The Download Blog

Amidio makes some heavy-duty musical apps for the iPhone and iPod Touch; I was particularly impressed with StarGuitar, which gives you a virtual guitar with a bunch of preset rhythms, letting songwriters create quick sketches of ideas when they're nowhere near a guitar.

I created a nice vocal loop from the new Beach House single, then dropped it into Pink Floyd's "Astronomy Domine." It took me about five minutes.

On Tuesday, Apple approved a new Amidio app, called TouchDJ, for the iPhone and iPod Touch, and it's both very impressive from a technical standpoint and a heck of a lot of fun. The iPhone can only play one audio track at a time, but TouchDJ essentially fools it into placing two MP3s side by side for simultaneous, real-time manipulation and playback. It's like a two-track digital DJ setup right on your iPhone.

You get a crossfader to control the balance between the two tracks, plus individual controls for each track's volume, pitch/speed (which aren't independent from one another, unfortunately), equalization (three bands), and effects (the built-in real-time effect sounds like a kind of flanger, and there are several lame samples of a low-pitched robot voice, but you can upload your own). Each track is represented by simple waveform images that use a different color for the bass, which helps you match beats more effectively. A tempobend effect, which lets you quickly bend the speed up or down on either track, also helps you get in sync.

The looping functions were most impressive--you can create a cue and loop mark at any point in either track, then return to the cue with the rewind button, move to the loop mark with the fast forward button, or create an endless loop between the two points. All of this is in real time. If you've got an audio splitter, you can even create a separate cue track for your headphones--for example, to set up a loop in your second track while the first one is playing, without exposing your experimentation to your audience--although this requires some serious processing power, and is recommended only for an iPhone 3GS.

There are a couple caveats.... Read more

Internet Explorer 8, Firefox 3, Google Chrome 4, Apple's Safari 4, and Opera 10 include features that block sites known to host malware and malicious downloads. All but Opera also let you browse without leaving any tracks. But just as important as these protections is ensuring that whichever browser you use is thoroughly patched.

Filtering out bad sites
Firefox's built-in antiphishing tool claims to update its bad-site database 48 times a day, according to Mozilla's Firefox security page. Firefox 3 uses Google's Safe Browsing service to automatically block sites that are known to host malware. The Google Code site describes how Safe Browsing works in Firefox.

To verify that attack-site blocking is enabled in Firefox, click Tools > Options > Security and make sure "Block reported attack sites" is checked.

Firefox will prevent known-bad sites from opening when "Block reported attack sites" is checked.

(Credit: Mozilla Foundation)

The same feature is built into Google's own Chrome browser. You can ensure that malware-site filtering is on in Chrome by clicking the wrench icon in the top-right corner, choosing Options, and selecting Under the Hood. "Enable phishing and malware filtering" should be checked. The Google Chrome Help site describes the feature. (Hint: This page looks very similar to the description on the Google Code site.)

Google's Chrome browser blocks known-bad sites when "Enable phishing and malware protection" is checked.

(Credit: Google)

The SmartScreen technology in version 8 of Internet Explorer blocks known-malicious downloads as well as bad URLs. Other new security features in IE 8 include automatic blocking of click-jacking and cross-site scripting attacks, automatic crash recovery, and highlighting of the actual domain name in the address bar. The Microsoft Security site describes the SmartScreen Filter and includes links to a SmartScreen FAQ and information for site managers.

Apple's Safari browser added phishing and malware blocking in version 3.2, which was released in late 2008; read about this and other security features in Safari 4 on the Apple Safari site. Likewise, Opera's Fraud Protection predates the phishing and malware filters in IE and Firefox and is enhanced in the latest version 10. But attack-site blocking is only one of Opera's many security features, which you can read about on the Opera site.

Browsing in private
To activate private browsing in Firefox 3, click Tools > Start Private Browsing, or simply press Ctrl-Shift-P. You can set Firefox to start in private-browsing mode by clicking Tools > Options > Privacy and check "Automatically start Firefox in a private browsing session." The Mozilla support site provides more information about this feature. Likewise, put IE 8 in private-browsing mode by clicking Safety > InPrivate Browsing, or by pressing Ctrl-Shift-P. You can also open a new tab and click either Browse with InPrivate or Open an InPrivate Window.

IE 8 also lets you control the information about your browsing habits that's shared with Web tracking services. To activate this feature, click Tools > InPrivate Filtering Settings and choose "Let me choose which providers receive my information." This opens the InPrivate Filtering settings dialog, where you can turn filtering off, choose which services to block from tracking you, or automatically block all trackers.

Internet Explorer 8's InPrivate Filtering lets you block some or all Web tracking services.

(Credit: Microsoft)

You can open an incognito window in Google Chrome by clicking the wrench icon in the top-right corner and choosing "New incognito window," or simply press Ctrl-Shift-N. The incognito icon (a shadow figure in a fedora and glasses) appears in the top-left corner of the browser window. The Chrome support site offers a more detailed description of this feature.

Opera lacks an equivalent private-browsing capability but does offer private searching and other identity-blocking features, as described on the Opera site. To activate private browsing in Safari, simply click Safari Settings Menu > Private Browsing.

Automatic and not-so-automatic browser updates
Patching is a way of life with nearly all software, but especially with browsers and the media players associated with them: Adobe Reader, the Flash Player, Apple's QuickTime, and Sun's Java, among others. All of a browser's security features can be rendered useless by a piece of malware that takes advantage of an unpatched hole in the program.

Firefox 3 alerts users to the presence of an update and now also notifies you when your Flash Player is out-of-date. Internet Explorer 8 updates via the Windows Update/Microsoft Update services. Google Chrome made a splash by being the first browser to update itself in the background without requiring any prompting from users. Safari updates automatically via Apple's update service, which also serves up patches automatically for QuickTime, iTunes, and other Apple software. Opera also notifies you automatically when a new version is available.

But updating is too important to leave to others. Back in April, I described Secunia's Online Software Inspector and downloadable Personal Software Inspector, which identify out-of-date programs on your PC. The programs mentioned in that post have all been updated since, but Secunia's services should point you to the most recent versions.

(Note that Secunia sometimes reports a program as being out-of-date when in fact you have the latest version. On my PC, it continually reports my up-to-date Flash Player as being in need of an update, for example. But the free service Secunia provides is worth putting up with this and similar minor annoyances.)

Trillian IM is finally available to iPhone users.

(Credit: Trillian)

It took a few months, but finally, Trillian IM is available to iPhone and iPod Touch users through Apple's App Store. The application costs $4.99.

Cerulean Studios, the company that created Trillian, said that Trillian for iPhone sports several features users will already find on the company's desktop software. The app displays contacts, grouped and sorted by their respective categories. Users can also view multiple chat windows in a tabbed display. Thanks to updates Apple has made to the iPhone and iPod Touch, Trillian for iPhone also supports copy and paste. As with Trillian for the desktop, users can set their status, choose an avatar, and set up different status messages.

Because the app is always connected to Cerulean Studios' Astra server, users can synchronize content across multiple IM clients. In other words, any changes made on the iPhone version of the app will immediately be reflected on the company's Windows client and the user's Astra profile. Any contacts users add will also be synchronized with their other clients.

According to Cerulean Studios, all chats are maintained on the server, so they are kept in case of a lost connection. The app will also alert users when they receive an instant message, regardless of whether Trillian for iPhone is open or not. When an IM is received, users will see a dialog box, hear the Trillian IM-notification sound, and be able to start Trillian and reply to the person.

Those interested in using Trillian for iPhone will first need a Trillian Astra account. Luckily, the iPhone app allows users to sign up for Astra from within the app.

(Credit: CNET)

Like I've mentioned here several times before, I'm one of the people who is still using the iPhone 3G. Like many, I'm waiting for my two-year contract to be up so I can get whatever the next-gen iPhone is. It doesn't bother me too much (aside from a few app features that require 3GS), but I do long for the faster processing power and extra features found in the latest iPhone. Especially when it comes to (surprise!) games.

To give you an idea of the difference between the two iPhone processors and how they effect game performance, fellow CNET editor, Josh Lowensohn, put the two iPhone models to the test. In Josh's article, he offers up several side-by-side comparisons of many of the top iPhone games with analysis. If you're an iPhone-gaming fan or just want to see how the processing power matches up between the two models, check out his article.

This week's apps are both games, with the first complete basketball game for the iPhone and a fun sequel to one of the more unique games in the iTunes App Store.

I hope Ellis doesn't pass it to the guy with the green square around him

(Credit: Screenshot by Jason Parker/CNET)

NBA Live ($9.99) is the first fully licensed and complete basketball game for the iPhone and iPod Touch. You can play as any of the 30 NBA teams featuring the actual players and stats. You can play a quick exhibition game, play through an entire season, or just play through the playoffs up to the NBA Championship. The control system includes an onscreen joystick for movement and two buttons that take care of most basketball action (shooting, passing, etc.), but with a clever system for pulling off more advanced moves. The graphics are not on par with what you'll find in the current basketball games on consoles, but for an iPhone game, it looks fairly good and plays well enough to satisfy basketball game fans.

NBA Live packs a lot of features into the game using only a couple of buttons. Advanced moves like cross-over dribbles and hardcore dunks require you touch a button then flick in a direction. Holding down on the pass button brings up icons you can touch to pass to specific players. If you want to go deeper than just running and gunning, you can touch the clipboard icon to call a play and set up an open man for an easy shot. While I'm happy with NBA Live as an iPhone basketball game, I may be spoiled by the smooth experience on console versions. The graphics are pretty good, but not great and the movement can be a bit jerky. Overall, I think it's a pretty good basketball game, but it might be worth waiting a little while to see if it goes on sale. Hardcore fans should get this game.

The simple, hand-drawn graphics are part of what makes this game charming.

(Credit: Screenshot by Jason Parker/CNET)

JellyCar 2 is the sequel to the unique squishy driving-puzzle game, JellyCar. JellyCar 2 expands on the hand-drawn, cartoon puzzle game with several more levels, new game types, and the capability to customize your car and create your own levels. The controls involve touching the screen on either side to go forward and backward and you can tilt your iPhone to right your car when it flips over. Play the game in the Classic Mode to navigate your car through a level to the goal in the least amount of time. You have three skill levels in classic mode with a number of tracks for each level. Long Jump mode lets you drive down a long ramp and use obstacles in the level to project your car the longest distance. The third mode adds a new game entirely, requiring you to direct Tetris-like puzzle pieces to their associated bins--strange sounding, but it's pretty fun with the JellyCar physics in play. Adding to your options for solving puzzles, you can touch the car to "go big" like the original JellyCar. You also get two extra skills you can grab while driving: a balloon that lets you take to the air and one that makes your wheels sticky--each of which you will use at different times to pass levels.

JellyCar 2 also adds a few other features to play with and will amount to a lot of replay value. You can customize your vehicle and wheels with different colors, but you can also choose different vehicles, each with their own physical properties to change how you attack various levels. A new editing mode even lets you create and save your own levels from the ground up. Overall, I think JellyCar 2 is in a class by itself, with a fun, stylistic feel to the game and plenty of challenging levels that are very enjoyable to play.

What's your favorite iPhone app? Do you think NBA Live is worth the price to play? Is JellyCar 2 a worthy sequel to JellyCar? Let me know in the comments!

Apple quietly launched a new preview service this week that makes it easier for users to view its iTunes music library from the browser.

Dubbed iTunes Preview, the new feature allows visitors to view iTunes content from their browser without being forced to launch iTunes. Previously, when a Web user received an iTunes link, they needed to open iTunes to view its content.

As part of the launch, Apple has updated links in iTunes to redirect to iTunes Preview. When a user copies a link in the software and pastes it into the browser, they will be brought to the song's individual listing on Apple's Web site. The feature is especially handy for those who don't use iTunes, since they can now view an individual song without being forced to download the software.

Aside from individual music listings, iTunes Preview also allows users to sift through artists and albums based on genre. Each individual listing displays all the songs in an album, the album art associated with it, its cost, and other content typically found in the iTunes store. The page also includes a link to the iTunes store in case the viewer wants to buy it. That said, there aren't any song previews in iTunes Preview; users will still need to go to iTunes to hear them.

iTunes Preview in action.

(Credit: Screenshot by Don Reisinger/CNET)

For now, iTunes Preview features music. There's no telling if Apple will add more content over time. If you want to check it out, copy an iTunes link from within the software and paste it into your browser.

(Via AppleInsider)

Apple released a security update for its Safari Web browser on Wednesday. Available for Windows and Mac, Safari 4.0.4 plugs what sound like moderate to severe security holes. Unlike competitors Internet Explorer, Firefox, and Chrome, Apple doesn't rate the severity of its security fixes.

The security fixes address a wide range of problem points. On both Windows and Mac, parsing maliciously written XML content could have led to a browser crash, using shortcut menu options within a maliciously created Web site could have led to the disclosure of local information, and visiting a maliciously built Web site could have resulted in unexpected actions on other opened Web sites.

For Windows only, viewing a maliciously made image with an embedded color profile that could lead to a browser crash or running arbitrary code is no longer a threat, nor is accessing a maliciously crafted FTP server, which could have led to an unexpected crash, information disclosure, or arbitrary code execution. For Mac only, an exploit that could have allowed e-mail to remotely load audio and video content when loading a remote image has been disabled.

Although it's good practice to update a program whenever a security fix has been released, more transparency from Apple on the matter would pull the company up to competitors' standards.

Click here to read the full changelog for Safari 4.0.4.

Apple on Monday released a large security update for Mac OS X that fixes dozens of vulnerabilities and provides protection against potential attacks exploiting a weakness in the protocol used to verify that a domain is legitimate.

There are 43 specific issues addressed in the 2009-006 update, released the same day as Mac OS X v.10.6.2.

It plugs a variety of holes for the Mac OS X v10.5.8, 10.6, 10.6.1, and Mac OS X Server v10.6 and 10.6.1, many of which could lead to arbitrary code execution and allow an attacker to take control of a computer.

Several updates affect Apache and QuickTime. Others target AFP Client, Apple Type Services, Core Graphics, CoreMedia, Dictionary, Disk Images, Dovecot, Directory Service, fetch mail, FTP Server, Help Viewer, Kernel, PHP, QuickDraw Manager and Spotlight.

One update fixes a hole in Adaptive Firewall that could allow a brute force or dictionary attack to guess an SSH log-in password, and another update addresses a vulnerability in Login Window that could allow a user to log in to any account without supplying a password.

Several updates address holes that could allow domain spoofing or man-in-the-middle attacks involving SSL (Secure Sockets Layer) used for encrypting data in transit, including a significant weakness in the X.509 protocol for generating SSL connections.

One of the updates affects the libsecurity feature and is billed as a "proactive change to protect users in advance of improved attacks against the MD2 hash algorithm" that could expose users to spoofing and information disclosure.

"There are known cryptographic weaknesses in the MD2 hash algorithm. Further research could allow the creation of X.509 certificates with attacker controlled values that are trusted by the system," the update says. "This could expose X.509 based protocols to spoofing, man in the middle attacks, and information disclosure. While it is not yet considered computationally feasible to mount an attack using these weaknesses, this update disables support for an X.509 certificate with an MD2 hash for any use other than as trusted root certificate."

That major weakness was revealed by security researcher Dan Kaminsky at the Defcon hacker conference in July. Kaminsky was able to trick a Certificate Authority into providing a certificate verifying authenticity for a domain that belonged to someone else.

The updates can be downloaded from Apple's site.

(Credit: CNET)

Is the iPhone finally coming to Verizon? According to an article over at Apple Insider, sources in the Taiwan handset supply chain say Apple has contracted to produce a UMTS/CDMA hybrid iPhone, making it compatible with more networks worldwide. The sources say the move indicates that Apple is specifically targeting Verizon and that we may see Verizon iPhones by the end of next year.

Whenever I talk to anyone about the iPhone, they always say the same thing; they love the device, but wish that AT&T had better coverage. I happen to agree, because even where I work in San Francisco (a supposedly "hot" AT&T zone), I get really bad coverage at my desk and often need to walk to another part of the building to get decent reception. I even have to walk over to a window to send text messages! Maybe these new Verizon rumors will light a fire under AT&T to improve its coverage, because you can bet a lot of people will be jumping ship if Verizon gets the iPhone next year (including me!).

This week's apps include a free app to explore the latest NASA info and a game where you race at high speeds on a cushion of air.

View tons of images from several NASA missions including classic Space Shuttle shots

(Credit: Screenshot by Jason Parker/CNET)

The NASA app (free) gives you all the latest news, images, and video of current space missions from NASA. Get up-to-the minute updates of current missions with this official NASA app and follow the path of your favorite spacecraft. The interface is extremely easy to navigate, with buttons across the bottom for current missions, images, videos, and news updates. The missions screen lets you sort by your particular interest with info and multimedia about the International Space Station; NASA's recently unveiled ship, the Constellation; the Lunar Reconnaissance Orbiter; and several others.

The NASA app is perfect for those interested in science and space exploration with plenty of images and video to get a window into projects NASA is currently working on. The ability to follow current and future missions is particularly interesting because if you hear about a launch, you'll be able to track a ship's progress and follow along with the latest news from the mission. Anyone with an interest in science, space exploration, and current NASA missions should definitely grab this free app. When the next mission comes, you'll have a free tool on your iPhone to follow along as astronauts trace their path across the sky.

Use the pedal on the right to boost when the outer (yellow) meter is filled up

(Credit: Screenshot by Jason Parker/CNET)

Ground Effect ($3.99) is a hovercraft racing game with beautiful 3D graphics and challenging gameplay. Tilt your iPhone or iPod Touch to steer your hover craft and use onscreen controls to accelerate and break. The game is set up with tracks laid out across a ring of islands in a tropical setting. Choose from 10 different styles of hovercraft and race through check points around 14 different tracks you will unlock as you progress. You can race to unlock new tracks or choose Ghost Race to try to go for your best time against a ghost of your previous best lap.

Ground Effect has excellent 3D graphics and a control system that's easy to pick up and play, but difficult to master. Your hovercraft automatically accelerates to it's cruising speed, but you'll need to use the gas pedal to get a momentary boost to push you past opponents. Once the boost meter goes down, you'll need to wait some time before you can initiate another burst. As the game progresses and you race on harder tracks, you'll need to use the brakes at just the right time to quickly navigate sharper turns. Anyone who likes racing games and wants something a little different than the usual auto-racing type of game should check out Ground Effect. Unfortunately, there is no multiplayer option at this time, but a solid Wi-Fi multiplayer might be the thing to make this game truly great.

What's your favorite iPhone app? Are you excited that the iPhone may soon become available on Verizon? What other good science apps have you tried? What do you think of Ground Effect? Let me know in the comments!

Tom and Rafe discuss the apps they put on first thing when they get a new computer.

Listen now: Download today's podcast