Google, Microsoft Online Apps Raise Security Questions

Google's hosted application suite Microsoft Office Live,

But like the traditional desktop environment, Web applications have security problems. Last week, more than 60 new Web application vulnerabilities were found, according to the SANS Institute's latest @RISK bulletin. Compare that to the number of vulnerabilities found last week in Windows (2), Mac OS (2), and Linux (3), Internet Explorer (2), third party Windows apps (9), or cross-platform apps (16).

"Web applications tend to be written less tightly than other applications," says Alan Paller, director of research for computer security organization at the SANS Institute, though he notes that Google's code review process is probably more rigorous than that of an average online startup. Google's apps are not among those listed in @RISK as being vulnerable.

Douglas Merrill, VP of engineering at Google, acknowledges that the programming methodology for Web apps isn't as mature as the desktop application programming model. "Anytime you have a new piece of technology, you will find more problems with it," he says.

But Merrill also says that the SANS Institute's figures don't exactly represent an apples-to-apples comparison because they don't take into account the amount of time the software has been available. "After something has been out a while, that means you shouldn't be finding as many holes in it because you've found all the early ones," he explains.

Merrill stresses that Google takes security very seriously, both to protect its users and to keep its intellectual property and internal systems—Google's secret sauce, so to speak—safe. In contrast to having a centralized security group review code before it's released, Google uses what Merrill describes as distributed system that enlists every engineer to make programs more secure. That means training every software engineer and Q&A engineer to look for security problems and to practice secure coding, and using common libraries that help avoid common security problems. It also means that code gets reviewed by another engineer whenever it gets checked in, and again during design, implementation, and launch.

"Everyone in the company feels accountability for building secure product because at the end of the day our users are what matters," Merrill says. "And providing good security is good for our users." Many companies make similar claims, though unlike a lot of Web startups, Google has the resources to practice what it preaches.

Microsoft also has considerable resources and since 2002 has been making a concerted effort to improve the security of its applications. It has made many recent security-related acquisitions and hires. Earlier this month, it hired former McAfee virus researcher Vincent Gullotto to serve as Microsoft's general manager of Security Research and Response.

Businesses, of course, worry about security at least as much as software vendors. Matt Glotzbach, head of enterprise products at Google, says people in his group regularly discuss security with business customers.

Among some corporate IT executives, Google's message that online apps aren't necessarily less secure than desktop ones appears to have been heard. Brad Friedman, VP of IT for retailer Burlington Coat Factory, uses Star/Open Office at more than 360 retail locations and says that the security issues for Web-based apps are similar to desktop programs, though different risk mitigation methodologies may be required.

"I would be no more or less likely to consider a Web application like Google's Writely over say Microsoft Word," Friedman writes via e-mail. "The point is that both need to employ a certain level of security surrounding the application that would make it 'less vulnerable.'"

As an example, Friedman observes that Microsoft Word in a desktop environment may be capable of executing macros. "One can turn off macros as a security measure but the prudent backup measure is virus protection on the desktop," he writes. "If it gets past the desktop, enterprise-level protection is the next level that should be enforced. The situation is no different for a Web-based application; it just may have different levels of exposure that need to be taken in consideration."

Others, like Kevin Jaffe, director of corporate systems for Priceline.com, take a more cautious approach even while acknowledging that the software-as-a-service model represents the future. "Our culture from the beginning has always been let somebody else jump out there first," he says.

With Web applications, "you don't have the same concentric circles of deterrent," says Jaffe. "We're not so concerned about, say, certain vulnerabilities within certain Microsoft applications because there're three or four levels of security around this company that you've got to get through to begin with."

And Jaffe believes Web applications are potentially more vulnerable because specialized, application-specific knowledge isn't as necessary. "When you start dealing with Web-based applications, you've lowered the common denominator for the typical hacker," he says.

While there's no such thing as perfect security, companies have to determine for themselves whether the possible benefits of online applications outweigh the risks.

"The advantage of Web apps is they're far easier to patch," says Merrill. "When a problem is in fact found, trying to fix it is never trivial. But it's much simpler to patch a server than it is to patch some large number of clients distributed across some large number of networks."

Paller concurs. "One huge positive is that the patching is going on in real-time," he says, "whereas most of us aren't doing that." And because patching can be such an onerous chore, he believes that many organizations will contemplate ditching PCs altogether in favor of applications delivered through a thin client. Pointing to Citrix Systems' network application delivery platform, he says, "The security guys seem to be supportive of it."

Jaffe contends that the ease of patch management online isn't that significant to organizations like his that have a patch management system in place, but he nonetheless believes that online apps represent the future. "Our feeling is that things will definitely be going in that direction as an industry because it's just easier to support," he says. "And in terms of performance, a lot of the industry is making a push for going back to a terminal-type setup on the desktop."

That may have something to do with why last week Microsoft and Citrix expanded their existing partnership to announce a new joint marketing and development plan.

That's not to say that online apps are any guarantee of secure computing. As the popularity of the software-as-a-service model grows, so too will its problems. Paller predicts an increase in Web apps attacks that attempt to exploit the protocols used by online apps, rather than exploiting holes in the applications themselves, by "piggybacking" on data sent from the Web app to the browser-based client.

But because the desktop model really isn't any better, and is in some ways worse, Paller predicts businesses will overcome their reservations about hosted software. "Security will drive people to centralized applications," he says.

Microsoft's Copilot AI Can Now Compose Songs, Complete With Lyrics

Composing music usually takes years of practice, study, and mastery of theory. But the barrier to entry is getting lower all the time. Following on the heels of Google's AI music generator, Microsoft is rolling out a Copilot AI feature to create songs, complete with written lyrics and singing.

One of the oft-spoken fears about the current AI revolution is that Artificial Intelligence might replace high-skill jobs in creative fields. That concept may have seemed impossible a year ago, but things have changed rapidly. Take music, which is a complex thing to create. Earlier this year, Google rolled out a test AI that can compose short, simple music from a written prompt. The results weren't anything to write home about, especially given the 30-second limitation, but they were still impressive, considering how quickly it worked.

Now, Microsoft is showing off a similar tool. The company is working with Suno, an AI company focusing on music generation. Suno now exists as a plugin for Copilot's online interface, though for the moment, it's limited to the Edge browser. You can head to Copilot, turn on the Suno plugin, and describe a song you'd like to create. You can even download the music or share links directly to the results, as we've done below.

We tried it, and in about 10 seconds flat, Copilot created a 47-second song with written lyrics and a voice singing them. The voice itself is somewhat clear, but you may have trouble understanding some of the singing unless you're reading the lyrics as you listen. Copilot says you can specify song lengths using "long, longer, or longest" in the prompt. We generated a 60-second song with that last option. Oddly, the AI had a suggested prompt to ask questions about the AI songs, like what instruments it used, but then refused to answer.

Microsoft's blog post also didn't answer several important questions. Suno's AI service is available separately and has both free and subscription options. But Suno states in its FAQ that you can only use generated songs commercially on a paid account. Microsoft's blog doesn't mention anything about commercial rights. When we asked Copilot, it provided a somewhat confusing answer:

That's a good question. The songs that I create for you using my internal tools are for personal and non-commercial use only. You cannot use them for any commercial purposes, such as selling, licensing, or monetizing them. ?

Exactly who owns the copyright is always a question with AI-generated content. Suno claims it owns the copyright for any generated content on free accounts, and you own it if you subscribe. But here, Copilot suggests you should "obtain the proper rights and permissions from the original creators...of the songs," when in theory it created the song.

Most AI is trained on existing content, often without creator permission, which has led to questions of copyright and several lawsuits. Google and Microsoft have promised to shield users from such lawsuits. But, it may be best to tread carefully before selling any Copilot-created music.

Microsoft Windows 11 Pro is just $24.97 and makes a great last-minute gift!

TL;DR: Microsoft Windows 11 Pro is the latest Windows OS and includes updated apps and features. Get it instantly to gift for just $24.97 (reg. $199) through December 25!

One minute, you’re enjoying the end of summer, and the next, you realize it’s well into December, and you need to get some holiday gifts. If you are looking to give impressive, useful gifts that won’t break the bank and don’t need weeks to ship, a top OS from a leading brand like Microsoft could do the trick.

This offer gets you (or your giftee!) a lifetime license to Microsoft Windows 11 Pro for only $24.97 (reg. $199) through December 25. And because it’s a digital product, you won’t have to worry about shipping times!

One of the cool things about Windows 11 Pro (4.5-star rated!) is that it’s the most up-to-date OS on the market, and you can download it on up to two devices with this purchase. And because updates are included with Windows 11 Pro, you get the most recent ones, including a new AI assistant called Windows Copilot.

You can call on this assistant to help you perform time-saving tasks like summarizing documents and changing settings. The other latest includes updates to the Microsoft Paint app. Thanks again to AI, access dark mode, improve zooming, and more, you’ll be able to edit out backgrounds.

Enjoy a smoother interface with more advanced security features for business and individual users. BitLocker encryption protects your hard drive’s data, and Smart App Control blocks untrustworthy apps. Other safety features include biometrics login, TPM 2.0, additional antivirus defenses, and much more. 

And if you take advantage of the hybrid work life or travel for business, Windows 11 Pro allows you remote access to your desktop from virtually anywhere in the world. Plus, gamers will benefit from the OS’s offering of DirectX 12 Ultimate, which significantly enhances gaming graphics and maximizes hardware to ensure players get the most out of their gaming experience. 

Here’s your chance to run with the best Microsoft OS out there — or gift it to someone for the holidays — for a fraction of the usual cost. 

Get lifetime access to Microsoft Windows 11 Pro for just $24.97 through December 25 at 11:59 p.m. PT — with instant delivery and download (and no shipping worries!) for the holidays.

Prices subject to change.