The Download Blog

Mozilla, racing to release Firefox 3.6 before the end of the year, has released a second beta of the open-source browser for Windows, Mac, and Linux.

Firefox 3.6 beta 1 introduced most of the new features, most visibly the ability to customize Firefox's look through Personas, less than two weeks ago. But among the 190 patches in the new beta is what Mike Beltzner, Mozilla's director of Firefox, described in a blog post as "a mechanism to prevent incompatible software from crashing Firefox."

There also are a number of deeper changes in Firefox 3.6 that Web developers likely will be more interested in. Note that one of them, the ability to use color gradients with formatting technology called Cascading Style Sheets (CSS), has changed syntax in between Firefox 3.6 beta 1 and beta 2.

Mozilla is trying to accelerate the pace of Firefox releases; Firefox 3.7 is set for release in the first half of 2010 and 4.0 some time later that year. The project faces new competition from Google's Chrome browser.

Google has cut the price to store photos at its Picasa Web Albums site by a factor of eight.

The photo-sharing site offers 1GB of photo and video storage for free, but now going beyond that limit costs less. The options now range from $5 a year for 20GB to $4,096 a year for a whopping 16 terabytes.

"Today we're dramatically lowering our prices to make extra storage even more affordable. You can now buy 20GB for only $5 a year--that's twice as much storage for a quarter of the old price, and enough space for more than 10,000 full resolution pictures taken with a five megapixel camera. Since most people have less than 10GB of photos, chances are you can now save all your memories online for a year for the cost of a triple mocha," programmer Elvin Lee said in a blog post Tuesday.

A lot of us have well over 5 megapixels per shot to contend with, but it's still interesting. When Google introduced the option to pay for extra storage in 2007, it cost $20 a year for 6GB.

The move is the latest to indicate that Picasa, although not a high-priority Google project like Chrome or search, does have a pulse. Last year, it added face recognition to the Web site and followed suit this year with the free Picasa photo editing software the company offers. And in March, Google started adding advertisements to the Picasa site.

Picasa is gradually getting more sophisticated, but as far as I can tell it has yet to dethrone Yahoo's Flickr as a preferred hub of at the center of a lot of photography activity on the Web. Picasa is fine for sharing snapshots with the family, but it's not really the place to join groups, chat on forums, and discover what the photography world is up to.

Picasa's more modest scope isn't a problem--plenty of people just want to share some photos, after all, and Google generally tries to offer services with broad rather than specific appeal--but Flickr has more vitality in this more social era of photography--at least among its "pro" subscribers who pay $25 a year.

Another interesting comparison is Facebook, with an extraordinary 2 billion photos uploads each month and a well-used system to identify who's in a photo that Flickr only just began offering. While Facebook has a strong social angle, though, it cuts down photos to a lower resolution and really is more a place for sharing snapshots than for digging into the world of photography.

Picasa's price cut raises an interesting prospect for photography enthusiasts, though. If it's going to set its prices to try to match some portion of the dropping prices of hard drives--not just this week, but regularly--it'll gradually become a more appealing place to back up photos in the cloud. Of course, like Flickr, it's chiefly for JPEG files, not the larger and more awkward raw files serious photographers often use. But even a JPEG backup is useful, especially with synchronization tools built into the Picasa software.

Paying Google $256 per year for 1TB of Picasa storage space is getting in the vicinity of the $100 price or so a 1TB external hard drive costs. Of course you only have to pay once for the hard drive, and even a slow USB hard drive is faster to access than photos on the Net, but Google's price includes backup and some assurance that you'll still have your photos if someone steals your laptop or your hard drive fails. Plus, of course, you get to share your photos.

A big gap here is support for raw files, something that SmugMug offers in its Amazon Web Services-based SmugVault. But that costs 22 cents per gigabyte per month, a price that rapidly gets steep when you consider how fast a modern SLR can fill up a 4GB flash memory card. SmugMug, a subscription-only site, caters to the serious set, though.

(Credit: Mozilla)

It's been just under four months since Mozilla launched its pilot program for contributions, a way for users to donate to add-on developers for their time and effort.

The program was launched in tandem with a redesign of Mozilla's add-ons site that gave developers their own profile pages. Many add-on makers were already running donation programs through their own sites, but wanted the option to show up in Mozilla's catalog too.

Already it appears to be working, but on a smaller scale than some developers might have hoped. For the half dozen developers that CNET News talked to, none has made enough from it to, say, quit their day job. While Mozilla would not reveal specifics on which developers are getting the most contributions, it did provide us with the total amount given: around $20,000. An organization spokesperson said that most of that came in September and October.

Of the 500 or so developers who are participating in the program, the average contribution falls somewhere between $5 and $6, with the largest thus far being $150. All have gone through PayPal, which is the sole way to pay through Mozilla's add-on site. PayPal then gets a small fee out of each transaction, something that comes out of the developer's pocket, although this varies based on how much the user gives.

Other ways to make money

Some developers believe Mozilla has gone about the payment problem in reverse. With the current contributions program developers are given the chance to ask for money before the user even downloads the free add-on. So why not give them a way to ask for a contribution after a user has downloaded and installed it?... Read more

First introduced in beta in April, Panda Cloud Antivirus graduates to a stable, public release and signifies a major security vendor taking aim at the freeware competition--instead of the other way around. Cloud Antivirus was notable on its beta release for being one of the few security options available to users that contained most of its protections in the cloud. This allowed it to protect users while consuming significantly fewer resources than many competing programs.

Panda Cloud Antivirus leaves beta--photos

Panda Cloud Antivirus 1.0 is notable as a free security solution for two reasons: Panda is a reputable security vendor, and the program achieves its goal of freeing up system resources. In a press release, Panda Security CEO Juan Santana described Cloud Antivirus as a game-changer. It's not clear quite yet that that's the case, but at the very least the program looks to fill a niche created by resource-conscious netbooks.

As light on resources as advertised, Cloud Antivirus offers strong reputation-based protection for those who want their security program out of sight and out of mind. A third-party efficacy evaluation wasn't available at the time of writing, but in empirical testing the program only used 9 MB of RAM while idle, and only 56 MB of RAM when scanning. Many other security programs will run scans at 150 MB of RAM or more.

Despite keeping most of its database in the cloud, Panda Security's Senior Research Advisor, Pedro Bustamante, noted during an interview in October that Cloud Antivirus isn't disabled just because the host computer is disconnected from the Internet. "Panda has an offline mode that uses a small cached copy of Collective Intelligence on your local drive, it's only the most recent threats on a real time wild list." Collective Intelligence is the name that Panda gave its cloud system when it was introduced in 2007.

When you open Cloud Antivirus, the main window lets you know whether you're safe or not with a big red or green icon. Cloud Antivirus works as other antivirus solutions do, offering a Quick Scan and a Custom scan for specific folder, files, and drives, but its ancillary features are exceptionally light. The Quick Scan took 13 minutes on my Windows 7 Lenovo T400 laptop.

Dragging an active Cloud Antivirus window, in Windows 7 at least, will turn it translucent.

(Credit: Screenshot by Seth Rosenblatt/CNET)

You can opt out of contributing anonymous data to the cloud, but that also opts you out of automatic threat management. There's a network connection proxy option should you need it, and a reporting feature that will show you what kind of threats have been detected and removed from your computer. You can filter the report by All, Last 24 hours, Last Week, or Last Month, and there's a Recycle Bin pane from which you can recover a false positive, should you need it. Unfortunately, the Recycle Bin is hidden behind an obnoxious "flipping" screen that cheesily rotates when you need to access it.

If you're familiar with the minimalist Microsoft Security Essentials, Cloud Antivirus is even simpler. I did notice some odd interface rendering around the minimize and close buttons in Windows XP, but not in Windows 7. There are other more serious concerns about the program. Most notably, it lacks a scheduler, and it removes user input from update functions. Scans are also limited: you can tell the program what to scan, but not what to look for, so forget about toggling heuristics or rootkits. Then again, the point of this kind of security is that it's all wrapped into one.

Keeping in mind its limited feature set, and that we don't have efficacy numbers at the time of reviewing, Panda Cloud Antivirus makes good security choice for those willing to take the plunge.

(Credit: Xobni)

A few months ago, e-mail search app Xobni told us they were creating a version for BlackBerry. At the BlackBerry Developer Conference in San Francisco on Monday, we got a look at it.

Xobni on the Windows PC is an Outlook add-on that quickly finds e-mail messages and attachments. On BlackBerry, Xobni will integrate with your e-mail account, where it will extract addresses, phone numbers, and social networking details to automatically create a secondary address book for your phone. You'll be able to use Xobni for BlackBerry to quickly find contacts--including those you have not physically added to the native address book yourself. That expanded address book goes for everyone who has ever sent you an e-mail, been cc'd in an e-mail, or even mentioned in a message.

With the premium Xobni Plus Outlook add-on, you can access this secondary address book by typing into the Compose field. Integration isn't quite so tight in BlackBerry. On the Bold, Tour, and new Curve 8900s, you'll access contacts by flicking up on the track pad to get to to the stylized Xobni address book.

Then search by a contact's name, domain name, or by a keyword to speedily find the person you're looking for. As with Xobni on the desktop, you'll be able to send your calendar availability to a contact, get Facebook to supply contacts' Xobni profile picture, and view Twitter feeds and LinkedIn and Hoovers information from the BlackBerry.

In creating its own address book--instead of adding contacts to the native address book--Xobni makes a statement. Unlike Gwabbit, which adds the information from a signature block into a new record, Xobni finds e-mails and phone numbers anywhere in the message. Besides that, Xobni CEO Jeff Bonforte believes that inserting contacts into your native address book means "you've already lost the battle." Instead of adding contacts one-by-one, Xobni builds you a social roster behind-the-scenes, and adds social networking plug-ins in the process.

As far as time lines go, Xobni is looking at a closed alpha release sometime in December. Bonforte expects a beta early next year, and the final release a few months after that. The pricing model is still undecided.

Xobni for BlackBerry will first be available on the Bold, Tour, and Curve 8900. Storm users will have to wait a little longer.

The woefully incomplete Louvre app for iPhone offers little to smile about.

J'adore France and the French people. But I'm pretty disappointed with Musee du Louvre, a free but painfully brief virtual tour of the famous museum.

The app consists of four main sections. In Louvre: The Visit, you get a video tour of seven well-known areas of the museum, including The Venus de Milo and Mona Lisa.

However, each "tour" lasts less than 20 seconds, and the default language is French. If you tap the screen to bring up the controls and then tap the language icon, you can select English (or German or Japanese), but there's no way to make it the default. You have to perform this step for each video, each time you watch it.

In Artworks, you get a Cover Flow-style selection of famous paintings--but only 20 of them. Tap one to get information about the work, a zoom-and-pan-able full-screen view, and a map showing its location within the museum.

The Palace follows the same format, but focuses on areas of the Louvre itself rather than individual artworks.

Finally, there's the prerequisite visitor information, including hours and admission fees--but no maps to or of the museum (save for the aforementioned few).

Musee du Louvre does let you bookmark any item for easy reference, but with so little content, this seems rather pointless. Hopefully the curators developers will turn this incomplete tease of an app into the rich, arts-friendly resource it should be.

In the meantime, anyone planning a visit to the actual museum would be much better served by Rick Steves' Louvre Tour ($4.99).

Apple on Monday released a large security update for Mac OS X that fixes dozens of vulnerabilities and provides protection against potential attacks exploiting a weakness in the protocol used to verify that a domain is legitimate.

There are 43 specific issues addressed in the 2009-006 update, released the same day as Mac OS X v.10.6.2.

It plugs a variety of holes for the Mac OS X v10.5.8, 10.6, 10.6.1, and Mac OS X Server v10.6 and 10.6.1, many of which could lead to arbitrary code execution and allow an attacker to take control of a computer.

Several updates affect Apache and QuickTime. Others target AFP Client, Apple Type Services, Core Graphics, CoreMedia, Dictionary, Disk Images, Dovecot, Directory Service, fetch mail, FTP Server, Help Viewer, Kernel, PHP, QuickDraw Manager and Spotlight.

One update fixes a hole in Adaptive Firewall that could allow a brute force or dictionary attack to guess an SSH log-in password, and another update addresses a vulnerability in Login Window that could allow a user to log in to any account without supplying a password.

Several updates address holes that could allow domain spoofing or man-in-the-middle attacks involving SSL (Secure Sockets Layer) used for encrypting data in transit, including a significant weakness in the X.509 protocol for generating SSL connections.

One of the updates affects the libsecurity feature and is billed as a "proactive change to protect users in advance of improved attacks against the MD2 hash algorithm" that could expose users to spoofing and information disclosure.

"There are known cryptographic weaknesses in the MD2 hash algorithm. Further research could allow the creation of X.509 certificates with attacker controlled values that are trusted by the system," the update says. "This could expose X.509 based protocols to spoofing, man in the middle attacks, and information disclosure. While it is not yet considered computationally feasible to mount an attack using these weaknesses, this update disables support for an X.509 certificate with an MD2 hash for any use other than as trusted root certificate."

That major weakness was revealed by security researcher Dan Kaminsky at the Defcon hacker conference in July. Kaminsky was able to trick a Certificate Authority into providing a certificate verifying authenticity for a domain that belonged to someone else.

The updates can be downloaded from Apple's site.

Far more robust than Microsoft Paint, but nowhere near as loaded with features as Photoshop, Paint.NET occupies a niche perfect for users who want a free image editor that has more than resizing and inverting. Version 3.5 includes an enormous number of stability tweaks and menu adjustments, as well as a couple of new minor features and some Windows 7 love, too.

Paint.NET 3.5 includes better Aero-theme integration and a new Utilities menu.

(Credit: Screenshot by Seth Rosenblatt/CNET)

One of the biggest changes makes the program's installation far less obvious. The new version automatically downloads and installs the program's prerequisites, including the latest Microsoft .Net version and Windows Installer. It will update in the background now, too, so that you can continue to use the program until it's ready to restart. Longtime users should notice that the program starts up about 20 percent faster, according to the publisher.

The program has been visually tweaked to look better on Aero for both Vista and Windows 7. Mostly, this means that the menu bar appears offset from the Aero pane border, and it looks good. The Selection tool will no longer use the "dancing ants" that most other image editors use. Instead, a context-sensitive gray overlay appears as you make your selection. This works fine when using the lasso tool, but was hard to discern when used with the magic wand. According to the publisher, this change was made to reduce CPU consumption. There are three new effects, as well, for Surface blurs, Dents, and Crystalize.

The new Utilities option on the menu bar now hosts the Language submenu, Manage Fonts, which loads the Windows font control panel, and the manual Check for Updates tool. The full list of program changes can be found here.

To make it easier to see what an application looks like before going to the trouble of downloading and installing it, we've made a number of improvements to the way we show screenshots on Download.

First, we took every screenshot we've ever received from a software publisher over the past 13 years (anyone remember Doom 95?) and reprocessed it for improved clarity. Then we created a larger preview version of each screenshot and moved it to the top of the product page.

Finally, we no longer send you to a new page when you want to view a screenshot at full size. Instead, clicking the preview image opens a light box where you can cycle through all the screenshots at once. It's particularly nice for games where there are typically a number of high-res preview images available.