"For years consumers have wanted to build their own mobile computing platforms, but the product offerings and market simply did not serve them as they did in the desktop do it yourself segment," said OCZ Systems Solutions Product Manager Eugene Chang back in May. "With the OCZ Do-It-Yourself Notebook initiative, OCZ empowers with the resources like validated component guides, documentation, tech support, and a warranty to allow consumers to configure and build a true gaming notebook with the exact specification that matches their unique requirements."

Buy.com now has the OCZ Barebone Gaming Notebook (OCZNBIAS15DIYA) in stock for $719.99 with free shipping. Buyers can send off for a manufacturer's mail-in rebate to drop that price to $669.99.

That price will get you the actual 15.4" notebook, requisite Intel PM965 chipset, 512MB NVIDIA GeForce 8600M GT mobile GPU, 8x DVD burner, and 9-cell battery. The processor, memory, HDD, WiFi/Bluetooth adapters, and operating system must be provided by the buyers which would easily push the price close to, or over the $1,000 mark.

It's nice to see that OCZ is giving buyers a choice with a system that they can configure and put together themselves, but many may wonder what if any cost savings can be realized by going this route considering the steady drop in pricing for notebook computers.

http://www.dailytech.com/OCZ+Barebone+Gaming+Notebook+Shows+up+Online/article12012.htm

It’s no small mystery that AMD these days simply seems incapable of outcompeting Intel.  Intel argues that this is due to its superior products.  AMD, however, has long maintained that Intel was deploying anticompetitive processes, which it says are digging it into a hole from which it cannot escape.  However, despite a passionate ad campaign and lengthy discussions with antitrust officials in the U.S., AMD has seemingly had a tough time selling its idea that Intel was cheating in the microprocessor war.

The U.S. Federal Trade Commission (FTC), which supervises free trade in the U.S., announced that it was launching a formal antitrust investigation against Intel.  The stakes are high for both Intel and AMD; the total market for microprocessors racked up $225 billion in sales last year. 

Both Intel and AMD realize what’s at stake and have spent tens of millions in legal expenses and on public relations campaigns.  AMD had previous success in Europe, Korea, and Japan -- all of which have investigated Intel or threatened it with possible fines.  However, the biggest victory -- a U.S. antitrust investigation -- seemed out of reach until this week.

State authorities and federal appointees from the Bush administration have been taking a more lenient approach to antitrust that their European counterparts.  However, the major decision Friday marked a sharp new shift in policy. 

The new investigation originated with the new blood -- William E. Kovacic, the new chairman of the trade commission.  With the backing of his fellow commissioners, he reversed the decision of Deborah P. Majoras, the previous chair, who had been blocking the investigation for months to the frustration of those on Capitol Hill.  Majoras was a more lenient appointee, and helped work out the antitrust settlement in 2001 with Microsoft.

It will take months before formal charges against Intel might be made, so the upcoming administration’s stance will greatly factor into the case.  AMD is relying on the federal case as only one state -- New York, at the behest of attorney general Andrew M. Cuomo -- has agreed to investigate Intel on a state level.  California attorney general Jerry Brown denied AMD's pleas, derisively commenting that he was "not barking at every truck that comes down the street."

D. Bruce Sewell, Intel’s senior vice president and general counsel, says that the U.S. antitrust laws are different than European ones, and it will not be charged.  Intel is planning on racking up its Capitol Hill efforts, though, likely in the form of lobbyist dollars.

The first signs of the upcoming bad news for Intel appeared when chip manufacturers began to get subpoenaed by the FTC.  The FTC is working with Europe and other foreign governments to obtain evidence to use against Intel in a possible case.  Mr. Sewell said that he was working amiably with the FTC on a less formal review since 2006 and that Intel would remain cooperative.

AMD's top executives expressed their pleasure over the Commission's decision.  Tom McCoy, executive vice president for legal affairs at AMD, stated, "Intel must now answer to the Federal Trade Commission, which is the appropriate way to determine the impact of Intel practices on U.S. consumers and technology businesses.  In every country around the world where Intel’s business practices have been investigated, including the decision by South Korea this week, antitrust regulators have taken action."

The largest U.S. antitrust investigation since the Microsoft one of the 90s came the same week as more good news for AMD; Korean officials slammed Intel with a $25 million fine for violating its fair trade laws.  The Korean officials discovered that Intel illegally paid Samsung Electronics and the Trigem Company $37 million in payments between 2002 and 2005 to not buy AMD processors.  The European Union's European Commission (EC), which charged Intel with "the aim of excluding its main rival from the market" is expected to expand its charges this year.

Intel currently owns somewhere between 80 to 90 percent of the worldwide microprocessor market.  Many U.S. citizens do not realize that U.S. laws do allow monopolies, unlike elsewhere, but forbid companies with a monopoly from using its dominance to restrict competition.

With mounting evidence worldwide, Intel faces a tough case before the FTC.  However, it will likely do what it takes, or perhaps more aptly write the lobbyist checks needed to prevent it from becoming the next Microsoft.  Meanwhile, AMD will also likely step up its efforts in hopes that it can stop its downhill slide by a court victory over Intel.

http://www.dailytech.com/Just+What+It+Was+Dreading++Intel+Monopoly+Rocked+By+Official+FTC+Investigation/article12011.htm

For all the criticism of Microsoft and its security flaws, the software giant has made an impressive turnaround.  While Vista has been derided for a variety of reasons, most would agree that it’s much more secure than Windows XP.  Recently, a hacker conference showed just how vulnerable systems running Mac OS X are, due to their slow rate of patches.  The Mac machine was hijacked within 10 minutes, while the Linux and Windows boxes survived the day.

Now an even worse security flaw has been found in some of the basic code used by a wide variety of Linux security programs.  The error originated back in May 2006 when workers on the open-source security project committed a grave and unrealized error. 

A simple programming error reduced the entropy in the generated program keys created by the OpenSSL library.  Why does this matter?  The OpenSSL library's key generation and other routines are used by the SSH remote access program, the IPsec Virtual Private Network (VPN), the Apache Web server, secure email clients, programs that offer secure internet portals and more.

Just two lines of code created crippling security holes in four different open source operating systems, 25 application programs, and millions of internet-attached computer systems.  The vulnerability was publicly discovered for the first time May 13, after having left the door open nearly two years.  A patch has been distributed, but that can do nothing to repair the damage that has occurred to compromise systems.  Worse yet, it appears that through the installation of compromised keys on other systems, numerous systems not even running the code have likely been compromised.

To understand the error fully, a basic discussion on cryptography is essential.  On a network anyone can peek at traffic, which is bad news for anyone sharing personal information.  However, by using keys, information can be encrypted and then decrypted on the other side by a friendly computer with the proper key.  As a "secure key" is typically 128 bits, which is 2¹²⁸ or about 3.4*10³⁸, the possibility of breaking the key by merely by a brute force attack is out of the realm of modern computing power.  A brute force attack simply involves guessing every single number, but to try to do this on a number of this size would take many years.

However, the system falls apart if the computer can only make a small set of keys, despite the large key size.  To a normal user the key looks fine, it’s the right size, and the data is being encrypted as it’s sent out.  However, to the malicious user they can now use brute force attacks to guess the key and monitor your activity, opening the door to surveillance and exploitation.  This is exactly what has resulted based on the newly discovered error.

The error reduced the number of keys that Linux can generate from 2¹²⁸ to approximately 2¹⁵.  The error was not caught until now because the keys were still 128 bits and to the human eye looked random.  If the system had consistently produced one key, this problem would have been caught, but instead it produced a variety of keys, but a much smaller variety.  The number of keys the system can generate varies with processor architecture, the size of the key, and the type of the key, but all keys using the flawed code will be greatly reduced in their number of possibilities.

Now that the floodgates are opened, a hacker HD Moore of the Metasploit project has released "toys" to help malicious users crack the poor defenseless Linux and Ubuntu boxes.  Moore's website provides lists of precalculated keys based on the bug, to allow malicious users to easily identify vulnerable systems.

Fixing the key problem is not as simple as fixing a buffer overflow vulnerability, another typical security flaw.  As the keys generated our actual files, merely patching the system will not change these files.  Every single key will need to be replaced in a difficult and time consuming process.  Further keys need to be certified and distributed, which takes more time and is error prone.

Debian, the Linux variant used largely by security professionals, and Ubuntu, the variant most commonly used by home users are both affected.  Furthermore, Windows servers may be compromised as well if they are using keys generated on Linux systems. 

Ironically the bug originated from an automated tool known as Valgrind which is supposed to reduce programming bugs which lead to security vulnerabilities.  It found that a block memory was not being properly initialized, meaning that it would contain random information.  The automated tool politely inserted code to clean up the block of memory making it all zeros.  The only problem was that the system was intentionally using the block's unknown to get randomness to generate the keys.  The library also gets randomness from mouse movements, keystroke timings, network packet arrival timings, and even microvariations in hard drive speed.

The Valgrind code caused errors, so the programmers simply commented out all the code, including the other methods of generating randomness on accident.  Only the code which utilized the process ID, an integer ranging from 0 to 32,767, remained to provide randomness.  It turns out the "fix" turned grievous error was not the work of the OpenSSL programmers themselves, but of the Debian team, known for their security expertise. 

OpenSSL developer Ben Laurie raged, "Never fix a bug you don't understand!  Had Debian [sent the bug to us] in this case, we (the OpenSSL Team) would have fallen about laughing, and once we had got our breath back, told them what a terrible idea this was. But no, it seems that every vendor wants to 'add value' by getting in between the user of the software and its author."

One developer more alarmingly points out that the vulnerability has showed a perhaps fatal flaw in the state of the open source industry and in the computer security in general.  One programmer can make a major change which can be blindly accepted by other developers with little understanding of the implications.  This reckons back to controversial statements made by Steve Gibson, a highly respected security consultant, when a major bug was found in Windows.  Gibson suggested that rather than dumb error, it was an intentional attempt to create an open back door.  While hopefully the Linux vulnerability was not maliciously created, the possibility of such a development remains.

Like Alice in Wonderland, it is often amazing to see just far down the rabbit hole goes in terms of the breadth of these kinds of problems.  And this problem is clearly illustrative that unless a more comprehensive methodology of security development is adopted, these problems will only persist and multiply with time.

http://www.dailytech.com/Huge+Hole+in+Open+Source+Software+Found+Leaves+Millions+Vulnerable/article11869.htm