No Starch Press, November 2011, 320 pp., $49.95

In a recent survey by Veracode in December 2011 found that more than 80 percent of approximately 10,000 web applications examined failed security testing. This data shows that web applications provide a fertile ground for hackers to launch their malware. Obviously web developers still have some work to do to make their applications secure. The Tangled Web by Michal Zalewski is targeted toward web application developers and security professionals that have a solid understanding of the web and browser operations at an operational level. The author will go into fairly technical details assuming that the reader has the necessary skills to understand the technology discussed.

After an introductory chapter outlining some security fundamentals, the book is split into three parts. The first part covers browser and web technologies. Specific attention is paid to vulnerabilities and how they became to be part of the infrastructure. The second part covers browser security and highlights some of the ways to mitigate the inherent holes in the current technology. The final portion covers some of the new vulnerabilities that are expected to come in the near future. With a couple of exceptions, most chapters are concluded with a security engineering cheat sheet. This gives a summary of the topics covered in the chapter and serves as a guide to implementing some of the technology discussed. It provides a useful quick reference to the books contents after the reader has completed their read through and can be used as a design aid on future projects.

Part One goes into some depth on the various technologies used by browsers, both their inherent operating infrastructure and the services used over the web. Attention is paid to areas of the technology that are open to exploitation. In many cases the author outlines how some of the weaknesses came into being and provides a good view into the difficulty of building this technology. Part One is broken down into chapters that cover the different pieces of the browser function. Both internal processes, HTML and CSS parsing for example, are covered plus external processes, HTML and URL parsing, are reviewed. Two chapters cover additional programming capabilities of the browser i.e. JavaScript and plug-ins.  Throughout this section many examples are given on how the vulnerabilities can be exploited. This gives the reader a better understanding on how a hacker would go about using these weaknesses. In some cases a chapter has a limited discussion of the topic due its wide complexity. The author does include references to other works that cover the topic in greater detail and then focuses on key areas that are relevant to web security.

The first five chapters of Part Two concentrates on browser security mechanisms that attempt to prevent rogue content from interfering with valid, legitimate, content displayed with in the browser. These chapters cover how content isolation is maintained within the operation of the browser. The concepts discussed in part one are used to show how the browser security achieves this. Content from user input and downloaded data are included in this review. Furthermore the impact of scripting and plug-in functionality is discussed in depth to allow the reader to understand how this can impact the overall security of a web application. There are many references to works where researchers have shown example of exploits based on the vulnerabilities in the browser and associated functions. The latter two chapters in this section cover dealing with rogue scripts and extrinsic site privileges.  In general Part Two provides a comprehensive overview of many security flaws in the browser. There are comparisons between the major browsers and how their operation differs with respect to the exploits. Additionally there are also recommendations on how to understand and overcome them.

Part Three looks at some of the changes that may come to fruition in the future. The first chapter covers new and upcoming security standards. They are intended to mitigate some of the problems that plague browsers today. These include, cross domain requests (including a discussion of Cross-Origin Resource Sharing CORS), content security policy CSP, sandboxed frames, strict transport security, private browsing modes, in-browser HTML sanitizers and XSS Filtering. In each case a summary of the goal of the security measure and its current status is given. The second chapter covers new browser developments and how they may impact security. Several new or planned API sets are examined for their intent and current implementation. The final chapter is a synopsis of common web vulnerabilities and how they are defined. Common, simple definitions are used for the various vulnerabilities – e.g. Cross Site Scripting (XSS). For each there is a short description with a reference to the details section of the book.

There is a pivotal statement in Chapter 16 “the dream of inventing a brand-new browser security model is strong within the community, but it is always followed by the realization that it would require rebuilding the entire Web.” This book walks the reader through the inner workings of popular browsers with a focus on showing the weaknesses that are embedded in their very construction. The author does take time to explain how these came about and the attempts to fix them. In part 2 he also gives examples on how to develop web applications so you can navigate around these deficiencies. The security engineering cheat sheets give an easy way to develop a strategy to apply basic security concepts to web application development. The book provides an invaluable reference for anyone working with, testing or deploying web applications.

After having evaluated the obvious parts of the 2.5 version, it’s easy to see why a training video would be a big bonus. In addition to supporting Office 2011 and tapping wireless mics, the software has a voice recognition mode that is worth every minute you’ll put into it. Not that Dictate is useless without the training, but a video that outlines the education process will be a lot smoother than the extensive-but-exhaustive product manual.

If you’ve never used an online dictation product before, there’s no better time to start — considering that the technology is a quantum leap in front of anything during the previous decade.

There’s something about the conversational tone in writing that attracts us. Especially when we want to persuade or sell either an idea or a product. In testing, our writing got simpler and more direct while we dictated.

The new 2.5 version of the product lets you use an iPhone or an iPad to control the software, treating the phone as a wireless mic. You can also make a quick post directly to Facebook or Twitter. It’s as simple as saying “post to Twitter,” although you’ll want to be able to find a way to manage the 140-character limit for Twitter.

That kind of vendor-supplied documentation is fine, to a point. But this kind of training rarely gets as honest as an independent guide to a product. For example, if you look over those videos on the Apple website, you’ll find they’ve got a snappy 2 minutes on buying music via iTunes on the iPad — when what you really need is a primer on how to use iTunes on the Mac or PC to control what’s on your iPad. No such video exists.

No Starch Press has produced a “My New iPad 2” book, written by Wallace Wang, to help. We reached out to a first-time iPad user  who’s running a travel agent business, Ron Wilcox of Seabird Cruises, to tell us how this book stacked up for him. He added, after reviewing it, “now just try to get it out of my hands.”

I’ve often found instruction manuals to be frustrating and confusing.  Many are written with an assumption about the level of understanding that the reader already has about the subject. Online manuals tend to be exasperatingly user-UNfriendly, but manufacturers are so fond of the format that good print manuals are often difficult to find.

However, this manual, for this user, was pretty close to perfect. The index was detailed and complete. As a reference manual, it was quick and easy to locate information specific to a particular function.

Screen shots were clear and plentiful. The step-by-step instructions were very specific and easy to understand. If a set of instructions for a function included part of the instructions for another operation, there was no assumption that the user knew the previously-described operation. All steps were repeated clearly. The instructions for a particular operation didn’t require knowledge of any other operation covered earlier in the book.

Each chapter concluded with a section called “Additional Tips” for using the functions covered in that chapter. While interesting, this section sometimes mentioned a way of using the iPad but failed to explain that particular usage/function or even refer the reader to another source of more specific information.

Wang, the author of the book, has penned several others for No Starch Press on Mac and Apple products. His bio indicates that he’s also had a stand-up comedy career — just the kind of edgy, indie voice that makes a new computer like Apple’s tablet easier to embrace.

The faster, cheaper, cooler-running WD My Book Studio

Stop reading now if disk drives bore you. You might be able to find some articles up here about storage disaster recovery, because if disks make your eyes glaze over, you’re likely to recover from a disaster. Knowing the basics about disks for your Mac is as important as knowing a cholesterol score. A slow score, or a low score for your drive is going to attack the heart of your business: your data.

That’s why I was glad to review the improved model of the Western Digital My Book Studio. I found it faster, running cooler and a better value than a drive I bought at the start of the year.

The price of external drives, which you plug into your Mac, has dropped dramatically since I last bought a drive. Just seven months ago I paid $140 for a Mercury Elite AL Pro 1.5TB drive with two kinds of interfaces, two FireWire 400, and one USB 2.0. The 3TB My Book — twice as much storage — costs $200 at Amazon.com for three kinds of interfaces, two Firewire (either can be used at 400 or 800) plus a USB port. (The wider range of interfaces to plug in, the better. Your more modern Macs are now shipping with fewer ports on them, and it’s good to have non-USB port choices on the back of a drive.)

One of the biggest upgrades to this My Book — I now run a two-year-old 1TB My Book for Time Machine backups — is the new case. It’s morphed from plastic to aluminum, so it stays cooler. Cool means quieter, and this drive is so cool it has no fan. No fan is one less moving part to break down, plus less electricity to purchase.

I ran speed tests against this newest My Book. A massive file transfer that took 6 minutes, 53 seconds on the older My Book completed in 5:37. That’s about 20 percent faster, time that can really add up in an era when big files of 10MB or more — think recorded Skype calls. or the size of your iPhoto Library — have become commonplace.

What would you need a big, honking 3TB drive for? The top use that I can see for most business users is a multiple-year Time Machine backup drive. It took me less than 18 months to fill up that 1TB My Book with TimeMachine backups. After a fill-up, Time Machine starts deleting older backups. Sometimes it does this with nary a warning.

You’d like to have something bigger to delay that day when you avoid the accidental deleting, and so need to swap in a replacement drive. You see, in the old days we used to back up to DVDs or some other plastic, but now most backups go to these external drives. You the stash away the disk hardware like you would DVDs. Elbow room is important on backup disk drives.

Speed is also important, too. Time Machine, which one of the best default backup programs, cranks through a lot of data to pluck out that file or folder you’ll want out of a backup. The faster the drive, the less time you wait. You’ll also see a faster drive taking less time to do a backup. No matter how you set Time Machine, when it backs up there’s a hit on your Mac performance, even if it’s just twice a day.

Western Digital also provides SmartWare backup software for the Studio drive as part of the purchase, but frankly I didn’t find that it delivered any more than most of the drive makers’ backup solutions. The interface is unfamiliar and complex, the speed is no better than Time Machine, Carbon Copy Cloner or SuperDuper. And what you get requires you to use the WD Software for restoring — plus it runs in the background all the time. Not my first choice, even if it says it provides complete backup all day long of everything.

There’s another ding on that WD backup software — the files it creates have odd names, with “@0″ added to each name. This helps the SmartWare find and restore your files. But any backup tool that includes an “uninstall” utility is too deep into my Mac’s file system.

The included software is no deal-breaker while choosing and using the bigger and better My Book Studio. Faster and bigger means you can partition that drive into multiple uses, so it might include a section for the new Lion OS, as well as a slice to do nightly clones onto. I’ve even got a Time Machine section that’s 50 percent larger than the WD My Book that’s almost full now.

Western Digital’s brand has a good heritage and a fine track record for reliability. WD makes many of the internal drives shipping in PCs and laptops today. For $250 you can stop thinking about the need to add drives for several years. Then you can turn your backup focus to the next wave of Web-based storage choices: CrashPlan, DropBox and even Dolly Drive, which can send your TimeMachine backups into the clouds.

Urban Tool’s Pocket Bar is flexible, but my iPad had to ride bareback to fit into the best compartment

The Pocket Bar looks like a good match for the iPad, taller than the tablet but with just about the same width. The bag is woven with a nylon and elastane cloth that has some stretch and a waterproofed quality. Inside there’s a full cotton interior to protect sensitive gear. The main pocket is roomy in its thickness, but it’s mouth is a bit tight on the width of the iPad. Only the most spare of iPad cases can squeeze their way through the zippered opening. I stripped off my ZooGue case and let the tablet ride bareback, for the first time in months, inside the Pocket Bar. It was an easy slip in and out at airport security.

The outside of the case is dotted with pockets that stretch to fit mobile phones, point and shoot cameras, wallets and more. A key lanyard is clipped on the outside, and another key yo-yo is inside another pocket. The array of outside pockets is one of the best features of this bag. I was about to discover another one when I stepped off the BART on Powell Street. It was pouring, a classic February California rain.

I zipped the top of the Pocket Bar tight and re-clipped the adjustable strap across my body on the diagonal. The iPad now rode nearly under my arm, but I had to pinch the zipper flap tight. Though it zips side to side, it doesn’t seal the bag completely, but my tablet stayed dry over the six blocks of gusting that I walked though to the cable car station.

Pockets, pockets, so many useful pockets

I had no use for the removable leg strap that can tie down the bottom of the bag while you’re walking. It works like a holster tie, but I’m not cool enough to pull that look off. You can even attach the strap around your waist, but that creates an odd bounce in your gait if you’re carrying an iPad in the Pocket Bar.

The best part of using the Pocket Bar is its versatility. There’s so much stretch and give in the pockets you can put mobile items and iPods anyplace. I wished for a wider mouth on the main pocket and a fully-enclosed zipper. What’s offered isn’t wide enough for an 8.5 x 11 sheet of paper; maybe the A4 Euro size fits cleaner. I folded some of mine, and tended to use another iPad case in daily meetings. But the bag is lightweight, weather resistant, and its design is subtle. Even considering the cost, this is a special bit of luggage to make your mobile Apple device move easily through your travels.

Best of all, it looks like the Pocket Bar will provide a good fit for Apple’s other mobile gem, the MacBook Air. The Air is about two inches taller than the iPad but the same width. So unlike the iPad, the Air may be an even better fit for the design of Urban Tool’s case. There’s really nothing else like it out there — a sleek new generation of messenger bag slimmed to the size of a tablet or small notebook.

Pogue and his boys review the newest iPad

The only iPad you can buy today is the original generation’s models. Apple sold out its first build of the product in less than a day over the kickoff weekend. Apple built up less than enough inventory to immediately satisfy customers hungry for the iPad 2. Delivery times at 1 AM Pacific were quoted at 2-3 business days, regardless of model. By mid-morning the deliveries were 5-7 business days. Now the orders placed will be fulfilled through Apple’s online store in 3-4 weeks.

That’s right; it means that unless you were up ordering at early morning, the soonest you will receive a new iPad model will be April 1-2. That’s one week after the device goes on sale outside the US. Analyst Gene Munster of Piper Jaffray estimated the company sold 500,000 across retail outlets and Apple’s online stores. The first edition of the tablet sold 300,000 units.

Despite the simultaneous outlets of Best Buy, Walmart, Target and the two phone carriers in the US, nothing was available to purchase one hour after the iPad 2 went on sale in retail settings. The tablets disappeared in 37 minutes at a local Verizon shop here in Austin. The ATT outlet across the parking lot had only four on hand to begin with. At Verizon, they were eager to order one, to arrive in the official monthlong waiting period.

The prices at retail outlets are no better than those at the Apple Stores, and an online order costs the same. Free shipping is part of every order now — but the Apple Store online offers free engraving.

The most fun review that I’ve seen so far comes from the New York Times’ David Pogue, who employs his two young sons in explaining what’s improved while we see the boys goof and cavort and even drop the new iPad. They demonstrate the most sizzling apps on the new device, Garage Band and iMovie. The latter obviously has more business uses than the former. Also mentioned is the new gyroscope, which when developers tap into it, gives app users the chance to observe a product in 3D and manipulate moving parts. Great prospect for an interactive sales catalog.

Wallace Wang's My New iPad from No Starch Press

My New iPad was written by a stand-up comic, but the advice in this thorough book is no joke. The 350 pages of this manual ($24.95 print plus ebook, $19.95 ebook) from No Starch Press don’t overlook a thing in the iPad user experience. It’s a guide to the 1st generation of the iPad, written in Deb. 2010. iPad 2 users can look forward to another edition in May, but this book does include specifics on the recent iOS 4.2 release. Apple rolled out version 4.3 of the iOS today.

The new iPad user can rely on this book like a novice cook reading The Joy of Cooking. The tasks explained, from setting up email accounts to synchronizing contacts, all include a novel What You’ll be Using feature.

For example, to transfer ebooks and audiobooks to the iPad, you’ll need 1. The iPad’s USB cable; 2. iTunes on your computer; 3. The iBooks app. The range of possible ingredients is vast these days for Apple owners, with some software on desktop/laptops, and other programs on iPads. This feature keeps things well-sorted-out. There’s a generous layout that leaves plenty of room for screen shots — very important for new-user books.

Another element that’s extraordinary is the “Additional Ideas” wrap-ups for each chapter. After you’ve learned how to do something like set up and customize an email account, it’s good to see the bigger picture and deploy what you’ve learned to do. Establishing separate accounts for work and home, or customizing your signature, may seem obvious to some. But a user who’s new to the Mail in iPad, coming from a Web-based mail service, can find this deeper dive aspect useful.

If you own an iPad already, this book will provide the training to take it to another level. I’ve learned that every onscreen keyboard key can be held down to reveal its alternative characters. Great for speeding up your typing.

Bookmark management is another insider kind of task you might have overlooked if you already own this device. A lot of this kind of technique is hidden away in the Settings app of the iPad. You’ll feel a lot more comfortable with Settings by using this book.

No Starch (an imprint of the O’Reilly tech publishing empire) has an extensive overview of the book on its site. The table of contents shows a thoughtful and thorough collection of subjects.

Part 1: Basic Training

Chapter 1: Turning Your iPad On and Off
Chapter 2: Charging and Conserving iPad Battery Power
Chapter 3: Using Your iPad’s Physical and Virtual Controls
Chapter 4: Controlling the iPad User Interface
Chapter 5: Using and Customizing the Virtual Keyboard

Part 2: Customizing Your iPad
Chapter 6: Customizing the Home Screen
Chapter 7: Using Parental Controls
Chapter 8: Protecting Your Privacy
Chapter 9: Setting the Date and Time
Chapter 10: Restoring and Resetting Your iPad
Chapter 11: Setting Up an Internet Connection
Chapter 12: Installing (and Uninstalling) Apps

Part 3: Getting on the Internet
Chapter 13: Browsing with Safari
Chapter 14: Using Bookmarks with Safari
Chapter 15: Filling Out Forms Automatically in Safari
Chapter 16: Setting Up and Customizing an Email Account
Chapter 17: Reading, Writing, and Organizing Email

Part 4: Sharing Data with Your iPad
Chapter 18: Transferring Photos, Movies, Music, TV Shows, and Podcasts to Your iPad
Chapter 19: Transferring Ebooks and Audiobooks to Your iPad
Chapter 20: Transferring Contacts, Appointments, Mail, Notes, and Bookmarks
Chapter 21: Transferring iTunes University Courses from a Computer to Your iPad

Part 5: Video, Music, and Ebooks
Chapter 22: Shopping on iTunes and the iBookstore
Chapter 23: Listening to Music and Other Audio Files
Chapter 24: Watching Videos
Chapter 25: Watching YouTube Videos
Chapter 26: Reading Ebooks
Chapter 27: Viewing Photographs
Chapter 28: Using and Sharing Photographs

Part 6: Organizing Yourself
Chapter 29: Jotting Down Notes
Chapter 30: Viewing Contact Information
Chapter 31: Tracking Appointments on a Calendar
Chapter 32: Viewing a Map
Chapter 33: Finding Places and Getting Directions with Maps
Chapter 34: Searching Your iPad with Spotlight

Part 7: Additional Tips
Chapter 35: Updating the iPad Operating System
Chapter 36: Making an iPad Accessible
Chapter 37: Using Foreign Languages
Chapter 38: Transferring and Editing Microsoft Office Documents
Chapter 39: The Best iPad Apps

It’s a little bit of a miracle for this old dog to point my iPhone at a card, snap a picture and then have it Recognize the card and its fields, and slip them into my Contacts app. Often this happened without a shred of extra work on my part. Sometimes I had to make an edit or two. I even had an arty business card that used a very stylized “A” in the middle of the contact’s name. WorldCard Mobile never blinked at the challenge. Mary got her first name plugged in automatically.

There’s features to share cards and contacts over email, and the app files its own “stack” of cards. It also stores the original photo of the card for reference. A very useful feature gives you the ability to take an email signature block and recognize it into the WorldCard database. There’s more editing needed on a signature block than a card, but it saves a lot of work of cutting and pasting, old-style.

There are not a lot of features in World Card Mobile. That decision follows classic app design, to do something really well and not gunk up the rest of the app. At $5.99 it will pay for itself within the first hour you use it on business cards. You gotta figure it will work with the new iPad 2, which will include the product’s first back-facing camera.

Highly recommended. There’s no end in sight to the business card. But using an iPhone or iPad with WorldCard Mobile to put these into a database is a nice upgrade to the old card scanner + software solutions. This is also a great example of how an app for iPhone can beat any desktop Mac application, just by focusing on one good thing.

Share slides and docs via the cloud

There are more clouds than ever to share work through, thanks to the latest version of Quickoffice Connect Mobile Suite. In addition to Google, Dropbox, box.net, and Mobile Me’s iDisk and Web interface, the suite’s been integrated with two additional mobile cloud storage providers, Huddle and SugarSync. And what’s on the way in a new version is support for social publishing partners Slideshare, Scribd and .docstoc.

We’ve used Quickoffice for about six months here as a regular iPad tool. It’s got built-in accommodations for Microsoft’s Office tools, so you can save and trade and edit files for things like Word and Excel. Last year they added Powerpoint support, and at year’s end the Suite gained the ability to edit Powerpoint slides. When I think of the trips where slide edits might have made a difference, if only the right person in the company could get to them, this editing is one of the best arguments for pushing your office work, via these clouds, to the iPad.You will want to be careful of how big that slide set gets, because many wi-fi connections are a lot slower up-bound than downloading. I found that editing was pretty straightforward once I got the hang of double-tapping to select an element in a slide. Powerpoint edits include inserting graphics from your iPad or your shared storage location.

Quickoffice has been polishing the fundamentals of its app for a long time, in iPad years anyway. We plugged in a few external keyboards (Apple’s keyboard dock, the Kensington Bluetooth case and keypad) and were delighted to find Word’s option-arrow navigation available to us. That’s important because selecting a section of text to edit isn’t very intuitive in some iPad writing tools. In Quickoffice you just hold the shift key and use the arrows to pluck whatever text you need.

In Excel spreadsheets — which Quickoffice is careful to call Spreadsheet 2003 or 2007 Format — you have number formatting, bold and italics, row and column insertions, plus a raft of functions already at hand.

Most importantly for any tool that exchanges office documents between iPad and the desktops, the changes arrive intact when opened in the classic Microsoft documents. The work I did for use back at the office with Quickoffice didn’t need the full bore of Office desktop app features. Bare bones is a good description of what kind of Powerpoint slide you can create with Quickoffice. But for the mobile worker who’s armed with a featherlight iPad, Quickoffice hits heavy enough with the right features to make a mark on a to-do list.

Quickoffice Connect is $14.99 out of the App Store. There’s a free podcast with video, 18 minutes’ worth, to show you the app’s paces in iTunes, too.

Keyfolio keypad: An iPad version of a netbook

One of the best additions I’ve made to my iPad this year has been the Kensington Keyfolio keyboard. It’s a Bluetooth keyboard that includes a nice protective, leather case for the iPad. It also adds a stand capability to the iPad, one which works just great to browse the Web from bed in the morning if you’re getting a pre-dawn start on your work day. In a way, this adds the touch interface of the iPad to the concept of a netbook. The weight of the combined keyboard and iPad comes in at 2.75 pounds, so you’re right into the netbook weight category.

The Keyfolio has a great battery saving feature, pulling itself offline when you stop using it for an extended period. It doesn’t need to be resynced often, and you can bypass it by simply switching it off to use the iPad onscreen keyboard.

It’s a great product in the Kensington tradition: well built, lightweight, protects your iPad. Even can be used in a non-keyboard setting (i.e. just a case to use while reading your iPad.) Some say you can’t use it on your lap, but a nice lap desk (think Levenger) makes that possible, too. Big improvement over the on-screen keyboard.

Only the Apple iPad dock has better speed, but it’s not a traveling tool like this one. This keyboard recognizes and includes the cursor arrows, unlike some iPad writing apps whose softkey keyboards do not. I wish there were a shift key on both sides of this keyboard, and the apostrophe key has its own key that’s not in an intuitive place. You type a bit slower at first while using it, but get used to having those keys in unusual places. So far, very happy with this product. In a way, this makes the iPad a great alternative to the new MacBook Air, which at first glance seems like an iPad with an attached keyboard. The Air weighs a little more than the Keyfolio combo, and of course, it’s a full Mac. Just doesn’t have that touch interface, but a lot richer field of applications.

Keyfolio is $69.99 at Amazon today and worth every penny. I bought an Apple Keyboard Dock in the very first month of the iPad’s existence, but the Apple device doesn’t offer a landscape mode like the Keyfolio does. (Keyfolio won’t do portrait, in contrast.) But the Apple keyboard isn’t portable and won’t act as a stand for Netflix movies. There’s a lot to like here.