Google 'experiment' crossbreeds Python with C++

Multi-core coding on the Go








Google has open-sourced an experimental programming language that attempts to crossbreed a dynamic web-happy language like Python with a compiled language like C++.
"There is a growing rebellion against cumbersome type systems like those of Java and C++, pushing people towards dynamically typed languages such as Python and JavaScript, [but] some fundamental concepts such as garbage collection and parallel computation are not well supported by popular systems languages," the company says.
"We believe it's worth trying again with a new language, a concurrent, garbage-collected language with fast compilation."
Dubbed Go, the new language was unveiled today via the Google Open Source blog. "Want to write a server with thousands of communicating threads? Want to spend less time reading blogs while waiting for builds? Feel like whipping up a prototype of your latest idea? Go is the way to go!"
Google says the language is type safe and memory safe, and it's specifically designed for building software that runs on multi-core machines. Systems and servers are written as lightweight processes called goroutines. "Run thousands of goroutines if you want - and say good-bye to stack overflows," Google says.
But more than anything else, Google plays up the speed of the language - at both compile time and run-time. "Typical builds feel instantaneous," the company says. "Even large binaries compile in just a few seconds. And the compiled code runs close to the speed of C. Go lets you move fast."
In a video trumpeting the new language, Googler Russ Cox shows off the Go math package, which includes about 1,000 lines of code across and about 20 files. It builds in about 20 milliseconds, he says, and he can test the package - which involves rebuilding and running - in under a second.

The project's developers include Unix founding father Ken Thompson; fellow Bell Labs Unix developer Rob Pike; and Robert Griesemer, known for his work on the Java HotSpot compiler. They call the language Go because, well, you know. "'Ogle' would be a good name for a Go debugger," the company says.

Microsoft putting Windows 7 onto USB drives -- sort of, almost

Responding to concerns about loading Windows 7 onto netbooks and other computers that don't have DVD drives, Microsoft introduced a tool to load the software onto a USB memory stick.

A netbook can then boot up from the USB stick, initiating the process of upgrading the PC to Windows 7.

The "Windows 7 USB/DVD Download Tool" is used when you buy a downloadable version of the software from Microsoft's online store. During the download process, buyers are given the option of creating a bootable USB stick or burning a DVD.

A number of hobbyist sites have been offering similar software tools for transferring Windows 7 to USB sticks, although it can take a leap of faith to download and use some of them.

In Monday's Windows 7 review I said the easiest option would be if Microsoft sold USB drives preloaded with the software. Reading between the lines of a Windows team blog entry today, it sounds like that may happen soon.

"We're working with partners now to deliver similar tools through their sites and hope to have more news to share in this regard soon," it said.

Wipro sets up global services delivery from China

Indian outsourcer Wipro has set up a global services delivery center in Chengdu in southwest China, targeting customers in the U.S., Europe, and other markets outside the country.

The company already runs a services center in Shanghai with about 300 to 400 staff. The center, set up in 2004, is focused on local customers and on Chinese operations of multinational companies, Suchira Iyer, general manager at Wipro Chengdu, said Thursday.

The move by Wipro to open a global services facility in Chengdu reflects a growing trend for Indian outsourcers to set up global delivery facilities outside India. "The center is part of our strategy to have development centers worldwide, and to use local talent that is available across the world," Iyer said.

Indian outsourcing companies have to become global with the flexibility to offer services from a large number of countries, said Siddharth Pai, a partner at outsourcing consultancy Technology Partners International (TPI) in Houston.

Setting up operations outside India also helps outsourcers offer their customers assurances about business continuity and disaster recovery, analysts said.

The center at Chengdu has 100 staff with plans to increase the number to about 1,000 in a few years, Iyer said. Chengdu offers skilled staff at costs similar to those in India, she added.

The Chengdu center, though predominantly focused on foreign customers, will also address the local market, Iyer said.

Chengdu has a large number of universities, and there is large pool of skilled staff that Wipro hopes to hire, she said. The local government in Chengdu is also actively promoting outsourcing, she added.

The Chengdu center will provide IT and business process outsourcing (BPO) services, Wipro said.

The center will have an initial focus on testing and enterprise application services for the manufacturing, banking, financial services, and insurance industries. It will provide multilingual services in English, Chinese and Japanese, Wipro added.

Race on between hackers, Microsoft over IE zero-day

Game on as bad guys try to make public attack code reliable, say researchers

 Hackers are racing to build reliable exploits to use against a zero-day vulnerability in Internet Explorer (IE), putting pressure on Microsoft to push out a patch before attacks go public, researchers said today.

Yesterday, Microsoft first confirmed that new exploit code could compromise PCs running Internet Explorer 6 (IE6) and Internet Explorer 7 (IE7), then later in the day issued a security advisory that said Windows 2000, Windows XP and Windows Vista users were at risk.

Because the attack code had been publicly posted to a widely-read mailing list, researchers today said that the clock has started.

"This is clearly a critical vulnerability, and as bad as it gets," said Ben Greenbaum, a senior research manager with Symantec's security response team. "It is a race, yes, it certainly is," he added when asked whether hackers and Microsoft are pitted in a drag race.

"Definitely some kind of race," agreed Wolfgang Kandek, the chief technology officer at security company Qualys. "It's a matter of whether Microsoft can fix it first or attackers can get something that works reliably."

According to Kandek, variants of the original attack code have appeared on the Web. "So attackers are already working on [more reliable versions]," he said.

Greenbaum echoed Kandek's take that the original exploit was iffy. "By our tests, the published exploit code only works some of the time against some of the platforms," said Greenbaum. "[Hackers] will have to work on developing a more reliable exploit."

Their job won't be easy, but it can be done without too much difficulty, said Greenbaum, who characterized the creation of a working attack as somewhere between those two poles. "It won't be trivial, but it's not the Holy Grail of computing, either," he said.

In , Microsoft offered up several ways that users could protect their PCs until a patch is available, ranging from turning on the DEP (data execution prevention) security feature in IE6 and IE7, to boosting the browsers' security settings -- something that would block JavaScript. That move had been urged on users by several security companies Monday as a way to stymie any attack based on the original exploit, which relied on JavaScript to hijack a Windows PC.

But Kandek didn't think much of Microsoft's suggestions. "The mitigations are pretty complicated, and they're not very viable for the majority of users," he said. "For consumers, turning this on, turning that off makes the browser useless."

Another option, hinted Microsoft, is to switch to IE8, which doesn't contain the vulnerability. While that's something consumers can consider, and in fact should do, said Kandek, it's difficult or impossible for enterprise workers to swap out the browser supported by their companies. "I can switch to IE8 at home, and home users should do this," Kandek said, "but enterprise users typically cannot."

Microsoft will issue its next regularly-scheduled security updates in two weeks, on Dec. 8, but most researchers aren't expecting the company to pull a patch together that quickly. "I don't think that will happen," said Kandek. "IE is a pretty critical piece of software, and Microsoft will want to test [the patch] thoroughly."

Historically, Microsoft has taken a month or more to deliver a patch for a publicly-disclosed IE vulnerability. On the rare times when Microsoft has issued an "out-of-band" update -- one outside its normal second-Tuesday-of-each-month schedule -- it's done so because in-the-wild attacks were gaining momentum. As of yesterday, Microsoft said it had seen no evidence of attacks using the published exploit code, something Greenbaum said Symantec confirmed.

"But there's definitely activity on this," concluded Kandek. "Attackers are testing the waters to see how well different exploits work."