News Blog

This week, the PCI Security Standards Council announced the availability of its new Payment Application Data Security Standard (PA-DSS). PA-DSS provides a set of best practices to software vendors for developing secure payment applications that don't store sensitive or private data such as personal identification numbers, and ensure that these applications support standard Payment Card Industry Data Security Standard (PCI DSS) requirements. Once a certification process is established, retailers will be able to purchase applications with a PA-DSS "good housekeeping" seal of approval.

Hmm, what a good idea. Retail companies get the benefit of a third-party audit of their software vendor's code and get to make their selections based on whether a vendor meets the PA-DSS standard. It's great for the retail and financial services industries mandated by PCI, but what about the rest of us poor schmoes? Shouldn't we get the same kind of protection?

Well, maybe we should but it ain't gonna happen anytime soon. My suggestion to CIOs in other industries is caveat emptor. IT executives shouldn't buy any software from any vendor without some type of review of the company's software development process, security testing, and emergency response procedures. What's more, purchasing agreements should hold software vendors' feet to the fire to address security process gaps, fix vulnerabilities within a reasonable time frame, and respond to emergency situations with an appropriate level of urgency. No commitment, no purchase.

Software vendors have always focused their attention on functionality, eschewing security in many cases. For the PCI Security Standards Council, this lack of secure development oversight led to regulations in the form of the PA-DSS. Yes, companies like EMC, Microsoft, and Oracle have embraced secure software development methodologies but we are still buying a lot of vulnerable code from a plethora of vendors.

Since the rest of us don't have the PCI Security Standards Council to protect us, I strongly suggest more vigilant purchasing policies. Most vendors won't improve software security until they realize that this omission will go straight to the top and bottom line.

Jon Oltsik is a senior analyst at the Enterprise Strategy Group.

European antitrust regulators are investigating whether Microsoft abused its desktop software market dominance in its effort to standardize the Office Open XML file formats.

The European Commission's antitrust regulatory body sent queries to several European countries to see how the standards-setting process was working, a spokesperson confirmed on Wednesday.

The investigation is still ongoing, he added.

The effort stems from a complaint lodged by anti-Microsoft lobbying group ECIS (European Commission for Interoperable Systems). The Commission said in January that it is exploring whether the Open XML file formats are sufficiently interoperable with competitors' products.

The Wall Street Journal in February reported that the investigation had started.

In a letter seen by CNET News.com, European regulators queried the national standards body in Norway to gain details into the local standardization process. Specifically, the European Commission sought information on attempts to influence the debate or vote over the standards proposal.

In response, Standards Norway said there was heated debate but not any "inappropriate behavior that endangered our process," according to a document seen by CNET News.com.

Office Open XML (OOXML) is a technical specification that describes the inner workings of how to read and create Microsoft Office documents. In 2005, Microsoft started a process to standardize Open XML in an effort to appeal to government customers who favor standards-based software and improve interoperability with third-party products.

On Wednesday, the International Organization for Standardization (ISO) announced that Open XML received enough for votes for it to be ratified as a standard.

The Commission query to Standards Norway came in February, before the results of the ISO ballot were published. The approval of Open XML reversed a previous attempt in September at standards approval that failed.

There was intense lobbying by Microsoft, IBM, and their partners to influence the international delegates from national standards bodies who participated in the voting.

In some cases, people favorable to Microsoft's pro-Open XML position joined standards bodies late in the process, bringing protests from Microsoft foes.

In addition, there have been reports of irregularities in the run-up to the most recent voting, which ended Saturday.

The head of the committee established to form Norway's position on Open XML wrote a letter to the ISO, complaining that the country's changed yes vote did not represent the views of most committee members.

Standards Norway, however, issued a statement indicating that its position will remain yes.

Microsoft's director of corporate standards, Jason Matusow, said on Tuesday that he expects IBM and its allies will launch "an orchestrated process attack in the hopes of overturning the ratification of Open XML, or at least to discredit what has come out of this long, global process."

In response, an IBM spokesperson on Wednesday said: "As always, the sentiment has to be organic. It will be up to people and organizations in individual countries to decide whether they want to try to appeal this."

Update 3:47 p.m. Pacific: Microsoft's general manager of standards and interoperability Tom Robertson said that Microsoft, too, has been queried as part of the investigation.

He said that Microsoft will "fully cooperate" with any investigation from the Commission.

In response to the accusations of stacking committees, Robertson said that IBM and other competitors have done exactly what Microsoft is accused of doing. For example, an employee from Google, which opposed Open XML standardization, joined the Danish national committee only three days before a vote.

"It seems that one of the main concerns that people have raised about the process is the broad-based participation in the standards body deliberation," he said. "I think it's ironic IBM is complaining about new members in national standards bodies when they have been working around the clock to get people to join."

Clarification: Robertson said that a Google employee joined the Finnish committee but a Microsoft spokesperson said that it was in Denmark. The quote was changed.

Now that Office Open XML (OOXML) has been certified as an ISO standard, there is a possibility that the vote leading to that result will be challenged. It seems Microsoft is already counting on it.

The ISO on Wednesday officially announced that Open XML received enough votes to become a standard, reversing a previous attempt in September that failed.

But there have been several reports of "irregularities" in the voting of the 87 national standards bodies that participated.

Those complaints could lead to a formal appeal of the votes which, under ISO rules, need to be lodged by those countries in the next two months.

Microsoft's director of corporate standards, Jason Matusow, wrote in a blog on Tuesday that challenges to the overall process will likely come. The source? IBM.

"We now see IBM/et al driving an orchestrated process attack in the hopes of overturning the ratification of Open XML, or at least to discredit what has come out of this long, global process," Matusow wrote.

IBM representatives heavily lobbied national standards bodies against approval in the run-up to the vote. But the company itself cannot lodge a formal complaint, a company spokesman said Wednesday.

"As always, the sentiment has to be organic. It will be up to people and organizations in individual countries to decide whether they want to try to appeal this," he said.

Instead, IBM is calling for reform of the standards process and "harmonization" between Open XML and ODF, the OpenDocument Format (ODF), another standardized format.

"While fully cognizant of these current results, I'm energized to take the bigger fight for openness to the next level with the thousands of individuals who are now convinced that the standards system needs fixing, and soon. I hope you'll take part," wrote Bob Sutor, IBM's vice president of open source and standards, who has been a vocal opponent of Open XML standardization.

The case of Norway
On Tuesday, the head of the committee in charge of forming Norway's position on Open XML, Steve Pepper, sent a letter to the ISO complaining that Norway's Yes position did not reflect the views of most participants in that committee.

Standards Norway responded to those criticisms, explaining why Norway changed its vote to Yes even though not all of its issues with the specification were addressed.

The letter from Standards Norway appears to indicate that the country's position will not be changed or suspended during an appeal. An ISO representative on Tuesday said that the ISO had not received a formal protest from its Norwegian delegation, indicating that Pepper's complaint did not represent the country's overall position.

In his blog, Microsoft's Matusow reproduced an English translation of Standards Norway's response to Pepper's complaint as well as letter from Germany's national standards organization.

In Germany, too, there were accusations of improprieties in what was a close vote, but Germany's standards organization said it will not change its Yes position to No or Abstain.

"The steering committee has accepted the process as compliant with the rules with a majority of 7 to 6 and therefore it has seen no reason to lift the decision of the working group. If the majority of the working group would have been convinced that the process of dealing with and voting were noncompliant to the rules then the German vote would have been changed to abstain," according to a translated statement.

The voting record shows that 75 percent of countries voted to approve and 14 percent voted against. To pass, it needed a two-thirds majority and not more than a quarter opposed.

As such, a change in one country's vote would not affect the overall result.

Meanwhile, one of the participants in Standards Norway's Open XML vote, Geir Isene, speculated that the European Union will investigate what happened in that country.

In February, the Wall Street Journal reported that European antitrust regulators were investigating earlier steps in the ISO voting process.

As expected, the ISO on Wednesday announced that Office Open XML (OOXML) has been approved as a standard, marking the end a long and sometimes contentious path.

The Geneva-based International Organization for Standardization (ISO) issued a press release with the details of a vote that showed Open XML receiving 75 percent approval and 14 percent disapproval. It needed two-thirds approval and not more than 25 percent disapproval to pass.

News of the vote results circulated on Tuesday when open-document advocates released a document showing the results. Microsoft confirmed the information later in the day.

The effort to make Open XML an ISO standard did not pass a ballot in September, which precipitated a follow-on Ballot Resolution Meeting in February where, after redundancies were eliminated, over 1,000 issues were considered, according to the ISO.

Following the BRM, delegates from participants had the option of changing their position from No or Abstain to Yes--something that enough did to have the effort pass.

Microsoft originally submitted the Open XML file formats to standards organization Ecma International in 2005. Ecma then proposed the specification to ISO in its Fast Track process, which many considered to be too fast for a complicated specification.

ISO standards status means that software that uses Open XML, notably Microsoft's Office products, will be more attractive to governments and large corporate customers that prefer to purchase ISO-certified goods.

It also means that development of the specification will be done through the ISO, which counts members from over 100 countries. There were 87 countries which participated in the Open XML vote.

Microsoft and other software companies that support Open XML in their products, such as Apple and Novell, are expected to conform to the standard as it changes over time.

The entire endeavor was opposed by many, although certainly not all, open-source advocates who feared that standards status would give Microsoft more market power.

The run-up to the vote was marked by intense lobbying from Microsoft, IBM, and their business partners.

There were reports of what have been called irregularities in the vote which ended Saturday. The head of the committee which formed Standards Norway's position lodged a complaint saying that the yes vote did not reflect the opposition of the majority of the committee.

However, ISO spokesperson Roger Frost on Tuesday said that the organization has not received a complaint from its Norwegian ISO member, referring the matter to Standards Norway.

It's all over except the press release. But in other ways, it's just the beginning.

After a document appeared on Tuesday showing that Office Open XML (OOXML) gained enough votes to be ratified as an ISO standard, Microsoft on Tuesday confirmed the result.

The company's bid--started in 2005--to make the Open XML file formats international standards has succeeded, barring any last-minute changes. The ISO (International Organization for Standardization) is scheduled to issue the official communiqué on Wednesday.

Once final, ISO/IEC certification means that development of the specification, officially called Draft International Standard (DIS) 29500, will be done by members of the ISO, an international organization with representatives from over 100 countries.

On a technical level, changes proposed during the standardization process will need to be incorporated into Open XML, which is now the default document format in Microsoft Office 2007.

In the near term, that means Microsoft, Novell, and other companies that have software that works with the file formats will need to update their products. As the specification evolves in the future, these companies are expected to conform to the changes.

There remains distrust of Microsoft's efforts to promote interoperability between its products and others, including open-source software. But ISO ratification is a significant step towards Microsoft's pledge to support standards, said Peter O'Kelly, an analyst at the Burton Group.

Open XML will now be subject to more scrutiny on a technical level and people can feel less apprehensive about any possible legal entanglements from writing software based on the specification, he said.

"A lot of people continue to believe that Microsoft hasn't changed its modus operandi and the onus is on Microsoft to very clearly demonstrate a track record," O'Kelly said. "It's not like 1998. They really are enlightened about the importance of standards."

Asked what impact the ISO status would give Open XML, standards expert Jan van den Beld who now works for the pro-Microsoft industry group CompTIA, said "not much at the very moment."

Government customers and large corporations that favor certified standards now have a choice, he said. "It certainly is one less barrier to doing business in an environment that otherwise would be difficult," van den Beld said.

Not buying it
But many people committed to standards, including open-source advocates, are certain to be dismayed by the ISO ratification.

A number of national standards bodies voted "no" in the Open XML vote or abstained even after a Ballot Resolution Meeting (BRM) in February, which was meant to resolve technical issues. The tally shows that 75 percent voted to approve with 14 percent voting against.

A representative from Standards Norge, Norway's standards body has lodged a complaint over how the voting was conducted but a reversal to a "no" vote does not look like it will affect the overall result.

IBM executives lobbied heavily against the standards bid, arguing that Open XML was redundant with the OpenDocument Format (ODF) standard, technically flawed, and not sufficiently "open." A spokesperson declined to comment before the official ISO announcement.

A few days before national standards bodies were to submit their votes, the Free Software Foundation issued a legal analysis saying that the legal protections on Open XML were not to be trusted.

Some issues raised in the long-running debate seem intractable.

Microsoft executives and others have said that different "standards" suit different purposes, while others claim that multiple standards for the same purpose is wrong.

The episode has also stirred up intense anti-Microsoft sentiment.

The editor of the ODF specification, Patrick Durusau, lobbied for Open XML ISO approval to improve interoperability with ODF. At one point, he said that businesses opposed to Open XML were operating with "spite as a business strategy."

One of the most common complaints was that Microsoft and Ecma--the standards body that controls the specification--sought ISO status through its accelerated Fast-Track process, which made thorough examination of the 6,000 specification challenging.

Standards expert and ODF advocate Andrew Updegrove predicted on Tuesday that there will be a thorough review of the entire process.

"Clearly some changes need to be made in how the process works, so that the next time such an important and commercially strategic standard is processed, the process works better than this," he said.

Update: Microsoft has confirmed that Office Open XML has been ratified as an ISO standard. See updated information below.

A document that appears to be the voting record over a contentious ISO vote shows Office Open XML (OOXML) having enough support to pass as a standard.

The PDF document appeared on at least two Web sites Tuesday morning.

The results in the document show that Open XML received 75 percent approval from the "P-members" of the International Organization for Standardization (ISO) committee and 10 negative votes, or 14 percent.

To become certified, Open XML needed at least two-thirds of the votes to be "yes" and not more than one-quarter to be "no."

ISO spokesperson Roger Frost on Tuesday said he could not confirm the results.

"We will be issuing our press release on Wednesday," Frost said.

The document correlates with an unofficial tally done by Open Malaysia and standards expert Andrew Updegrove on Sunday, a day after the voting on Open XML closed.

A Microsoft representative declined to comment on the appearance of the unofficial tally, saying that it will wait until an official statement from the ISO.

An international document standards advocacy group called the OpenDoc Society posted what appear to be the official voting record on a mailing list.

In a letter to OpenDoc Society members, board member Michiel Leenaars said the impact of OOXML standardization will have a minimal impact on the adoption of OpenDocument Format (ODF), another document standard favored by most open-source advocates.

OOXML which was submitted by Microsoft to ECMA, and by ECMA to ISO, has literally crawled through the needles eye. After a year of discussion and repairs it still receives the very minimum of support. The BRM (Ballot Resolution Meeting held in February) convinced some yet unconvinced others, and counter votes from large countries like China, India, Brazil, Canada, South Africa and Iran speak volumes. This must be one of the worst results ever for a standard to pass within ISO/JTC1 in years.

Norway on Monday lodged a formal protest over its Yes vote with an eye to reversing it. Standards Norway responded to the complaint to the ISO, saying that it voted for approval to influence future development.

It does not appear as if a change to Norway's vote would affect the overall result.

Update 8:15 a.m. Pacific: ZDNet has posted the document here, which is a Zip file of PDF.

Update 8:44 a.m. Pacific: Microsoft on Tuesday issued a press release confirming the information found in document posted by the OpenDoc Society. Microsoft said that after the end of voting, 86 percent of the 87 countries participating voted to approve Open XML as a standard.

"The input from technical experts, customers and governments around the world has greatly improved the Open XML specification and will make it even more useful to developers and customers. Once it is formally approved, we are committed to supporting this specification in our products, and we will continue to work with standards bodies, governments and the industry to promote greater interoperability and innovation," said Tom Robertson, Microsoft's general manager of standards and interoperability, in a statement.

Norway's national standards body has lodged a formal protest over the country's vote on Office Open XML (OOXML) at the ISO.

The chairman of the Norway's standards committee said there were "serious irregularities" with the voting process and that the vote should be changed to oppose ISO certification of Open XML.

In the letter, sent on Monday to the ISO, Steve Pepper asked that Norway's vote be suspended pending the results of an investigation.

Here is the text of what Pepper wrote in the letter (PDF):

I am writing to you in my capacity as Chairman (of 13 years standing) of the Norwegian mirror committee to ISO/IEC JTC 1/SC 34. I wish to inform you of serious irregularities in connection with the Norwegian vote on ISO/IEC DIS 29500 (Office Open XML) and to lodge a formal protest.

You will have been notified that Norway voted to approve OOXML in this ballot. This decision does not reflect the view of the vast majority of the Norwegian committee, 80% of which was against changing Norway's vote from No with comments to Yes.

Because of this irregularity, a call has been made for an investigation by the Norwegian Ministry of Trade and Industry with a view to changing the vote.

I hereby request that the Norwegian decision be suspended pending the results of this investigation.

Reports of the voting process surfaced on Friday at Computerworld Norge. In a translation of the article at Groklaw, participants said that representatives from Microsoft and Statoilhydro on the Standards Norge committee voted for approval of Open XML. But the other members of the committee were opposed because their comments on the specification were not addressed. Yet the overall vote changed from changed from No to Yes.

The text of Pepper's letter to the ISO was posted by Gere Isene, an IT professional in Norway.

An official announcement from the ISO on whether Open XML received enough votes to pass is expected Wednesday. It's not clear how an appeal to the process from Norway, or potentially other countries, will delay that communication and whether potential changes in votes will affect the decision.

Based on a tally from Open Malaysia and standards expert and advocate Andrew Updegrove, it appeared on Sunday that Open XML had the required voting to pass.

Update 6:57 a.m. Pacific. Microsoft employee Stephen McGibbon posted an English translation of a statement from Standards Norge responding to the criticism of the process. The statement calls for "critically evaluate the Fast-Track procedure at the ISO," the accelerated process for standards submission and consideration.

Regarding the actual vote, the statement reads:

"In the committee there is a clear majority that is opposed to making OOXML into a ISO/IEC standard. Standard Norge must however in its overall assessment also consider the result of the formal hearing, and thus there is a majority of yes votes. There was greater number of end-users of document standard formats among those in favor, than those who were opposed to the standard.

ISO spokesperson Roger Frost on Tuesday said the ISO will have a response to the issue later.

Intel is working on technology that would allow handheld Internet devices to wirelessly use big screens.

All technology is a problem looking for a solution (or the converse). Intel is working on technology that would mitigate one of the inherent problems with ultra-small devices: ultra-small screens. Vic Lortz, a research scientist and senior architect at Intel's Communications Technology Lab in Hillsboro, Ore., discussed a technology that would include a wireless display feature on big-screen digital TVs allowing Mobile Internet Devices, or MIDs, to wirelessly use the display on a big screen.

"Imagine if digital TVs included a wireless display feature (either integrated or through an external adapter) so that a MID could easily use that large display instead of or in addition to the integrated screen of the MID," he writes. "Intel is working on this and other similar problems...As we identify the necessary set of technologies and standards to support, we will integrate them into our next-generation mobile devices (both laptops and MIDs)."

Lortz says the success of the MID may ride on whether technologies like this come to fruition. "If we succeed, the MID may confound its detractors and become the next big thing after all."

The International Organization for Standardization is expected to announce the results of an Open XML vote on Wednesday.

Representatives from 87 countries had until Saturday night to submit their votes on whether the Office Open XML (OOXML) file formats should be certified as ISO standards.

The final tally was expected to be communicated on Monday. But a spokesperson for the ISO told Reuters that it will issue a press release on Wednesday to notify member countries first.

Tallies of official and unofficial sources by two Web sites--one run by standards expert and ODF advocate Andrew Updegrove and the other by open-source advocates at Open Malaysia--indicated that Open XML is expected to be approved.

Microsoft on Monday issued a statement saying that it will not comment on the matter until Wednesday "out of respect for the standards process."