Here's the hot line: "Vulnerabilities in such widely used software can cause myriad problems. More than a dozen sites, including those of The New York Times, USA Today, and Nature, have been infected with fake ads that exploit Adobe software."

The latter phrase should read "exploit older, un-updated Adobe software." Attackers will use the newest vulnerabilities in hopes of increasing their catch -- no surprise. This article contains the worry, but not the general advice readers need: keep your Internet software current.

The more-interesting part of this exploit is mentioned only in passing... trusted websites cannot always assure the third-party content they serve. The Web, as we know it today, is infected... more last week and last June... even trustworthy sites are not sure what they're serving you.

(There's also a line later on: "Historically, Adobe hasn't had to contend with attacks, so it hasn't been focused on potential weaknesses." The Internet Archive has pages from the Macromedia Security Zone dating back to 2002.)

Summary: Yes, criminals are trying to exploit you. But to reduce the risk, keep your Internet software current. And consider using browser software (such as an ad-blocker) to monitor third-party content which may be attached to a trusted site.

I'm more interested in a minor quote in there: "What's driving the most successful [browser] plug-in, which is [Adobe Flash Player], is video support."

I suspect that might be the other way 'round... Macromedia Flash Player had been solidly above 90% consumer support for many years before video was introduced in 2002. Early adopters started using video via Flash in 2003, but it wasn't until 2004 that we started seeing businesses built atop it, and by 2006 there was widespread awareness.

Why? Video took off only after the production costs were lowered: once producers did not have to multiply-encode video for different audiences, and once support costs for consumer installations were removed. Adobe Flash Player added video in early 2002, then became a practical choice towards late 2004, after consumer support levels rose above 90%.

The same kind of dynamic occured with "Ajax" a few years back... consumer support was already high for Microsoft browsers, and as soon as browsers from Mozilla and Apple added support for live XML requests, developers could immediately build websites which large audiences could immediately view. When Jesse James Garrett coined the name on Feb 18 2005, those startling new "Ajax" projects would magically "just work" for their audiences.

Both Ajax and Flash video were considered "overnight sensations", even though the groundwork had actually taken many years. The hype started only after the capability was already there.

Anyway, linear video playback on a notebook is certainly a lucrative area right now... lots of firms are making lots of money from massive audiences via their video content -- popular video is certainly "a shiny object" these days -- so I can understand the mental shortcut of thinking that video drove Flash.

But history shows that it was Flash's total ecology of creators and audiences -- all the exceptionally diverse people who found value in using Flash -- which successfully drove the later practicality of in-browser video. In a sense, sites like JibJab and NewGrounds made sites like YouTube possible.

Adobe today? The company still establishes publishing technologies, then profits within these new, wider ecologies. That pattern is embedded deep within its corporate culture. Yesterday's view of video will not be tomorrow's view of video, and Adobe is trying to solve newer, harder problems.

We were all quite shocked. But Usenet's architecture naively trusted all inputs. Bound to happen.

Email surprised us with the same problem. It was very useful, particularly after Usenet started to get noisy. But then Email clients tried to compete with the colored fonts of HTML, and let anybody send a file to you, then executed JavaScript when an email was opened, and there were plenty of marketers urging them along on this road to perdition. The first big Flash security problem was My Naked Wife, a file-deleting .EXE which called itself a SWF... not all that much different than the latest issue, in wanting to trust any odd file which came along.

Email's architecture also believed anything any stranger said, and so had an initial boom, before becoming parasitized. Like Usenet.

The World Wide Web is also very lauded, very useful. But we've got that same Usenet dynamic of wanting to listen to any speech or visit any site, while following the email-client dynamic of adding all types of extraneous features in hopes of becoming the universal client. The result is that more people are now asking "Can we trust the Web?", not even knowing whose content they're serving up.

"Green Card Lawyers" and "My Naked Wife" arose because they could, once Usenet or Email became attractive enough. Both Usenet and email were successful among early adopters, but neither system could really adapt to their eventual parasites. The Web has become popular too, and also has issues with accepting candy from strangers.

Fortunately, The Internet -- the network of all networks -- is bigger than The World Wide Web and its hyperlinks. Our connectivity is expanding from the desktop to the pocket and the wall. It's time to change again.

Usenet may be moribund, and 90% of email may be spam, and the web's search engines may be full of plagiarized or infected sites, but our networking strength has only increased. I suspect the next architectural design should offer more control over how strangers might gain our attention.

Internet access in China is still uncertain... sites with user-generated content (Twitter, Facebook etc) have been blocked leading up to the 60th anniversary week for the PRC, and then for a media conference in Beijing (yes, that sounds ironic to me too ;-). I'm hoping things will open up this week... if so, I'll be on Twitter, Typepad, and perhaps I'll even be able to revive my moribund Flickr account.

(If you're into walking or urban orienteering, take a look at Chongqing, near Sichuan, and zoom around a bit... with its mountains, rivers, stairs and curved streets, it's said to be one of the easiest cities in the world in which to get lost, before finding yourself again. Fun challenge! :)

Meanwhile Google Websearch shows that this site is distributing files claiming to be software that Adobe develops.

I hope I'm misunderstanding it. They can't really be complaining that someone else is infringing on their infringements of others...!?

(btw, thanks to Bing Websearch, which does not list these sites which promise to install Adobe CS4 onto your computer....)

I'd urge you to read Peter-Paul's original paper, as well as followup essays by Savio Rodrigues, Stefan Constantinescu, others.

WebKit is an interesting situation. In HTML itself the file format is openly published, and implementers are encouraged to build their own versions. The WebKit project, under Apple governance, openly publishes HTML runtime source code, which is then modified and distributed by device manufacturers.

In HTML, a file format is "open", and implementations vary. In WebKit, a reference implementation is "open", and device-specific implementations still vary.

Flash complements these two. The SWF file format is openly published, same as the HTML file format (although governance of file format improvements is within the Adobe ecology, rather than the W3C/WhatWG ecology). With Open Screen Project we're more in the WebKit range, where Adobe establishes the reference implementation, and partners customize this to their device. Flash Player 10.1 will differ across device based upon device capabilities (screensize, input methods, accelerometer, etc), but I don't expect it to vary in basic runtime capability the way WebKit does.

Is one better than the other? Is WebKit better than HTML, or Flash better than WebKit? I don't think so... each serves different purposes. Apple's donation of WebKit sourcecode helps resolve some of the implementation differences of the HTML/JS/CSS/DOM/etc specifications. Adobe donates a standard Flash implementation to the world's screens. These options are better when they work together, when one doesn't try to be the other. They're different... both good.

The problem I have with free-software advocates like Richard Stallman is that they think freedom is the primary reason to use open-source software. It's not. Utility is.

After all, we're not talking about essential human rights here. We're talking about getting work done with software.

Over the past 10 years I and the companies with which I've worked have sold hundreds of millions of dollars in open-source software/services. Not once have I been asked about "freedom." For that matter, I've also never heard a customer gush about reduced vendor lock-in.

To the contrary, I've met with CIOs and CTOs who have explicitly told me that this isn't a top consideration for them. Just last week, in fact, I moderated a panel at LinuxCon in which I asked senior IT executives from leading media companies if vendor lock-in is a primary motivation for using open source. Nope.

They have work to do. They want software that helps them get their work done and gets out of the way. That's what open source does.

(Go to the original article to get the links Matt uses to document this section.)

The above will be spun by some as "Business is Anti-Freedom", but I think a more apt description is "Different strokes for different folks". People are seeking solutions to their own problems... their judgments may be very different than your own.

It's finding ways to accommodate all those differences -- developing multiple options to satisfy diverse needs -- that's a trickier problem than assuming everyone shares the same values.

I haven't investigated the hack's details, and know nowhere near enough to speculate how the project might evolve. But it's significant, to me, for being the first comprehensive attempt to address bringing the "HTML5" ideas to realworld audiences.

A person's browser becomes their habit -- they're loathe to give up surfing efficiency, not quite willing to risk the expense of exploring a new interface. The global surfing public has diverse choice in browsers, and Microsoft Internet Explorer has proven to be a very strong habit for many.

Google Chrome Frame is (from what I understand) respectful of the current user experience... people don't need to risk their existing browser habits and efficiencies, yet can still explore something new.

I like that. It's like the Adobe Flash Player... a capability which can be invoked across a wide range of HTML engines... an invisible addition, uniting browser choices.

There's a wry aspect to the news too, of course... in 140 characters: "So Google's using a browser plugin, to advance WhatWG's 'HTML5', which tries to do what plugins already do, coz plugins are bad. Is that it?" Seemed to have struck a chord.

There's no need to seek direct conflict. People have been improving browsers for fifteen years, and while growth is slow, it is steady. No need to bash plugins when announcing new feature sets.

Plugins enfranchise minority browsers... the De Facto Web is a more accessible scene than If Plugins Never Were. Objecting "because it is a Plug-in" is as empty a phrase as objecting "because it 'IS' proprietary." No need to be a hater or a killer. It's too weird to hear closedness coming from those evangelizing openness.

So, welcome Google, to the challenge of cross-browser plugins -- improving the capability of diverse consumer installations, by cooperating with their choice of browser configurations. Glad you're here, it's a little less lonely now. ;-)

(Hmm, matter of fact, why isn't there much talk yet about making an Ogg Theora set of plugins? Seems to make sense, so that sites which prefer opensource codecs can accommodate diverse audiences without making content developers sweat the multi-encoding. Here's a request from May 2009: "If you're actually seeking browser support for patent-unencumbered codecs, expanded local storage, drawing engines and such, then why aren't you making plugins for other browsers? If it's because 'plugins are not first-class citizens in the browser', then [please] improve your plugin support and cross-browser homogeneity so that they are." Why shouldn't "open codec" people make cross-browser plugins too?)

Comments are turned off on this entry, due to past history on the topic. If you'd like to do your own blogpost, then including the phrase "Advanced Support, from Diverse Audiences" in the text will let me find it find it fastest in the search engines, thanks!

What types of interactions will we have through The Internet, sitting back a few feet away from a large entertainment screen, remote control in hand?

Take a look the photo in Jessica Hodgson's WSJ article on upcoming Internet TV models. It shows a future TV with a slide-out tool bar, little application widgets available. The looks don't matter at this point -- think of the function.

You'd want to customize the types of info you can call up. Probably a notification system of some type, IM presence, caller ID, a webcam to the front door, various personal services. You probably wouldn't want to dig into a big document on that big screen -- more like quickly monitoring changing world conditions, connecting to others.

Would you want to use a web browser? to surf the Web? to pull up pages which were designed to fit a certain laptop sized screen? to have the ads and the sidebars and the third-party widgets that today's WWW pages possess? Take a look again at that photo... would you want browser panes and all up on that screen?

I don't think so. It would be good to have access to a WWW browsing tool, but the numberless millions of today's WWW pages were explicitly designed for laptop display screens. The very network effects which led to the fast growth of WWW content over the past decade make the viewing not quite satisfactory with other types of digital display screens.

Your mobile phone has a WWW browser. It's indeed handy. But if you have the choice of a fullsize screen, this is much handier. Or if the site has a parallel version designed for a small screen, then that's handier too. It's useful to be able to Surf the Web on a small screen, but the bulk of the content on today's WWW is not very friendly to unexpected display devices.

Now, the web tech itself can make the crossover across devices, I think... shouldn't be any reason why hypertext markup and JavaScript couldn't drive a good TV display too. But the World Wide Web of content, all those pages, all those sites... it's hard for me to picture that as being as much fun eight feet away from the screen with a keypad.

Web tech... that's a different subject than WWW content. That content was tuned for one screen. In a multiscreen world, we have to figure out how to migrate the useful parts of this legacy content.

If you've got a work screen, a pocket screen, and a home screen, it would be strange if they all showed the same thing. The World Wide Web's current content is largely designed to be displayed upon a workstation screen. It's legacy content.

Looking at it, you wouldn't know it was made by the Google Maps team in Japan, which has had particular privacy concerns with the service. Aside from the credits there is no Japanese, no English, no Russian or Romanian -- no spoken language, just sequential visual imagery.

Yet the meaning of the message comes across, without text. More importantly, the affective content of the message comes across too -- it's cute, compelling, leaves you with a good feeling.

We'd still need a textual representation, for people with low visual acuity or who use devices which don't have adequate display screens... it's hard to get away from the need for multiple representations of a message.

But this Google Street View animation may be one of the clearest examples of how motion graphics assist understanding, in a way that text alone cannot. We humans do learn visually. That's why animation aids access.

[Thanks to Veronique Brossier for the link!]

When successfully logged in, the Trojan requests a page from a private newsgroup, escape2sun. The page contains commands for the Trojan to carry out. The command consists of an index number, a command line to execute, and optionally, a file to download. Responses are uploaded as posts to the newsgroup using the index number as a subject. The post and page contents are encrypted using the RC4 stream cipher and then base64 encoded. The attacker can thus issue confidential commands and read responses.

This is a handy layer of indirection for a zombie master, because public message boards are harder to blacklist than known-compromised servers. But this public command-and-control method also allows security researchers to study message content, replies, and overall volume levels -- ironically, the zombie masters are publicly "opening up the source" of their network's communications.

In this particular case, debug strings and low posting volumes indicate preliminary testing -- but if this turns out to be a useful attack, it seems like it could be adopted fairly quickly.

So, should newsgroups be considered harmful? I don't see how they could be, considering their proven history of improving global communication. But this article shows that even innocuous network technology is vulnerable to being parasitized by those who don't yet deal honestly with each other.

When a shadow network is operating on citizens' machines without their knowledge, and when public communication methods are used to transmit exploitative commands, how should our networks evolve in response? What's the next step?

Implications? Here are two paragraphs from the press release by NXP Semiconductors, a chip manufacturer and an Open Screen Project partner:

"NXP Semiconductors today unveiled a new family of highly integrated system-on-chip products enabling a complete range of high-performance solutions for mainstream HD DVRs and set-top box platforms in global satellite, cable and IPTV networks. Representing the world's first fully integrated 45nm set-top box SoC platform incorporating multi-channel broadcast receivers, the NXP PNX847x/8x/9x delivers advanced broadcast decoding, media processing and graphics rendering technologies. This comprehensive feature set provides an optimized system that significantly reduces manufacturer bill-of-materials costs and power consumption and also ensures advanced picture quality for an improved home entertainment experience.

"Based on a powerful 1250DMIPS ARM Cortex-A9 Superscalar applications CPU architecture, the PNX847x/8x/9x delivers advanced system level performance for secure, multi-room DVR video streaming on home networks and for fast execution of Java-based STB middleware engines. . Combined with a rich set of hardware and DSP based content decoding resources, the ARM Cortex-A9 CPU's internet software technology eco-system delivers industry leading performance for user interface environments based on Adobe Flash and web browser technologies. Dedicated hardare for flexible content format decoding along side ARM architecture optimizations for Javascript and Flash components ensures that the PNX847x/8x/9x can deliver the most responsive and robust user experience for on-line VOD and other content delivered via the internet."

Timeline? They expect to provide device manufacturers with "sample quantities in Q4 2009", so we're still a ways off from having a sizable home audience. But groups like Intel, Broadcom, and Sigma Designs are also working on Flash/SoC integration too... seems a strong trend, like how flat screens eventually replaced cathode screens.

It may be too early to plan a business around Social TV, but it's not too early to think of the social applications they'll need. Some TV/connectivity contracts may end up being walled gardens, but the sheer diversity of chip manufacturers implies multiple business models, and I'm betting we'll see open models emerge as well.

Bottom line? We already use workstations, and handhelds, and we're getting closer to sitback screens too. Three screens, all expected to access those services we need, but all three accessing those services in different manners -- work at a workstation, fast facts on the go, and notifications and networking while watching a movie.

(There's a fourth screen too -- ambient display screens accessed by personal mobile, such as interactive wallmaps at a transit station or message-boards at a convention. Flash is already well-established in environmental signage, and the screens themselves are prevalent in many public places these days, but I don't know when we'll make the social jump to accessing and interacting with ambient displays in public places.)

The notebook-only world of applications will still be useful. But just as with desktop publishing, or CD-ROM, or World Wide Web, or RIAs, the newer areas will grow faster than the old. You'll still be able to design for a single screen, but the action will be in serving audiences across the different types of screens they own.

Just one small press release this week, one manufacturer disclosing chip and schedule details for the next generation of TV. But to me it seemed a significant marker. That third screen is finally becoming real.

More on NXP and Flash... more on Open Screen Project.

There are many people innovating in 3D via Flash today, but I'd like to make sure you're aware of a new book, "Papervision3D Essentials", from Paul Tondeur and Jeff Winder. Amazing new things are possible now, and the book shows you how to achieve it.

For more context, see Ralph Hauwert and Carlos Ulloa, two of the folks contributing to the larger Papervision3D effort.

I'm not usually comfortable plugging a book, or raising one project among others, but what convinced me to join Macromedia was seeing a demo of the "Smart3D" work of Young Harvill, back before VRML... it makes me very happy to see what people are doing with 3D today, so I'd encourage you to check into it too, thanks.

Earlier this week Adobe opened up the Text Layout Framework (advanced typography available within today's browsers via Flash Player 10) and Open Source Media Framework (component-based construction of video interfaces with advanced functionality), to both source-code publishing and community contribution.

The varied reaction was interesting... some thought this was a reaction to Silverlight, others to Ogg Theora or new font-distribution initiatives... other discussions were about the licensing model or other issues.

I was a little bit boggled. ;-) It seemed that, here in the dogdays of summer, there was more reaction to higher-level branding issues than to direct technical issues... more discussion about the relative popularity of video playback formats than of the task of creating more-capable clientside interfaces... more comparison to font-embedding proposals than to radical improvements in on-screen typography. Apples to oranges at the technical level, but a dramatic conflict at the branding level.

It prompted me to go back to the 1998 announcement of how Flash, like HTML, would publish a file format which anyone could implement... the specification was published up on the public website, in pre-license days.

(Trivia note: The early days of "Open Flash" included runtime sourcecode as well as an openly-published file-format specification... people like Olivier Debon used this for third-party players, and I believe this code was eventually reused by projects like GplFlash, gameswf and the Free Software Foundation's Gnash project. But most partners ended up needing one-on-one consultation beyond the generic runtime code, and the later inclusion of third-party audio and video codecs made public distribution of the entire codebase impossible anyway. These days SWF is more like HTML, where anyone can construct tools atop the openly published file format specification.)

Here's an example of how the 1998 news was received, in the netscape.public.mozilla.general newsgroup. It's funny that there's a similar emotional mix today -- some happy and optimistic at new capabilities, some comparing other technical initiatives or proposing further modularization of browsers, others just enjoying detailed objections and counter-objections and counter-counter-objections to previous sentences. ;-)

I particularly like the comment from Marc Byrd, who was Plugin Chief at Netscape at the time: "We also need to make plugins 'first class' from the feature and support point
of view. Developers have to be confident that the plugin solution is every
bit as robust, performant, and feature-capable as would be glomming the
feature onto the monolith." (Too bad we ended up in "plugin prison" a decade later, huh? ;-)

(The "PGML" in some of those comparisons is Adobe's Precision Graphics Markup Language, submitted to the W3C and eventually a foundation of the SVG specifications. [press release, news account])

There were other conversations in the Flasher mailing list at the time, but these were talking about the new Flash 3 and Macromedia Generator announcements as well... lots of fun browsing, but not the same overall flavor as the Mozilla discussion. Slashdot was pretty quiet on the SWF-opening of April 1998, although it did come up in discussion during "The Rise of SVG" years later.

Bottom line: Flash was told it was no good unless it was opened... until it did so... after which it was told it was still no good. ;-)

There's been a ton of "open" announcements since then, whether governance of PDF by ISO or Flex's development approach or Tamarin donations or RTMP and other specs or whatever, but the dynamics of online debate are similar today to what they were ten years ago. The positions don't change, just the rationales.

Matt Asay described a similar dynamic in an CNET article this week, asking "Why would anyone expect Microsoft and its ilk to continue to court a community that ridicules and second-guesses its every attempt at perestroika? I know from conversations with several companies that they're actually scared to engage the open-source community because the responses have been so intemperate and ideological."

Best reply I've got comes from Adobe co-founder Charles Geschke, when describing PostScript's early challenges: "If you really wanted to make it a standard -- and our goal from the beginning was to have it be a universal standard -- you have to publish. You just have no choice. You're taking the risk that someone will do a better job of implementing it. We had the self confidence that we would always have the best implementation, and that has turned out to be true."

No reason to change that just because people later try to co-opt the term. There's a need to improve the world's communicative capabilities, and weblog debates are just one of the many elements shaping how that goal is achieved.

Tom Barclay, Flash product manager: "Text Layout Framework is an extensible ActionScript library that runs on the new text engine in Flash Player 10 and AIR 1.5. Leveraging the publishing expertise of the Adobe InDesign team, Text Layout Framework offers a level of typographic control and sophistication that goes well beyond what can be done with HTML and CSS."

Features include right-to-left scripts (Hebrew, Arabic, Urdu, more)... vertical scripts (Japanese, Chinese)... font-embedding of world scripts... print-worthy typography: "kerning, ligatures, typographic case, digit case (oldstyle/lining figures), digit width (proportional/tabular figures)"... graphics nestled within live paragraphs... multi-column flow of text, arbitrary rotation, discretionary hyphenation, many other typographic necessities... text is described as external XML files. Rendered by Adobe Flash Player 10 and above.

Right now it's just a beta API within the Flex 4 Framework, with an interface like this. One application of this API to content creation is in a Flash CS4 component.

There's lots of room to grow -- lots of other ways people will want to access precise layout. It's easy to create a SWF, many authoring interfaces are possible.

Projects based on this may help with standard markup languages such as MathML and OpenMath... maybe even markup languages like MusicXML, rendering predictably across browsers, without installing anything new. Sort of a PostScript for the Web.

Resources: Release Notes... wiki... Veronique Brossier.... Mihai Corlan... info on Flex governance... weblog.

This capability is just sitting out there, in the world's browsers, today. It's waiting... waiting for us to learn how to use it.