Med students' tweets, posts expose patient info

Future doctors are too frequently putting inappropriate postings and sometimes confidential patient information on social sites like Facebook and Twitter, according to a study published in the Journal of the American Medical Association. Thirteen percent reported that students had violated patient confidentiality in postings on social networking sites. The study shows that in a survey of medical colleges, 60% reported incidents of medical students' posting unprofessional content online.

The survey also showed that 39% of colleges found medical students posting pictures of themselves being intoxicated, and 38% reported medical students posting sexually suggestive material. Of the schools that reported finding inappropriate student content only, 67% said they gave informal warnings and 7% said they expelled the student. The study, published this week, surveyed deans or their counterparts at 78 U.S. medical colleges. People are frequently warned that photos and posts, and even comments from friends and family - on sites like Facebook, MySpace and Twitter could come back to haunt them. Dan Olds, an analyst with The Gabriel Consulting Group, said people who post inappropriate material, such as pictures of themselves drunk, has long been a downside of social networking.

Companies report that they check social networking sites before hiring a prospective employee, and an off-hand comment about a work project or annoying colleague can easily come back to bite someone in the office. However, when health care workers are involved in such activity, it takes on a new dimension. "Doctors are in a bit of a unique position in society - almost universally trusted by patients to hold some of their most personal information confidential," Olds said. "This relationship needs to exist, because if patients hold back information from their doctor, it can have a serious impact on their lives. And it's hard to believe that medical students, folks who are highly educated, are so stupid as to not see the downside of these social networking activities." He added that aside from posting patient information online, it's also a bad idea for medical students to post pictures of the drunken party they were at the night before or information about their latest tryst. "Even though this was probably done innocently and with no bad intent, the potential for damage to patients is large," Olds said. "Seeing their doctors partying and drunk is not the way to engender trust, particularly if you're the person who has an appointment with that doctor the next day." If patients believe their doctors are unintentionally, or, worse yet, intentionally, revealing confidential information, then that trust will be irreparable damaged.

Ellison: Fusion Applications in 2010

Oracle plans to launch its long-awaited Fusion Applications in 2010, and they will be deployable both on-premises and as SaaS (software as a service), CEO Larry Ellison said Wednesday during a keynote address at the OpenWorld conference in San Francisco. Oracle has placed special emphasis on improving the user experience with Fusion, as well as embedded BI (business intelligence) throughout the applications, Ellison said. Fusion Applications, which Oracle first announced several years ago, will combine the best elements of Oracle's various business software product lines into a next-generation suite.

Ellison's keynote contained the most specific information the company has provided about Fusion Applications since first announcing the project several years ago. We're absolutely committed to do that," he said to applause. "We can afford to not only maintain the software you're running today, but also build the software you may want to move to tomorrow." Ellison did not provide details regarding licensing and pricing models, including whether Oracle will sell the new applications via subscription, as is the norm with SaaS. But Oracle is nonetheless ensuring the products are ready for SaaS, including by developing monitoring tools that will track their performance, Ellison said. The CEO took pains to tell the packed room of Siebel, JD Edwards and E-Business Suite users that Oracle has no plans to abandon the product lines anytime soon. "Oracle will continue to enhance those applications for the next decade and beyond. While SaaS vendors provide users with service-level agreement guarantees, "there aren't very good tools for figuring out whether you're actually getting the service levels you're paying for," he said. This gives Oracle "a huge advantage" because the SOA model will allow users easily to tie together "the Fusion generation and all the stuff you have deployed today," Ellison said. "We don't think all customers are going to replace what they have today with Fusion," he added. "We think they will augment what they have with some Fusion. Oracle's tools will enable it to "not only contractually commit but prove we're delivering the service levels." Fusion Applications are based on a SOA (service oriented architecture) provided by Oracle's Fusion Middleware stack, Ellison said.

Fusion is designed to be delivered that way. ... We have replacement applications and then we have net-new applications." The initial suite will include modules for financial management, human capital management, sales and marketing, supply chain management, project management, procurement management and GRC (governance, risk and compliance), but other key areas, such as manufacturing, will come later. Oracle has worked "very, very closely" with customers to design and test Fusion Applications, work that has resulted in a superior user interface, Ellison said. Ellison stressed the benefits of the modular approach. "You assemble the components in the order you want to use them, in the order that makes sense for your industry," he said. Embedded BI is another major focus of the suite. "You can't use the system without using business intelligence," Ellison said. The application allowed the user to bring up a dashboard showing which order manager was responsible for the particular transaction, and then begin an instant-messaging conversation with him directly from the tool. In a demonstration, a pair of Oracle executives showed how the system alerted one user that a particular shipment had been delayed.

In turn, the order manager was able to search for less critical orders and reroute them to fulfill the first one. "We tell you what you need to know, what you need to do, and we tell you how to do it," Ellison said. While Oracle "definitely has the capability to deliver this as SaaS, it's really up to them to figure out if they want to enter [that market] large-scale," Wang added. Ellison's presentation proved that "Fusion apps are real," said Ray Wang, a partner with the analyst firm Altimeter Group. In some product areas, such as talent management, "they can't compete without the SaaS option," he said. In a presentation Tuesday, on-demand CRM (customer relationship management) vendor and Oracle rival Salesforce.com compared multitenancy to an office building, where individual tenants share the overall infrastructure but customize their office spaces.

SaaS applications are different from straight application hosting, because they use a "multitenant" architecture wherein customers share a single instance of an application but their data is kept private from other customers. Oracle "will definitely" offer a hosted version of Fusion Applications, although it remains to be seen exactly how their SaaS strategy for the software plays out, Wang said. They're playing catch-up." Meanwhile, the work ahead of companies looking to adopt Fusion Applications sooner rather than later is "not trivial," said Floyd Teter, head of the Oracle Applications Users Group's Fusion Council, which has been educating group members about the upcoming applications release. When Fusion Applications arrive, they will also raise the competitive stakes between Oracle and its main rival, SAP. But SAP spokesman Saswato Das dismissed Oracle's announcement. "Basically, our Business Suite 7 is the most comprehensive and flexible suite of applications on the market," Das said. "Oracle has been talking about Fusion for a long time, and our suite is available now. One key step customers should take is to catalogue their application customizations and determine which ones could be retired, Teter said. "A lot of us have done a lot of custom things. The skill set now is more Java and specifically [Java Enterprise Edition]. You also better have some knowledge of JavaScript." In addition, Fusion Applications rely on Oracle's JDeveloper IDE (integrated development environment), rather than other Java development tools like Eclipse.

If you're a long-term Oracle customer, it's easy to lose track." Fusion Applications will also require some companies to acquire new development skills, Teter said. "A lot of us run a lot of customizations through MOD PL_SQL. That's going to be gone. For many companies, there will be plenty of time to plan, since the first version of Fusion Applications won't include certain functional areas. In the meantime, we'll continue to stay current on EBS." But Teter said the vendor's work on Fusion has produced impressive results, particularly in regards to user experience. The lack of manufacturing has prompted the Jet Propulsion Laboratory at the California Institute of Technology, which uses E-Business Suite, to wait for a future version, said Teter, who is a project manager at the lab. "When I get a full-functionality replacement, we'll look at it. Earlier in his keynote, Ellison turned to Oracle's recently announced Exadata 2 appliance for data warehousing and transaction processing. Exadata 2 uses Sun hardware, while the original machine, announced at last year's OpenWorld show, used Hewlett-Packard iron.

He claimed the machine widely outperforms and is much less expensive than competing technologies, such as from IBM, calling it "the fastest computer that has ever been built to run data warehousing applications." "This system will outperform any of the competition," he said. Oracle is in the process of buying Sun Microsystems but the deal is on hold while European officials conduct an antitrust review. Ellison temporarily ceded the stage to California Gov. Ellison didn't discuss the acquisition during his keynote, but Sun and its officials have played an active role in this year's OpenWorld conference. Arnold Schwarzenegger, who delivered a joke-peppered talk espousing the value of technology, from biotech to the Hollywood special effects that powered his long career as an action star. "Think of Conan the Barbarian fighting the giant snake," he said, referring to his role in the 1982 film based on Robert E. Howard's tales of a legendary warrior king. "I never could have done that and look so studly without technology," he said to an eruption of laughter from the crowd.

Schwarzenegger also congratulated Ellison and Sun chairman Scott McNealy on the pending acquisition, stressing the companies' importance to California's economy. "Working together, I know the sky is the limit for you and your employees," he said.

Amazon takes Kindle global, lowers price

Amazon plans to start selling its Kindle reader in over 100 countries and territories on Oct. 19, and the company has already started booking pre-orders for the device on its web site. The Kindle was earlier only available in the U.S. Amazon has been working with publishers for many months to build a vast selection of English language books available around the world, said Stephanie Mantello Ward, a spokeswoman for Amazon, in an e-mail on Wednesday. Amazon is selling the Kindle with U.S. & International Wireless to customers in Asia, Africa, Europe, Australia and South America, for US$279 for a reader with a 6-inch display and the ability to wirelessly download books and other content globally, the company said on Wednesday. Amazon also has some books in languages other than English, but its focus right now is to provide its customers with the best possible experience for English-language content, she added.

She did not give a reason why China was not included in the current launch. The Kindle will not be sold in China because Amazon is unable to ship the Kindle or offer Kindle content to Chinese customers, the company said. "We want to ship Kindle everywhere, and we're working on it," Ward said. Best-seller books will cost $11.99 or more for international customers, with about 100,000 other titles available for less than $5.99, Amazon said. Amazon also said that it is lowering the price of the 6-inch display Kindle in the U.S. from $299 to $259. The Kindle DX, which has a 9.7-inch display, retails for $489. The Kindle with U.S. & International Wireless is 0.36 inches thick and weighs just over 10 ounces, Amazon said. These prices are higher than in the U.S. where most best sellers cost $9.99. As Amazon is selling from the U.S. store, the prices of the books in international markets are denominated in U.S. dollars rather than local currencies. "We aren't announcing a timeline today for payments in other currencies," Ward said. Its 2GB of memory holds up to 1,500 books.

Customers who buy a Kindle in a country without Whispernet coverage will be able to purchase content from the Kindle Store through a PC and download it to their Kindle through a USB (universal serial bus) cable, Ward said. The device features an experimental text-to-speech feature, Amazon added. Whispernet is a wireless delivery system for the Kindle that allows a user to download books and other Kindle content. AT&T will be offering the service to international users of the Kindle.

Flash flaw puts most sites, users at risk, say researchers

Hackers can exploit a flaw in Adobe's Flash to compromise nearly every Web site that allows users to upload content, including Google's Gmail, then launch silent attacks on visitors to those sites, security researchers said today. "The magnitude of this is huge," said Mike Murray, the chief information security officer at Orlando, Fla.-based Foreground Security. "Any site that allows user-uploadable content is vulnerable, and most are not configured to prevent this." The problem lies in the Flash ActionScript same-origin policy, which is designed to limit a Flash object's access to other content only from the domain it originated from, added Mike Bailey, a senior security researcher at Foreground. How many of those sites serve files back to users from the same domain as the rest of the application? Unfortunately, said Bailey, if an attacker can deposit a malicious Flash object on a Web site - through its user-generated content capabilities, which typically allow people to upload files to the site or service - they can execute malicious scripts in the context of that domain. "This is a frighteningly bad thing," Bailey said. "How many Web sites allow users to upload files of some sort?

Nearly every one of them is vulnerable." Bailey, who demonstrated how attackers could compromise a Web site and attack users in a post today on Foreground's blog , outlined how a hacker would leverage the Flash flaw. "It's relatively simple," he maintained. "All they need to do is create a malicious Flash object, and upload it to the [Web] server." He used the example of a company that lets users upload content to a message forum to explain the process. "If the user forum lets people upload an image for their avatar, someone could upload a malicious Flash file that looks like an avatar image," Bailey said. "Anyone who then views that avatar would be vulnerable to attack." Adobe has told Foreground that the flaw is "unpatchable," Murray and Bailey said. But they've not had much success. "Some of the big Web properties have figured this out," said Bailey. "In a lot of cases, they're hosting user-generated content on another domain, perhaps for performance reasons." Among those site and services that have locked down their servers, Foreground cited Microsoft's Windows Live Hotmail and Google's YouTube. "But very few system administrators are even aware of this," Bailey added. Instead, Adobe is trying to educate site administrators to close the hole on their end. Even some of Adobe's Web properties are vulnerable to such an attack. "How can Adobe expect others to protect themselves when they can't do it themselves?" asked Murray. The only current defense users can employ against such attacks is to stop using Flash, or failing that, restrict its use to sites known to be safe with tools such as the NoScript add-on for Mozilla's Firefox, or ToggleFlash for Microsoft's Internet Explorer. "The best mitigation is to not use Flash," argued Murray, "but we know that that's impossible for most users, since Flash is so widely used on the Web." "Almost everyone using the Internet is vulnerable to a Web site that allows content to be updated inappropriately," said Murray. "That's not hyperbole, it's just fact.

Google's Gmail is also at risk from malicious Flash attack - Gmail lets users upload and download file attachments - although Bailey said that exploiting Google's Web mail service would be "extremely tricky" with "lots of hoops to jump through." Although Foreground has not detected any in-the-wild attacks using the technique, Murray said that there's evidence hackers are moving toward such tactics. "We're starting to see Flash used in these ways," he said, and cited a recent worm that leveraged a similar vulnerability in Adobe's software, which is pervasive on the Web and on users' machines. "The worst-case scenario is that someone would figure this out, and launch silent attacks against the entire Internet." That fear was a major consideration in Foreground's decision to go public with its information, even though Adobe can't fix the problem with a global patch of some sort. "We went back and forth on this a whole lot," said Murray. This has the potential to affect any social media site, any career site, any dating site, many retail sites and many cloud applications. End users would never know they got exploited." Adobe was not immediately available for comment. That's why this attack is so serious.

Mozilla augments Firefox's plug-in check

As it promised, Mozilla has created a page that checks for outdated plug-ins used by Firefox. Links to the plug-in download pages are also available so that users can obtain the most current versions of software from the likes of Adobe, Microsoft , Sun and Apple . A month ago, Mozilla debuted its plug-in checking with updates to Firefox 3.5.3 and Firefox 3.0.14, which automatically detected outdated versions of Adobe's Flash Player and prompted users to upgrade to the newest - and theoretically the most secure - edition of the browser plug-in. Mozilla is testing the page , which pings the company servers, then returns a list of plug-ins, noting those that are up-to-date and ones that should be updated.

At the time, Mozilla said it would follow that initial move with others, including the publishing of a page that Firefox users could visit to check the status of other vendors' plug-ins. According to Blair McBride, the Mozilla developer who announced the test plug-in check page on his blog today, Mozilla will add a built-in plug-in checking feature to Firefox 3.6, which is slated for release before the end of the year. "Firefox 3.6 will have this integrated to make sure users know when they have an outdated plug-in, without having to manually visit the Plugin Check page," said McBride. "Whenever you load a page that uses a plug-in that is out of date, you'll get [a] warning." The warning will read: "Some plugins used by this page are out of date." A button will be available to update the plug-in. Two weeks after introducing the plug-in check, Mozilla said it had convinced 10 million Firefox users to go to Adobe's site and grab the latest version of Flash. Firefox 3.6 will also sport changes to the browser's add-on too. "The Plugins tab of the Extension Manager (Tools/Add-ons) will indicate which of your plugins are out of date," promised McBride. Security experts have commended Mozilla on the moves.

The changes are to appear in the first, and likely only, beta of Firefox 3.6; that preview is slated to ship next week under Mozilla's published schedule. Last month, Wolfgang Kandek, the chief technology officer at security firm Qualys, called it "a great way to improve the security of Web browsers," as he noted that vulnerabilities in Adobe's Flash are frequently targeted by hackers. Earlier Tuesday, Mac users running Snow Leopard were told that QuickTime was out of date, even though they had installed Mac OS X 10.6.1, Apple's sole security update so far for the new OS. The problem, according to a post on Bugzilla , Mozilla's bug- and change-tracking database, was that Snow Leopard dubbed its version of QuickTime as 7.6.3, while its predecessor Leopard tagged it as 7.6.4. Later Tuesday, Mozilla had implemented a fix to the plug-in checking page to accurately report QuickTime 7.6.3 as the most up-to-date edition for Snow Leopard users. Mozilla has already caught one bug in the plug-in test page.

Microsoft greasing Windows 7 skids with early release of desktop tools

With the hope of sparking Windows 7 upgrades, Microsoft is planning an early release of its suite of desktop deployment tools.  The tools were originally slated to ship in early 2010, but Microsoft hopes to give customers the software in late October for use in rollouts of Windows 7 across corporate desktops. The news of the early release was announced by Ran Oelgiesser, senior product manager for MED-V, on the MDOP blog. The catch is that the Microsoft Desktop Optimization Pack (MDOP) R2 2009 is only available to volume licensing customers with Software Assurance contracts.

Slideshow: Snow Leopard vs. All the tools in MDOP R2 2009 will include support for Windows 7 except MED-V. Support for the new OS in MED-V 1.0 SP1 will come early in 2010, wrote Oelgiesser. Windows 7 Windows 7 is slated to ship to commercial customers on Oct. 22, but corporate users with volume licensing contracts have had access to Windows 7 since last month. MED-V runs multiple versions of Windows or applications concurrently without having to open multiple virtual machine sessions. The suite is a major part of Microsoft 's Optimized Desktop strategy, which addresses centralized management and deployment of physical and virtual resources. The software complements another MDOP tool called App-V, which is used for managing and deploying virtual PCs. The MDOP lineup also includes Asset Inventory Service; System Center Desktop Error Monitoring; Advanced Group Policy Management (AGPM) for change management via group policy objects; and the Diagnostics and Recovery Toolset, which helps in recovering a crashed PC. MDOP is composed of software from Microsoft's purchases of Softricity, Kidaro, AssetMetrix, Winternals Software and DesktopStandard.

According to Oelgiesser, App-V 4.5 SP1 will have various integration points with 32-bit versions of Windows 7, including with the AppLocker, Branch Cache and BitLocker ToGo features. The 64-bit version, App-V 4.6 will be available in the first half of 2010. Advanced Group Policy Management 4.0 features two new capabilities targeted at Windows 7. One allows users to manage group policies across different domains, and the other provides new search and filtering to ease tracking of group policy objects. In addition, the software will support 32-bit version of XP, Vista and Windows Server. Follow John Fontana on Twitter 

US company burned by China Web filter plans rival product

A U.S. company whose software code was allegedly stolen in China by a controversial, government-backed Internet filtering program will hit back by launching a rival product for a low price in China, the company said late Sunday. The Solid Oak program, called CyberSitter and targeted at parents, will be offered in languages including Chinese in a version due out next month. Solid Oak Software, which has said its code was copied in a program that China ordered be bundled with all new PCs, is exploring ways to offer its own Web filter for free or at a very low price in China, company President Brian Milburn, said in an e-mail.

A Chinese version of the product would compete with Green Dam Youth Escort, the program that Solid Oak says copied its code and that China originally ordered PC makers to include with all new computers sold in the country from July this year. But under heavy pressure from foreign PC makers and the U.S. government, China indefinitely postponed the mandate just hours before it was set to take effect. The Chinese government had paid the program's developers to allow all PC buyers to use the software for free for one year. Major PC makers including Lenovo and Acer began bundling Green Dam with new PCs until this month. The program also used blacklists apparently lifted from Solid Oak's software, according to the company and a group of U.S. researchers.

The program, which China said was meant to protect children from online pornography, was also found to block politically sensitive material such as negative references to a former Chinese president. One file found in the Chinese program contained an encrypted version of a years-old Solid Oak news bulletin, according to the researchers. Green Dam came under fire for concerns about system stability in addition to user privacy and freedom of speech. Solid Oak, which is based in Santa Barbara, California, is preparing legal action against PC makers that shipped Green Dam, though an update to the program in June removed some of the allegedly infringing elements. One Beijing high school recently removed the program from its computers after finding that it conflicted with software used for grading and attendance tracking.

Bryan Zhang, general manager of Jinhui Computer System Engineering, one of the designers of the Chinese software, declined to comment on the allegations of code theft. Green Dam "is a conglomeration of whatever components [the developers] managed to steal ... or otherwise appropriate from various sources, and duct tape together in the form of an alleged piece of software," Milburn wrote in his e-mail. "They should be utterly humiliated, not just because they stole much of the core functionality, but even more so because they intentionally inflicted such a miserable product on a population of innocent computer users," Milburn wrote. The new Solid Oak product will have a Chinese user interface available and a filtering function that the company reworked after much of its old proprietary code appeared online. That is the ultimate goal," company spokeswoman Jenna DiPasquale said in an e-mail. The filtering will be entirely URL-based, avoiding the need to translate keywords into Chinese. "We are working on a way to release it for free.