It looks like Google is somehow involved in developing an online virtual world program called My World that will be available to Arizona State University students starting next month, and it’s likely to expand from there. There aren’t many details yet, but the source (Google Blogoscoped) is usually reliable. TechCrunch also has the story.

It has been suggested that this service may provide the same sorts of social functions provided in Second Life. Second Life is a 3D virtual world that allows users to customize their appearance; purchase virtual land and products; construct objects, devices, and even creatures from raw materials and a simple programming language; run virtual businesses; and socialize with other users. There isn’t enough information yet to suggest that My World will allow you this level of freedom, but it is clearly designed to allow users to interact with each other in some sort of virtual world.

There is some speculation that Google will use some of the technology behind Google Earth in this new product, although this is purely speculation and not based on any statements made by Google. It isn’t yet confirmed whether the My World environment will be 2D, 3D, or “2.5D“.

Google has recently begun a big push into social networking:

• Google announced at a secret meeting (some attendants anonymously spilled the beans to news sources) that they will launch a new service on November 5 that will rival the popular social networking site Facebook by competing in the openness of their respective frameworks. Facebook has been criticized for employing the Microsoft strategy of “let everything in, let nothing out” which has been a turn-off for many users. Google’s upcoming rival may or may not be directly related to My World.

• Recently, Google quietly launched a beta service called My Shared Stuff that looks to rival popular social bookmarking sites like del.icio.us (which Yahoo bought out a while ago) and Ma.gnolia.com. My Shared Stuff isn’t yet advertised anywhere on the Google site and seems to have a lot of rough edges, so its public release might have been unintentional.

• Google has been working with Carnegie Mellon University on a project called Socialstream which aims to “create a system for users to seamlessly share, view, and respond to many types of social content across multiple networks.”

• Google developed the orkut social networking site that is extremely popular in Brazil (at one point, studies showed that orkut was the #1 most visited website among Brazilian Internet users). It’s available worldwide, but most mainstream users of social networking sites in the United States have primarily used MySpace and are starting to move to Facebook.

• Google also has other products like Blogger, YouTube, Google Talk, Google Docs, and Google Groups which have a strong emphasis on social networking.

According to the beta site (which is not yet fully open even to ASU students), the product will officially launch later this year, presumably to everyone.

Google Docs is a free suite of online document collaboration tools, sort of like a simpler version of Microsoft Office with more focus on group editing and sharing. It previously offered text document and spreadsheet tools. Yesterday, Google added a new tool to the bunch: presentations.

Google’s presentation tool attempts to serve the same purpose as Microsoft Powerpoint, but in a more portable form. Presentations can be conducted over the Internet, and the participants can communicate with each other through a chat box on the presentation page. As with the other Google Docs tools, the presentation tool also allows you to set up collaborators so multiple people can help develop the presentation without having to deal with the mess of e-mailing the revisions to each other. Every revision is saved on Google’s servers, and you can easily go through the revision history to look at older versions.

The presentation tool is still new and currently falls short of Powerpoint’s feature set in several areas. For instance, animations and audio are not yet supported, and the styling capabilities in general are fairly limited. Although it allows you to import Powerpoint files, it tends to get some of the spacing and sizing slightly off. Google says that this is just an early version and there will be many improvements to come. Google has a history of releasing products early before they are considered “feature-complete” and then rolling in new features over time.

If you’re looking for a true free alternative to Microsoft Powerpoint, I would personally recommend the Impress tool from the free OpenOffice application suite. But the collaboration features offered by Google’s presentation tool are definitely unique, and it’s worth a look if you plan to develop or conduct your presentation over the Internet.

Here is a presentation I made, as viewed through Google’s presentation tool. I originally developed it in OpenOffice, exported it to Powerpoint, and then imported it into Google Docs.

OOXML, Microsoft’s new document format which I have written about here and here, appears to have failed to achieve the number of votes necessary for ISO standard fast-track approval. This means that additional review will be required before determining whether the OOXML specification should qualify as an ISO international standard.

While the vote is not yet final, it appears that the specification has already failed to receive the 2/3 majority vote it needed. Of the 41 participating countries, 13 have so far announced “no” votes and 5 have announced that they are abstaining. From the remaining votes, 16 of which are not yet publicly known, the highest possible “yes” count would be 23, although 24 are required for the 2/3 majority among the voting members.

After the results are final, the next step will be to address the comments left by the countries who voted “no, with comments”. After this process, those countries will have the ability to change their votes to “yes” if they believe their comments have been adequately addressed. So this standardization process is still far from over.

Update: The official vote is in, and OOXML fast-track received only 17 “yes” votes out of the 32 countries which cast votes (9 participating countries decided to abstain). This amounts to 53.125%, 5 votes short of the 2/3 majority needed for fast-track approval. Of those 17 “yes” votes, only 6 expressed full satisfaction with the OOXML specification.

In contrast, the OpenDocument Format (ODF, which OOXML was designed to rival) was approved by ISO last year with unanimous “yes” votes.

Of course, Microsoft is spinning the numbers as much as they can, but it seems the technical problems with the OOXML specification are gaining more and more attention due in large part to the scandals surrounding this voting process.

Microsoft and ECMA International will now have a chance to address the concerns that were raised about OOXML, and then the final vote will take place in the last week of February 2008.

Update: Google has issued an official response to the OOXML fast-track vote, strongly agreeing with the decision to not approve it. In the response, Google reiterates a number of the concerns with OOXML and expresses Google’s own positive experience implementing ODF support in its Google Docs service.

Microsoft is attempting to get the International Standards Organization to fast-track the approval of its Office Open XML (OOXML) document format which it developed to compete with the already-established OpenDocument Format (ODF) ISO standard. The Linux Foundation has recently made an official statement urging ISO members to vote “no” on fast-track approval, citing numerous implementation problems and allegations that Microsoft is attempting to use its wealth and business connections to hijack the standardization process.

I’ve written about these document formats before, and many of the technical issues with the 6,000-page OOXML specification have not yet been resolved. Several ISO members have raised concerns about these issues, but the United States, Germany, and Sweden voted to fast-track the approval process anyway.

However, critics have accused Microsoft of bribing ISO members to vote in Microsoft’s favor. Microsoft has admitted to sending e-mails to many of its partners saying that they are “expected” to vote in favor of fast-tracking OOXML, and that they would be rewarded with “market assistance” and “extra support in the form of Microsoft resources”. Many countries that have historically stayed out of the ISO standardization process have suddenly announced plans to vote on OOXML, and there is worry that this change was due to further misconduct by Microsoft, attempting to stack the vote.

The Linux Foundation is a group that develops standards to be used across Linux environments and submits them to international standards bodies like ISO for approval. The Linux Foundation is now worried that corruption will cause ISO to lose credibility in the industry and thus hinder the Linux Foundation’s mission.

The Linux Foundation also reviewed some of the open concerns about the technical merit of OOXML:

• The OOXML specification is extremely lengthy. Based upon all that we have been able to learn, the review period that has been allowed is insufficient to provide confidence that all issues that may need to be resolved before OOXML could meet minimum quality standards. Accordingly, the Linux Foundation believes that adoption of OOXML, after addressing only those issues that have been identified to date, would be unwise.

• That said, there have already been hundreds of issues that have been raised. While some of these issues are minor, many are not. The Linux Foundation believes that OOXML is simply not mature enough at this point to be granted approval as an ISO/IEC standard. Many, but not all, of these issues have been summarized here <http://www.noooxml.org/local–files/arguments/TheCaseAgai…>.

• ISO/IEC standards are supposed to reference other globally adopted standards where those standards exist. In the case of OOXML, many proprietary Microsoft specifications have been referenced. In some cases (e.g., language codes, vector graphics), Microsoft has used its own, internal codes and specifications rather than already existing, publicly available alternatives. This not only violates ISO/IEC rules, but also puts in question whether implementers can fully implement OOXML without infringing intellectual property rights (IPR) of Microsoft. Will those IPRs be available? If so, upon what terms will they be available? The answers to these questions appear to be currently unknown.

• OOXML is specific to Windows and other Microsoft products. It is uncertain whether OOXML-based documents will be easily created, saved, and opened using other operating systems - like Linux - and applications, with or without converters or translators. An international standard should be created in the first instance to be neutral to all operating systems and other products.

The group concludes:

For all these reasons and more, the Linux Foundation calls upon those National Bodies that have not yet cast their votes to vote “No, with comments.” Those comments should reflect their best, neutral, technical judgment, based upon OOXML in its current form. Only by doing so, we believe, can both the future availability of documents, but [sic] the integrity of the standard setting process be assured.

It should be noted that ISO is not considering replacing the OpenDocument standard with OOXML. If OOXML is approved, the two competing formats will exist side-by-side as separate ISO standards, with neither being officially favored.

Update: SiS, the group which represents Sweden in the International Standards Organization, has just announced that its own vote was invalid due to fraud. The vote has been retracted, and SiS has decided that it is too late in the process to issue a replacement vote. More information, including the official statement and a partial translation, is available at this Groklaw post.

At the 2007 SIGGRAPH conference, an annual convention for computer graphics specialists to discuss new computer graphics techniques and applications, Shai Avidan and Ariel Shamir of Mitsubishi Electric Research Laboratories demonstrated an innovative new method for resizing the dimensions of images. The new method, called content-aware image resizing, preserves the size and visual quality of the more important regions of the image by sacrificing accuracy in the less important areas. It’s difficult to describe in words alone, so here is a video from the creators illustrating the impressive results:

Classic resizing methods work by removing vertical and/or horizontal columns of pixels at regular intervals as needed to account for the difference between the original dimensions and the desired dimensions. As you shrink the image, you inevitably lose some of the detail. If the image consists of a single person and some unimportant surroundings, you could maximize the detail of the person in the resized image by first cropping out some of the surroundings so they don’t take up the precious pixel real estate in the final image.

But what about when an image consists of a person and a house with some featureless landscape in between? In order to preserve the detail of the person and the house, you would ideally want to remove some of that space between them. Simply cropping out that space and shoving the two sides of the image together would leave a very apparent and ugly division in the middle. There isn’t any good solution using classic resizing and slicing methods.

This is where content-aware image resizing comes in. Rather than just removing entire columns of pixels at regular intervals, this algorithm analyzes the image and determines the least noticeable sets of pixels to remove. It does this by calculating the “energy” of pixels. The energy relates to the relative visual importance of those pixels (in other words, how much the pixels stand out). By removing the pixels with the lowest energy, the image can be resized with minimal change to the most visually significant parts of the image.

There’s one more key aspect of the algorithm: Let’s imagine for a moment what would happen if it simply removed the lowest-energy pixels from each horizontal row. What if the lowest-energy pixel in one row were on one side of a house and the lowest-energy pixel on the next row were on the other side of the house? Suddenly, after removing those pixels, the edges of the house would be noticeably zig-zagged. So in order to also preserve the shapes in the image, the algorithm makes sure that it only removes pixels along continuous paths from one side of the image to the other side. The creators of this technique call these continuous paths “seams”.

This works great for shrinking images, but what about enlarging them? It turns out this algorithm is also well-suited for enlarging images. It follows the same procedure, except instead of removing the lowest-energy seams, it doubles them (with a little mixing to smooth them out). Since the seams are low-energy, doubling them has a minimal visual effect. In other words, the result doesn’t look nearly as blocky or blurry as it would with traditional resizing methods, and the sizes and shapes of the most important parts of the page are preserved.

The above video also illustrates how this concept can be used to convincingly remove whole objects from an image by manually forcing the algorithm to treat the particular object areas as being low-energy and then resizing appropriately.

An obvious limitation of the algorithm used in the above video is that it simply removes whole pixels rather than performing some sort of resampling. As I explained above, the classic resizing technique is to remove columns of pixels at regular intervals. While this is the fastest method, it also introduces significant visual data loss, even compared to other traditional resizing techniques.

Image resampling is a way to resize the image without completely discarding any pixel data, by instead calculating each pixel on the resized image as a combination of pixels on the original image. For example, if you were resizing the image to half its original height and width, each pixel on the resized image would be an equal mixture of four pixels (two by two) from the original image.

The content-aware image resizing algorithm could be modified to incorporate some aspect of this technique, by condensing pixels near the seams rather than stripping out the pixels entirely. This would probably improve the outcome of the last example in the above video, where the current algorithm’s limitations were quite apparent.

For more information, see the PDF. The download may be temporarily unresponsive since it has recently been linked to by several very high-traffic websites.

Update: Following the huge attention this new technique has received, co-inventor Shai Avidan has just been hired by Adobe, presumably to add this technology and other work to the popular Adobe Photoshop image editing software.

Dave Gutteridge from the Tokyo Linux User Group speculates on why Linux, a free alternative to Windows, isn’t getting the attention from home users that a free MP3 player or a free car would receive, and he traces it to a general perception that Windows is also free.

Read the article: Windows Is Free

Several technology news sites have written about a recent survey from Netcraft which, at first glance, appears to show that Apache has suddenly lost a lot of market share in the webserver market. However, the change in numbers actually has more to do with how Google is reporting their server usage than people switching webservers.

A webserver is the software that delivers webpages to your browser. Every website is running some sort of webserver. The open source Apache server is, and has for over 10 years been, the most widely used webserver on the Internet, currently used on about 50% of all websites. The runner-up is Microsoft’s IIS, used on about 35% of all websites (it should be noted that last year Microsoft negotiated with the popular Internet registrar GoDaddy to use IIS on all of its parked [placeholder] domains, within a couple months causing an estimated 10-percentage-point bump in IIS market share numbers).

According to Netcraft’s data, some big changes appeared to happen this year. Apache market share suddenly dropped about 10 percentage points (on top of the 10 percentage points it lost in the GoDaddy deal the previous year). Because IIS’s market share also showed a slight increase on top of the GoDaddy bump, several news sites began reporting that websites are massively switching from Apache to IIS.

Upon further inspection, though, this is not the case. The largest factor in the recent change was something Google did. Google has historically used a custom version of Linux and either a built-from-scratch webserver or a custom version of Apache for most of their core services. This year, they modified several of their servers so that they call themselves “Google Front End” (GFE) instead of Apache. On Netcraft’s graphs, you can see the result of this change by the purple line that suddenly jumped up in May 2007, at the same time the Apache numbers appeared to fall. This wasn’t the result of massive server migrations across the Web, it was mostly a name change by Google. Another factor was some migrations elsewhere to lighttpd, another open source webserver designed to be more efficient and less robust than Apache.

For the curious, here are the highest-traffic websites on the Internet, according to Netcraft, and the primary operating systems and webservers they use:

IIS servers above are highlighted in dark blue for clarity. Every operating system listed above is a Unix-based system except for Windows (although it is not listed, Mac OS X is also Unix-based). Country-specific domains were skipped to avoid redundancy.

If you’ve been closely following the world of software security, especially in relation to web browsers, you’ve probably heard about a recent URI handling problem found in Microsoft Internet Explorer and Mozilla Firefox which could allow a website to execute malicious code on your computer. There has been a lot of confusion about this issue, and even some major technology news sites have misunderstood the situation. I will attempt to clarify the issue here.

First, it was discovered that Internet Explorer had a flaw in the way it allowed other programs to be launched from web links. Programs like e-mail applications, instant messengers, and media players often reserve certain URI schemes like “mailto:”, “aim:”, and “mms:” for their use. When you click on a link with a reserved URI scheme, the web browser will launch the appropriate program using an internal command format like the following: outlook "mailto:someone@example.com".

The problem is when certain characters are used in the URI which cannot safely be plopped as-is into that command format. For example, if there is a quotation mark and a space in the URI, that might look something like: outlook "mailto:some" one@example.com". So one of Outlook’s command parameters is the first quoted section ("mailto:some") and the rest of the URI would be treated as a separate parameter, possibly triggering an unsafe program function which is only supposed to be available to the local user. By crafting the link URI a certain way, a website could send a program special instructions resulting in remote code execution — the most dangerous kind of security vulnerability.

The proper way a web browser should handle these situations is to use something called URI encoding. This is a process by which special characters like quotation marks and spaces are replaced with safe identifiers which represent those characters. A space would be converted into “%20”, and a quotation mark would be converted into “%22”. So the Outlook example above would become outlook "mailto:some%22%20one@example.com" which runs no risk of executing arbitrary parameters.

When this vulnerability was discovered in Internet Explorer, Firefox was the first program in which the researchers saw that these arbitrary parameters could cause harm. However, it was by no means a Firefox-specific issue. Internet Explorer’s incorrect URI delivery has also been shown to affect dozens of other Windows programs, including Trillian, Adobe Reader, Outlook, AOL Instant Messenger, Windows Media Player, and Skype. Depending on what levels of operation the programs allow from their parameters (which are generally assumed to be safely supplied and thus trusted by the program), some programs face a more serious impact from Internet Explorer’s vulnerability than others. Firefox and Trillian are two programs of which security research company Secunia decided to specifically make note. Firefox has had far more media attention than any other program affected by this issue, but it’s Internet Explorer which is allowing websites to essentially have user-level access to your programs.

Mozilla recently released a Firefox update which prevents it from being exploited by Internet Explorer in this way, but other programs are still at risk of being exploited as long as Internet Explorer has this vulnerability. Microsoft has stated that they do not plan to fix it, although they’ve been known to change their minds on these issues as media pressure escalates.

After Mozilla patched Firefox to guard against the Internet Explorer vulnerability, it was discovered that Firefox has a similar vulnerability to the one that Internet Explorer has: Firefox may mistakenly pass programs URI parameters without encoding the quotation marks properly. As of this moment, Mozilla has already developed a fix and will release a Firefox update shortly.

Many news articles have misrepresented this situation in a number of ways. Some have claimed that both of these problems were specifically Firefox vulnerabilities. Some have claimed that Mozilla released a fix that didn’t actually fix anything. Some have claimed that Mozilla initially blamed the first issue on Microsoft and then later retracted that accusation and admitted to being responsible for the entire issue. These claims are false, and were largely due to the writers misunderstanding the situation as it has developed.

The real situation is that Internet Explorer and Firefox both have a flaw which allows websites some user-level access to various programs on your computer. Firefox has been updated to protect itself from Internet Explorer’s flaw, and Firefox will soon be updated to fix its own flaw. Microsoft has stated that it will not fix the flaw in Internet Explorer, which means that browsing in Internet Explorer could result in your system being compromised.

Update: Since posting this, Google has added the ability to upload these formats through the regular interface.

Picasa Web Albums is a free service from Google that allows you to upload and share photos, similar to the popular Flickr service. Although Picasa Web Albums’ interface is slick and visually appealing, it does have a few shortcomings to Flickr. One of the big ones is the fact that the PNG, GIF, and BMP image formats are not supported. Picasa Web Albums currently only allows you to upload images in the photo-optimized JPEG format, which makes the service less than ideal for things like screenshots and design mockups for which PNG would be a better choice. The Picasa desktop application only allows uploading of other image types by converting those images to JPEG, which still reduces quality and dramatically increases filesize of certain non-photo images.

However, I’ve discovered a solution which allows you to upload PNG, GIF, and BMP images unaltered to Picasa Web Albums for people to view. Here’s what to do (this assumes you already have Picasa Web Albums set up):

1. If you don’t already have a Blogger account, sign up for one at http://www.blogger.com/

2. Create a new blog. The title will be the name of the album you want to make on Picasa Web Albums. You have to use Blog*Spot for the hosting, and you should pick a Blog*Spot address that no one else is likely to want (some random keyboard mashing will be fine). You’ll never need to actually visit this address.

   Warning: If an album of the same name already exists in your Picasa Web Albums account, they will not merge. You will end up having two albums of the same name (but different URL), which you probably don’t want. Take this into account before picking the blog name.

3. Once your blog is set up, go to the “Create Post” page in Blogger.

4. Click on the “Add Image” icon just above the post entry field. This will open an “Upload Images” window.

5. Click on “Browse” and select the image you want to upload. This may be a JPEG (JPG), GIF, BMP, or PNG up to 8 MB in size.

6. If you want to add multiple images at once, click on “Add another image”. A maximum of 5 images may be uploaded at once.

7. Once you’re ready to upload, click the “Upload Image” button.

8. After it’s finished uploading, optionally give the post a title (today’s date or something, just to identify the image upload session), save the draft, and leave Blogger. The post body may be blank and you don’t need to actually publish the post, but there has to at least be a draft saved or else the images will be lost.

9. Go to your Picasa Web Albums account. If all went well, you should have a new album with a little Blogger logo in the bottom-left corner. If the album isn’t there, try waiting a few minutes and refresh. If it still isn’t there, you should recheck the steps above.

10. To make the album public, open the album page in Picasa Web Albums, click on Edit Album Properties in the left sidebar, and set it to Public.

For these Blogger albums, you’ll always have to use Blogger to upload images; the regular Picasa Web Albums interface won’t let you upload images into those albums. But you can view them normally, set captions, comments, etc. The images retain the full pixel-precise quality and filesize of the original images, and you can manually download them in their original PNG/GIF/BMP formats.

It would be nice if Picasa Web Albums would allow us to simply upload PNG/GIF/BMP images from the regular upload interface, but this will have to do for now.

A couple of weeks ago, Apple gave the web development world a nice surprise when it released a beta Windows version of its Safari 3 web browser.

Safari is currently the third most used browser on the Web with about 5% usage share, largely due to the fact that it is installed by default on all Apple computers. Safari, as well as its webpage display engine, WebKit, was previously only available on Mac OS X, which left Windows and Linux users with no way to reliably test website compatibility without buying a Mac.

The idea of Apple shipping a Windows version of Safari was met with a lot of excitement. High-ranking employees of Mozilla — the company that develops the second most popular browser, Firefox — were quick to praise Apple for this decision.

However, the excitement was soon muffled by a growing number of problems. From a user experience point of view, Safari for Windows was met with lots of very negative reviews. Popular technology blog Ars Technica stated, “Safari’s user interface simply doesn’t provide the usability or flexibility of competing products.” Many complaints stemmed from Apple’s attempt to emulate the Mac OS X look and feel on Windows, which left the browser feeling awkward and out-of-place.

Then came an avalanche of security vulnerabilities. The official Safari website claims, “Apple engineers designed Safari to be secure from day one.” However, on day one of the Safari 3 beta release, several major security vulnerabilities were already discovered. Security researcher Thor Larholm posted on his blog, “I downloaded and installed Safari for Windows 2 hours ago, when I started writing this, and I now have a fully functional command execution vulnerability, triggered without user interaction simply by visiting a web site.” This is the most serious kind of security vulnerability a web browser can have, and these vulnerabilities were then confirmed by Apple and later patched.

But that wasn’t the end of the security woes. A week later, Apple had to release yet another version to fix more security issues. And the next day, another security vulnerability was found that Apple has yet to fix.

It’s typical for a relatively high number of vulnerabilities to be discovered early after this kind of product release. For most people, web browsers in general are the single largest access points for malicious software trying to get into your computer. The Windows release of Safari was a pretty big-news event among people in the field, and Apple really played up its security benefits. So it was naturally an attractive target for security researchers looking to make some headlines. However, no other browser has been met with this number of security issues in such a short time frame, even when releases like Firefox 1.0 made more news than Safari has. Some security researchers believe this to be an indication that Safari is actually the most insecure of all major browsers on Windows, even counting the infamously insecure Internet Explorer.

Finally, Apple CEO Steve Jobs gave a presentation which was very unsettling to many of the early supporters of Apple’s decision to bring Safari to Windows. In the presentation, Jobs presented a pie chart showing the respective usage shares of today’s major browsers, with Internet Explorer at about 78%, Firefox at 15%, Safari at 5%, and other browsers at 2%. Next, he presented a graph which showed his vision for the future: Internet Explorer with the same usage share as before, but with Safari taking up the entire remainder of the pie, thus eliminating all other minority browsers. Mozilla COO John Lilly criticized Jobs on his blog, stating, “This world view that Steve gave a glimpse into betrays their thinking: it’s out-of-date, corporate-controlled, duopoly-oriented, not-the-web thinking. And it’s not good for the web.”

Safari has an interesting history. Its webpage display engine, WebKit, was derived from the open source KHTML engine, which was developed for the Konqueror browser on Linux and is used in some portable devices and other small applications. Although Apple has made WebKit open source and continues to forward their code changes to the KHTML group, it’s Apple’s general nature to be secretive about its development projects, hence the surprise about the Windows version. Safari’s mixture of open source code and proprietary-themed management is unique when looking at the other popular web browsers. Mozilla, the developers of the only other major open source web browser on Windows, has a very open and transparent nature about the way the company is run and the plans it has for future projects. In general, open source communities have always held freedom of choice in high regard, but Steve Jobs’ presentation seemed to have betrayed this line of thinking, idealizing a world with less choice.

The fact remains that this is the first time the WebKit engine was reliably available on a major non-Mac operating system, which means more convenience for web developers. Safari 3 also boasts much improved support for web technology than the Safari 2 series. But in terms of whether or not it’s the right browser for the average user, Safari isn’t looking too good so far.