Google's ‘One Pass’ subscription solution for publishers

Just one day after Apple made its App Store subscription service available to publishers, Google has already responded by announcing a similar service for its Android platform. The solution will also work in Web-based clients, allowing publishers to reach users on multiple platforms with a single solution. Much like Apple’s implementation, Google’s One Pass provides users with a single interface where they can access and manage all of their digital newspaper, magazine and other content subscriptions. Unlike App Store subscriptions, however, Google gives publishers much more freedom with regard to pricing models and flexibility. Publishers will also be able to give free or reduced subscriptions to paid print subscribers, and they can even utilize a freemium model if they so desire. Hit the break for a video from Google outlining the One Pass product.

No Reboot Required Ksplice uses new technology to build security updates for Linux that can be installed without restarting.

"Restart required." The words are guaranteed to bring a groan from computer users. And for busy system administrators, they are even more annoying: applying critical system updates to protect a machine against attack must be balanced with the demands of hundreds or even thousands of users. Software from a new company called Ksplice addresses this dilemma with updates that do not require a restart.

In order to install an update while a computer continues running, a software patch must be carefully structured so that it doesn't interfere with the operating system's current operations. This is a difficult and delicate process, and Ksplice addresses it by working at a different level of computer architecture. Most update technologies use the same programming language as the operating system itself. The computer has to translate these instructions into a lower-level language. Ksplice's software sidesteps this process, analyzing the changes that an update would make at a low level and implementing them using the lower level language.

The technology was developed by cofounder Jeff Arnold while he was a graduate student at MIT, and last week, it won the grand prize at the Institute's $100K Entrepreneurship Competition.

Waseem Daher, cofounder and chief operating officer, explains that the approach adopted by Ksplice saves it from restructuring instructions in a higher-level programming language on the fly. So far, Ksplice has developed its new update technology for the Linux operating system--which is commonly used to control server machines--although Daher says that the technology could work on other operating systems too.

Ksplice is intended to work for all security patches. "If you don't have a complete solution, it's basically useless," Daher says.

In tests conducted from May 2005 to May 2008, Ksplice was able to install 88 percent of Linux security updates automatically and without a reboot. The remaining updates could be installed without rebooting when a human programmer added a few lines of code.

Ksplice hopes to license its technology directly to software vendors, and then provide the human expertise needed to keep the system working. While Ksplice searches for deals with vendors, Daher says that the company will offer a subscription service to convert patches for clients so that they do not require a reboot.

Google Grabs More Geo-Data By letting developers store data on its servers, Google hopes to make the geo-Web more searchable.

On Wednesday, Google announced that it would open its servers to geographic data belonging to anyone. This means that developers will be able to quickly build a location-based Web service without having to also manage their own data server. The announcement might be good for many developers, but it's also good for Google itself: the location data will be integrated into Google's search index, making it searchable and, ultimately, capable of generating advertising revenue.

At the Where 2.0 conference in San Jose, CA, Google senior product manager, Lior Ron, introduced an application programming interface (API) for Google Maps Data. Ron explained that the product allows developers to "store custom geographic information on Google's infrastructure, relieving developers of the duty of maintaining data on an infrastructure."

In 2005, Google released an API for its Google Maps services, providing a simple way to create a custom map for a website or build "mashups" using other data sources such as Craigslist rental listings. Now, Google Maps Data API, lets developers dive deeper into the map-making process, using Google's servers to store and manage the geographical data an application or service might need.

One company that's already using the Google Maps Data API is Platial, an online atlas that lets users tag and share places of interest. Currently, Platial holds all of this user-generated geo-data on its own servers. With the new API, the data will be integrated into Google's index, says Jake Olsen, Platial's chief technology officer, providing "immediate discovery via Google Search in Maps."

Another Maps Data project, called My Tracks, was created by Google's own engineers. My Tracks runs on Android mobile phones and records the location of GPS "breadcrumbs" left by users as they walk, jog, or bike outdoors. The data is also stored on Google's servers, and people can edit and share information via Google Maps.

As real-time geographical data enters Google's database, it could provide the search engine with a hook into real-time search, says Olsen. Currently, the company indexes the Web on a rolling basis throughout the day and updates a few services, like Google News, more frequently. A real-time stream of geographical data could help Google index certain types of events more quickly. The search engine could, for instance, collect users' pictures geo-tagged at the scene of a crime or accident and include them in a news search.

One increasing concern, however, is that Google might gain access to much more geographical data than other services. This could lock out some smaller companies, and some developers might be wary about completely trusting Google with all of their data.

Another drawback for developers may be that currently the API has some service constraints. "If you run a popular site, you will hit limits," says Olsen, "whether it be rate limits or content limits." He suspects that Google will come up with a commercial licensing scheme and find a service-level agreement that makes its capabilities clearer.

In the meantime, Platial isn't giving up its databases completely. "As with any cloud-based service," says Olsen, "if that service goes down, so do you."

Are Your "Secret Questions" Too Easily Answered? Research finds that the answers to secret questions used to retrieve forgotten passwords are easily

Brian Green's experience with not-so-secret questions began when he logged on to his World of Warcraft account in March of this year and found all of his characters in their underwear. Someone had stolen the account and sold off all of his virtual equipment.

"My first thought was that I might have a keylogger on my computer," Green wrote in a description of the event. Yet his own research into the incident--and the attacker's ability to change his account passwords multiple times--led Green, who is himself a game designer, to a different conclusion: "My 'secret question' has an all-too-common answer . . . This wasn't something I considered when I filled it out way back when."

The incident bares similarities to the high-profile case involving Alaska governor and former vice-presidential candidate Sarah Palin. In September 2008, hackers used the name of the location where Palin and her husband met to gain access to her Yahoo e-mail account via the "secret question" password-recovery mechanism.

Palin and Green are not alone. In research to be presented at the IEEE Symposium on Security and Privacy this week, researchers from Microsoft and Carnegie Mellon University plan to show that the secret questions used to secure the password-reset functions of a variety of websites are woefully insecure. In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.

"Secret questions alone are not as secure as we would like our backup authentication to be," says Stuart Schechter, a researcher with software giant Microsoft and one of the authors of the paper. "Nor are they reliable enough that their use alone is sufficient to ensure users can recover their accounts when they forget their passwords."

The least-secure questions are simple ones whose answers can be guessed with no existing knowledge of the subject, the researchers say. For example, the answers to the questions "What is your favorite town?" and "What is your favorite sports team?" were relatively easy for participants to guess. All told, 30 percent and 57 percent of the correct answers, respectively, appeared in the top-five list of guesses.

But answers that require only a little personal knowledge to guess should also be considered unsafe, the researchers warn. Of people that participants would not trust with their password, 45 percent could still answer a question about where they were born, and 40 percent could correctly give their pet's name, the researchers found.