 servers and Network to automate the process. The company Appliance storage systems. “One of our requirements was that the hired CMS Watch, an analyst firm in Olney, Md., that specializes in CMSes, to provide software would be compatible to our softan evaluation shortlist of mid- to top-tier ware stack because we were not looking to vendors of enterprise CMS solutions. Last do .Net or make changes to our infrastrucsummer, Gandee and his team completed ture,” Gandee said. “We needed something a product evaluation; CMS vendors then that could fit right into our existing applicawent on-site at Edmunds.com to provide tion stack, and Communiqué did.” Edmunds.com used to rely on homea proof of concept. Gandee’s main requirement for any CMS grown systems, which took a lot of time to product was that it be easy to implement, develop and update. With Communiqué, IT managers now have time to focus on other things. eWEEK Labs’ Peter Coffee and Day “In our development, the only thing we Software’s chief scientist discuss focus on now is our components, because content repositories and standards we are going to allow our users to maintain on Page 45. the Web site,” Gandee said. “The tool has

By Anne Chen

W

44 e W E E K n A P R I L 2 4 , 2 0 0 6

been a big benefit.” In July 2006, Edmunds.com will go live with the CMS, which Gandee said will power most of the Edmunds.com Web site. After the product is implemented, business users will be able to update and manage the content on the Web site. Communiqué also will let Edmunds.com share data with partners, such as auto manufacturers. While the company has focused mainly on using the content management piece at this time, Gandee said Edmunds.com will eventually leverage Day’s CRX repository, which implements the new JSR-170, or Content Repository API for Java technology, standard (see story, Page 37). When and to what extent Edmunds.com will use CRX, however, will depend on Day’s plans for the product, Gandee said. “We’re going to use CRX, but we don’t have any specific plans yet,” he said. “It’s a promising technology, but we’re going to see where Day Software heads and get more familiar with it ourselves before we actually plan to do something major with it.” ´ Senior Writer Anne Chen can be reached at [email protected].

Case file Company

Edmunds.com Santa Monica, Calif. Challenge Edmunds.com wanted to empower business users to manage their content without having to go through a lengthy approval and programming process Solution Edmunds.com turned to a centralized content repository to automate the process of adding and updating content to its Web site Tools Day Software’s Communiqué 4; Red Hat Linux Enterprise Server 4; BEA Systems’ WebLogic Server 8.1; Oracle’s 10g RAC database; Apache Software Foundation’s Apache Web server; Dell’s PowerEdge 1850 servers; and Network Appliance enterprise storage systems What’s next Edmunds.com will eventually leverage Day Software’s CRX repository, which implements the Content Repository API for Java technology enterprise standard Location

Source: eWEEK reporting

w w w. e w e e k . c o m

fWEEKLABS

Anytime, anywhere content DAY’S FIELDING CHAMPIONS STANDARDS-BASED PLATFORM ontent repository api for java, bit—and trying to get more people involved a specification released in Version with building applications on top of it as 1.0 in June 2005, gives applica- a platform. And companies can develop on the JCR tions access to content collections with minimal concern for storage platform—they can build products that details. Also known by its Java Specifica- compete essentially with our existing Comtion Request number, JSR-170, or its nick- muniqué product. Of course, there are name of JCR (Java Content Repository), it many improvements that are made in the defines an object model and interfaces for process of standardizing on JCR, but you create a much larger base of standardized and disciplined developers working on appliaccess to many storage types cations, and as those applicaand arrangements. tions mature, it becomes an Enterprises continue to infrastructure issue of which find that key information content repository you want about their customers, their to have underneath that. suppliers and competitive Right now, we also have a environments is in differCRX content repository that ent places and varied forms, is our version of the JCR making applications both implementation. overly complex and insufficiently flexible as new data Fielding: “You lose some of You’ve used the phrase “content sources emerge. JCR lead the vendor lock-in.” bus.” I’ve heard the concept of company Day Software, in Irvine, Calif., has released an open-source “bus” applied to services and a number of other JCR implementation and has augmented things, but it’s the first time I’ve heard of a it to deliver a commercial JCR product to “content bus.” Could you elaborate on that? address this critical enterprise concern. The term came from the earlier versions eWeek Technology Editor Peter Coffee of our Communiqué product. It was the spoke with Day’s chief scientist, Roy Field- name that we gave to what is now called the Content Repository API for Java teching, about key JCR concepts. nology, which is the JCR interface. It’s an As I understand it, one of the most distinc- architecture for creating a content-centric tive features of Day’s Communiqué content integration interface with data that you’re management system is the fact that it’s one involved with in an enterprise so that you of the few full-scale implementations of JCR operate on that data regardless of where that data is stored. It’s technology. Is that correct? Yes, we’re one of the developers of the a way of providing an JCR technology. We based it on our earlier abstraction on all of the methods of storage you content bus ideas. might have in an enterHow would you characterize the distinctive prise, without having opportunities that the existence of JCR as a to have the application standard creates for people over and above developer write to a spethe ways that were available to do content cific interface for each management on the Java platform—or, for one of those storage methods. that matter, on any platform—before JCR It sounds to me as if it’s important not to took form? Well, you lose some of the vendor lock-in, confuse what you’ve just described with other and, as a result of that, you have more abstraction schemes, such as CORBA, that opportunity for the global network effect of try to make you indifferent to the physical having many more application developers device on which something is stored. You’re talking about going to another level of abstracworking on a common platform. What we’ve done is try to increase adop- tion—not even knowing what specific object tion of the technology by making it avail- you’re asking for but, rather, being able to able through Apache—through Jackrab- ask a pool of objects which of them has vari-

C

ous content characteristics. Do I have that about right? It’s close, but not quite. It’s actually a very similar concept of application integration. In a CORBA or a .Net style of interface, it’s a controlled interaction, controlledspace interface. What I mean by that is if you think of an application like a word processor, such as Microsoft Word, you go up to all of the menus and you’ll see a File menu, which has Open, Close, Save As and so on. Those are all control interfaces for the Word application. The JCR interface takes a different perspective. It uses the same style of Web interface that I developed as part of the work on the World Wide Web project and applies it to the Java environment to create a data-centric interface. So the data-centric interface is going to treat the data that’s manipulated by the word processor as being more significant to the controls in the application itself. So, for example, it will focus on what a paragraph is or what style sheets are, things like that. You can have a more general concept—data can be less specific to particular applications than tools are, and this allows various advantages in terms of being able to apply more tool sets to that data. I guess that’s the real key point to make here—that many attempts have been made to deliver the independence of content from form. You’re talking about once again delivering that notion that data can be put into whatever application or whatever vehicle meets your needs without bringing with it a bunch of baggage from how it was originally expected to be used. Right. There are a number of differences— big differences—in the way that JCR operates over the Web. The Web focuses on standardized data formats, while JCR really focuses on—because it’s an internal server API—objects that can be manipulated as generic data. So it doesn’t have the same parsing overhead as, for example, doing things with XML directly.

‘There are many improvements that are made in the process of standardizing on JCR.’

w w w. e w e e k . c o m

And that’s a critical point, considering that the bandwidth explosion associated with that XML overhead and the parsing overhead you’ve just been describing are impediments to its use in some situations. That’s correct. ´ A P R I L 2 4 , 2 0 0 6 n e W E E K 45

fWEEKLABS JIM RAPOZA: TECH DIRECTIONS

Security box of chocolates

WEBLOG

JIM’S PICKS FROM GWEEK BLOGS

go.eweek.com/weblog

YOU NEVER KNOW WHAT YOU’RE GOING TO GET THESE DAYS e-mail and the Internet, some of those bad seeds tupid is as stupid out there are gettin’ smarter about how they try does.” That’s what to trick folks. So even those who ain’t being too my mama always dumb can be fooled into clickin’ on the wrong said to me. sites and givin’ up their credit cards numbers and Now, the fella that other info. writes this here column Take the case of this phishing trick that came keeps on sayin’ that a lot up not too long ago. Naw, I ain’t talking ’bout of those computer and when you grab your pole and some crawlers and technological security try to catch some catfish. I’m talking ’bout this problems would go away if people would stop Internet thing where bad guys try to make an bein’ so stupid ’bout the way they use their e-mail and a Web site look just like one from a computers and answer their e-mail letters. real-live bank or credit card company. One example of folks who weren’t being too As the smart fellas over at The SANS Instismart about their computers happened over tute tell it (isc.sans.org/diary.php?storyid=1118), there in London not too long ago. These fellas some pretty smart bad guys came up with a from an IT training group called The Training phishing attack that would trick even a lot of Camp decided to do a test to see if people there really smart Internet-using folks. were being smart about computer security. These bad phishers made the e-mail look like People from The Training Camp handed it knew some folks’ credit card numbers, so it out what they were callin’ Valentine’s Day CDs. looked all personallike. Even worse, they were able They passed these silvery discs to workers as to trick the company that makes secure Web site they headed into their offices in the morning. These CD thingies weren’t really no Valentines. technology into making their fake site look legit to users’ Web browsin’ tools. The Training Camp fellas were using them to It wouldn’t be quite right to call folks who fell see if any of these fancy-pants people with the for this kind of trickery funny accents would be daffy enough to stick a CD I AIN’T TALKING ’BOUT WHEN stupid. Lots of people who followed all the advice from from a stranger into their YOU GRAB YOUR POLE AND the smart security people PCs. Sure enough, a whole would still end up gettin’ bunch of these London TRY TO CATCH CATFISH. tricked by this here scam. workers went ahead and Course, there are ways to tell that this phishing stuck these CDs into their computers at work, e-mail ain’t quite right. The biggest is that it don’t including some folks at banks and other such have the user’s name there in the e-mail—it just places. says, “Dear customer.” Now, anyone who gets Now, these people definitely weren’t being these e-mail letters from banks and such knows smart about security. They shoulda known that they always use your real name in the part that you don’t take a CD from a stranger and that says hello. (What’s that called? The salutajust load it into a PC—at work or at home. tion?) With any e-mail like this, if it ain’t usin’ your But the stupidness ain’t just on the side of name upfront, then something might be up with the workers. Their employers weren’t being too that there e-mail. (Although it’s probably only a smart, either. After all, if they’d been listening matter of time till some smart bad guy comes up to some of the nice folks over at eWeek Labs, with a way to put the names in a phishing letter.) they’da known that they shoulda been—what So, remember, there’s a whole lotta different they call it?—lockin’ down their employee comtypes of stupid out there. Sometimes users don’t puters so they couldn’t just load software from do the smart thing. Sometimes the companies any ol’ CD or even download it off that there aren’t bein’ smart enough to protect against info highway. While I’m sure those companies users who are being kinda dumb. And, someweren’t too happy with their employees loadin’ those outside CDs, they should probably be care- times, the bad guys are so slick they can trip up folks who are doin’ their best to be smart. ´ ful ’bout who they’re callin’ stupid. Course, while a lot of those security-type problems can be avoided by people being just a tiny Labs Director Jim Rapoza can be reached at bit smarter about how they use their computers, [email protected].

S

46 e W E E K n A P R I L 2 4 , 2 0 0 6

@

H E N R Y B A LTA Z A R

Storage monster Packing 21TB of storage in a 4U (7-inch) chassis, Nexsan Technologies’ SATABeast is truly monstrous. The SATABeast holds 42 hard drives while consuming only 4U of rack space. This should make it a popular target for disk backup and archive implementations. Nexsan’s AutoMAID functionality is something I should have mentioned in my recent MAID story. AutoMAID spins down disks in idle mode to cut down on the overall power consumption. According to Nexsan, AutoMAID doesn’t require additional host software to function, which is always a good thing. 4/13/06

@

PETE R COFFE E

Salesforce.com buys Sendia Salesforce.com’s Chairman and CEO Marc Benioff recently said in an e-mail, “You will love our announcement.” And now I know what announcement he meant, and I do. As I wrote a few weeks ago, “‘Next-generation portable hardware’ ... isn’t portable hardware at all—it’s a cloud of network services and devices that know where I am, observe what I’m doing, anticipate the resources that I’ll need, secure the required connections as desired and allocate those resources to me on request.” The Salesforce.com acquisition of Sendia moves us quite clearly in that direction. 4/11/06

w w w. e w e e k . c o m

Keeping up with new customers. Kimberly-Clark Corporation is home to some of the world’s most trusted brands—like HUGGIES® and KLEENEX.® With operations in 43 countries, the company needed to simplify its operations. HP Services implemented a standardized IT environment running on HP Integrity servers that helped streamline the move into new markets and speed the integration of disparate technology into their operations.Today, Kimberly-Clark enjoys a 41% lower TCO of IT, and is able to stay ahead of its customers. hp.com/adapt

Tools of change: HP Integrity servers | HP Services

©2006 Hewlett-Packard Development Company, L.P. Other company, product and/or service names and symbols mentioned herein are trademarks and are the property of their respective owners.

fWEEKLABS

Sun, Open-Xchange collaborate well REVIEW: NOT WITH EACH OTHER—WITH SERVERS THAT PUT OUTLOOK FACE ON E-MAIL TOOLS By Michael Caton

C

ompanies looking for an e-mail, calendar and scheduling platform that supports Microsoft Outlook will find OpenXchange’s Open-Xchange Server 5 and the collaboration suite in Sun Microsystems’ Java Enterprise System to be good, low-cost options. Open-Xchange Server 5 is priced starting at $850 for the server and 25 users, with each additional user costing $25. Sun prices the e-mail, calendar and instant messaging components of the Java Enterprise System on a per-user basis. Messaging Server starts at $20 per user, while the Calendar Server and Instant Messaging Server each start at $30 per user. Per Sun’s published volume discount pric-

ing, large enterprises should expect to pay about $40 per user for the three components. These servers are also sold bundled as the Sun Java Communications Suite on a subscription basis for $50 per user. A pareddown version of Open-Xchange, without Outlook support, is available for free in the open-source Open-Xchange 0.8 Server. Open-Xchange Server 5, released in April, is a Linuxbased system that provides more features than most of the messaging and collaboration servers in this space. During eWeek Labs’ tests, the product was not only easy to manage but also offered a well-balanced Web client for its e-mail, calendar and scheduling, and project management applications. However, the advanced col-

EXECUTIVE SUMMARY

Sun Collaboration Suite Sun Microsystems’ Messaging Server, Calendar Server and Instant Messaging Server fit together nicely. The Web-based clients aren’t as KEY PERFORMANCE advanced as some competing INDICATORS products, but they are fast and INTEROPERABILITY EXCELLENT easy to navigate. To access IM ADMINISTRATION GOOD Server, users can choose between GROUPWARE FEATURES GOOD the Java-based client and a EXTENSIBILITY EXCELLENT client that supports the XMPP PLATFORM SUPPORT GOOD standard. For more information, go to www.sun.com. COST ANALYSIS: The three server components have very low per-user pricing in volume, although there is some minor server management overhead associated with ISP management tools. The Outlook plug-in will work almost seamlessly for the user and includes a well-designed deployment tool. Companies will likely want to purchase a fourth component of the Sun Java Enterprise System, Sun Java System Portal Server, to really tie the components together with IM presence data.

48 e W E E K n A P R I L 2 4 , 2 0 0 6

Open-Xchange’s Web interface brings collaborative apps to the forefront.

laboration tools, project management, document management and discussion forums are available only through the OpenXchange Web interface and not through Microsoft Outlook. The collaboration servers in Sun’s Java Enterprise System provide a more basic approach to messaging, group calendars and scheduling. The Sun system, released in February, also adds IM. Sun’s products have a legacy of supporting ISPs and hosted messaging solutions, and, for that reason, Sun sells the servers as discrete products. There are some domain man-

agement features that add a level of complexity to the Sun product, but we still found it easy to administer. The end-user Web interface doesn’t have the slick look and feel of interfaces found on competitors—such as Microsoft Exchange Server, IBM Lotus Notes and Domino, and Scalix’s namesake product—but it is fast and makes it easy to navigate the various application elements.

Open-Xchange Server 5 open-xchange server 5 is derived from the open-source Open-Xchange 0.8 release, adding a rich set of features

EXECUTIVE SUMMARY

Open-Xchange Server 5 For companies looking for more than just e-mail and calendars, Open-Xchange’s Open-Xchange Server 5 provides collaborative applications with inteKEY PERFORMANCE grated Web-based project, docuINDICATORS ment and knowledge management INTEROPERABILITY GOOD applications. None of these systems ADMINISTRATION GOOD would replace a dedicated applicaGROUPWARE FEATURES EXCELLENT tion, but they will allow teams with EXTENSIBILITY EXCELLENT simple requirements to organize PLATFORM SUPPORT GOOD projects and workflow. Although these applications aren’t directly accessible through OpenXchange’s Outlook OXtender, notification and tasks are accessible through links and iCal data. For more information, go to www.open-xchange.com. COST ANALYSIS: At $25 per user, Open-Xchange Server 5 has a relatively low cost. Administration is straightforward, and the product includes open-source anti-virus and antispam filtering. The Outlook plug-in can be deployed remotely, although users likely will need some training because of small changes to the Outlook experience.

w w w. e w e e k . c o m

fWEEKLABS through a series of add-ons called OXtenders. These extensions allow the product to work with Outlook and to synchronize with Palm OS-based devices. The Outlook OXtender is a plug-in for Microsoft Outlook that allowed us to configure Open-Xchange server and Outlook clients to communicate relatively seamlessly. Since Outlook plug-ins are specific to e-mail servers—for instance, Sun and Scalix each have Outlook plug-ins specific to their servers—feature availability and execution can be different. For example, we liked that the Outlook OXtender allowed us to configure mail filter rules, even though the interface is a little raw. During tests, Outlook OXtender proved easy to deploy, with the ability to self-update. We would have liked better integration with the existing Outlook folder structure, however: The OXtender creates a specific Open-Xchange in-box instead of using the existing one, for example. One nice feature is the ability for users to include a personal profile that can update the server’s address book, including information such as phone numbers and address. Open-Xchange provides a good framework for broader collaboration through the project management and content management tools available through the Web interface. The project management tool would be well-suited for companies that have light team-based project duties, as the application tracks tasks and milestones as well as provides for time and financial budgeting. We liked that we could add custom fields as needed to any project. Integration between the Web interface and Outlook isn’t entirely seamless: If companies choose to use the Outlook OXtender as the primary way to access e-mail and calendars, many of the broader collaborative capabilities could end up being ignored or forw w w. e w e e k . c o m

the IM portlet on the gotten by users. Java System Portal There are plenty Server. of e-mail-based noWhile most of tifications of tasks the vendors offerand projects, howing e-mail and calever, pulling users endar servers have back into the Web gone the route of interface from Outbuilding rich Web look. Tasks assigned interfaces around in the task mantechnologies such as agement and projAJAX (Asynchroect management nous JavaScript and applications also XML), Sun has stuck can be forwarded to with a fairly simple Outlook users in user interface that the iCal format. still manages to Open-Xchange only supports running Sun’s configuration tool eases distribution of the Outlook plug-in. present data clearly and efficiently. The the server on SUSE and Red Hat Linux distros. ence Protocol)-based system that biggest drawback is that users we accessed through either a don’t get as rich an interaction Java-based client or by using a with the UI as they would with while each of the sun col- client that supports XMPP, such a competing product. For examlaboration servers is a discrete as Gaim. The IM server also sup- ple, with richer Web clients, the component within the Java Enter- ports federation, so a company ability to reply to e-mail through prise System, Sun has done a can use it to directly connect an option in a right mouse good job of integrating the the internal IM network with button menu is common. For companies that need Outservers where it makes sense to internal IM networks of partners, look support, Sun has done a help users manage e-mail, cal- as well as public IM networks. We particularly liked the good job delivering a plug-in that endars and IM. In our test configuration, we Java IM client. It does a good almost completely hides users also looked at a fourth compo- job of providing access to the rich from the fact that they are accessnent, the Java System Portal capabilities found on most ing a server other than Microsoft Server, which provides a uni- XMPP-based servers, such as Exchange. This is due in part fied interface for the three col- persistent chat. Java Enterprise to a well-designed managelaborative components. We rec- System can be configured to ment tool for packaging up ommend companies planning manage archiving of IM-based necessary configuration settings to use all three servers consider conversations—on the server and an executable for delivery or by copying conversations to to the user’s system. The only the portal to ease integration. notable change is the “work The bundling of the three the user’s in-box. We would have liked better offline” menu item specific to the components in the Java Communications Suite sets Sun integration of user presence Sun connector. ´ apart from both Microsoft, information throughout the which has completely decou- applications—such as the Web Technical Analyst Michael Caton pled IM from Exchange Server, mail client—but we could view can be reached at michael_caton and IBM, with its two sepa- a user’s presence status through @ziffdavis.com. rate e-mail and IM products (Domino and Sametime). The EVALUATION SHORTLIST closest direct competition N IBM’s IBM Lotus Domino 6.5 Enterprise groupware with would be CommuniGate Sysdatabase-driven applications (www.ibm.com) tems and its CommuniGate Pro N Microsoft’s Microsoft Exchange Server 2003 Defines groupCore Server. ware in the Outlook world and allows forms-based applications The messaging and calendar in Outlook (www.microsoft.com) N Open-Xchange’s Openservers are standards-based Xchange Server 5 Includes additional collaboration tools to help systems that can be accessed teams with project, document and knowledge management through a Web browser, standard (www.open-xchange.com) e-mail client or Outlook (using N Sun Microsystems’ Java Enterprise System Collaboration the Sun Java System Connector Suite Good integration of IM with e-mail and calendar tools plug-in). The IM server is also (www.sun.com) standards-based—an XMPP

Sun Java Enterprise System

(Extensible Messaging and PresA P R I L 2 4 , 2 0 0 6 n e W E E K 49

WE’RE GOING TO GIVE YOU A NEW

WAY T O S E L L Custom Events

Ziff Davis Media Custom Solutions Group guarantees you a seat at the table with your best potential customer. (selected from a database of over 2 million Enterprise IT Buyers).

eSeminars White Paper Case Studies Custom Publishing

We use our expertise and products to

ROI Calculators demonstrate how both parties need each other. And then, everyone smiles and a deal is made.

Lead Generation Print Online

To find out more, please contact Martha Schwartz, Senior Vice President, at 212-503-5643 or [email protected]

Database Marketing Microsites

IN PRINT ▼ IN PERSON ▼ ONLINE ...from brand to demand

ZIFF DAVIS MEDIA Custom Solutions We Make Sales Happen

fWEEKLABS gWEEK CORPORATE PARTNERS eWEEK’s Corporate Partner Advisory Board comprises IT decision makers from government, manufacturing, education, retail, publishing, financial, utility, medical, telecom and nonprofit sectors. The Corporate Partners represent eWEEK readers and work on an ongoing basis with eWEEK editors, reporters and Labs analysts.

ADVISORY BOARD MEMBERS Sam Inks

Aerojet

Francine M. Siconolfi Aetna Inc. Glenn Evans Kevin Levesque Michael Skaff

AT&T ATX II LLC Bare Escentuals

Frank Calabrese

Bose Corp.

Kevin R. Baradet

Cornell University

Carl S. Ashkin Craig L. Lush

Darby Group Cos. Defense Acquisition University

Randy Dugger

Dugger & Associates

Kevin Wilson David Bray Keith Carter Ed Benincasa

Duke Energy Corp. Emory University Estee Lauder Cos. FN Manufacturing LLC

Tom Miller

FoxHollow Technologies Inc.

Gary Gunnerson

Gannett Co. Inc.

David Milkovich

Lockheed Martin

Bill Conati

Maax Spas Arizona Inc.

Dr. Kathie Sigler

Medical Center Campus of MiamiDade Community College

Robert Rosen

National Institute of Arthritis and Musculoskeletal and Skin Diseases

Erich Berman

Northwestern Mutual

Francis Rabuck Pankaj Chowdhry

Rabuck Associates Third Pillar

Michael Schwedhelm United Labor Bank Susan Nowicke Bruce Brorson

U.S. District Court University of Minnesota, Crookston

Judy Brown

(also CP coordinator) University of Wisconsin System

Gregory Smith

World Wildlife Fund

w w w. e w e e k . c o m

PETER COFFEE: EPICENTERS

Super services = superhighway CALL AKAMAI WHEN CONTENT POSITIVELY HAS TO GET THERE like all the others in the chain, is a new building hen people used to that has to be tailored to a particular environcall the Internet an ment. As a civil engineer by training, I often information superlook at a cookie-cutter building like a fast-food highway, they emphasized joint and see it as merely a decorative ornament its openness to all and on top of a foundation that was unique to its its ability to connect anysite and much harder to get right. thing to anything. Many Meanwhile, inside that building, every food who used the expression server represents a new need to recruit, train, had an agenda of ensurmotivate and retain a person who is different ing universal info-highway access, and this from every other person doing that same job has been largely accomplished in developed at every other location. In contrast, offering a nations like the United States. service on the information superhighway looks At some point, though, the real-world like a proposition of doing it once, doing it interstate highway system became more of right, making it automatic and being instantly a maintenance project than a construction everywhere. Location doesn’t matter, right? project. It’s now much more interesting to Well, if you actually know anything about look at Federal Express and United Parcel the physics and the engineering of large-scale Service, and the supply chain efficiencies they network and content technologies, you know can provide to the business that knows how that there’s a middle layer where location to use them as partners, than it is to buy a matters a lot. Akamai operates 18,000 servcement mixer and look for work as a highway ers in 2,400 locations, I learned in a recent builder—or to look at highway maps and to conversation with Akamai Vice President Bill buy trucks and hire drivers for yourself. Wheaton. Like a wily FedEx driver who knows The Internet is likewise past that tipover the best way to get across Manhattan during point, with companies like Akamai Technolothe morning rush, that gies increasingly taking Akamai platform knows the role of business THE NET NEEDS CAPABLE how to apply its own partner rather than mere BUSINESS PARTNERS, NOT routing strategies to get transporter—to get the performance right stuff to the right MERE DATA TRANSPORTERS. superior from the public network. place at the right time at Akamai, a pioneer of network-edge services, the right price. now works with content providers to make the I said earlier that people “used to” use the Internet marketplace as responsive—and as open information superhighway metaphor; I rarely to segmentation of premium services to profitsee it used anymore except in mocking tones by able customers—as any physical marketplace. people who can tell you a dozen things that are It’s rather like California’s superhighways that wrong with it. I’m often in that group, since any are now being paralleled by privately built toll metaphor leaves out most of the details so as roads offering faster peak-time travel to those to highlight some shared characteristic. When who can afford it. That’s the other respect in someone calls an aggressive businessperson “a which the Net looks increasingly like a highway. tiger of a competitor,” it doesn’t mean that he or Catering to automobile owners used to mean, by she has striped fur. Like all metaphors, “infordefinition, catering to the educated and affluent mation superhighway” is incomplete and can customer. Now, the highway market is a mass even be seriously distorting. market and requires its own internal segmentaThe major error that I’ve noted in calling the tion to deliver services based on ability and incliInternet a superhighway is that it buries a crunation to pay for them. cial difference in the way that an idea becomes The Internet has made this transition as well; a success in the world of bits versus the world companies like Akamai are therefore now a cruof atoms. If I want to offer a roadside service to cial part of commercial Net content plans. ´ travelers on a physical highway, every point of presence of that service is a whole new investment in both facilities and people. Every fastTechnology Editor Peter Coffee can be reached at food restaurant, no matter how much it looks [email protected].

W

A P R I L 2 4 , 2 0 0 6 n e W E E K 51

digital

Day CMS has broad audience CHIEF SCIENTIST DISCUSSES ROLE OF CONTENT MANAGEMENT SYSTEMS

E

week technology editor Peter Coffee recently spoke with Chief Scientist Roy Fielding of Day Software, in Irvine, Calif., about his company’s flagship product, the Communiqué enterprise CMS, or content management system. For a case study of Edmunds.com’s use of Communiqué and its plans for Day's CRX, or Content Repository Extreme, go to Page 44. More of Coffee’s interview with Fielding is on Page 45. Who do you visualize as being the target user of the Communiqué product? Who is the person who interacts directly with the application and gains increased access or productivity from what it’s able to provide? The Communiqué product covers a wide spectrum of uses—it goes from the people who are developing content for a Web site to a way to [direct] a whole organization’s workflow toward developing information.

anything to do with managing enterprise content. The JCR [ Java Content Repository standard-based] interface is just one part of that. JCR is used as a storage interface for the back end. And

So, one of the most difficult things about enterprise content management is that it’s really difficult to pinpoint who the user of the moment is. Really, we’re trying to focus on a very broad solution for

sites or public Internet sites. But, in many cases, it’s also used for annual reports, investor relations information and employee training. Probably the biggest use of Communiqué is for training within large corporations. What Communiqué does best is to handle the processing of information, particularly in relation to workflow for languages. And much of the reason for that is Day Software is a Swiss company. It focuses on different languages for implementation. So, the whole philosophy of the system is, How do we maintain content that’s up-to-date across four or five or 11 or 12 different languages? We have many tools that support that.

I’ve seen material from Day that talks about four different domains of content in which the company envisions Communiqué being applied: content management, digital asset management, document management and portal management. I think that’s a really interesting taxonomy, So, it should not be thought and I was wondering if of as a Web designer tool you could elaborate on or a database adminiswhat differences you see tration tool but rather as Day’s Communiqué 4 (top) decouples the CMS from the underlying repository. Day’s CRX something that presents (bottom) provides a standardized way for applications to interact with underlying content. between, for example, the needs of a content mandifferent facets to those An evaluation version of CRX can be downloaded at www.day.com/site/en/index/products/ agement system and the kinds of people but is still content-centric_infrastructure/content_repository/crx_downloads.html. needs of a digital asset in a form that they all can then we also have client con- an organization to manage management system. use? Yes, Communiqué is a full- nectors from the JCR interface information so they can pre- They’re all very similar—the featured enterprise content to specific applications, such sent it one way or another. In only real difference is how management system. There as Oracle databases and other our case, it usually ends up they’re portrayed in the indusbeing presented on intranet try. ´ are ways to use it for virtually products like that. w w w. e w e e k . c o m

A P R I L 2 4 , 2 0 0 6 n e W E E K EW3

digital

STAN GIBSON: OUTSOURCING & SERVICES

Tools for the globe rush

WEBLOG

STAN'S PICKS FROM GWEEK BLOGS

go.eweek.com/weblog

DON’T LEAVE HOME WITHOUT SOME GOOD ADVICE, SOFTWARE engagements,” said John Martin, senior uring the california vice president of strategy and technology gold rush, it was said that the only people who at IQNavigator. If you’re having application development work done, you enter all the made fortunes were those who sold picks and shovels to contract information about the relationship into IQNavigator, including deliverables, time the prospectors. During the frames and quality metrics, said Martin. “We current globe rush, vendors then calculate the invoice based on deliverand consultants are similarly ables and contract terms,” he said, noting that aiming to cash in, either by assisting companies in the globalization process as that can go a long way to heading off disputes with service providers before they happen, consultants and aggregators or by selling software since both customers and providers can to help customers manage their globally scattered access IQNavigator via a Web browser. The service providers. As you globalize, here are a few of the play- tool also rates the performance of providers. “You can find out who’s giving you the best ers you might meet. talent and price,” Martin said. Although better known for its hosting services, IQNavigator is being enhanced with supNavisite, in Andover, Mass., also offers advice port for multiple currencies and multiple to those interested in building a global sourcing languages, Martin added. Even though pricing strategy. Navisite’s Sumeet Sabharwal, senior vice starts in the low six figures, the service can pay president of outsourcing services and global delivfor itself quickly by ensuring that you pay only ery, stresses the importance of upfront planning. for what you get, according to Martin. “Putting a comprehensive governance framework Shell Oil is using in place is important. It often falls by the wayside YOU CAN’T SUBSTITUTE THE IQNavigator to manage its global procurement because clients have too HUMAN TOUCH WHEN IT process. “We develop many things to do,” said centrally global strateSabharwal. COMES TO GLOBALIZATION. gies and execute in local The necessary planning environments in over 10 countries,” said Allen is not free, Sabharwal warned. “There are costs Kirkley, vice president of contracting and proon top of costs savings. Studies have shown 15 curement at Shell, in Houston. IQNavigator percent to 40 percent of the value of a contract, is being used to handle $15 billion per year in including transition costs, layoff and retention “downstream” procurement, that is, for goods costs, and process improvement costs, need to be and services other than hydrocarbon resources done upfront.” After that, he said, “There are consuch as oil and gas. Included is contract labor tract management and vendor selection costs.” and a wide variety of technical products used Another vendor, EXA Infosystems, wraps in refineries and chemical plants, said Kirkley. offshore advice in its aggregation service, which Helen Huntley, a Gartner analyst, had this to finds the best partners for particular tasks. say at the recent Gartner Outsourcing Summit, The Stamford, Conn., company specializes in in Orlando, Fla. “Outsourcing contracts require Russian, Eastern European and Israeli service major review and modification before they can go providers. “We identify resources. We aggregate global, to reduce liability, regulatory enforceability the talent or partner with companies in different service performance and privacy risks. It’s not countries to provide the talent,” said EXA Infothat easy. There are different understandings and systems CEO Arthur Tisi. The company recently stringency of contract enforceability in different hired a new chief technology officer, Oleg Marcountries.” golin, who is originally from Russia. Bottom line: Tools are great, but when it Some vendors are selling tools to aid in the comes to globalization, there’s no substitute for management of service providers. One such venthe human touch. ´ dor is Denver-based IQNavigator, which offers its flagship tool set, IQNavigator7, as a hosted service. “It helps customers control outsourcing E-mail Stan Gibson at [email protected].

D

EW4 eW E E K n A P R I L 2 4 , 2 0 0 6

@

E R IC LU N DQU IST

Save the date—for a loong time “I hear it’s launching tonight” was perhaps the pithiest comment about the launch of Google Calendar. The comment was from Mitch Kapor’s blog and succinctly sums up most of the blogging comments on Google Calendar. Kapor’s own open-source calendaring product, Chandler, seems to be competing with Microsoft’s Vista for the longest development cycle. Chandler, which as of April 4 was in Version 0.6.1, “is still raw,” in Kapor’s blogging words, and was first announced in its 0.1 version in April 2003. Here’s my quick take on Google Calendar. It works. But why can’t a user define how long the calendar items should exist? Forever seems like a very long default setting. 4/13/06

@

KEVI N FOGARTY

Outsourcing savings in real dollars Over the last two or three years, it’s become increasingly clear the claims by outsourcing consulting companies that outsourcing deals in India and elsewhere could save 60 percent and more of the cost of similar operations in the U.S. were ... optimistic. A new study says the real savings—once you factor in severance for laid-off workers, training, governance and other costs—averages around 15 percent. 4/14/06 w w w. e w e e k . c o m

enterprise CLASSIFIED

enterprise CLASSIFIED GROUP

3 Magazines - 1 Insertion Order - 1 Price

1,775,000 Potential Customers Place your ad in the Ziff Davis Media Enterprise Classified Group: eWEEK, CIO Insight and Baseline.* The largest classified advertising arena in the Enterprise IT market. Reach 1,775,000 Enterprise IT Buyers, Business Leaders, IT Project Leaders, IT Analysts, CIOs, CTOs, Tech IT, Network Developement experts IN ONE PLACE, AT ONE PRICE.

3 Magazines - 1 Insertion Order - 1 Price

*Keep your campaign highly visible and increase reader impressions by running your ad four times per month in eWEEK

1,775,000 Potential Customers

For more information contact, Lauren Kossak, Classified Sales Representative at 212-503-5647 or [email protected]

Place your ad in the Ziff Davis Media Enterprise Classified Group: eWEEK, CIO Insight and Baseline.* The largest classified advertising arena in the Enterprise IT market.

For more information call 1-800-758-3789

®

dtSearch Terabyte Indexer “Bottom line: dtSearch manages a terabyte of text in a single index and returns results in less than a second” — InfoWorld ◆ over two dozen indexed, unindexed, fielded data and full-text search options ◆ highlights hits in HTML, XML and PDF, while displaying links, formatting and images ◆ converts other file types (word processor, database, spreadsheet, email and attachments, ZIP, Unicode, etc.) to HTML for display with highlighted hits ◆ Spider supports static and dynamic Web content, with WYSWYG hit-highlighting ◆ optional API for C++, .NET, Java, SQL, etc. Ask about new .NET Spider API

Developer Quotes and Reviews dtSearch vs. the competition: “dtSearch easily overpowered the document indexing and searching abilities of other solutions, especially against large volumes of documents” ($199)

Spider Desktop with 00) pider (from $8 S h it w rk o Netw ) er (from $999 id p S h it w b We m $2,500) /DVDs (fro D C r fo h s li Pub Win & .NET Engine for Linux Engine for

Reliability: “dtSearch got the highest marks from our systems engineering folks that I've ever heard of” Results: “customer response has been phenomenal”

For hundreds more reviews and developer case studies, see www.dtsearch.com Contact dtSearch for fully-functional evaluations

“For combing through large amounts of data, dtSearch ... leads the market” — Network Computing “Blindingly fast” — Computer Forensics: Incident Response Essentials “Super fast, super-reliable” — The Wall Street Journal “A powerful arsenal of search tools” — The New York Times “Powerful Web-based engines” — eWeek “Blazing speeds” — Computer Reseller News Test Center “The most powerful document search tool on the market” — Wired Magazine

The Smart Choice for Text Retrieval® since 1991

1-800-IT-FINDS • www.dtsearch.com

AD INDEX

ADVE RTI S I N G SALE S O FFI C E S Karl H. Elken Publisher (212) 503-5631 Jason Ratner National Associate Publisher (415) 547-8813

COMPANY

PAGE

TELEPHONE

Advanced Micro Devices

15, 17

www.amd.com/lessenergy

Hewlett-Packard

21, C11, 47

www.hp.com

IBM

A-B, 2-3

www.ibm.com

Informatica Software

5

Microsoft

8-9, 19, C2-C3, C5, 42-43

(800) 653-3871

URL

www.informatica.com/eweek

www.microsoft.com

EASTERN REGION Frank Bilich Northeast Regional Sales Manager (212) 503-5634 Matthew Merkin Southeast/Midwest Regional Sales Manager (212) 503-5641 Johanna Zottarelli-Duffe Senior Account Executive (212) 503-5678

WESTERN REGION Christina Card Bay Area/Southwest District Sales Manager (415) 547-8474 Matt Stovall Bay Area/Northwest District Sales Manager (415) 547-8241 Tia Lambert Marketing Specialist (415) 547-8486

Radware

6

(866) 722-4316

Oracle Corp.

56

www.oracle.com

Sterling Commerce (America) Inc.

11

www.sterlingcommerce.com

Sun Microsystems

55

www.sun.com

Toshiba America Inc.

23

www.toshibabusiness.com

Verisign Inc.

34-35

www.verisign.com/intelligence.com

Vizioncore

31

(866) 260-2483

www.radware.com

www.vizioncore.com

ADVERTISING CLOSING DATES

CUSTOM CONFERENCE GROUP

ISSUE

CLOSING DATE

ISSUE

CLOSING DATE

ISSUE

CLOSING DATE

ISSUE

CLOSING DATE

Martha Schwartz Vice President (212) 503-5643

May 8

Apr. 24

May 15

May 1

May 22

May 8

May 29

May 15

Beatrice Olivas Sales Director (415) 547-8476

E D I T O R I A L CA L E N DA R

Bruce Kidd Sales Director (404) 364-1815

ISSUE

LABS

DEMOGRAPHICS

May 8

Thin-client computing

Security Solutions VOIP Solutions

May 15

Trusted OSes

Developer Solutions SMB Solutions

May 22

Compliance

Storage Solutions

May 29

Accessibility

Channel Solutions

June 5

Data protection

Office Solutions

ENTERPRISE CLASSIFIED Lauren Kossak Classified Sales Representative (212) 503-5647

CIRCULATION Doreen Schrack Rod Roudi

Circulation Manager Circulation Assistant

SUBSCRIPTION INQUIRIES (888) 663-8438; Fax: (847) 291-4816 http://service.eweek.com

Marketing resources For information about advertising in the No. 1 enterprise newsweekly, go to mediakits.eweek.com. You’ll find the resources you need, including our events calendar, research and circulation summaries, as well as background info on eWEEK’s award-winning print and online brands.

eWEEK’S sales and marketing staffs can be reached at (212) 503-5600 or (800) 758-3789, or via e-mail by using the following formula: [email protected] eWEEK®, PC Week®, PC Week Netweek®, PC Week Shoot-Out®, Spencer F. Katt® and Spencer F. Katt: Rumor Central® are registered trademarks of Ziff Davis Publishing Holdings Inc. Copyright (c) 2002 Ziff Davis Media Inc. All rights reserved. Reproduction in whole or in part without permission is prohibited. For permission to reuse material in this publication or to use our logo, send e-mail to [email protected]. For reprints, contact Linda Ragusin via e-mail, lragusin@fostereprints. com; phone, (866) 879-9144.

w w w. e w e e k . c o m

eWEEK (ISSN 1530-6283) is published weekly except for combined issues (the last week of June and the first week of July, as well as the last two weeks of December) and a midweek issue in November by Ziff Davis Media Inc., 28 East 28th St., New York, NY 10016-7930. Periodicals postage paid at New York, N.Y., and additional mailing offices. Single-copy price including first-class postage: $6. One-year subscription rates: U.S. $195, Canada/Mexico $295, foreign airmail $395. All orders must be prepaid. Subscription inquiries should be directed to Customer Service Department, eWEEK, P.O. Box 3402, Northbrook, IL 60065-3402, or call (888) 663-8438, fax (847) 564-9453; Customer Service Web site: http://service.eweek.com. Please note that changes of address require that a new application be filled out completely, and please include both the new and the old addresses. Please allow a minimum of 4 to 6 weeks for processing. POSTMASTER: Send address changes to eWEEK, P.O. Box 3402, Northbrook, IL 60065-3402. We periodically make lists of our customers available to carefully screened mailers of quality goods and services. If you do not want to receive such mailings, please let us know by writing us at Customer Service Department, eWEEK, P.O. Box 3402, Northbrook, IL 60065-3402. GST registration number 865286033. Publications Mail Agreement No. 40009221. Return undeliverable Canadian addresses to P.O. Box 503, RPO West Beaver Creek, Richmond Hill, Ontario L4B 4R6. Printed in the U.S.A.

A P R I L 2 4 , 2 0 0 6 n e W E E K 53

RUMOR CENTRAL: SPENCER F. KATT

Platinum platter puss CHANNELING ELVIS: RUMORS, LYRICS FLY FROM OUTBACK TO MEMPHIS ock-a-hula, baby,” sang the Kitty, King-like, when he heard rumors were flying around Hawaii that Michael Dell’s MSD Capital and a fellow investment group might be looking to purchase the Four Seasons Resort Hualalai along the Kona coast. The Hirsute Hula Boy remembered hearing that MSD Capital scooped up the Four Seasons Resort Maui at Wailea in 2004, so adding another Hawaiian hotel to the portfolio wouldn’t be a stretch—even if it is rumored to be worth more than $500 million. Maybe Dell should consider opening up a manufacturing facility in Hawaii, too, mused the Maui Meower. The American Electronics Association placed Hawaii 47th in its annual survey that rates tech industry job opportunities by state. Montana, North Dakota, Alaska, South Dakota and Wyoming filled out the AEA’s bottom six. Hawaii ranks 27th for tech salaries, though, as an average Hawaiian tech worker brings home about 61,216 coconuts a year. California, Texas, New York, Florida and Virginia were rated the top five states for hightech job opportunities. Suddenly, the KattPhone’s new ring tone, “Separate Ways,” by Elvis, heralded a caller who told the tabby that CA’s COO Jeff Clarke has parted ways with the Islandia, N.Y., company. Clarke will head up Cendant’s travel distribution division. Michael Christenson, CA’s executive vice president of strategy and business development, will reportedly replace Clarke as COO. Bidding the caller adieu, the Baron of Babble belted out “Money Honey” as he fielded an e-mail from a friend who said Intuit scared scores of Turbo Tax users when it refreshed its servers for about 20 minutes on tax day. Apparently, the company anticipated volume on its system to increase as the day wore on and decided to reboot its system to prevent a slowdown. “Can you imagine how traumatized tardy tax filers were for those 20 minutes?” pondered the Puss.

R

Still feeling his inner Elvis, the famished Furball decided to fulfill his craving for cheeseburgers at Outback Steakhouse. There, the Furry One was amused by an Aussie waiter who claimed that the Australian Security Intelligence Organisation has reportedly tried using Google’s sponsored ad links to tout employment opportunities to Web surfers who browse keywords related to the agency. Just as El

Gato was about to chomp into a big hunka, hunka burger, a crony called to note that HP CEO Mark Hurd told attendees at the Outlook Conference in San Jose, Calif., at which the Governator also spoke, that the company may use some of the cash it amassed in 2005 to hit the acquisition trail—and that it won’t sell its PC business. Returning to his feast, the Katt hummed “Baby, Let’s Play House” as he dreamed about something he’d like to acquire: Elvis’ pre-Graceland home, bought at the beginning of his career in Memphis, is available for bid on eBay until May 14. “Mmm, maybe I could auction my first scratching post on eBay,” cackled the Kitty. budugllydesign.com “There’s a lot of milkandcookies.com/article/3372 history there.” ´

LITTERBOXLYNX

@

DIFRWear.com And don’t forget me at blog.ziffdavis.com/katt Spill your guts at [email protected] or give the Katt a howl at 781-938-2627

54 eW E E K n A P R I L 2 4 , 2 0 0 6

w w w. e w e e k . c o m

About 1/3 the power consumption

More than 50% faster Two Single- or Dual-Core AMD Opteron™ Processors

1/4 the size Four Gigabit Ethernet ports

Fan-access door

Service processor

PCI-X slot expansion

Less than 1/2 the price

Dual-redundant, hot-swappable power supplies

2.5” SAS servergrade HDDs

VGA video port

The Sun Fire™ x64 servers

OH, ONE MORE REASON WHY IT’S THE NEW STANDARD IN x64 INDUSTRY STANDARD SERVERS: IT STARTS AT ONLY $2,195. SERVER FACTS: 57% FASTER

1

1/4 THE SIZE ABOUT 1/3 THE POWER CONSUMPTION CERTIFIED FOR THE TOP 3 OSs LESS THAN 1/2 THE PRICE

2

Sun Fire™ X4100

Dell PE6850

SPECfp_rate2000: 82.4

SPECfp_rate2000: 52.5

1U

4U

550 watts

1,470 watts

Solaris, Linux, Windows

Linux, Windows

$2,195

$4,949

Buy today at sun.com. © 2006 Sun Microsystems, Inc. All rights reserved. AMD, the AMD logo, AMD Opteron, combinations thereof, are trademarks of Advanced Micro Devices, Inc. SPEC, SPECfp are registered trademarks of the Standard Performance Evaluation Corporation. 1 Results from http://www.spec.org, as of 02/15/06. 2 U.S. list price. All prices quoted are in U.S. dollars.