Previous Issue | Search TidBITS | TidBITS Home Page | Next Issue

TidBITS Logo

TidBITS#590/30-Jul-01

Wondering what the future holds for Mac OS X? Jeff Carlson examines Mac OS X 10.1 as shown during the Macworld Expo keynote. Adam and Mark Anbinder continue the Macworld Expo coverage with looks at the most interesting products at the show, and we report on Mac OS 9.2's quiet appearance. Finally, Jamie McCarthy editorializes about SirCam, the Windows email worm that can annoy even Mac users by bombarding them with futile infection attempts.

Topics:

Copyright 2001 TidBITS Electronic Publishing. All rights reserved.
Information: <info@tidbits.com> Comments: <editors@tidbits.com>

This issue of TidBITS sponsored in part by:

MailBITS/30-Jul-01

Mac OS 9.2 Slides Onto New Power Mac G4s -- With nary a mention in Steve Jobs's Macworld Expo keynote address, Apple last week began shipping computers with Mac OS 9.2 installed. The new version of the operating system is reportedly a minor enough upgrade that it could have been called "9.1.1" if not for the likelihood it would prompt jokes about "911" (an emergency phone number in most of the U.S.). Although Apple has provided no release notes about what changed in Mac OS 9.2, reports indicate that it contains some bug fixes, support for the latest Power Mac G4 (QuickSilver) machines, and improvements that will be required for use with Mac OS X 10.1, slated for release in September 2001. It's a moot point for most people right now, since Mac OS 9.2 is currently available only with the new Power Mac G4 (QuickSilver). [MHA]

<http://til.info.apple.com/techinfo.nsf/artnum/n58840>

Eudora Welty Dead at 92 -- Pulitzer Prize-winning author Eudora Welty died last Monday at age 92. Welty was a lifelong resident of Jackson, Mississippi, and an icon of American literature. Among her best known works are the short story collection The Golden Apples and the novels Losing Battles and The Optimist's Daughter; two of her works (The Ponder Heart and The Robber Bridegroom) also became Broadway plays. Her stories tended to focus on the lives of sheltered characters in southern America, but also quietly contradict easy categorization into any particular genre. Welty is also noted for her photographs, particularly images of the South during the Great Depression taken when she was working as a "junior publicity agent" for the Works Progress Administration.

<http://www.olemiss.edu/depts/english/ms-writers/dir/welty_eudora/>

In relation to the Macintosh world, the popular email program Eudora is named for Eudora Welty, specifically because of her famous short story "Why I Live At The P.O.," published in her first collection in 1941. Programmer Steve Dorner read the story in college, and it was still with him years later when it came time to name the first version of his new email program. [GD]

<http://www.eudora.com/presskit/backgrounder.html>

The SirCam Worm: Email Exhibitionism

by Jamie McCarthy <jamie@mccarthy.vg>

The SirCam email worm has been pestering me - and vast numbers of other people around the world - all week. Luckily, it has been only an annoyance since I use Mailsmith on Mac OS X and SirCam infects only PCs running Microsoft Windows. Even so, over the last ten days it has managed to coerce infected machines into sending me 250 copies of itself attached to innocuous-sounding documents. At about 200K apiece (with some documents being much larger), we're talking some serious wasted bandwidth and disk space.

<http://wtc.trendmicro.com/wtc/>

How It Works -- SirCam is a bit more clever than earlier viruses or worms that exploit weaknesses in Windows or specific Windows programs. SirCam uses its own SMTP engine to spam itself not just to contacts in its victims' Windows Address Books, but to any email addresses found in their Internet Explorer cache as well. So I've been getting mail from total strangers who just happened to have visited my Web site recently.

This design means that people with high-profile email addresses have been hit a lot harder than others. "CmdrTaco" at the popular geek news and discussion site Slashdot has received about 3,000 copies totalling 600 MB. [Here at TidBITS, we're at about 350 copies so far, but our Web site is read primarily by Mac users who can't be infected. -Adam] So my own red badge of courage, 250 copies, may sound a little lame, but in my defense, that's not counting what I've been getting from my biggest fan, a Prodigy DSL user who has kindly sent me thirty SirCam-generated messages a day since 27-Jul-01.

I don't count the Prodigy user because I run my own mail server, which makes it easy to code up a custom filter (I use the Perl module Mail::Audit). So I've not only been ignoring her mail, but also sending my helpful commentary on how to stop this flood of email directly to the president of Prodigy Communications, thirty times a day. Haven't heard back yet.

[If you don't run your own server and your ISP isn't successfully blocking the SirCam worm, you can reduce the annoyance level by setting your email program to skip messages over 100K; in some programs like Eudora, you can then create filters to look for SirCam-generated messages and delete them from the server (as with all destructive filters, be very careful - I'd recommend invoking them manually until you're certain they're working properly). The body of a SirCam-generated message always contains fixed first and last lines in either English or Spanish, and the attachments always have a .COM, .BAT, .PIF, or .LNK extension (see the Web pages below for details). For those like Jamie who run their own mail servers with filtering capabilities, it's relatively easy to filter out all the SirCam messages because of the similarities between each message. Here at TidBITS, we decided to reject all messages with attachments using those file extensions; however, this approach might create administrative hassles for others. -Adam]

<http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html>
<http://www.f-secure.com/v-descs/sircam.shtml>

SirCam replicates in part thanks to the way Windows and at least some Windows programs (such as older versions of Microsoft Outlook and Outlook Express, but possibly others) operate by default. Although Windows requires filename extensions on all files, it hides those extensions from the user by default, and email programs can do the same. When the worm arrives as the batch file "COVERAGE OF PEARL HARBOR ATTACK.doc.bat" (an actual example), it appears to Outlook users as "COVERAGE OF PEARL HARBOR ATTACK.doc" - seemingly a Microsoft Word document. Double-clicking it opens the document, but while the user is trying to figure out why they've received it, the worm infects the PC.

Even this allegedly user-friendly extension hiding feature (which is slated to appear in Mac OS X 10.1 as well) wouldn't be sufficient to allow exploitation on many systems, but for the fact that older versions of Microsoft Outlook don't warn users that double-clicking an attachment can have serious security implications. Many other email programs do, and in both July of 1999 and June of 2000 Microsoft patched Outlook to warn users of potentially dangerous attachments, but downloading and installing a security patch requires far more attention to security issues than most users are willing to pay.

<http://support.microsoft.com/support/kb/articles/Q235/3/09.ASP>

Email Voyeurism -- The cool thing about the SirCam worm is that it disseminates itself within a random file from its victims' desktop or My Documents folder. So every time I receive a copy of SirCam, I also get a peek into a stranger's hard disk.

Normally I'm not the voyeuristic type, but when goodies arrive unbidden, I have a hard time throwing them away. I've had splendid schadenfreudigen fun all week, opening the attachments in BBEdit and reading private files from other people's lives. Some are short and dull, others are long and interesting. I've been trading excerpts with friends over IRC. SirCam has turned into Pokemon: "Gotta catch 'em all!"

Here are just some of my more interesting finds:

I contacted the ironworks applicant and we traded a few email messages back and forth. She doesn't use Microsoft products herself, but the firm she applied to does.

Therein lies the most frightening thing about this worm: her cover letter has been sitting on the ironworks' hard disks for months, and she had no control over its being sent to me. She would never have known if I hadn't dropped her a line.

I honestly don't much mind my inbox being clogged: I have a cable modem and I can filter at the server. But despite my best efforts to avoid Microsoft products - Linux at the server, OpenBSD for a firewall, Mac OS X on my desktop - my privacy may still have been compromised. Many of my friends use Windows, and I trust them to keep secrets about the private information we've shared. The problem is that I can no longer trust their computers. No matter how careful we are, the insecure monocultures of Windows and Outlook turn us all into exhibitionists.

SirCam isn't benign - there's a 1 in 20 chance it will delete all files on infected hard disks on the 16th of October, and on any other day there's a 1 in 50 chance it will fill up infected hard disks. There have been significantly more destructive worms: what makes SirCam special is the way it randomly exposes our private information to the world. Perhaps potential embarrassment will encourage individuals to exercise caution in computing, and also inspire software companies to produce programs that not only protect users but also help them become part of the solution.

Mac OS X 10.1 Previewed At Macworld Expo

by Jeff Carlson <jeffc@tidbits.com>

More than any other event, Macworld Expo stirs up the excitement of Mac users looking for Apple's newest take on thinking different. Ironically, the show also tends to temper that excitement with an equal dose of patience. At Macworld Expo San Francisco 2001, Steve Jobs incited outbreaks of mass techno-lust with the introduction of the PowerBook G4 Titanium, but even those who ordered their machines wirelessly from the floor of the keynote didn't receive them for several weeks. At this year's show in New York, Jobs introduced Mac OS X 10.1, Apple's first major update to its new operating system - but you won't be able to get your hands on it until September. Here's some of what you have to look forward to.

<http://www.apple.com/macosx/newversion/>

The Bouncer at the Door -- Translucent menus and preemptive multitasking quickly lose their luster if essentials like selecting menu items or resizing Finder windows don't respond quickly. The main improvement in Mac OS X 10.1 is a performance boost across the board, with an emphasis on improving application launch time, as measured in bounces. Under Mac OS X, a program's icon bounces like a caffeinated child in its place on the Dock to indicate that the application is loading. Under Mac OS X 10.1, Internet Explorer launched in one bounce, and Mac OS X's Mail program barely bounced at all. Of course, Jobs was undoubtedly running on the fastest possible hardware, but we've heard that launch performance is two to three times better even on slower Macs.

"Performance, performance, performance," Jobs chanted, but it's not just brute-force processing power that's improved. Under 10.1, you'll be able to choose a method of minimizing windows. The current scheme, called Genie because of the way windows get sucked into the Dock, will be joined by Scale, which resizes the window proportionally as it moves to the Dock. The effect is cleaner and faster than Genie, and Jobs suggested that Scale will be the default behavior when 10.1 is released. (Personally, I'd vote for a balloon behavior, where the window splutters around the screen, deflates, and drops limply to the Dock.)

Finder windows will also enjoy resizable columns in the column view (hopefully the widths will be remembered, unlike Mac OS X 10.0.4), and long filenames will run onto multiple lines if needed instead of truncating the text. Like Windows, Mac OS X 10.1 will offer the capability for users to hide or show filename extensions. This feature is disastrously confusing in Windows; let's hope Apple somehow avoids similar problems.

Another improvement to the system's Aqua interface is the capability to position the Dock on the left, right, or bottom edges of the screen. This is possible in the current version of Mac OS X, although the position isn't remembered through restarts. To move your Dock now, Control-click the dividing line between applications and documents in the Dock to choose an alignment, though the new system won't support putting the Dock at the top edge of the screen.

Apple is also addressing Dock overload by pulling some functions currently available as Dock extras out of the Dock and into the top menu bar. These "system menus," as Jobs called them, will display status for battery life and AirPort signal strength, and offer controls for changing sound volume, display settings, and a modem connection. The concern here is that this area will itself immediately be overloaded, much as happens with the Windows system tray. The existing Control Strip isn't perfect, but at least it can be tucked away off-screen when not needed.

Finally, applications in the Dock can now have menus, just like folders do, though it was unclear from the keynote just what menu items would appear there.

Hub Caps -- Mac OS X 10.1 catches up on Apple's digital hub strategy, adding DVD playback and CD burning (for saving data, not just music via iTunes) directly in the Finder, courtesy of a new Burn button that can be placed in the toolbar in Finder windows. Perhaps the most entertaining moment in the keynote came from Jobs when he tried to connect a digital camera via USB; when it didn't work, he just tossed (er, threw) it to an Apple employee offstage and moved on. Later, he came back to the camera and showed the system automatically copying its images to a special folder that can also use the photos as the basis for one of Apple's screensaver modules.

Of course, Mac OS X 10.1 couldn't be a digital hub if it weren't at the center of things, so Apple has boosted its networking capabilities. You will finally be able to configure AirPort base stations from within the AirPort Admin Utility under Mac OS X 10.1. Apple is also adding support for connecting to the machine using AFP over AppleTalk, plus SMB networking support to enable the Mac to interoperate better on a Windows-dominated network. Mac OS X 10.1 will not only support an emerging technology called WebDAV (Web-based Distributed Authoring and Versioning; it's a set of extensions to the Web's HTTP protocol to enable users to edit and manage remote files collaboratively - you can think of it as FTP on steroids), it will use WebDAV as the underlying technology behind your iDisk. Since WebDAV uses the stateless HTTP to transfer data, it can be left on your desktop for long stretches of time without having to always check in with Apple's servers.

<http://www.webdav.org/>

The Future Is Still Here, Still Coming Soon, For $20 -- When it becomes available in September, Mac OS X 10.1 will be available as a "free" upgrade for current users. However, because so much data has changed between this release and previous ones, owners of Mac OS 10.0.4 and earlier will find themselves spending $20 (for shipping and handling) to order the update on CD. Apple's certainly allowed to charge whatever they want, but it's a bit annoying to be forced to pay more for an update which feels like a fix to make the operating system basically functional for mainstream users. Even if a online update was huge, why not give users the option of a very long download to head off any complaints?

Macworld Expo NY 2001 Superlatives

by Adam C. Engst and Mark H. Anbinder <editors@tidbits.com>

This year's Macworld Expo in New York City may have been an odd show with no spectacular announcements, but that doesn't mean nothing caught our eyes while wandering the show floor. The main liability this year? As with so many other announcements at the show, a number of these products simply aren't shipping yet. I'm looking for the last few months of 2001 to boast a flurry of releases, and I'm sure you'll be able to see many of these products at January's Macworld Expo in San Francisco.

<http://db.tidbits.com/getbits.acgi?tbart=06502>

Shake Hands With Your Mac -- The first thing I saw upon walking into the Macworld Expo show floor was Essential Reality's P5 glove-like controller. It's a USB device that fits over your hand and enables you to use hand and finger motions to control 3-D graphics programs, games, and more. It definitely wins the futuristic interface award, though it's not entirely clear to me how well it will work for many types of applications, and it looked as though your arm would get tired if you were using the P5 for a long time. Still, the P5 will be cheap (as in $130) when it ships in a few months - let's hope Essential Reality comes up with a better name between then and now. [ACE]

<http://www.essentialreality.com/products.html>

Tantalizing Test Drive -- One of the handful of reasons I don't use Mac OS X full-time on my laptop is that Virtual PC doesn't yet work in Mac OS X. Connectix has improved that situation by introducing the Virtual PC Test Drive for Mac OS X, a free download for owners of Virtual PC 4. Due largely to limitations in Mac OS X itself, the test drive doesn't support USB devices, can't use a unique IP address within Windows, and can't display the virtual PC full screen, but the software is otherwise quite functional. We were delighted to hear that Virtual PC can share drive image files and saved states between the Mac OS 9 and X versions of the software. Connectix can't say when a final version of Virtual PC for Mac OS X will be available, but promises that a final version (or another test drive version) will appear before this test drive expires on 31-Jan-02. [MHA]

<http://preview.connectix.com/testdrive/>

Don't Forget Your Wallet -- You're going on vacation with your digital camera, but you don't want to bring a laptop to store photos after your camera's Compact Flash card fills up. Minds@Work has the solution, with the palm-sized Digital Wallet, a 12 ounce battery-powered hard disk with a PC Card slot that operates independently of a computer. The Digital Wallet supports Compact Flash, SmartMedia, Sony MemoryStick, Panasonic SD Memory Card, IBM Microdrive, Intel StrataFlash, and MultiMedia Cards; simply put your camera's memory card into a PC Card adapter, plug it into the Digital Wallet, and transfer the files from the memory card onto the Digital Wallet's 2.5-inch hard disk, which is available in 3 GB ($350), 10 GB ($450), and 20 GB ($550) sizes. The NiMH battery lasts for up to 120 minutes of use, and can be recharged about 500 times. When you get home, plug the Digital Wallet into your Mac (or PC, or Linux box) via USB and transfer the files to your computer. The Digital Wallet also features a small monochrome LCD screen, not for previewing pictures, but for seeing directory listings, file transfer status, and so on. The main downside is price, given that you can get a 256 MB Compact Flash card for between $150 and $250, it might be possible to get by on vacation with a couple minuscule memory cards. [ACE]

<http://mindsatwork.net/>

Smallest Media -- While we're on the subject of tiny media, look for the new DataPlay digital media to appear before the end of the year. Manufactured by Imation, DataPlay's long-lived optical disks store 500 MB in a package about the size of a U.S. quarter and will be available in five colors. Joining the DataPlay media will be Imation's DiscGO, a device similar to the Digital Wallet that lets you copy the contents of memory cards to and from DataPlay disks, which you can then copy back to your computer via USB. A number of devices are using DataPlay media, most notably portable music players but also PDAs, an electrocardiogram recorder, and digital cameras. I'll be curious to see real-world impressions of how well DataPlay media works, since it seems to combine a great form factor with decent capacity (twice the size of large Compact Flash cards) and the promise of archival storage. [ACE]

<http://www.dataplay.com/>

Best Traveler Gizmo -- We already knew Battery Technology, Inc. (BTI) was great for laptop and cell phone batteries and power adapters, but a new product at the BTI booth combined these two areas nicely. An inexpensive USB cell phone charger provides power to charge your wireless phone via the USB port on your laptop or desktop computer. (A full phone charge drains around a fifth of your laptop's battery charge, a reasonable trade-off if you need your cell phone charged!) I've kept mine in my laptop bag since I bought it several days ago, and have used it at the office while my laptop's plugged in, as well as while traveling. [MHA]

<http://www.batterytech.com/>

Smallest Hard Disk -- If you're in the market for small media that holds more than the 500 MB DataPlay disks, check out SmartDisk's sleek new FireLite 5 GB hard disk. It measures a mere 2.4" x .5" x 4", weighs 5 ounces, and is powered from the FireWire bus so no additional power adapters are necessary. The magic behind this minuscule drive comes from a new 1.8-inch mechanism from Toshiba, and once Toshiba provides mechanisms in other capacities, SmartDisk will introduce more options. The FireLite will be priced at $400 when it ships (SmartDisk is saying only "Available soon") so the size does command a premium price, but if size is of paramount importance, you won't find a single 5 GB package any smaller than the FireLite. [ACE]

<http://www.smartdisk.com/Products/Storage%20Products/Hard%20Drives/FWFL.asp>

Spider's Eye View -- As Web sites have grown, it's become ever more difficult for site authors to see just what pages they have, how they link to one another, and how coherently they follow site guidelines. There are a variety of utilities that will give you a list of files with broken links, or let you search across a set of HTML files. But the Java-based (so it runs on Mac OS X, but not Mac OS 9) Funnel Web Profiler from Quest Software goes well beyond that by letting you look at your entire Web site at once in a graphical map view that you can customize to reveal different bits of information about each page. Funnel Web Profiler can apply different colors to pages to indicate how well they match your desired level of HTML quality, change the size of the page dot to indicate how linked that page is, and so on. The $600 Funnel Web Profiler also works with the flexible Funnel Web Analyzer log analysis tool. If you're responsible for serious Web sites, take a look when Funnel Web Profiler ships later this quarter. [ACE]

<http://www.quest.com/funnel_web/profiler/>

Input Device Stars -- Apple somewhat dried up the market for third-party keyboards and other input devices with last July's introduction of the Apple Pro Keyboard and Apple Pro Mouse, but some vendors are still successfully offering alternatives. Adesso's multimedia ergonomic keyboard, tiny portable USB numeric keypad, and Lilliputian two-button optical mouse with scroll wheel are great examples. [MHA]

<http://db.tidbits.com/getbits.acgi?tbart=06049>
<http://www.adessoinc.com/>

Two Half Keyboards Equals? At last January's Macworld Expo in San Francisco, we wrote about the Matias Half Keyboard, which was literally a QWERTY keyboard sawed in half (well, it's more elegant looking than that). By pressing the space bar with your thumb, you can type the characters from the other half of the keyboard. Although some will want it for desktop use, it's most compelling in the $300 Wearable Half Keyboard bundle from Matias, which includes a Half Keyboard with five-foot cable, wrist straps, and screen rotation software for the Palm OS so you can strap it and the Palm to your wrists. Portable data entry becomes a reality, and an inexpensive one at that. Anyway, you can imagine my initial confusion at Macworld Expo when Edgar Matias proudly showed me his new Half Keyboard x2, which looks exactly like a normal keyboard. For a moment I thought he was just having some fun with me, but then he explained that the Half Keyboard x2 is a normal keyboard, but by holding down the space bar, you can use either side of the keyboard to type the full range of characters. Without the space bar down, it acts like a normal keyboard. Thus, you're not forced to use the slower Half Keyboard typing most of the time, but when you really need a hand on the mouse for text editing, desktop publishing, CAD, or even gaming, you can do so. It's slated for release in October for $100. [ACE]

<http://www.halfkeyboard.com/products/whkbinfo.html>
<http://www.halfkeyboard.com/products/hkbx2info.html>

RTMac Update -- Matrox, whose RTMac real-time video editing card for Final Cut Pro I reviewed in TidBITS-587, was showing a new version of their software, due to ship in September, that will extend the RTMac card's real-time editing capabilities to users of Adobe Premiere 6. [MHA]

<http://db.tidbits.com/getbits.acgi?tbart=06486>
<http://www.matrox.com/videoweb/products/enduser/rtmac.htm>
<http://www.adobe.com/products/premiere/>

Best Consumer Audio Devices -- Griffin Technology easily takes this award with a pair of devices. The USB-based $45 PowerMate is a elegant knob on a glowing base that you can rotate and press to activate a user-defined action. It's most obviously useful for controlling audio volume, since it's far easier to turn a physical knob than to fiddle with a tiny virtual slider. But it's also totally programmable, so you could press it to have it act as a power key, mute the sound, or do other things. Then there's the $100 PowerWave, which is a USB audio amplifier and interface. It provides two RCA line level input connectors, two line RCA line level output connectors, a 1/8-inch microphone input jack, a 1/8-inch headphone output jack, a USB hub, and an Apple Pro Speaker connector. Internally it features a 24-bit DSP (Digital Signal Processor) chip for high quality sound, though of course it was difficult to determine audio quality amidst the cacophony of the show floor. Both are set to ship in September. [ACE]

<http://www.griffintechnology.com/audio/pwrmate.html>
<http://www.griffintechnology.com/audio/pwrwave.html>

Closest Zoom -- I'm one of those people who's never been able to use a microscope comfortably, thanks to a fairly thin face and glasses. If only Bodelin's The Scope had been available back when I was dissecting worms and counting protists! It's a handheld USB digital microscope that can display 640 by 480 images on a computer screen at up to 200 times magnification. It can even show live video, record movies, or do time-lapse photography at those magnifications. The $200 package includes a 50x lens, the necessary software, backlighting, and standard tripod mount (also for use with The Scope's optional $125 stand). Also available are an $85 1x lens that turns The Scope into a standard digital camera and $100 100x and $129 200x lenses for increased magnification. Plus, a $20 C-Ring lens adapter enables the use of any standard C-mount lens. The Scope sounds ideal for schools, since a teacher could display magnified images or live video for the entire class to see. [ACE]

<http://www.bodelin.com/>

Server Software Chutzpah -- 4D's WebSTAR V Server Suite takes this award for putting a ton of effort into moving the leading suite of Mac OS server to Mac OS X despite the preponderance of Unix server programs. But WebSTAR V aims to distinguish itself based on easier setup and administration, better performance (thanks to advanced caching and a multi-threaded architecture), and integrated WebDAV and FTP servers. The software is in public beta now, so if you've found configuring Mac OS X's Apache difficult, give WebSTAR a try. It's slated for release by the end of this quarter, with the price to be announced at ship date. [ACE]

<http://www.webstar.com/hottopics/4dwsv_beta.html>

Non-profit, non-commercial publications and Web sites may reprint or link to articles if full credit is given. Others please contact us. We do not guarantee accuracy of articles. Caveat lector. Publication, product, and company names may be registered trademarks of their companies. TidBITS ISSN 1090-7017.

Previous Issue | Search TidBITS | TidBITS Home Page | Next Issue