A recent Computerworld story cites unnamed analysts as giving the iPad an “F” for its security features, then quotes Gartner analyst Ken Dulaney on why iPhones shouldn’t be used in the enterprise:

Despite Apple’s updates and the inclusion of the Cisco VPN, Dulaney said Gartner concludes that the iPad is “not enterprise ready … and Apple would have no problem with Gartner saying this was not enterprise ready. … We don’t endorse use of netbooks, and the iPad is in the same category. … We don’t think it has the security and manageability capabilities for offline applications and, more importantly, the support of Apple for the enterprise.”

Dulaney is a smart guy, and Gartner is almost always conservative in its recommendations; it was one of the first analyst firms to backtrack on promoting Windows Vista for example, and it traditionally tells IT to avoid major operating system updates until 18 months or so after the initial version ships. Thus, I know he’s being honest in his cautious approach. It’s clear his standard applies to a broad range of devices, not just iPads.

But there’s a flawed premise that Gartner shares with IT managers: that mobile devices must meet military-grade security needs or, at least, financial-services-grade security needs.

I ask, why? After all, most laptops don’t come with the hard-to-break (if, indeed, any) encryption, remote kill capabilities, and application management that analysts and vendors say mobile devices should have.

The fact is most companies are not defense contractors, financial service providers, or similarly highly regulated entities. So why should smartphones meet those industries’ special requirements?

One reason is what I call Neanderthal IT thinking: that IT’s job is to control information and process by preventing users from doing much of anything. That ship sailed years ago, and IT leaders who stake themelves to that approach are doomed. IT’s job is to enable the business and minimize risk where reasonable.

If information is so critical that it needs to be tightly controlled on a iPad or other mobile device, you have to ask why that information is so accessible in the first place. The best way to control highly sensitive information is to not make it available, or at least keep it on the server and never let it be stored on an external device. That’s what many hospitals do with their wireless tablets and laptops, so patient information doesn’t leave the grounds even if the hardware does.

There is a hypocrisy in IT’s mobile expectations if the IT department that insists on military-grade security for mobile isn’t doing the same for its laptops and other computers, you know the issue is not security but resistance to change — a reluctance to accept new technologies that are user-oriented.

I’ve seen firsthand what real military contractors have to deal with to protect their secrets: They get to tote an extra laptop for their security work, one that is encrypted at several levels, with automatic drive-wiping if the multiple passwords are incorrectly entered, often requiring a security token device in addition to the passwords. Also, the USB and other ports on those laptops are glued over or otherwise incapacitated. Email is restricted to approved recipients, and users are completely locked out from installing or modifying apps. (Financial-services-grade security isn’t quite as strict and doesn’t usually require a separate laptop, a hardware security token, or email whitelist.)

Yet I don’t hear analysts and IT managers criticize Hewlett-Packard, Dell, or Lenovo for shipping standard PCs that aren’t so equipped and configured. Why is there no analyst or IT demand for USB-less PCs? After all, USB thumb drives are an incredible security threat. Also, I don’t see most businesses implementing the severe measures that military contractors do. So why are they expected to do so for mobile?

Of course, the big reason is that PCs evolved when IT was focused on mainframes, and its initial resistance to PCs was too little, too late. IT leaders who still think that way see mobile as the new line in the sand: They lost control to the PC, and they’ll be damned if they lose more control to mobile. (Of course, it’s already too late; nearly half of smartphones in use in business today are employee-owned.)

Vendors, analysts, and consultants are happy to play to the Neanderthal IT crowd. After all, securing information is a lucrative business, and the control-freak IT department is the perfect bottomless purse. The latest example is Boxtone, which recently released a study with these findings:

According to the survey of more than 400 IT managers, there are still concerns with connecting the iPhone to the IT infrastructure. According to the report, more than 80 percent of respondents cited security (such as encryption, antivirus, and loss); 50 percent cited IT policy and compliance; and 30 percent listed limited carrier choice as concerns.

Boxtone, of course, sells tools to help IT manage mobile devices — yet it has no offering to manage mobile security, oddly enough. Its competitors — Good Technology, MobileIron, Sybase, Trust Digital, and Zenprise, among others — have released or promoted similar self-interested “studies” over the last few months to promote IT spending on their mobile management tools.

There are of course some businesses and corporate roles that require military- or financial-services-grade security. Right now, only the BlackBerry and in some circumstances the Good server/Windows Mobile combination offer that level of protection. (The forthcoming iPhone OS 4.2 should offer most, if not all, of these capabilities when paired with a management server such as Good’s.)

For the vast majority of businesses, there are plenty of mobile devices whose security capabilities are good enough: iPhone OS-based devices, Windows Mobile-based devices, Palm OS-based devices, Symbian OS-based devices, and in some cases even WebOS-based devices. (Google’s Android is the only major mobile operating system not to have any built-in business-level security capabilities.) As that Computerworld article mentioned, many IT managers who criticized the poor security of the iPad and iPhone weren’t aware of their Cisco VPN support, remote kill, and AES encryption capabilities — their knee-jerk nos were based on ignorance, which is scary, given their key role in security management.

I find it quite ironic that with all the hyperventilation around mobile security, which is disproportionately focused on the iPhone (no doubt there’s some proxy Apple-bashing going on there), you don’t hear criticism of IBM for not embedding mobile-oriented security into its Lotus Domino and Lotus Notes server platform, nor of Novell for not embedding mobile-oriented security into its GroupWise email platform. After all, they’re the access points for the data that allegedly needs protecting. Yet both of these enterprise platforms rely solely on outside vendors — mainly RIM’s BlackBerry Enterprise Server and Good Technology’s Good server — to do the mobile security work.

If security were the real issue, you’d think IT would insist that security be guaranteed at the server level, not leave it to the mobile devices. Instead, most IT organizations are content to bolt on third-party server and mobile-client software that typically handles a subset of their security needs and a subset of the devices out there. If the security considerations were that core, they’d be in the core.

More ironically, only Microsoft has built-in basic mobile security for its server (Exchange). The iPhone OS devices use that, as do the Nokia Symbian and, of course, Windows Mobile devices. Heck, even IBM is now licensing the Microsoft security management technology (Exchange ActiveSync) for use in Notes. My point: If the demand was significant for such strong security as the analysts and Neanderthal IT folks claim, it wouldn’t be a mid-market-oriented vendor like Microsoft leading the way.

So the next time you’re tempted to raise the security shibboleth when someone wants to bring in an iPhone or Droid, ask yourself if you’re not holding those devices to a different standard than you do your laptops and PCs — and why that’s the case. You may find your knee-jerk response is the wrong one, so you might consider a way to safely say yes instead. That’s the first step to moving off a dead branch of the evolutionary tree.

Flipboard is a free app, and once you have it installed and you’re logged in to your Facebook and Twitter accounts, it will scan your friends’ posts and present the links and articles that they’ve been posting to Facebook or Twitter to you in a magazine-like layout. Your Facebook friends, their shared links, photos, and videos are all arranged in a layout that looks much better than Facebook itself, and the links from the people you follow on Twitter are pre-loaded and the articles displayed in-line.You don’t have to scroll endlessly through pages and pages of content to find the things you’re looking for, either: They’re all laid out on pages that look like you’re reading an actual magazine, and you can move your finger across the iPad display to flip between pages. The app also recognizes if your iPad is in portrait or display mode, and will change the page layout accordingly.

Once you have your accounts added, the app will show you all of your available sections, and you can opt to view just the links and posts from your Facebook friends, the people you follow on Twitter, or any of the pre-loaded channels that the app from popular news sources elsewhere on the Web. When you enter one of the channels based on your social network, the app displays the media from your social networks laid out like a magazine, with the hottest and most popular news stories highlighted.

If someone’s posted something particularly interesting, you can tap it to zoom in on the article and read the whole thing. If there’s an associated image or embedded video, you can tap it to zoom in on the image or to play the video inside the app without having to leave Flipboard and open a video player. When you’re using the Twitter or Facebook sections of the app, you have the ability to interact with your social network straight from Flipboard, which means you can like, comment, and re-share links on Facebook from inside Flipboard. Over in the Twitter section you can retweet and reply to links and interesting tweets as well.

The word is the next version will be even more interesting, as it will be powered by the relevance engine built by Ellerdale. In recent weeks, Flipboard acquired Ellerdale, which had developed a set of real-time search and discovery tools based on Twitter. Ellerdale co-founder Arthur van Hoff has joined Flipboard as Chief Technology Officer.

A video shows the new Droid X going from four bars to no bars when held in such a way that the antenna is covered.

At a July 16 press conference, Apple CEO Steve Jobs did his best to quell a storm of bad press surrounding the iPhone 4. During his presentation, Jobs showed the Research In Motion (RIM) Bold 9700, HTC Droid Eris and Samsung Omnia II supposedly producing the same loss of signal that the iPhone 4 experiences when the user makes skin contact with the lower left-hand corner of the device’s stainless steel exterior antenna.

Apple said it would provide free cases, which appears to remedy the problem by mitigating contact with the skin. Users were also allowed to return the phone for a full refund without a restocking fee.

Apple has been continually adding to the videos on its site that show a variety of handsets, from nearly every major OEM, losing signal when held in a way that covers the phone’s antenna.

The Droid X is Motorola’s most recent high-profile Android-based smartphone for Verizon Wireless. The new phone features a massive 4.3-inch touchscreen, 720p video capture, Wi-Fi hot spot functionality, as well as a number of other high-end features.

Not only does 4G not exist, but when it does come along several years from now, it won’t solve many of the issues that plauge users, such as spectrum shortage and lack of device portability across carriers.

Despite not yet existing, 4G is cropping up increasingly in advertisements. But what carriers such as Sprint mean by the term is the high-speed WiMax wireless data service that it and its partner Clearwire are deploying in dozens of U.S. cities. Other carriers are slapping the 4G label on a 3G-based technology, LTE, an extension of the top-speed HSPA 3G technology that carriers are only now starting to deploy and one that has not yet been fully standardized.

Phil Redman, Gartner’s longtime mobile analyst, points out, 4G is still being defined by the international telecom standards bodies. For now, it’s a meaningless term that carriers slap on to whatever they want you to think is the next big thing.

Redman notes that a main attribute of the 4G definition that’s likely to emerge involves its theoretical maximum throughput: 1Gbps when used in a fixed location, such as from a laptop in a café. (Throughput rates in a mobile context, such as from a smartphone while walking, are usually a tenth of the fixed rate.) Of course, real-world throughput will be much lower — as is always true of wireless technologies — than the theoretical maximum. Still, the 4G target represents a 10-fold speed improvement over today’s top 3G networks.

The term “4G” won’t refer to any specific wireless technology (if specific technologies deliver on the specs, they’ll count as 4G), but in practice 4G will likely be offered through the LTE Advanced standard now being defined, Redman notes. The 802.16m standard, currently under development as a successor to the current WiMax’s 802.16d and 802.16e standards, could also fit the likely 4G requirements, though Redman expects most carriers will go the LTE Advanced route.

We won’t see real 4G until between 2015 and 2020, Redman says — with full deployment to follow a decade later, if history is any guide. In other words, don’t hold your breath for 4G anytime soon.

Even when real 4G exists, it won’t cure the two most conspicuous problems that users face today with 3G: spectrum shortages and the inability to use your device of choice with any carrier’s network.

AT&T has made a lot of noise that its iPhone users are already straining its 3G network in the United States, and carriers elsewhere in the world have said the same thing. That’s just one device used by 3 percent of its customers — imagine what happens when smartphones, 3G-enabled laptops, and wireless e-readers such as the Amazom.com Kindle and the rumored Apple media slate are commonplace.

Even as carriers bolster their local cell stations’ capability to relieve local congestion, the FCC has warned that there is not enough spectrum to go around — despite the fact that just two years ago a big block of analog-TV spectrum was auctioned off to carriers for use in “3G-plus” LTE and WiMax networks. WiMax is available in about a dozen cities now, while the first-generation LTE network should start coming online in 2011 — but don’t confuse these 3G LTE and 802.16d/e WiMax deployments with the 4G LTE Advanced and 802.16m WiMax networks expected in the next decade or so.

Exponential mobile device growth is one culprit in this presumed shortage of spectrum. The other is the quiltwork of wireless spectrum allocated to carriers. Each country has set aside spectrum for various purposes, but the spectrum used in one country for, say, 3G may be different than the spectrum used in another. Because of this, four spectrum bands comprise the GSM cellular technology used by most carriers. Even within a country, carriers may use different bandwidths for the same technology, based on what became available when they put in their bid.

Thus, in the United States, AT&T uses a different spectrum than T-Mobile does for its GSM-based voice and data services. Each carrier also uses different spectrum for 3G, even though both run the same network technology (UMTS). Many GSM-capable phones work with all four GSM 2G bands by having tunable radios — but they are rarely designed to work with all the UMTS 3G bands — and that’s why Google’s Nexus One, designed for T-Mobile, can’t do 3G on AT&T’s network.

Throw in multiple bandwidths for the CDMA 2G/3G technology used by Sprint and Verizon Wireless, and you quickly get so many technology and frequency variations that the phones can’t easily be designed to support them all. Adding the circuitry and multiple radio tuners to support every possibility quickly causes space, power usage, and heat issues — and higher costs.

Avoiding these issues is a big reason why smartphones are tied to specific carriers. But the fractured networks that result are subject to oversaturation, as carriers cannot divert excess traffic to one another to better balance the load. AT&T says that most iPhone users’ complaints about poor 3G coverage center around New York and San Francisco, where the local networks are saturated — but AT&T can’t divert users to T-Mobile’s network, though both are based on the same technology. (AT&T and T-Mobile do divert voice traffic to each other when the 2G network is overloaded.)

T-Mobile’s late entry into 3G services via Android smartphones this past year also raises concerns, Redman notes, since T-Mobile doesn’t have a lot of spectrum available, a consequence of sitting out several spectrum auctions in the past decade due to economic woes at its parent company Deutsche Telekom. Worse, T-Mobile doesn’t have any spectrum that could be used with the expected LTE devices; Verizon and AT&T locked up most of that spectrum in 2008.

When 4G is available, there will be the same split in technologies — likely LTE Advanced and 802.16m WiMax — and in frequencies, Redman notes. And the patchwork of spectrum based on who successfully bids as it becomes available will continue. Devices will likely continue to be tied to specific carriers, who won’t be able to balance usage across each other’s networks.

For example, in the United States, Verizon and AT&T have licensed the 700MHz spectrum for LTE, while European carriers will use the 2100MHz spectrum. Sprint plans to offer WiMax service instead, as that technology was available sooner and Sprint wanted to beat its competitors to the “4G” market — but Redman notes that very few other carriers have WiMax plans, so Sprint’s WiMax smartphones may not be usable in most parts of the world. Also, there may not be enough demand for device makers to bother with dual LTE/WiMax models.

If there’s any hope, it’s that the 4G networks will be less fragmented than today’s 2G and 3G networks, so device makers might be able to create cost-effective and power-efficient global smartphones, at least for LTE Advanced networks.

Redman expects carriers to offer dual 3G/4G smartphones, using the 4G networks for data services and the 3G networks for voice traffic. Doing so could decrease the congestion by essentially having phones use two networks simultaneously. Plus, this approach would let the carriers load-balance across their own 3G and 4G networks, since 3G supports both data and voice traffic, while 4G can support voice if it’s converted to VoIP, à la Skype.

And the near-standardization on LTE Advanced, coupled with the smaller number of frequencies involved, might let carriers perform mutual load-balancing across one anothers’ networks to help smooth out capacity gaps even more. That would be particularly useful when one carrier has only a small amount of spectrum in certain geographies and thus can’t serve all the demand in those specific areas.

Of course, it’s in the carriers’ interest to lock in customers by tying devices to their networks, so even if technologically the ability to use your desired smartphone on most carrier networks comes to pass, the carriers may not play ball. After all, that would let customers easily change carriers, leading to price wars and unstable revenues. What’s good for users may not be good for the carriers — and the carriers call the shots, at least within the mosaic of spectrum available to them.

However, the question remains, will corporations open up their pocket books and purchase Windows 7 or take a wait-and-see approach to determine if the new features are worth the money. With that in mind, lets take a look at some of what’s new and why it matters.

Navigation / Interface:

Windows users are all too familiar with the pros and cons of Windows Explorer. With each release of Windows, Microsoft has made changes to Windows Explorer, some well accepted, others not so much. With Windows 7, Microsoft has once again reinvented Windows Explorer, and users can expect changes for the better.

Aero Desktop:

Enhancements to Aero include features like Aero Peek, which allows users to make open windows transparent to see what’s underneath. Users will also find the new Aero Shake a welcome feature – users can simply “shake” the active window to minimize it, something that notebook users will grow to appreciate. Aero “Snaps” offer the opposite approach — users can simply “snap” a desktop item to expand it to the borders of the screen. There are many other enhancements that improve Aero’s look and feel, which should help to make Windows 7 easier to use.

Windows SideBar: Microsoft has changed the Windows Sidebar to a decoupled interface that allows users to place gadgets (sidebar applications). Users no longer need to dedicate desktop real estate to the sidebar, and thanks to Areo Peek, uses can now see active gadgets behind open windows.

Jump Lists:

Jump Lists are automatically populated lists that are created from the Start Menu. With Windows 7, Jump Lists can include task bar items as well as the most recently used applications. Users will be able to use Jump Lists to create quick and easy links to popular parts of an application. For example, by pointing the mouse at Internet Explorer, a jump list can pop up with common tasks like opening a tab or fetching bookmarks.

Windows Search:

Microsoft has added some much needed strength to the integrated search function of Windows. Users can search from the Start menu, from open windows and by right-clicking on the desktop. Searches are now much more extensive and can return results from libraries and external resources (SharePoint, Web sites, etc.). An enhanced search algorithm offers other improvements, such as highlighting related words, as well as incorporating dynamic filtering, and offers input recommendations for search terms.

Windows Touch:

Windows 7 adds enhanced support for touch screen technology and allows users to select icons and control applications with just a touch of the screen. Windows Touch adds multi-touch capabilities, allowing users to zoom in and out as well as perform other tasks by using multiple fingers.

Other Changes:

There are also many minor improvements, bug fixes and usability enhancements throughout the Windows 7 UI, all of which help to create a better user experience. Microsoft has also improved many bundled applications, thanks to the UI enhancements. Wordpad and Paint now incorporate the infamous Windows Ribbon interface and resemble Office 2007 applications. The Windows calculator features support for touch, has a new interface and handles date calculations. Sticky notes have been improved and can be resized and support virtual ink, as well as cut and paste. Windows accessibility benefits from an improved magnifier and better speech recognition. Some small but useful changes have been incorporated into Windows Explorer, most of which you will have to experience to appreciate.

Performance and Stability:

Performance has been one of the biggest complaints with Windows Vista, which came across as bloated and slow, suffering from long bootups and slow shutdowns, as well as slow program launches and the responsiveness (or lack of responsiveness) of the Start menu. Microsoft has put a great deal of effort into making sure Windows 7 performs acceptably, but Windows 7 is still a complex bit of code and no one should expect earth-shattering performance. However, the improvements are readily noticeable when compared to Windows Vista.

Ready Boost: Microsoft’s Ready Boost technology was introduced with Windows Vista as a method to cache applications and data into fast RAM, instead of relying on slow hard drives. With Windows 7, Ready Boost can be used with multiple memory devices concurrently. In other words, with Vista, Ready Boost could only use a single USB key drive to cache with; Windows 7 lifts that limit and allows users to plug in multiple key drives or other high-speed memory devices to crank up the boost.

Battery Performance:

Windows 7 offers more intelligence around powering peripherals and running applications, which helps to improve battery life. Windows 7 is able to shut down processes and suspend applications when the system is idle to conserve battery life. The OS also features adaptive display brightness, automatically dimming the screen during periods of inactivity. Windows 7 also powers down network ports, if no cables are plugged in, while a more efficient video decoder reduces the processing power needed when playing DVDs. New battery controls and tools give users the ability to fine-tune performance for extended battery life and prove to be more informative.

Security:

Windows Vista was often derided because of the poor implementation of security features. The reality was that Vista did improve security over Windows XP, but contrived enhancements left many unhappy. Users had to deal with cryptic messages, frequent pop-ups and several layers of security, which made security more of a hassle than it was worth. Even so, the core security functionality of Windows Vista proved to work quite well, meaning that most of the security fixes under Windows 7 were only minor changes. But those changes will make a big difference in the user experience.

AppLocker:

AppLocker is a new feature, which is used to restrict program execution based on firewall profiles. Users will appreciate the ability to “lock down” applications and can now set up portable systems that can be used both in a business environment and in a home environment. Applications that are deemed less secure can be disabled when a user is connected to a corporate network and re-enabled when on a home or public network. AppLocker also features in-depth application controls, which can be used to define polices to allow or prevent an application from launching. With Windows 7, Microsoft has reduced the number of applications that require administrator-level permissions to execute. Users will be less frequently prompted for permission to run system applications.

Action Center:

Windows 7 brings with it “Action Center,” which is a new management console designed to handle all alerts and warnings. Action Center keeps users informed of critical events, ranging from security problems to diagnostics to solutions. Action Center makes it much easier to deal with the numerous events, warnings and messages that Windows generates.

Windows Defender & Windows Firewall:

Windows Defender has a vastly improved interface, which is much easier to understand. What’s more, Windows Defender events are relayed to Action Center, which keeps users better informed. Windows Defender offers improved continuous monitoring, helping to better protect systems. Windows Firewall now supports more third-party security applications, which add extended features, such as customized firewall policies. Windows Firewall offers multi-profile capabilities, which are concurrently or separately activated based upon a user’s connection status or other defined policies.

Media Player 12:

Microsoft has added support for more media formats than ever before, including AAC audio and H.264, DivX and Xvid video. Users will no longer have to install third-party codecs to use those file formats. Media Player can be used to stream media to remote PCs or devices, which allows a Windows 7 system to function as a media server. Windows Live leverages that feature and users can now stream media to remote systems over the Web. The redesigned interface of Windows Media Player offers some much needed enhancements, including a nifty pop-up mini music player. Common tasks are now much easier to accomplish, especially functions like Play, Burn and Sync, thanks to a new set of tabs on the right hand side of the UI.

One of the most interesting additions is the new “play-to” feature, which has the ability to send music, video and photos to any compatible devices on the network, without the need to run proprietary software and without any additional setup. In other words, sending a song, video or photo to an Xbox or other compatible device just takes a mouse click and nothing more. All of these enhancements should make Media Player 12 a multimedia force to be reckoned with.

Windows Media Center: A new UI makes Media Center much easier to navigate and use. Media Center supports more devices and can be used with Windows Touch, allowing users to add touch screen TVs to the mix. Cable-TV users will welcome the addition of ClearQAM support, a technology that receives unencrypted digital TV over cable-TV lines. ClearQAM can eliminate the need for adding a cable company set-top box to receive digital cable TV feeds. Those looking for an improved TV experience on a PC will appreciate the improvements to the channel guide, which include faster updates and improved controls, making it easier to record programs. Other usability improvements include an on-screen keyboard, which eliminates the need for a wireless keyboard and brings more functionality to a media center remote control. TV viewing is enhanced with features like “commercial skip,” which allows viewers to skip ahead 30 seconds at a time. Those looking to build large libraries of recorded content will appreciate the new sorting features, which allow users to sort by title, date, length and so on, almost instantly.

Microsoft’s enhancements to Windows 7 multimedia capabilities could place the operating system back into competition with other PC-TV solutions and could eventually make a Windows 7 PC a fixture in the entertainment center. With both Media Player and Media Center, it appears that Microsoft closely listened to user gripes and has put much effort into getting those two feature sets right with Windows 7.

To Sum Up:

There are literally dozens, if not hundreds, of other improvements incorporated into Windows 7, so many that a very large book would be needed to explain them all. Other significant features, such as XP Mode, will prove themselves just as critical to Windows 7’s ultimate success. XP mode, which uses virtualization technology, is currently available as an add-on download.

One thing is certain: Windows 7 will prove to be much more than just a rehash of Windows Vista. It seems Microsoft has learned a lot from the failures of Vista and has created Windows 7 as a new operating system that looks to change people’s perceptions about Microsoft’s products.

My take? It has an ice cube’s chance in Hell of succeeding.

Seriously, creating a brand-new PC operating system is no small task. Even if Google bases Chrome OS on some existing technology — like the ever-adaptable Linux kernel — it still needs to address several very real hurdles before it can deliver anything even remotely competitive to Microsoft’s ubiquitous Windows.

For example, if the Chrome browser is truly the new OS’ only front end, then what about those applications and utilities that have no AJAX-based equivalents? I’m talking about the myriad legacy programs that expect to run atop a traditional OS, with a real windowing environment, file system, and process management/IPC mechanisms. Although the world has come a long way on the road to full “Webification,” there are still many miles to go before we get to a point where IT organizations can rip and replace their Windows-based fat client environments in favor of JavaScript, XML, and HTML 5.

Then there is the issue of peripheral plumbing. People want their PCs and devices to work together seamlessly. And that requires a vast ecosystem of third-party device drivers, as well as their supporting development partners. Getting the larger software and hardware developer communities to support your platform is a tall order — just ask Microsoft, a company that has spent the better part of three decades laying precisely such a hardware foundation so that Windows “just runs” on virtually any combination of PC hardware.

Basing Chrome OS on the Linux kernel would help to mitigate this last hurdle a bit. However, as the netbook remix fiasco has shown, customers have little tolerance for half-baked device support, even in a task-oriented OS running on a single function device. Linux is still years behind Windows in the seamless hardware compatibility department, so Google has some work ahead if it hopes to slap lipstick on the FOSS pig and call it user-friendly.

Of course, Google has likely thought through these issues already. The folks from Mountain View probably have some superduper master plan to deal with the seemingly insurmountable hurdles that lay before them. It’s just that, right now, I can’t figure out what that plan is. Barring a heavy dose of pixie dust, you simply can’t get there from here.

So I say, “Good luck, Google! You’ll need it!”

XHTML been an XML-based version of HTML and has been the subject of several W3C efforts ranging from XHTML 1.0 to XHTML Modularization and XHTML 2. The 2 version of the XHTML language was to offer capabilities for mobile systems and internationalization.

The XHTML 2 Working Group charter, scheduled to expire at the end of 2009, will not be renewed. By discontinuing the XHTML 2 working group and increasing resources in the HTML 5 Working Group, W3C hopes to accelerate progress of HTML 5 and clarify the organization’s position regarding the future HTML.

HTML 5, out in a draft form, focuses on Web application development and offers such capabilities as multimedia for browser-based applications, which could present strong competition to existing browser plug-in technologies such as Adobe Flash. “HTML 5 is the language of Web pages,” said Ian Jacobs, W3C representative.

XHTML was spawned in the late 1990s, when some thought XML represented the future of formats on the Web, said Jacobs. Meanwhile, others stuck by HTML and formed WHATWG (Web Hypertext Application Technology Working Group) outside of W3C to continue work on HTML. But work on the HTML 5 specification development now is taking place at W3C, with W3C and WHATWG working in parallel.

HTML and XHTML 2 working groups were formed by W3C in March 2007. “Basically, two years ago we chartered two working groups to work on similar things, and that created confusion in the marketplace,” said Jacobs.

Work on both XHTML 2 and HTML 5 proceeded as parallel efforts for Web development, but it has become clear to W3C that markets for XHTML 2 are so small compared to HTML 5, Jacobs said.

XHTML 2 will not become a W3C standard, Jacobs said. “We’re investing in HTML 5 for the future,” he said. Work stops on the XHTML language, but W3C still plans an XML formulation of HTML 5, to be done by the HTML working group.

A prominent AJAX and Web development proponent applauded the W3C decision.

“XHTML was a rat hole, and now we can use W3C folks to help make HTML 5 better,” said Dion Almaer, co-editor of the Ajaxian Web site who also has been serving as co-director of developer tools at Mozilla.

Meanwhile, WC3 hopes to go to a ‘last call’ phase with HTML 5 later this year, which would seek community confirmation of the work that has been done. Afterward, there would be a candidate recommendation phase and development of a test suite.

“What the [HTML] group has said is they expect the process of getting implementations [of the specification] to work together is going to be a long process,” Jacobs said.

Maintenance work will continue to be done on XHTML 1.1, to fix bugs.

Van Baker of Gartner thinks Apple has to step it up to stay in the game. “Windows 7 is an enormous improvement over Vista,” Baker said, “and it will steal the limelight if Apple doesn’t have anything that one ups it.” While he’s not sure if Apple has a “just one more thing” surprise planned for Snow Leopard, he thinks that it needs one to match the behind-the-scenes improvement the company has made in such areas as multi-core support and offloading tasks to the graphics processor.

Ezra Gottheil of Technology Business Research on the other hand, conceded the win to Windows 7. “I’m not sure that Apple can do very much, there’s not any miracles they can pull off in the interface. So I think they’ll have to let Microsoft have the limelight this time.”

Talk about a turnaround. It’s always hard to recognize the larger, slow-moving paradigm shifts as they happen. But after a decade of bad press regarding its commitment to software security, Microsoft seems to have turned the tide. Redmond is getting consistent security accolades these days, often from the very critics who used to call it out. Many of the world’s most knowledgeable security experts are urging their favorite software vendors to follow in the footsteps of Microsoft.

Haters will always continue hating, but the technical press is giving a lot of favorable coverage to Microsoft’s successful efforts to make itself a computer software security leader. Here are some recent examples:

“Microsoft for a long time rightly got a bad reputation for insecure products. However, as an industry we should recognize the sea change in Microsoft’s approach to security, of which this [Microsoft's plans to share its Security Development Lifecycle process components] is just one example, and encourage other vendors to follow Microsoft’s lead.” — SANS NewsBites

“Microsoft becomes high priest of secure software development.” — CNET

“When I first started writing about information security five years ago, all a writer had to do was mention Microsoft in the same headline space as ‘security vulnerability’ to strike page-view gold. In 2004 Microsoft was a couple years into its Trustworthy Computing Initiative but it remained the software company IT security practitioners hated with glee…. That’s not so much the case today.” — Computerworld

“‘This [Windows 7 new memory protection] is smart,’ said Charlie Miller, who as principal analyst at Independent Security Evaluators has successfully exploited weaknesses in Windows, OS X, and Linux. ‘I think they’re [Microsoft] trying to stay ahead of the curve.’” — The Register

“Johannes Ullrich, CTO of the SANS Institute, who teaches secure coding classes to developers… likened memcpy() to other risky functions such as strcpy() and strcat(), which Microsoft has already banned after exacting untold misery over the years. [He] also wondered aloud when ‘Larry, Steve, and Linus’ plan to issue similar security edicts in their products. It’s a question worth asking.” — The Register

“As repugnant as it sounds, Apple will need to take a page from Microsoft’s book in this area. Years of combating viral threats, malware, and so on (partially through their greater exposure and partially, it must be admitted, through bad programming) have resulted in a well-oiled machine which responds quickly and decisively to the threats.” — CrunchGear

What’s in it for you
It isn’t just press talk alone. Every common security and vulnerability metric shows Microsoft’s software security has dramatically improved over the years, especially compared to its main competitors. Vulnerabilities found by employees and external researchers are down well over half from just a few years ago. For some products, such as IIS and SQL Server, the improvement is startling, going from dozens of exploits a year to barely a handful over five years.

Hackers have moved on from focusing on Windows holes to attacking third-party applications or social engineering the end-user as the primary attack vector. Patch Tuesday was derided when it first appeared. Now it has become a model for many other popularly attacked products, and vendors not using a regularly scheduled patch period are being asked to get on board by their customers.

Sure, Microsoft still has its share of critics, and it has a long way to go before it is done, but it’s hard to argue that the company has not made significant progress. Although there are many factors to its success, including better patching, host-based firewalls, and increased responsible disclosure, the lion’s share of the success belongs to its dedication to Security Development Lifecycle (SDL) processes.

Microsoft is being touted more and more frequently, even by people who otherwise would claim to hate Microsoft, as a programming security model to follow. All that positive energy is ending up in the press and is not lost on potential customers.

By now you might be wondering if there is a point to this column, besides delivering kudos to Microsoft. Well, yes. First, the success of SDL can no longer be ignored. SDL is responsible for Microsoft’s transition from being the butt of security jokes to being touted as a security leader. That shift is huge, and it’s worth billions of measurable dollars. Second, it took serious commitment from the CEO on down. Without long-term executive commitment, the chance for success is diminished.

Third, even with top-level commitment from all the senior executives, retraining of staff, and a dedicated corporate focus, it took about five years to turn the ship. It may have taken only a few weeks of education to turn all the programmers into secure programmers, but it took much longer to change the company culture. It took year after year of examining the weak links, providing new tools and solutions, and changing ingrained policies and processes. It took, and continues to take, heated debates on internal discussion lists, where everyone is encouraged to share their feelings about a particular decision.

But the best part is that most of the tools and thousands of pages of information that Microsoft used to turn itself around are freely available to anyone. They can be used by you and your company to create more secure software. You don’t have to reinvent the wheel or discover the secrets of secure coding on your own. Microsoft is pretty far along in the maturity of their SDL model, and you can benefit from the policies, standards, and procedures it has developed. Instead of guarding this know-how as a secret competitive selling point, Microsoft is inviting everyone to participate. After all, a stronger, more secure computing ecosystem benefits everyone.

If your company could benefit from SDL, start with the Microsoft SDL Training and Resources page and Michael Howard’s Web Log on MSDN. I challenge you to find anywhere near the amount of free resources on improving your software security from any other source.

Cute commercials at the expense of a competitor are one thing. Trying to improve security for everyone is another.

Fortunately, there’s a lot of motion at the federal level, including both houses of Congress and the FCC, to do something about the sad state of competition in the wireless world.

A hearing by the antitrust subcommittee of the Senate Judiciary Committee next week will focus on text messaging rates and broader competitive issues. Given the workload of a committee occupied with hearings on a Supreme Court nominee, that’s a signal of significant interest in those issues, says Chris Riley, policy council for Free Press, a nonpartisan public interest group working to reform the media.

I’ve beat on this before, and some have said, “No one has a right to an iPhone. If you don’t like it don’t buy it.” Fair enough. Or is it? “No has the right to an iPhone,” agrees Riley. “But this is about the right to consumer choice. Exclusive deals are impediments to innovation and competition.”

Exactly. Just as the old AT&T stifled landline innovation in the 20th century, the new AT&T is stifling wireless innovation in the 21st.

High Price for Tethering? At Tuesday’s launch of the new iPhone at the World Wide Developers Conference, AT&T was very conspicuous in its absence from the list of providers who will support tethering and MMS. Not surprisingly, the audience noticed it immediately and their jeers were quickly echoed around the Web in blogs and news stories. By Wednesday, AT&T was backpedaling furiously, saying it will offer both services — later in the year.

I don’t like to be overly suspicious or conspiratorial, but something nasty is going on. As Apple’s exclusive U.S. partner, Ma Bell has plenty of insight into upcoming iPhone features and revenue opportunities. Yet AT&T said nothing about two widely anticipated features until the next day. The company couldn’t have been surprised or suddenly discovered the billing and network issues it cited as reasons for the delay.

What’s next? My best guess is that we’ll see horrendous pricing surcharges for tethering and MMS, on top of the already expensive data and voice charges iPhone users pay. I don’t think AT&T execs wanted to stand up at WWDC and announce that. They’ll wait in hopes that the bad news will garner less publicity in the late summer when so many news sources are on vacation and users are thinking more about the beach than about technology.

Tethering, of course, allows a user’s PC to access the Internet via the connectivity of the iPhone or other cellular device. It’s a tremendously useful application, and AT&T, which has boasted about multi-billion-dollar plans to upgrade its network, would be crazy to miss the revenue opportunity. Incompetent, greedy, and obnoxious, maybe. But crazy? Definitely not. That’s why I’m worried about a huge price tag.

I doubt it will take long for smart develoeprs to “jailbreak” the iPhone — create unsanctioned hacks that break Apple’s and AT&T’s restrictions — to find ways to tether your iPhone without the blessing of AT&T. As many of you know, jailbreaking an iPhone is not a big deal — and once you do, you’re free to tether away. Mario Ciabarra, who runs Rock Your Phone, says, “We are expecting to release a very simple-to-use tethering app for users left behind from Apple’s 3.0 release shortly after 3.0 is made available.” And I’m sure other unofficial apps stores will follow suit.

That’s all good, but users shouldn’t have to play games with their carrier or hack their products to do what they’re designed to do. And innovation shouldn’t be stifled by quasi-monopolies like AT&T. One step you can take: Write to Rep. Henry Waxman of California, who chairs the House Commerce Committee (which is about to hold hearings on the matter) and Sen. Herb Kohl of Wisconsin, who chairs the Senate subcommittee on Antitrust, Competition Policy, and Consumer Rights. And let the FCC, which is preparing its annual report on the wireless industry, know how you feel.

AT&T has had a lot of time to get its act together. It needs to be pushed — hard.