The vague timetable that Microsoft gave Monday for pushing out Windows XP SP3 to most users got specific Tuesday as the company quietly said it would release the upgrade on Thursday at 10 a.m. PDT.

Microsoft will add Windows XP Service Pack 3 (SP3) to Windows Update at that time, and trigger its automatic download and installation for users who have left the operating system's update service at its default "Automatic (recommended)" setting.

"Updated applicability rules and updated metadata to target the update to Automatic Update channel," read a Microsoft support document revised Tuesday after the company unveiled its monthly security patches . "The Automatic Update change will be published at 10:00 A.M. on July 10."

Monday, a Microsoft manager said only that XP SP3 would be automatically downloaded and installed "shortly," but did not specify a date.

Microsoft delayed the distribution of Windows XP SP3 twice this spring, but the July 10 date seems firm; it was included in the cumulative list of all updates available via Windows Server Update Services (WSUS), the server-side update tool many businesses use, as well as via the client-side Windows Update (WU) and Microsoft Update Web-based services.

A Microsoft spokeswoman, however, was not able to immediately confirm that July 10 will, in fact, be XP SP3's automatic update debut.

In late April, Microsoft postponed the release of XP SP3 because it found a compatibility bug between the operating system and the company's Retail Management System (RMS) point-of-sale software. It also stopped the automatic installation of Windows Vista SP1, which had already been pushed to some users.

A few weeks later, Microsoft added a filter to WU to block AMD-powered PCs susceptible to an "endless reboot" problem from seeing Windows XP SP3 as an available update. In late June, Microsoft crafted a fix and added it to the WU list. Users who had WU set to automatically grab and install updates presumably have this patch already in place.

However, it's not clear how the automatic distribution of XP SP3 will affect users running AMD-equipped machines that haven't been updated with the June fix.

The announcement that Microsoft would release XP SP3 to Automatic Updates came just a week after the company started the operating system on its road to retirement by halting sales of the operating system to retail outlets and barring major computer makers from installing it on most new PCs.

People who want to block the automatic deployment of Windows XP SP3 can either modify the Windows Update settings, or download and use the Windows Service Pack Blocker Tool Kit , which provides several tools for stopping the service pack from reaching client PCs until at least April 2009.

Real Software and Veryant are upgrading development tools this week, with Real Software focused on its RealBasic platform and Veryant on Cobol.

Real Software is shipping RealBasic 2008 Release 3 on Tuesday, featuring an Attributes capability in which developers can specify compile-time metadata.

RealBasic is a cross-platform development environment for Windows, Mac OS X, and Linux. It features the RBscript scripting language. Also included in Release 3 is an update to the language's project analyzer to include warnings of deprecated functionality and other code issues. Deprecated functionality refers to features no longer actively in development.

An integrated code profiler in the product allows programmers to track performance issues within their applications. Other features include the ability to add types within classes and capabilities and improvements to the platform's introspection functionality.

Veryant is offering isCobol Application Platform Suite 2008 for developing and modernizing Cobol applications.

Featured in the product is a compiler that outputs Java byte code, enabling Cobol applications to be deployed on any platform that can run a Java virtual machine. Such platforms as AIX, HP-UX, Solaris, Windows, and Linux are supported.

Developers can write applications in Cobol or take existing Cobol applications and recompile them for use on different platforms. These applications also can be used in Web services and SOA environments as well as the Web.

"It's a tool that's used by Cobol programmers to compile their programs into executable code," said Dovid Lubin, vice president of technical operations at Veryant.

Featured in the new version are improved performance and compatibility features for applications written in IBM Cobol, AccuCobol, or Micro Focus Cobol. These enhancements making it easier to recompile those applications. Micro Focus also has been emphasizing application modernization, forging an alliance with Microsoft this month.

Also included in the suite is isCobol Web Direct, which generates HTML and JavaScript to put a Cobol UI inside a Web browser. "It allows you to bring a Cobol application to the Web without leaving Cobol," Lubin said.

A date and time selection capability has been added to Web Direct in the new release as well as more capabilities to detect user interface interactions.

Microsoft on Tuesday revealed pricing for its forthcoming hosted business productivity services and unveiled its channel model for allowing partners to resell those services. However, while the company painted a rosy picture for the partner opportunity around its evolving software-plus-services business model, not all of its partners were thrilled with the idea of Microsoft competing with them in that market.

As part of its plan to transition from providing only on-premises software to a combination of software and hosted services, Microsoft early next year will begin offering a hosted business productivity suite that includes Exchange Online, Office SharePoint Online, Office Communications Online, and Office Live Meeting for $15 per user, per month.

[ Find out more about Microsoft's move into hosted services:  Microsoft's cloud forms ]

The company unveiled the pricing for its forthcoming hosted services at its Worldwide Partner Conference (WPC) in Houston this week. Microsoft's hosted services partners already can offer customers this package through Microsoft's Hosted Messaging and Collaboration 4.5, which the company released two weeks ago.

Individually, Microsoft will be selling hosted Exchange Online for $10 per user, per month; SharePoint Online for $7.25 per user, per month; Office Communications Online for $2.50 per user, per month; and Office Live Meeting Online for $4.50 per user, per month.

This means if customers buy the entire suite, they are getting a 38 percent discount than if they buy the products individually, said Microsoft director of online services Eron Kelly on a conference call Tuesday.

On top of its hosted business productivity services, Microsoft also introduced two "deskless" items that allow companies to offer workers who don't necessarily sit in front of PCs but still need access to e-mail and internal company Web sites access to those online services. Exchange Online Deskless Worker and SharePoint Online Deskless Worker will be available for $3 per user, per month early next year.

Microsoft is facing competitive pressure from Google, which is offering similar hosted services to business customers, and so had to price its hosted services competitively.

But this also puts them in direct competition with hosted-services partners that have been offering their own hosted services using Microsoft software infrastructure. And its traditional reseller partners also won't see the kind of margins in reselling services that they've seen with reselling software licensed in the traditional per-CPU way, they said.

One former Microsoft partner who asked not to be named suspects that Microsoft knew it would cause its hosting partners grief if it went ahead and offered its own hosted services, but thought it was a small price to pay compared to losing that business to Google.

"I think they looked at one hand [and] they looked at Google, which was causing all kinds of headaches and is tough competition, and looked at a set of long-term hosted Exchange partners and thought, 'Who can we afford to [tick] off more?'" he said. "It's obvious what they chose."

Danny Essner, director of marketing for Microsoft hosted Exchange partner Intermedia, said Microsoft's pricing for its hosted services is "very aggressive" and will force the company's hosted partners to "move up the stack to preserve profit margins."

For example, Intermedia can offer mobile e-mail support for BlackBerry users on a hosted version of Exchange, while Microsoft does not offer this service.

However, even if hosted partners may have to work harder now that Microsoft is competing with them, Essner said the fact that Microsoft is "bringing market education and market awareness" to the hosted services space is a good thing for anyone providing these services.

Indeed, Scott Gode, vice president of marketing for another Microsoft partner, Azaleos -- which offers managed services for Exchange customers that install the software on premises -- said many customers prefer to have their proprietary e-mail hosted on site rather than farm that out to a third party.

"There is still a huge percentage of customers that will run it locally and want to run it locally because of security concerns," he said of Exchange.

But even if Microsoft knew some partners might be unhappy with their new, yet necessary, business model, the company certainly doesn't want to cut its loyal partner channel out of its services strategy, which is where it's new customer-referral model around hosted services comes into play.

Partners can offer Microsoft's hosted business productivity services to customers and receive 12 percent per user, per month, up front for a first-year contract, and 6 percent per user, per month, of the ongoing subscription fee, the company said. So in the first year, resellers of hosted services will receive 18 percent margins on the subscription value, and 6 percent for subsequent years, Microsoft's Kelly said.

Microsoft also is encouraging partners to add value to the sale by doing what they have always done best: offering integration, consulting, and management services on top of any vendor products their customers buy, whether hosted or on-premise.

In an interview Tuesday after her keynote at the WPC, Allison Watson, corporate vice president for Microsoft's worldwide partner group, said Microsoft studied subscription-based partner models in other markets -- such as the mobile business market -- and did extensive work with partners to help come up with the margin percentages for its hosted services

"Not only are the upfront fees fair for the referral, but the follow-on fees allow [partners] to build a rich annuity stream," she said.

However, Watson did acknowledge that some partners are worried that by reselling Microsoft's hosted services in a referral program, they will be doing a lot of the legwork to secure customers and lose control by merely turning them over to Microsoft, since the company handles the support and billing for the services.

She attributed this to fear among partners that they will not be part of the ongoing relationship with the customer, which is not the case.

"The concern you've heard is valid and I hear that as well," Watson said. "But once we sit down and walk them through the user experience of the customer and partner interaction online, it will create good optimism about their ability to be a rich part of the solution."

For instance, for partners who manage current customer Enterprise Agreements with Microsoft, the company's hosted business productivity suite will be just another product SKU in that agreement, she said. This means that partners will get existing revenue margins on Microsoft hosted services that their customers purchase just as they would on any other product, and continue to maintain their relationship with customers, Watson said.

Adobe is developing a mashup interface code-named "Genesis" that will allow business users to pull together "workspaces" that combine assets such as business application data, documents, and analytics, along with collaboration tools such as instant messaging.

Users will be able to download a free desktop-based client, while Adobe will provide a hosted sharing and collaboration infrastructure, "allowing users to adopt Genesis without or only minimal involvement of the IT department," according to a blog post by Matthias Zeller, group product manager.

[ Adobe is bringing even more capabilities to the desktop with AIR. For additional info, see InfoWorld Test Center's review and Tom Yager's evaluation of the software. ]  

Despite the advent of Web 2.0-era tools like wikis, most enterprises haven't gone much beyond the old standbys, such as e-mail and voice mail, Zeller said.

"I am convinced that there is another major white space today that is not being covered by [Web 2.0] tools: A workspace on my desktop, which allows me to mash-up applications and documents in a business context (e.g. a specific customer deal I am working on), share that workspace with others (e.g. sales engineering and legal team) and then collaborate asynchronously or in real time," he wrote. "In a nutshell, that's what we want to deliver with Genesis."

That said, other vendors, such as IBM, have been moving to provide mashup technologies to business workers.

To fine-tune its entry, Adobe is conducting a number of "road shows" to get initial feedback from typical Genesis users. Initial tour areas include Dallas and Austin, Texas; Seattle; Portland, Ore.; and Chicago. "We are specifically interested to talk with sales management, sales operations management, finance management (focus on financial planning and analysis) as well as IT professionals in charge of enterprise collaboration," he wrote.

The blog states that a private beta of the service, which is built with the company's Adobe Integrated Runtime (AIR), will be launched later this year.

In a demo, Zeller shows how users can drag various "tiles" -- prebuilt widgets with a specific function, such as a sales pipeline dashboard -- onto a "workspace."

Users can then begin sharing their completed workspace by sending access to others through the hosted service. Once logged into the service, presence indicators on workspaces show who it has been shared with and whether they are available to collaborate, such as by instant message.

To enable users to get up and running quickly, Adobe wants to deliver a lot of prebuilt workspace templates oriented around themes such as "project management" or "hiring process," according to the demo.

Adobe also plans to host a marketplace where third-party developers can sell tiles, according to the demo.

In an e-mail Tuesday, Zeller stressed that the project is still in an early phase and he could not immediately provide a full interview.

He did reveal that the initial idea for Genesis arose from discussions with Business Objects, with which Adobe formed a partnership last year.

Adobe will make money on Genesis by charging a subscription fee to users who want to share workspaces, conduct real-time collaboration -- or both -- according to Zeller's e-mail. "There are some more ideas of how to generate revenue, which I can't discuss yet," he added.

One Adobe user had a generally positive reaction to the company's plans.

Bob Gourley, former CTO of the U.S. Defense Intelligence Agency, has been using Adobe's Connect and Acrobat.com collaboration offerings for his consulting business. Those tools and the workspaces concept in Genesis collectively generate "a really disruptive capability," he said in an e-mail.

Gourley has questions, however: "I wonder what their price point will be. I also wonder about the governance needs that enterprises like. For example, will it connect with LDAP or Active Directory? Is it PKI-enabled? What auditing capabilities will be enabled?"

Ronald Schmelzer, an analyst with ZapThink, largely echoed Gourley. "If there's any company that can do the lightweight enterprise mashup thing credibly, it's Adobe," he wrote in an e-mail. "The challenges they face to their vision are mostly focused around governance and security."

Zeller addressed the security questions in his e-mail.

"The initial version of Genesis will be a hosted service and will include user management. Users can maintain their own contact lists and decide who they share a workspace with (with different levels of usage rights)," he wrote. "There will also be the option of an enterprise hosted service which will allow synch with corporate LDAP and enterprise-specific catalogs and management." In the future, the company will also consider creating an on-premise version, depending on customer feedback, he wrote.

Microsoft has patched bugs in its Exchange, SQL Server, and Windows software that could give hackers new ways to break into computers.

The company released four sets of patches Tuesday, all rated "important." They address a total of nine bugs in Microsoft's products.

Although Microsoft has not rated any of its patches as critical, they will still keep corporate system administrators busy this week, said Andrew Storms, director of security operations with security vendor nCircle. "Not only will the IT admins have their hands full with the normal client-side updates, but they also need to go patch two of the most important enterprise services in an organization -- e-mail and databases," he said via instant message.

Security experts say that the DNS (Domain Name System) bug , is particularly worrisome. That's because the bug is due to a design flaw in the DNS protocol that affects all DNS servers on the Internet.

By sending certain types of queries to DNS servers, the attacker could then redirect victims away from a legitimate Web site -- say, Bofa.com -- to a malicious Web site without the victim realizing it. This type of attack, known as DNS cache poisoning, doesn't affect only the Web. It could be used to redirect all Internet traffic to the hacker's servers.

The bug could be exploited "like a phishing attack without sending you e-mail," said Wolfgang Kandek, chief technical officer with Qualys.

Other DNS software providers, including the Internet Software Consortium, Cisco and, Sun are also patching this vulnerability.

Although this flaw does affect some home routers and client DNS software, it is mostly an issue for corporate users and ISPs that run the DNS servers used by PCs to find their way around the Internet, said Dan Kaminsky, the IOActive security researcher who discovered the problem. "Home users should not panic," he said in a Tuesday conference call.

One of the bugs that Microsoft patched on Tuesday had previously been disclosed, making it a priority fix. That flaw, which lies in the version of Windows Explorer used by Vista and Windows Server 2008, could give criminals a way of running unauthorized software on a Windows PC. For that to happen, the attacker would first have to convince the user to open and save a specially crafted saved-search file using Windows Explorer.

Exchange shops that read e-mail via the Web should give the Exchange patch a top priority, Qualys' Kandek said. That's because it can be exploited to attack users of Outlook Web Access (OWA) for Microsoft Exchange Server with a cross-scripting attack. By sending maliciously encoded e-mails to OWA users, attackers could theoretically steal e-mail credentials and install malicious software on a victim's system, he said.

Finally, the SQL Server patch fixes four bugs that affect all supported versions of SQL Server.

At the Worldwide Partner Conference in Houston, Microsoft made its biggest foray yet into cloud computing with pricing and partnership arrangements for Microsoft Online Services, a family that includes Online versions of Exchange, SharePoint, Office Communications, Office Live Meeting, and Dynamics CRM.

Microsoft's uniform pricing and low subscription rates stand out. Whether Microsoft or its partner/resellers make the sale, the cost per seat for all of the above applications (not including Dynamics CRM) bundled together runs just $15 per seat per month. For browser-based versions of Exchange and SharePoint -- an offering that targets so-called "deskless" workers -- the price drops to a rock-bottom $3 per month per seat. In both cases, partner/resellers reap 12 percent of the first-year contract price plus 6 percent of the ongoing subscription fee.

[ Learn ?more about what cloud computing really means?and the new breed of utility computing and platform-as-a-service offerings. ]

According to Eron Kelly, Senior Director of Microsoft's Business Online Service Group, the new offerings "help customer deployment times shift from months to minutes." And for Microsoft partners, the pricing model "provides a way for them to participate in Microsoft's transformation to software plus services. They will be able to generate ongoing, recurring revenue streams."

The focus on Microsoft partners reveals a keen sensitivity to potential channel conflicts. Numerous partners already host Exchange and SharePoint for their customers and can continue to do so. In the new Online Business offering, however, Microsoft itself will also run multitenanted versions of Exchange, SharePoint, Office Communications, Office Live Meeting, and Dynamics CRM -- while enabling partners to customize, add value, and enjoy a slice of the revenue.

The value-adds apply mainly to Exchange and SharePoint. For example, said Kelly, partners could help customers set up Active Directory on premise and migrate an existing mail store to an instance of Exchange running on Microsoft servers. With SharePoint deployments, which typically involve significant customization, Microsoft will run the SharePoint core while partners help customers engage in such tasks as building templates that reflect their brand.

Kelly acknowledges that Microsoft's Online Services are not multitenanted across the board. If a customer needs a SharePoint template that runs custom code, for example, that template must run locally and call Microsoft's multitenanted instance of SharePoint via Web services APIs. SaaS (software-as-a-service) companies like Salesforce, by contrast, have offered full multitenanted applications with self-service customization for years. Kelly provided no firm date, but asserted that eventually all features of Microsoft Online Services will be multitented.

Microsoft rattled off a long list of beta customers for Microsoft Online Services at the announcement, including Eddie Bauer and Nokia. The fully cooked version at the quoted per-seat prices will be available to all this fall. And according to Kelly, Microsoft's Global Foundation Services Group will ensure the company has enough datacenter capacity to handle the new load.

Facing heat over privacy worries, NebuAd said Tuesday it has a new notification and opt-out system for its targeted advertising system that critics say is invasive and spies on users.

With access to an ISP's network, NebuAd's system monitors Internet browsing in order to deliver targeted advertisements related to search queries and Web sites a person has viewed.

NebuAd said it has developed a "direct online notification system" that would give consumers periodic reminders -- which could be used in addition to regular mail and e-mail -- that they are enrolled in the ad system.

The company also said it has developed a network-based "opt-out" mechanism that does not use cookies, a small data file stored on a user's PC. One of the ways targeted advertising systems can recognize if a person does not want to be in the system is by checking to see if an opt-out cookie is present.

An opt-out system using a cookie poses a problem if the cookie is deleted, as Web browsers have a control where users can flush out all cookies. That would mean users would potentially need to go through the opt-out process again to be excluded.

Behavioral targeting is seen as the next big advancement in advertising technology, but one that has stirred much controversy over potential conflicts with legal restrictions on wiretapping and consumer privacy rights.

ISPs, which face slim profit margins providing broadband service, could benefit from the systems by gaining a new stream of ad revenue. But privacy activists fear the systems could be presented to consumers in deceptive ways in addition to posing a risk if the collected data is mishandled.

NebuAd maintains its system can anonymously assign ads to people without retaining sensitive personal information.

NebuAd's announcement comes as its ISP partners are bailing out over fears they will alienate customers. Charter Communications, one of the largest cable broadband suppliers, cancelled a planned NebuAd pilot last month.

Another ISP, WOW -- which provides cable, Internet, and phone service to Illinois, Michigan, and Ohio -- has also suspended its deployment of NebuAd since the U.S. Congress started looking into behavioral advertising, a NebuAd spokeswoman said.

Efforts to reach NebuAd CEO Bob Dykes were unsuccessful on Tuesday. Dykes is scheduled to testify Wednesday before the Senate Commerce, Science and Transportation Committee, which will examine privacy issues around online advertising.

A report released last month by two digital rights watchdogs, Public Knowledge and Free Press, concluded that NebuAd's technology forged and modified TCP/IP packets and placed other cookies on a user's PC, techniques widely frowned upon by security experts.

NebuAd isn't the only company testing the choppy waters. In the U.K., Phorm has struck agreements with three ISPs -- incumbent operator BT, Virgin Media, and Carphone Warehouse -- to trial its targeted ad system called Webwise as well as its Open Internet Exchange ad bidding system. Phorm also has offices in New York and Moscow.

The U.K.'s telecommunications regulator has said Phorm's system is OK as long as consumers willingly join the system. However, opposition is growing, and anti-Phorm activists plan to protest BT's plan to use the system at the company's annual meeting next week.

Google has open-sourced its protocol buffers, the company's lingua franca for encoding various types of data, in order to set the stage for a wave of new releases, according to official company blog posts and documents.

"Practically everyone inside Google" uses protocol buffers, states a FAQ page . "We have many other projects we would like to release as open source that use protocol buffers, so to do this, we needed to release protocol buffers first."

Google uses "thousands of different data formats to represent networked messages between servers, index records in repositories, geospatial datasets, and more," wrote Kenton Varda, a member of Google's software engineering team, in a blog post. "Most of these formats are structured, not flat. This raises an important question: How do we encode it all?"

The ubiquitous XML (extensible markup language) is not efficient enough for Google's data-sharing needs, according to Varda: "When all of your machines and network links are running at capacity, XML is an extremely expensive proposition."

With protocol buffers, "you define how you want your data to be structured once, then you can use special generated source code to easily write and read your structured data to and from a variety of data streams and using a variety of languages," according to a documentation page. "You can even update your data structure without breaking deployed programs that are compiled against the 'old' format."

Protocol buffers are three to 10 times smaller and 20 to 100 times faster than XML, according to Google.

But XML has some advantages for certain tasks, according to the documentation: "Protocol buffers would not be a good way to model a text-based document with markup (e.g. HTML), since you cannot easily interleave structure with text. In addition, XML is human-readable and human-editable; protocol buffers, at least in their native format, are not."

Google has prepared a download page that contains protocol buffer compilers for Java, C++, and Python.

MessageLabs, best known as a provider of e-mail security services, last week introduced a managed e-mail backup service that has as a selling point the same security features built into the company's other products.

The security angle could be an important feature for MessageLabs, since security is a recurring issue for remote backup systems.

Like the company's other products, MessageLabs Email Continuity is SaaS (software as a service) and is integrated with other offerings such as encryption or content policy enforcement services, MessageLabs said.

The service enables continuous Outlook, Webmail, and BlackBerry access and can scale up to the needs of large organizations, the company said.

Failover can be activated within a minute, and administrators can specify which parts of the organization have been affected by an outage. Priority can also be set for which systems are synchronized back to Exchange once the outage is over.

Synchronization covers corporate directories, user accounts, contacts, calendars and distribution lists, and sent and received e-mail data is restored to the primary system along with forensic information after the outage, MessageLabs said.

Administrators have the option of a retention feature, where the backup system gets an encrypted copy of every e-mail sent or received while the primary system is operating normally, as an extra safeguard.

The system cuts back on bandwidth usage by sending only a single copy of each e-mail to the backup system, even for messages sent to multiple recipients.

MessageLabs has made its reputation through e-mail security services, with offerings such as the Boundary Encryption Service, protecting e-mail sent between business partners, and Email Content Control and Email Image Control, which scan e-mails for inappropriate, confidential, or malicious content sent or received by an organization's employees.

Techworld is an InfoWorld affiliate.

Taiwanese electronics maker Giga-byte Technology has teamed up with mobile phone service provider Chunghwa Telecom to launch the M528 mobile Internet device in August, a Giga-byte representative said.

The M528 is a small, handheld device with a 4.8-inch touchscreen that runs a Linux OS and uses an 800MHz Intel Centrino Atom microprocessor as its calculating engine. It's part of a new breed of handheld devices the PC industry hopes will catch on as a way for people to surf the Web from just about anywhere. What makes it different from a mobile phone is its larger screen. The biggest mobile phone screens, even when the entire face is used, still top out at around 3 inches.

The M528 will be packaged with 3G service from Chunghwa Telecom when it launches in Taiwan, for HSDPA/HSUPA (High Speed Downlink/Uplink Packet Access) Web surfing. The device can also access the Web via Wi-Fi 802.11b/g.

The Giga-byte representative said the price of the handheld hasn't yet been determined since it will be bundled with a 3G contract. The hardware may be priced lower to entice users to sign up for Chunghwa's service.

The M528 weighs just 340 grams and is 152 millimeters by 80mm by 22.5mm. It has a Qwerty keypad with a backlight that slides out from underneath so that people can use their thumbs to type messages or Web addresses.

The handheld is built for multimedia. It comes with a 4GB SSD (solid-state drive) to store music, photos, and other data, an earphone, and a 3-megapixel auto-focus camera on one side, with a 300KB Webcam on the front for video chat.

The device can transfer files wirelessly via Bluetooth 2.0, and it has USB and other ports, as well as a micro-SD card slot.

Microsoft has announced it will upgrade Windows' update mechanism later this month, a warning that comes nearly a year after the company issued a similar upgrade without informing users.

Last September, reports of Microsoft conducting a "stealth" update of its Windows Update (WU) service angered users and put the company on the defensive.

"Beginning at the end of this month and continuing over the next few months, we'll be rolling out an infrastructure update to the Windows Update agent," said Michelle Haven, a product manager in the Windows Update group, in a posting to the team's blog late last Thursday.

Haven went on to say that the update would affect both Microsoft's back-end update infrastructure as well as the client-side software necessary to use WU directly or access it through a Windows Server Update Services (WSUS) server. She also said users would see few, if any, visible changes in the WU software or process, but that scanning performance would improve. "We've invested heavily in reducing the amount of time it takes the Windows Update agent to scan to see if new updates are available," she said. "We've seen some instances of the scan times on some machines decreasing almost 20%."

Microsoft revises the WU infrastructure and client software annually, said Haven.

Haven's pre-release announcement was in stark contrast to last year, when users raised a ruckus after discovering that Microsoft had updated files related to the Windows Update client even when they had disabled the operating systems' automatic installation option.

Microsoft's response then was that it had engaged in the practice before, and the client-side software needed to be updated -- no matter what the user settings -- in order to guarantee receipt of future security patches.

Haven made the same case last week. "To avoid a false sense of security, the Windows Update client automatically checks for and installs any available infrastructure updates anytime a system uses the Windows Update service, independent of the settings for how it handles updates," she said.

The only setting that will not result in the WU client software being updated, Haven added, is the "off" option, which is labeled "Turn off Automatic Updates" in Windows XP and "Never check for updates" in Windows Vista.

Some users weren't happy, even with Microsoft's advance notice. "It [is] unfortunate you didn't take the opportunity of XP SP3/Vista SP1 to fix this obviously incorrect behavior and regain users' trust, especially after the contraversy [sic] this caused back in September," said a user identified only as "thingy" in a comment to Haven's post. "As it is, you are still ignoring an explicit user instruction to 'don't download or install things on my machine without my permission'."

Last year, after the initial reports of WU's stealth updating, Microsoft acknowledged it could have done a better job informing users. "The point of this explanation," said Nate Clinton, a WU program manager in September 2007, "is not to suggest that we were as transparent as we could have been; to the contrary, people have told us that we should have been clearer on how Windows Update behaves when it updates itself.

"We are now looking at the best way to clarify WU's behavior to customers so that they can more clearly understand how WU works," he added at the time.

Enterprise that rely on WSUS servers to get patches and hotfixes to users will also be affected by the WU software update, noted another Microsoft manager.

"WSUS-managed end-user[s] who navigate to WU to perform an interactive sync will receive an updated version of WUA [Windows User Agent] as this new agent is rolled out over the next few months," said Marc Shepard, a program manager with the WSUS group, in a separate post on Monday. "Machines whose end-users don't explicitly navigate to WUA to perform an interactive scan will continue to use the existing version of WUA. This will result in a mixture of WUA versions in most corporate environments."

Shepard said that the mix shouldn't matter, since the new version of WGA, the WU client software, is backwards compatible, and will continue to connect with WSUS servers.

Computerworld is an InfoWorld affiliate.

Cybercriminals are exploiting a bug in software used by Microsoft's Access database program in a new online attack, Microsoft warned Monday.

The flaw lies in the Snapshot Viewer ActiveX control, which ships with "all supported versions of Microsoft Office Access except Microsoft Access 2007," Microsoft said in a security advisory, published Monday.

Microsoft released few details of how the bug is actually being exploited, but said that it is investigating an ongoing computer attack that takes advantage of the problem. "The attack appears to be targeted, and not widespread," wrote Bill Sisk, a Microsoft spokesman, in a blog posting.

Attackers are trying to lure victims to a specially crafted Web page that tries to run the attack code within Internet Explorer. The bug gives attackers a way to run their malicious software on the victim's machine.

Microsoft's Security Advisory offers a number of possible work-arounds for the problem, but the company has not said when it plans to fix the underlying bug.

"We encourage affected customers to implement the manual work-arounds included in the Advisory, which Microsoft has tested," Sisk said. "Although these work-arounds will not correct the underlying vulnerability, they help block known attack vectors."

Snapshot Viewer lets PC users view a Microsoft Access report without having to run the Access software itself. It can be downloaded as stand-alone software.

Because the vulnerable ActiveX control is digitally signed by Microsoft, some users could be attacked even if they haven't installed the Snapshot Viewer control. Victims who have configured Internet Explorer to trust Microsoft software could be forced to silently download the buggy viewer and then be attacked via the Web, said Matthew Richard, director of VeriSign's iDefense Rapid Response Team.

Microsoft has made a concerted effort to lock down its core Windows operating system over the past five years and, as a result, hackers have increasingly turned to third-party software and ActiveX components like Snapshot Viewer when looking for bugs.

In April, criminals began using software that included attack code for seven ActiveX bugs, including flaws in controls made by Microsoft, Citrix Systems, Hewlett-Packard, Sony, and D-Link.

This latest issue is "another in the long line of ActiveX bugs," said Andrew Storms, director of security operations with nCircle, via instant message. "It's disheartening to see yet another ActiveX problem."

Microsoft is adding a feature to its controversial SAM (software asset management) program that it claims will benefit corporate IT users by giving them a scorecard for evaluating their internal asset management processes.

The SAM Optimization Model, which is being announced at Microsoft's Worldwide Partner Conference in Houston this week, is a free tool that can be used by corporate customers or by value-added resellers and other Microsoft business partners. Companies undergoing an evaluation -- always performed internally or by partners, never by Microsoft directly -- are given a rating for their SAM efforts on a four-stage scale, from Basic for worst to Dynamic for best.

According to a Q&A with Michael Beare, Microsoft's director of license compliance, that was posted today on the software vendor's Web site, companies that treat software like they do other assets, such as real estate and intellectual property, are less likely to waste money buying products that end up being unused. Their networks also are less likely to be hit by vulnerabilities because of the presence of unmanaged and unpatched software, Beare contended.

In addition, companies that actively manage their software assets are more apt to engage in smart business practices, such as funneling purchases to a single reseller in order to maximize their volume-based discounts, Beare said. And finally, he maintained that they are less likely to consciously pirate software or inadvertently be out of compliance with their software licensing contracts.

The compliance issue has made many IT managers leery of taking part in Microsoft's SAM initiative.

Some users said in the past that they were uncomfortable with the idea of giving Microsoft and its agents so much insight into their IT infrastructures. Others have complained that the SAM program arms Microsoft with ammo for possible software audits that could occupy customers for months even if they're vindicated in the end.

In the Q&A, Beare indirectly acknowledged that the SAM process continues to have a poor reputation with many customers. "Unfortunately, in many areas of the world, there is still much confusion about what SAM is; in these areas, we see a focus only on licensing reviews or audits, which . . . is really only part of the picture," he said.

But he insisted that the SAM Optimization Model evaluations are separate from formal software license reviews or audits that could be conducted by Microsoft or other parties, such as the Business Software Alliance in the case of companies suspected of piracy. "The focus is only on SAM policies, processes and tool evaluations," Beare said. "Partners don't want to be software compliance enforcers."

IBM began on Monday an open beta program for the second product based on its Jazz ALM (application lifecycle management) platform, IBM Rational Requirements Composer.

Due for general availability by the end of this year, Requirements Composer is intended help software delivery teams gain a consensus on project design. The tool actually is first used by those who stipulate application requirements, which are then filtered to developers.

"This is a tool really for the business analysts, product managers, more business-oriented users," said Dave Locke, Rational marketing director.

Requirements Composer features visual and collaborative components, such as storyboards, sketches, scenarios, and models. Business analysts can solicit ideas and clarify business issues before committing resources to a project. The tool provides an alternative to manual, unstructured processes, Locke said.

Users of Requirements Composer could, for example, set up requirements for a loan process application, he said. Pricing for the product has not yet been set.

Jazz is IBM's project to build a software development platform for distributed teams. The first Jazz product was Team Concert, enabling collaboration between teams and utilizing technologies like instant messaging and presence awareness. Version control and work item and build management capabilities also are featured.

IBM plans to have 20 products available by the end of the year that leverage Jazz technology. Among these are Rational Quality Manager, for managing a test lab, and upgrades to the ClearQuest process automation tool and ClearCase configuration management tool.?

Until recently, many CIOs didn't know how much electricity their IT equipment used, and they didn't care.

The electric bill was someone else's responsibility -- usually the head of facilities -- so they didn't track it, and they weren't motivated to reduce it. They didn't factor energy efficiency into their IT purchasing decisions, either.

Now, with a stagnating U.S. economy, CIOs need to squeeze every penny out of their IT operations, and that means choosing the most efficient servers and desktops, as well as datacenter power supplies and air conditioning systems.

CIOs are being hit from all sides to become environmentally savvy, not just because it sounds good but because it cuts costs, drives profitability and improves competitiveness.

We've put together a list of the Top 10 people who are pressuring CIOs to green up their IT practices.

1. CFOsPressure gauge reading: 10The No. 1 reason CIOs are greening up their IT operations is to save money.

By reducing the amount of electricity or chilled water used in their data center operations, CIOs can contribute money straight to the company's bottom line, and that's what the CFO wants to see.

"The whole notion of being green is associated with making some sort of a sacrifice ... one less shower, driving a smaller car, changing out light bulbs," says Albert Esser, vice president of power and infrastructure solutions at Dell. "For green IT, that is just not true. Anything you can do to be green in IT will help your bottom line, will help your operations, and will help your service-level agreements....With green IT, there's no sacrifice involved."

Esser says CIOs can't afford not to be green. Dell, for example, has saved $1.8 million and reduced its carbon emissions by 11,000 tons in one year by requiring 50,000 employees to put their desktop computers into sleep mode each night.

"Companies that are embracing green IT practices today will have stronger balance sheets in five to 10 years than ones that don't," Esser adds. Green IT "contributes to the bottom line and allows you as a company to be a more responsible citizen in the corporate world."

Cimarex Energy, a Denver oil and gas exploration company, recently bought two American Power Conversion (APC) InRow cooling solutions because the units allow Cimarex to pack more IT equipment into the floor space of a datacenter located on the 11th floor of a high-rise building in Tulsa, Okla. The APC units use 50 percent less chilled water and produce more cool air in a datacenter expansion than Leibert units in the original data center space.

"In our old room, we have 600 square feet, and we can rack 35 servers because of the Leibert units," says Rodney McPhearson, project manager for Cimarex' enterprise infrastructure team. "Our new space is about 300 square feet, and with the APC units we can populate 112 servers."

McPhearson says his primary driver for selecting the APC units was to save floor space, but he's benefiting from savings in chilled water, too. Electricity costs for the APC and Leibert systems are about the same.

"Our new room runs about $1,000 a month for chilled water. Our old room runs around $2,300 a month for chilled water," McPhearson says.

McPherson says Cimarex is taking other steps to improve the efficiency of its datacenter operations, including consolidating and virtualizing servers.

"I get a lot of budget pressure," McPhearson says. "Efficiency is very important to me because I have to make a good business case. I'm focused on my ongoing operating costs."

Jim Smith, vice president of engineering with datacenter operator Digital Realty Trust, says reducing capital expenses is as important as reducing operating expenses when it comes to green IT.

"If you can design more efficient datacenters, you can reduce the operating budget and you can reduce the capital costs," Smith says. "We're huge proponents of that.... The big money is going to be made in reducing capital expenses."

2. Electric utilitiesPressure gauge reading: 10IT operations come to a screeching halt without electricity, and in some parts of the world, the availability of reliable power is the main driver for improving the energy efficiency of corporate IT operations.

In London, Mumbai, Tokyo, and New York City, datacenter operators can't get more power to their sites. If they want to add new servers, they need to retire older ones. They can't plan on datacenter expansion; instead, they need to eke the most amount of processing power out of the datacenters they have.

"Datacenters are reaching their capacity in electricity," says Simon Mingay, research vice president at Gartner. "As organizations go to more dense, power-consuming technologies like blade servers, datacenters are reaching their limits.... Squeezing more watts out of the datacenter is absolutely what CIOs care about."

The lack of available power from utilities is why corporate IT buyers are starting to look at new metrics like performance per watt of servers and desktops. It's also why datacenter operators are consolidating facilities and driving up their watts per square foot.

"One in four datacenters around the globe is going to have an outage due to power over a five-year horizon," predicts Brian Brouillette, vice president of datacenter services at HP. "As companies are in growth mode and they are figuring out how to consolidate datacenters, the issue that everybody is talking about now is cost. But the availability of power is a close second."

Over the last 36 months, HP has consolidated 85 datacenters down to six, two each in Austin, Texas, Houston, and Atlanta. Key to HP's strategy was making sure the remaining six datacenters are as energy efficient as possible.

"If IT is fundamental to the way you run the business and you want to grow the business, you need more capacity online faster," Brouillette says. "If the CIO can't do more with its datacenters, he can't meet the CEO's needs."

Companies that can't squeeze enough power out of their existing datacenters are stuck building new ones at a significant capital investment or outsourcing to providers like Savvis and RackSpace.

"The number of new datacenter builds because there's no power at the existing datacenter is phenomenal," says Shally Bansal Stanley, managing director of Acumen Solutions, an IT consulting firm. "You can't get power generators. They're on back order.... We're consuming the datacenter utility faster than it can be created."

Some electric utilities -- particularly California's PG&E -- offer rebates to corporate customers if they improve energy efficiency. Around 20 electric utilities offer such rebates, according to Climate Savers, an IT industry group that promotes energy savings that can be gained from purchasing the most efficient desktop computers and turning them off at night.

"In order to get some of the rebates, you have to give back the excess power," Stanley says. "You have to show that you reduced it and not redeployed it. Most of our customers are redeploying it. They're optimizing it so they can use it."

The scarcity of electric power in some locations is driving up the cost, so the two go hand-in-hand in driving CIOs to go green.

"We have a customer -- a financial services institution -- that was paying $6 million a year to the electric company for a datacenter. The electric utility told him that over the next 12 months, that cost was going to be $2.1 million higher," Brouillette says. "Nobody is giving him that extra money. This becomes a really big problem, really fast."

3. CEOsPressure gauge reading: 8CEOs are under increasing pressure to use natural resources -- energy, water, land -- in a more responsible, sustainable way. Urged on by outside directors and shareholders, CEOs are expected to understand their carbon footprint and start taking steps to reduce it.

For CIOs, C-suite pressure means not only reducing the amount of electricity they consume but switching their IT operations to locations with greener sources of power. That's why more datacenters are being built using hydro in the Pacific Northwest, nuclear in Chicago, and geothermal in Iceland.

CEOs "have to have a sustainability strategy that meets or exceeds the expectations of customers and shareholders," says John Skinner, marketing director for eco-technology at Intel. "One of the first people the CEO turns to is the CIO because the CEO understands that technology is an enabler of efficiency ... CEOs are turning to CIOs as allies to help identify how technology -- not just computers, but air conditioning -- can improve the efficiency of the entire corporation."

European CIOs are ahead when it comes to measuring their carbon footprint and understanding the trade-offs in how their IT equipment purchases and management decisions affect this metric.

"The cost in energy around the world varies, but the trend in unit cost per kilowatt hour is going up, and it's going up way ahead of inflation. That's pretty universal, and it's increasingly a point of contention," Gartner's Mingay says. "In the U.S., [cost of energy] is the most important driver. It's maybe 80/20, cost savings or cost avoidance vs. carbon footprint. In Europe, it's 60 percent about cost savings and 40 percent about carbon reduction."

How much pressure CIOs are under to reduce their carbon footprint depends on their industry. In a manufacturing business, where IT might count for 1 percent of total carbon emissions, there's not as much pressure as there is on a Web portal where IT is the business.

"For knowledge industries, like financial services, banking, pharmaceuticals, and the public sector, IT is going to be a much bigger portion of carbon footprint and more of a focus of attention," Mingay says. "We think the need for action on climate change will increase significantly in the U.S. over the next two to three years. This will be a pressure on CIOs to be contributing toward carbon reduction."

Acumen's Stanley says the pressure on CIOs to reduce their carbon footprint because of a CEO-initiated green initiative is less than the pressure to maximize their data center footprint and keep electricity costs down.

"The biggest pressure on IT executives is datacenter footprint. That's No. 1," Stanley says. "Cost savings and energy efficiency is No. 2, particularly from a hardware perspective. Being green is a distant third as far as motivation is concerned."

For now, "the green that they are focused on the IT side of the house is the color of money," Stanley adds.

4. LawmakersPressure gauge reading: 5In Europe, with its cap-and-trade program for greenhouse gases, the pressure on CIOs to measure and reduce their carbon footprint is real. But in the United States, the regulatory pressure on CIOs is considerably less because comparable legislation doesn't exist here.

"Based on potential changes in Congress, there may be some form of regulation," says Erik Teetzel, renewable energy manager at Google. "The fact that this administration is ending may encourage people to start taking inventory of their emissions" before regulation passes.

Teetzel says most CIOs don't feel pressure to adopt green IT practices created by lawmakers yet. But forward-looking companies like Google are identifying areas where they can cut back on their carbon footprint whether or not legislation is passed.

"People will get ready for action" related to regulatory compliance, Teetzel adds.

"Some organizations are looking at this in terms of acting now so that if and when there should be any regulation, they are in a better position to respond," Gartner's Mingay says. "Since there's no mandate, this is more of a risk avoidance than an actual pressure."

CIOs in some leading-edge industries, such as Internet services, feel the need to self-regulate before any carbon footprint-related legislation passes.

"In the U.K., I will have to be reporting my carbon footprint based on regulations in the U.K and EU," Digital Realty's Smith says. "Those same processes and reporting structures will impact my U.S. operations."

Some state and local environmental regulations already affect CIOs. In California, Title 24 dictates energy-efficiency standards for buildings including datacenters. King County, Wash., requires outdoor-air cooling for datacenters.

"Title 24 impacts our California designs in a meaningful way," Smith says. "You'll find little [regulations] like this regionally. This type of pressure is growing."

As far as federal legislation is concerned, most observers expect it to be in the form of a cap-and-trade program or a tax that acts as a financial incentive to companies to reduce their carbon footprint.

"The big question is, how much will carbon be?" Gartner's Mingay asks. "If it's $120 a ton, then everybody will care a lot.... The balance of probability is that companies will be paying for carbon in some shape or size. The $60 billion question is in what format."

"Legislative pressure is inevitable but probably not immediate," Skinner says. "A lot of companies are doing the baselining and benchmarking to see how they stack up, not only for carbon legislation but also for increased competitiveness."

Industry observers expect there will be an increase in legislative pressure on CIOs to go green. For example, in June the Lieberman-Warner Climate Act, which would have enacted a carbon tax, was voted down by the Senate. Many more similar bills are expected.

"There's all sorts of rumbling in the industry about a carbon tax. There's rumbling about the cap-and-trade initiatives and are we going to see that happen as an industry. Even if we don't think it's going to happen, it behooves us as an industry to start to measure carbon and get a good benchmark to use," says John Tuccillo, vice president of industry alliances for APC.

5. IT vendorsPressure gauge reading: 5Green IT is one of those movements where vendors have been ahead of most CIOs and IT buyers. That means IT buyers are seeing a lot of hype from hardware and software manufacturers about why they need to go green.

Vendors are "painting everything green," Mingay says. "Some of it is credible. In some cases it's just plain greenwashing."

"There is an arms race among the server vendors to get the most efficient server that will operate in the widest range of temperature and humidity ranges, the one that provides the biggest bang for the buck," Smith says.

Green IT initiatives like Climate Savers and The Green Grid are being driven by manufacturers including Intel, Google, Dell, IBM, HP, Microsoft, and others.

APC's Tuccillo says one of the key areas where IT vendors are applying pressure is in the development of metrics that CIOs can use to measure IT and datacenter energy efficiency.

"The near-term fixes are going to be in the areas of increasing the energy efficiency of existing datacenters. The first step is to measure what we're doing," Tuccillo says. "It's through groups like The Green Grid and others that we're able to gather that data and compare it against peers."

IT industry groups also are providing operational best practices for IT departments.

"The IT vendor community recognized this was a challenge that could not be met by any one entity," Tuccillo says. "We recognized that this tidal wave was coming, and we decided we'd better work together as an industry to start solving the problem. There's still an opportunity for differentiation for IT vendors, but there's also room for commonality in terms of standard metrics and a common lexicon."

Industry officials involved with groups such as Climate Savers and The Green Grid say they are trying to involve more IT buyers in their activities.

"This can't just be the tech industry pushing," Intel's Skinner says. "We're also working on the demand side of this...A key pillar of what we're trying to do is raise awareness of computer buyers and work the demand side of it so they will make more purchases that are energy efficient."

Still, IT industry observers say most CIOs are not yet choosing servers, desktops, or other IT gear based on how environmentally friendly it is.

"I don't think CIOs are buying stuff because it's green. That's not their primary focus. It's an afterthought," Acumen's Stanley says. "The decision criteria from a computing perspective is: Does it get the job done and is it cost-effective?"

6. The mediaPressure gauge reading: 5Going hand-in-hand with the pressure that CIOs feel from lawmakers and the IT industry is pressure from the media, which informs CIOs about what's going on in these areas.

The mainstream media, trade journals, and bloggers have all focused on the connection between datacenters, computing, and energy use.

"The media as well as bloggers play a critical role in building awareness and communication," Google's Teetzel says. "Ten years ago, people wouldn't be able to quote their parts per million in C02. Today people who are not environmental scientists can. The media has been a big impetus of the climate change debate."

The media not only raises the climate change issue, but fosters debate and encourages investment in environmental technologies.

"Awareness is the first step," Teetzel says. "Once you start getting people to look at this issue, a lot of the steps they need to take are fairly straightforward."

"The media is way ahead of where most IT organizations are at," Mingay says. "The media keeps referring to possible regulation and legislation. One of the most common questions we get from CIOs is about regulation."

The media also offers CIOs an opportunity to tell their stories about the improvements they make in energy efficiency.

"Money is the primary driver for a lot of this [green IT movement], but there are also some very good benefits from PR and good press," Teetzel says. "A lot of companies try to tout their environmental and sustainable practices, and there's obviously a lot of benefit there for their brands."

In the future, CIOs may be under more pressure from negative press if they don't make environmentally sound choices.

CIOs "have to be cautious not to make an anti-green decision," Stanley says. "If they make a decision that's clearly not green, I think they'll come under a tremendous amount of scrutiny.... It's one thing to have a legacy that's not green, and it's another thing to make a new business decision that's not aware."

7. CompetitorsPressure gauge reading: 5Companies always feel pressure about what their direct competitors are doing, and green IT is no exception.

"A lot of companies are reactionary to what their competitors do, so that's a big pressure," Teetzel says. "Microsoft, Google and Yahoo -- all three have declared plans for carbon neutrality.... Now we're jockeying for position as to who is going to be the greenest company out there."

Teetzel says he sees the same trend among retailers, with Wal-Mart leading the way. The same holds true in the airline and auto industries. "There's been a radical transition in the auto industry. A lot of companies were producing hybrids grudgingly, but the competitive pressure is a big deal," Teetzel adds.

Teetzel says that competitive pressure regarding energy efficiency and carbon-footprint reduction will rise because the most aggressive companies in these areas will be the most profitable.

"This is not just about a reduction of C02," Teetzel says. "It's about freeing up capital that goes into energy and is wasted [and putting it] into other areas of the business. It's about making businesses more efficient not just from an energy standpoint but in other areas. It's very good for the economy... in the next five to 10 years, you're going to see businesses that are streamlined and more efficient."

Already, IT vendors are reporting competitiveness among CIOs regarding the energy efficiency of the new data centers they are building.

"Those folks who are designing datacenters say they want to design the most energy efficient datacenter in their space," APC's Tuccillo says. "That's pretty much the mind-set."

Companies are also seeing pressure from their customers or potential customers to improve their energy efficiency.

"We're beginning to see a trend where the CEOs of some companies are being asked by some of their customers, like Wal-Mart and others, to adhere to environmental codes of conduct," Intel's Skinner says. "We're just starting to see companies audit carbon footprint, measure it, and take steps to reduce it. Then CEOs turn to CIOs and ask the IT department to be an enabler to carbon-footprint reduction. Teleconferencing, telepresence, and enabling employees to telecommute help reduce carbon."

8. Generation YPressure gauge reading: 3Teens and 20-somethings are fired up about environmentalism, and that is increasingly putting pressure on companies to green their operations.

Many CIOs are parents, too, and their kids are learning about global climate change at school. Kids are pushing recycling, switching out light bulbs, and unplugging computers and other electronic devices at night.

CIOs not only feel the pressure from their own kids but from the college graduates they are trying to recruit and the Millennials on their staff.

"College grads who can be selective are selecting their employers by the reputation of the company and how committed it is to environmental practices," Skinner says. "Demographics are on the side of this issue, and IT managers who are on the front lines of hiring out of college will be seeing that."

This is a pressure that CIOs can expect to rise over the next few years .

"When I do recruiting at local universities, I'm usually the most popular guy," Teetzel says. "There's a huge amount of interest in solving the [climate-change] problem. There's a kind of buzz in the next generation."

9. EmployeesPressure gauge reading: 2C-suite executives are just beginning to see bottom-up efforts from employees to make their companies more environmentally friendly.

Whether they are launching recycling programs or turning off lights at night, employees can exert peer pressure on each other to change wasteful behavior at work.

"What we're observing is a lot of grassroots efforts by employees to create green teams or green IT communities and adopt green practices," Skinner says. "Increasingly, eco-minded employees are taking on initiatives and putting pressure up the leadership chain.... Increasingly, the C-suite is being pressured from below."

Teetzel says this phenomenon has occurred at Google, where employees have organized into green teams.

There's more to employee efforts than "just putting stickers on desktop computers left on all night that say, 'Thanks for wasting electricity,'" Teetzel says. "Employees have a lot of debate and discussion ... related to climate change."

One way that employees are driving action is through carbon-reduction competitions, such as Carbon Rally.

Employees have "the potential to have the largest impact," Smith says. "Like all corporate processes, it's when you push them as far down into the field as possible that you get all these incredible results."

Smith says Digital Realty's employees are driving the company's efforts to have its datacenter buildings certified as green through the Leadership in Energy and Environmental Design (LEED) process.

"Once I explained LEED to our operations and construction teams, they took it from there. They are finding LEED points from other parts of the business," Smith says. "It's the same thing with consumption, performance and metering. We're trying to push that as far out into the field as possible."

10. The communityPressure gauge reading: 2Community leaders are starting to apply pressure to local corporations to improve their sustainability. Although that's not a big pressure on CIOs today, these efforts are likely to increase.

"Cities, churches, nonprofits -- I do think that is a growing source of pressure with respect to people thinking a bit more about this topic," Teetzel says.

For example, the Climate Savers computing initiative has signed up the states of Oregon, Colorado and Minnesota for energy efficiency collaborations. Under the terms of these agreements, the states will improve the energy efficiency of their own IT operations but they also will promote such concepts as buying Energy Star equipment and turning it off at night to the companies doing business in their states.

In fact, the National Governors' Association partnered with Climate Savers last November to encourage the deployment of energy efficient computers and IT practices in state government offices.

Symbian launched a partner program for software developers working with its mobile OS, taking an interim step to attract more developers while the OS moves toward open-source availability.

Joining the Symbian Partner Network (SPN) gives developers access to Symbian source code before all of it becomes open source, a period that may last a year or more, according to David Wood, executive vice president for research at Symbian. It also will include access to a new Web portal where developers can download code for future versions of the OS and communicate with their colleagues on forums and wikis.

Membership will cost $1,500 per year, compared with $5,000 per year for the Platinum Partner Program, which it will replace. As with the Platinum program, membership also includes access to live events, opportunities to pitch applications to carriers and handset makers, and some marketing assistance. In addition to application creators, SPN is intended for middleware developers, consultants and trainers. Companies can join now, and some already have, Wood said.

Late last month, Nokia announced it would buy out the remainder of Symbian and form the Symbian Foundation, which would eventually make the OS available as open source. But that won't happen overnight, Wood explained. All the code has to be reviewed for potential intellectual property and security issues, and because of arrangements with third parties, some of the code may not be opened for some time, he said. There are about 30 million lines of code in the OS to be dealt with, according to Wood. And Nokia's buyout still needs regulatory approval.

"We're living in sort of a dual world," Wood said. But even after the OS becomes available as open source through the Symbian Foundation, SPN membership will probably continue to have value because of its community and networking opportunities, he added.

Competition for the hearts and minds of mobile developers has heated up in recent months with the emergence of Google's Android platform and the LiMo Linux-based platform, both of which are open source, as well as Apple's iPhone SDK. Symbian is the dominant smartphone platform in Europe and shipped on 18.5 million phones in the first quarter of this year. But analysts say its backers are moving toward open source to keep the platform competitive and to gain market share in North America.

Developers have created an easy way to load Android, Google's mobile-phone OS that is still in the works, on Nokia's N810 open-source handheld devices.

The development is of interest to people who are trying to build applications for Android, rather than for general users. "So, from the point of view of someone who just wants to use his N800 and doesn't necessarily want to experiment for the sake of experimenting, what does running Android get me?" one person asked on the Internet Tablet Talk Web site that is sharing the technique for loading the software on the devices.

"Probably not much," a respondent wrote back. In the future, however, it means that anyone could decide to run Android on the devices and use applications developed for the OS, the respondent said.

[ Check out InfoWorld's special report on Google Android ]

For developers, the discovery is exciting. "Testing on a physical device is way different than testing in an emulator," said Mike Rowehl, a mobile developer who has loaded Android on his N810.

In addition, he thinks this is an important move that indicates the success of the open-source model. "By virtue of building on open-source platforms already well-represented in terms of active projects, developers have been able to get Android up and running on physical hardware," he said.

The N810 devices run on Maemo Linux, and Android is based on Linux. Since most phones come with closed operating systems, users typically can't simply remove and replace OSes, as developers were able to do. Because Android isn't yet complete, no actual phones running the software are available.

In April, developers also posted information about loading Android onto the Nokia tablets on the elinux.org Web site. However, the process was complicated. The new installer makes it much easier for people to load the software onto the devices.

The N810 has a larger form factor than a cell phone, but is much smaller than a laptop. The initial release of the line of Internet tablets, the N770, by Nokia raised some eyebrows because the devices don't include cellular connectivity. They have Wi-Fi, however, and users can connect a cell phone to the N810 via Bluetooth for mobile access.

Microsoft plans to release a new Windows server OS aimed at midsized businesses as well as the next version of its small-business server software worldwide on Nov. 12, the company said Monday.

Both Windows Essential Business Server 2008 (EBS 2008) and Windows Small Business Server 2008 (SBS 2008) will be available that day, the company revealed at its Worldwide Partner Conference in Houston on Monday. Hardware providers Dell and Wortmann AG in Europe will be among the first companies to offer hardware for both OSes when they are available, the company also said.

Microsoft expects to post new release candidates for both products on its Web site next week. Customers also can get information about the products on the site.

SBS 2008, code-named "Cougar," and EBS 2008, code-named "Centro," are part of Microsoft's new Windows Essential Server Solutions line. The products in the Essential line combine Microsoft's Windows Server OS with other software products the company deems necessary to running a business. Microsoft's goal with these products is to provide what it describes as an all-in-one, easy-to-install software stack for companies that may only have a small IT support staff.

SBS 2008 is an integrated offering of Windows Server 2008, Exchange Server 2007 Standard Edition, and Windows SharePoint Services 3.0. It also includes Microsoft's Office Live Small Business service and 120-day trial subscriptions to Forefront Security for Exchange and Windows Live OneCare for Server. The premium edition of the software includes an additional license for Windows Server 2008 and SQL Server 2008.

EBS includes three copies of Windows Server 2008 running on three hardware servers. The first server is a domain controller and management server that includes Microsoft's system-management software. The second server in the EBS stack is for e-mail; it runs Exchange Server 2007 Standard Edition. The third server is a security server running Forefront Security for Exchange Server and Forefront Threat Management Gateway. A premium edition of EBS will include a fourth version of Windows Server 2008 on a fourth piece of hardware running SQL Server 2008.

Microsoft set pricing for both products in May, revealing that the price for SBS 2008 would be going up from the previous version. At the time, the company said the price increase was because it had added more technology and services to the offering.

In May, Microsoft also said SBS 2008 would only be released for 64-bit servers, although earlier versions of SBS were available for 32-bit hardware as well. The move to 64-bit was not a big surprise, however, as the company has said it plans to offer most of its business software in 64-bit versions only to encourage customers to move Windows Server off of 32-bit hardware.

Cybercriminals are exploiting a bug in software used by Microsoft's Access database program in a new online attack, Microsoft warned Monday.

The flaw lies in the Snapshot Viewer ActiveX control, which ships with "all supported versions of Microsoft Office Access except Microsoft Access 2007," Microsoft said in a security advisory, published Monday.

Microsoft released few details of how the bug is actually being exploited, but said that it is investigating an ongoing computer attack that takes advantage of the problem. "The attack appears to be targeted, and not widespread," wrote Bill Sisk, a Microsoft spokesman, in a blog posting.

Attackers are trying to lure victims to a specially crafted Web page that tries to run the attack code within Internet Explorer. The bug gives attackers a way to run their malicious software on the victim's machine.

Microsoft's Security Advisory offers a number of possible work-arounds for the problem, but the company has not said when it plans to fix the underlying bug.

"We encourage affected customers to implement the manual work-arounds included in the Advisory, which Microsoft has tested," Sisk said. "Although these work-arounds will not correct the underlying vulnerability, they help block known attack vectors."

Snapshot Viewer lets PC users view a Microsoft Access report without having to run the Access software itself. It can be downloaded as stand-alone software.

Microsoft said Monday that it would begin pushing Windows XP SP3 (Service Pack 3) to most users "shortly."

The announcement, made by Nick MacKechnie, a senior manager for Microsoft's New Zealand operations, was not unexpected, as the company had previously said it would release Windows XP SP3 to Automatic Updates sometime in the "early summer."

"We would like to remind you that Windows XP Service Pack 3 (SP3) will be released to Automatic Updates shortly," said MacKechnie in a post to a company blog Monday.

Windows XP SP3, which was released to the general public in late April, has plagued some users with problems after they updated the aged operating system.

Immediately after Microsoft posted XP SP3 for download, for example, users reported that PCs powered by AMD's processors were rebooting endlessly, a bug that Microsoft addressed by blocking AMD machines from downloading the update.

Later, other users complained that their Internet and wireless connections had been deleted after installing XP SP3 and blamed a flood of corrupted registry keys added during the update. The problem, Microsoft later argued, was the fault of certain security software, a contention that at least one vendor, Symantec, disputed.

Microsoft issued a fix for systems affected by the registry corruption less than two weeks ago.

The announcement that Microsoft would release XP SP3 to Automatic Updates came just a week after the company started the operating system on its road to retirement last Monday by halting sales of the OS to retail outlets and barring major computer makers from installing it on most new PCs.

When Microsoft flips the Automatic Updates switch for XP SP3, users who have the Windows Update client software set to the "Automatic (recommended)" option will see their machines automatically download and install the service pack.

Individuals or companies that want to block the automatic deployment of Windows XP SP3 can download and use the Windows Service Pack Blocker Tool Kit, which provides the means for stopping the service pack from reaching client PCs through April 2009.